Regulatory Guide 1.118

Rev. 1, Periodic Testing of Electric Power and Protection Systems.

ML13350A279
Person / Time
Issue date:	11/30/1977
Revision:	0
From:	NRC/OSD
To:
References
RG-1.118, Rev. 1
Download: ML13350A279 (4)

U.S. NUCLEAR REGULATORY COMMISSIONRevision INovember 19774REGULATORY GUIDE0.i OFFICE-OF STANDARDS DEVELOPMENTREGULATORY GUIDE 1.118PERIODIC TESTING OF ELECTRIC POWER AND PROTECTION SYSTEMSA. INTRODUCTIONSection 50.55a, "Codes and Standards," of 10CFR Part 50. "Licensing of Production and Utiliza-tion Facilities'" requires in paragraph (h) that protec-tion systems meet the requirements set forth in theInstitute of Electrical and Electronics Engineers'Standard, "Criteria for Protection Systems for Nu-clear Power Generating Stations" (IEEE 279).' Sec-tion 4.9 of IEEE Std 279-1971 (also designated ANSIN42.7-1972) requires, in part, that means be pro-vided for checking the operational availability ofeach protection system input sensor during reactoroperation and includes examples of how this can beaccomplished. Section 4. 10 of IEEE Std 279-1971 re-quires, in part, that capability be provided for testingand calibrating protection system equipment otherthan sensors and indicates when such equipment mustbe tested during reactor operation. General DesignCriterion 21, "Protection System Reliability and Tes-tability," of Appendix A. "General Design Criteriafor Nuclear Power Plants,- to 10 CFR Part 50 re-quires. in part, that the protection system be designedto permit its periodic testing during reactor operationincluding a capability to test channels independentlyto determine failures and losses of redundancy thatmay have occurred. General Design Criterion 18,"Inspection and Testing of Electric Power Systems,"requires, in part, that electric power systems impor-tant to safety be designed to permit periodic testing,including performance of the components of the sys-tem and the system as a whole. The testing should becarried out under conditions as close to design aspractical and should involve the full operational se-Lines indicate substantive changes from previous issue.Copies may be obtained from the Institute of Electrical andElectronics Engineers, United Engineering Center, 345 East47th Street, New York. New York 10017.quence, including operation of portions of the protec-tion system, as well as transfer of power among thenuclear power unit, the offsite power system. and theonsite power system. Criterion Xi. "Test Control."of Appendix B, "Quality Assurance Criteria for Nu-clear Power Plants and Fuel Reprocessing Plants," to10 CFR Part 50 requires. in part, that a test programbe established to ensure that all testing, including op-eratiroal testing required to demonstrate that systemsand c.omponents will perform satisfactorily in serv-ice, is identified and performed.This guide describes a method acceptable to theNRC staff of complying with the Commission's regu-lations with respect to the periodic testing of the pro-tection system and electric power systems for systemsimportant to safety.' It also provides supplementaryguidance to that included in Regulatory Guide 1.32."'Criteria for Safety-Related Electric Power Systemsfor Nuclear Power Plants." regarding the periodictesting of electric power systems. The AdvisoryCommittee on Reactor Safeguards has been consultedconcerning this guide and has concurred in the regu-latory position.B. DISCU..SIONIEEE Std 338-1975, "Criteria for the PeriodicTesting of Nuclear Power Generating Station ClassIE Power and Protection Systems." was prepared bySubcommittee 3, Operations, Surveillance and Test-ing, of the Institute of Electrical and Electronics En-gineers Nuclear Power Engineering Committee(NPEC). IEEE Std 338-1975 was subsequently ap-proved by NPEC on November 7, 1974, and by theIEEE Standards Committee on February 27, 1975.' Systems important to safety are defined in Regulatory Guide1.105. "Instrument Setpoints."I *IUSNRC REGULATORY GUIDES Comment should be nent to the Seceeav ot the Co,,,,rno. US. Nuclear RAe,Lalaryv Commiluton. D.C. Alvren~l~ ODticetitV and ServiceRegulatory Guidei age issued to deletnbe and maite avivlable to the public methods Cm mCch.acceptable to the NRC staf1f of implernemtnr specific partt of the Commtstion'tregtilation$. tO deltieate technqjuet uted by the staff on evutlutong specifc fproteet. The guides ae ,tnuetd in the following ten tiv'ionor postulated aoccitdenS. Of to provide guidance to aplicalnts. Regulatory Guidesare not susnitute" fat tegulatian. and compliance weth them is not trequlred. t. POwer Reactors 6, Productsand solutions ditferent from thase %at Out ' tho guides will b accept. 2. Research and Tts, Reactos 7. Tanmeoit.y;onable iI they prOvide a bast., foe the findings requtlite to the nituanci oa continuance 4. Fuels and Melaltee ict.lt.g .Ociulatttal R euitw4. Em'erO'tmtafl 9, A,,tl,ffutt Reul*e,of a permit or license by the CommmuO*. 5. Maleittat and Plant Protection 10, GencealComments$ and foe impeoveentas In them guide awe encouraged at all Requests for tingle cOpe of issued guides hwfitch may ti revoduceclr or lot placrtimes. and guides will tbe rvisld, in ,o aoccommodate comttients l and mevnt on am automatic dislbutlon lilt lot p.rngle covt'" oa fulute qgutle in soecihicto reflet new rinfoormatoon o r*eperite. This guide wars ftitied at a rasult of divisions dsould be made in wt~ting to the US. Nucleic Regutitoty Commn'non.subetantm@ comments rceitted Plaen the public and additional staff revrtwa. Washington. D.C. 2055S. Attention Deector. Ot, wson oa Document Co,,t'o IEEE Sid 338-1975 is ancillary to IEEE Stds 279-1971 and 308-1974 and includes criteria, require-ments, and recommendations for the development ofperiodic testing programs for electric power and pro-tection systems in commercial nuclear power plants.The criteria and requirements are indicated by theverbs "shall" and "must," and the recommenda-tions are indicated by the verb -should."C. REGULATORY POSITIONThe criteria, requirements. and recommendationscontained in IEEE Std 338-1975 are considered by theNRC staff to be generally acceptable methods for theperiodic testing of electric power and protection sys-tems, subject to the following:1. Section 5 of IEEE Std 338-1975 should besupplemented by the following:"Means shall be included in the design to facili-tate response time testing from sensor input toand including the actuated equipment. Equip-ment used to implement these means shall be in-cluded in the determination of system opera-.tionaf availability."2. The term. .'protective action system." as usedin item (6) in Section 5 of IEEE Std 338-1975 shouldbe understood to mean, collectively, the electric, in-strumentation, and controls portions of those systemsactuated or controlled by the protection system thatare required to implement a protective function.3. Item (7) of Section 5 of IEEE Std 338-1975 listsalternative means of including the actuated equipmentin the periodic testing of protection system equip-ment. The method in which actuated equipment issimultaneously tested with the associated protectionsystem equipment is preferred by the NRC staff;however, overlap testing is acceptable. In addition tothe requirements of item (2) in Section 6. I. completesystem tests should be performed at suitable inter-vals.4. If actuated equipment is not tested during reac-tor operation, in addition to the requirements of items(7)(a),(b). and (c) in Section 5 of IEEE Std 338-1975, it should be shown (1) that there is no practicalsystem design that would permit operation of the ac-tuated equipment without adversely affecting thesafety or operability, of the plant and (2) that testingonly when the reactor is shut down provides a satis-factory test interval.5. Item (8) in Section 5 of IEEE Std 338-1975should be supplemented by the following:"Designs that do not require the use of bypassesin order to test all or part of a safety system arepreferred oyer those that require bypasses."6. The term "safety system"' is used in IEEE Std338-1975 (e.g., item (7) in Section 5). For the pur-poses of this guide, "safety system" should be un-derstood to mean, collectively, the electric, in-strumentation, and controls portions of the protectionsystem; the protective action system; and auxiliary orsupporting features that must be operable for the pro-tection system and protective action system to per-form their safety-related functions.7. Consistent with the provisions of item (2) inSection 6.1 and the first item (1) in Section 6.4 ofIEEE Std 338-1975, item (13) in Section 5 and thelast full paragraph on page II in Section 6.3,4 shouldnot be construed to imply that use of simulated tripsignals inserted in lieu of sensor outputs is preferredover tests that involve perturbing the monitored vari-able (the: same or a substitute process variable). In-strumentation channel tests should include perturbingthe monitored variable wherever practical. Whereverthis is not practical, it should be shown that the pro-posed substitute tests are adequate.Where simulated signals are used, or in other caseswhere protective channels can be effectively by-passed during a test, care should be exercised to en-sure that more channels are n(,: bypassed than arenecessary to perform the test. .he remaining chan-nels (those not bypassed) should provide that safetyfunction consistent with the provisions of Section5(4) of IEEE Std 338-1975.8. Test equipment, methods, and proceduresshould not circumvent any of the provisions of Sec-tion 5 of IEEE Standard 338-1975. Therefore, insteadof item (3) in Section 6.1 of IEEE Standard 338-1975. the following should be used:"(3) Test equipment, methods, and proceduresshall not circumvent the provisions of Section5."9. Instead of item (1) in Section 6.3.1 of IEEE Std338-1975, the following should be used:"M(I) Comparing readings on channels thatmonitor the same variable accounting for anyknown differences in the actual process variablebetween sensor locations."10. Instead of item (5) in Section 6.3.2 of IEEEStd 338-1975, the following should be used:"(5) Testing to verify trip setpoints that are con-tinuously calculated shall be performed to verifyeach variable that enters into computation,While the signals for one or more parameters arevaried to achieve tripping or change in computeroutput, the signals for other variables shall bemaintained at their expected values. Theparameters to be varied shall be selected basedon expected accident conditions."11. Section 6.3.2 of IEEE Std 338-1975 should besupplemented as follows:II1.118-2

"(7) Testing the status and operability of by-passes, bypass indications, and bypass annuncia-tion circuits."(8) Testing the operability of test indicationand/or test annunciation equipment. where ;uchfeatures are provided."12. Section 6.3.4 of IEEE Standard 338-1975states that ,ensors that should be response time testedare:"(1) Those .,ensors whose response time isshown to be critical to reactor safety in thesafety analysis report."(2) Those sensors whose respo;nse time is asignificant part of the overall system responsetime and is expected to suffer response time de-gradation."Section 6.3.4 of IEEE Standard 338-1975 alsostates that "those components comprising a portionof a system whose expected worst case response timeis not a significant fraction of the total overall systemresponse time (less than 5 percent) nec:! not be testedprovided the remaining portions of the system aretested." Testing of the response time of all portionsof the safety system should be performed. consistentwith the requirements of item (7) of Section 5 ofIEEE Std 338-1975. This includes periodic testing ofsensors to determine if their response time is satisfac-tory. Therefore. instead of Section 6.3.4 of thestandard, the following should be used:"6.3.4 Response Time Verification Tests.Safety system response time measurements shallbe made periodically to verify the overall re-sponse time (assumed in the safety analysis ofthe plant) of all portiors of the system from andincluding the sensor to operation of the actuator."Where it is not possible to -",,Aude sensors inin-plant individual or system response time tests.the sensors shall be periodically removed fromtheir normal installations and tested. When thisis. aecessary, the test installation shall duplicateas nearly as possible the expected environmentand mechanical configuration of the actualinstallation."For channel testing, not including sensors, testequipment shall include that necessary to simu-late sensor output over its full range and simul-taneously record input and output conditions fordetermining the overall response time. The testinput should span the normal trip setpoint suffi-ciently to reset the channel for the untrippedcondition and ensure complete tripping for thetripped condition."For protection tripping functions where two ormore variables enter into the tripping action (forexample, the trip point is computed from tem-perature. differential pressure. and nuclear fluxsignals), the channel response time shall be ver-ified using each of the variables to produce thetripping action. During this tripping action, thetest signals for the remaining variables shall beadjusted to within their expected operatingrange, but to a value tha! will produce conserva-tive test results."The response time test shall include as much ofeach safety system. from sensor input to actuatedequipment. as possible in a single test. Wherethe entire set of equipment from sensor to ac-tuated equipment cannot be tested at once. ver-ification of system response time may be accom-plished by measuring the response times oifdiscrete portions of the system and showing thatthe sum of the response times of all portions isequal to or less than the overall system require-ment.*'Response time testing of all safety systemequipment per se is not required if. in lieu ofresponse time testing, the response time ofsafety system equipment is verified by functionaltesting and/or calibration check!; where it can bedemonstrated that changes in response time be-yond acceptable limits are always accompaniedby changes in performance characteristics thatare detectable during these routine periodic func-tional tests and/or calibration checks."13. For neutron detectors ( I ) tests of detector-cableassemblies for increased capacitance, (2) monitoringof noise characteristics of neutron detector signals. or(3) some other test that does not require removal ofdetectors from their installed location should be usedto confirm neutron detector response time characteris-tics to avoid undue radiation exposure of plant per-sonnel unless such tests are not capable of detectingresponse time changes beyond acceptable limits.14. Section 6.4 of the IEEE Std 338-1975 shouldbe supplemented by the following:"Test procedures for periodic tests within thescope of this standard shall not require jury rigtests setups. the use of temporary jumper wires,the removal of fuses, or the opening of breakersexcept as follows:"a. Temporary jumper wires may be used withportable test equipment where the safety systemequipment to be tested is provided with facilitiesspecifically designed for connection of this testequipment. These facilities shall be consideredpart of the safety system and shall meet all therequirements of this standard, whether the porta-ble test equipment is disconnected or remainsconnected to these facilities."b. Removal of fuses or opening a breaker ispermitted only if such action causes (I) the trip1.118-3 IIof the associated protection system channel or(2) the actuation (startup and operation) f(l theassociated Class IE load group."15. In addition to periodic tests to determine if sat-uration is occurring, it is important tO determine, atsuitable intervals, if foldover will occur. Foldoveroccurs when an output signal. which normally in.creases with increasing input, changes to a decreasingsignal, or conversely for a normally decreasing sig-nal. Accordingly. the example in the last iten (3) ofSection 6.4 of IEEE Std 338-1975 and the example inSection 6.3.3 should be construed to include foldoveras follows:a. In Section 6.4:"'(for example. by saturation of foldover)."b. In Section 6.3.3:"(for example, the bistable trip did not occur a.the required s'tpoint, the analog output was outof tolerance, or saturation or foldover was ob-served)..."16. Test intervals, both initial and revised, shouldhe such that significant changes in failure rates can bedetected before multiplc faiiures occur. Accordingly.Sectiuns 6.5.1 and 6.5.2 should be supplemented asfoII o w s:UNITED STATESNUCLEAR REGUL'TORY COMMISSIONWASHINGTUN. 0. C, 20555OFFICIAL BUSINESSPENALTY FOR PRIVATE USE. S30Oa. In Section 6.5.1 add item (8):"'(8) Detection of significant increases in failurerates before multiple failures occur.b. In Section 6.5.2 add item (5):'(5) Detection of significant increases in failurerates before multiple failures occur.D. IMPLEMENTATIONThe purpose of this section is to provide informa-tion to applicants regarding the NRC staff's plans forusing this regulatory guidc.Except in those cases in which the applicant pro-poses an acceptable alternative method for complyingwith specified portions of the Commission's regula-tions. the method described herein will be used in theevaluation of submittals in connection with construc-tion permit applications docketed after January !,1978.If an applicant wishes to use this regulatory guidein developing submittals for applications docketed onor before January I, 1978. the pertinent portions ofthe application will be evaluated on the basis of thisguide.POSTAGE ANO FEES PAIDU.S. NUCLEAR REGULATORYCOMMISSION