Environmental qualification and maintenance of the qualified state of equipment in operating nuclear power plant

Transcription

1 Hungarian Atomic Energy Authority Guideline 4.13 Environmental qualification and maintenance of the qualified state of equipment in operating nuclear power plant Version number: March

2 Issued by: József Rónaky PhD, director-general Budapest, 2007 March The publication can be purchased from: Hungarian Atomic Energy Authority Nuclear Safety Directorate Budapest

3 PREAMBLE The legal hierarchy of nuclear safety regulations in Hungary is as follows: 1. The uppermost level is represented by the Act CXVI of 1996 on Atomic Energy (Atomic Act). 2. The next level basically consists of two government decrees issued as executive orders of the Atomic Act. The 114/2003. (VII.29.) Korm. government decree defines the legal status of the Hungarian Atomic Energy Authority (HAEA), while the 89/2005. (V.5.) Korm. government decree specifies the HAEA s generic procedural rules in nuclear safety regulatory matters. The nuclear safety code consists of seven volumes, which are issued as the annexes of this latter decree. The first four volumes address the NPP, the fifth one the research and training reactors, whilst the sixth volume addresses the spent fuel interim storage facility. These six volumes determine the specific nuclear safety requirements, whilst the seventh volume contains the definitions applied in the code. The regulations are mandatory; failing to meet any of them is possible only in those specific cases that are identified by the decree. 3. The regulatory guidelines constituting the next level of the regulatory system are connected to one of the volumes of the code. The guidelines describe the method recommended by the proceeding authority for meeting the requirements of the nuclear safety code. The guidelines are issued by the director general of the HAEA, and they are regularly reviewed and reissued based on accumulated experience. So as to proceed smoothly and duly the authority encourages the licensees to take into account the recommendations of the guidelines to the extent possible. 4. In addition to the described regulations of general type, individual regulatory prescriptions and resolutions may also address specific components, activities and procedures. 5. The listed regulations are obviously supplemented by the regulating documents of other organizations participating in the use of nuclear energy (designers, manufacturers, etc.). Such documents are prepared and maintained in accordance with the internal quality assurance system of the user.

4 Before applying a given guideline, always make sure whether the newest, effective version is considered. The effective guidelines can be downloaded from the HAEA's website:

5 Guideline /57 Version: 2 TABLE OF CONTENTS 1. INTRODUCTION Subject and objective of the guideline Corresponding laws and prescriptions 7 2. DEFINITIONS Abbreviations RELATION OF ENVIRONMENTAL QUALIFICATION WITH OTHER PROGRAMMES QUALIFICATION OF OPERATING EQUIPMENT Organizational conditions for realization of qualification programme Organization responsible for establishment of qualification requirements Organization responsible for meeting the qualification requirements Organization responsible for verification of meeting the qualification requirements Initial conditions of development of the environmental qualification programme Assessment of environmental circumstances Service conditions Scope of equipment to be qualified Identification of the existing qualification documentation Requirements and methods of modern environmental qualification Qualification by testing Qualification by testing material tests Qualification by analysis Consideration of operational experience Selection of the qualification method Application of the Space method Execution of environmental qualification programme Elaboration of the environmental qualification programme Assessment of the actual status of qualification Documentation of qualification Evaluation of the actual status of qualification Supplement of missing qualification 41

6 Guideline /57 Version: Measures in case of losing qualification MAINTENANCE OF THE QUALIFIED STATE Functional tests Monitoring Diagnostics Reliability of data of diagnostics and monitoring systems Maintenance Harmonization of maintenance and results of environmental qualification Maintenance of active components Measures to be taken if insufficient maintenance Condition monitoring Trend analysis of failures Equipment modifications and design modifications Feedback of operational experience Repair and replacement Extension of the qualified lifetime 55

7 Guideline /57 Version: 2 1. INTRODUCTION 1.1. Subject and objective of the guideline The activity aiming at maintaining the qualified state postulates the existence of the required initial qualification of equipment. The initial qualification is discussed in Guideline The subject of this guideline is the environmental qualification of electric, instrumentation and control and certain active engineering components and of certain structures. Their qualification is not a single action, but it lasts during the whole lifetime of equipment through the maintenance of the qualified state. The design requirements of nuclear power plants built in accordance with former standards do not include the requirements for initial qualification of safety equipment; therefore the activities connecting to the demonstration of environmental qualification and the correction of revealed deficiencies should be performed simultaneously with the activities connecting to the maintenance of the qualified state, and if the replacement of equipment and instruments become necessary then with the environmental qualification tasks of the new components. This guideline describes how the above mentioned complex activities should be executed. The objective of the guideline is to describe recommendations, which facilitate to execute those activities that support: the making up for the missing qualification of installed equipment, subsequently, the maintenance of the qualified state and the validity of existing qualifications, or if those above cannot be fulfilled, then the implementation of the necessary measures. This guideline describes a possible method for being in compliance with the regulations of Volume 4 of Nuclear Safety Code. The licensee may fulfill the referred regulations in a way other than described in this guideline. However, it should be justified in this case that the chosen approach ensures solutions equivalent to this guideline.

8 Guideline /57 Version: Corresponding laws and regulations Pursuant to the paragraph of Chapter 7 of Volume 4 of Nuclear Safety Code (NSC) issued based on the authorization of section 4. (1) of the Gov. decree 89/2005. (V.5.) Korm on the generic rules of procedures of the Hungarian Atomic Energy Authority in nuclear safety regulatory matters, the specified operating limits and conditions are required for maintaining the qualified state of equipment having environmental qualification. The compliance with limits and conditions is a necessary, but not sufficient condition of that the components complete their qualified or service lifetime in the facility. The Chapter 8 of the Code discusses the detection of deviations, monitoring of their variations in time and the requirements for documented maintenance. The Chapter 18 prescribes the feedback of operational experience in order to evaluate the design and expected residual lifetime of the components.

9 Guideline /57 Version: 2 2. DEFINITIONS Active components: Components fulfilling their safety function with moving parts or by changing their shape or properties. Design lifetime of a nuclear power plant unit: Lifetime that is taken into account during the design of the nuclear power plant unit, for which the safe operability is justified by the facility safety report. Identical part, structural element, component: The part, structural element or component is identical, if all of its properties (material, geometry, mode of operation, environmental resistance, reliability, mode of fabrication, type, etc.) are the same as those of the original one. Equipment qualification: The demonstration of that the safety classified equipment of the nuclear power plant can fulfill their design safety function during their whole lifetime. Various qualifications are exist: environmental qualification, seismic qualification, fire resistance qualification, electromagnetic compatibility qualification, etc. The maintenance of performance parameters necessary for ensuring the functionality and for achieving the safety function should be justified both under normal conditions (including: designed special service states), and under conditions taken place in the case of deign basis events. The equipment qualification should take into consideration of the ageing effect of environmental and operational circumstances occurring during the lifetime of the equipment. The process of equipment qualification includes the measures connecting to both achievement and maintenance of the qualified state. Safety analysis: Examinations and tests to be performed in order to evaluate whether the safety of systems, structures and components of a nuclear power plant comply with the requirements.

10 Guideline /57 Version: 2 Lifetime: Lifetime specified during design; besides the design lifetime, the service lifetime, which means the period between installation and disassembly, can also characterize certain equipment. Earthquake: OBE, SL-1 - Design earthquake During and after the design earthquake the plant operates undisturbed or shuts down, but it can be restarted after (or even without) the accomplishment of certain tests. This American definition is identical with the SL-1 earthquake as defined by the IAEA. SSE, SL-2 - Maximum design earthquake The largest earthquake in the case of which the plant can be safely shut down, and maintained in shut down state without release of any radioactive material. This American definition is identical with the SL-2 earthquake as defined by the IAEA. Similar part, structural element or component: A part, structural element or component is similar, if the safety analysis approved by the authority has justified that it is equivalent to the original one. Authentic data: Information compiled and documented in an understandable and followable manner, which provides the opportunity for independent reviewing the deductions made and conclusions drawn. Such data are the manufacturer s technical descriptions, testing records and analyses, etc. Maintenance: Activities performed on nuclear power plant systems, structures and components that aim at guaranteeing that they can reliably and economically fulfill their function as designed within the design lifetime of the unit. Two types of maintenance activities are distinguished as follows: - preventive maintenance, - corrective maintenance, i.e. repair. The preventive maintenance consists of cyclic maintenance (independently of the actual condition; its scope, method and frequency is specified on the

11 Guideline /57 Version: 2 basis of experience and prescriptions) and condition dependent maintenance (its scope, method and duration is determined based on changing of measured or observed parameters). The corrective maintenance is to be accomplished because of the occurrence of a failure. The scope, method and time point of the repair is dependent on the extent and nature of the failure. Maintenance programme: Long term plan of maintenance activities to be performed on certain systems, structures and components, which plan is developed for maintaining the design function of systems, structures and components, and for preventing and avoiding the safety consequences of failures. Initiating event: Such event resulting in deviation from the designed service states, which occurs due to technical reasons inside the facility, the intervention of personnel, or due to artificial or natural effect originating from the outside environment, and which may lead to anticipated operational occurrences, design basis accidents or severe accidents. Environments: The following environmental conditions are reasonable to be distinguished in a nuclear power plant: - Mild: environmental conditions appearing during normal operation of the nuclear power plant that do not alter significantly if an accident (including abnormal operating states) occurs. - Harsh: environmental conditions appearing during a design basis event (DBE) of the nuclear power plant that alter significantly in comparison with those appearing under normal service /such events are LOCA, HELB, MSLB/. - Degraded: service conditions that altered in comparison with the initial environmental conditions or with those that were considered during the initial qualification (higher temperature, humidity, radiation, fungus, etc.). Environmental resistance qualification or environmental qualification: Determination of resistance to environmental and service conditions ensuing during the lifetime of the equipment. This is the environmental part of the equipment qualification. The validity period of equipment qualification is

12 Guideline /57 Version: 2 specified during the qualification by the simulation of the service environment. Qualification: Evaluation of the applicability of organizations, persons and/or tools for performing activities relating to the safety of the nuclear facility, and for fulfilling functions in order to support the decision to be made on their approval. Maintenance of the qualified state: In the case of certain types of equipment and instruments, the process of environmental qualification is followed by the accomplishment of a programme, which ensures the long-term maintenance of operational environmental parameters, environmental effect parameters and other conditions that were taken into account during the qualification. The control of monitoring the environmental parameters that are necessary for demonstration of the maintenance of the qualified state of equipment is performed during the process of Monitoring of Maintenance Effectiveness. Qualified lifetime: That lifetime of components during which the component, based on the preinstallation qualification procedure is (certified) able to fulfill its design function during the necessary time-period even under such physical circumstances, which do or might appear in the environment of the component during fulfillment of the safety function. Qualification margin: Difference between the actual service parameters and those parameters belonging to conditions (that are more rigorous than the actual service conditions) postulated during equipment qualification. Normal service: Such operation of the nuclear facilities during which the operational limits and conditions approved by the authority are complied with; including load changes, shut-down, start-up, refueling, maintenance, test, etc. Ageing: Effect of operational, environmental and technological conditions on equipment that result in occurrence and further development of degradation mechanisms during a certain period of time, which conditions are within the design basis accidents (but do not include them).

13 Guideline /57 Version: 2 Ageing management: Series of those analysis, operation, maintenance, in-service inspection and testing, monitoring, repair and reconstruction activities related to degradation processes caused by ageing identified on designated components of the nuclear facility, which activities ensure that the component remains able to fulfill its function with the maintenance of the minimum necessary safety margin. Passive component: Those components, which perform their design safety function without moving parts and changing their shape or properties. (General examples of passive safety functions are included in the Annex of Guideline 4.14.) System: Entirety of components serving for fulfillment of a given function. Component: A unit performing individual sub-function of a given function (e.g. equipment, instrument, piping, building structure). Significant ageing process: Damage caused by such a degradation process, as a consequence of which the equipment, under normal and abnormal service conditions, become responsive in a more and more serious and observable manner with regard to its function to be performed during a design basis event. Seismic classification: Categorization of systems, structures and components of nuclear facilities in relation to their role in prevention of the safety of the facility during an earthquake. Design basis: Those attributes of a nuclear facility, the existence of which is required for the controlled management of anticipated operating events and postulated accidents by complying with the specified radiation protection requirements. The design basis includes the anticipated service states and the accident conditions generated by postulated initiating events, the significant assumptions and in certain cases the specific analysis methods as well. Those anticipated operating events belong to the design basis, which can be derived from the postulation of the lack of a safety actuation.

14 Guideline /57 Version: Abbreviations PSRR NSC SSC FSAR Periodic Safety Review Report Nuclear Safety Code System, structure and component Final Safety Analysis Report

15 Guideline /57 Version: 2 3. RELATION OF ENVIRONMENTAL QUALIFICATION WITH OTHER PROGRAMMES The nuclear power plants are designed for meeting the prescribed nuclear safety, radiation protection and technical safety objectives during their operation. Those safety functions are specified, the performance of which ensures the meeting of these objectives. The safety functions are performed by systems, and their components. These systems, structures and components (SSCs) perform their safety function through their availability and through their operation according to a given performance parameter. During the operation of the nuclear power plant the licensee should continuously demonstrate the ability to perform the required safety functions (including the performance capability according to required performance parameters) in the following scope: SSCs performing safety function(s) (SC 1-3), SSCs not performing safety function, but their failures risk the safety function. This demonstration can be made through safety analyses, environmental (environmental resistance) qualification, implementation of ageing management programmes, monitoring of the maintenance effectiveness, and through their joint and harmonized realization (see Figure 1). The licensee should decide on the method to be applied, with the limitation that environmental resistance qualification should be performed for electric, instrumentation and control components operating in harsh environment, ageing management should be realized pursuant to Guideline 4.12 for equipment listed, ageing locations and degradation processes identified in the Annex of Guideline 1.26.

16 Guideline /57 Version: 2 DESIGN BASIS ACTIVE and PASSIVE Objective: To justify by analysis that - the given piece of equipment (material, construction) - under the given circumstances (environmental parameters, loads) - during the specified period is able to fulfill the required function SAFETY ANALYSES TLSAs EQ Ageing management - Preventive programmes - Mitigating programmes - Condition monitoring ISI, TRP, MAINTENANCE Individual ageing management programmes Objective: To demonstrate equipment functionality through - harmonized realization of existing programmes (material testing, TRPs, maintenances), - development and implementation of necessary individual programmes Maintenance effectiveness monitoring (MEM) MAINTENANCE Objective: To justify that the SSC, by effective maintenance, is able to fulfill the required function and to operate according to specified parameters ACTIVE and PASSIVE Figure 1 Demonstration of the ability to fulfill safety functions and to comply with the required performance parameters (SC 1-3 +) Safety analyses: the safety analyses should justify that ACTIVE

17 Guideline /57 Version: 2 the given piece of equipment (material, construction, etc.), under the given circumstances (environmental parameters. loads, etc.), during the specified period is able to fulfill the required function. The time limited safety analyses are able to justify this for a period of time limited by taking account of ageing processes of components, altering loads expected during operation or of parameters occurring during an design basis accident that the component will be able to perform its safety function. Environmental analysis qualification: The limits of resistance ability against environmental, operational and accident circumstances occurring during the lifetime of equipment are specified during the environmental or (with other words) environmental resistance qualification. The validity period of environmental qualification is calculated by the simulation of the operating and accident environment. The qualification is valid, if the long term preservation of operating and accident environmental parameters and other conditions considered during the qualification, thus the maintenance of the qualified state is continuously justified and ensured. Besides this guideline, the Guideline 1.27 and Guideline 3.15 include recommendations with respect to environmental resistance qualification. If the safety analysis or the environmental qualification is valid for limited period of time, then the suitability of a component is justified for a limited time period. In such cases the further suitability of a given component should be qualified prior to the end of the limited period or it should be replaced by an element having qualification. Ageing management: The design aims at preventing the appearance of ageing processes, however several such effects occur on the SSCs, which may adversely affect the performance of their function. The objective of the ageing management programme is to identify all ageing processes postulated to occur on the given component, and to minimize their negative effects. In certain cases the monitoring of the condition and condition changing of the given component could be sufficient. The recommendations regarding ageing management are included in Guideline 1.26, Guideline 3.13 and Guideline 4.12.

18 Guideline /57 Version: 2 Monitoring of maintenance effectiveness: The monitoring of maintenance effectiveness means the monitoring of all the results of such activities, which play role in the preservation of the required level of functionality of components. The general objective of monitoring of maintenance effectiveness is to justify that the executed maintenance activities can ensure the compliance with the maintenance objectives defined for systems and components subject to maintenance or the implementation of the necessary corrective measures. Beyond the identification and correction of actual and possible failures, the maintenance includes such support activities like the in-service inspections, tests and exercises, the evaluation of maintenance results and monitoring of the compliance with maintenance criteria. The recommendations with respect to the monitoring of maintenance effectiveness are included in Guideline 1.19 and Guideline 4.5. If the licensee intends to demonstrate the suitability of the SSC through environmental resistance analysis, then recommendations are given in this guideline. Further recommendations regarding environmental resistance qualification can be found in Guideline 1.27 and Guideline QUALIFICATION OF OPERATING EQUIPMENT 4.1. Organizational conditions for realization of qualification programme Organization responsible for establishment of qualification requirements The environmental qualification requirements should be basically determined by the designer; it should have been elaborated during the design phase of the nuclear power plant. During the development of the original design the comprehensive environmental qualification documentation was not elaborated for formerly built nuclear power plants. An additional specialty is that due to development of design and operational experience and to other reasons the plant implements a significant (relating to its safety significant part) safety improvement modification programme. The tasks resulting in the provision of design input data for environmental qualification can be grouped as follows: organization of equipment to technological and safety systems, establishment of the technological, protection, control, etc. links,

19 Guideline /57 Version: 2 categorization of equipment to safety classes, evaluation of safety analyses in order to specify the environmental conditions and required performance parameters occurring during normal service, abnormal operation and accident states, more accurate specification of design input data based on operational experience. The above listed tasks may be executed by the operating organization with external designer(s), however the verification and approval of the design input data is the absolute responsibility of the licensee. The determination of environmental qualification requirements does not require, however does not exclude either the establishment and operation of an independent organizational unit (persons) entrusted with this task. The task should be reasonably managed within the organization coordinating the design and planning with the involvement of engineers responsible for maintenance. The following requirements should be met by the organization responsible for determining the requirements: It should be aware of the documents specifying the input data of environmental qualification; it should have possibility to compare them, to analyze the differing or contradictory data, to determine the authoritative input data. It should elaborate and maintain the environmental qualification specification regarding the entire plant. It should be informed about the scientific-technical development and the environmental qualification related operational (service and maintenance) experience accumulated at the plant (including the analysis of operational experience of other plants). It should have available resources for executing analyses, experiment and measurements necessary for more accurate specification of environmental qualification requirements. It should be informed about modifications that are planned at the plant; it should have capabilities to enforce the environmental qualification aspects in the course of the connecting purchase, installation, commissioning and operation activities.

20 Guideline /57 Version: Organization responsible for meeting the qualification requirements The maintenance of adequate qualified state of equipment requires such design, analysis, fabrication, purchase, assembly, operation, maintenance, in-service inspection, etc part activities, which are achieved by the executors of the given activities during their normal work. In such sense an independent organization responsible for meeting the qualification requirements should not be necessary. The meeting of the environmental qualification requirements should be ensured in the relating work instructions Organization responsible for verification of meeting the qualification requirements The grounding of qualification and the maintenance of the qualified state (altogether, with other words: equipment qualification) is such a process, which lasts from the design to the removal of equipment. Accordingly, it is justified to assign such organizational unit or person(s), whose duty is the verification of the meeting of environmental qualification requirements during the whole lifetime of the equipment Initial conditions of development of the environmental qualification programme The results of activities conducted by designers and manufacturers of equipment and the equipment safety classification serve as input data for that process during operation, which monitors the environmental qualification conditions of the equipment, by taking account of alterations resulted by implemented modifications, operational and maintenance experience, condition monitoring, failure analyses, in-service tests and other activities. The monitoring of alterations should be conducted parallel to the supplement of the required information or if it is missing to guaranteeing the operational safety. The activities relating to the compilation of initial conditions are as follows: Assessment of environmental circumstances During the design of the nuclear power plant the equipment and systems are sized for tolerating various, postulated events.

21 Guideline /57 Version: 2 Due to design basis accidents, the environmental circumstances of certain equipment of the nuclear power plant significantly alter, whilst no or not significant change occurs on other equipment. Those regions/rooms should be pointed in the nuclear power plant, where the accident conditions result in significant change of environmental loads. Those equipment, which are installed in these regions and the operability of which during accident is required by the safety analyses should be considered as equipment to be qualified for operation under harsh conditions. The other safety equipment should be qualified for mild environment. The environmental conditions of certain equipment should not be characterized by the step function between the two extremums (mild and harsh). Consequently, the detailed analysis of environmental conditions is the source of all concrete information making the qualification conditions more precise. The events having role in generation of environmental conditions should be assessed at least in the extent of initiating events analyzed in the Final Safety Analysis Report (FSAR). The environmental conditions of rooms falling under the effect of DBE events and of those not falling under such effect. Beyond the initiating events identified in the FSAR, the effect of other environmental conditions (see examples below) affecting the equipment operability should be analyzed by taking account of the single failure criterion: fungus generation, internal flooding, electromagnetic effects. The possibility of damages caused by rodents in outside regions of the facilities should be taken into consideration. Determination of performance parameters in the case of failure of various equipment and loss or output reduction of support systems (e.g. with the failure of venting and air conditioning systems), and the effect of deviation regarding failure, output or efficiency of certain components (sealing, heat insulation) affecting environmental parameters.

22 Guideline /57 Version: 2 The duration of harsh conditions and the operating time required under given circumstances should be carefully analyzed for equipment to be qualified for harsh environment. The deviation of environmental parameters may be smaller (e.g. in the case of an interface LOCA than of main circulating pipeline break), however the duration of events, and consequently the required time of functionality of certain safety equipment may be much longer. It is similar to the mitigation of beyond design basis accidents, and to the determination of qualification conditions of equipment serving for condition monitoring. The postulation of mild environmental parameters should mean the analysis of a possible alteration range of parameters, in which the conduction of a formal environmental qualification procedure does not result in significant contribution to increasing the anticipated operability of equipment. The maintenance of the reliability of equipment operating under such circumstances may be sufficiently ensured by: conservative design practice, demonstration of mild nature of DBA conditions, assurance of adequate quality of fabrication, assembly, operational and maintenance processes, investigation and analyses of failures. This approach simultaneously brings with itself that the in-service failures of equipment are resulted generally by individual, human, process and material failures, which cannot be revealed by equipment qualification methods. In the range of harsh environmental conditions, the previously mentioned measures are necessary, but they are not able to guarantee the reliable operation of equipment under DBA conditions. Certain accident conditions cannot be simulated during tests prior to operation (commissioning) and during in-service tests. At the same time the harsh environment causes such change of external parameters, which leads to change of properties of materials used in equipment (e.g. with increasing temperature the mechanical and electrical properties of certain materials are changing; moreover if the parameters changes occur simultaneously, then new failure mode may appear). The environmental qualification aims at preventing such possible failures.

23 Guideline /57 Version: 2 A specific area of qualification is the seismic qualification, the specialty of which is that the resulted harsh environmental conditions affect all equipment of the nuclear power plant. The seismic qualification is a part of the general process of qualification, its separate management is not adequate. The standardized practice follows the sequence of ageing earthquake harsh environment, where the ageing is the simulation of ageing affects of service environment. The seismic qualification should be only performed on aged equipment. Adequate qualification margins prescribed in standards should be required during environmental qualification. The qualification margin means the difference between environmental parameters applied or postulated during initial environmental qualification and those actually expected at the installation location of equipment. The design conservatisms and the applied safety factor may also result in margins. The application of statistical approach is not recommended, since it should be postulated that the unqualified equipment do not live through the harsh conditions, even with statistical probability. The harsh environment should be simulated. In the case of non-harsh environments, if significant ageing factor exists, then the environment should be simulated according to the validity period of qualification. Nevertheless, the realistic evaluation of results requires considering that only a few specimens are really tested during the initial environmental qualification, since the quantitative testing of statistically sufficient number of specimens make the qualification process unreasonably expensive Service conditions The service conditions are determined by operational and environmental conditions together. These conditions due to various reasons may alter between certain extremums. The knowledge of service conditions is required both for specification of mild environmental parameter range to be considered during equipment qualification and for identification of ageing induced degradation processes of equipment. The specification of anticipated service conditions is possible only with limited accuracy during the design because of: equipment failures, condition degradation,

24 Guideline /57 Version: 2 modifications. The most reliable method for considering these possible effects is: the real verification of parameters important to environmental qualification during operation, in different service modes and under various environmental (e.g. weather) conditions. The instrumentation and control equipment should be distinguished during the implementation of environmental qualification and ageing management programmes in relation with environmental conditions under which and the room in which they operate. The consideration of categorized environmental conditions may provide significant advantages during the initial qualification (or if it misses, then during its supplementation) of equipment and instruments operating in various premises. The greatest attention should be paid to components operating in harsh environment. The environmental qualification related management of the table of operational parameters (the entire list of parameters to be monitored, and the method for processing, etc.) should be practically conducted by the organization or person(s) responsible for specification of qualification requirements Scope of equipment to be qualified In accordance with up-to-date requirements, such environmental qualification specification should be compiled during the design of the nuclear power plant, which at least identifies: the scope of equipment to be qualified, the service and accident conditions to be considered in relation with qualification, the qualification methods to be applied, and the criteria of environmental qualification. Such requirements did not exist for formerly designed nuclear power plants; therefore equipment qualification list was not compiled. During the identification of equipment to be qualified, those should be selected, the operation of which is required during a design basis accident, and which, based on their location, are under harsh environmental conditions during the given period due to the accident situation to be mitigated.

25 Guideline /57 Version: 2 The selection of components falling under to scope of environmental qualification are discussed in Guideline 3.15 and in Chapter 3 of this guideline (SC 1-3+). Special attention should be paid to those functions, the loss of which affects the environmental conditions of the operation of that given piece of equipment or others. Care should be taken for the maintenance of the qualified state of structures being boundary of harsh conditions, if their failures under such conditions can hinder the fulfillment of the safety function necessary for event management. The environmental qualification should be achieved on system level on equipment basis; accordingly the applied equipment are qualified and then it is postulated that qualification of the systems consisting them is also demonstrated. The adequacy of this assumption always should be carefully assessed. The identification of the boundary of a system and its components is important in order to understand the role of sub-units, which can be individually assembled in the traditional sense, but are connected to each other from electrical and functional viewpoints of operation. The breaking electric component, so the breaker or the fuse is the component boundary for motor operated components (valves, pumps). The high current cables may belong to a component if they supply only that one, or may be handled individually if they supply more components. The transformers connecting different voltage levels should be considered as system boundary, as a part of the system. A certain assembly unit should mean the boundary; and if such identifier system exists for registering components that includes the assembly units, then it should be followed during the identification of boundaries. The equipment used for different function having different identifiers, but operating in similar environment and having similar construction should require totally uniform qualification activity. This fact should be taken into account during the recording of the environmental qualification and organization of the relating databases. Those equipment should be taken into a common qualification package of the environmental qualification programme, for which the uniform type and identical normal service and accident environmental conditions could be justified.

26 Guideline /57 Version: 2 Sometimes, by taking account of the establishment (including the design) circumstances of formerly built nuclear power plants, the precise specification of the normal service environmental parameters are not sufficiently documented; therefore this deficiency should be considered during the identification of the scope of the environmental qualification programme Identification of the existing qualification documentation Specific environmental qualification documentation was not prepared for formerly built nuclear power plants. However, general and equipment specific prescriptions including certain requirements were effective, and the manufacturer documents of certain equipment are also available, in which environmental qualification information can be found. The equipment specific analysis of the differences between the information of former documents and the requirements of the modern regulations should be achieved for the specification of actions necessary for reaching the environmental qualification level pursuant to modern requirements Requirements and methods of modern environmental qualification The assurance of the quality of installed equipment of nuclear power plant in service can be divided into two phases: establishment of qualification requirements, assurance of quality. The establishment of qualification requirements demands those available qualification systems for equipment having different functions and installed in different environment, the adequate implementation and positive results of which provide the qualification of a given equipment(type) to certain accident environmental conditions. It should be verified during the plant specific analysis that the accident environmental parameters expected to occur in a given installation location do not exceed the limits of toleration of the given equipment as justified by the appropriate methods. If the qualification reveals a degradation process progressing in time and existing under given environmental conditions and parameters, then the equipment have a limited lifetime that can be characterized by the number of operating cycles or a period of time.

27 Guideline /57 Version: 2 The possible tools of qualifications are: testing, analysis, operational experience, and their combinations, and processing of information collected during maintenance. Nevertheless, the different qualification methods can be applied to different cases; each method has its advantages, disadvantages and application limits Qualification by testing The qualification by testing aims at demonstrating the performance characteristics of an equipment group. The selected specimen of the equipment should be tested in the appropriate sequence of environmental conditions, during which its operability and performance indicators should be demonstrated. The testing is the most reliable method from environmental qualification point of view. Any operating condition may be modeled during testing (including ageing as well), and also the accident conditions with the required margins. Not only the performance indicators of the equipment can be demonstrated during testing, but the environmental conditions to be provided by the support equipment and systems. Nevertheless, the testing results do not justify the appropriate operation of the given type of equipment (due to the non-statistical sampling), but the deterministic failure of the given type of equipment should not be assumed. The tests should be accomplished in line with written testing document, their results should be recorded in test reports, which are applicable for detailed description of the test configuration, the applied parameters, the validity range of test and the arisen issues. Occasionally tests could be only accomplished for certain part areas or part units, or for justifying the toleration of certain selected loads. These methods often should be combined with analysis methods regarding toleration of other occurring loads. The partial tests very often are accomplished by the manufacturers of the equipment or by laboratories entitled by them, but without taking account of the application in the nuclear industry. The utilization of these tests in the nuclear industry is possible, if the authentication, accuracy and representativity of the provided data is justified in accordance with the circumstances of the nuclear industrial application. An example for partial testing is the demonstration of radiation resistance of certain materials by testing (by taking account of the former proves of other required properties of the material).

28 Guideline /57 Version: 2 If the equipment does not fall under the scope of environmental qualification, and significant ageing factor cannot be identified, the simulation of accelerated ageing can be rejected. However other tests could be necessary pursuant to other aspects of qualification, thus the connecting tests should also be accomplished Qualification by testing material tests The classical method for identification of effects caused by temperature and irradiation, and for quantifying ageing is the examination of the specimens of cables, measuring instruments and other components. It is fortunate, if the specimens are from the real service environment. Mechanical, electrical and chemical tests and simulations should be performed on cables. The classical method for evaluation of the consequences of environmental effects (temperature, radiation, humidity, chemicals, etc.), for evaluation of the ageing condition of cables and other components, and for determination of residual lifetime is the testing of specimens from the service environment. The tests can be accomplished by non-destructive and destructive methods Non-destructive analyses The non-destructive test methods could be primarily applied for equipment in service. These tests can be made by electrical, mechanical and chemical methods. The most frequently used electrical method is the measurement of insulation resistance, and of direct and alternate current voltage resistance. The measurement of the elasticity of cable insulation (sheath) and the examination of color changes of sheath that indicate the start of ageing (appearance of rupture, break, crack) of insulation material are among the mechanical tests. A chemical method is the laboratory analysis (infrared spectrophotometric analysis, density measurements, plasticity measurement, etc.) of the micro size material samples from the insulation and the cable sheath. The organized storage and periodic inspection (visual inspection, measurement of changing of insulation resistance, examination of insulation of cables being in wet and humid environment) of representative cable samples under conditions worse than the service environment, and their accident testing belong to the non-destructive testing. The data obtained in this way should be used for estimation of expected lifetime.

29 Guideline /57 Version: 2 Other methods used in the international practice for non-destructive analysis of cables are: Insulation examination by measurement of penetration modulus (INDENTER monitor). Examination of cable insulation by return voltage method. Measurement of loss factor. During the realization of lifetime extension the non-destructive methods should be used for monitoring degradation processes during the extended lifetime Destructive analyses The analysis methods entailing the destruction of the material serve for assessment of the ageing condition of insulation materials (primarily cable insulations). The samples necessary for analyses should be prepared form the insulation material of equipment (cables) that are out of service. The insulation material of cables becomes brittle and tough due to the ageing effects of service environment. In general this alteration is well followed by the elongation at break of the material; therefore the break analyses of samples of cable insulation material provides valuable information on the ageing process. During the analysis the elongation of break of the sample is measured in comparison with the initial state of the sample. The evaluation of the analysis results requires the knowledge of the initial elongation at break values of the insulation materials. IN the international practice the condition of insulation material is adequate if its elongation at break value is not lower than 50% of the initial value. Otherwise, it is postulated that the cable insulation is not able to fulfill its required function in the case of a possible accident state. Other methods used in the international practice for destructive analysis of ageing of cables are: Flexibility and tensile strength examinations of the insulation and sheath materials. Density analysis of insulation materials. Thermoanalyitical analyses with differential scanning calorimeter (DSC). High voltage insulation analyses.

30 Guideline /57 Version: 2 During the realization of the lifetime extension, the destructive examination methods should be applied in order to monitor the degradation of cable samples ageing in the actual service environment Qualification by analysis The qualification by analysis is successful, if the analysis model can correspond to the element to be qualified. All relevant properties (shape, material properties, etc.) of the model should correspond to the element to be qualified, whilst the postulated loads should correspond to the anticipated service loads and other effects. The qualification by analysis requires logical evaluation and application of a validated mathematical model. The analysis should include natural laws, testing and examination data, operational experience and condition indicators. The adequacy of the model is the critical point of the applicability of this qualification system. The sufficient similarity between the model and the product should be justified on the basis of natural laws, analysis results, operational experience, or other verifiable database. The qualified state can be demonstrated by evaluation of tests and data from the viewpoint of material properties, the resistance to environmental circumstances and by failure statistics. Nevertheless, the analysis cannot demonstrate the qualified state individually. In general, the qualification by analysis can be used for demonstration of toleration of individually affecting loads (e.g. earthquake, temperature effects). The qualification by analysis cannot be used as lonely method for instrumentation and control, and control equipment. Usually, the analysis methods can be well applied to extension of existing test results by extrapolation. The extension of the use of detailed test results by analysis is very often performed. The effects of applied simplifications and unavoidable uncertainties should be taken into consideration during analyses by application of appropriate margins, safety coefficients and of simplification methods that are justified as conservative.