PNL-751 6

RG, RM, R1, R2

Technical Evaluation Report

Emergency Diesel

Generator Technical

Specifications Study Results

K. R. Hoopingarner

March 1991

Prepared for

Division of Engineering

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

under Contract DE-AC06-76RLO 1830

NRC/RES FIN 2911

Pacific Northwest Laboratory

Operated for the U.S. Department of Energy

by Battelle Memorial Institute

OBattelle

z

o- '-A

Lfl
PNL-7516

RG, RM, RI, R2

TECHNICAL EVALUATION REPORT

EMERGENCY DIESEL GENERATOR TECHNICAL

SPECIFICATIONS STUDY RESULTS

K. R. Hoopingarner

March 1991

Prepared for

the U.S. Nuclear Regulatory Commission

Office of Nuclear Regulatory Research

Division of Engineering

under Contract DE-AC06-76RLO 1830

NRC/RES FIN 2911

Pacific Northwest Laboratory

Richland, Washington 99352
ABSTRACT

The purpose of this report is to review technical specifications for

emergency diesel generators in the context of new information developed in the

Nuclear Plant Aging Research Program and the application of current NRC regulatory concepts and knowledge. Aging and reliability relationships related to

the standard technical specifications are reviewed and supported by data and

published information to ensure that conservative and beneficial specifications are identified. Where technical specifications could adversely

influence aging and reliability, the technical issues and reasonable alternatives are identified for consideration.

This report documents and spans the technical progress from the published

and approved regulatory documents to the current knowledge basis. This

ensures that the technical bases for the technical specifications discussed

are documented and relatively complete subject information is contained in one

document.

-The Pacific Northwest Laboratory (PNL) has participated in the Nuclear

Plant Aging Research (NPAR) Program directed by the Nuclear Regulatory Commission's (NRC) Office of Nuclear Regulatory Research, Division of Engineering.

The NPAR study of emergency diesel generator aging was performed in two

phases. In Phase I, plant operating experience, data, expert opinion and

statistical methods were used to produce a new data base related to aging,

reliability, and operational readiness of nuclear service diesel generators.

Phase II was chiefly concerned with aging mitigation measures.

iii
SUMMARY

The Pacific'Northwest Laboratory (PNL) has been studying the aging of

Emergency Diesel'Generators (EDGs).'for.several years, in support of NRC

research efforts. -Insights have been obtained'indicating many.opportunities

exist.for improved management of.EDG systems including-the influence of

existing technical specifications. Technical specifications could be modified

to yield significant safety-benefits.in the reduction of direct aging effects

and increased.system reliability. .This would support the reliability improvements.proposed in draft.Regulatory.Guide, 1.9, Revision 3, Section. Design.

Oualification. Testing and Reliability of Diesel Generator Units Used as Class

IE Onsite Electric Power Systems Nuclear Power Plants.

Potential technical specification changes that.would ,result in.the most

beneficial engine improvements for aging and reliability results are:

* Significantly reduce the number of total engine 'starts

* Reduce the load application rates for testing purposes and gradually

5add load:to the engine' .

f~~~ ...ad .-to , .. . : . . or 

*. Reduce the EDG testing loads to 90' of the continuous load rating or

'to the plant emergency'unit'load, whichever is less'-

*' Increase the maximum'EDGstartftime to-25'to 30 secondrange .0'second:.t..- . ..5 

* Make necessary changes to support.the reliability emphasis of

Regulatory'Guide 1.9, Revision'3 and delete statistical 'emphasis

* Address fuel oil storage to permit station flexibility and the use

of a larger fraction of stored fuel before replacement

-* 'Eliminate many unnecessary And partially redundant-tests and-engine

starts.in thel 18-month:test.period,:-as 'well ,as those due to false-: . ESF signals.. . .' .

* Eliminate,' where~possible, short.engine.run'timesiand excessive idle :

time. '

-The.technical basis for changes to-the technical,*specifications'to avoid

aging and-improve reliability have-been identified,!'researched and reported by

the NPAR Program, Diesel Generator Task. The Electric Power Research Institute (EPRI) and the Nuclear Safety Analysis Center (NSAC), operated by EPRI,

v
'I

have sponsored research and reported important results applicable to technical

specification improvement. Another major contributor to the technical basis

for potential improvements has been the NRC staff, Nuclear Management

Resources Council, SAIC, and others working on engine reliability issues and

the process of development of Regulatory Guide 1.9, Revision 3. The references for this report document additional technical information sources.

In NSAC/96 which is discussed in Section'4.1 in this report, the Nuclear

Safety Analysis Center in their "NSAC Perspective" introduction cited fast

starts, fast loading and the large number of tests as acting to increase

diesel generator stress and wear. The PNL data confirms this list and adds

excessive testing loads as another important stressor. The important concern

is that these stressors are all imposed on the licensees by current NRC guidelines and technical specifications.

In the NPAR Program emergency diesel generator aging study, the overall

objective was to provide information to assist regulatory organizations and

plant operators to understand the role of aging in emergency 'diesel generators. The study was performed in two phases. Phase I provided general

background material for this report. It defined which diesel generator system

components fail and the causes of the observed failures. The principal

accomplishment of Phase II was to develop information and recommendations to

assist regulatory organizations and plant operators to improve diesel generator reliability and the management of aging. These activities have been

performed with interaction with the NRC staff, industry, and code and standards committees.

The 10 to 12 second starting time followed by very rapid loading imposed

by the typical plant technical specification has many negative technical

safety implications. Recently, the NRC permitted a new, more'realistic,

approach for performing LOCA analyses. Under sponsorship of the Nuclear

Safety Analysis Center (NSAC), studies were performed by General Electric and

Westinghouse to investigate the safety implications of this more realistic

analysis and calculation method for the emergency diesel generator starting

time.

vi
Both studies revealed that considerable relaxation of the current

10-second starting time requirements may,,be possible. The results of the BWR

study.indicated that the start time could be increased to 118 seconds for a

typical BWR/6,without peakfu'el temperatures exceeding the 22000F limit. The

results further show that for a 16000F peak cladding temperature, the'diesel

generator start time can be 70 seconds. The PWR study concluded that a diesel

start delay of,30 seconds was defendable with acceptable'licensing calculitions. Longer delays may-be possible.'

:The-most likely emergencyjelectrical power need for nuclear power plants

is the emergency developed-forilossof offsite ac power (LOOP), but the plant

remains fully-functional otherwise. This isathe chief mission for the Emer-

:gency Diesel Generator-System.- With-over 1000-reactor-years of operating history without a large-break event,-.Loss of;Coolant (LOCA) for primary water

containment and with the recent 10 CFR 50 General Design Criterion 4 (leak-.

before-break) rulemaking, the PNL study results lead to a conclusion that the

true mission envelope for the diesel-generator may be redefined with consequential benefits. The most realistic mission envelop appears to be:

* Reliability - very high, greater than 0.95 for each engine

* Duration - three to four days appears adequate

* Start Time - thirty seconds is an acceptable compromise with conservative margins. If Leak-Before-Break considerations are extended to the EDG

system, a start time of 1 minute should be acceptable.

* Engine Load - The emergency ac electrical load for design should be in the range

of 70 to 90% of the EDG continuous rating.

- For testing, the load should be the emergency ac electrical load or

90% of the continuous rating, whichever is less.

Current NRC guidelines and technical specifications tend to focus on the

hypothetical situation where both LOOP and LOCA events occur. Design considerations, engine purchase specifications, instrumentation logic, and

periodic testing are all intended to mitigate this very rare postulated

vii
accident. Unfortunately, in doing so EDGs are subjected to many conditions

that are harmful to aging and reliability concerns.

This report outlines a comprehensive analysis of the technical factors

that apply to the Standard Technical Specifications and how safety may be

positively influenced by considering certain modifications to these specifications. It attempts to. integrate the EDG mission and reliability requirements

into a balanced regulatory overview process and supply appropriate information

allowing the NRC staff to select technical specifications options to achieve

these goals. Because this document spans the technical progress from published and released regulatory documents to the present knowledge basis, some

NRC current activities are discussed and presented. The purpose of this

approach is to ensure that all applicable information needed for the technical

specification improvement of the diesel generator system is included in this

document.

viii
CONTENTS

ABSTRACT . . . . . . . . . . . . . . . . . . . . . . . iii

SUMMARY . . . ....................... v

1.0 INTRODUCTION . . . . ... . . . . . . . . ... . . . . . . . .. . 1.1

1.1 BACKGROUND . . . . . . . . . . . . . . . . . . . . . . . . . 1.1

2.0 DIESEL GENERATOR TECHNICAL SPECIFICATIONS . . . . . . . . . . . . 2.1

2.1 REVIEW OF PRESENT SPECIFICATION CONTENT . . . . . . . . . . . 2.1

2.2 AGING AND RELIABILITY RELATIONSHIPS . . . . . . . . . . . . . 2.7

2.3 OUTLINE OF POTENTIAL BENEFICIAL CHANGES . . . . . . . . . . . 2.8

3.0 AGING INFORMATION AND APPLICATIONS TO TECHNICAL SPECIFICATIONS . . 3.1

3.1 PHASE I DATA APPLICATIONS .3.1

3.2 PHASE II AGING MITIGATION OPPORTUNITIES . . . . . . . . . . . 3.3

4.0 RELATED STUDIES . . . . . . . . ..... 4.1

4.1 SUMMARY OF BWR DIESEL STARTING TIME STUDY . . . . . . . . . . 4.1

4.2 SUMMARY OF PWR DIESEL STARTING TIME STUDY . . . . . . . . . . 4.2

5.0 DIESEL GENERATOR MISSION ANALYSIS .. 5.1

5.1 LOCA CONSIDERATIONS . . . . . . . . . . . . . . . . . . . . . 5.2

5.2 STATION BLACKOUT CONSIDERATIONS . . . . . . . . . . . . . . . 5.2

5.3 SUMMARY OF MOST LIKELY MISSION RESPONSE NEEDS . . . . . . . . 5.3

6.0 OTHER REGULATORY OPTIONS FOR SAFETY AND CONTROL . . . . . . . . . 6.1

6.1 TECHNICAL SPECIFICATIONS .. 6.2

6.2 REGULATORY GUIDES AND INDUSTRY STANDARDS . . . . . . . . . . 6.2

6.3 PLANT PROCEDURES .6.3

7.0 REFERENCES. . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1

ix
1.0 INTRODUCTION

The Pacific Northwest Laboratory_(PNL) was selected to participate in the

Nuclear PlantAging Research (NPAR) Program by the Nuclear Regulatory Commission's (NRC).Office of Nuclear RegulatoryResearch, Division of Engin'eering.

The NPAR study of Emergency Diesel Generator (EDG) aging was performed in two

phases.- In.Phase I, plant-operating experience, data, expert opin'ion 'and statistical-methods were used.to produce a.new data base related to aging, reli-

* ability, and operational readiness of nuclear service diesel generators.

Phase-II was chiefly concerned with aging mitigation measures. Phase I pro-

,gram results of assessments.6f aging experience have been published

(Hoopingarner etial...1987, Vol. 1 and 2). Methods for testing and aging miti-

*gation (Hoopingarner et al.,1989)-have been published as part of the Phase II

work for the diesel generator task.

The purpose of. this report is to review published technical specifications related to a new proposed management, testing and maintenance'program

foremergency diesel generators that was developed as a product of Phase II.

Aging and reliability relationships to the Standard Technical Specifications

are reviewed and supported by data and published information to ensure that

beneficial specifications are identified. Where technical specifications

could adversely influence aging and reliability, the technical issues and

alternatives are also identified for consideration.

1.1 BACKGROUND - -

The historical approach takenoby NRC for assuring diesel 'generator relia-

-bility-had.the objective of developing statistical data-on the past fast

.starting and loading of the diesel generator.units. This was suipported-by

Standard Technical Specifications, that detailedthe fast starting'and loading

.conditions.to.,be achieved. However, this approach provides no information on

*the long-term degradation of the performance of components and related systems

. which could lead to future failures.and which could be corrected before an

actual failure occurred or before a unit's reliability'was'compromised. The

. 1.1
detection time to statistically determine unacceptable performance deterioration is considered to be excessive for regulatory purposes.

In 1977, Regulatory Guide 1.108 (Rev. 1) was issued and it defined a

routine testing schedule that related the testing frequency to the number of

failures being experienced. This guide requires the diesel generators to be

"fast, cold" started at intervals of at least 31 days. If two failures are

experienced in the last 100 valid tests, then the maximum test interval is

decreased to 14 days. If three failures are experienced in the last 100 valid

starts, the maximum test interval is further decreased to 7 days. Finally, if

four or more failures are experienced in the last 100 valid tests, starting

tests must be performed at least every three days. The requisites for a valid

test are delineated in the guide. The thrust of this requirement was intended

to encourage utilities with diesel generators with high failure rates to make

improvements to avoid the high costs of frequent starting tests.

"Fast, cold" starting refers to plant technical specification requirements that the engine be started within approximately 10 seconds from ambient

conditions and fully loaded in about 60 seconds. The start time and fullload time was not specified in Regulatory Guide 1.108 but was determined from

admittedly conservative fuel cladding temperature calculations defined in

10 CFR 50, Appendix K. These requirements were then made a part of each

plant's technical specifications.

The NRC has recognized the possibility of detrimental effects of the very

testing that was originally meant to assure the diesel generators' reliability. In December of 1983, Generic Letter 83-41 was issued which requested

licensees to provide information related to potential detrimental effects of

"fast, cold" starts. This letter was followed by Generic Letter 84-15 in July

1984 which described changes in requirements to improve diesel generator reliability. This action requested that the licensees take action to reduce

"fast, cold" starting tests and encouraged them to propose technical specification changes. The generic letter also described a goal-oriented reliability

program developed by the staff and invited licensee comments on this program.

In response to these historical conditions, the NRC staff has in addition

acted by the issue of Regulatory Guide 1.155, "Station Blackout" in August,

1.2
1988 which identifies a need for a reliability program. This reliability

program for emergency diesel generators is designed to maintain and monitor

reliability levels selected for compliance with the Station Blackout Rule

10 CFR 50.63 (6/68).

Regulatory Guide 1.9, Revision 3, "Section, Design, Qualification, Testing, and Reliability of Diesel Generator Units Used as Onsite Electric Power

Systems at Nuclear Power Plants" is in the final NRC approval process. It

integrates into a single guide pertinent guidance previously addressed in

Regulatory Guides 1.108, 1.9 Revision 2 and Generic Letter 84-15. Regulatory

Guide 1.108 will be withdrawn after the issue of Regulatory Guide 1.9, Revision 3. The new guide is consistent with industry needs and with the recommendations contained in the NPAR study (Hoopingarner et al. 1989). Many prior

operational and testing practices deleterious to engine reliability and life,

such as cold fast starts, have been deleted from the new guide.

Although the NRC is moving away from frequent fast-starting requirements

and allowing some slower loading testing, the technical specifications for the

majority of U.S. nuclear power stations still define fast, cold starting and

rapid loading for monthly tests of diesel generators. In addition, at the

present time, most stations have not installed the necessary hardware modifications to permit both slower loading and fast-start response of the dieselgenerator system.

The focus of the following sections in this technical evaluation report

will be to review existing and proposed technical specifications and to ensure

that balance and consistency are outlined in the consideration of specification details. The broad intent within the NRC to improve diesel generator

reliability should be supported by Standard Technical Specifications that are

defendable and also tend to reduce aging and reliability effects.

1.3
.. 2.0 DIESEL GENERATOR TECHNICAL SPECIFICATIONS

The NPAR study developed information on the aging of diesel generator

systems and the detailed causes of the observed degradation. It was relatively,easy to develop the relationship between aging and reliability'during

the study,,which is discussed in Section 2.2. It was much more difficult to

obtain the data.and information to link the provisions of standards, guides,

and-the Standard Technical Specifications to aging concerns.

This-section presents:a-,reviewof-the content ofan existing representative-technical specification -andfa.technical evaluation of itby expert

diesel generator consultants. Aging and reliabilityrelationships for presently known aging.influences of selected technical specification provisions

are discussed. This.section concludes with aoutline of potential beneficial

technical changes that avoid or reduce aging stressors. The data'ind study

results more often. indicate..the direction of beneficial changes rather than

confirm numbers or absolute values of.such changes.

2.1 REVIEW OF PRESENT SPECIFICATION CONTENT

Independent EDG experts have assisted the PNL staff during the performance of the Phase I and II NPAR-studies related to diesel-generator aging.

As a result, they were-qualified to'review the'standard technical specifications and make judgments as' to-'the aging influences' ofthe present specification guidelines. - ' '

Three of these consultants were selected to review each current specification requirement and to determine the aging influence-of these requirements. The direction given to the consultants was to 'evaluate each -'

specification item and to make a judgment as to its most likely effect on

known aging factors. The intended resultwas to place each specification

requirement into a positive, negative, or neutral aging category. A positive

category was defined as either preventing'`aging or'detecting EDG deterioration

without known harmful influences or testing conditions. A negative category

would be where rapid wear, agin'g, 'or other deterioration could'be reasonably

projected as a consequence of the specification requirement. A 'neutral

. 2.1
.requirement is one were there is no aging influence on the hardware such as a

requirement to report failures to the NRC, or to have a certain number of EDG

units.

The NRC staff is presently involved in a program to improve the technical

specifications, including those addressing emergency diesel generators. The

technical specification review by the EDG consultants is intended to evaluate

the aging and reliability influence of the present Standard Technical Specifications. Any proposed changes by the NRC staff can then be compared to

existing specifications and the evaluation comments shown below by the consultants. This should give a sound technical basis to the improvement initiative for technical specifications.

For the purpose of this technical evaluation,' the provisions of the ac

portion of the Standard Technical Specifications are similar for all four

common reactor vendor variations. The representative technical specification

selected for review and comment is NUREG-0452, Standard Technical Specifications for Westinghouse Pressurized Water Reactors. Comments are limited to

the Electrical Power Systems and the ac portion of it.

3/4.8.1 A. C. Sources from NUREG-0452

The following outline of the present specification paraphrases the

requirements and lists the chief items cited. After each listing are the

PNL staff and consultants comments. Copies of NUREG-0452 are readily

available for comparison to the latest text.

SPECIFICATION OUTLINE

LIMITING CONDITION FOR OPERATION

3.8.1.1 Minimum'operable ac sources are defined:

a. Two independent offsite circuits

b. Two independent diesel generators.

Comment: These were judged to be neutral for aging. However, the

minimum amount of fuel may have aging and reliability considerations. This is addressed in Section 2.3.

2.2
Action

a. If one' diesel or one offsite circuit'is lost, surveillances

4.8.1.1.1.a and 4.8.1.1.2.a.4 are to be performed within an

hour and each 8 hours thereafter, 72 hour time limit to progressively proceed to mode 3, and mode 4. -

' Comment: Surveillance'4.8.1..a judged to be neutral, surveillance 4.8.1.1.2.a.4 judged to be negative., A fast engine start has

been shown to be harmful (Hoopingarner, et. al. 1989). Even a

slower start'with a prelube-period-has'significant effects on

certain components. All time periods specifiedare aging neutral.

b. If one-diesel-and.one-offsite circuit are lost, surveillances

4.8.1.1.1.a.and 4.8.1.1.2.a.4 are to be performed within an

hour and each'8 hours thereafter, 12-hour time-limit to

progressively proceed tormode-3'and 4.'.

Comment: Same as Action item a.

c. With one diesel inoperable in addition to a or b above:

1. Verify that the remaining diesel and ac driven components

are operable (implies 3 diesels if b is involved, since

both b and c'defirie that an EDG is lost)J -

2. Verify that steam driven auxiliary feed pump is operable.

Two hour time'limit to be in mode 3 and-30 hours

to be in mode 5. - -

Comment: All sections and time periods specified were judged to be

aging neutral. This assumes that verification does not imply actual

operations. ;

d. If two offsite circuits are lost, surveillance 4.8.1.1.2.a.4 is

to be performed (if 3 offsite circuits are available otherwise

the EDGs are'operating;to'prevent-station blackout) 24 hour

time limit.

Comment: Same as action item a, where the plant has three or more

offsite circuits.w Does not apply for two'offsite circuits.

'e. ' If two diesels are inoperable, surveillance 4.8.1.1.1.a is to

be performed within i hour and each-8Shours thereafter, 2 hour

time limit to progressively proceed to modes 3 and 5.

Comment: Surveillance 4.8.1:1.'l.a was judged to be positive. . . , ', '

2.3
SURVEILLANCE REQUIREMENTS

4.8.1.1.1 Each offsite independent circuits shall be:

a. Determined operable by breaker alignment and indicated power,

each 7 days.

Comment: Was judged to be positive, and is an example of nonintrusive monitoring.

b. Demonstrated operable by actual use each 18 months (during

shutdown).

Comment: Was judged to be positive overall, but it would cause some

aging of the breakers. The 18 month period is appropriate to ensure

that the alternate offsite power source will actually deliver power

and that aging failures have not occurred. The frequency, at 18

months, is not enough to wear out the breakers.

4.8.1.1.2 Each diesel generator shall be demonstrated operable by:

a. Table 4.8.1 frequency and a staggered test basis defined.

TABLE 4.8-1. Describes the Test Schedule Frequency Related to the Number of

EDG Failures in the Last 100 Valid Tests

for 0 and 1 failures the test frequency is 31 days

for 2 the test frequency is 14 days

for 3 the test frequency is 7 days

for 4 or more the test frequency is 3 days.

Comment: Test frequencies were judged to be negative. References:

Beard J. T. September 1982, and Hoopingarner et. al. December 1989,

further document the aging influence of too frequent testing.

1. check fuel level in engine day tank

2. check fuel level in storage tanks

3. check fuel transfer pump operation

4. fast start the EDG from ambient condition to rated speed

within 10 to 12 seconds, achieving rated voltage and

frequency.

5. fast load the EDG to greater than or equal to the

continuous rating within the rated time (about 60

seconds), 1 hour operation minimum

2.4
6. check the alignment'of the IE power breakers.

Comment: a.1,2,3-and'6 were judged to be positive. a.4 and 5

were judged to be negative. Fast starting and loading spec-

*ified by a.4and5aswritten-have been recognized by the NRC

and industry as being harmful and need reassessment for

regulatory value.

b. After operation z1 hour and each month checking for and

removing water from engine day tank(s).

Comment: Judged to be positive.

c. Once'per 92 days and fornew'fuel, sample and test the fuel oil

-for water,-sediment,'-'viscosity and impurities.

Comment: Judged to be positive.

d. Once per 18 months during shutdown do the following:

1. inspect the diesel in accordance with procedures and

manufacturer's recommendations

2. check'the EDG capability to reject the largest emergency

single load and maintain voltage and frequency without

exceeding over-speed set points

3. check the EDG capability to reject the entire continuous -load rating without an over-speed trip, maximum voltage

also sPecified -

Comment: Item d.1 was judged to be positive. d.2 and 3 were

judged to be negative as written, but there is a positive

governor checking role for a'modified specification. This is

discussed in Section 2.3.-

4. simulate-loss of'offsite'power and --

a. check'the IE busses for load shedding

b. check for successful EDG fast starting and fast

loading with a-run time of 5 minutes or greater,

voltage and frequency are specified

5. check that with an ESF signal the EDG auto starts with a

fast start. V-oltage, frequency, and maximum time are

specified as'well as a.5 minute run time

6.;with a simulated-loss'of one diesel and offsite power,

check that d.4 specifications are achieved with the

exception no run time is given

2.5
7. with both Loop and ESF signals

a. check for proper load shedding form 1E busses

b. check for fast starting and loading of the EDG while

voltage and frequency are maintained for 5 minutes or

more

c. check that the EDG protective trips are automatically

bypassed. Overspeed and generator differential

current are an exception to the trip bypass

Comment: Items d.4 through 7 were judged to be negative as

written. Tests involved in 4., 5., and 6 were considered to be

unnecessary since specification item 7. appears to check these

same items. Section 2.3 will discuss how the regulatory objectives of these tests can be achieved with fewer actual engine

starts and other desirable changes.

8. check for a successful 24 hour test run with 22 hours

greater than or equal to the continuous load rating and 2

hours at equal to or greater than the 2-hour load rating.

A fast-start is specified along with voltage and frequency. Within 5 minutes of this test perform

4.8.1.1.2.d.7.b (another fast-start) surveillance

Comment: Judged to be negative. This specification, as

written, requires the engine to operate in excess of 13 hours

at the 2-hour rating. This is very harmful and exceeds the

manufacturer's warranty and the Diesel Engine Manufacturing

Association (DEMA) rating schedule. Refer to Section 2.3 for

further discussion of this test specification.

9. check that the emergency loads do not exceed the engine

2000-hour rating

10. check the EDG capability to:

a. synchronize with the offsite sources while loaded with

the emergency power load

b. transfer the emergency power load, and

c. return to standby status

Comment: Items d.9 and 10 appear to be neutral for

They also-appear to be completely unnecessary. The

addresses specification item 9 and item 10 and they

each month since it is the only way to load the EDG

components tested in item 10 are chiefly non-safety

components.

aging.

FSAR

are tested

units. The

related

2.6
11. check that while the EDG is in the test mode, an emergency

signal-causes the EDG to 1) go to standby and 2) the emergency loads are energized by offsite power

12. check that the fuel transfer pump transfers fuel to all

diesels via cross-connection'lines

13. check the accuracy, within 10%o of the load sequencer

intervals

14. check that the EDG-lockouts function for:'

a. turning gear engagement

b. -emergency stops.

Comment: Items'd.11 through 14'were'judged to be positive, at

-least in'the absence of aging effects.

e. Simultaneous EDG engine'fast-starting test verifying rated

speed and time specifications on a 10-year basis or after

significant modifications.

Comment: Judged to be positive on the test frequency basis.

f. :At least once per 10-years: - -

1'. drain and clean'the fuel oil tanks''

2. perform a pressure test of the fuel oil system portion

designed to ASME, Section '3,-subsection NP, at'110% of

-design pressure.:--

Comment: 'Judg'ed to`b'e positive'.

4.8.1.1.3 Reporting requirements are defined.

Comment:, Reporting is neutral for aging and has no influence on the

hardware.

2.2 AGING AND RELIABILITY RELATIONSHIPS ' '' *s '',- s!; '' ' ; - ' ,f_|ig.2 -_i.i

The NPAR diesel generator study was originally intended-to develop data

and information related to aging effects during the-ongoing license period.

This information was then intended,to be used primarily by the NRC to mitigate

aging and assist in formulating any required new regulatory-actions. However, the investigators'wo rkhiror'thte study sodn started getting information

2.7
from NRC and industry sources indicating that standards, regulatory guides,

technical specifications, and plant procedures all contributed to aging in

various ways. The original concept that aging mitigation was primarily

achieved through proper inspection, maintenance, and replacement has now been

expanded to include modified technical specifications, standards, and regulatory guides.

Aging was the focal point of the NPAR study and reliability issues were

chiefly being addressed for the diesel-generators by other groups. This concept worked for studies involving causes and effects of aging. Later when

mitigation of aging was addressed, every useful corrective action proposed

seemed to increase reliability. Looked at another way, if it did not increase

reliability, it was not effective as an aging mitigation measure. The end

result was open cooperation with the staff working on reliability issues and

the use of the NPAR information in the reliability work.

After the linkage between aging and reliability was established and

accepted, the interactions of applicable guides, standards, and the technical

specifications with aging and reliability were studied. Regulatory

Guide 1.108 was often cited by industry groups and individuals as a direct

factor in excessive engine starts and the rapid engine loading leading to

unexpected wear in certain engine components. The NRC staff increasingly

joined in this judgment and conclusion. One end result was the development of

a new draft regulatory guide to remove many of the provisions that induced

aging effects. Draft Regulatory Guide 1.9, Revision 3 is expected to be

released soon as an approved guide.

Many concerns addressed by Draft Regulatory Guide 1.9, Revision 3 can be

only partly resolved by the guide, because of adverse details in current plant

technical specifications. Current industry standards, and the technical

specifications may be revised to complete the improvement envisioned for

diesel generator management.

2.3 OUTLINE OF POTENTIAL BENEFICIAL CHANGES

This section is intended to outline the potential changes in emergency

diesel generator operation that would result in less aging degradation or

2.8
improved reliability. The technical.-bases for these potential improvements

are also presented. The methodology used in this section applies thegeneral

information and data developed in the NPAR diesel generator task to the engine

andgenerator hardware to reduce aging effects. That is, what physical

changes would result in lesswear and deterioration or conversely improved

reliability.

The factors discussed in this section, if implemented, would result in

less aging and-.wear in any'diesel.engine in any normal power production application. These same operational conditions have then been ranked, beginning

with the most important, based upon-data and experience from nuclear plant

emergency diesel generators.. --

Potential ImDrovements

Beneficial changes with the most potential for reducing EDG aging and

increasing reliability are as follows:

I. Significantly re'duce'the number 'of 'engine starts on a monthly or

yearly basis.

2. Reduce the load application rates for testing purposes and gradually

add load over a,'15 minute'period. - ; -- ,

3. Reduce'the EDG'testing loads to 90% 'of the' continuous load rating'or

to the plant emergency unit load, whichever is less.

4. Increase the maximum EDG start time to 25'to' 30 second range for all

engine operation demands.' :

5. Make necessary changes to support the reliability emphasis of Regulatory Guide 1.9, Revision 3 and delete statistical emphasis.

6. -Address fuel oil storageto permitflexibility.and a larger fraction

of-stored fueluse before replacement with new fuel.

'7.2: Many-unnecessary'and partially ;redundant,tests and engine'starts in.

the 18-monthperiod,,could be eliminated, as well as unnecessary

engine starts due to false6-ESF signals. '

_8.-,Eliminate,,where possible,,shortengine run times and excessive'idle

time.' ' ' ,

2.9
-

Technical Basis for Potential ImDrovements

The technical basis for changes to the technical specifications to avoid

aging and improve reliability have been identified, researched, and reported

by the NPAR Program, Diesel Generator Task. The Electric Power Research

Institute (EPRI) and the Nuclear Safety Analysis Center (NSAC) operated by

EPRI also have sponsored research and reported important results applicable to

technical specification improvement. Another major contributor to the technical basis for potential improvements has been the NRC staff and others working on engine reliability issues and the process of development of draft Regulatory Guide 1.9, Revision 3, 'Selection, Design, Qualification, Testing, and

Reliability of Emergency Diesel Generator Units Used as Class lE Onsite Electric Power Systems at Nuclear Power Plants." The references listed include

the research from these sources.

Engine Starts

Reduction of the number of engine starts as a goal has had strong technical support and NRC staff attention for some time (J. T. Beard, 1982). The

French national utility (EDF) has implemented a goal to reduce the average

number of EDG starts from about 60/year in 1985 to 15/year (A. F. Colas,

1988). Draft Regulatory Guide 1.9, Revision 3 provides for some reduction in

the number of starts. The technical specifications may also be structured to

further reduce the average number of engine starts by reducing or eliminating

certain automatic engine starts (i.e., ESF signal) and test starts that partially duplicate other tests.

Starting the engine is a severe aging stressor for certain engine components such as the pistons and cylinder liners. During standby, oil drains

away from the liners and the pistons, especially under warm standby conditions. During startup conditions lasting only seconds, these components may

experience wear exceeding normal running wear rates equal to many hours of

operation. Piston and cylinder liner scuffing are also more likely during

startup conditions. Obviously, neither scuffing or high wear rates add to

engine reliability.

2.10
-Engine Loading Rate

Aging stressors associated with fast loading in response to accident

signals are important. However, because of their frequency, the most important are those associated with the periodic testing mandated by regulations

that simulate the starting and loading sequence that would be encountered,

during an emergency.: Real emergency (unplanned) fast-starts amount to only 2%

of'all starts, and the rest are.tests.(Nuclear-Engineering International,

1987). -Of the unplanned starts, 'only about one-half was.followed by loading.

On the average, there are only'5 incidents -involving loss-of-offsite-power in

the U.S. per year (EPRI 1987). . .. -

Rapid loading of the engines 'without allow ingtime for more normal thermal equilibration 'is very harmful to the engines.'"When the-engine is called

upon to deliverlseveral megawatts of power in less'than 60 seconds, the pistons thermally expand very rapidlyJ"The-cylinder liners are'water cooled and

expand much slower. The cylinder-piston clearance gap-may then be lost causing metal-to-metal contact. This.physical metal-to-metal contact can lead to

piston/cylinder liner scuffing. Later under emergency power conditions, this

scuffed metal.can reach temperatures in the 600-7000F range, which can then

initiate a crankcase explosion (Hoopingarner et al. 1989).

-Reduction of Test Loads

Tihe emergencyidiesel generators are perhaps-the only large components of

'the plant safety'related equipmnnt that are'rbutinely tested at much more than

100% of the emergency requirement's.-The relationship between high loads and

wear is well known for typical piston engine applications.'Engine:manufac-

.'turers-have indicated that aging and.wear.significantly increase-after 95% of

the continuous load -rating is achieved.;" - .

-'The;Diesel !Engine Manufacturers'Association (DEMA) has-defined-a "continuous'rating""'and a "2-hour rating" based on a 10% increaseto theacontinuous

rating. Non-nuclear customers;,'tpic'ally 'as good practice; load'the'engines

to 80 to 90% of the continuous' rating and rarely exceed these'power levels.

2.11
This conservative use experience base, over decades of operation, is the basis

for maintenance practices and the generally excellent reliability reputation

of large diesel engines.

The nuclear industry often, in addition to the DEMA ratings, specifies

special 2000-hour and 168-hour power ratings. Operators at nuclear stations

may not fully understand the full implications of these ratings. The special

engine ratings are intended by the manufacturers to specify the combination of

loads and times which are to be followed by extensive engine disassembly to

inspect for heat effects and unusual wear. It is equally important to note

that these rating numbers are intended to represent the maximum loads and

times in each power range. These two facts are not well known. The safety

implications are that nuclear engines are routinely operated at high power

levels and may unknowingly exceed rating limits and times without inspections

being performed, as intended by the engine manufacturers.

Increase of Start Time

The maximum allowed EDG start time was established based on the emergency

power needs of a coincident loss of offsite power (LOOP) and a loss of coolant

accident (LOCA) plus a very conservative 10 CFR 50, Appendix K calculation of

reactor core thermodynamics. The 10- to 12-second EDG starting time imposed

by the typical plant technical specification is the result. There is no record of an actual LOOP and LOCA coincident event. In addition, the NRC has

reduced the LOCA design applications and reconsidered the core thermodynamics

calculation. Sections 4.0, Related Studies, and 5.1 LOCA Considerations

supply additional details.

The increase of the maximum allowed EDG start time from about 10 seconds

to about 30 seconds appears to be more conservative from the regulatory perspective. There are three benefits for this technical specification change.

First, there is less risk of an overspeed trip and subsequent engine mission

response loss. Second, significant reliability and engine performance

improvements are obtained. Third, less aging and wear occurs.

Following the rapid acceleration to speed, an overspeed condition always

occurs as the governor acts to gain control of the engine rpm. Often the

2.12
result is an engine overspeed trip.and the failure-to support .the intended EDG

function to supply emergency power. Also this overspeed condition results-in

increased stresses in engine and generator components that can accelerate

mechanical wear and loosen generator wiring.

An increase in the permitted starting time should-improve reliability.

To achieve a 10-second start the governor and fuel rack adjustments-are not

ideal for:dependable-running later when the engine is hot. This can lead to

unacceptable surging, speed hunting, and other engine faults.

Support of Reliability Em~hasis'

Draft Regulatory Guide 1.9, Revision 3, currently in the final NRC

release process, has a reliability emphasis rather than a statistical basis

for regulatory guidance. This new guide was'developed with -assistance'and

information from EPRI, NUMARC,:SAIC, NRC,-and-the EDG aging task of the NPAR

Program (Lofgren et al. 1988, -Vol.-1 and 2).- Accelerated-testing, rapidengine loading and certain other practices-have been dropped since it was

determined that such practices could-not be supported (Hoopingarner et al.

1989). The intent of the new guidelines should be incorporated into any

proposed technical specification changes.

Fuel Oil StoraQe

Current technical specificat'iorns require that'about a'seven-day fuel oil

supply be on hand at all times for emergency use. This has important reliability and aging consequences as developed in the NPAR aging study. Briefly,

this rather'large amount of fuel oil ris subject to several aging mechanisms

and the 'current allowed-use of -fuel does -not- permit effective management.

Reliability would be improved if the licensees were permitted to use a larger

fraction 1of the' fuel :before' replacement and they were encouraged to run the

engines for longer time periods and use the oilat a faster rate.uOne change that appears to be reasonable and practical for fuel oil management would allow greater management flexibility without any significant

public risk change. -It is to reduce-the minimum fuel oil supply to about

3-4 days. This is ample for almost any conceivable emergency and allows

enough time to organize additional supplies. A potential supply method,

-2.13
modern heavy-lift helicopters, could supply additional fuel for any additional

emergency duration, and overcome adverse transportation problems.

Particulates and other standards allowed for new fuel are found in Federal Specification VV-F-800, ASTM D975 and other supporting standards. These

specifications for new fuel are applied to fuel in long term storage, without

any exceptions. For typical military applications fuel stored for more than

90 days is considered old fuel. Regulatory Guide 1.137, allows fuel to be

stored for 10 years before cleaning out the tanks. With such long term storage some degradation should be provided for by perhaps allowing color changes,

an increase in particulates (maybe twice or three times new fuel standards),

and adding control of organic contaminants.

Unnecessary and Redundant Testinc

Discussions with EDG consultants and engine manufacturers have provided

information on qualification and periodic engine tests with marginal or nonexistent justification. The NPAR study also documented aging and the lack of

observed benefits for some testing (Hoopingarner et al. 1988 and 1989). Candidates for tests that could be eliminated are:

* The engine hot restart test. This is not a problem area and does

not need to be tested.

* The LOOP and.ESF actuation signal start test is adequate and the

separate LOOP and separate ESF signal start tests are redundant and

provide no additional information.

* 18-month tests involving synchronizer and load transfer equipment

are completely redundant and also test non-safety related functions.

This equipment is used each month in performing the EDG surveillance

testing and thus, it already tested adequately.

* The continuous (full) load rejection test is adequate and the less

severe partial load rejection test is redundant and has almost no

potential of revealing new information or problems that the-full

load test would not reveal.

Engine Run/Idle Time

The NPAR aging study documented results showing that some engine types

are sensitive to running and idle time. Short-run times at full power have

2.14
more aging effects than longer operating periods. Conversely, longer time at

idle is more harmful (Hoopingarner et al. 1988 and 1989).

Helpful changes for reliability would include reducing the requirements

for engine starting followed by a standby period and either the elimination of

5-minute test runs or incorporating such short tests into a longer test

series. A simple change to eliminate the automatic engine start upon an ESF

actuation signal would reduce both short-run and idle-run times since most of

these signals are either false signals or test signals.

2.15
3.0 AGING INFORMATION AND APPLICATIONS-TO TECHNICAL SPECIFICATIONS

In the NPAR Program emergency diesel generator systems were evaluated to

1) determine-which components and subsystems were subject to aging, how they

failed, and with what frequency, 2) determine the adequacy of surveillance,

inspection, and-trending methods, 3) assess the role of maintenance and other

industrial practices in resolving aging effects, and 4) assess the role of

regulatory practices, guides and technical specifications on aging. The overall objective of this study was to provide information to assist regulatory

organizations and plant operators to understand the'role of aging in emergency

diesel generators.

The study to date was performed in two phases. Phase I, which was completed and provided general background material for this report, was concerned

with defining which diesel generator system components fail and the principal

causes of the observed failures. The principal objective of Phase II was to

develop information and recommendations to assist regulatory organizations and

plant operators'in the improvement of diesel generator reliability and the

management of aging influences. This activity has been performed with interaction with the NRC Staff, industry, and code and standards committees.

3.1 PHASE I-DATA APPLICATIONS". '

This technical evaluation report applies the results of the Phase I

,activity of the Diesel Generator Aging Research Program which is reported in

detail in.(Hoopingarner et al. 1987). The principal issues addressed in

Phase I included the following:.

* Observable aging; failures, causes; .and-l6cations,

* important aging stressors including operations 'and regulatory

effects, and

* potential corrective actions and mitigating measures.-

The statistical analysis performed as part 'of thePhase Ieffort resulted

in'the identification of failures and ranking of'the'stressors 'identified'in

Tables'3.1 and 3.2 that can'lead'to"the-failure 'of diesel'generator -

(-3.1
TABLE 3.1. Systems and Components Subject to Aging-Induced Failures

Resulting In Loss of Function of Unit

Percentage of

Systems and Components Aging-Related Failures

Instruments and Control Systems 26

Governor 12

Control Air System 3

Wiring and Terminations 2

Sensors 2

Fuel System 15

Engine Piping 7

Injector Pumps 5

Injectors and Nozzles 2

Starting System 10

Starting Air Valve 5

Controls 2

Starting Motor 2

Cooling System 10

Piping 3

Pumps 2

Heat Exchangers 2

Engine. Structure 9

Crankcase 3

Cylinder Liners 2

Main Bearings 2

Other Systems 30

TABLE 3.2. Causes of Aging-Related Failures that Result in

Loss of Function or Reliability

Percentage of

Failure Cause Aging-Related Failures

Adverse conditions - vibration, shock 32

Poor manufacture or construction quality control 23

Adverse environment - dust, humidity, etc 15

Human error - maintenance, operation 9

Poor design - wrong application or component 7

Other 15

components. Another valuable ranking of these stressors and their relative

importance was obtained from an industry-wide workshop on diesel generator

aging held under the auspices of the NPAR Program (Hoopingarner 1987, Vol. 2).

Attending were representatives of U.S. utilities, vendors, contractors, consultants, and the national laboratories. One of the principal objectives of

3.2
this workshop was to obtain the industry's.perception of issues and problems

regarding nuclear service diesel generators and to identify potential..

solutions. - -:

The workshop attendees identified some'of the same aging stressors as

'found-in the statistical analysis-of1the data base and summarized'in

Table 3;2.; However, they added other stressors and ranked them in a somewhat

different order-of importance as-shown in Table 3.3.. 'This table suggests that

the principal-stressors-leading tojthe-aging of diesel generator components

are environmentally related., The second;-third, and:.fourth most important

stressors weresin order, maintenance practices,.testing -practices, and operating practices. It-was apparentsfrom.the expressed concern about aging

degradation-factors, the workshop participants perceived that deterioration of

diesel -generator systems to be influenced .by their normal loperating environment, including the influence of guidelines -and.other regulatoryrequirements.

3.2 PHASE 1I AGING MITIGATION OPPORTUNITIES

Phase II activities-were-intended to-develop information on aging mitigation and aging;management opportunities -for the diesel-generator-system.

* STABLE 3.3. Workshop-Participant's View of Major Aging Stressors

Rank Maior Stressors -

1. Environmentally induced - dust, water, heat, oil, chemical, etc.

2. ''Maintenance-errors'-'inadequate training, etc.;' i . 3. Fast starts, and other regulatory induced factors -

4. Design inadequacy - wrong.application, or. poor component

5' 'Operation induced: inadequat' traiing and skills

6. Vibration induced--- --- -- , -

7. Fuel or lubricant degeneration

8. Gasket, seal, or organic material degeneration

9. Inadequate spares - quality, storage, ordering problems, data and

specifications

10. Corrosion

11. Thermal stress

12. Manufacturing or quality problems

13. Fatigue not related to vibration

14. Others

! -3.3
This has been done and the results have been published (Hoopingarner et al.

1983 and 1989). Many seminars and presentations have been given, outlining

improvement possibilities and to carry out the technology transfer responsibilities defined in the task plan and requested by the NRC Project Manager.

Fortunately, many improvement possibilities were developed by many individuals

and groups within industry, the NRC staff and the PNL research task.

In NSAC/96 (Muralidharan 1986) discussed in Section 4.1 in this report,

the Nuclear Safety Analysis Center in their "NSAC Perspective" introduction

cited fast starts, fast loading and the large number of tests as acting to

increase diesel generator stress and wear. The PNL data confirms this list

and adds excessive testing loads as another important stressor. The important

concern is that these stressors are all imposed on the licensees by current

NRC guidelines and technical specifications. Fuel oil also ages, but it is

not an engine stressor. However, reliability is affected and it is part of

the specification and minor specification changes would permit better fuel oil

management.

Based upon Phase I results, other input-from the nuclear industry, and

new Phase II research results, it was concluded that significant opportunities

exist for reduction of aging effects and long-term improvement in dieselgenerator system reliability. The key to this improvement in reliability and

reduction in aging effects is 1) the reduction in the fast-starting, fastloading, and heavy-loading stressors imposed by current guidelines and regulations, 2) the implementation of new recommended testing and trending

procedures, and 3) the improvement of certain maintenance practices

(Hoopingarner et'al. 1989). The scope of this technical evaluation report is

limited to the first key improvement recommended.

3.4
4.0 RELATED STUDIES

The 10- to 12-second starting time imposed-by the typical plant Technical

Specification is the result of 10 CFR 50,:Appendix:A,,.requirements which

define a conservative approach to the calculation basis for a large-break loss

of coolant accident (LOCA) with aa'coincident-'loss-of-offsite-power. Recently,

the NRC outlined a new, more realistic, approach for performing LOCA analyses.

Under sponsorship of-the Nuclear.Safety Analysis Center (NSAC), studies were

performed by General Electric (Muralidharan 1986) and Westinghouse (Schwarz

,1988) to investigate~the implications-of this more realistic analysis and calculation method forthe emergency dieselgenerator starting time. Both

studies revealed that considerable relaxation of the current 10-second starting time requirements may be possible.

4.1 SUMMARY OF BWR DIESEL STARTING TIME STUDY

The-results of the BWR study indicated that the start time could be'

increased to 118,seconds.ina typical BWR/6 without the peak fuel temperatures

exceeding the,22000F limit imposed by.l0 CFR.50,'Appendix K, for a combined

LOCA and-loss-of-offsite-power (L00P). .The results further show that for a

16000F peak cladding temperature, the diesel generator start time can be

70 seconds.

Licensees haverbeen.required.to use a set of guidelines established by

the NRC and stated.in Appendix K of 10 CFR 50.' These guidelines have several

built in.arbitrary conservatisms. Recently, the NRC outlined'in SECY-83-472 a

new realistic approach for performing ECCS analysis and gave approval General Electric to use this new approach in their SAFER/GESTR LOCA computer

code. The results were published.in (Muralidharan 1986) "Effect of Diesel. -~~~~~~~~,A - * * *- . . .. - . .- . . .

Start Time on BWR/6 Peak.Cladding Temperature Licensing.Basis Sensitivity'

Calculations." This.,report addresses the sensitivity of peak 'cladding'temperature that is.determined using the realisticLOCA a'naljsis' approach'outlined in SECY-83-472 for various diesel generator start durations.''

SAFER/GESTR is an improved thermal-hydraulic code developed by General

Electric Company and has been approved by the Nuclear Regulatory Commission

4.1
(NRC). Sensitivity/Analyses using this code, were performed to evaluate the

changes in the fuel peak cladding temperature of a typical BWR/6 for various

start-up durations of the Emergency Core Cooling System (ECCS), diesel/

generators, and stroke-times of the associated injection valves.

4.2 SUMMARY OF PWR DIESEL STARTING TIME STUDY

In the PWR study, it was shown that the start time could be increased to

53 seconds in a typical Westinghouse four-loop plant without exceeding the

22000F peak cladding temperature limit. The study further showed that the

diesel start delay time could be increased from 10 seconds to 33 seconds with

only a small increase in the peak cladding temperature (PCT) (from 17060F to

17950F)

The containment cooling effects of relaxed diesel start delay times were

also evaluated in the study using the COCO computer code. When the maximum

allowable diesel start delay times, as defined by the WCOBRA/TRAC large break

LOCA analyses, were used in the containment integrity analyses, it was found

that the peak containment pressure during the transient was well below the

containment design pressure limit. However, the equipment qualification

design envelope may be exceeded which limits the diesel start delay time to

45 seconds.

The Westinghouse study concluded that a diesel start delay of 30 seconds

was defendable with currently accepted licensing calculations. Longer delays

may be possible, but these would require the analysis of additional transients

and improvements in analytical methods, particularly in the area of equipment

qualification. The actual sensitivity of a given PWR design to diesel start

delay time and the application of the results to regulatory and design limits

would vary depending on the particular PWR considered. The reported calculations were done using the Appendix K revision of RCOBRA/TRAC computer code for

a typical Westinghouse 4-loop PWR. The results were published in (Schwarz

1988) "The Effect of Diesel Start Time Delay on Westinghouse PWRs."

4.2
5.0 DIESEL GENERATOR MISSION ANALYSIS

The most likely backup electrical power need for nuclear power plants is

when offsite ac power is lost, but the plant remains fully functional otherwise. This is the key need or mission for the Emergency Diesel Generator

System. It is a single failure type of emergency condition, because a severe

*.winter winter ice storm strm . .... or or, severe ,o.f.s.te winds (tornado) * may .- disable .. both offsite power o. 

sources at the same time.._In this case public safety is ensured if adequate

ac power.from any source is available in about a 5-minute time frame, since

the undamaged plant-is able to cope with an ac power loss for time periods of

lOminutes, or more,,before damage to sensitive components would being.

A much'less likely~emergency.electrical power need.for nuclear power

plants is the emergency developed when both offsite ac power is lost (LOOP

event) and the plant develops a severe breach-of the primary coolant boun-

*dary,.or a LOCA event. Based on Section 4.0 information, ac power is needed

in about 30 or more seconds for.this combination of events. To put this in

perspective, the U.S. nuclear power industry has never experienced'a largebreak loss of coolant event, with a-collective exposure of over 1000 reactoryears of operation. It may be further assumed that after about 8 to 10 hours

after a postulated'LOCA event'starts the plantlwill have'been-cooled down if

'normal power' is available. -'If then a loss of ac6"power occurs, the 'emergency

is essentially over as far as offsite risks to the public are concerned. In

plain language', the risk is esse'ntially non-existent for the combination LOOP

and LOCA events.

It is interesting to observe that in'contrast to the analysis.presented

in' this report, 'that current NRC-guidelines and technical'specifications tend

to ignore the loss of offsite' power event and'focus instead on the hypothetical situation where both LOOP and LOCA events occur together.' Design con-

'siderations ,engine purchase 'specifications,' instrumentation logic; and

periddic'testing are all intende~d to mitigate this' very rare postulated acci-

'dent. ' Unfortunately,' in doing'so EDGs are'subjected to many conditions that

are harmful to aging'and'reliability concerns.''

-. 5.1
5.1 LOCA CONSIDERATIONS

A major change has been made to 10 CFR 50, General Design Criterion 4,

which accepts leak-before-break analysis and detection for all large-diameter

primary system piping. In essence, the LOCA event no longer has to be a

design concern for piping hangers, supports, snubbers and the piping system.

However, this LOCA event design relaxation has not been extended to the emergency diesel generator system, nor to equipment qualification. Therefore the

present EDG system large-break LOCA operating conditions should be retained

for EDG design requirements and qualification purposes. But, as discussed in

the mission analysis and for aging concerns, there is little justification to

continue with the routine testing of EDG equipment for fast-starting and

rapid-loading capabilities associated with the large-break LOCA conditions.

5.2 STATION BLACKOUT CONSIDERATIONS

Diesel generator reliability has always been a concern of the NRC staff

and previous U.S. regulatory administrations. In 1985, Generic Safety

Issue GSI B-56, 'Diesel Reliability" had the highest safety priority in

NUREG-0933, "A Prioritization of Generic Safety Issues."

In response to these historical conditions, the NRC staff has acted by

the issue of Regulatory Guide 1.155, "Station Blackout" in August, 1988 which

identifies a need for a reliability program. This reliability program for

emergency diesel generators is designed to maintain and monitor reliability

levels selected for compliance with the Station Blackout Rule 10 CFR 50.63.

Regulatory-Guide 1.9, Revision 3, "Section, Design, Qualification, Testing, and Reliability of Diesel Generator Units Used as Onsite Electric Power

Systems at Nuclear Power Plants" is in the final NRC approval process. It

integrates into a single guide pertinent guidance previously addressed in Regulatory Guides 1.108, 1.9, Revision 2 and Generic Letter 84-15. Regulatory

Guide 1.108 will be withdrawn after the issue of Regulatory Guide 1.9, Revision 3 which is consistent with industry guidance contained in NUMARC-8700,

Appendix D. These two guides have resolved GSI B-56.

5.2
In Regulatory Guide 1.9, Revision 3 many prior operational and testing

practices that were found to be harmful to engine reliability and life, such

as cold fast starts, have been deleted. The development of this regulatory

guide utilized information obtained through the NPAR Program, Diesel Generator

Task. This same information should be applied to any revision of the plant

Standard Technical Specifications.

5.3 SUMMARY OF MOST LIKELY MISSION RESPONSE NEEDS

With over 1000 reactor years of operation in U.S. regulatory history

without a large-break LOCA event for primary water containment and with the

recent 10 CFR 50 General Design Criterion 4 (leak-before-break) rulemaking, it

may be concluded that the true mission envelope for the diesel-generator may

be considered with consequential benefits. The most realistic mission envelope envisioned from the analysis of the NPAR diesel aging study data is:

* Reliability

--very high, greater than 0.95 for each engine

* Duration

--three to four days appears adequate

* Start Time

--thirty seconds is an acceptable compromise with conservative

margins. If Leak-Before-Break considerations are extended to the

EDG system, within 1 minute.should be acceptable.

* Engine Load

--The emergency ac electrical load for the best practice design

should be in the range of 70 to 90% of the EDG continuous rating.

--For testing the load should be the emergency ac electrical load or

90%e of the continuous rating, whichever is less.

* Start and Load Time --for design and qualification, about 100 seconds (BWRs) --for design and qualification, about 50 seconds (PWRs)

--for routine testing, rapid loading should be avoided (recommended

gradual loading over a time of 5 to 15 minutes or more) --for six months or outage testing, same as design and qualification

time [if General Design Criterion No. 4 (leak-before-break) is

further relaxed to include emergency power, fast-starts may be

eliminated].

5.3
6.0 OTHER REGULATORY OPTIONS FOR SAFETY AND CONTROL

Regulatory bodies have responsibilities to exercise control to ensure

-public-safety. In the nuclear* industry.;regulators have options to exercise

this control by use of various levels of overview. Conceptually, these levels

may be viewed as a pyramid with the plant procedures at the bottom. The next

levels are industry standards and guides, then regulatory guides, and finally

technical specifications at the topof the pyramid. Of course this illustration could include many other types of NRC related documents such as FSARs,

Notices, Bulletins, and.others,-.but these do not seem to.be.true.alternatives

to the type of control information given in technical specifications.

It would be presumptuous for a technical evaluation report to specify

which diesel generator concerns belong ir'i.each'category of procedures, standards, regulatoryoguides, or technical specifications. However, it may be

helpful to apply the insights aid'risk perceptions obtained.in the-diesel

generator research study to indicate which general items belong next to the

top and which are relatively'unimportant'and should'be near the-plant procedures at the bottom.

The general intent of the'imiprovement'pprogram that the NRC is acting on

for the Standard Technical-Specifications is to simplify them and to eliminate

requirements that have no important safety role. The EDG research on diesels

also noted that plant personnel were aware of the increasing difficulties in

making changes that would tend to improve safety, increasingly'a~s'the change

progressed up the pyramid concept discussed above. Plant procedure changes

took effort, but theywere done most often. If.the change affected a technical specification requirement, then it was rarely attempted, even when

safety and reliability benefits may have appeared obvious to the plant personnel. The implication of this observation is'that the NRC staff collectively can effectively increase safety by ensuring that regulatory control is

placed at the right level and it is no higher than necessary.

I . 6.1
6.1 TECHNICAL SPECIFICATIONS

The number of ac sources, their independence, and the limiting conditions

for operations have the utmost importance and these control elements directly

influence public risk. These are obvious illustrations for proper specification control elements. Other items with higher risk significance include the

following:

* Engine load rating (i.e., continuous rating).

* Fuel oil gross tank capacity.

* Needed electrical output parameters, voltage, frequency, etc.

* Reliability category selected i.e., 0.95 or 0.975.

* Desired emergency EDG starting and loading times, electrical loads

and sequence, fuel oil inventory levels, and related parameters.

* Desired EDG test conditions; startup, loading schedule and permitted

prelube and post-test operation schedules.

* The scope of surveillance; daily, monthly, refueling and 10-year

periods.

6.2 REGULATORY GUIDES AND INDUSTRY STANDARDS

Regulatory guides and industry standards are good options for items of

lessor importance, these may include:

* engine qualification and design standards

* important definitions and scope diagrams for the system

* surveillance test details, test descriptions, and guidelines

* reliability improvement practices

. reliability measurement guidelines

* reporting requirements

* descriptions of EDG control logic needs.

6.2
6.3 PLANT PROCEDURES

Plant procedures are subject to rigorous approvals by the plant staff and

are subject to additional NRC overview at the plant, region, and national

levels. Plant procedures should supply the important supporting details for

plant operations, maintenance, testing, and other EDG concerns. Examples of

these control elements are:

* Tests of non-safety related equipment such as EDG frequency

synchronization equipment and load transfer tests.

* Maintenance and test procedures.

* Test parameters for EDG condition monitoring, temperatures,

pressures, and flows.

* Engine lockout, protective trips for plant equipment, and plant

personnel safety concerns.

6.3
7.0 REFERENCES

10 CFR50, Appendix K. :Code of Federal Regulations, Chapter 10, Part 50

Appendix K.; *

'Beard, J. T. September 1982. Recent Operatina Experience with Emergency

Diesel Generators. Presentation to the NRC/ACRS Subcommittee on AC/DC Power

Systems.

Federal Fuel Oil Specification, ;VV-F-800; ASTM D975. 'Standard Specification

for Diesel Fuel Oils.

Hoopingarner, K. R., J.'.W. Vause, D. A. Dingee, J. F.-Nesbitt. 1987.- Aging

of Nuclear Station Diesel Generators: Evaluation of Operating Experience. NUREG/CR-4590, PNL-5832, Vol. 1, prepared by Pacific Northwest Laboratory for

the U.S: Nuclear Regulatory Commission, Washington, D.C. - - -

Hoopingarner,-K. R. and J. W. Vause., ,1987.' iAginciof Nuclear Station'Diesel

Generators: Evaluation of Operating Experience. Workshop. NUREG/CR-4590,

PNL-5832, Vol. 2, prepared by Pacific Northwest Laboratory for'the U.S.

Nuclear Regulatory Commission, Washington,-D.C. '

Hoopingarner, K. R. and F. R. Zaloudek. 1989.' Aqinq Mitiqation-and Improved

Programs for Nuclear-Service Diesel Generators.'-NUREG/CR-5057, PNL-6397,

prepared .by Pacific Northwest:Laboratory for the U.S. Nuclear Regulatory

Commission, Washington, D.C. -

Lofgren, E. V., G. M. DeMoss, J. R. Fragola, P. L. Appignani, G. Delarche,

J. Boccio. 1988. A Reliability Program for Emergencv Diesel Generators at

Nuclear Power Plants. NUREG/CR-5078, SAND87-7176, Vol. 2, Prepared by Science

Applications International Corporation and Sandia National Laboratories for

the U.S. Nuclear Regulatory Commission, Washington, D.C.

Lofgren, E. V., W. Henderson, D. Burghardt, L. Kripps, B. Rothleader. 1988.

A reliability Program for Emergencv Diesel Generators at Nuclear Power Plants.

NUREG/CR-5078, SAND87-7176, Vol. 2, Prepared by Science Applications

International Corporation and Sandia National Laboratories for the U.S.

Nuclear Regulatory Commission, Washington, D.C.

Muralidharan, R. 1986. Effect of Diesel Start Time on BWR/6 Peak Cladding

Temperature-Licensing Basis Sensitivity Calculations. EPRI-NSAC-96, Electric

Power Research Institute, Palo Alto, California.

NRC Generic Letter, 84-15. July 1984. Proposed Staff Actions to Improve and

Maintain Diesel Generator Reliability.

NRC Generic Letter, 83-41. December 1983. Fast Cold Starts of Diesel

Generators.

7.1
NRC Regulatory Guide 1.108 Revision 1. 1977. Periodic Testing of Diesel

Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants.

Nuclear Engineering International. 1988. Improving Diesel Generator

Reliability at French 900 MWe and 1300 MWe PWRs. Colas, A.F. May 1988.

Nuclear Engineering International. 1987. EPRI Finds the Reliability of U.S.

Diesel Generators is Excellent. May 1987, pp. 54-55.

Schwarz, W. R. 1988. The Effect of Diesel Start Time Delay on Westinghouse

PWRs. EPRI-NSAC-130, Electric Power Research Institute, Palo Alto,

California.

U.S. NRC. 1988. Regulatory Guide 1.155: Station Blackout. U.S. Nuclear

Regulatory Commission, Washington, D.C.

U.S. NRC. 1979. Reaulatorv Guide 1.9: Selection, Design, and Qualification

of Diesel-Generator Units Used as Standby (Onsite) Electric Power Systems at

Nuclear Power Plants. Revision 2. U.S. Nuclear Regulatory Commission,

Washington, D.C.

U.S. NRC. Standard Technical Specifications for Westinghouse Pressurized

Water Reactors. NUREG-0452 (Rev. 4).

??PLEASE CHECK MARKENE NUMARC 87-00. Revision 1.. 1990. Guidelines and

Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light

Water Reactors. Appendix D, EDG Reliability Program. Washington, D.C.

7.2
PNL-7516

RG, RM, RI, R2

DISTRIBUTION

No. of

CoDies

OFFSITE

J. P. Vora

U.S. Nuclear.Regulatory

Commission --

MS: NS217B

Washington, DC 20555.

20 J. J. Burns

U.S. Nuclear Regulatory

Commission

MS: NS217B

Washington, DC 20555

A. W. Serkiz

U.S. Nuclear Regulatory

Commission

MS: NLN344

Washington, DC 20555

R. Lobel

U.S. Nuclear Regulatory

Commission

MS: 11E-22

Washington, DC 20555

E. B. Tomlinson

U.S. Nuclear Regulatory

Commission

MS: 11F23

Washington, DC 20555

J. Basile

Manager Special Nuclear.

Projects

Consolidated Edison Co.

Indian Point 2

Broadway and Bleakley Ave.

Buchanan, NY 10511

No. of- -- Copies

J. Ferguson ;

Northeast Utilities

P.O. Box 270

Hartford, CT 06141

I

W. Goelzer

Pacific Gas

P.O. Box 56

Avila Beach,

and Electric

CA 93424

W. B. Henderson -

Trident Engineering

48 Maryland Ave.

Annapolis, MD 21401

A. J; -Henriksen

7731 N. Fairchild Road

Fox Point, WI. 53217

S. S. Kasturi

MOS -;--

25 Piermont Drive

Melville, NY 11747

. -;. S. - Kotowski -.

Virginia Electric &

P.O. Box 402

Mineral, VA ~23117

Power Co.

B. J. Kirkwood

Covenant Engineering

P.O. Box 788

Buena Vista, CO 81211

E. V Lofiren -

SAIC,-G6-1 ,

P.O. Box 1303

McLean, VA 22102

E. Fabri

Bechtel Power Corp.

P.O. Box 3965

San Francisco, CA 94119

P. J. Louzecky

476 Sarsfield Drive

Rochester Hills, MI 48063

Distr.1
PNL-7516

RG, RM, R1, R2

No. of

Conies

No. of

Copies

W. Monroe

Portland General Electric

Company

71760 Columbia River

Highway

Rainier, OR 97048

A. Marion

NUMARC

1776 I St., NM

Suite 300

Washington, DC 20006

ONSITE

50 Pacific Northwest Laboratory

L. R. Dodd

M. D. Freshley

K. R. Hoopingarner (31)

A. B. Johnson, Jr. (10)

W. B. Scott

Publishing Coordination

Technical Report Files (5)

G. Sliter

Nuclear Engineering and

Operations Department

Electric Power Research

Institute

P.O. Box 10412

Palo Alto, CA 94304

J. E. Thomas

Duke Power Company

P.O. Box 33189

422 South Church Street

Charlotte, NC 28242

J. E. Rhoads

Washington Public Power Supply

System

3000 George Washington Way

P.O. Box 968

Richland, WA 99352

H. Wyckoff

Electric Power Research

Institute

3412 Hillview Avenue

P.O. Box 10412

Palo Alto, CA 94304

Distr.2