Issue Date: 05/12/86 - 1 - 9900 STS 4.8.1.1.2

NRC INSPECTION MANUAL ORPB:DI

PART 9900: TECHNICAL GUIDANCE

STS48112.TG

STANDARD TECHNICAL SPECIFICATIONS

SECTION 4.8.1.1.2

A. PURPOSE

To provide the NRC position concerning the surveillance testing of

diesel generator lockout features as provided in an NRR memorandum

dated March 7, 1986.

B. BACKGROUND

By memorandum from Richard W. Starostecki, Director, Division of

Reactor Projects, Region I to Themis Speis, Director, Division of

Safety Review and Oversight, NRR, a request was made that NRR

develop a uniform position on surveillance requirements of the

Technical Specifications concerning diesel generator lockout

features. This request was prompted as a result of questions raised

during a routine resident inspector review of surveillance

procedures at Susquehanna. Susquehanna's Technical Specifications

require verification that the following lockout features prevent

diesel generator starting and/or operation only when required:

1. engine overspeed

2. generator differential

3. engine low lube oil pressure

It was noted that the licensee's surveillance procedures did not

appear to meet the surveillance requirement of the Technical

Specifications (TS). The testing methods are as follows:

1. During the 18 month diesel generator load reject test, the

licensee verifies that the overspeed trip does not actuate on

the speed peak following a 4000 kW load reject.

2. During the 18-month 4kV diesel generator differential relay

calibration, the differential lockout relay is removed, bench

calibrated, and reinstalled. The automatic lockout feature

circuitry is not tested (i.e., repeater relays and contacts)

during the surveillance.
9900 STS 4.8.1.1.2 - 2 - Issue Date: 05/12/86

3. During the 18-month calibration of the diesel generator lube

oil low pressure switches, the pressure switch is calibrated,

but the automatic circuitry is not functionally tested.
Issue Date: 05/12/86 - 3 - 9900 STS 4.8.1.1.2

It also was noted that the licensee's staff believes that the

current calibration procedures are sufficient to meet the intent of

the surveillance requirement. Because the nuclear safety concern

is that the diesel generator (D/G) does not receive a spurious trip

in the emergency mode, the licensee believes the absence of a trip

during testing and the completion of the calibrations noted above

adequately proves that inadvertent emergency trip signals are not

actuated and therefore satisfies the TS surveillance requirement.

The overspeed governors are "periodically" replaced with vendor

(Woodward) calibrated governors. The licensee also believes that

verification that the trips will actuate when a valid malfunction

occurs is important for equipment protection but is not necessary

to ensure plant safety.

Region I stated its belief that the testing is not adequate to meet

the surveillance requirement as written. The testing is not

verifying that the lockout features prevent D/G operation only when

required, but is verifying that the lockout features do not prevent

operation when not required. The region noted that the basis for

the surveillance requirement is indeterminable from the TS.

The region's review of the GE Standard Technical Specifications

(STS) found that this surveillance requirement is left blank. A

check by Region I of three other plants found that the intent of

this requirement has been interpreted differently by other

utilities. Some have listed emergency lockouts, while others have

listed manual lockout features or all diesel generator trips

(test/emergency mode). A comparison of the plants reviewed is

presented in Attachment 1. This comparison by the region was

limited to GE facilities; however, it was suspected that the problem

also exists with the other standardized TS and warrants a more

structured review than the region was able to perform.

C. DISCUSSION

The current STS for each vendor include examples of the types of

lockout features intended for inclusion under Specification

4.8.1.1.2.e.13 (see Attachment 2); these examples are "turning gear

engaged" and "emergency stop." The surveillance requirement is to

verify that the lockout features prevent starting only when

required. Because the lockout features are not normally actuated,

i.e., in a state which prevents starting of a diesel generator, the

intent of the surveillance requirement is to verify that the lockout

features prevent starting of the diesel generator when, in the terms

of the examples cited, the turning gear is engaged or the emergency

stop lockout feature is actuated. The other 18-month surveillance

requirements are performed to verify the starting and loading of the

diesel generators would verify that the identified lockout features

do not prevent starting of the diesel generators when they are not

required, i.e., the lockout feature is not actuated.

With regard to the test method used to demonstrate conformance with

this surveillance requirement, it should demonstrate the operability

of those components which must function to prevent starting of the

D/G that are associated with each lockout feature identified.
9900 STS 4.8.1.1.2 - 4 - Issue Date: 05/12/86

Obviously a test would not attempt to start a diesel generator with

a turning gear engaged because damage to equipment could result if

the lockout feature did not function as required. Instead, the test

would probably be performed in two steps, e.g., first verify that

the lockout relay is activated when the turning gear is engaged and

then verify that the diesel generator will not start when the

lockout relay is activated.

The lockout features identified in the Susquehanna Technical

Specification under Section 4.8.1.1.2.c.13 are noted in Attachment

1 as a) engine overspeed, b) generator differential, and c) engine

lube oil pressure low. With regard to what features should be

included in this specification, the current guidance providing

examples was added to the GE STS in Revision 3. It is clear that

some licensees had proposed and the staff had issued the Technical

Specifications with requirements that differ from the current

guidance on the types of lockout features listed. The fact that

these differences exist is not surprising because the earlier STS

versions did not provide guidance on the type of lockout features

intended. However, when the Technical Specifications are issued,

the requirements exist and conformance to these requirements is

required. Conformance to TS requirements is not subject to

interpretations with regard to intent by subsequent change to the

STS. Thus, in this case, the lockout features indicated in the

Susquehanna TS are those which must be addressed and tested in

conformance to the stated requirements.

Based on the description of the licensee's tests noted above, the

NRR staff agrees with Region I that these tests do not satisfy the

intent of the surveillance requirements because they do not fully

demonstrate that these features prevent starting and/or operation

when required. The description of the licensee's test procedure on

the engine overspeed trip is not directly responsive to the

specification in question since it is a requirement of Specification

4.8.1.1.2.d.3 (load rejection without overspeed trip). The fact

that the overspeed governors are periodically replaced with

vendor-calibrated governors would appear to be adequate to address

their operability under the assumption that the frequency of such

action is performed in accordance with the manufacturer's recommendation and in the absence of any other practical method to verify

the operability of the overspeed trip. (Note: It is assumed that

the overspeed trip function is an integral part of the overspeed

governor and is not a separate component.) The licensee's test for

"generator differential" and "engine low lube oil pressure" verifies

that these components are operable. However, these tests are not

sufficient to satisfy the surveillance requirements, which would

require that the next step should be to simulate the actuation of

these components and to verify that the balance of the circuits

associated with these lockout features will in fact prevent starting

the diesel generator. The omission of this step in the test

procedures results in a failure to satisfy the surveillance

requirement.

The licensee's position that verification that the trips will

actuate when a valid malfunction occurs is important for equipment

protection but not necessary to ensure plant safety, is an argument
Issue Date: 05/12/86 - 5 - 9900 STS 4.8.1.1.2

which could be made for a change in the TS requirements. However

it is not acceptable as a basis to disregard an existing TS which

is explicit in its requirements. The tests should be performed as

noted above.

With regard to the broader aspects of what types of tests should be

included in the diesel generator surveillance requirements, it is

clear that the current guidance in the STS does not address all

lockout, trip or other features which are included in the design of

the system. As a minimum, the objective of TS surveillance

requirements should be that all features which are considered to be

essential to ensure plant safety are included. As an example, the

current STS guidance on lockout features addresses features which

are not considered to be essential for satisfying the design basis

of the diesel generators. These features are associated with

equipment or personnel protection. The same is true for those trip

features which are bypassed on emergency start signals. It is

important that testing verifies that these features do not preclude

the capability of the diesel generators to satisfy its safety

function, however; this objective is met by the present start and

loading surveillance requirements. It is not essential that the TS

include testing of those features that are not essential to ensure

plant safety. Good practice should be the basis for licensees to

test these features in the absence of a TS requirement.

D. CONCLUSION

The resolution of the problem of different TS requirements such as

those noted in Attachment 1 is a matter which will be addressed as

a part of the ongoing NRC Technical Specifications Improvement

Program to implement improvements to the STS and their basis.

However, the differences in TS requirements that presently exist do

not require additional action at this time because they do not

involve tests of functions which are essential to ensure plant

safety. For plants such as Susquehanna, the TS requirements should

be met as they are stated or the requirements are changed by a

license amendment.

F. REFERENCE

The guidance provided in this directive was extracted from a

memorandum from William T. Russell, Director, Division of Human

Factors Technology, NRR to Richard W. Starostecki, Director,

Division of Reactor Projects, Region I, dated March 7, 1986,

subject: Technical Specification Interpretation Concerning

Surveillance Testing Methods For Diesel Generator Lock Out Features.

The complete memorandum and enclosure have been placed in the

Document Control System.

END

Attachments
Issue Date: 05/12/86 E-1 9900 STS 4.8.1.1.2 Attachment 1

ATTACHMENT 1

TECHNICAL SPECIFICATION COMPARISONS

NUREG-0123, Rev. 2

STS for GE BWR

TS 4.8.1.1.2.c.14

Verifying that the following diesel generator lockout features

prevent diesel generator starting only when required:

a) ___________________________

b) ___________________________

Susquehanna Units 1 & 2

TS 4.8.1.1.2.d.13

Verifying that the following diesel generator lockout features

prevent diesel generator starting and/or operations only when

required:

a) Engine overspeed

b) Generator differential

c) Engine low lube oil pressure

Limerick

TS 4.8.1.1.2.e.13

Verifying that the following diesel generator lockout features

prevent diesel generator starting only when required:

a) Control Room Switch In Pull-To-Lock (With Local/Remote Switch

in Remote)

b) Local/Remote Switch in Local

c) Emergency Stop

LaSalle Unit 2

TS 4.8.1.1.2.d.13

Verifying that the following diesel generator lockout features

prevent diesel generator operation only when required:

a) Generator underfrequency

b) Low lube oil pressure
9900 STS 4.8.1.1.2 Attachment 1 E-2 Issue Date: 05/12/86

c) High jacket cooling temperature

d) Generator reverse power

e) Generator overcurrent

f) Generator loss of field

g) Engine cranking lockout

Hope Creek (Proof and Review)

TS 4.8.1.1.2.h.14

Verifying that the following diesel generator lockout features

prevent diesel generator starting only when required:

a) Engine Overspeed, generator differential, and low lube oil

pressure (regular lockout relay, (1) 86R)

b) Backup generator differential and generator overcurrent

(Backup lockout relay, (1) 86B)

c) Generator ground and lockout relays - regular, backup and test

energized (breaker failure lockout relay, (1) 86F)

END
* If Specification 4.8.1.1.2e.6(b) is not satisfactorily completed, it is not necessary to repeat the

preceding 24-hour test. Instead, the diesel generator may be operated at [continuous rating]

kW for 1 hour or until operating temperature has stabilized.

W-STS 3/4 8-6

Issue Date: 05/12/86 E-3 9900 STS 4.8.1.1.2 Attachment 2

ATTACHMENT 2

(THIS IS A PAGE FROM A WESTINGHOUSE STANDARD TECHNICAL SPECIFICATION)

STANDARD TECHNICAL SPECIFICATIONS

ELECTRICAL POWER SYSTEMS

SURVEILLANCE REQUIREMENTS (Continued)

frequency shall be maintained within these limits during

this test. Within 5 minutes after completing this

24-hour test, perform specification 4.8.1.1.2e.6(b),*

8) Verifying that the auto-connected leads to each diesel

generator do not exceed the 2000-hour rating of ___ kW;

9) Verifying the diesel generator's capability to:

a) Synchronize with the offsite power source while the

generator is loaded with its emergency loads upon a

simulated restoration of offsite power.

b) Transfer its loads to the offsite power source, and

c) Be restored to its standby status.

10) Verifying that with the diesel generator operating in a

test mode connected to its bus, a simulated Safety Injection

signal overrides the test mode by: (1) returning the diesel

generator to standby operation' and (2) automatically

energizing the emergency loads with offsite power;

11) Verifying that the fuel transfer pump transfers fuel from

each fuel storage tank to the day and engine-mounted tank of

each diesel via the installed cross-connection lines;

12) Verifying that the automatic load sequence timer is

OPERABLE with the interval between each load block within

± 10% of its design interval;

13) Verifying the following diesel generator lockout features

prevent diesel generator starting only when required:

a) [Turning Gear engaged], or
9900 STS 4.8.1.1.2 Attachment 2 E-4 Issue Date: 05/12/86

b) [Emergency stop].

14) Verifying that with all diesel generator air start

receivers pressurized to less than or equal to ___ psig

and the compressors secured, the diesel generator starts

at least [5] times from ambient conditions and accelerates to at least [900] rpm in less than or equal to [10]

seconds.

END