ont>. Yahoo! is not affiliated with the authors of this page or responsible for its content.
NRC INSPECTION MANUAL
Issue Date: 05/12/86
- 1 -
9900 STS 4.8.1.1.2
NRC INSPECTION MANUAL
ORPB:DI
PART 9900: TECHNICAL GUIDANCE
STS48112.TG
STANDARD TECHNICAL SPECIFICATIONS
SECTION 4.8.1.1.2
A.
PURPOSE
To provide the NRC position concerning the surveillance testing of
diesel generator lockout features as provided in an NRR memorandum
dated March 7, 1986.
B.
BACKGROUND
By memorandum from Richard W. Starostecki, Director, Division of
Reactor Projects, Region I to Themis Speis, Director, Division of
Safety Review and Oversight, NRR, a request was made that NRR
develop a uniform position on surveillance requirements of the
Technical Specifications concerning diesel generator lockout
features. This request was prompted as a result of questions raised
during a routine resident inspector review of surveillance
procedures at Susquehanna. Susquehanna's Technical Specifications
require verification that the following lockout features prevent
diesel generator starting and/or operation only when required:
1.
engine overspeed
2.
generator differential
3.
engine low lube oil pressure
It was noted that the licensee's surveillance procedures did not
appear to meet the surveillance requirement of the Technical
Specifications (TS). The testing methods are as follows:
1.
During the 18 month diesel generator load reject test, the
licensee verifies that the overspeed trip does not actuate on
the speed peak following a 4000 kW load reject.
2.
During the 18-month 4kV diesel generator differential relay
calibration, the differential lockout relay is removed, bench
calibrated, and reinstalled. The automatic lockout feature
circuitry is not tested (i.e., repeater relays and contacts)
during the surveillance. 9900 STS 4.8.1.1.2
- 2 -
Issue Date: 05/12/86
3.
During the 18-month calibration of the diesel generator lube
oil low pressure switches, the pressure switch is calibrated,
but the automatic circuitry is not functionally tested. Issue Date: 05/12/86
- 3 -
9900 STS 4.8.1.1.2
It also was noted that the licensee's staff believes that the
current calibration procedures are sufficient to meet the intent of
the surveillance requirement. Because the nuclear safety concern
is that the diesel generator (D/G) does not receive a spurious trip
in the emergency mode, the licensee believes the absence of a trip
during testing and the completion of the calibrations noted above
adequately proves that inadvertent emergency trip signals are not
actuated and therefore satisfies the TS surveillance requirement.
The overspeed governors are "periodically" replaced with vendor
(Woodward) calibrated governors. The licensee also believes that
verification that the trips will actuate when a valid malfunction
occurs is important for equipment protection but is not necessary
to ensure plant safety.
Region I stated its belief that the testing is not adequate to meet
the surveillance requirement as written. The testing is not
verifying that the lockout features prevent D/G operation only when
required, but is verifying that the lockout features do not prevent
operation when not required. The region noted that the basis for
the surveillance requirement is indeterminable from the TS.
The region's review of the GE Standard Technical Specifications
(STS) found that this surveillance requirement is left blank. A
check by Region I of three other plants found that the intent of
this requirement has been interpreted differently by other
utilities. Some have listed emergency lockouts, while others have
listed manual lockout features or all diesel generator trips
(test/emergency mode). A comparison of the plants reviewed is
presented in Attachment 1. This comparison by the region was
limited to GE facilities; however, it was suspected that the problem
also exists with the other standardized TS and warrants a more
structured review than the region was able to perform.
C.
DISCUSSION
The current STS for each vendor include examples of the types of
lockout features intended for inclusion under Specification
4.8.1.1.2.e.13 (see Attachment 2); these examples are "turning gear
engaged" and "emergency stop." The surveillance requirement is to
verify that the lockout features prevent starting only when
required. Because the lockout features are not normally actuated,
i.e., in a state which prevents starting of a diesel generator, the
intent of the surveillance requirement is to verify that the lockout
features prevent starting of the diesel generator when, in the terms
of the examples cited, the turning gear is engaged or the emergency
stop lockout feature is actuated. The other 18-month surveillance
requirements are performed to verify the starting and loading of the
diesel generators would verify that the identified lockout features
do not prevent starting of the diesel generators when they are not
required, i.e., the lockout feature is not actuated.
With regard to the test method used to demonstrate conformance with
this surveillance requirement, it should demonstrate the operability
of those components which must function to prevent starting of the
D/G that are associated with each lockout feature identified. 9900 STS 4.8.1.1.2
- 4 -
Issue Date: 05/12/86
Obviously a test would not attempt to start a diesel generator with
a turning gear engaged because damage to equipment could result if
the lockout feature did not function as required. Instead, the test
would probably be performed in two steps, e.g., first verify that
the lockout relay is activated when the turning gear is engaged and
then verify that the diesel generator will not start when the
lockout relay is activated.
The lockout features identified in the Susquehanna Technical
Specification under Section 4.8.1.1.2.c.13 are noted in Attachment
1 as a) engine overspeed, b) generator differential, and c) engine
lube oil pressure low. With regard to what features should be
included in this specification, the current guidance providing
examples was added to the GE STS in Revision 3. It is clear that
some licensees had proposed and the staff had issued the Technical
Specifications with requirements that differ from the current
guidance on the types of lockout features listed. The fact that
these differences exist is not surprising because the earlier STS
versions did not provide guidance on the type of lockout features
intended. However, when the Technical Specifications are issued,
the requirements exist and conformance to these requirements is
required. Conformance to TS requirements is not subject to
interpretations with regard to intent by subsequent change to the
STS. Thus, in this case, the lockout features indicated in the
Susquehanna TS are those which must be addressed and tested in
conformance to the stated requirements.
Based on the description of the licensee's tests noted above, the
NRR staff agrees with Region I that these tests do not satisfy the
intent of the surveillance requirements because they do not fully
demonstrate that these features prevent starting and/or operation
when required. The description of the licensee's test procedure on
the engine overspeed trip is not directly responsive to the
specification in question since it is a requirement of Specification
4.8.1.1.2.d.3 (load rejection without overspeed trip). The fact
that the overspeed governors are periodically replaced with
vendor-calibrated governors would appear to be adequate to address
their operability under the assumption that the frequency of such
action is performed in accordance with the manufacturer's recommen-
dation and in the absence of any other practical method to verify
the operability of the overspeed trip. (Note: It is assumed that
the overspeed trip function is an integral part of the overspeed
governor and is not a separate component.) The licensee's test for
"generator differential" and "engine low lube oil pressure" verifies
that these components are operable. However, these tests are not
sufficient to satisfy the surveillance requirements, which would
require that the next step should be to simulate the actuation of
these components and to verify that the balance of the circuits
associated with these lockout features will in fact prevent starting
the diesel generator. The omission of this step in the test
procedures results in a failure to satisfy the surveillance
requirement.
The licensee's position that verification that the trips will
actuate when a valid malfunction occurs is important for equipment
protection but not necessary to ensure plant safety, is an argument Issue Date: 05/12/86
- 5 -
9900 STS 4.8.1.1.2
which could be made for a change in the TS requirements. However
it is not acceptable as a basis to disregard an existing TS which
is explicit in its requirements. The tests should be performed as
noted above.
With regard to the broader aspects of what types of tests should be
included in the diesel generator surveillance requirements, it is
clear that the current guidance in the STS doe