Environmental qualification of equipment during the design of nuclear power plants

Transcription

1 Hungarian Atomic Energy Authority Guideline 3.15 Environmental qualification of equipment during the design of nuclear power plants Version number: 2. March, 2007

2 Issued by: József Rónaky PhD, director-general Budapest, 2007 March The publication can be purchased from: Hungarian Atomic Energy Authority Nuclear Safety Directorate Budapest

3 PREAMBLE The legal hierarchy of nuclear safety regulations in Hungary is as follows: 1. The uppermost level is represented by the Act CXVI of 1996 on Atomic Energy (Atomic Act). 2. The next level basically consists of two government decrees issued as executive orders of the Atomic Act. The 114/2003. (VII.29.) Korm. government decree defines the legal status of the Hungarian Atomic Energy Authority (HAEA), while the 89/2005. (V.5.) Korm. government decree specifies the HAEA s generic procedural rules in nuclear safety regulatory matters. The nuclear safety code consists of seven volumes, which are issued as the annexes of this latter decree. The first four volumes address the NPP, the fifth one the research and training reactors, whilst the sixth volume addresses the spent fuel interim storage facility. These six volumes determine the specific nuclear safety requirements, whilst the seventh volume contains the definitions applied in the code. The regulations are mandatory; failing to meet any of them is possible only in those specific cases that are identified by the decree. 3. The regulatory guidelines constituting the next level of the regulatory system are connected to one of the volumes of the code. The guidelines describe the method recommended by the proceeding authority for meeting the requirements of the nuclear safety code. The guidelines are issued by the director general of the HAEA, and they are regularly reviewed and reissued based on accumulated experience. So as to proceed smoothly and duly the authority encourages the licensees to take into account the recommendations of the guidelines to the extent possible. 4. In addition to the described regulations of general type, individual regulatory prescriptions and resolutions may also address specific components, activities and procedures. 5. The listed regulations are obviously supplemented by the regulating documents of other organizations participating in the use of nuclear energy (designers, manufacturers, etc.). Such documents are prepared and maintained in accordance with the internal quality assurance system of the user.

4 Before applying a given guideline, always make sure whether the newest, effective version is considered. The effective guidelines can be downloaded from the HAEA's website:

5 Guideline /65 Version: 2 TABLE OF CONTENTS 1. INTRODUCTION Subject and objective of the guideline Corresponding laws and prescriptions 7 2. DEFINITIONS Abbreviations INITIAL ENVIROMENTAL QUALIFICATION OF EQUIPMENT Objective of and general requirements for environmental qualification of equipment The scope of qualification in line with function performance and effects Role of equipment in guaranteeing the safety of the unit Classification of equipment and components Specific aspects of identification of qualification requirements Service loads and environmental conditions Consideration of equipment type Degradation processes consideration of ageing effects Application of the Space method Input data of initial environmental qualification Environmental qualification specification Performance requirements for equipment Locations of equipment to be qualified Environmental attributes Initiating event to be considered Ageing processes to be considered Conduction of the initial environmental qualification Standards and regulations Qualification criteria Qualification report Evaluation of the data of the initial environmental qualification Selection of qualification standards and criteria Required environmental conditions The service conditions and the required performance parameters Review of qualification reports Similarity of operating and tested equipment 44

6 Guideline /65 Version: Requirements and limitations for placement and arrangement Performance requirements and acceptance criteria Testing sequence Modeling of ageing processes and the qualified lifetime Consideration of accident conditions Management of deviations Consideration of other information MAINTENANCE OF THE QUALIFIED STATE Functional tests Monitoring Diagnostics Data credibility of diagnostics and monitoring systems Repair and replacement QUALITY ASSURANCE AND DOCUMENTATION OF QUALIFICATION Mild environment Harsh environment Evaluation of qualification documentation ANNEX INFORMATIVE LIST OF ENVIRONMENTAL QUALIFICATION STANDARDS 63

7 Guideline /65 Version: 2 1. INTRODUCTION 1.1. Subject and objective of the guideline The subject of this guideline is the environmental qualification of electrical, control and instrumentation, and certain active engineering components, and of certain structures. Their qualification is not a single event, but a process accompanying the lifetime of equipment through maintenance of their qualified state. The environmental qualification of equipment is a process commencing at the design phase of the nuclear power plant and lasting during its whole lifetime; it includes the initial qualification of equipment and the necessary programmes and procedures, and those methods and measures, which make possible to maintain the qualified state during the whole qualified or operating lifetime. Accordingly, actions to be performed during operation, but to be considered even in the design phase are also discussed. The objective of environmental or with other words environmental resistance qualification of nuclear power plant equipment is to maintain the functionality and the achieved level of required performance indicators of safety significant equipment during operation, in order to keep the equipment operable in spite of the circumstances and operating events of its past, and to ensure that it fulfills its safety function under the conditions of the most serious event belonging to the design basis, and if necessary even after its occurrence for the required period of time. For equipment of safety systems the spectrum of environmental conditions covers the normal operating conditions, their deviation due to a transient state and the accident conditions considered during the design of the nuclear power plant. In order to meet the objective of environmental qualification during the design and establishment of nuclear power plants, only such equipment could be installed in the plant, which are able to provably perform their function under the environmental conditions of the given installation location, or which do not hinder the performance of the safety function by other equipment. In the case of such operating nuclear power plant, the design basis of which does not include the requirements of environmental qualification, the

8 Guideline /65 Version: 2 objective of environmental qualification is to specify and prioritize those actions, which are necessary for achieving, demonstrating and maintaining the qualified state of equipment. The objective of this guideline is to describe the possible method for execution of these actions. In order to comply with the regulatory requirement the licensee may apply any approach differing from, but equivalent to that described here Corresponding laws and regulations Chapter 4.5 of Volume 3 of Nuclear Safety Code (NSC) issued based on the authorization of Article 4. (1) of the Gov. decree 89/2005. (V.5.) Korm on the generic rules of procedures of the Hungarian Atomic Energy Authority in nuclear safety regulatory matters includes the requirements of environmental qualification belonging to the design and establishment of the nuclear power plant. Chapter 4.7 discusses the lifetime requirements, detection of adverse effects on components and the considerations of lifetime management, in a word the ageing management; while Chapter 4.8 includes requirements for structural materials of component parts in order to achieve the required lifetime. Chapter 4.6 is an important chapter being in close relation with those above; it discusses the maintenance and testing activities to be performed in order to maintain and verify the qualified state following the qualification procedure.

9 Guideline /65 Version: 2 2. DEFINITIONS Active components: Components fulfilling their safety function with moving parts or by changing their shape or properties. Design lifetime of a nuclear power plant unit: Lifetime that is taken into account during the design of the nuclear power plant unit, for which the safe operability is justified by the facility safety report. Identical part, structural element, component: The part, structural element or component is identical, if all of its properties (material, geometry, mode of operation, environmental resistance, reliability, mode of fabrication, type, etc.) are the same as those of the original one. Equipment qualification: The demonstration of that the safety classified equipment of the nuclear power plant can fulfill their design safety function during their whole lifetime. Various qualifications are exist: environmental qualification, seismic qualification, fire resistance qualification, electromagnetic compatibility qualification, etc. The maintenance of performance parameters necessary for ensuring the functionality and for achieving the safety function should be justified both under normal conditions (including: designed special service states), and under conditions taken place in the case of deign basis events. The equipment qualification should take into consideration of the ageing effect of environmental and operational circumstances occurring during the lifetime of the equipment. The process of equipment qualification includes the measures connecting to both achievement and maintenance of the qualified state. Safety analysis: Examinations and tests to be performed in order to evaluate whether the safety of systems, structures and components of a nuclear power plant comply with the requirements.

10 Guideline /65 Version: 2 Lifetime: Lifetime specified during design; besides the design lifetime, the service lifetime, which means the period between installation and disassembly, can also characterize certain equipment. Earthquake: OBE, SL-1 - Design earthquake During and after the design earthquake the plant operates undisturbed or shuts down, but it can be restarted after (or even without) the accomplishment of certain tests. This American definition is identical with the SL-1 earthquake as defined by the IAEA. SSE, SL-2 - Maximum design earthquake The largest earthquake in the case of which the plant can be safely shut down, and maintained in shut down state without release of any radioactive material. This American definition is identical with the SL-2 earthquake as defined by the IAEA. Similar part, structural element or component: A part, structural element or component is similar, if the safety analysis approved by the authority has justified that it is equivalent to the original one. Authentic data: Information compiled and documented in an understandable and followable manner, which provides the opportunity for independent reviewing the deductions made and conclusions drawn. Such data are the manufacturer s technical descriptions, testing records and analyses, etc. Maintenance: Activities performed on nuclear power plant systems, structures and components that aim at guaranteeing that they can reliably and economically fulfill their function as designed within the design lifetime of the unit. Two types of maintenance activities are distinguished as follows: - preventive maintenance, - corrective maintenance, i.e. repair. The preventive maintenance consists of cyclic maintenance (independently of the actual condition; its scope, method and frequency is specified on the basis

11 Guideline /65 Version: 2 of experience and prescriptions) and condition dependent maintenance (its scope, method and duration is determined based on changing of measured or observed parameters). The corrective maintenance is to be accomplished because of the occurrence of a failure. The scope, method and time point of the repair is dependent on the extent and nature of the failure. Maintenance programme: Long term plan of maintenance activities to be performed on certain systems, structures and components, which plan is developed for maintaining the design function of systems, structures and components, and for preventing and avoiding the safety consequences of failures. Initiating event: Such event resulting in deviation from the designed service states, which occurs due to technical reasons inside the facility, the intervention of personnel, or due to artificial or natural effect originating from the outside environment, and which may lead to anticipated operational occurrences, design basis accidents or severe accidents. Environments: The following environmental conditions are reasonable to be distinguished in a nuclear power plant: - Mild: environmental conditions appearing during normal operation of the nuclear power plant that do not alter significantly if an accident (including abnormal operating states) occurs. - Harsh: environmental conditions appearing during a design basis event (DBE) of the nuclear power plant that alter significantly in comparison with those appearing under normal service /such events are LOCA, HELB, MSLB/. - Degraded: service conditions that altered in comparison with the initial environmental conditions or with those that were considered during the initial qualification (higher temperature, humidity, radiation, fungus, etc.). Environmental resistance qualification or environmental qualification: Determination of resistance to environmental and service conditions ensuing during the lifetime of the equipment. This is the environmental part of the equipment qualification. The validity period of equipment qualification is

12 Guideline /65 Version: 2 specified during the qualification by the simulation of the service environment. Qualification: Evaluation of the applicability of organizations, persons and/or tools for performing activities relating to the safety of the nuclear facility, and for fulfilling functions in order to support the decision to be made on their approval. Maintenance of the qualified state: In the case of certain types of equipment and instruments, the process of environmental qualification is followed by the accomplishment of a programme, which ensures the long-term maintenance of operational environmental parameters, environmental effect parameters and other conditions that were taken into account during the qualification. The control of monitoring the environmental parameters that are necessary for demonstration of the maintenance of the qualified state of equipment is performed during the process of Monitoring of Maintenance Effectiveness. Qualified lifetime: That lifetime of components during which the component, based on the preinstallation qualification procedure is (certified) able to fulfill its design function during the necessary time-period even under such physical circumstances, which do or might appear in the environment of the component during fulfillment of the safety function. Qualification margin: Difference between the actual service parameters and those parameters belonging to conditions (that are more rigorous than the actual service conditions) postulated during equipment qualification. Normal service: Such operation of the nuclear facilities during which the operational limits and conditions approved by the authority are complied with; including load changes, shut-down, start-up, refueling, maintenance, test, etc. Ageing: Effect of operational, environmental and technological conditions on equipment that result in occurrence and further development of degradation mechanisms during a certain period of time, which conditions are within the design basis accidents (but do not include them).

13 Guideline /65 Version: 2 Ageing management: Series of those analysis, operation, maintenance, in-service inspection and testing, monitoring, repair and reconstruction activities related to degradation processes caused by ageing identified on designated components of the nuclear facility, which activities ensure that the component remains able to fulfill its function with the maintenance of the minimum necessary safety margin. Passive component: Those components, which perform their design safety function without moving parts and changing their shape or properties. (General examples of passive safety functions are included in the Annex of Guideline 4.14.) System: Entirety of components serving for fulfillment of a given function. Component: A unit performing individual sub-function of a given function (e.g. equipment, instrument, piping, building structure). Significant ageing process: Damage caused by such a degradation process, as a consequence of which the equipment, under normal and abnormal service conditions, become responsive in a more and more serious and observable manner with regard to its function to be performed during a design basis event. Seismic classification: Categorization of systems, structures and components of nuclear facilities in relation to their role in prevention of the safety of the facility during an earthquake. Design basis: Those attributes of a nuclear facility, the existence of which is required for the controlled management of anticipated operating events and postulated accidents by complying with the specified radiation protection requirements. The design basis includes the anticipated service states and the accident conditions generated by postulated initiating events, the significant assumptions and in certain cases the specific analysis methods as well. Those anticipated operating events belong to the design basis, which can be derived from the postulation of the lack of a safety actuation.

14 Guideline /65 Version: Abbreviations PSRR NSC SSC FSAR Periodic Safety Review Report Nuclear Safety Code System, structure and component Final Safety Analysis Report

15 Guideline /65 Version: 2 3. INITIAL ENVIROMENTAL QUALIFICATION OF EQUIPMENT 3.1. Objective of and general requirements for environmental qualification of equipment For electrical, instrumentation and control components, by taking account of their material properties, the availability of the safety function and the reliability and good quality of the time-limited and non-limited analyses require the qualification of each piece of equipment and instrument selected in accordance with the scope of the qualification procedure. The initial qualification of components falling under the scope of environmental qualification is required for elaboration of the safety analyses or the time-limited analyses. The qualification provides those service environment and environmental effect parameters, if which are complied with, then the function will be performed for the required period of time and under the required conditions, thus the qualification will remain valid as time goes on. The primary objective of environmental qualification is to justify that not necessary to postulate so called common cause (systematic, not random) failures, which would be able to break through the defense line of the redundant system, and to make inoperable all ways of the performance of the required safety function. The two major sources of common cause failures are the failures in concept and the environment. Failures in concept would be: design, fabrication, assembly, operational and maintenance failures. The environmental qualification primarily, but not exclusively prevents the occurrence of failures in concept. The environment, as the initiator of common cause failures may act in two ways: The ageing mechanisms occurring in service environment may cause inservice common cause failures, while in harsh environment the sudden damage to equipment or instruments can be expected. The harsh environmental conditions are caused by accidents. The accidents can result in sudden, intensive parameter changes, and consequences leading to significant effects in certain regions of the plant,

16 Guideline /65 Version: 2 thus the failure of one piece of or more equipment would appear in the given area. Due to the latter phenomenon the equipment qualification is interpreted as environmental resistance qualification, however other qualification approach could be also necessary. The external environmental conditions (e.g. seismic effects) may cause common cause failure even during normal operation. In this sense all safety equipment should have environmental qualification in a certain extent. At the same time, as it will be clarified below, the methods and criteria of qualification will significantly change depending on whether the equipment operate in harsh or mild environment. Accordingly, the equipment qualification may be interpreted in wider term than the environmental qualification. Certain conditions of the environment of equipment have significant effect on its state and performance. These are e.g. temperature, radiation, vapor content and humidity, spraying water and flooding, pressure, vibration, and seismic movements. A few of these conditions alter significantly only during accidents, whilst others do not change even during accidents. Consequently, the resulted harsh or mild environment depends primarily on the physical location, rather than the operation of the given equipment or their role in the technological process. The other group of operating conditions is resulted by the operation of equipment themselves or the served system (e.g. pressure, temperature, flow of operating medium, self vibration). These effects together may result in gradual degradation (ageing) or sudden failure of equipment. During the design of safety equipment of a nuclear power plant all the potential degradation processes should be considered during initial qualification. In order to obtain the empirical proofs, the environmental qualification consists of various examinations and tests, target analysis and evaluation of operational experience, or of the combination of the above three methods. Limitations are: The qualification by analysis is only accepted, if the component has initial qualification and it is intended to be operated under environmental conditions differing from the initial qualification.

17 Guideline /65 Version: 2 The qualification by analysis can only be used for justification of toleration of independent (self acting) loads (e.g. earthquake, temperature effects). The operational experience provides input data only for qualification to mild environmental conditions. The qualification by analysis requires logical evaluation and application of proven mathematical models. The analysis should take into consideration of the natural laws, testing and examination data, operational experience and condition indicators. The qualified state can be demonstrated by evaluation of examinations and data from the viewpoint of material properties, by using resistance shown to environmental conditions or failure statistics. However the analysis itself cannot demonstrate the qualified state. The objective of the selection of methods to be applied is to demonstrate that the ageing degradation suffered by the equipment during the service term (the qualified lifetime) does not result in common cause failure generated by the environment either during normal operation of the unit or in the case if the equipment will operate under harsh accident environmental conditions as considered in the design, even at the very end of the qualfied lifetime. The mild or harsh character of the environment should be taken into account during the selection of the method; examinations and tests should get priority. During the qualification those environmental conditions should be specified, under which the qualification itself remains valid. The purpose of the qualification documentation is to provide authentic data for internal or independent review of the compliance with the qualification requirements for the equipment to be installed, and for determination of requirements of supplementary qualification becoming necessary due to alteration of circumstances postulated during the qualification of the already installed (operating) equipment. The requirements for documentation should be specified accordingly. For systems, components and structures performing safety function, the qualification procedure or if needed additional measure should provide such data collection, which could demonstrate that the initial assumptions will remain valid during the whole lifetime of the component!

18 Guideline /65 Version: The scope of qualification in line with function performance and effects Role of equipment in guaranteeing the safety of the unit The equipment (instruments) contributing to fulfill a function should be identified by analysis on the basis of the construction and operation of the system. The Guideline 4.13 provides guidance for selection of components falling under the scope of environmental qualification. The equipment serving for post accident monitoring, physical protection, fire protection and radioactive waste management should also be classified during the analysis of their functions. However the determination of qualification requirements for these equipment does not does not serve for nuclear safety interests, it is important from the viewpoint of general safety of the nuclear facility Classification of equipment and components The various systems and equipment of the nuclear power plant play different role in guaranteeing the safety of the plant. The nuclear power plant consists of many different equipment, therefore it is impossible to handle all elements in accordance with the highest qualification requirements (from design to decommissioning). The uniform management of equipment can result in degradation of the quality level of systems that are most safety significant, and in unreasonable over-qualification of less important equipment. According to the above considerations the equipment of the nuclear power plant should be categorized to classes. The fundamental principles of categorization of nuclear power plant equipment to safety classes are included in Guideline 3.1 titled as Fundamental principles of safety classification of nuclear power plant systems and components. The safety classification of equipment and components provides an objective basis for including components performing basic safety function and those performing safety function in the environmental qualification process. However the qualification of such equipment could be also necessary, the failure of which hinders the operation of other safety important components,

19 Guideline /65 Version: 2 or the operation of which is necessary in situations demanding interventions (SC 1-3+) Specific aspects of identification of qualification requirements Single failure criterion The random, individual failures may occur even during activities being in compliance with the rigorous requirements for the highest safety class. In order to eliminate their negative effect the single failure principle should be applied, which principle requires that a safety system remains functional even if an element of the system or an element of its support systems ensuring its operation fails. From designer point of view the application of the principle means that the plans should be systematically reviewed to identify the potential locations and consequences of individual failures; and if necessary redundant, diverse provision should be ensured in order to reach the required reliability. If accident with tube rupture could be assumed in the room or region where the equipment, instruments are located, then this should be included in the qualification requirements. During the compilation of requirements for environmental qualification the single failure principle should mean that: The systems should preserve their ability to perform their safety functions, if the following failure types do occur: each single, detectable failure (so random failure), each anticipated failure (so such failures, the occurrence probability of which is high enough) including non-detectable failures, each additional failure occurring due to a single failure, and each failure, which is caused by an event requiring protection function. It should be noted that the failure is not planned; it means not only total loss of function, but a deviation from the defined operating state. If the assumed accident conditions lead equipment failures, then all these failures and an additional independent, random and individual failure should be taken into account.

20 Guideline /65 Version: 2 It depends on the extent of the deviation whether it is identified as failure; so this extent should be defined when the failure criterion is specified Common cause and common mode failures The failures of systems or equipment occurring in identical way are called common mode failures. The common mode failures can be fabrication failures, which may occur in identical way, but in different time and at different equipment and instrument. Common cause failure occurs when a given environmental, operating condition or human intervention causes failures of more equipment and instruments at the same time, however the mode how the failure occurs can be different per equipment or instrument types. Common cause could be fire, flooding, high temperature and pressure, the earthquake or loss of power, or a human action. Examples of common cause failures are as follows: Failure of accumulator plants structurally degraded due to in-service ageing that is caused by an earthquake. Failure of equipment located in the hermetic zone due to the high temperature and humidity caused by a LOCA. Incorrect closure of redundant valves that are designed to be open during operation due to an incorrect procedural instruction (human). Drives of motor operated valves are not able to close the valve due to incorrect set values of momentum limiters (human). The failures can occur due to short effects of overloading or as a consequence of a continuous ageing mechanism. The main objective of environmental qualification is to reasonably ensure the prevention of common cause and common mode failures Redundancy and diversity Systems or equipment are redundant, if they ensure the fulfillment of the system function independently of the operating mode or even if another system serving for the same function is disfunctional. Beyond the duplication of function performance the redundant systems are independent of each other from every aspect, since the failure occurring in a system cannot lead to the failure of another system. The provision of independency requires specific considerations for systems operating with electric signals and sending and receiving digital data.

21 Guideline /65 Version: 2 The principle of physical separation is a very important aspect of redundancy. The redundancy is aimed to prevent common cause failures. In programmed systems even an incorrect or previously not appeared data can initiate an inadequate code-part of the software, thus such errors cannot be prevented by redundancy, since it means a common mode. The diversity means that such components or systems are applied for performing the same principal function, which have different operating principle and physical construction. The diverse equipment and instruments may create a redundant configuration as well. The diversity is aimed to prevent common mode failures. The different constructions, types and operating principles make the manifestation of different failure types probable, thus they protect against simultaneity, so against the loss of redundant equipment and instruments Role of environmental qualification in grounding the safety of the unit The environmental qualification means the demonstration that a piece of equipment is able to perform its required function by taking account of the operating and environmental loads, including the accidents considered during the design. This demonstration should cover the whole lifetime of the equipment. Consequently, the environmental qualification should consider the equipment ageing during operation prior to the assumed accident. The consideration of tests, analyses applied during the environmental qualification and the operational experience, or their combination ensure that environmental and operational common cause failures of equipment do not occur, and that the defense in depth (if the redundancy is appropriately ensured) is not breached. The environmental qualification is achieved on equipment basis even on system level, thus the applied equipment are qualified individually and it is assumed that the qualified state of a system consisting of them is also demonstrated. The adequacy of this assumption should be carefully reviewed for each case. The system and component boundaries play relevant role for understanding the roles of sub-units, which can be (in ordinary sense) assembled individually, but belong together from electrical or functional aspects. The breaking electrical component, so the breaker or the fuse is the component boundary for motor operated components (valves, pumps) and heavy current cables. The heavy current cables may belong to a component if they supply

22 Guideline /65 Version: 2 only one component, or can be managed individually if they supply more components. The transformer connecting different voltage levels should be taken into account as system boundary and as the part of the system. An assembly unit should be the boundary; if such identification system for recording components does exist, which includes the assembly units as well and then it should be used during the specification of boundaries. It should be considered that the design, fabrication, the use materials, the assembly configuration, the operational and maintenance practice may also have effect on qualification. Due to the above reasons the general environmental qualification data should be carefully compared to the specific conditions, constructional solutions and performance requirements that characterize a given unit of a given nuclear power plant Service loads and environmental conditions Normal operating conditions The equipment qualification should be achieved for the full spectrum of service loads, including both the operating conditions occurring inside the equipment and the so called environmental conditions outside the equipment during normal operation and accident situations. In fact, less load is applied on most of the equipment under normal service conditions than during accident situations; therefore the practical tasks of environmental qualification connect to the analysis of deviations of service conditions and the analysis of effects appearing during accidents. The ageing phenomenon, by taking account of the slow degradation processes caused by service loads are discussed in the ageing guidelines. The common set of the two approach is that the preservation of qualification conditions should be demonstrated by taking account of the alterations caused by ageing processes, and during the management of certain ageing processes that cannot be characterized by quantitative indicators the compliance with the technological and environmental parameters examined during the initial qualification (as the criterion of safe state) should be justified. The normal service conditions are specified in operating instructions of certain systems and equipment, and in the Technical Specifications (TS) for safety important systems.

23 Guideline /65 Version: 2 The operating instructions identify the scope of parameters causing normal service loads like e.g. temperature, pressure, mass flow, properties of operating medium, voltage, current, and self vibration from operation. These parameters are specified for various operating states including the parameters of continuous operation on 100% power, the load changes, operation in stand-by (reserved) state (which is a specially important operating state for redundant and safety systems), and certain examination and test states Deviations from normal service state Deviations from the normal service states as described in paragraph above can occur during the operation of the nuclear power plant. These deviations are usually in connection with the failure of a piece of equipment or a system. Such deviations are e.g.: loss of voltage, loss of venting systems, steam or water blow outs, and inadvertent operation of fire distinguisher system. The earthquakes should be listed here as well. Such states can be defined as deviations from the normal service state, which last for a short period of time, but probably occur, maybe several times during the lifetime of the nuclear power plant. The earthquakes are discussed in detail in paragraph below. The independent discussion of deviations from normal service conditions is important, because the majority of the regulations on sizing of resistance to loads calculate with other permitted limit values and other safety coefficients for normal service loads and for short term loads. The reasonable explanation of this approach is that the loads permitted for such situations cannot cause equipment failure, however subsequent to such events due to their low frequency the operator can verify whether the failures really have not occurred and the unit or the system can be safely re-started Accidents The designer s objectives in connection with the damage caused by the most serious accidents considered in the design, like loss of coolant accident (LOCA), design basis earthquake (SSE) or high energy line break (HELB) are the safe shutdown of the unit, removal of the residual heat and mitigation of accident consequences. Those equipment should be qualified for such loads, which participate in the performance of the above identified function and the function to be performed can be limited as a single operation.

24 Guideline /65 Version: 2 The re-start of the unit and the maintenance of the long-term operability of equipment after the time period calculated from the accident analyses is not required. Harsh environment occurs at the location of the mentioned accident. A key designer task of equipment qualification is to specify the extent of the accident and the design parameters of the assumed harsh environment. If the equipment, instruments have post-accident monitoring or consequence mitigation function, then they should be qualfied for the post-accident state Service loads The normal service, the abnormal and the accident conditions should be identified in the Final Safety Analysis Report (FSAR) based on design service parameters of the nuclear power plant and the analysis of possible (with not negligible probability) event and accident scenarios. The parameters of postulated service and environmental conditions should be verified and if necessary modified during the annual review of the FSAR on the basis of operational experience and results of safety analyses performed during the lifetime of the plant. The consequences of a modification should be enforced during the environmental qualification. In the case of previously performed qualifications it may require the review of qualifications Consideration of equipment type Effect of external and internal loads The equipment type basically affects the sensitivity to environmental and service conditions that were considered during environmental qualification. Besides external, environmental effects the equipment are exposed to internal, technological effects as well. For thermal technology equipment the internal loads are almost always significantly higher than the environmental loads. For electrical equipment the characterizing factors of external environmental effects are clear from the operational experience: the lifetime and the reliability of these equipment basically depend on external environmental conditions. In certain cases the accident situations belong to the design basis of equipment, while in other cases their operability is determined by the conditions occurring during the accident. The mechanical effects entailing assembly of cables can affect the condition of the cable-sheath and isolation. It is especially valid for cables that are

25 Guideline /65 Version: 2 frequently connected and disconnected. Consequently, this above and the fact that the replacement of cables is more difficult than of equipment or instruments requiring the cable should be considered during the design of the layout. The equipment and instruments with short lifetime could be replaced and repaired several times during the lifetime of the cable, which could multiply the effects on the cable due to its frequent connection and disconnection Consequences of structural materials The materials applied in parts of engineering and electric equipment and instruments have important effect. The metals, with a few exemptions are much more resistant to the effect of the external environment than non-metallic elements, especially than organic materials with large molecules. The engineering equipment are generally made of metal, whilst a significant part of the electric equipment is organic material. It is not neglectable also from the viewpoint of environmental qualification that engineering equipment are very carefully sized and verified for effects generated by technological loads (e.g. see the various strength analysis norms). The failure modes and their consequences affect differently on the performance of complete equipment. In general, the failure of non-metal parts of mechanical equipment (sealing, lubricants, packed joints) can lead to degradation of performance parameters at most, but does not result in disfunctionality of equipment; whilst the failure of non-metal parts of electric equipment very often result in total disfucntionality Testability The major part of engineering equipment may be tested during operation for technology generated conditions, which may be identical with accident conditions. The harsh environmental conditions cannot be modeled on electric equipment at their installation location Seismic effects In general, the effects of a seismic event on passive engineering and on certain electric equipment, like on cables, do not result in incompliance with

26 Guideline /65 Version: 2 the permitted loads; however this possibility should be examined for active engineering equipment. In general, the effects of seismic events should be examined for active electric equipment. It is recommended also for hermetic penetrations and connections among the passive components Ageing effects The ageing effects appear differently on metal base materials of mechanical equipment and on non-metal base materials of electric equipment. The most characterizing ageing processes of mechanical equipment are the wear, fatigue, corrosion and erosion of metal parts, whilst the degradation of nonmetal structural materials appears only as secondary effect. The priorities of these aspects are just the opposite in the case of electric equipment Environmental qualification aspects of active engineering components The active engineering equipment fall under the scope of the equipment to be qualified only, if they create a commodity machine group with the electric, and instrumentation and control components, the accident environmental loads of an engineering component cannot be neglected in comparison with normal service loads, the question of their earthquake resistance should be handled. The engineering equipment that are designed with adequate conservatism need less strict, formal qualification requirements, than the safety important electric equipment. It should be taken into consideration during the qualification of mechanical equipment that the sensitivity of metal parts to environmental parameters is generally much less than of parts made of organic material. Consequently, generally enough to demonstrate for these equipment that the parts made of organic material do not lose their operability under anticipated accident conditions. Nevertheless, there are special cases. The time limited analyses of active engineering components require to perform environmental qualification as well; especially in those cases when they perform basic safety function or safety function, and any of the design accidents endangers the function by significantly changing the environmental parameters of normal service. Two additional aspects should be also

27 Guideline /65 Version: 2 considered for determining the scope of environmental qualification, thus it should be examined whether the failure of the equipment can hinder the performance of any safety function or whether the equipment is needed if a situation requiring intervention occurs. The active engineering components should be qualified for environmental conditions generated by LOCA, flooding or high energy line break, if they create worse environmental conditions than of the service state. If the engineering equipment forms a machine group with an electric machine, it is equipped with electric or electronic sub-units, parts in one casing, then environmental effects that are worse than the service conditions should be postulated in situation when the LOCA or high energy line break generates real environmental effects. Such components would be pumps and valves. If erosion, corrosion and chemical effects belonging to the normal operation and endangering the safety function do occur, then they should be taken into account in the ageing management programme. The existence of erosion, corrosion and chemical effects should be examined for active engineering components performing safety function, even if the function is not endangered by design basis accidents through changing of environmental parameters. (Such components would be pumps valves). If such effects exist, then an ageing management programme that takes them into account should be implemented. If the environmental loads of an engineering component can be neglected in comparison to normal service loads, then the ageing management programme should consider the normal operation only Environmental qualification aspects of building structures Environmental qualification should be performed for structures containing harsh conditions, if their failure under such conditions hinders the performance of the safety function necessary for the management of the event Degradation processes consideration of ageing effects A critical element of environmental qualification is the evaluation of the degradation mechanisms caused by operational and environmental conditions occurring during normal service.

28 Guideline /65 Version: 2 The actual FSAR should include the residual lifetime of selected components and environmental conditions of the facility. The collection of trends of weather data is important for the evaluation of environmental tendencies. Such data are the number of warm days, daily average temperatures, and temperature and flow rate values of natural cooling waters. If significant ageing process limiting the lifetime is identified on equipment, then it should be taken into account in the environmental qualification programme of equipment and during the determination of the qualified lifetime. The following effects may cause smaller or greater loads: environmental temperature, pressure, relative humidity, steam and its condensation, chemical effects, irradiation, vibration effects, (number of) service cycles, electric voltages, over-voltage waves. If the equipment do not fall under the scope of environmental qualification (see the definition), and significant ageing factor cannot be identified, then the simulation of accelerated ageing is not required. However other examinations depending on other aspects of the qualification may be necessary. The progress of identified ageing processes can be followed by in-service function tests, various monitoring methods, during maintenance; for electric components by material testing of isolation materials and cables. The introduction of gentle service modes that slow down the ageing is possible for each piece of equipment. The decrease of temperature, the shielding and the changing of installation location may have significant role in the case of electric components. Where appropriate, ageing management programme decreasing degradation effects should be applied. The venting decreases the thermal effect and the humidity. The distance and shielding walls may protect against radiation effects. The selection of an adequate cable schedule may reduce the thermal, radiological and humidity effects on cables. If necessary the replacement of aged equipment should be decided.

29 Guideline /65 Version: 2 There is no unified ageing management method that is applicable to each component and degradation mechanism, only a few generally applicable steps can be mentioned, which appear in different ageing management programmes. These are as follows: Review of equipment construction. Review of design and applied materials. Specification of technological and environmental loads. Identification of significant ageing processes. Analysis of ageing processes, implementation of ageing tests. Determination of the management method of ageing processes that cannot be managed by tests. Estimation of qualified lifetime. Planning of maintenance, material testing, test and monitoring activities. Specification of non-compliance criteria, planning of replacements. The effect of ageing processes should be taken into account during environmental qualification by testing and during selection of parameters to be examined by testing. These parameters could be characterizing parameters of the above listed effects. If significant ageing effect can be identified in the operational environment of equipment, then accelerated environmental effect simulation (artificial ageing) that is in compliance with the validity period of equipment qualification should be performed during equipment qualification by testing. The types and sequence of tests are prescribed in standards. The effects of ageing processes appear as input data for qualification by analysis. Qualification by analysis is only possible if the component has initial environmental qualification, and it will be operated under milder environmental conditions differing from the initial qualification. The qualification by analysis can be used only for demonstration of compliance whit individually affecting loads (e.g. earthquake, seismic effects). The parameters of conditions occurring during the service period considered during the qualification by operational experience should be compared with