4-13v2 Eng

Hungarian Atomic Energy Authority
Guideline 4.13
Environmental qualification and maintenance of the qualified state of equipment in operating nuclear power plant
Version number: 2. 2007 March
Issued by: Jzsef Rnaky PhD, director-general Budapest, 2007 March
The publication can be purchased from: Hungarian Atomic Energy Authority Nuclear Safety Directorate Budapest
PREAMBLE
The legal hierarchy of nuclear safety regulations in Hungary is as follows: 1. The uppermost level is represented by the Act CXVI of 1996 on Atomic Energy (Atomic Act). 2. The next level basically consists of two government decrees issued as executive orders of the Atomic Act. The 114/2003. (VII.29.) Korm. government decree defines the legal status of the Hungarian Atomic Energy Authority (HAEA), while the 89/2005. (V.5.) Korm. government decree specifies the HAEAs generic procedural rules in nuclear safety regulatory matters. The nuclear safety code consists of seven volumes, which are issued as the annexes of this latter decree. The first four volumes address the NPP, the fifth one the research and training reactors, whilst the sixth volume addresses the spent fuel interim storage facility. These six volumes determine the specific nuclear safety requirements, whilst the seventh volume contains the definitions applied in the code. The regulations are mandatory; failing to meet any of them is possible only in those specific cases that are identified by the decree. 3. The regulatory guidelines constituting the next level of the regulatory system are connected to one of the volumes of the code. The guidelines describe the method recommended by the proceeding authority for meeting the requirements of the nuclear safety code. The guidelines are issued by the director general of the HAEA, and they are regularly reviewed and reissued based on accumulated experience. So as to proceed smoothly and duly the authority encourages the licensees to take into account the recommendations of the guidelines to the extent possible. 4. In addition to the described regulations of general type, individual regulatory prescriptions and resolutions may also address specific components, activities and procedures. 5. The listed regulations are obviously supplemented by the regulating documents of other organizations participating in the use of nuclear energy (designers, manufacturers, etc.). Such documents are prepared and maintained in accordance with the internal quality assurance system of the user.
Before applying a given guideline, always make sure whether the newest, effective version is considered. The effective guidelines can be downloaded from the HAEA's website: http://www.haea.gov.hu.
Guideline 4.13 4/57 Version: 2 Environmental qualification and maintenance of the qualified state of equipment in operating nuclear power plant
TABLE OF CONTENTS
1. INTRODUCTION 1.1. Subject and objective of the guideline 1.2. Corresponding laws and prescriptions 2. DEFINITIONS 2.1. Abbreviations 3. RELATION OF ENVIRONMENTAL QUALIFICATION WITH OTHER PROGRAMMES 6 6 7 8 13 14
4. QUALIFICATION OF OPERATING EQUIPMENT 17 4.1. Organizational conditions for realization of qualification programme 17 4.1.1. Organization responsible for establishment of qualification requirements 17 4.1.2. Organization responsible for meeting the qualification requirements 19 4.1.3. Organization responsible for verification of meeting the qualification requirements 19 4.2. Initial conditions of development of the environmental qualification programme 19 4.2.1. Assessment of environmental circumstances 19 4.2.2. Service conditions 22 4.2.3. Scope of equipment to be qualified 23 4.2.4. Identification of the existing qualification documentation 25 4.3. Requirements and methods of modern environmental qualification 25 4.3.1. Qualification by testing 26 4.3.2. Qualification by testing material tests 27 4.3.3. Qualification by analysis 29 4.3.4. Consideration of operational experience 30 4.3.5. Selection of the qualification method 31 4.3.6. Application of the Space method 32 4.4. Execution of environmental qualification programme 33 4.4.1. Elaboration of the environmental qualification programme 34 4.4.2. Assessment of the actual status of qualification 36 4.4.3. Documentation of qualification 37 4.4.4. Evaluation of the actual status of qualification 40 4.4.5. Supplement of missing qualification 41
4.4.6. Measures in case of losing qualification 5. MAINTENANCE OF THE QUALIFIED STATE 5.1. Functional tests 5.2. Monitoring 5.3. Diagnostics 5.4. Reliability of data of diagnostics and monitoring systems 5.5. Maintenance 5.5.1. Harmonization of maintenance and results of environmental qualification 5.5.2. Maintenance of active components 5.5.3. Measures to be taken if insufficient maintenance 5.6. Condition monitoring 5.7. Trend analysis of failures 5.8. Equipment modifications and design modifications 5.9. Feedback of operational experience 5.10. Repair and replacement 5.11. Extension of the qualified lifetime
43 43 46 47 49 49 49 50 51 51 52 52 53 53 54 55
1.
INTRODUCTION
1.1. Subject and objective of the guideline

The activity aiming at maintaining the qualified state postulates the existence of the required initial qualification of equipment. The initial qualification is discussed in Guideline 3.15. The subject of this guideline is the environmental qualification of electric, instrumentation and control and certain active engineering components and of certain structures. Their qualification is not a single action, but it lasts during the whole lifetime of equipment through the maintenance of the qualified state. The design requirements of nuclear power plants built in accordance with former standards do not include the requirements for initial qualification of safety equipment; therefore the activities connecting to the demonstration of environmental qualification and the correction of revealed deficiencies should be performed simultaneously with the activities connecting to the maintenance of the qualified state, and if the replacement of equipment and instruments become necessary then with the environmental qualification tasks of the new components. This guideline describes how the above mentioned complex activities should be executed. The objective of the guideline is to describe recommendations, which facilitate to execute those activities that support: the making up for the missing qualification of installed equipment, subsequently, the maintenance of the qualified state and the validity of existing qualifications, or if those above cannot be fulfilled, then the implementation of the necessary measures. This guideline describes a possible method for being in compliance with the regulations of Volume 4 of Nuclear Safety Code. The licensee may fulfill the referred regulations in a way other than described in this guideline. However, it should be justified in this case that the chosen approach ensures solutions equivalent to this guideline.
1.2. Corresponding laws and regulations

Pursuant to the paragraph 7.003 of Chapter 7 of Volume 4 of Nuclear Safety Code (NSC) issued based on the authorization of section 4. (1) of the Gov. decree 89/2005. (V.5.) Korm on the generic rules of procedures of the Hungarian Atomic Energy Authority in nuclear safety regulatory matters, the specified operating limits and conditions are required for maintaining the qualified state of equipment having environmental qualification. The compliance with limits and conditions is a necessary, but not sufficient condition of that the components complete their qualified or service lifetime in the facility. The Chapter 8 of the Code discusses the detection of deviations, monitoring of their variations in time and the requirements for documented maintenance. The Chapter 18 prescribes the feedback of operational experience in order to evaluate the design and expected residual lifetime of the components.
2.
DEFINITIONS
Active components: Components fulfilling their safety function with moving parts or by changing their shape or properties. Design lifetime of a nuclear power plant unit: Lifetime that is taken into account during the design of the nuclear power plant unit, for which the safe operability is justified by the facility safety report. Identical part, structural element, component: The part, structural element or component is identical, if all of its properties (material, geometry, mode of operation, environmental resistance, reliability, mode of fabrication, type, etc.) are the same as those of the original one. Equipment qualification: The demonstration of that the safety classified equipment of the nuclear power plant can fulfill their design safety function during their whole lifetime. Various qualifications are exist: environmental qualification, seismic qualification, fire resistance qualification, electromagnetic compatibility qualification, etc. The maintenance of performance parameters necessary for ensuring the functionality and for achieving the safety function should be justified both under normal conditions (including: designed special service states), and under conditions taken place in the case of deign basis events. The equipment qualification should take into consideration of the ageing effect of environmental and operational circumstances occurring during the lifetime of the equipment. The process of equipment qualification includes the measures connecting to both achievement and maintenance of the qualified state. Safety analysis: Examinations and tests to be performed in order to evaluate whether the safety of systems, structures and components of a nuclear power plant comply with the requirements.
Lifetime: Lifetime specified during design; besides the design lifetime, the service lifetime, which means the period between installation and disassembly, can also characterize certain equipment. Earthquake: OBE, SL-1 - Design earthquake During and after the design earthquake the plant operates undisturbed or shuts down, but it can be restarted after (or even without) the accomplishment of certain tests. This American definition is identical with the SL-1 earthquake as defined by the IAEA. SSE, SL-2 - Maximum design earthquake The largest earthquake in the case of which the plant can be safely shut down, and maintained in shut down state without release of any radioactive material. This American definition is identical with the SL-2 earthquake as defined by the IAEA. Similar part, structural element or component: A part, structural element or component is similar, if the safety analysis approved by the authority has justified that it is equivalent to the original one. Authentic data: Information compiled and documented in an understandable and followable manner, which provides the opportunity for independent reviewing the deductions made and conclusions drawn. Such data are the manufacturers technical descriptions, testing records and analyses, etc. Maintenance: Activities performed on nuclear power plant systems, structures and components that aim at guaranteeing that they can reliably and economically fulfill their function as designed within the design lifetime of the unit. Two types of maintenance activities are distinguished as follows: preventive maintenance, corrective maintenance, i.e. repair.
The preventive maintenance consists of cyclic maintenance (independently of the actual condition; its scope, method and frequency is specified on the
basis of experience and prescriptions) and condition dependent maintenance (its scope, method and duration is determined based on changing of measured or observed parameters). The corrective maintenance is to be accomplished because of the occurrence of a failure. The scope, method and time point of the repair is dependent on the extent and nature of the failure. Maintenance programme: Long term plan of maintenance activities to be performed on certain systems, structures and components, which plan is developed for maintaining the design function of systems, structures and components, and for preventing and avoiding the safety consequences of failures. Initiating event: Such event resulting in deviation from the designed service states, which occurs due to technical reasons inside the facility, the intervention of personnel, or due to artificial or natural effect originating from the outside environment, and which may lead to anticipated operational occurrences, design basis accidents or severe accidents. Environments: The following environmental conditions are reasonable to be distinguished in a nuclear power plant: Mild: environmental conditions appearing during normal operation of the nuclear power plant that do not alter significantly if an accident (including abnormal operating states) occurs. Harsh: environmental conditions appearing during a design basis event (DBE) of the nuclear power plant that alter significantly in comparison with those appearing under normal service /such events are LOCA, HELB, MSLB/. Degraded: service conditions that altered in comparison with the initial environmental conditions or with those that were considered during the initial qualification (higher temperature, humidity, radiation, fungus, etc.).
Environmental resistance qualification or environmental qualification: Determination of resistance to environmental and service conditions ensuing during the lifetime of the equipment. This is the environmental part of the equipment qualification. The validity period of equipment qualification is
specified during the qualification by the simulation of the service environment. Qualification: Evaluation of the applicability of organizations, persons and/or tools for performing activities relating to the safety of the nuclear facility, and for fulfilling functions in order to support the decision to be made on their approval. Maintenance of the qualified state: In the case of certain types of equipment and instruments, the process of environmental qualification is followed by the accomplishment of a programme, which ensures the long-term maintenance of operational environmental parameters, environmental effect parameters and other conditions that were taken into account during the qualification. The control of monitoring the environmental parameters that are necessary for demonstration of the maintenance of the qualified state of equipment is performed during the process of Monitoring of Maintenance Effectiveness. Qualified lifetime: That lifetime of components during which the component, based on the preinstallation qualification procedure is (certified) able to fulfill its design function during the necessary time-period even under such physical circumstances, which do or might appear in the environment of the component during fulfillment of the safety function. Qualification margin: Difference between the actual service parameters and those parameters belonging to conditions (that are more rigorous than the actual service conditions) postulated during equipment qualification. Normal service: Such operation of the nuclear facilities during which the operational limits and conditions approved by the authority are complied with; including load changes, shut-down, start-up, refueling, maintenance, test, etc. Ageing: Effect of operational, environmental and technological conditions on equipment that result in occurrence and further development of degradation mechanisms during a certain period of time, which conditions are within the design basis accidents (but do not include them).
Ageing management: Series of those analysis, operation, maintenance, in-service inspection and testing, monitoring, repair and reconstruction activities related to degradation processes c a u s e d by ageing identified on designated components of the nuclear facility, which activities ensure that the component remains able to fulfill its function with the maintenance of the minimum necessary safety margin. Passive component: Those components, which perform their design safety function without moving parts and changing their shape or properties. (General examples of passive safety functions are included in the Annex of Guideline 4.14.) System: Entirety of components serving for fulfillment of a given function. Component: A unit performing individual sub-function of a given function (e.g. equipment, instrument, piping, building structure). Significant ageing process: Damage caused by such a degradation process, as a consequence of which the equipment, under normal and abnormal service conditions, become responsive in a more and more serious and observable manner with regard to its function to be performed during a design basis event. Seismic classification: Categorization of systems, structures and components of nuclear facilities in relation to their role in prevention of the safety of the facility during an earthquake. Design basis: Those attributes of a nuclear facility, the existence of which is required for the controlled management of anticipated operating events and postulated accidents by complying with the specified radiation protection requirements. The design basis includes the anticipated service states and the accident conditions generated by postulated initiating events, the significant assumptions and in certain cases the specific analysis methods as well. Those anticipated operating events belong to the design basis, which can be derived from the postulation of the lack of a safety actuation.
2.1. Abbreviations
PSRR NSC SSC FSAR Periodic Safety Review Report Nuclear Safety Code System, structure and component Final Safety Analysis Report
3.
RELATION OF ENVIRONMENTAL QUALIFICATION WITH OTHER PROGRAMMES

The nuclear power plants are designed for meeting the prescribed nuclear safety, radiation protection and technical safety objectives during their operation. Those safety functions are specified, the performance of which ensures the meeting of these objectives. The safety functions are performed by systems, and their components. These systems, structures and components (SSCs) perform their safety function through their availability and through their operation according to a given performance parameter. During the operation of the nuclear power plant the licensee should continuously demonstrate the ability to perform the required safety functions (including the performance capability according to required performance parameters) in the following scope: SSCs performing safety function(s) (SC 1-3), SSCs not performing safety function, but their failures risk the safety function. This demonstration can be made through safety analyses, environmental (environmental resistance) qualification, implementation of ageing management programmes, monitoring of the maintenance effectiveness, and through their joint and harmonized realization (see Figure 1). The licensee should decide on the method to be applied, with the limitation that environmental resistance qualification should be performed for electric, instrumentation and control components operating in harsh environment, ageing management should be realized pursuant to Guideline 4.12 for equipment listed, ageing locations and degradation processes identified in the Annex of Guideline 1.26.
ACTIVE and PASSIVE

Objective: To justify by analysis that - the given piece of equipment (material, construction) - under the given circumstances (environmental parameters, loads) - during the specified period is able to fulfill the required function
DESIGN BASIS
SAFETY ANALYSES
TLSAs EQ
Ageing management - Preventive programmes - Mitigating programmes - Condition monitoring ISI, TRP, MAINTENANCE Individual ageing management programmes
Objective: To demonstrate equipment functionality through - harmonized realization of existing programmes (material testing, TRPs, maintenances), - development and implementation of necessary individual programmes
Maintenance effectiveness monitoring (MEM)
MAINTENANCE
Objective: To justify that the SSC, by effective maintenance, is able to fulfill the required function and to operate according to specified parameters
ACTIVE and PASSIVE
ACTIVE
Figure 1 Demonstration of the ability to fulfill safety functions and to comply with the required performance parameters (SC 1-3 +)
Safety analyses: the safety analyses should justify that
the given piece of equipment (material, construction, etc.), under the given circumstances (environmental parameters. loads, etc.), during the specified period is able to fulfill the required function. The time limited safety analyses are able to justify this for a period of time limited by taking account of ageing processes of components, altering loads expected during operation or of parameters occurring during an design basis accident that the component will be able to perform its safety function. Environmental analysis qualification: The limits of resistance ability against environmental, operational and accident circumstances occurring during the lifetime of equipment are specified during the environmental or (with other words) environmental resistance qualification. The validity period of environmental qualification is calculated by the simulation of the operating and accident environment. The qualification is valid, if the long term preservation of operating and accident environmental parameters and other conditions considered during the qualification, thus the maintenance of the qualified state is continuously justified and ensured. Besides this guideline, the Guideline 1.27 and Guideline 3.15 include recommendations with respect to environmental resistance qualification. If the safety analysis or the environmental qualification is valid for limited period of time, then the suitability of a component is justified for a limited time period. In such cases the further suitability of a given component should be qualified prior to the end of the limited period or it should be replaced by an element having qualification. Ageing management: The design aims at preventing the appearance of ageing processes, however several such effects occur on the SSCs, which may adversely affect the performance of their function. The objective of the ageing management programme is to identify all ageing processes postulated to occur on the given component, and to minimize their negative effects. In certain cases the monitoring of the condition and condition changing of the given component could be sufficient. The recommendations regarding ageing management are included in Guideline 1.26, Guideline 3.13 and Guideline 4.12.
Monitoring of maintenance effectiveness: The monitoring of maintenance effectiveness means the monitoring of all the results of such activities, which play role in the preservation of the required level of functionality of components. The general objective of monitoring of maintenance effectiveness is to justify that the executed maintenance activities can ensure the compliance with the maintenance objectives defined for systems and components subject to maintenance or the implementation of the necessary corrective measures. Beyond the identification and correction of actual and possible failures, the maintenance includes such support activities like the in-service inspections, tests and exercises, the evaluation of maintenance results and monitoring of the compliance with maintenance criteria. The recommendations with respect to the monitoring of maintenance effectiveness are included in Guideline 1.19 and Guideline 4.5. If the licensee intends to demonstrate the suitability of the SSC through environmental resistance analysis, then recommendations are given in this guideline. Further recommendations regarding environmental resistance qualification can be found in Guideline 1.27 and Guideline 3.15.
4.
QUALIFICATION OF OPERATING EQUIPMENT
4.1. Organizational conditions for realization of qualification programme

4.1.1. Organization responsible for establishment of qualification requirements The environmental qualification requirements should be basically determined by the designer; it should have been elaborated during the design phase of the nuclear power plant. During the development of the original design the comprehensive environmental qualification documentation was not elaborated for formerly built nuclear power plants. An additional specialty is that due to development of design and operational experience and to other reasons the plant implements a significant (relating to its safety significant part) safety improvement modification programme. The tasks resulting in the provision of design input data for environmental qualification can be grouped as follows: organization of equipment to technological and safety systems, establishment of the technological, protection, control, etc. links,
categorization of equipment to safety classes, evaluation of safety analyses in order to specify the environmental conditions and required performance parameters occurring during normal service, abnormal operation and accident states, more accurate specification of design input data based on operational experience. The above listed tasks may be executed by the operating organization with external designer(s), however the verification and approval of the design input data is the absolute responsibility of the licensee. The determination of environmental qualification requirements does not require, however does not exclude either the establishment and operation of an independent organizational unit (persons) entrusted with this task. The task should be reasonably managed within the organization coordinating the design and planning with the involvement of engineers responsible for maintenance. The following requirements should be met by the organization responsible for determining the requirements: It should be aware of the documents specifying the input data of environmental qualification; it should have possibility to compare them, to analyze the differing or contradictory data, to determine the authoritative input data. It should elaborate and maintain the environmental qualification specification regarding the entire plant. It should be informed about the scientific-technical development and the environmental qualification related operational (service and maintenance) experience accumulated at the plant (including the analysis of operational experience of other plants). It should have available resources for executing analyses, experiment and measurements necessary for more accurate specification of environmental qualification requirements. It should be informed about modifications that are planned at the plant; it should have capabilities to enforce the environmental qualification aspects in the course of the connecting purchase, installation, commissioning and operation activities.
4.1.2.
Organization responsible for meeting the qualification requirements The maintenance of adequate qualified state of equipment requires such design, analysis, fabrication, purchase, assembly, operation, maintenance, in-service inspection, etc part activities, which are achieved by the executors of the given activities during their normal work. In such sense an independent organization responsible for meeting the qualification requirements should not be necessary. The meeting of the environmental qualification requirements should be ensured in the relating work instructions.
4.1.3.
Organization responsible for verification of meeting the qualification requirements The grounding of qualification and the maintenance of the qualified state (altogether, with other words: equipment qualification) is such a process, which lasts from the design to the removal of equipment. Accordingly, it is justified to assign such organizational unit or person(s), whose duty is the verification of the meeting of environmental qualification requirements during the whole lifetime of the equipment.
4.2. Initial conditions of development of the environmental qualification programme

The results of activities conducted by designers and manufacturers of equipment and the equipment safety classification serve as input data for that process during operation, which monitors the environmental qualification conditions of the equipment, by taking account of alterations resulted by implemented modifications, operational and maintenance experience, condition monitoring, failure analyses, in-service tests and other activities. The monitoring of alterations should be conducted parallel to the supplement of the required information or if it is missing to guaranteeing the operational safety. The activities relating to the compilation of initial conditions are as follows: 4.2.1. Assessment of environmental circumstances During the design of the nuclear power plant the equipment and systems are sized for tolerating various, postulated events.
Due to design basis accidents, the environmental circumstances of certain equipment of the nuclear power plant significantly alter, whilst no or not significant change occurs on other equipment. Those regions/rooms should be pointed in the nuclear power plant, where the accident conditions result in significant change of environmental loads. Those equipment, which are installed in these regions and the operability of which during accident is required by the safety analyses should be considered as equipment to be qualified for operation under harsh conditions. The other safety equipment should be qualified for mild environment. The environmental conditions of certain equipment should not be characterized by the step function between the two extremums (mild and harsh). Consequently, the detailed analysis of environmental conditions is the source of all concrete information making the qualification conditions more precise. The events having role in generation of environmental conditions should be assessed at least in the extent of initiating events analyzed in the Final Safety Analysis Report (FSAR). The environmental conditions of rooms falling under the effect of DBE events and of those not falling under such effect. Beyond the initiating events identified in the FSAR, the effect of other environmental conditions (see examples below) affecting the equipment operability should be analyzed by taking account of the single failure criterion: fungus generation, internal flooding, electromagnetic effects. The possibility of damages caused by rodents in outside regions of the facilities should be taken into consideration. Determination of performance parameters in the case of failure of various equipment and loss or output reduction of support systems (e.g. with the failure of venting and air conditioning systems), and the effect of deviation regarding failure, output or efficiency of certain components (sealing, heat insulation) affecting environmental parameters.
The duration of harsh conditions and the operating time required under given circumstances should be carefully analyzed for equipment to be qualified for harsh environment. The deviation of environmental parameters may be smaller (e.g. in the case of an interface LOCA than of main circulating pipeline break), however the duration of events, and consequently the required time of functionality of certain safety equipment may be much longer. It is similar to the mitigation of beyond design basis accidents, and to the determination of qualification conditions of equipment serving for condition monitoring. The postulation of mild environmental parameters should mean the analysis of a possible alteration range of parameters, in which the conduction of a formal environmental qualification procedure does not result in significant contribution to increasing the anticipated operability of equipment. The maintenance of the reliability of equipment operating under such circumstances may be sufficiently ensured by: conservative design practice, demonstration of mild nature of DBA conditions, assurance of adequate quality of fabrication, assembly, operational and maintenance processes, investigation and analyses of failures. This approach simultaneously brings with itself that the in-service failures of equipment are resulted generally by individual, human, process and material failures, which cannot be revealed by equipment qualification methods. In the range of harsh environmental conditions, the previously mentioned measures are necessary, but they are not able to guarantee the reliable operation of equipment under DBA conditions. Certain accident conditions cannot be simulated during tests prior to operation (commissioning) and during in-service tests. At the same time the harsh environment causes such change of external parameters, which leads to change of properties of materials used in equipment (e.g. with increasing temperature the mechanical and electrical properties of certain materials are changing; moreover if the parameters changes occur simultaneously, then new failure mode may appear). The environmental qualification aims at preventing such possible failures.
A specific area of qualification is the seismic qualification, the specialty of which is that the resulted harsh environmental conditions affect all equipment of the nuclear power plant. The seismic qualification is a part of the general process of qualification, its separate management is not adequate. The standardized practice follows the sequence of ageing earthquake harsh environment, where the ageing is the simulation of ageing affects of service environment. The seismic qualification should be only performed on aged equipment. Adequate qualification margins prescribed in standards should be required during environmental qualification. The qualification margin means the difference between environmental parameters applied or postulated during initial environmental qualification and those actually expected at the installation location of equipment. The design conservatisms and the applied safety factor may also result in margins. The application of statistical approach is not recommended, since it should be postulated that the unqualified equipment do not live through the harsh conditions, even with statistical probability. The harsh environment should be simulated. In the case of non-harsh environments, if significant ageing factor exists, then the environment should be simulated according to the validity period of qualification. Nevertheless, the realistic evaluation of results requires considering that only a few specimens are really tested during the initial environmental qualification, since the quantitative testing of statistically sufficient number of specimens make the qualification process unreasonably expensive. 4.2.2. Service conditions The service conditions are determined by operational and environmental conditions together. These conditions due to various reasons may alter between certain extremums. The knowledge of service conditions is required both for specification of mild environmental parameter range to be considered during equipment qualification and for identification of ageing induced degradation processes of equipment. The specification of anticipated service conditions is possible only with limited accuracy during the design because of: equipment failures, condition degradation,
modifications. The most reliable method for considering these possible effects is: the real verification of parameters important to environmental qualification during operation, in different service modes and under various environmental (e.g. weather) conditions. The instrumentation and control equipment should be distinguished during the implementation of environmental qualification and ageing management programmes in relation with environmental conditions under which and the room in which they operate. The consideration of categorized environmental conditions may provide significant advantages during the initial qualification (or if it misses, then during its supplementation) of equipment and instruments operating in various premises. The greatest attention should be paid to components operating in harsh environment. The environmental qualification related management of the table of operational parameters (the entire list of parameters to be monitored, and the method for processing, etc.) should be practically conducted by the organization or person(s) responsible for specification of qualification requirements. 4.2.3. Scope of equipment to be qualified In accordance with up-to-date requirements, such environmental qualification specification should be compiled during the design of the nuclear power plant, which at least identifies: the scope of equipment to be qualified, the service and accident conditions to be considered in relation with qualification, the qualification methods to be applied, and the criteria of environmental qualification. Such requirements did not exist for formerly designed nuclear power plants; therefore equipment qualification list was not compiled. During the identification of equipment to be qualified, those should be selected, the operation of which is required during a design basis accident, and which, based on their location, are under harsh environmental conditions during the given period due to the accident situation to be mitigated.
The selection of components falling under to scope of environmental qualification are discussed in Guideline 3.15 and in Chapter 3 of this guideline (SC 1-3+). Special attention should be paid to those functions, the loss of which affects the environmental conditions of the operation of that given piece of equipment or others. Care should be taken for the maintenance of the qualified state of structures being boundary of harsh conditions, if their failures under such conditions can hinder the fulfillment of the safety function necessary for event management. The environmental qualification should be achieved on system level on equipment basis; accordingly the applied equipment are qualified and then it is postulated that qualification of the systems consisting them is also demonstrated. The adequacy of this assumption always should be carefully assessed. The identification of the boundary of a system and its components is important in order to understand the role of sub-units, which can be individually assembled in the traditional sense, but are connected to each other from electrical and functional viewpoints of operation. The breaking electric component, so the breaker or the fuse is the component boundary for motor operated components (valves, pumps). The high current cables may belong to a component if they supply only that one, or may be handled individually if they supply more components. The transformers connecting different voltage levels should be considered as system boundary, as a part of the system. A certain assembly unit should mean the boundary; and if such identifier system exists for registering components that includes the assembly units, then it should be followed during the identification of boundaries. The equipment used for different function having different identifiers, but operating in similar environment and having similar construction should require totally uniform qualification activity. This fact should be taken into account during the recording of the environmental qualification and organization of the relating databases. Those equipment should be taken into a common qualification package of the environmental qualification programme, for which the uniform type and identical normal service and accident environmental conditions could be justified.
Sometimes, by taking account of the establishment (including the design) circumstances of formerly built nuclear power plants, the precise specification of the normal service environmental parameters are not sufficiently documented; therefore this deficiency should be considered during the identification of the scope of the environmental qualification programme. 4.2.4. Identification of the existing qualification documentation Specific environmental qualification documentation was not prepared for formerly built nuclear power plants. However, general and equipment specific prescriptions including certain requirements were effective, and the manufacturer documents of certain equipment are also available, in which environmental qualification information can be found. The equipment specific analysis of the differences between the information of former documents and the requirements of the modern regulations should be achieved for the specification of actions necessary for reaching the environmental qualification level pursuant to modern requirements.
4.3. Requirements and methods of modern environmental qualification

The assurance of the quality of installed equipment of nuclear power plant in service can be divided into two phases: establishment of qualification requirements, assurance of quality. The establishment of qualification requirements demands those available qualification systems for equipment having different functions and installed in different environment, the adequate implementation and positive results of which provide the qualification of a given equipment(type) to certain accident environmental conditions. It should be verified during the plant specific analysis that the accident environmental parameters expected to occur in a given installation location do not exceed the limits of toleration of the given equipment as justified by the appropriate methods. If the qualification reveals a degradation process progressing in time and existing under given environmental conditions and parameters, then the equipment have a limited lifetime that can be characterized by the number of operating cycles or a period of time.
The possible tools of qualifications are: testing, analysis, operational experience, and their combinations, and processing of information collected during maintenance. Nevertheless, the different qualification methods can be applied to different cases; each method has its advantages, disadvantages and application limits. 4.3.1. Qualification by testing The qualification characteristics of equipment should conditions, during be demonstrated. by testing aims at demonstrating the performance an equipment group. The selected specimen of the be tested in the appropriate sequence of environmental which its operability and performance indicators should
The testing is the most reliable method from environmental qualification point of view. Any operating condition may be modeled during testing (including ageing as well), and also the accident conditions with the required margins. Not only the performance indicators of the equipment can be demonstrated during testing, but the environmental conditions to be provided by the support equipment and systems. Nevertheless, the testing results do not justify the appropriate operation of the given type of equipment (due to the non-statistical sampling), but the deterministic failure of the given type of equipment should not be assumed. The tests should be accomplished in line with written testing document, their results should be recorded in test reports, which are applicable for detailed description of the test configuration, the applied parameters, the validity range of test and the arisen issues. Occasionally tests could be only accomplished for certain part areas or part units, or for justifying the toleration of certain selected loads. These methods often should be combined with analysis methods regarding toleration of other occurring loads. The partial tests very often are accomplished by the manufacturers of the equipment or by laboratories entitled by them, but without taking account of the application in the nuclear industry. The utilization of these tests in the nuclear industry is possible, if the authentication, accuracy and representativity of the provided data is justified in accordance with the circumstances of the nuclear industrial application. An example for partial testing is the demonstration of radiation resistance of certain materials by testing (by taking account of the former proves of other required properties of the material).
If the equipment does not fall under the scope of environmental qualification, and significant ageing factor cannot be identified, the simulation of accelerated ageing can be rejected. However other tests could be necessary pursuant to other aspects of qualification, thus the connecting tests should also be accomplished. 4.3.2. Qualification by testing material tests The classical method for identification of effects caused by temperature and irradiation, and for quantifying ageing is the examination of the specimens of cables, measuring instruments and other components. It is fortunate, if the specimens are from the real service environment. Mechanical, electrical and chemical tests and simulations should be performed on cables. The classical method for evaluation of the consequences of environmental effects (temperature, radiation, humidity, chemicals, etc.), for evaluation of the ageing condition of cables and other components, and for determination of residual lifetime is the testing of specimens from the service environment. The tests can be accomplished by non-destructive and destructive methods. 4.3.2.1. Non-destructive analyses
The non-destructive test methods could be primarily applied for equipment in service. These tests can be made by electrical, mechanical and chemical methods. The most frequently used electrical method is the measurement of insulation resistance, and of direct and alternate current voltage resistance. The measurement of the elasticity of cable insulation (sheath) and the examination of color changes of sheath that indicate the start of ageing (appearance of rupture, break, crack) of insulation material are among the mechanical tests. A chemical method is the laboratory analysis (infrared spectrophotometric analysis, density measurements, plasticity measurement, etc.) of the micro size material samples from the insulation and the cable sheath. The organized storage and periodic inspection (visual inspection, measurement of changing of insulation resistance, examination of insulation of cables being in wet and humid environment) of representative cable samples under conditions worse than the service environment, and their accident testing belong to the non-destructive testing. The data obtained in this way should be used for estimation of expected lifetime.
Other methods used in the international practice for non-destructive analysis of cables are: Insulation examination by measurement of penetration modulus (INDENTER monitor). Examination of cable insulation by return voltage method. Measurement of loss factor. During the realization of lifetime extension the non-destructive methods should be used for monitoring degradation processes during the extended lifetime. 4.3.2.2. Destructive analyses
The analysis methods entailing the destruction of the material serve for assessment of the ageing condition of insulation materials (primarily cable insulations). The samples necessary for analyses should be prepared form the insulation material of equipment (cables) that are out of service. The insulation material of cables becomes brittle and tough due to the ageing effects of service environment. In general this alteration is well followed by the elongation at break of the material; therefore the break analyses of samples of cable insulation material provides valuable information on the ageing process. During the analysis the elongation of break of the sample is measured in comparison with the initial state of the sample. The evaluation of the analysis results requires the knowledge of the initial elongation at break values of the insulation materials. IN the international practice the condition of insulation material is adequate if its elongation at break value is not lower than 50% of the initial value. Otherwise, it is postulated that the cable insulation is not able to fulfill its required function in the case of a possible accident state. Other methods used in the international practice for destructive analysis of ageing of cables are: Flexibility and tensile strength examinations of the insulation and sheath materials. Density analysis of insulation materials. Thermoanalyitical analyses with differential scanning calorimeter (DSC). High voltage insulation analyses.
During the realization of the lifetime extension, the destructive examination methods should be applied in order to monitor the degradation of cable samples ageing in the actual service environment. 4.3.3. Qualification by analysis The qualification by analysis is successful, if the analysis model can correspond to the element to be qualified. All relevant properties (shape, material properties, etc.) of the model should correspond to the element to be qualified, whilst the postulated loads should correspond to the anticipated service loads and other effects. The qualification by analysis requires logical evaluation and application of a validated mathematical model. The analysis should include natural laws, testing and examination data, operational experience and condition indicators. The adequacy of the model is the critical point of the applicability of this qualification system. The sufficient similarity between the model and the product should be justified on the basis of natural laws, analysis results, operational experience, or other verifiable database. The qualified state can be demonstrated by evaluation of tests and data from the viewpoint of material properties, the resistance to environmental circumstances and by failure statistics. Nevertheless, the analysis cannot demonstrate the qualified state individually. In general, the qualification by analysis can be used for demonstration of toleration of individually affecting loads (e.g. earthquake, temperature effects). The qualification by analysis cannot be used as lonely method for instrumentation and control, and control equipment. Usually, the analysis methods can be well applied to extension of existing test results by extrapolation. The extension of the use of detailed test results by analysis is very often performed. The effects of applied simplifications and unavoidable uncertainties should be taken into consideration during analyses by application of appropriate margins, safety coefficients and of simplification methods that are justified as conservative.
4.3.4.
Consideration of operational experience The operational experience can provide applicable input data only to the qualification of mild environmental conditions. Its applicability to qualification for harsh environmental conditions is very limited. During qualification for mild environmental conditions both the tests results of the equipment of the given unit prior to installation and during commissioning, and the operational experience of similar equipment installed in units in operation provide relevant input data for equipment qualification in the power plant under construction. In particular, the results of in-service tests and overload tests are worth mentioning within the operational experience. In general the overload tests (pneumatic and hydraulic pressure tests, load tests, etc.) are performed pursuant to industrial standards with a load exceeding the normal service load, and it is postulated that if the component tolerates the overload at a given moment, then it will be able to tolerate the normal service load for a given period of time. The circumstances of in-service tests are highly dependent on the designer foresight (design for testability) and the installation conditions of the equipment. At a major part of equipment, especially of safety equipment, only partial testing conditions are arranged (see e.g. ECCS pumps), and the instrumentation controlling the normal service conditions are not always applicable for recording the test parameters with sufficient accuracy. In other cases (e.g. hermetic zone) the actual physical testing of qualified state is avoided in order to prevent ageing or degradation due to the high values of test parameters. Consequently, the representation of accomplished tests from environmental qualification aspects should be individually assessed. The statistical processing of operational experience can be well used for qualification of mass products. However it has two conditions: on the one hand reliable event (failure) recording system should be used for sufficiently long period (because the lack of event recording may cause false judgment on applicability), on the other hand the monitoring of the load value is required.
The total utilization of operational experience is dependent on the monitoring of loads, since the experience gained at locations with higher loads can provide prospective information for locations with lower loads. 4.3.5. Selection of the qualification method The below limitations should be taken into consideration during the selection of the method for environmental qualification: Qualification by analysis is only possible if the component has initial qualification and it is intended to be operated under environmental circumstances differing from the initial state. Qualification by analysis can be used for justification of toleration of independently affecting loads (e.g. earthquake, temperature effects). The operational experience provides input data to qualification for mild environmental conditions only. The appropriate selection of the methods to be applied aims at demonstrating that the ageing degradation of equipment in a service period does not result in common cause environment induced failure either during normal service of the unit, or if the equipment will be under harsh environmental conditions that are considered in a design event at the very end of its qualified lifetime. The mild or harsh nature of the environment should be taken into account during the selection of the method; inspection and testing should get priority. One of the most effective methods from environmental qualification viewpoint is the type testing of equipment to be installed. Accordingly, the resistance of the given equipment type to ageing, environmental and seismic effects could be demonstrated in the adequate sequence under both normal service and accident conditions. The analysis method is less applicable; its conclusions are highly dependent on the suitability of the applied model, the scope, and on how rigorous and accurate the analysis is. Nevertheless, the testing method rarely applicable individually for already installed equipment without certain supplementary analyses. A typical example of application is the seismic qualification by analysis. The qualification by analysis cannot be applied to seismic qualification of complex instrumentation and control, or electronic equipment. Exemption is only possible on the basis of the size or mass of equipment. Such equipment
are e.g. the Diesel generators. The analysis provides the vibration spectrum of the input signal calculated for the location of small equipment, but it is not applicable for the entire qualification. In general, a limitation of operational experience as an equipment qualification method is the adequately documented operational information. The applicability for qualification for worst case should be assessed during the selection of the qualification method. The qualification list should be merged for those equipment (and groups) which can be qualified for the worst possible environmental conditions in the plant. However care should be taken that the parameters of the worst case should cover the parameters of all individual harsh environmental conditions. The selection of the qualification method to be applied is dependent on the function to be fulfilled by the equipment and on the phase of the accident in which it should be fulfilled. If e.g. the active functions of equipment are performed before the occurrence of the accident conditions, then their related elements should not be qualified for toleration of the given accident conditions. 4.3.6. Application of the Space method The subject method is one of those formalized procedures, by which the scope of components requiring ageing management can be identified. It can be primarily applied for qualification and ageing management of cables, connectors and extensions.
Figure 2
4.4. Execution of environmental qualification programme

The environmental qualification programme aims at examination of equipment that are sensitive to harsh environmental conditions, or the collective appearance of ageing and harsh environmental conditions. The
environmental qualification programme should take into account that the seismic effects also load the equipment operating in mild environment. The execution of the environmental qualification programme consists of three major phases, as follows: elaboration of the programme, execution of the programme, maintenance of the qualified state. The status of qualification of nuclear power plant equipment should be reviewed during the elaboration of the programme. If the qualification is missing, then the concrete action necessary for achieving the qualified state of equipment should be identified, the preliminary schedule of these actions should be elaborated. The priorities of actions should be specified during the realization by taking account of the correction of problems requiring immediate measure that occur during the specification of qualification requirements. The environmental qualification programme should be executed parallel to the operation of the nuclear power plant; therefore certain measures necessary for continuous maintenance of safety may require immediate measures. The maintenance of the qualified state should include the appropriate documentation of the process, and if necessary the modifications of the operation, maintenance and testing methods. 4.4.1. Elaboration of the environmental qualification programme The knowledge about environmental conditions of equipment and their required operation during accident situations has become much more accurate since the commissioning of formerly built nuclear power plants. The parameters occurring during various initiating events became more accurate, and the list of initiating events was extended as well. Such significant modifications could be implemented, which modifies the operational and environmental resistance properties of equipment such a way that they are getting closer to requirements prescribed in modern standards and regulations. During the modifications the authority requires purchasing and installing such new equipment, which are in compliance with environmental qualification requirements that seem to be necessary on the basis of the latest knowledge.
Accordingly, the elaboration phase of environmental qualification is not a single action to be executed and finished, but a process that should be continuously performed parallel to the operation of the plant, extension of the engineering knowledge and development of more rigorous regulatory requirements.
Without EQ
Safety result
Probability of failure or inoperability
By taking account of EQ
Probability of failure that is independent of the environment
Controlled conditions
Normal service conditions
Abnormal service conditions
Limited harsh conditions (e.g. only radiation)
DBA (e.g.. LOCA)
Severe accident (BDBA)
Mild environment
Harsh environment
Worsening of environmental conditions
Figure 3 Role of qualification as a function of environmental conditions The environmental qualification aims at assuring that the equipment of the nuclear power plant will fulfill their required functions during the whole lifetime of the plant.
The safety functions fall under the scope of regulatory supervision, whilst the performance of other functions is governed by production interests. Therefore, the economical aspects should also be taken into account. The development of the environmental qualification programme should include the review of the qualified state of equipment and the enhancement of their qualification level. The economical aspects cover the followings: maintenance of the qualified state is in close relation to the further operability of the plant, cost of maintenance of the qualified state of an existing equipment versus the cost of reconstruction, requalification of an existing equipment versus cost of replacement, specification of date and schedule of requalification or replacement, value and distribution in time of the needed human resources. The decision made on the basis of economical considerations should belong to the competence of the operator. The elaboration of the environmental qualification programme is basically dependent on those regulatory requirements, which in various forms are the conditions of granting or extending the operating license. The regulatory requirements should in any case include the list of initiating events to be considered as the basis of environmental qualification, practically together with the associated environmental parameters. If the environmental qualification programme is developed in an operating nuclear power plant, other important aspects are: the approval of the list of systems and equipment to be qualified, the regulatory statement on the sequence and deadlines of correction of environmental qualification deficiencies. 4.4.2. Assessment of the actual status of qualification The most important part of the development phase of the whole environmental qualification programme is the assessment of the actual state of equipment qualification. The scope of equipment and instruments to be qualified should be identified on the basis of initiating events belonging to the design basis, and of other events requiring measures. The SC1-3+ safety classification provides support to the evaluation of the functional criteria. The equipment and
instruments required in case of fire, anticipated transients without scram (ATWS), temperature and pressure shock of equipment belonging to the primary system boundary, and of total loss of power should also be taken into account. Those components should also be qualified, the failure of which may hinder the fulfillment of a basic safety function or a safety function (see definitions). The environmental parameters occurring during normal service of the unit and accident occurrences should be identified for each room. The document templates serving for documentation of qualification and their rules of filling in should be developed. Those principles and methods should be clarified, which should be applied during the qualification. 4.4.3. Documentation of qualification The documentation of qualification should be made in a unified, clearly organized form. The documentation should contain the input data of equipment qualification, the description of reference basis and the qualification results. The documentation should determine: the achieved qualification level and the conclusion that can be drawn accordingly, the installation requirements, those operational limits, within which the qualification conclusions remain valid, those maintenance, in-service testing and replacement requirements, which are necessary for the maintenance of the qualified state, the qualified lifetime of equipment, and the documents grounding the evaluation of environmental qualification, and their conclusions. The documentation should be organized for equipment groups; the determinant conditions should be highlighted: the extreme environmental parameters and the equipment lifetime. The recording of qualification in a database is an important aspect of administration and data management.
It is advantageous from practical and administration points of view, if the recording of components falling under the scope of equipment qualification is consistent with the already existing registry of components. The basic safety system functions should be assessed to the boundary surfaces. Beyond the boundary surface the function performed by another system should be assessed: whether it serves for the fulfillment of basic safety functions, or may hinder it by their failure or false operation. The database should include the environmental parameters occurring during normal service and accident occurrences, the criteria for fulfillment of the required functions, and the associated parameters values in the various rooms of the facility. The number of databases should be minimized; links should be developed between them. The various databases may be linked via components, product groups, components groups that are qualified in the same way, participation in the required function, rooms, etc. The validity period of environmental qualification should be specified by the simulation of the service environmental during qualification. The documentation of equipment should be stored until the end of their qualified and service lifetime. Pursuant to the relating standards the documentation of environmental qualification should consists of the following chapters. 4.4.3.1. Documentation for mild environment
The following documents should demonstrate the qualified state of equipment operating in mild environment and fulfilling safety functions: Designer or purchase specification, which includes the description of function requirements to be fulfilled under specific environmental conditions appearing in case of operational occurrences. Reports (records) of seismic tests, evaluation and certification of compliance. 4.4.3.2. Documentation for harsh environment
The documentation of equipment operating in harsh environment and performing safety function should demonstrate that the equipment are qualified for the conditions of their service and their qualified lifetime, and
the rules of their in-service testing, maintenance and condition monitoring are specified. The considered data should be specific to the application of the equipment. The data should be available in easily understandable and up-to-date manner; they should facilitate the verification and independent audit of the drawn conclusions. The documentation of equipment operating in harsh environment and performing safety function should include the following compulsory items. Certain items may be not relevant. a) Identifier data required for identification of qualified equipment, including data for identification of the manufacturer, type family and type. b) Description of the safety function, data applicable for its identification: denomination, symbol, sign. c) Description of the qualification method, data applicable for its identification. d) Data, signs serving for identification of tested specimens. e) Description of normal environmental conditions and denominations applicable for their identification, including the description of environmental conditions appearing during normal occurrences and denominations applicable for their identification. Such like temperature, pressure, irradiation, relative humidity, characteristics of electromagnetic an radiofrequency interference, attributes of occurring overvoltage, number and attributes of service load cycles, and those design basis events, the toleration of which the equipment should be qualified for. f) Description of acceptance criteria and values of performance parameters necessary for fulfillment of the function, and of the values produced by the equipment during testing. g) Description of the sequence of inspections and testing. h) Description of designer considerations relating to the installation location: assembly, characterizing geometrical directions, connecting surfaces, insulation tubes, sealing and other protections. i) Description of configuration used during testing in order to demonstrate whether the connections of equipment in the testing room (chamber) were affected by the simulated accident events.
j) Demonstration of that the examined and tested specimens can adequately represent the equipment to be qualified or the equipment group created by type categorization of loads. k) Description of the revealed ageing mechanisms, and of how they are considered during qualification tests. l) Declaration of the qualified lifetime, justification of the given value. m) Results of tests determining the lifetime simulated by artificial ageing. n) Description of the simulation of design basis events, including temperature-time and pressure-time functions, humidity, mechanical load, electrical load, applied voltages, frequencies, chemical effects water spraying or flooding. o) Description of irradiation tests, including type of radiation, dose intensity and value of total dose p) Description of results of seismic tests q) Evaluation of margins against extreme parameters with respect to temperature, pressure, irradiation, voltage of electric supply, service time and earthquake. r) Description of surveillance, in-service inspection and testing, maintenance and part replacement required for maintaining the qualified state. s) Description of deviations occurred during testing belonging to initial qualification, and of their effects on qualification. t) Summary of qualification results, discussion by description of the limitations of qualifications, the related warnings, the value of qualified lifetime, the time interval of in-service tests and inspection activities necessary for maintenance of the qualified state. 4.4.4. Evaluation of the actual status of qualification The evaluation of the status of environmental qualification should include the following aspects: It is demonstrated that a part of equipment is in full compliance with the requirements of the defined environmental qualification. It is demonstrated that another group of equipment is resistant to certain environmental loads.
The resistance of other equipment is not demonstrated, or obviously missing. It is obvious that certain equipment will become disfunctional under those accident conditions, for which the functionality is postulated in the safety analyses. The unit should continuously operate in a safe state, consequently if such a significant safety deficiency is detected that was not revealed during equipment qualification, then immediate corrective actions should be a condition for further operation. The correction of deficiencies or uncertainties should be scheduled on the basis of the priority of the safety function. Other aspects may be relevant during compilation of the corrective programme for a plant having more units, e.g. age of units, schedule of main overhauls and other safety improvement measures. The probabilistic based risk assessment (PRA) may facilitate the prioritization of measures provided its conditions are at present. 4.4.5. Supplement of missing qualification The qualified state of equipment should be demonstrated by testing, analysis, based on operational experience, or the combinations of the three methods. The limitations discussed in paragraph 3.3.5 should be taken into consideration! If the equipment may be tested, then the following should be considered: The operational and maintenance history of equipment should be reconstructed, in order to provide authentic supplement of the accelerated ageing effects necessary for achieving the state simulating the end of the lifetime. If alternatives exist in the selection of the specimen, then the specimen providing the most representative information should be selected. Operational limits due to the removal of equipment. Identification of the root cause of failures occurring during equipment testing. (The failure may be an unknown event occurred during the lifetime of equipment or damage appeared due to disassembly or transport!)
If the testing device is transported from the store, then the storage history (with special respect to the environmental parameters) should be reconstructed. During qualification by testing, attention should be paid to the analysis of whether sufficient similarity exists between the tested equipment and those being in service. As far as possible the supplementary qualification in operating plants should be performed on equipment disassembled from service. The precise knowledge of operational history of samples is significant. If the supplier of the equipment is reachable, then similar equipment should be purchased. The qualification tests of equipment performing basic safety function or safety function should be anyway accomplished by taking account of the service environmental circumstances. The operational experience could be applied to environmental qualification in a correct manner, if it can be justified that the service loads are at least such rigorous for the equipment as those occurring during environmental qualification; therefore the application of the method is rather limited. Testing can be combined by analysis. It can be used for e.g. calculation of qualified lifetime by mathematical models of thermal ageing effects (the most often applied model is the Arrhenius-equation). A special utilization of operational experience for cables is the destructive test after a certain service period. The test results provide good picture of the state of cables operating under similar circumstances. The greatest safety benefit of such qualification is obtained from the analysis of specimens collected either from the first unit of multi-unit power plant or from the oldest one among units with similar construction. The residual lifetime of components not qualified pursuant to the former regulation should be demonstrated by testing and analyses! Other possible method for management of missing qualifications is the movement of equipment to such a region or room, where the environmental parameters occurring during accidents are milder than in the original installation location thereof. Qualification for flooding is needed, if it may occur in the installation location of equipment and the meeting of single failure criterion requires it.
4.4.6.
Measures in case of losing qualification The violation of the environmental and other effect parameters considered during qualification may lead to degradation not considered during qualification or assumed to be slow then but being faster under the new circumstances; therefore the qualification loses its validity. If the qualification cannot be obtained for an electrical, and instrumentation and control component that is technically and reasonably replaceable, and the qualification loses its validity or reaches the end of its qualified state specified during qualification, then it should be replaced by a qualified one. In order to assure the fulfillment of the function described in FASR, ageing management programme aiming at preventing degradation or mitigating degradation effects should be applied to components not reasonably replaceable. (Such components are certain cables and hermetic penetrations.) The residual lifetime should be demonstrated by testing and analyses!
5.
MAINTENANCE OF THE QUALIFIED STATE

Short term measures could be necessary subsequent to the initial environmental qualification procedure, or if it was not performed then to its supplementation. The safety effect of equipment is determinant during the determination of the sequence of measures and during the selection of those to be implemented immediately. Measures to be taken on the basis of environmental qualification results may be: shielding or covering of equipment in order to reduce environmental effects, reduction of periodicity of in-service tests, easy-fix seismic resistance reinforcements, replacement of smaller parts that are not resistant to harsh environment. The environmental qualification requirements relating to the actual installation location should be complied with during the purchase and installation of new equipment and components performed because of wearing of the old ones.
The initial environmental qualification procedure, or if it was missing originally then its supplement should be followed by a programme serving for the maintenance of the qualified state, which ensures the long-term monitoring of conditions taken into account during environmental qualification, and thus the validity of the qualified state during the qualified lifetime. The equipment and instruments treated in this way could be the following ones: electric operated valves (with solenoid coil), electric motors, electric, and penetrations, instrumentation and control hermetic cable
wires and cables, connections and couplings, cable connection cabinets, sensors and transducers, sensors and devices of radiation monitoring. After the justification of the appropriate qualifications the operator should take care of maintaining the qualified state of equipment. The fundamental tools of this process are: functional tests, monitoring, diagnostics, maintenance and proper management, condition monitoring (if applicable), repair and replacement. It should be emphasized that the visual inspection is able to provide only limited information on the state of equipment and components; therefore it cannot be used as a single method. This is particularly true for cables and metal structures. The deficiencies, failures revealed during in-service functional tests and performance testing, the operational experience and the results of in-service material tests should be analyzed; their data should be used for trend analysis.
If the revealed problems cannot be corrected by maintenance, then the qualified state should be maintained by modifications and timely replacement. The violation of parameters considered during initial qualification (because of the environmental circumstances worsening due to venting, cooling or another reason) or postulated to be slow then but being faster under the new circumstances may lead to faster degradation; therefore all qualifications lose their validity. Thus the equipment lifetime specified as service cycle number or time period will be shorter by assuming a degradation existing under given environmental conditions and parameters and worsening in time. The analysis of ageing processes and projection of degradation may indicate the appropriate time point of maintenance, repair and if necessary of replacement. The improvement of operational circumstances and environmental conditions may mitigate the degradation effects. In order to ensure the function described in FSAR, ageing management programme either preventing or mitigating the degradation effects should be implemented for reasonably non-replaceable components. It is very difficult to replace certain cables and hermetic transfers. The residual lifetime of equipment, instruments, cables and hermetic penetrations should be demonstrated by examinations and analyses. The lifetime of old cables installed at the construction of the plant or in its early phase should be extrapolated by calculations based on measurement results of examinations made on cable samples and on collected data of environmental parameters. The highest possible temperature data should be used for the calculation of residual lifetime. The hot spots, if exist, should be identified! The extrapolation is only accepted as analysis method, if only one environmental ageing factor appears. The extrapolation can be accepted as an analysis method, if only one environmental ageing factor exists. If an equipment has no basic safety function, does not contribute to a basic safety function performed by another component, and its failure or false operation does not hinder the operation of other component performing basic safety function, then the equipment should not be qualified, it could be excluded from monitoring and testing, its repair or replacement becomes necessary only if failed.
The requirements for maintenance, inspection and part replacement should be specified such a way that the disfunctionality of equipment should be reliably prevented. Measures could be implemented for maintaining the qualified state even for passive, electric components with long lifetime. Passive electric components are the cables and their hermetic penetrations. Hermetic penetrations may also belong to cables of instrumentation and control systems. The surveillance activities may be executed by unqualified equipment and instruments due to production related interests.
5.1. Functional tests

The in-service tests performed on components can demonstrate that the component is able to fulfill its function under its given conditions. Beyond the demonstration of the functionality at the given moment, by measuring the parameters characterizing the component operability and performance, such tests are applicable to indicate the deviations, which do not cause inoperability or disfucntionality, but can refer to the occurrence of a failure prior to the next testing period. The detection of such deviations is effectively facilitated by the existence and analysis of parameter time series utilizing the data of previous tests. The functional tests to be executed in accordance with the Technical Specifications describing the operational limits and conditions and with the maintenance document and recommendations of the manufacturer are the part of the maintenance activity and the implemented procedural maintenance programme. If maintenance documentation of the manufacturer is not available, then the well-tried maintenance practice supported by the operational experience should be documented. The industrial good practice and the regulatory prescriptions should be taken into account during the elaboration of the procedure. The equipment, instrument and system tests performed subsequent to a longer period out of operation should include the calibration of measuring instruments. The procedure should take care of that the measurement uncertainties should be known and should be in compliance with the accuracy requirements for measurements. For systems playing role in safety shutdown and cool down of the reactor, the tests accomplished at the shutdown of the reactor should demonstrate
that the equipment, instruments and the system were able to fulfill their functions at the end of the service period (campaign) of the facility, prior to maintenance. The tests may be performed during operation, if they are in harmony with the operational limits and conditions. During functional tests the operation of equipment and instruments should be in compliance with the operating modes permitted by the Technical Specification collecting the operational limits and conditions, and the minimum, maximum and interim values relating to equipment, instruments and systems. The test operation should represent the stationer operating points of normal service and characterizing transients. Facility specific requirements (regulation) should be elaborated for the scope of equipment, instruments and systems to be examined by testing during maintenance and service, the testing methods, the testing frequency and timeliness.
5.2. Monitoring
Monitoring programme should be elaborated for equipment and instruments, and in-service non-destructive material testing and condition monitoring programme should be elaborated for cables in order to control ageing processes and to timely detect the possible effects of significant ageing processes, and to timely implement the necessary measures. The availability of primary components performing basic safety function and safety function requires the implementation of a monitoring programme that includes the execution of in-service tests. The monitoring of cables exposed to high or increased temperature is very important due to the anticipated significant ageing. Besides visual inspection, monitoring should be accomplished by testing, measurement, analysis of parallel aged material samples. The monitoring programme of cables should cover cable connections as well. The quantified evaluation of degradation is only possible by experimental, measurement based techniques. Majority of the electric, instrumentation and control components should be monitored by calibration tests or inspections that belong to the preventive maintenance. These tests can verify the function performance or indicate the effect of an already known degradation mechanism.
If the parameters demonstrating the performance characteristic of the component can be verified by continuous measurement, or by measurement made during in-service and cyclic exercises and tests, then it can be demonstrated at the same time whether the maintenance (it will be further discussed below) effective is and meets its objective. These in-service tests are described in the Technical Specifications containing the operational limits and conditions; being in compliance with the regulations is required for the validity of the operating license of the facility. The environmental qualification programme does not always prescribe the monitoring and the collection of parameters indicating the degradation and measurement data characterizing the performance and condition of equipment or instruments for the purpose of managing their ageing. Those degradations caused by effects that can be linked to measurable parameters, in a fortunate case should be read out from the timelines of measurement results, therefore the data collection should be prescribed. The registration of service time of at least the qualified equipment and instruments should be included in the environmental qualification programme. This also can be considered as monitoring. The data can be used for correcting the design. Taking account of uncertainties of long term analysis, the time and measurement data may serve for determination of the necessary time point of repair that prevents the replacement of equipment. The monitoring or verification of environmental condition parameters facilitates to demonstrate that the conditions are continuously in compliance with those considered during the environmental qualification; or if being not in compliance with them, then the collected data contribute to modify the value of qualified lifetime. The frequency of in-service functional and calibration tests is specified in the Technical Specifications (TS); such intervention may be implemented as a result of them which can be considered as preventive. Such like: Further grounding of toleration of service conditions: further specification of limit values characterizing certain tolerated loads, or further specification of the value of qualified lifetime. Execution of installation, inspection, monitoring or periodic maintenance prescriptions for decreasing degradation effects, and for
ensuring that the degradation is in compliance with the extension assumed during the initial environmental qualification.
5.3. Diagnostics
The diagnostic and load monitoring systems make possible the fast and accurate evaluation of states and environmental conditions of structures, systems and components in all operating states of the unit. They can indicate the appearance of failures, the necessity of corrective measures and maintenance prior to loss of the safety margins of measured parameters. They reveal the maintenance effectiveness. The international practice most often refers to the following diagnostic solutions: 1. Monitoring of environmental parameters (temperature, radiation, humidity and moisture) of the operating environment, 2. Electric diagnostic examinations of low and medium voltage cables and cable connections, 3. Measurements and vibration diagnostic of electric rotating machines, 4. Diagnostic of uninterruptable power supplies and accumulators, 5. Self diagnostic of electronic data collector and controlling equipment.
5.4. Reliability of data of diagnostics and monitoring systems

One of the major task of connecting instrumentation and control solutions is to verify the operation of sensors, the credibility of detected data and uninterruption of the data processing. The diagnostic and monitoring systems may age themselves (e.g. drift of sensors, changing of measuring characteristics) and thus require maintenance. Due to this reason the applicable new solutions for signal and data transfer, like fiber optics or wireless data transfer should be assessed. Due to the high data flux, the diagnostic and monitoring systems often base on computerized data collection systems running complex algorithms. The as simple as possible validation of such systems should be considered during their design.
5.5. Maintenance
The maintenance activity aims at correction of certain parameters or operating equipment and improving their performance indicators or reliability. The preventive maintenance is intended to ensure the adequate
future operation of equipment based on their examination results and measurement results of tests. The minimum maintenance required for preservation of the qualified state of equipment should be specified during the evaluation of the qualification. This should be accomplished during the initial environmental qualification or during supplementation of qualifications for a facility built pursuant to former standards. The description of attributes originating form normal service of equipment, the identification and documentation of possible deviations and failures should be taken into account during the training of maintenance programmes. 5.5.1. Harmonization of maintenance and results of environmental qualification From the viewpoint of environmental qualification the maintenance should contain preventive and corrective measures and post-maintenance tests. The cycle time of maintenance should be specified on the basis of the results of accelerated ageing tests that were accomplished during qualification; the specified cycle time should ensure that the equipment remain reliably functional in the period between two maintenances. If necessary, post-maintenance overload tests should be scheduled for guaranteeing reliability. The appropriate performance indicators of equipment operating in mild environment can be demonstrated by inspection of the normal service or by in-service testing (with the exemption of those equipment, the identified ageing processes of which reduce seismic resistance). Those manufacturer and designer instructions should be identified, which have effects on the qualified state of the equipment. These instructions should be revised by taking account of environmental conditions governing the installation location; their modification should be approved by the person or organization responsible for specification of qualification requirements. The appropriateness and effectiveness of maintenance activities serving for the objectives of environmental qualification should be regularly analyzed for each type of equipment.
5.5.2.
Maintenance of active components The management of degradation processes should be made through effective surveillance, inspection, condition monitoring, data collection, maintenance, reconstruction, replacement of equipment or instruments, and appropriate selection of operating and handling conditions. Consequently, a possible method for the management of ageing processes is the maintenance of equipment and instruments. The maintenance should be placed on such a scale, which may prioritize the measures of ageing management by taking account of economic aspects as well. The scale starts with the initial qualification and then it may continue with the more precise subsequent specification by the collected data, whilst the maintenance should be listed among the corrective measures. These measures may delay the replacement of components. The scale is finished by the replacement of components. The economic aspects play role in the schedule of replacement (sooner or later), even without requalification, in-service testing or maintenance. The maintenance can mitigate or eliminate the effect of degradation processes; it can be an appropriate solution from technical and economical points of view if it can manage the ageing effect by an easily executable action or replacement of an easily replaceable part. The periodic maintenance may be supported by manufacturer prescriptions, operational experience, or detecting of changes of environmental parameters or of those characterizing the operation of equipment or instruments. The latter one requires also the implementation of a monitoring and condition surveillance programme. The replacement of parts postulates the existence of storage stock or the permanent market appearance of the manufacturers.
5.5.3.
Measures to be taken if insufficient maintenance The effects of non-executed, delayed or incompletely executed maintenance steps on qualification should be analyzed. The following issues should be studied: Does the deviation affect a given piece of equipment or redundant equipment as well, or all equipment of the same type?
May the deviation influence the equipment performance (accuracy, response time, etc.)? May the deviation lead to a common cause failure or the damage to the boundaries of defense in depth? Is the further safe operation of the equipment possible?
5.6. Condition monitoring

The condition monitoring is the surveillance of states by tests, analyses and visual inspections. The scope of condition monitoring covers building structures, pipe, cable and other support structures, electrical, and instrumentation and control cabinets. The handling and condition monitoring of equipment has extreme importance for maintenance of the qualified state of equipment due to the uncertainties of projection of ageing processes and the single failures that can occur any time. The organization responsible for the system should execute condition monitoring tasks relating to structures and supports fixing equipment and instruments, not only the actions directly relating to equipment and instruments.
5.7. Trend analysis of failures

The operational and maintenance documentation should be conducted in such a way that the increase of the frequency of failures induced by the progress of ageing processes could be detected in time. It should be taken into account during the analyses to be made if the ratio of failures occurring during normal service increases that high number of failures may occur if the equipment being close to the end of their lifetime are under harsh environmental conditions. The results of failure trend analyses should be taken into account during the realization of the ageing management programme, more precise estimation of qualified lifetime and scheduling of replacements necessary for the safe operation. The analysis of failure ratio very often provides basis for the decision on the extension of service time specified during the estimation of the initial lifetime.
5.8. Equipment modifications and design modifications

The modifications alter the specification and age of operating equipment, sometimes even the environmental conditions of their service and the parameters of the design basis accident scenario. The elaboration and proper documentation of the environmental qualification programme is essential for evaluating the positive effect of modifications on the qualification, and for proper compensation of the potential adverse effects appearing due to the modifications. The quality informed review of equipment and design modifications should cover the analysis whether the given modification: Change the scope and location of equipment serving for mitigating the consequences of tube ruptures. Change the performance requirements or required operating time of the qualified equipment. Change the quantity of energy and mass produced by tube ruptures, and the pressure, temperature, radiation and other parameters and distributions occurring in certain zones of the plant and affecting the qualified state of equipment. Change the normal service environmental conditions. Change the normal service conditions and limitations of qualified technological, electrical, instrumentation and control and other equipment with regard to the parameters generating internal loads.
5.9. Feedback of operational experience

The most essential data regarding reliability can be obtained from the own operational, maintenance and condition monitoring experience of the plant. Due to the low number of own experience, the experience gained in other nuclear power plants, and even in other branches of industry should be taken into account. The operational experience is a useful source of information for more precise specification of parameters postulated during the initial qualification.
5.10. Repair and replacement

In spite of the qualified state of equipment, repairs can be necessary due to single failures. Nevertheless, it always should be analyzed whether the occurrence is really a single failure, or an example of a regular failure occurring due to a preceding failure. The parts to be assembled during replacement should be selected from the same or similar type (see definitions). The quality, certification, and the quality of assembling of the spare parts to be assembled should be at least on the same level as those of the original parts, and the results of failure investigation should be also taken into consideration. During the planning of repairs, special attention should be paid to that certain manufacturers are against the reparation of failed parts and prescribe or recommend the sorting out and replacement thereof. This fact should be taken into account during the stocking of spare parts. The requirements for equipment and instrument replacements that were determined as the result of the subsequent tests accomplished in the appropriate sequence during the initial examinations of environmental qualification should be met. If the qualified lifetime is limited, then the results of environmental qualification tests should be linked to the replacements to be executed in the frame of preventive maintenance. The repair or replacement of active electric, instrumentation and control components should be implemented at the time of the detection of degradation indicated during the calibration tests or as the result of other supervisory activity prescribed for the long term operation. Taking account of the modification of the configuration operating in the unit during the execution of the work, the repair and replacement should be performed only pursuant to operational regulations. The application of monitoring techniques makes possible the estimation of the necessity of repairs and replacements in advance and their harmonization with the interests of production. If the qualification cannot be granted for an electric, instrumentation and control component that can be technically reasonably replaced, and its qualification loses its validity or it is at the end of its qualified lifetime
specified during its qualification, then it should be replaced to a qualified one. During the purchase of equipment and parts intended to be used for replacement, the sameness of identical type equipment and parts should be noted. Taking account of the manufacturer capacities lost or regressed due to the reduction of demand for nuclear equipment, the sameness should be analyzed even in that case if the supplier of the equipment intended to be used for replacement is namely the same manufacturer or its successor. It is also possible that the same equipment or parts can be purchased from another manufacturer. Such case is the fabrication based on license. The equipment intended to be operated under harsh environmental conditions should be qualified. The assembly of commercial products into safety classified equipment is only permitted, if the applicability is properly justified.
5.11. Extension of the qualified lifetime

The initial qualification may result in the specification of such a qualified lifetime, which is shorter than the expected lifetime of the equipment. E.g. the qualified lifetime may be limited, if the applied simulation includes moderated degradation effects during the limited time available for testing. Due to these moderated effects the state of the equipment at the end of the test was much far from its final state when it should be considered as unserviceable. In such case the qualified lifetime may be extended by the methods listed below: a) Parallel to the operation of the installed equipment the specimens stored after initial qualification should be further examined, or new specimens should be artificially aged. The subsequent demonstration of that the equipment are able to fulfill their safety function provides additional lifetime under the circumstances of design basis events, thus it extends the result of the original initial qualification. b) Additional equipment operating under identical service conditions should be installed, and the type testing of equipment disassembled prior to the end of their qualified lifetime should be continued by simulation of additional ageing factors in order to ground the extended qualified lifetime.
c) The level of conservatism of consideration of environmental and ageing acceleration conditions during initial qualification, and of the failure criteria should be reviewed, and if it can be justified that the actual conditions are more advantageous then the qualified lifetime can be extended. d) The parts sensitive to aging factors should be identified and replaced.

4-13v2 Eng

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

4-13v2 Eng

Uploaded by

Copyright:

Available Formats

Hungarian Atomic Energy Authority

Version number: 2. 2007 March

Issued by: Jzsef Rnaky PhD, director-general Budapest, 2007 March

1.1. Subject and objective of the guideline

1.2. Corresponding laws and regulations

RELATION OF ENVIRONMENTAL QUALIFICATION WITH OTHER PROGRAMMES

ACTIVE and PASSIVE

Maintenance effectiveness monitoring (MEM)

ACTIVE and PASSIVE

Safety analyses: the safety analyses should justify that

QUALIFICATION OF OPERATING EQUIPMENT

4.1. Organizational conditions for realization of qualification programme

4.2. Initial conditions of development of the environmental qualification programme

4.3. Requirements and methods of modern environmental qualification

4.4. Execution of environmental qualification programme

Probability of failure or inoperability

Probability of failure that is independent of the environment

Normal service conditions

Abnormal service conditions

Limited harsh conditions (e.g. only radiation)

DBA (e.g.. LOCA)

Severe accident (BDBA)

Worsening of environmental conditions

MAINTENANCE OF THE QUALIFIED STATE

5.1. Functional tests

5.4. Reliability of data of diagnostics and monitoring systems

5.6. Condition monitoring

5.7. Trend analysis of failures

5.8. Equipment modifications and design modifications

5.9. Feedback of operational experience

5.10. Repair and replacement

5.11. Extension of the qualified lifetime

You might also like