environmental qualification of equipment during the design of ......nuclear safety regulatory...

Hungarian Atomic Energy Authority

Guideline 3.15

Environmental qualification of equipment during the design of nuclear power plants

Version number:2.

March, 2007

Issued by: József Rónaky PhD, director-generalBudapest, 2007 March

The publication can be purchased from:Hungarian Atomic Energy Authority

Nuclear Safety DirectorateBudapest

PREAMBLE

The legal hierarchy of nuclear safety regulations in Hungary is as follows:

1. The uppermost level is represented by the Act CXVI of 1996 on Atomic Energy (Atomic Act).

2. The next level basically consists of two government decrees issued as executive orders of the Atomic Act. The 114/2003. (VII.29.) Korm. government decree defines the legal status of the Hungarian Atomic Energy Authority (HAEA), while the 89/2005. (V.5.) Korm. government decree specifies the HAEA’s generic procedural rules in nuclear safety regulatory matters. The nuclear safety code consists of seven volumes, which are issued as the annexes of this latter decree. The first four volumes address the NPP, the fifth one the research and training reactors, whilst the sixth volume addresses the spent fuel interim storage facility. These six volumes determine the specific nuclear safety requirements, whilst the seventh volume contains the definitions applied in the code. The regulations are mandatory; failing to meet any of them is possible only in those specific cases that are identified by the decree.3. The regulatory guidelines constituting the next level of the regulatory system are connected to one of the volumes of the code. The guidelines describe the method recommended by the proceeding authority for meeting the requirements of the nuclear safety code. The guidelines are issued by the director general of the HAEA, and they are regularly reviewed and reissued based on accumulated experience. So as to proceed smoothly and duly the authority encourages the licensees to take into account the recommendations of the guidelines to the extent possible.4. In addition to the described regulations of general type, individual regulatory prescriptions and resolutions may also address specific components, activities and procedures.

5. The listed regulations are obviously supplemented by the regulating documents of other organizations participating in the use of nuclear energy (designers, manufacturers, etc.). Such documents are prepared and maintained in accordance with the internal quality assurance system of the user.

Before applying a given guideline, always make sure whether the newest, effective version is considered. The effective guidelines can be downloaded from the HAEA's website: http://www.haea.gov.hu.

Guideline 3.15 4/65 Version: 2Environmental qualification of equipment during the design of nuclear power plants

TABLE OF CONTENTS

1. INTRODUCTION 61.1. Subject and objective of the guideline 61.2. Corresponding laws and prescriptions 7

2. DEFINITIONS 82.1 Abbreviations 13

3. INITIAL ENVIROMENTAL QUALIFICATION OF EQUIPMENT 143.1. Objective of and general requirements for environmental

qualification of equipment 143.2. The scope of qualification in line with function performance and

effects 173.2.1. Role of equipment in guaranteeing the safety of the unit 173.2.2. Classification of equipment and components 173.2.3. Specific aspects of identification of qualification requirements 183.2.4. Service loads and environmental conditions 213.2.5. Consideration of equipment type 233.2.6. Degradation processes – consideration of ageing effects 263.2.7. Application of the “Space” method 29

3.3. Input data of initial environmental qualification 313.3.1. Environmental qualification specification 313.3.2. Performance requirements for equipment 333.3.3. Locations of equipment to be qualified 353.3.4. Environmental attributes 353.3.5. Initiating event to be considered 413.3.6. Ageing processes to be considered 41

3.4. Conduction of the initial environmental qualification 423.4.1. Standards and regulations 423.4.2. Qualification criteria 423.4.3. Qualification report 43

3.5. Evaluation of the data of the initial environmental qualification 433.5.1. Selection of qualification standards and criteria 433.5.2. Required environmental conditions 443.5.3. The service conditions and the required performance parameters 443.5.4. Review of qualification reports 443.5.5. Similarity of operating and tested equipment 44


3.5.6. Requirements and limitations for placement and arrangement 453.5.7. Performance requirements and acceptance criteria 463.5.8. Testing sequence 463.5.9. Modeling of ageing processes and the qualified lifetime 483.5.10. Consideration of accident conditions 493.5.11. Management of deviations 493.5.12. Consideration of other information 50

4. MAINTENANCE OF THE QUALIFIED STATE 504.1. Functional tests 524.2. Monitoring 534.3. Diagnostics 544.4. Data credibility of diagnostics and monitoring systems 554.5. Repair and replacement 55

5. QUALITY ASSURANCE AND DOCUMENTATION OF QUALIFICATION 565.1. Mild environment 575.2. Harsh environment 575.3. Evaluation of qualification documentation 59

6. ANNEX INFORMATIVE LIST OF ENVIRONMENTAL QUALIFICATION STANDARDS 63


1. INTRODUCTION

1.1. Subject and objective of the guidelineThe subject of this guideline is the environmental qualification of electrical, control and instrumentation, and certain active engineering components, and of certain structures. Their qualification is not a single event, but a process accompanying the lifetime of equipment through maintenance of theirqualified state.

The environmental qualification of equipment is a process commencing at the design phase of the nuclear power plant and lasting during its whole lifetime;it includes the initial qualification of equipment and the necessary programmes and procedures, and those methods and measures, which make possible to maintain the qualified state during the whole qualified or operating lifetime. Accordingly, actions to be performed during operation, but to be considered even in the design phase are also discussed. The objective of environmental or with other words environmental resistance qualification of nuclear power plant equipment is to maintain the functionality and the achieved level of required performance indicators of safety significant equipment during operation, in order to keep the equipment operable in spite of the circumstances and operating events of its past, and to ensure that it fulfills its safety function under the conditions of the most serious event belonging to the design basis, and if necessary even after its occurrence for the required period of time. For equipment of safety systems the spectrum of environmental conditions covers the normal operating conditions, their deviation due to a transient state and the accident conditions considered during the design of the nuclear power plant. In order to meet the objective of environmental qualification during the design and establishment of nuclear power plants, only such equipment could be installed in the plant, which are able to provably perform their function under the environmental conditions of the given installation location, or which do not hinder the performance of the safety function by other equipment. In the case of such operating nuclear power plant, the design basis of which does not include the requirements of environmental qualification, the


objective of environmental qualification is to specify and prioritize those actions, which are necessary for achieving, demonstrating and maintaining the qualified state of equipment.

The objective of this guideline is to describe the possible method for execution of these actions.

In order to comply with the regulatory requirement the licensee may applyany approach differing from, but equivalent to that described here.

1.2. Corresponding laws and regulationsChapter 4.5 of Volume 3 of Nuclear Safety Code (NSC) issued based on the authorization of Article 4. § (1) of the Gov. decree 89/2005. (V.5.) Korm on the generic rules of procedures of the Hungarian Atomic Energy Authority in nuclear safety regulatory matters includes the requirements of environmental qualification belonging to the design and establishment of the nuclear power plant. Chapter 4.7 discusses the lifetime requirements, detection of adverse effects on components and the considerations of lifetime management, in a word the ageing management; while Chapter 4.8 includes requirements for structural materials of component parts in order to achieve the required lifetime. Chapter 4.6 is an important chapter being in close relation with those above; it discusses the maintenance and testing activities to be performed in order to maintain and verify the qualified state following the qualification procedure.


2. DEFINITIONS

Active components:Components fulfilling their safety function with moving parts or by changing their shape or properties.

Design lifetime of a nuclear power plant unit: Lifetime that is taken into account during the design of the nuclear power plant unit, for which the safe operability is justified by the facility safety report.

Identical part, structural element, component: The part, structural element or component is identical, if all of its properties (material, geometry, mode of operation, environmental resistance, reliability, mode of fabrication, type, etc.) are the same as those of the original one.

Equipment qualification:The demonstration of that the safety classified equipment of the nuclear power plant can fulfill their design safety function during their whole lifetime. Various qualifications are exist: environmental qualification, seismic qualification, fire resistance qualification, electromagnetic compatibility qualification, etc.

The maintenance of performance parameters necessary for ensuring the functionality and for achieving the safety function should be justified both under normal conditions (including: designed special service states), and under conditions taken place in the case of deign basis events.

The equipment qualification should take into consideration of the ageing effect of environmental and operational circumstances occurring during the lifetime of the equipment. The process of equipment qualification includes the measures connecting to both achievement and maintenance of the qualified state.

Safety analysis: Examinations and tests to be performed in order to evaluate whether the safety of systems, structures and components of a nuclear power plant comply with the requirements.


Lifetime: Lifetime specified during design; besides the design lifetime, the “service lifetime”, which means the period between installation and disassembly, can also characterize certain equipment.

Earthquake: OBE, SL-1 - Design earthquake During and after the design earthquake the plant operates undisturbed or shuts down, but it can be restarted after (or even without) the accomplishment of certain tests. This American definition is identical with the SL-1 earthquake as defined by the IAEA.

SSE, SL-2 - Maximum design earthquake The largest earthquake in the case of which the plant can be safely shut down, and maintained in shut down state without release of any radioactive material. This American definition is identical with the SL-2 earthquake as defined by the IAEA.

Similar part, structural element or component:A part, structural element or component is similar, if the safety analysis approved by the authority has justified that it is equivalent to the original one.

Authentic data:Information compiled and documented in an understandable and followable manner, which provides the opportunity for independent reviewing the deductions made and conclusions drawn. Such data are the manufacturer’s technical descriptions, testing records and analyses, etc.

Maintenance:Activities performed on nuclear power plant systems, structures and components that aim at guaranteeing that they can reliably and economically fulfill their function as designed within the design lifetime of the unit. Two types of maintenance activities are distinguished as follows:

- preventive maintenance,- corrective maintenance, i.e. repair.

The preventive maintenance consists of cyclic maintenance (independently of the actual condition; its scope, method and frequency is specified on the basis


of experience and prescriptions) and condition dependent maintenance (its scope, method and duration is determined based on changing of measured or observed parameters).

The corrective maintenance is to be accomplished because of the occurrence of a failure. The scope, method and time point of the repair is dependent on the extent and nature of the failure.

Maintenance programme: Long term plan of maintenance activities to be performed on certain systems, structures and components, which plan is developed for maintaining the design function of systems, structures and components, and for preventing and avoiding the safety consequences of failures.

Initiating event:Such event resulting in deviation from the designed service states, which occurs due to technical reasons inside the facility, the intervention of personnel, or due to artificial or natural effect originating from the outside environment, and which may lead to anticipated operational occurrences, design basis accidents or severe accidents.

Environments:The following environmental conditions are reasonable to be distinguished in a nuclear power plant:

- Mild: environmental conditions appearing during normal operation of the nuclear power plant that do not alter significantly if an accident (including abnormal operating states) occurs.

- Harsh: environmental conditions appearing during a design basis event (DBE) of the nuclear power plant that alter significantly in comparison with those appearing under normal service /such events are LOCA, HELB, MSLB/.

- Degraded: service conditions that altered in comparison with the initial environmental conditions or with those that were considered during the initial qualification (higher temperature, humidity, radiation, fungus, etc.).

Environmental resistance qualification or environmental qualification:Determination of resistance to environmental and service conditions ensuing during the lifetime of the equipment. This is the environmental part of the equipment qualification. The validity period of equipment qualification is


specified during the qualification by the simulation of the service environment.

Qualification: Evaluation of the applicability of organizations, persons and/or tools for performing activities relating to the safety of the nuclear facility, and for fulfilling functions in order to support the decision to be made on their approval.

Maintenance of the qualified state:In the case of certain types of equipment and instruments, the process of environmental qualification is followed by the accomplishment of a programme, which ensures the long-term maintenance of operationalenvironmental parameters, environmental effect parameters and other conditions that were taken into account during the qualification. The control of monitoring the environmental parameters that are necessary for demonstration of the maintenance of the qualified state of equipment is performed during the process of Monitoring of Maintenance Effectiveness.

Qualified lifetime:That lifetime of components during which the component, based on the pre-installation qualification procedure is (certified) able to fulfill its design function during the necessary time-period even under such physical circumstances, which do or might appear in the environment of the component during fulfillment of the safety function.

Qualification margin:Difference between the actual service parameters and those parameters belonging to conditions (that are more rigorous than the actual service conditions) postulated during equipment qualification.

Normal service:Such operation of the nuclear facilities during which the operational limits and conditions approved by the authority are complied with; including load changes, shut-down, start-up, refueling, maintenance, test, etc.

Ageing:Effect of operational, environmental and technological conditions on equipment that result in occurrence and further development of degradation mechanisms during a certain period of time, which conditions are within thedesign basis accidents (but do not include them).


Ageing management:Series of those analysis, operation, maintenance, in-service inspection and testing, monitoring, repair and reconstruction activities related to degradation processes caused by ageing identified on designated components of the nuclear facility, which activities ensure that the component remains able to fulfill its function with the maintenance of the minimum necessary safety margin.

Passive component: Those components, which perform their design safety function without moving parts and changing their shape or properties. (General examples of passive safety functions are included in the Annex of Guideline 4.14.)

System:Entirety of components serving for fulfillment of a given function.

Component: A unit performing individual sub-function of a given function (e.g. equipment, instrument, piping, building structure).

Significant ageing process: Damage caused by such a degradation process, as a consequence of which the equipment, under normal and abnormal service conditions, become responsive in a more and more serious and observable manner with regard to its function to be performed during a design basis event.

Seismic classification:Categorization of systems, structures and components of nuclear facilities in relation to their role in prevention of the safety of the facility during an earthquake.

Design basis:Those attributes of a nuclear facility, the existence of which is required for the controlled management of anticipated operating events and postulated accidents by complying with the specified radiation protection requirements. The design basis includes the anticipated service states and the accident conditions generated by postulated initiating events, the significant assumptions and in certain cases the specific analysis methods as well. Those anticipated operating events belong to the design basis, which can be derived from the postulation of the lack of a safety actuation.


2.1 Abbreviations

PSRR Periodic Safety Review Report

NSC Nuclear Safety CodeSSC System, structure and component

FSAR Final Safety Analysis Report


3. INITIAL ENVIROMENTAL QUALIFICATION OF EQUIPMENT

3.1. Objective of and general requirements for environmentalqualification of equipmentFor electrical, instrumentation and control components, by taking account of their material properties, the availability of the safety function and the reliability and good quality of the time-limited and non-limited analyses require the qualification of each piece of equipment and instrument selected in accordance with the scope of the qualification procedure.

The initial qualification of components falling under the scope of environmental qualification is required for elaboration of the safety analyses or the time-limited analyses. The qualification provides those service environment and environmental effect parameters, if which are complied with, then the function will be performed for the required period of time and under the required conditions, thus the qualification will remain valid as time goes on. The primary objective of environmental qualification is to justify that not necessary to postulate so called “common cause” (systematic, not random) failures, which would be able to break through the defense line of the redundant system, and to make inoperable all ways of the performance of the required safety function.

The two major sources of common cause failures are the failures in concept and the environment.

Failures in concept would be: design, fabrication, assembly, operational and maintenance failures. The environmental qualification primarily, but not exclusively prevents the occurrence of failures in concept. The environment, as the initiator of common cause failures may act in two ways:The ageing mechanisms occurring in service environment may cause in-service common cause failures, while in harsh environment the sudden damage to equipment or instruments can be expected. The harsh environmental conditions are caused by accidents. The accidents can result in sudden, intensive parameter changes, and consequences leading to significant effects in certain regions of the plant,


thus the failure of one piece of or more equipment would appear in the given area. Due to the latter phenomenon the equipment qualification is interpreted as environmental resistance qualification, however other qualification approach could be also necessary.

The external environmental conditions (e.g. seismic effects) may cause common cause failure even during normal operation. In this sense all safety equipment should have “environmental qualification” in a certain extent. At the same time, as it will be clarified below, the methods and criteria ofqualification will significantly change depending on whether the equipment operate in “harsh” or “mild” environment. Accordingly, the equipment qualification may be interpreted in wider term than the environmentalqualification.

Certain conditions of the environment of equipment have significant effect on its state and performance. These are e.g. temperature, radiation, vapor content and humidity, spraying water and flooding, pressure, vibration, and seismicmovements. A few of these conditions alter significantly only during accidents, whilst others do not change even during accidents. Consequently, the resulted “harsh” or “mild” environment depends primarily on the physical location, rather than the operation of the given equipment or their role in the technological process.

The other group of operating conditions is resulted by the operation of equipment themselves or the served system (e.g. pressure, temperature, flow of operating medium, self vibration). These effects together may result in gradual degradation (ageing) or suddenfailure of equipment. During the design of safety equipment of a nuclear power plant all the potential degradation processes should be considered during initialqualification.

In order to obtain the empirical proofs, the environmental qualification consists of various examinations and tests, target analysis and evaluation of operational experience, or of the combination of the above three methods. Limitations are:

The qualification by analysis is only accepted, if the component hasinitial qualification and it is intended to be operated under environmental conditions differing from the initial qualification.


The qualification by analysis can only be used for justification of toleration of independent (self acting) loads (e.g. earthquake, temperature effects).

The operational experience provides input data only for qualificationto mild environmental conditions.

The qualification by analysis requires logical evaluation and application of proven mathematical models. The analysis should take into consideration of the natural laws, testing and examination data, operational experience and condition indicators.The qualified state can be demonstrated by evaluation of examinations and data from the viewpoint of material properties, by using resistance shown to environmental conditions or failure statistics. However the analysis itself cannot demonstrate the qualified state.

The objective of the selection of methods to be applied is to demonstrate that the ageing degradation suffered by the equipment during the service term (the qualified lifetime) does not result in common cause failure generated by the environment either during normal operation of the unit or in the case if the equipment will operate under harsh accident environmental conditions as considered in the design, even at the very end of the qualfied lifetime.

The mild or harsh character of the environment should be taken into account during the selection of the method; examinations and tests should get priority.

During the qualification those environmental conditions should be specified, under which the qualification itself remains valid.

The purpose of the qualification documentation is to provide authentic data for internal or independent review of the compliance with the qualification requirements for the equipment to be installed, and for determination ofrequirements of supplementary qualification becoming necessary due to alteration of circumstances postulated during the qualification of the already installed (operating) equipment. The requirements for documentation should be specified accordingly. For systems, components and structures performing safety function, the qualification procedure or if needed additional measure should provide such data collection, which could demonstrate that the initial assumptions will remain valid during the whole lifetime of the component!


3.2. The scope of qualification in line with function performance and effects

3.2.1. Role of equipment in guaranteeing the safety of the unitThe equipment (instruments) contributing to fulfill a function should be identified by analysis on the basis of the construction and operation of the system.

The Guideline 4.13 provides guidance for selection of components falling under the scope of environmental qualification.

The equipment serving for post accident monitoring, physical protection, fire protection and radioactive waste management should also be classified during the analysis of their functions. However the determination of qualification requirements for these equipment does not does not serve fornuclear safety interests, it is important from the viewpoint of general safety of the nuclear facility.

3.2.2. Classification of equipment and componentsThe various systems and equipment of the nuclear power plant play different role in guaranteeing the safety of the plant. The nuclear power plant consists of many different equipment, therefore it is impossible to handle all elements in accordance with the highest qualification requirements (from design to decommissioning). The uniform management of equipment can result in degradation of the quality level of systems that are most safety significant, and in unreasonable over-qualification of less important equipment.

According to the above considerations the equipment of the nuclear power plant should be categorized to classes.

The fundamental principles of categorization of nuclear power plantequipment to safety classes are included in Guideline 3.1 titled as “Fundamental principles of safety classification of nuclear power plant systems and components”.

The safety classification of equipment and components provides an objective basis for including components performing basic safety function and those performing safety function in the environmental qualification process. However the qualification of such equipment could be also necessary, the failure of which hinders the operation of other safety important components,


or the operation of which is necessary in situations demanding interventions (SC 1-3+).

3.2.3. Specific aspects of identification of qualification requirements

3.2.3.1. Single failure criterion

The random, individual failures may occur even during activities being in compliance with the rigorous requirements for the highest safety class.

In order to eliminate their negative effect the single failure principle should be applied, which principle requires that a safety system remains functional even if an element of the system or an element of its support systems ensuring its operation fails.

From designer point of view the application of the principle means that the plans should be systematically reviewed to identify the potential locations and consequences of individual failures; and if necessary redundant, diverse provision should be ensured in order to reach the required reliability.

If accident with tube rupture could be assumed in the room or region where the equipment, instruments are located, then this should be included in the qualification requirements. During the compilation of requirements for environmental qualification the single failure principle should mean that:The systems should preserve their ability to perform their safety functions, if the following failure types do occur:

each single, detectable failure (so random failure),

each anticipated failure (so such failures, the occurrence probability of which is high enough) including non-detectable failures,

each additional failure occurring due to a single failure, and

each failure, which is caused by an event requiring protection function.

It should be noted that the failure is not planned; it means not only total loss of function, but a deviation from the defined operating state.

If the assumed accident conditions lead equipment failures, then all these failures and an additional independent, random and individual failure should be taken into account.


It depends on the extent of the deviation whether it is identified as failure; so this extent should be defined when the failure criterion is specified.

3.2.3.2. Common cause and common mode failures

The failures of systems or equipment occurring in identical way are called common mode failures. The common mode failures can be fabricationfailures, which may occur in identical way, but in different time and at different equipment and instrument. Common cause failure occurs when a given environmental, operating condition or human intervention causes failures of more equipment and instruments at the same time, however the mode how the failure occurs can be different per equipment or instrument types. Common cause could be fire, flooding, high temperature and pressure, the earthquake or loss of power, or a human action. Examples of common cause failures are as follows:

Failure of accumulator plants structurally degraded due to in-service ageing that is caused by an earthquake.

Failure of equipment located in the hermetic zone due to the high temperature and humidity caused by a LOCA.

Incorrect closure of redundant valves that are designed to be open during operation due to an incorrect procedural instruction (human).

Drives of motor operated valves are not able to close the valve due toincorrect set values of momentum limiters (human).

The failures can occur due to short effects of overloading or as a consequence of a continuous ageing mechanism.

The main objective of environmental qualification is to reasonably ensure the prevention of common cause and common mode failures.

3.2.3.3. Redundancy and diversity

Systems or equipment are redundant, if they ensure the fulfillment of the system function independently of the operating mode or even if another system serving for the same function is disfunctional.Beyond the duplication of function performance the redundant systems are independent of each other from every aspect, since the failure occurring in a system cannot lead to the failure of another system. The provision of independency requires specific considerations for systems operating with electric signals and sending and receiving digital data.


The principle of physical separation is a very important aspect of redundancy.

The redundancy is aimed to prevent common cause failures. In programmed systems even an incorrect or previously not appeared data can initiate an inadequate code-part of the software, thus such errors cannot be prevented by redundancy, since it means a common mode.

The diversity means that such components or systems are applied for performing the same principal function, which have different operating principle and physical construction. The diverse equipment and instruments may create a redundant configuration as well.

The diversity is aimed to prevent common mode failures. The different constructions, types and operating principles make the manifestation of different failure types probable, thus they protect against simultaneity, so against the loss of redundant equipment and instruments.

3.2.3.4. Role of environmental qualification in grounding the safety of the unit

The environmental qualification means the demonstration that a piece ofequipment is able to perform its required function by taking account of the operating and environmental loads, including the accidents considered duringthe design. This demonstration should cover the whole lifetime of the equipment. Consequently, the environmental qualification should consider the equipment ageing during operation prior to the assumed accident.

The consideration of tests, analyses applied during the environmental qualification and the operational experience, or their combination ensure that environmental and operational common cause failures of equipment do not occur, and that the defense in depth (if the redundancy is appropriately ensured) is not breached. The environmental qualification is achieved on equipment basis even onsystem level, thus the applied equipment are qualified individually and it is assumed that the qualified state of a system consisting of them is also demonstrated. The adequacy of this assumption should be carefully reviewed for each case.

The system and component boundaries play relevant role for understanding the roles of sub-units, which can be (in ordinary sense) assembled individually, but belong together from electrical or functional aspects. The breaking electrical component, so the breaker or the fuse is the component boundary for motor operated components (valves, pumps) and heavy current cables. The heavy current cables may belong to a component if they supply


only one component, or can be managed individually if they supply more components. The transformer connecting different voltage levels should be taken into account as system boundary and as the part of the system. An assembly unit should be the boundary; if such identification system for recording components does exist, which includes the assembly units as welland then it should be used during the specification of boundaries. It should be considered that the design, fabrication, the use materials, the assembly configuration, the operational and maintenance practice may also have effect on qualification.

Due to the above reasons the general environmental qualification data should be carefully compared to the specific conditions, constructional solutions and performance requirements that characterize a given unit of a given nuclearpower plant.

3.2.4. Service loads and environmental conditions

3.2.4.1. Normal operating conditions

The equipment qualification should be achieved for the full spectrum of service loads, including both the operating conditions occurring inside the equipment and the so called “environmental conditions” outside the equipment during normal operation and accident situations. In fact, less load is applied on most of the equipment under normal service conditions than during accident situations; therefore the practical tasks of environmental qualification connect to the analysis of deviations of service conditions and the analysis of effects appearing during accidents.The ageing phenomenon, by taking account of the slow degradation processes caused by service loads are discussed in the ageing guidelines. The common set of the two approach is that the preservation of qualification conditions should be demonstrated by taking account of the alterations caused by ageing processes, and during the management of certain ageing processes that cannot be characterized by quantitative indicators the compliance with the technological and environmental parameters examined during the initial qualification (as the criterion of safe state) should be justified.

The normal service conditions are specified in operating instructions of certain systems and equipment, and in the Technical Specifications (TS) for safety important systems.


The operating instructions identify the scope of parameters causing normal service loads like e.g. temperature, pressure, mass flow, properties of operating medium, voltage, current, and self vibration from operation. These parameters are specified for various operating states including the parameters of continuous operation on 100% power, the load changes, operation in stand-by (reserved) state (which is a specially important operating state for redundant and safety systems), and certain examination and test states.

3.2.4.2. Deviations from normal service state

Deviations from the normal service states as described in paragraph 3.2.4.1 above can occur during the operation of the nuclear power plant. These deviations are usually in connection with the failure of a piece of equipment or a system. Such deviations are e.g.: loss of voltage, loss of venting systems, steam or water blow outs, and inadvertent operation of fire distinguisher system.

The earthquakes should be listed here as well. Such states can be defined as deviations from the normal service state, which last for a short period of time, but probably occur, maybe several times during the lifetime of the nuclearpower plant. The earthquakes are discussed in detail in paragraph 3.3.4.8below. The independent discussion of deviations from normal service conditions is important, because the majority of the regulations on sizing of resistance to loads calculate with other permitted limit values and other safety coefficients for normal service loads and for short term loads. The reasonable explanation of this approach is that the loads permitted for such situations cannot cause equipment failure, however subsequent to such events due to their low frequency the operator can verify whether the failures really have not occurred and the unit or the system can be safely re-started.

3.2.4.3. Accidents

The designer’s objectives in connection with the damage caused by the most serious accidents considered in the design, like loss of coolant accident (LOCA), design basis earthquake (SSE) or high energy line break (HELB) are the safe shutdown of the unit, removal of the residual heat and mitigation of accident consequences.

Those equipment should be qualified for such loads, which participate in the performance of the above identified function and the function to be performed can be limited as a single operation.


The re-start of the unit and the maintenance of the long-term operability of equipment after the time period calculated from the accident analyses is not required.

“Harsh” environment occurs at the location of the mentioned accident. A key designer task of equipment qualification is to specify the extent of the accident and the design parameters of the assumed “harsh” environment. If the equipment, instruments have post-accident monitoring or consequence mitigation function, then they should be qualfied for the post-accident state.

3.2.4.4. Service loads

The normal service, the abnormal and the accident conditions should be identified in the Final Safety Analysis Report (FSAR) based on design service parameters of the nuclear power plant and the analysis of possible (with not negligible probability) event and accident scenarios. The parameters of postulated service and environmental conditions should be verified and if necessary modified during the annual review of the FSAR onthe basis of operational experience and results of safety analyses performed during the lifetime of the plant. The consequences of a modification should be enforced during the environmental qualification. In the case of previously performed qualifications it may require the review of qualifications.

3.2.5. Consideration of equipment type

3.2.5.1. Effect of external and internal loads

The equipment type basically affects the sensitivity to environmental and service conditions that were considered during environmental qualification. Besides external, environmental effects the equipment are exposed to internal, technological effects as well. For thermal technology equipment the internal loads are almost always significantly higher than the environmentalloads.

For electrical equipment the characterizing factors of external environmental effects are clear from the operational experience: the lifetime and the reliability of these equipment basically depend on external environmentalconditions. In certain cases the accident situations belong to the design basis of equipment, while in other cases their operability is determined by the conditions occurring during the accident.

The mechanical effects entailing assembly of cables can affect the condition of the cable-sheath and isolation. It is especially valid for cables that are


frequently connected and disconnected. Consequently, this above and the fact that the replacement of cables is more difficult than of equipment or instruments requiring the cable should be considered during the design of the layout. The equipment and instruments with short lifetime could be replaced and repaired several times during the lifetime of the cable, which could multiply the effects on the cable due to its frequent connection and disconnection.

3.2.5.2. Consequences of structural materials

The materials applied in parts of engineering and electric equipment and instruments have important effect.

The metals, with a few exemptions are much more resistant to the effect of the external environment than non-metallic elements, especially than organic materials with large molecules. The engineering equipment are generally made of metal, whilst a significant part of the electric equipment is organic material.It is not neglectable also from the viewpoint of environmental qualificationthat engineering equipment are very carefully sized and verified for effects generated by technological loads (e.g. see the various strength analysis norms). The failure modes and their consequences affect differently on the performance of complete equipment. In general, the failure of non-metal parts of mechanical equipment (sealing, lubricants, packed joints) can lead to degradation of performance parameters at most, but does not result in disfunctionality of equipment; whilst the failure of non-metal parts of electric equipment very often result in total disfucntionality.

3.2.5.3. Testability

The major part of engineering equipment may be tested during operation for technology generated conditions, which may be identical with accident conditions.

The harsh environmental conditions cannot be modeled on electric equipment at their installation location.

3.2.5.4. Seismic effects

In general, the effects of a seismic event on passive engineering and on certain electric equipment, like on cables, do not result in incompliance with


the permitted loads; however this possibility should be examined for active engineering equipment. In general, the effects of seismic events should be examined for active electric equipment. It is recommended also for hermetic penetrations and connections among the passive components.

3.2.5.5. Ageing effects

The ageing effects appear differently on metal base materials of mechanicalequipment and on non-metal base materials of electric equipment. The most characterizing ageing processes of mechanical equipment are the wear, fatigue, corrosion and erosion of metal parts, whilst the degradation of non-metal structural materials appears only as secondary effect. The priorities of these aspects are just the opposite in the case of electric equipment.

3.2.5.6. Environmental qualification aspects of active engineering components

The active engineering equipment fall under the scope of the equipment to be qualified only, if

they create a commodity machine group with the electric, and instrumentation and control components,

the accident environmental loads of an engineering component cannot be neglected in comparison with normal service loads,

the question of their earthquake resistance should be handled.

The engineering equipment that are designed with adequate conservatism need less strict, formal qualification requirements, than the safety important electric equipment. It should be taken into consideration during the qualification of mechanical equipment that the sensitivity of metal parts to environmental parameters is generally much less than of parts made of organic material. Consequently, generally enough to demonstrate for these equipment that the parts made of organic material do not lose their operability under anticipated accident conditions. Nevertheless, there are special cases. The time limited analyses of active engineering components require to perform environmental qualification as well; especially in those cases when they perform basic safety function or safety function, and any of the design accidents endangers the function by significantly changing the environmental parameters of normal service. Two additional aspects should be also


considered for determining the scope of environmental qualification, thus it should be examined whether the failure of the equipment can hinder the performance of any safety function or whether the equipment is needed if a situation requiring intervention occurs. The active engineering components should be qualified for environmental conditions generated by LOCA, flooding or high energy line break, if they create worse environmental conditions than of the service state.

If the engineering equipment forms a machine group with an electric machine, it is equipped with electric or electronic sub-units, parts in one casing, then environmental effects that are worse than the service conditions should be postulated in situation when the LOCA or high energy line break generates real environmental effects. Such components would be pumps and valves.

If erosion, corrosion and chemical effects belonging to the normal operation and endangering the safety function do occur, then they should be taken into account in the ageing management programme. The existence of erosion, corrosion and chemical effects should be examined for active engineering components performing safety function, even if the function is not endangered by design basis accidents through changing of environmental parameters. (Such components would be pumps valves). If such effects exist, then an ageing management programme that takes them into account should be implemented. If the environmental loads of an engineering component can be neglected in comparison to normal service loads, then the ageing management programme should consider the normal operation only.

3.2.5.7. Environmental qualification aspects of building structures

Environmental qualification should be performed for structures containing harsh conditions, if their failure under such conditions hinders the performance of the safety function necessary for the management of the event.

3.2.6. Degradation processes – consideration of ageing effectsA critical element of environmental qualification is the evaluation of the degradation mechanisms caused by operational and environmental conditions occurring during normal service.


The actual FSAR should include the residual lifetime of selected components and environmental conditions of the facility. The collection of trends of weather data is important for the evaluation of environmental tendencies. Such data are the number of warm days, daily average temperatures, and temperature and flow rate values of natural cooling waters.

If significant ageing process limiting the lifetime is identified on equipment, then it should be taken into account in the environmental qualification programme of equipment and during the determination of the qualified lifetime. The following effects may cause smaller or greater loads:

environmental temperature, pressure, relative humidity,

steam and its condensation, chemical effects,

irradiation,

vibration effects,

(number of) service cycles,

electric voltages, over-voltage waves.If the equipment do not fall under the scope of environmental qualification (see the definition), and significant ageing factor cannot be identified, then the simulation of accelerated ageing is not required. However other examinations depending on other aspects of the qualification may be necessary.

The progress of identified ageing processes can be followed by in-service function tests, various monitoring methods, during maintenance; for electric components by material testing of isolation materials and cables. The introduction of gentle service modes that slow down the ageing is possible for each piece of equipment. The decrease of temperature, the shielding and the changing of installation location may have significant role in the case of electric components. Where appropriate, ageing management programme decreasing degradationeffects should be applied. The venting decreases the thermal effect and the humidity. The distance and shielding walls may protect against radiation effects. The selection of an adequate cable schedule may reduce the thermal, radiological and humidity effects on cables. If necessary the replacement of aged equipment should be decided.


There is no unified ageing management method that is applicable to each component and degradation mechanism, only a few generally applicable steps can be mentioned, which appear in different ageing management programmes. These are as follows:

Review of equipment construction.

Review of design and applied materials.

Specification of technological and environmental loads.

Identification of significant ageing processes.

Analysis of ageing processes, implementation of ageing tests.

Determination of the management method of ageing processes that cannot be managed by tests.

Estimation of qualified lifetime.

Planning of maintenance, material testing, test and monitoring activities.

Specification of non-compliance criteria, planning of replacements.The effect of ageing processes should be taken into account during environmental qualification by testing and during selection of parameters to be examined by testing. These parameters could be characterizing parameters of the above listed effects. If significant ageing effect can be identified in the operational environment of equipment, then accelerated environmental effect simulation (artificial ageing) that is in compliance with the validity period of equipment qualification should be performed during equipment qualification by testing. The types and sequence of tests are prescribed in standards.

The effects of ageing processes appear as input data for qualification by analysis.

Qualification by analysis is only possible if the component has initial environmental qualification, and it will be operated under milder environmental conditions differing from the initial qualification. The qualification by analysis can be used only for demonstration of compliance whit individually affecting loads (e.g. earthquake, seismic effects).The parameters of conditions occurring during the service period considered during the qualification by operational experience should be compared with


environmental load parameters expected at the installation location of the equipment to be qualified.

3.2.7. Application of the “Space” methodThe method mentioned in the title is one of those formalized procedures, which can be used for identification of certain components requiring ageing management. It is primarily applicable during qualification and ageing management of cables, connectors and expansions.


3.3. Input data of initial environmental qualification

3.3.1. Environmental qualification specificationThe qualification specification serves as basis for the environmentalqualification programme and its execution. The qualification characteristics should be specified for each item of the qualification scope as follows:Identification of the equipment:

The accurate denomination and type of equipment should be given. The identification data provide unambiguous identification of various components belonging to a given specification item (e.g. pump with or without electric motor, lubricating and cooling system, with or without control and measurement instruments, with or without connecting flanges, piping, valves).

The type includes the basic operational parameters of given piece of equipment or identifiers of its location in the type series. If the type is missing, then the above parameters are specified individually.

Identification of the installation location of equipment: The identifiers (alpha-numerical identification signs) of the location of equipment within a technological system should be given, and the identifiers of the installation location or room. If more, similar equipment are installed in different locations at the nuclear power plant, then the installation location that is authoritative from environmental qualification point of view should be identified as well.

Technological loads: The technological loads are discussed in the FSAR, among which the following ones should be considered during environmental qualification:

Performance requirements and load parameters depending on the place within the technological system for abnormal and accident situations

Maximum loads serving the basis for qualification

Parameters of stand-by state relating to redundant equipment and those belonging to safety system

Values of loads appearing for a short time and of those generated by transient effects.


Depending on the system-technology position of equipment the electromagnetic and radiofrequency effects and the occurring overstresses should be mentioned among the technological or environmental effects, and their parameters should be listed.

Environmental parameters: The environmental load parameters affecting the qualification conditions that occur during normal, abnormal and accident states should be listed. Environmental conditions caused by equipmentfailure (including the failure or performance degradation of support systems) should be considered during identification.

Tasks and safety functions of equipment: The technological and safety functions of equipment should be specified in such extent that the

effect of function performance on nuclear safety,

required duration of function performance (measured in the relative timescale of postulated accidents), and

the redundancy of equipment

could be identified.Role of equipment from other aspects: It should be determined whether the

equipment failure may hinder the performance of the safety function of components.

Whether the equipment are required at the occurrence of such events, which do not mean immediate accident, but may easily generate one. It should be determined whether the equipment are necessary in case of fire, anticipated transient without scram (ATWS), temperature and pressure shock on primary circuit pressure boundary components, and during total loss of power (SC1-3+).

Type of qualificationIt should be determined whether the given equipment should be qualified for mild or harsh environment. The qualification could be only neglected, if the criteria used for specification of the scope of qualification are not met. The “equipment” is an item of qualification specification, which can mean the set of identical or similar equipment being installed at different locations and performing different functions, by taking account of the aspects used for identification of system and component boundaries as described in paragraph 3.2.3. It should be justified in this paragraph that


the equipment belonging to a qualification group on the basis of the above listed parameters are really identical or similar enough from environmental qualification point of view.

Planning of ageing and ageing managementThose degradation processes, which have effect on equipment due to technological or environmental loads, and those degradation locations, where the degradation processes occur should be identified.

The criteria for inoperability of equipment should be specified, what is not possible without specifying the criteria of postulated failures.

As it was mentioned above a failure should mean not only the total loss of function, but the deviation from the specified service state. It depends on the extent of the deviation whether a deviation is a failure or not, and this extent should be specified as a part of the failure criterion.

The maintenance, material testing, monitoring, test, replacement and other design requirements for managing them should be specified (see also Chapter 4 of this guideline).

Mode, extent and requirements of initial qualification methodThe qualification specification should identify based on the above listedinformation

the method applicable for equipment qualification (testing, analysis, operational experience or their combination),

standard, regulation or other prescription to be considered as the basis for qualification,

testing scope and sequence,

testing parameters and compliance criteria,

requirements for qualification documentation.

3.3.2. Performance requirements for equipmentThe required technical parameters and duration of their preservation during various service states, transients and accidents should be analyzed together in order to specify the performance requirements.


The following aspects should be considered during specification of technicalparameters

- certain equipment perform more functions, and different performance requirements may be applicable,

- technological (operational) and safety functions may belong to these functions,

- the operability of each component may not be required for performing the safety function,

- different approaches should be applied to active and passive functionsduring the equipment qualification (e.g. operability and integrity of MCP).

With regard to the time period of function performance the following aspects should be considered:

- certain functions are required to be performed for a few minutes, whilst others are required to be performed continuously (e.g. for a year),

- certain safety systems should be continuously operable under service and accident conditions, but may be inoperable in harsh environment caused by LOCA (e.g. certain elements of neutron measurement system),

- the required time of operability of certain equipment is longer in the case of smaller accidents (e.g. “small” tube rupture) than under LOCA conditions,

- the load durations should be ordered in specified time categories (e.g. 90 sec, 5 min, 1 hour, 10 hours, 1 day, 10 days, 100 days).

Reasonable safety margins should be used for load parameters and time periods to be used for compilation of qualification performance requirements. The IEEE323 standard recommends 10% as safety margin. Reasonably conservative, common requirements covering more service states or accident situations should be used during the compilation of performance requirements of initial qualification.


3.3.3. Locations of equipment to be qualifiedThe regions containing safety equipment may be divided to sub-regions for environmental qualification. Such a sub-region may be an individual building or a given room or room-group of a building. The environmental parameters of certain regions should be determined for normal, abnormal service and accident states that are taken into account inthe design.

It may be revealed during the analysis that specific “hot spots” should be identified within a sub-region during certain accident due to the significant, local changes of environmental parameters. The specification of environmental parameters of normal an abnormal service states has two objectives:Compilation of such an equipment specification, which ensures that only those equipment could be purchased which are able to tolerate the normal and abnormal service parameters for a long time.

Consequently, the followed practice is that the design maximum ofenvironmental parameters (by chance the normal values with margins) isspecified. This approach on the one hand ensures that the purchased equipment can operate under conservatively specified environmentalparameters, and on the other hand it provides environmental qualificationrequirements for safety equipment operating in “harsh” environment.

Identification of those ageing processes induced by environmental and technological reasons, which go through the safety equipment prior to the design accident. The equipment qualified lifetime (during accelerated ageing tests) should be determined accordingly for equipment operating under “harsh” accident conditions.

3.3.4. Environmental attributesThe instrumentation and control equipment and instruments should be clearly distinguished during the implementation of ageing management programmes on the basis of the environmental conditions under which and the room in which they operate.

The consideration of the categorized environmental conditions may provide significant advantage during the initial qualification (or its completion) of equipment and instruments operating in different rooms.


The greatest attention should be paid to components operating in harsh environment. The changes of environmental properties very differently affect the various materials applied in equipment. Most environmental parameters appearing in the nuclear power plant have no significant damaging effect on certain materials, but they have on others (e.g. on plastics). This differentiation should be considered for equipment made of various materials.

The thermal and oxidative ageing is relevant for passive electric components (e.g. cables). The thermal lifetime of cables may be examined and analyzedby standardized methods. The cable connections should be examined as well.

The specific characters of each load should be taken into account during the analysis of the effect of different environmental parameters.

3.3.4.1. Temperature

The temperature appearing at different points of the equipment is dependenton the environmental temperature of equipment, the quantity of heat generated inside the equipment, and of heat transferred towards the equipment from other equipment or from the service medium.

The range of environmental temperature is usually between the externaltemperature and the service temperature characterizing the given sub-region(room) of the nuclear power plant being in operation. The environmentaltemperature changes due to various anomalies (e.g. loss of a venting system) or accidents (e.g. various tube ruptures, including LOCA). The self-heating of equipment is dependent on their service mode (e.g. temperature of coils under voltage is higher than those free of it). The alteration of temperature modifies the properties of structural materials. This change may be immediate (e.g. decrease of yield point by increasing temperature) or slowly affecting (e.g. thermal ageing of insulation materials).

Similar to the majority of the load types the temperature changes can cause parameter changes with smaller or larger rate in the affected materials, only within certain range. If a certain limit is exceeded, the effect of temperaturechange may result in immediate, catastrophic degradation of the functionalproperties and inoperability of equipment. Most of the polymers become softer by increasing temperature, their relative elongation increases, their electric properties change. The reliability of


electronic elements decreases by increasing temperature. Occasionally, the rate of various chemical reactions changes drastically by changingtemperature.

One of the most important lifetime limiting factors of the electric equipment is the thermal ageing, consequently it is very important to be aware of the “temperature life” of equipment during equipment qualification activities performed during both design and operation.

3.3.4.2. Radiation

Among the alpha, beta, gamma and neutron radiation, the effects of gamma radiation are the most significant regarding environmental qualification. The radiation effects on materials have two basic mechanisms: physical displacement of atoms and electrons, and activation, ionization of atoms and molecules. In principle both mechanisms can be noticed in any material, but in fact the damage to metals and in general to inorganic materials can be made by displacement of atoms. The damage to organic materials can be also induced by chemical processes occurring due to activation and ionization. The neutron radiation does not cause direct ionization, only through radioactive materials produced by atomic interactions. Its effect is not significant on organic materials, but very significant on metallic parts, e.g. on the reactor pressure vessel, the fast neutron induced embitterment of which will be discussed as a part of ageing management. The damaging effect of neutron radiation on organic materials being in the close vicinity of the reactor should not be neglected. The beta radiation consists of high energy electrons. The energy transfer is made partly by ionization, partly by braking radiation. The penetration capability of beta radiation is about 3 mm in typical organic materials, whilst only about 0.5 mm in metals. Thus the protection against beta radiation can be solved by a relatively thin metal layer.

The penetration ability of gamma radiation is relatively high; its effects are through interaction with electrons and through ionization caused by electrons.

In organic materials the links between connecting atoms break up due to radiation, and free organic radicals or smaller molecules are produced, which make reaction with neighboring molecules. The properties of new molecules may significantly differ from original material properties.


The radiation damage is dependent on the absorbed radiation dose, the effect of which should be usually considered with the simplifying assumption of equal doses equal damages.

The radiation accelerates the oxidative degradation processes in mostpolymers.

Generally, the semiconductor instruments can tolerate radiation to 103 Gy, among them the metal oxide semiconductors only to 10 Gy.

The radiolysis and radiation generated oxidation characterizes certain rooms of the nuclear facility. If such effect appears, then its ageing effect becomes significant for cables.

3.3.4.3. Pressure

The external pressure and especially its rapid alteration very often lead to failure of closed box structures. Additionally, the characteristics of currentbreakers may also be altered by changing current. One of the most relevant effects, which may be induced by alteration of external pressure is in connection with the saturation pressure of the steam.

3.3.4.4. Moisture and humidity

The relative humidity of air may change significantly as the function of the barometric conditions and the microclimate of the room. The latter one may be significantly affected by the leakages from pipelines and sealing units of equipment.

The spraying water from leakages or by chance from the (controlled or failed) actuation of the fire distinguisher system has similar effect.

The water can enter into inadequately closed connector boxes, cabinets and may accumulate in their lower parts.

All types of humidity facilitate the development of corrosion processes, which have direct damaging effect on metallic parts and endanger their operation. The corrosion effect results in serious damage to the state of electric cable and wire ends and connections.

The humidity can directly damage the physical, mechanical and electrical properties of organic materials, and may lead to deformation of their shape. The hydroscopic materials (e.g. polyamide) is especially endangered from this point of view. The water absorption on the surface of organic materials may be resulted by both physical and chemical processes. The absorbed water molecules may interact with the molecules of the material and may


change their chemical properties. Other water molecules may cause material growth. Moisture, dampness and humidity may cause further chemical or organic degradation.The existence of surface moisture significantly alters the resistance and dielectric properties of isolation materials. The presence of moisture aggravates the thermal and radiation degradation of isolation materials.

3.3.4.5. Steam

The steam combines the damaging effects of high temperature and humidity. The steam condensation on cold surfaces results in their rapid warm up (condensation heat transfer). This process is much faster than the warming up by hot air. The condensed moisture shows its damaging effect by remaining on the surface or accumulating in various locations. The steam pressure has relevant role in specification of that whether the environment is saturated or overheated. If the surface temperature of structures is higher than the saturation temperature, then the surface moisture will dry up. The steam induced load typically entails the post-LOCA “harsh” environment.

3.3.4.6. Flooding

If flooding is postulated in the safety analysis, then environmentalqualification for flooding should be performed by taking account of the single failure criterion (paragraph 3.2.3.1). If flooding is not postulated, then this qualification could be neglected. Galvanic connection appears between the cables and connections with damaged isolation and the environment, if they are under water. The flooding accelerates entering the humidity to closed boxes, appliances, especially if significant hydrostatic pressure also appears. The flooding or dipping into water may cause dissolution of certain materials. The condensate that is pure in ions has more aggressive rinsing, damaging effect than the water that is not treated chemically.


Many organic materials are produced through condensation process, when water is generated when two or more molecules are combined. In the presence of water, the risk of a reverse process exists for such materials (e.g. capton), consequently parts made of such material should not be applied.

3.3.4.7. Chemical effects

The various chemicals can affect primarily by their presence in service fluids.

The effect of chemicals in the spray system of the hermetic zone can be important, if it is in service.

The various chemicals may also cause corrosion (e.g. dripping boron acid solution on carbon steel elements being boundary surface of the hermetic zone) or may lead to generation of toxics, fire and explosion hazardous gases (e.g. boron acid on aluminum surfaces).

The ionic chemicals that are either in a water solution or condensed bymoisture can significantly increase the conductivity of the water and worsen the isolation characteristics. The effect of chemical materials highly depends on the type of materials at present, the duration of contact, the temperature, the thermal and radiationeffects prior to contact, the pH value, the presence of humidity or other chemical materials, etc.

3.3.4.8. Earthquake

The earthquakes cause random ground motions beneath the building structures of the nuclear power plant, which are transferred to internal equipment and elements through building elements.

In general, an earthquake means a relative low frequency (1-33 Hz) vibration load.

Exact measuring value does not exist for measuring the earthquake intensity. The intensity is a number defined in an empirical scale for a given location, which qualifies earthquakes on the basis of subjective observations, damages to buildings and of changes observed in the environment. The Medvegyev-Sponhauser-Karnik 12 stage MSK-64 scale should be used in Hungary. The loads on equipment are dependent on the “response” movement, rather than on the direct motion induced by the earthquake. This response motion depends on the frequency of the exciting motion. The acceleration responsespectrum is such a frequency-acceleration function, which is derived by the association of amplitude and frequency of maximum response acceleration


given to an acceleration signal of a selected resonance frequency, single-mass floating system.The response spectrum depends on damping attributes of connectingelements between the exciting medium and the examined equipment. During environmental qualification, the seismic load should be specified by taking account of the seismic characteristics and history of the surroundings. Two characterizing limit values should be identified:

Design earthquake (OBE or SL-1): earthquake, under and after which the plant operates undisturbed, or stops but it can be restarted after or without the achievement of specified examinations. Maximum design earthquake (SSE or SL-2): maximum earthquake, under which the plant can be safely shut down and kept in shut down position without releasing radioactive material.

3.3.5. Initiating event to be consideredThe environmental conditions to be considered during the initial qualification should include the situations taken place after the occurrence of design basisevents.

The initiating events to be considered should be identified on the basis of the Final Safety Analysis Report of the nuclear power plant.

The initiating events having similar effects from the environmental qualification point of view, with appropriate grounding, could be categorized to such groups, which cover, with reasonable conservatism all environmental load parameters generated by any elements of the group.

Beyond the facility level initiating events, individual equipment failures that can alter the local environmental conditions should be also taken intoaccount.

3.3.6. Ageing processes to be consideredOnly the significant degradation processes should be taken into account during environmental qualification.

The effects of degradation processes should be analyzed individually for allequipment and degradation locations, and by taking account of their mutual relations.


The methods for analysis of degradation locations and processes are discussed in Guideline 3.13 “Consideration of ageing processes in the design of nuclear power plants”.

3.4. Conduction of the initial environmental qualification

3.4.1. Standards and regulationsThe environmental qualification should be conducted in accordance with the standards applied in nuclear industrial practice, the norms approved by international organizations or with an individually elaborated environmental qualification programme that is approved by the authority.

The nuclear industrial, nuclear power plant specific standards should get priority during the selection. If such standard do not exist, then the IEC, IEEE, KTA, EN and MSZ standards should be applied.The informative lists of relevant environmental qualification standards beingeffective at the issuance of this guideline can be found in the Annex.

3.4.2. Qualification criteriaThe qualification criteria should be specified in accordance with equipment and examination specific prescriptions of the standards and regulations mentioned above.If the standards offer alternatives for scope, methods and criteria of examinations, then the concrete requirements should be selected in line with the safety classification.

The Standard IEC-61226 identifies several requirement categories, and thus defines examination objectives:

functionality,

reliability,

performance,

environmental resistance,

qualification assurance.The standard specifies general and specific requirements for the listed requirement categories by safety classes. The A, B and C safety classes defined in the standard are identical with the SC 2, 3 and 4 respectively, what


means applicable association for electric and instrumentation and control components, since according to the effective criteria such components are not categorized to SC1.

3.4.3. Qualification reportThe qualification report should document each step of the qualification process in such a way that it could be audited, the validity of the initial qualification could be judged and the necessary supplementary measures could be specified if circumstances are changed. The qualification document:

- should identify the qualified equipment and the validity period of the qualification,

- should describe the qualification procedures,- should specify the acceptance criteria,

- should clearly evaluate the test results,- should describe the authoritative data of the tests,

- should list the experienced deviations and should describe the way of their correction.

The document should include sufficient information on the applied equipment and analysis methods.

3.5. Evaluation of the data of the initial environmentalqualificationInformation from several sources should be processed during the initial environmental qualification, in many cases on the basis of the results of adequate engineering judgment. Consequently, it is not possible to compile a unified prescriptive standard system for the entire environmental qualification. However a few important, requirement type elements can be highlighted.

3.5.1. Selection of qualification standards and criteriaThe normative qualification prescriptions appear in large number, sometimes in various forms. The designer should identify the standards and regulations, the prescriptions of which were applied and those not applied (in general the latter ones should be justified) during environmental qualification.


3.5.2. Required environmental conditionsIt should be verified that the normal service, abnormal and accident conditions are correctly specified, including those already discussed effects like local temperature differences, self-heating, radiation shielding.

3.5.3. The service conditions and the required performance parametersIn addition to verify the specification of operating conditions and performance parameters, it is important to review whether sufficient and appropriate instrumentation is available for verifying the compliance and stability of the important parameters, for executing the monitoring programme.

3.5.4. Review of qualification reportsThe review should especially cover the evaluation of deviations, weak points, limitations and non-compliances that are identified in qualification reports.

The deviations are often coming from the differences between service parameters and those applied during tests, and between service and test configurations.

3.5.5. Similarity of operating and tested equipmentThe similarity is complete only in the rarest case. An important difference is if e.g. the manufacturer of the tested and operating equipment is not the samecompany. It is especially important, if the operating equipment was fabricated by the manufacturer not possessing nuclear power plant level quality assurance system. In general, the limits of parameter ranges of equipment belonging to a product type are very accurately specified by the standards. Usually the same manufacturer, identical raw materials, similar geometry, limited size deviations may belong to a group of the series (however establishment ofqualification groups and selection of items to be tested always requires individual engineering judgment). The manufacturers generally preserve the right to “modify their product in harmony with the scientific and technical development”. Nevertheless, the modifications do not follow the trend of technical development sometimes, but economical approaches are governing them. These modifications are not identified in the product documentation sometimes, thus the evaluation


should cover the differences between the tested equipment and that is to be installed. In nuclear power plant applications each modification should be analyzed in order to judge whether the previously made qualification tests preserve their validity. If the given modification makes impossible to adapt the previously made qualification tests to the new construction, then the qualification tests of the new equipment type should be executed.

The Guideline 3.2 „Design principles for protection of nuclear power plants against earthquakes” should be applied during seismic qualification.

3.5.6. Requirements and limitations for placement and arrangementThe installation and assembly circumstances may significantly affect the applicability of the results of executed qualification tests. In general, the sealing procedures if exist, and the prescriptions on assembly position, method for fixation and accuracy of setting should be strictly followed. If unit specific circumstances require deviation from them, then it should be realized only after analysis of the meeting of qualification conditions.Occasionally a deviation may become possible, because the design does not require to comply with certain conditions at a given location among the conditions of qualification tests executed on the wide group of requirements (e.g. for certain passive equipment or that designed for “fail-safe” service mode).

The designer should review the qualification document, even if the assembly and arrangement requirements mentioned and defined above are missing.

In addition to the examination of connections and mutual effects that are applied during tests and designed for operation, this review aims at analyzingthe possible failures of equipment and their effects (failure mode and effect analysis). E.g. the effect of a possible failure of a venting or air conditioning system should be always assessed. The assembly of cables has mechanical effects on the state of cable sheath and isolation. It is especially valid for cables suffering frequent connectionsand disconnections. This should be taken into consideration during the design of their placement and arrangement.


3.5.7. Performance requirements and acceptance criteriaThe environmental qualification examinations should directly show or make unambiguously verifiable the realization of performance indicators expected from equipment. In a certain part of qualification tests the results demonstrate performance significantly exceeding the required level. In these cases the justification of meeting the performance requirements is evident.

However, the direct justification of performance indicators is often not possible, or the environmental qualification document does not include information that is relevant from the qualification point of view. Supplementary analysis is required in these cases.

3.5.8. Testing sequenceThe standard practice follows the following sequence of examinations: ageing – acceleration – harsh environment.The testing sequence is generally specified by standards or individuallydeveloped regulations. The more detailed sequence is as follows:

- condition review,

- accelerated ageing (thermal artificial ageing, radiation, cyclic load),- vibration and seismic load (with testing of functional operability),

- modeling of a radiation accident,- modeling of pressure + temperature + steam accident conditions

(with testing of functional operability),- modeling of flooding (if necessary),

- (long term) modeling of post accident states (with testing of functional operability),

- post-modeling testing,- condition review.

The examination of effects of electromagnetic compatibility and over-voltages, if required, should be performed on aged instrument. If its operation is required after the occurrence of an accident event, then after the simulationthereof. Such examinations are needed by data collection and controlling systems of analogue electronic and current digital measurements.


The most appropriate way is if the equipment is tested in the sequence causing the most severe effect, or in the most representative sequence based on the assembly circumstances. In general, the accident tests after accelerated ageing mean the most appropriate sequence. The thermal ageing after radiation ageing means more severe load in most cases then the reverse sequence. Additionally, this sequence is practically more close to modeling of post-accident states.

The entire test sequence should be executed on the same test specimens. The standard practice follows the following sequence of examinations: ageing –earthquake – harsh environment. The simulation of effects of operational environment resulting in ageing should be performed as artificial ageing. The harsh environment should be simulated. For non-harsh environments, if significant ageing factor exists, then such environment should be simulated which is in harmony with the validity period of environmental qualification.

The statistical approach should be rejected, since it should be postulated that the unqualified equipment do not live through the harsh conditions, even with statistical probability. The break of tubes with small diameter due to earthquake should be taken into account, unless the qualification or reinforcement of these pipes do not make it impossible.

The large LOCA and HELB environmental qualification for earthquake and harsh environment should not be performed on the same specimen, because the occurrence of such accidents during an earthquake is generally excluded from the design basis.

The seismic examinations should be performed only on aged equipment. If the radiation, steam, temperature and pressure condition of accidents could be realized simultaneously, then such modeling is suggested. However its conservative or non-conservative effect should be analyzed, since it may change for different equipment type. If the conditions could not be realized simultaneously, then radiation should be modeled first, followed by other accident environmental effects.It is recommended to be in compliance with the standards; however the effects of modification of the test sequence or exclusion of certain steps may be judged during the designer evaluation of environmental qualification.


3.5.9. Modeling of ageing processes and the qualified lifetimeThe lifetime of active electric and instrumentation and control componentsare generally shorter than of the facility.

The availability of spare parts should be considered during the determination of lifetime.

The qualified lifetime should be calculated by simulation of the previously listed environmental conditions and the subsequent functional examinations.

The modeling of aging processes should cover each “significant” ageing process.

The plant specific effects of thermal aging should be analyzed by Arrheniusmethod, which results, by taking account of the postulated environmental temperature and on the basis of the thermal tests results, in the specification of the equivalent thermal lifetime. In general, the thermal effect is the most limiting factor during the calculation of the qualfied lifetime. During the review of the analysis, the adequate consideration of the self heat production of equipment and the local hot spots should be carefully verified. If the analysis of ageing effects shows degradation existing under given environmental conditions and parameters and progressing in time during the environmental qualification, then the equipment have limited lifetime that should be characterized by number of service cycles or time period. If its value could be reasonably estimated, then it will be the qualified lifetime of the equipment. The qualified lifetime value calculated by accelerated ageing and projected to the lifetime of equipment is only valid if the environmental parameters do not exceed the limit values in the future.

The fatigue caused by cyclic loads is an important element of determination of qualified lifetime of active engineering components. The fatigue analysis is relevant because of the potential consequences. The qualified lifetime should be a value that is expressed in service cycles or cumulated usage factor (CUF). In such cases when the equipment are used in service cycles, then this should be considered during the qualification (e.g. examination of temperature load cycle of hermetic penetrations). In many cases, the operational experience documented in other industrial facilities may facilitate to solve the problem of determination of the qualified lifetime. Based on sufficiently reliable data and carefully performed (by


taking account of the effect of existing differences) analyses the operational experience may be a relevant tool of qualified lifetime specification. It is important to emphasize that keeping an eye on the qualified lifetime is necessary during condition monitoring, maintenance, repair and failure analysis activities and as supplement to the initial environmentalqualification. These activities can ensure the operability, but do not justify the qualified state!

If significant ageing mechanism does not exist, then justified qualifiedlifetime also does not exist. In this case the general methods used for assuring functional operability and reliability should be applied. It is fortunate if the manufacturer has own recommendations with respect to ageing that should be followed.

3.5.10. Consideration of accident conditionsThe qualification examinations should cover each environmental condition; including both the parameters and duration of environmental loads.

Attention should be paid to the heat transfer through steam condensation.In many cases the duration of accident conditions is shorter than the required time of operation during a given accident. The qualified lifetime should cover the lifetime of the general industrial need plus the mission time required during the accident event!The most important quality indicator of the effect of accident conditions is the difference between the verification results of initial state and of thoseafter the tests modeling the accident conditions, which is also applicable tojudge the post-accident long term functionality.

3.5.11. Management of deviationsThe deviations experienced during testing, and the non-compliances with the requirements should be documented in test reports. The reasons for deviations should be analyzed. The deviations are very often come from inadequate planning of qualification test conditions, but not from the non-compliance of the equipment with the service conditions under the given circumstances. However this always requires clear justification. The rejection of inadequate test results is not acceptable. The reason for inadequate test results often identified as “unknown”, which authorizes the


evaluator to occasionally, random evaluate the failure only if it can be find out, based on the failure analysis of the product and its operational experience that the inadequate test result is accidental and it is caused by e.g. a material defect.The test results often do no show clear non-compliance, but show the probability of degradation of operational accuracy, the response time or other parameters that are not considered as direct performance indicators. In this case the results can be accepted only after a thorough analysis of the reasons for deviation.

3.5.12. Consideration of other informationThe evaluation of the qualification documentation should not be limited to the evaluation of the results of the given activities.All such information (operational experience, results of qualification tests performed with other purpose or on other similar equipment, such safety analyses that include conclusion with regard to the values of environmental parameters) should be taken into consideration, which may modify the conclusions of the environmental qualification.

It is especially true for analysis of cases similar to the non-compliances that are qualified as individual failure, analysis of occurrences of operational faults and deviations accelerating the ageing mechanisms, analysis of information regarding material modifications qualified as irrelevant, and for information connecting to the potential effect of deviations from assembly conditions applied during testing.

The consideration of information indirectly belonging to the evaluation of qualification should not be directly prescribed. Rather it should be considered as a supplementary safety factor that depends on the practice, available information and on preparedness of the evaluator personnel.

4. MAINTENANCE OF THE QUALIFIED STATEThe process of environmental qualification is then followed by the implementation of the programme serving for maintenance of the qualified state, which programme ensures long term preservation of the operational environment and environment effect parameters and other conditions, and thus the maintenance of the qualified state. The demonstration of the qualified lifetime of instruments consists of the surveillance and the


inspection; the latter one includes in-service testing, monitoring and diagnostics. This ensures the long-term monitoring of conditions taken into account during environmental qualification, and thus the validity of the qualified state during the qualfied lifetime. The equipment and instruments treated in this way could be the following ones:

- electric operated valves (with solenoid coil),

- electric motors,- electric, and instrument and control hermetic penetrations,

- wires and cables, connections and couplings,- cable connection cabinets,

- sensors and transducers,- sensors and devices of radiation monitoring.

The analysis of ageing processes and projection of degradation may indicate the appropriate time point of maintenance, repair and if necessary of replacement. The improvement of operational circumstances and environmental conditions may mitigate the degradation effects.

In order to fulfill the function described in FSAR, ageing management programme either preventing or mitigating the degradation effects should be implemented for reasonably non-replaceable components. It is very difficult to replace certain cables and hermetic penetrations.

One of the most important objectives of evaluation of environmentalqualification during design is to determine whether the maintenance of the qualified state of equipment during the whole operating lifetime requires any special maintenance, in-service inspection or replacement action, and if yes then what type of action. The residual lifetime should be demonstrated by examinations and analysis! For old cables installed during the construction of the facility or in its early phase the lifetime should be extrapolated by calculations on the basis of measurement results of cable specimens and the collected data of environmental parameters.

The highest possible temperature data should be used for the calculation of residual lifetime. The hot spots, if exist, should be identified! The


extrapolation is only accepted as analysis method, if only one environmental ageing factor appears. The purpose of the maintenance activity is the correction of certain parameters of operating equipment, and improvement of their performance indicators or their reliability. The preventive maintenance is aimed to ensure the future operation of equipment based on their examination and test measurement results.

The evaluation of qualification is not aimed to elaborate the detailedmaintenance programme of installed equipment. Despite, those input data should be specified during the qualification, which give the minimum maintenance requirements for the preservation of the qualified state of the equipment. If a piece of equipment has no basic safety function, does not contribute to a basic safety function performed by another component, and its failure or false operation does not hinder the operation of another component performing basic safety function, then it should not be qualified, it could be excluded from monitoring and testing, its repair or replacement becomes necessary only if failed. The specification of the requirements for maintenance, inspection and part replacement should ensure the reliable prevention of equipment disfunctionality.

Measures could be implemented for maintenance of the qualified state even for passive, electric components with long lifetime. Passive electric components are the cables and their hermetic penetrations. Hermetic penetrations may also belong to cables of instrument and control systems.

The surveillance activities may be executed on unqualified equipment and instruments, due to production related interests.

4.1. Functional testsThe in-service tests performed on components demonstrate that a givencomponent is able to fulfill its function under its given conditions. Beyond the demonstration of the functionality at a given moment, by measuring the parameters characterizing the component operability and performance, such tests are applicable to indicate the deviations, which do not cause inoperability or disfucntionality, but can refer to the occurrence of a failure prior to the next testing period. The detection of such deviations is effectively


facilitated by the existence and analysis of parameter time series utilizing the data of previous tests.The functional tests to be executed in accordance with the Technical Specifications describing the operational limits and conditions, and in accordance with the maintenance document and recommendations of the manufacturer are the part of the maintenance activity and the implemented procedural maintenance programme. The industrial good practice and the regulatory prescriptions should be taken into account during the elaboration of the procedure.

4.2. MonitoringMonitoring programme should be elaborated for equipment and instruments, and in-service non-destructive material testing and condition monitoringprogramme should be elaborated for cables in order to control the ageing processes and timely detect the possible effects of significant ageing processes, and to timely implement the necessary measures.

The availability of the primary components performing basic safety function or safety function requires the implementation of a monitoring programme that includes the execution of in-service tests. The monitoring programme for cables should cover the examination of conditions of cable ends, cable connection, shielding and groundings. Majority of the electric, instrumentation and control components should be monitored by calibration tests or inspections that belong to preventive maintenance. These tests can verify the function performance or indicate the effect of an already known degradation mechanism. If the parameters demonstrating the performance characteristic of the component can be verified by continuous measurement, or by measurement made during in-service and cyclic exercises and tests, then it can be demonstrated at the same time whether the maintenance effective is and meets its objective.

These in-service tests are described in the Technical Specifications containing the operational limits and conditions; being in compliance with the regulations is required for the validity of the operating license of the facility.

The environmental qualification programme does not always require the monitoring and collection of parameters indicating the degradation and


measurement data characterizing the performance and condition of the equipment or instrument for the purpose of managing their ageing. Those degradations that are caused by effects and can be linked to measurable parameters in a fortunate case could be read out from the timelines of measurement results, therefore the data collection should be prescribed. The registration of time in service of at least the qualified equipment and instruments should be included in the environmental qualification programme. This can be considered as monitoring as well. The data can be used for correcting the design. Taking account of the uncertainties of long term analysis, the time and measurement data may serve for determination of the necessary time point of repair that prevents the replacement of equipment.

The monitoring or verification of environmental condition parameters facilitates to demonstrate that the conditions are continuously in compliance with those considered during the environmental qualification; or if being not in compliance with them, then the collected data contribute to modify the value of the qualified lifetime. The frequency of in-service functional and calibration tests is specified in the Technical Specifications (TS); such intervention may be implemented as a result of them which can be considered as preventive. Such like:

- Further grounding of toleration of service conditions: further specification of limit values characterizing certain tolerated loads, or furtherspecification of the value of qualified lifetime.

- Execution of installation, inspection, monitoring or periodic maintenanceprescriptions for decreasing degradation effects, and for ensuring that the degradation be in compliance with the range postulated during the initial environmental qualification.

4.3. DiagnosticsThe diagnostics and load monitoring systems make possible the fast andaccurate evaluation of states and environmental conditions of structures, systems and components in all operating states of the unit. They can indicate the appearance of failures, the necessity of corrective measures and maintenance prior to the loss of safety margins of measured parameters. They


reveal maintenance effectiveness. The international practice most often refers to the following diagnostic solutions- Monitoring of environmental parameters (temperature, radiation,

humidity and moisture) of the operating environment,- Electric diagnostic examinations of low and medium voltage cables and

cable connections,- Measurements and vibration diagnostic of electric rotating machines,

- Diagnostic of uninterruptible power supplies and accumulators,- Self-diagnostic of electronic data collector and controlling equipment.

4.4. Data credibility of diagnostics and monitoring systemsOne of the major tasks of connecting instrumentation and control solutions is to verify the operation of sensors, the credibility of the detected data and the continuous data processing.

The diagnostic and monitoring systems may suffer from ageing (e.g. drift of sensors, changing of measuring characteristics) and require maintenance. Due to this reason the applicable new solutions for signal and data transfer, like fiber optics or wireless data transfer should be studied.

Due to the high data flux, the diagnostics and monitoring systems often ground on computerized data collection systems running complex algorithms. As simple as possible validation of such systems should be considered duringtheir design.

4.5. Repair and replacementThe requirements for equipment and instrument replacements that were determined as the result of subsequent tests accomplished in the appropriate sequence during initial examinations of environmental qualification should be met. The repair or replacement of active electric, instrumentation and control components should be implemented at the detection of a degradation indicated during calibration tests or as the result of other surveillance activity prescribed for long term operation. Taking account of the modification of the configuration operating in the unit during the execution of the work, the repair and replacement should be performed only pursuant to operational regulations. The application of


monitoring techniques makes possible the estimation of the necessity of repairs and replacements in advance and their harmonization with the interests of production.

If the qualification cannot be granted for an electric, instrumentation and control component that can be technically reasonably replaced, and its qualification loses its validity or it is at the end of its qualfied lifetime specified during its qualification, then it should be replaced by a qualified one.

5. QUALITY ASSURANCE AND DOCUMENTATION OF QUALIFICATIONThe qualification document should be elaborated in a unified, clearly organized manner. The documentation should include the input data of environmental qualification, the description of references and the qualification results. The documentation should identify:

- the reached qualification level and the conclusions that can be drawn,

- installation (assembly) requirements,

- those operating conditions, within which the qualification conclusions remain valid,

- those maintenance, in-service inspection and replacement requirements, which are necessary for maintaining the qualified state,

- the qualified lifetime of equipment, and

- the documents grounding the evaluation of the environmental qualification and their conclusions.

The document should be organized by equipment groups; the determinant conditions should be highlighted: the extreme environmental parameters and the lifetime of the equipment. The recording of the qualification in a database is important from administration and data management viewpoints. It is practical and advantageous from administration point of view if the records of components falling under the scope of environmental qualification are consistent with the existing records of components. The basic safety functions should be evaluated to the boundary surfaces. The function


performed by another system should be examined beyond the boundary element: whether they serve for the performance of basic safety functions, or hinder their performance by their failures or false operation.

The database should contain the environmental parameters occurring duringnormal operation ad accident events, the criteria for the performance of the required function, and the related parameters in different premises of the facility.

The number of databases should be minimized; links should be established between them.

The various databases can be linked to each other per components, product groups, identically qualified component groups, contribution to the required function, or per rooms, etc. The validity period of environmental qualification is specified by the service time that is simulated by accelerated ageing. The documentation of equipment should be kept during its whole qualified and service lifetime. Pursuant to the relevant standard, the environmental qualification documentation should consist of the below chapters.

5.1. Mild environmentThe following documents can demonstrate the qualified state of equipment performing safety function and qualified for mild environment:

- Design and purchase specification, which includes the description of functional requirements to be complied with under specific circumstances appearing during normal service and between operating events.

- Reports (records) on seismic tests, and evaluation or certification of their compliance.

5.2. Harsh environmentThe documentation of a piece of equipment performing safety function and qualified for harsh environment should demonstrate that the equipment is qualified for the (service and accident) conditions of its application, and that its qualified lifetime, in-service testing, maintenance and condition monitoring is specified.


The used data should be specific to the application of the equipment. The data should be available in easily understandable, followable and up-to-dateformat; they should make possible to review and independently audit the drawn conclusions. The documentation of equipment performing safety function and operating in harsh environment should include the below items. It is possible that certain items or others will be irrelevant.

a) Identification data of qualified equipment, including the identification of manufacturer, type family and type.

b) Description of the safety function, its identification: denomination, identifier, sign.

c) Description of the qualification method, information applicable to identify the method.

d) Data, identifiers or specimens to be examined. e) Description of normal environmental conditions and the

denominations used for identification, including the description of environmental conditions occurring during operating events. Such like the attributes of temperature, pressure, irradiation, relative humidity, electromagnetic and radiofrequency interference, the occurring overvoltage, the number and attributes of load cycles and of those design basis events, the toleration of which should be tested during the qualification.

f) Description of acceptance criteria, values of performance parameters required for fulfilling the function, and the values produced by the equipment during the examination.

g) Description of the sequence of examination and test steps. h) Description of designer considerations regarding the installation

location: assembly, characterizing geometry directions, connecting surfaces, isolation tubes, sealing and other protections.

i) Description of configuration applied during examination in order to reveal whether the external connections of equipment in the examination room (chamber) were affected by simulated accident events.


j) Demonstration that the examined and tested specimens adequately represent the equipment or the equipment group (established by categorization of loads) to be qualified.

k) Description of revealed ageing mechanisms, demonstration that they were taken into account during the qualification examinations.

l) Declaration of the qualified lifetime, justification of the given value.m) Results of verification examinations of the artificially aged specimen.

n) Description of how the design basis events were simulated, including the temperature-time and pressure-time functions, humidity, mechanical load, electric load, applied voltages and frequencies, chemical effects, water spray or flooding.

o) Description of examinations performed by radiation, including the type of radiation, value of dose intensity total dose.

p) Description of results of seismic tests.q) Determination of the applied conservatism: with respect to

temperature, pressure, radiation, voltage of electric supply, operating time and earthquake.

r) Description of surveillance, in-service inspections and testing, maintenance and part replacement.

s) Description of deviations occurred during examinations of initial qualification, and their effects on qualification.

t) Summary of qualification results, discussion with description of qualification limits and the connecting warnings; declaration of thevalue of qualified lifetime, and time period of in-service inspections necessary for maintenance of the qualified state and of the supervisory activities.

5.3. Evaluation of qualification documentationThe existence and adequacy of replies given to questions arisen during the evaluation of the environmental qualification documentation should be reviewed. The issues to be reviewed are listed below. The questions can be used as a check-list by excluding those questions which do not regard the given equipment. The documentation depth of the review of qualification should be determinedin harmony with the importance of the performed safety function.


The criteria based on which a piece of equipment falls under the scope of qualification should be taken into account. If it is to be qualified because of the importance of its function, then its safety class is determinant. Nevertheless, the qualification may become necessary because its failure hinders the safety function of another component, or it has significant role during an event requiring intervention. The quality assurance review of the environmental qualification documentation can be performed by the operator and the authority as well. The list of questions to be used for the review is as follows.

- Is the documentation of the qualification results adequate? (Are the mathematical models and the extrapolation of examination results verified, adequate and documented?)

- Are there clearly defined exemptions?

- Is the applicability of the selected environmental qualification method justified?

- If the environmental qualification is performed by analysis:- Are the limitations regarding applicability of analyses as described in

paragraph 3.1. of this guideline taken into account? - Are the requirements for equipment performance specified?

- Are the possible failure modes and their effects comprehensively analyzed?

- Is the adequacy of the validity scope of the postulations and mathematical models analyzed?

- Are the specimens used for testing sufficiently similar to the equipment to be installed?

- Is the degradation appearing during significant ageing processes taken into account, including:

- Are the effects of mechanical and/or cyclic loads analyzed? - Are specimens artificially aged according to the end of the lifetime used

for modeling of DBE conditions? - Are the materials sensitive to thermal and radiation ageing identified?

- Is the normal service state of equipment (whether it is open, close, under voltage, etc.) taken into account?


- Are the occasional electric overvoltages taken into account?

- Are the mutual effects of different processes taken into account? - Is the qualified lifetime and the schedule of necessary replacements

specified? - Are the accident temperature and pressures adequately specified?

- Is the maximum value of temperature and/or pressure adequately specified?

- Is the postulated duration of maximum values acceptable? - Is an adequate envelope curve used for temperature and pressure

diagrams?- Is the effect of steam adequately taken into account?

- Is the testing sequence appropriate?- Are the effects of water spray adequately taken into account?

- Is the spray load test performed during the steam tests?- Are the quantity, pH, density and duration of spraying water in

compliance with the values considered during the design of the power plant?

- Are the criteria of immersing (flooding) tests complied with?- Are the criteria of radiation load complied with?

- Is the adequate radiation dose taken into account? - Is the beta radiation taken into account?

- Is the neutron radiation taken into account? - Are the electro-magnetic environmental effects (EFI, RFI) taken into

account?- Is the handling of deviations appeared during testing adequate?

- Are the criteria of functional tests adequate? - Are the performance requirements declared in the testing plant and the

test report?- Are the zero-state performance indicators adequately established?


- Is it demonstrated during the tests or analyses that the equipment are able to realize the characteristics expected at the given installation location of the given unit?

- Is the accuracy of the verification instruments of the specimens adequate? - Is the calibration of the instruments adequate?

- Is the testing period adequately grounded? - Is the testing period margin (time of operation + 10%) adequate?

- Are the maintenance and in-service testing requirements adequately established, including the emphasizing of those actions, which are significant for preservation of the qualified state of the equipment?

- Are the assembly requirements adequately specified?


6. ANNEXINFORMATIVE LIST OF ENVIRONMENTAL QUALIFICATION STANDARDS

1) IEEE Std 323-2003TM IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations.

2) IEC 60780 1998-10, Nuclear Power Plants-Electrical Equipment of the Safety System-Qualification.

3) IEEE Std 99TM –1980 (Reaff 2000) IEEE Recommended Practice for the Preparation of Test Procedure for the Thermal Evaluation of Insulation Systems for Electric Equipment.

4) IEEE Std 308TM -2001, IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations.

5) IEEE Std 317TM -1983, (Reaff 1996) IEEE Standard for Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations.

6) IEEE Std 334TM -1999, IEEE Standard for Qualifying ContinuousDuty Class 1E Motors for Nuclear Power Generating Stations.

7) IEEE Std 344TM -1987 (Reaff), Recommended Practice of Seismic qualification of class 1E equipment for Nuclear Power Generating Stations.

8) IEEE Std 382TM -1996, IEEE Standard for Qualification of Actuators for Power-Operated Valve Assemblies with Safety-Related Functions for Nuclear Power Plants.

9) IEEE Std 383TM -1974 (Reaff 1992), IEEE Standard for Type Test of Class 1E Electric Cables, Field Splices, and Connections for Nuclear Power Generating Stations.

10) IEEE Std 387TM -1995 (Reaff 2001), IEEE Standard Criteria for Diesel-Generator Units Applied as Power Standby Supplies for Nuclear Power Generating Stations.

11) IEEE Std 420TM -2001, IEEE Standard for the Design and Qualification of Class 1E Control Boards, Panels, and Racks Used in Nuclear Power Generating Stations.


12) IEEE Std 535TM -1986 (Reaff 1994), IEEE Standard for Qualification of Class 1E Lead Storage Bateries for Nuclear Power Generating Stations.

13) IEEE Std 572TM -1985 (Reaff 1992), IEEE Standard for Qualification of Class 1E Connection Assemblies for Nuclear PowerGenerating Stations.

14) IEEE Std 628TM -2001, IEEE Standard Criteria for the Design, Installation, and Qualification of Raceway Systems for Class 1E Circutis for Nuclear Power Generating Stations.

15) IEEE Std 638TM 1992 (Reaff 1999), IEEE Standard for Qualification of Class 1E Transformers for Nuclear Power Generating Stations.

16) IEEE Std 649TM -1991 (Reaff 1999), IEEE Standard for Qualifying Class 1E Motor Control Centers for Nuclear Power Generating Stations.

17) IEEE Std 650 TM –1990 (Reaff 1998), IEEE Standard forQualification of Class 1E Static Battery Chargers and Inverters for Nuclear Power Generating Stations.

18) IEEE Std 1205-2000, IEEE Guide for Assessing, Monitoring, and Mitigating Aging Effects on Class 1E Equipment Used in Nuclear Power Generating Stations.

19) IEEE Std C37.98™-1987 (Reaff 1999), IEEE Standard Seismic Testing of Relays.

environmental qualification of equipment during the design of ......nuclear safety regulatory...

Documents