Emergency diesel generators: four challenges

Emergency diesel generators (EDGs) are used as a back-up source of emergency power in nuclear power plants, powering core cooling systems and other equipment necessary for maintaining the safe shutdown of the reactor.

Suppliers of EDGs today need to meet both the requirements of customers, authorities and safety bodies, whether national or international, in areas including seismic qualification, control systems and environmental performance, while offering very high reliability and availability.

Requirements

The nuclear industry requires EDGs to comply with many requirements. This leads suppliers to offer engines with fully independent and redundant air-starting systems, and also two turbochargers in parallel and two exhaust gas manifolds improving transient behaviour of the engine during loading and start-up sequences. Manual start-up should be available in the case of loss of offsite power (LOOP) combined with two closed cooling water loops allowing start-up without the use of air cooler fans and so on. All cooling water circuits are preheated. EDGs also need to be seismically qualified; all components are checked, and in particular the axial thrust bearing needs to be appropriate for seismic conditions. Governing and controlling systems should be fully compliant with IEEE class 1E power systems requirements.

As a supplier, MAN Diesel & Turbo France is able to provide expertise and support in many of these areas, including testing and simulation for seismic qualification, simulation of special environmental conditions, exhaust gas emissions requirements, and performance testing and qualification.

Fuel supply

The following trends have been observed worldwide:

• A reduction of fuel sulphur content (to not more than 0.1% in Western countries)
• Incorporation of fatty acid methyl ester (FAME) into high-quality distillates
• Requirements for flexibility of fuel supply, such as the possibility to use aviation blends
• Widening of the range of ambient conditions: -50°C to +50°C.

Sulphur compounds in diesel fuel act as natural lubricants and thus a decrease in content reduces the natural lubricity of the fuel. This can lead to problems with reliability of injection equipment. One possible countermeasure is the introduction of additives or fatty acid methyl ester (FAME; biodiesel) into high-quality distillates. In France, for example the percentage of FAME incorporation into diesel fuel has risen to as much as 7%. However, doing so comes with its own consequences, including: hydrophilic properties, microbiological growth and questionable stability in long-term storage. In fact, no oil supplier today is ready to guarantee its stability within storage tanks for more than six months. The further use of additives is another potential solution to improve stability.

Another trend, the possibility for use of alternative aviation blends in EDGs, also comes with various consequences. Generally speaking, EDGs use distillate fuels corresponding to marine distillate fuels specified in ISO 8217. Aviation blends can impact the lubricity properties, which as mentioned above can lead to problems with equipment reliability. Second, they may lower the quality of the fuel (measured as the cetane index), and hence affect the EDGs' start-up time, load pick-up and cold-start ability. Finally, it may affect the flash point (the lowest temperature at which a volatile substance can vaporize to form an ignitable mixture in air). This can impact the equipment specification and its compliance with Europe's ATEX directive, which regulates the equipment and work that is allowed in an environment with an explosive atmosphere.

The significantly wider range of ambient temperature conditions (-50°C to +50°C) today also impacts EDG fuel. Factors that must be considered include the cetane index property for cold conditions (engines are more difficult to start in cold weather as gelling/freezing can occur). In contrast, high temperatures also increase the potential for low fuel viscosity, which can affect injection equipment reliability. Potential solutions could include engineering measures, and again, possibly, additives.

Trends in fuel supply are driven by two conflicting factors. The first is the oil chemical industry, which is itself driven by the automotive market. The second is the safety requirements of the nuclear industry regarding the operation of emergency diesel generators, which have to be guaranteed for the decades of lifetime of a nuclear power plant.

Based on the discussion above it is evident that there is a clear conflict between the overall macro boundaries of fuel oil supply, and the primary performance requirement, for the safe functioning of EDGs in nuclear power plants.

A potential solution could be to create a specific worldwide standard for fuel for nuclear power plant EDG applications (with a precise fuel specification like in the automotive industry). However, this would require the standards to be ratified and imposed by nuclear safety authorities worldwide.

Emissions

In the recent years and even today, regulatory bodies wish to control diesel engine gaseous emissions, including those of Emergency Diesel Generating Sets with less than 500 running hours per year. This has been the case in the USA, Europe, and elsewhere, including India. In some countries, it remains unclear if EDGs for NPP applications should be subject to such limitations. One exception is in the USA, where the Environmental Protection Agency (EPA) has decided to impose less-severe emission limits to stationary emergency applications when they run less than a certain number of hours per year.

Otherwise, it is generally unclear which authority is prevailing: the nuclear safety body or the general environment authorities.

EDGs for nuclear applications have only two potential running scenarios: periodic testing or emergency use. Periodic testing of EDG functionalities such as start-up are typically conducted every 30 days. Cumulative running hours are typically less than 40 hours per year for each EDG, and operation is very seldom longer than two hours. Furthermore, most of the time the EDGs are running idle or at very low output. EDGs used for nuclear applications are only tested approximately once a year at rated output.

In such a case, the emission footprint of an EDG is very marginal on an annual average and all external abatement techniques are inappropriate. First, the complexity of external abatement techniques could threaten the overall reliability of EDG plant. Second, their startup speed cannot match that of EDGs, rendering their effects useless, inefficient, or degraded.

The second scenario of an EDG is emergency use. In this case the safety function of the EDG is essential. Nobody will care about the exhaust gas emissions of the EDGs during a nuclear emergency event.

It is very important to keep in mind the purpose of an emergency diesel generator; doing so raises the question of whether there should be exemptions from environmental restrictions. As noted above, some countries, such as the US EPA, have emissions exemptions. Shouldn't all countries have similar exemptions?

Control systems

EDG control systems have the following functions: engine speed control, power control, sequence management (for example, start/stop and auxiliaries control), management of mechanical and electrical EDG safety protection, and interfaces with operators and the global nuclear plant control system. These control functions are fulfilled by equipment that is integrated on the EDGs (such as actuators, sensors, cables etc.) or by equipment in control cabinets (such as regulators, relays or safety-dedicated devices).

Control system requirements can be split into three categories. First, general quality aspects include highly demanding requirements for design document management, traceability and validation throughout the manufacturing process of each module, testing and validation procedures and reports, and also selection of qualified and validated suppliers.

Second, the very high reliability and availability requirements strongly influence the choice of technical solution. In this context, it is important to use well-proven equipment, with qualification of hardware and software (see box), and redundancies such as mechanical/electronic speed control, and two-out-of-three logic for management of EDG safety protection. Physical separation of classified and non-classified functions is also required.

Finally, the control system requirements must take into account the nuclear power plant context. Performance such as response time and stability are a key factor. Different functionalities are also required within the control systems for the different operating scenarios, periodic testing and emergency operation. Systems must also be compatible with EDG maintenance operations and checks, for instance they must take into account the anticipated replacement of devices, and be designed to enable easy maintenance.

Given the high stakes involved in EDG operation, reliable engine control equipment is a key requirement for the nuclear industry. Simple and well-proven technical solutions, and the use of equipment with significant field experience, are important for reliability. Careful handling of the product throughout the phases of design, evolution, manufacturing, qualification and entry into service is essential, especially for devices responsible for complex and/or essential functions, in order to ensure reliability and fitness for purpose (in terms of expected functions, interfaces, failure modes and effects analysis).

Hardware qualification

• Environmental qualifications can refer to various norms (for example IEC, IEEE), which have different and/or complementary aspects (for example, with regard to the approach for ageing).
• To be able to simulate the product lifecycle as much as possible, the order of the physical tests is important: functional tests, accelerated thermal ageing, mechanical ageing, electromagnetic compatibility, temperature variations, dry/damp heat, cold, vibration, seismic tests, etc.
• Site environmental conditions and criteria for the functional validation of the equipment must be very carefully defined.

Software qualification

• In parallel with hardware qualification, software qualification is an essential step to achieve and guarantee the reliability of programmable devices. It is important to keep software functions and hardware architectures simple.
• Software qualification not only covers the software itself, but also the way it is handled: allowing for adjustments at different project phases, validation tests, security, validation of development tools, capitalization of field experience, failure modes and effects analysis, and competences of parties involved.
• The V-Model scheme (definition of the need, software architecture, functions development, unit tests, site tests, HW/SW interactions, return on experience, management of evolutions) has to be well-understood.

Laurent Tessier and Eric Huet, MAN Diesel & Turbo France SAS

This article is based on a presentation made at the TUV symposium on emergency power systems at nuclear power plants in Munich, 11-12 April 2013.