Emergency diesel generator surveillance failure
During the monthly surveillance of the 'B' emergency diesel generator the recorder shows: start signal at 10:00:00, rated speed and voltage reached at 10:00:13. The surveillance procedure requires rated voltage and frequency within 12 seconds. The sequencer then applied the safeguards bus in two blocks. During the first block frequency dipped to 57.2 Hz and recovered in about 4 seconds; during the second block voltage dipped to 86% of rated for about 1.5 seconds. Procedure acceptance criteria state voltage must not fall below 90% and frequency must not fall below 58 Hz during load acceptance. The diesel carried 3.2 MW of its 4.0 MW continuous rating. The unit is at 100% power; the 'A' diesel passed the same surveillance two weeks ago. A retest is possible but requires removing the 'B' diesel from automatic for about 2 hours, and outside temperature is 36 °C.
1. Evaluate the test result against the acceptance criteria and decide whether the diesel should be declared operable. Explain the difference between failing a surveillance and being inoperable.
Read the worked answer
The test failed on three counts:
- 13 seconds to rated speed and voltage against a 12-second requirement.
- Frequency dip to 57.2 Hz against a 58 Hz minimum.
- Voltage dip to 86% against a 90% minimum.
Failing the procedure is not automatically identical to being inoperable, but the burden is on the plant to show the component can still perform its safety function. Here that is hard to argue:
- Undervoltage during load sequencing matters because the sequencer and the connected loads (safety injection pumps, service water pumps, battery chargers) see 86% voltage; contactors can drop out or the sequencer can time out and skip a load block, leaving a safety bus partially unloaded.
- The low-frequency dip indicates the governor and fuel rack are not responding as designed, so the second block loaded onto a machine already recovering.
- The acceptance criteria exist precisely because these margins have been analysed for the worst-case loss-of-offsite-power event; a test that misses them has not demonstrated the assumption.
Decision: declare the 'B' diesel inoperable unless engineering can justify the as-found condition within the allowed outage time, enter the technical specification action statement, and implement its compensatory measures.
2. List the compensatory measures and the immediate investigation you would direct, and explain why a quick uncontrolled retest is a poor first move.
Read the worked answer
Compensatory measures while the 'B' diesel is inoperable:
- Verify the 'A' diesel is operable and in automatic, with its last surveillance valid and no work in progress that would impair it.
- Verify offsite power lineups, breaker alignment and the station battery/DC system health, since the diesel is a backup to backups.
- Restrict maintenance on the 'A' diesel, the DC system and the switchgear; brief the crew and issue a standing order describing the single-failure exposure.
- Confirm the fire protection and other support systems assumed in the technical specification action are available.
Investigation before retest: start time (starting air pressure, battery voltage during cranking, ambient 36 °C effects on fuel and air density), governor droop and speed reference settings, fuel rack travel, voltage regulator/exciter response, load sequencer timing and block sizes, and calibration of the recording instruments. The 36 °C ambient is a legitimate variable to check, not an excuse.
A quick retest is a poor first move because it may pass by chance, destroy the evidence of a genuine degradation and leave the plant relying on a train that failed its only demonstration of capability.
3. The retest, with the same loads, passes all three criteria. What do you record, and what residual concerns remain?
Read the worked answer
Record: the original failure with all three as-found values and timestamps, the operability determination and its basis, entry into and exit from the technical specification action statement with times, the compensatory measures taken, the investigation findings, the retest data (start time, frequency and voltage dips against criteria), and the instrument calibration status. Note that the retest was performed with the same load profile so the comparison is valid.
Residual concerns:
- A pass on retest does not explain the first failure. If the cause was ambient temperature, the diesel remains sensitive to hot afternoons and should be trended, not closed out.
- If the cause was a marginal governor or exciter setting, that margin may be consumed by slightly different conditions (colder fuel, different bus loading) in a real event.
- Trend the start time and load-acceptance dips over the last several surveillances rather than looking at pass/fail alone; a two-second drift over a year is information.
- Feed the finding into the maintenance and surveillance programme: consider a setpoint review, additional trending, and a review of whether the 12-second criterion is being met with margin or just barely.
Close the work order only when the cause is understood or explicitly accepted with a monitoring plan.