ML17056A707

App U to Sser 6 Re Probability of Missile Generation in GE Nuclear Turbines

ML17056A707
Person / Time
Site:	Nine Mile Point
Issue date:	03/15/1990
From:	NRC
To:
Shared Package
ML17056A689	List: ML17056A688 ML17056A707
References
NUDOCS 9003280011
Download: ML17056A707 (20)

Text

ENCLOSURE 1

APPENDIX U PROBABILITY OF MISSILE GENERATION IN GENERAL ELECTRIC NUCLEAR TURBINES 1

SUMMARY

The objective of the NRC staff's review of the General Electric Company (GE) report, "Probability of Missile Generation in General Electric Nuclear Turbines" (submitted by the licensee in a letter dated, July 11, 1986),

was to evaluate

and, if appropriate, approve the methods and procedures utilized by the General Electric Company, Large Steam Turbine-Generator Department, to determine spe-cific turbine system inspection and testing intervals for its utility customers.

During the past few years, the staff has recommended a probabi listic approach to determine turbine rotor inspection intervals and turbine control system maintenance and testing frequencies so as to maintain the as-built turbine sys-tem integrity.

The GE report describes such an approach generically and, to the extent possible, supports it with test and turbine system operating experi-ence data.

The staff recognizes that probabilistic analyses based on limited statistical

data, especially for a complex system, will include inherent un-certainties.

Nevertheless, when the overall approach includes conservative assumptions that overcome the uncertainties, then the ultimate results can be meaningful.

The staff concludes, that the methodology described in the GE report is state of the art and is acceptable for use in establishing maintenance and inspection schedules for specific turbine systems.

Applicants or licensees who accept GE's recommendations, based on this report, should confirm their commitment to the staff and provide a description of their specific maintenance and inspection program including a curve (or curves) of missile probability (P,) versus service time for their specific turbine rotors.

2 BACKGROUND Although large steam turbines and their auxiliaries are not safety-related systems as defined by NRC regulations, failures that occur in these turbines can produce large, high-energy missiles.

If such missiles were to strike and damage plant safety-related structures,

systems, and components, they could render them unavailable.to perform their safety function.

Consequently, General Design Criterion 4, "Environmental and Missile Design Bases," of Appendix A, "General Design Criteria for Nuclear Power Plants," to 10 CFR 50, "Domestic Licensing of Production and Utilization Facilities," requires, in part, that structures,

systems, and components important to safety be appropriately pro-tected against the effects of missiles that might result from such failures.

In the past, with regard to construction permit and operating license applica-tions, evaluation of the effects of turbine failure on the public health and safety followed Regulatory Guide (RG) 1. 115, "Protection Against Low-Trajectory 1

Mope Creek SSER 6

90032800ii 9003i5 PDR ADOCK 050004i07 P

PD~R Appendix U

Turbine Missiles,"

and three essentially independent Standard Review Plan (SRP, NUREG-0800) sections:

Sections 10.2, "Turbine Generator,"

10.2.3, "Turbine Disk Integrity," and 3.5. 1.3, "Turbine Missiles."

According to the NRC guidelines in SRP Section 2.2.3 and RG 1. 115, the proba-bility of unacceptable damage from turbine missiles (P4} should be less than or equal to about 1 chance in 10 million per year for an individual plant, that is, P~

< 10-~ per year.

The probability of unacceptable damage resulting from turbine missiles is generally expressed as the product of (1) the probability of turbine failure resulting in the ejection of turbine disc (or internal struc-ture) fragments through the turbine casing (Pz); (2) the probability of ejected missiles perforating intervening barriers and stri king safety-related structures,

systems, or components (Pq);

and (3) the probability of struck structures, sys-

tems, or components fai ling to perform their safety function (Pq).

In the past, analyses assumed the probability of missile generation (Py) to be approximately 10-~ per turbine-year, based on the historical failure rate (Bush,

1973, 1978).

The stri ke probability (Pq} was estimated on the basis of postulated missile sizes,

shapes, and energies and on available plant-specific information such as turbine placement and orientation, number and type of i ntervening barriers, target geometry, and potential missile trajectories.

(See SRP Section 3.5. 1.3 for a description of the evaluation procedures pre-viously recommended by the staff.)

The damage probability (Ps) was generally assumed to be 1.0.

The overall probability of unacceptable damage to safety-related systems (P<), which is the sum over all targets of the product of these probabilities, was then evaluated for compliance with the NRC safety objective.

This logic places the regulatory emphasis on the strike probability; that is, it necessitates that Pq be made less than or equal to 10-s and disregards all the plant-specific factors that determine the actual Pq and its unique time dependency.

Although the calculation of stri ke probability is not difficult in principle, for the most part being not more than a straightforward ballistics analysis, it presents a problem in practice.

The problem stems from the fact that numerous modeling approximations and simplifying assumptions are required to make tract-able the.incorporation into acceptable models of available data on the (1) pro-perties of missiles, (2) interactions of missiles with barriers and obstacles, (3) trajectories of missiles as.they interact with and perforate (or are de-flected by)'arriers, and (4) identification and location of safety-related targets.

The particular approximations and assumptions made tend to have a

significant effect on the resulting value of P~.

Similarly, a reasonably accurate specification of the damage probability (Pq} is not a simple matter because of the difficulty in defining the missile impact energy required to render given safety-related systems unavailable to perform their safety func-tions and the difficulty in postulating sequences of events that would follow a missile-producing turbine failure.

Operating experience shows that nuclear turbine discs crack (Northern States Power Co.,

1981; NUREG/CR-1884), that turbine stop and control valves fail (Burns, 1977; Southern California Edison and San Diego Gas 8 Electric Co., 1982),

and that disc ruptures could result in the generation of high-energy missiles (Kalderon, 1972).

Analyses (Burns, 1977; Clark, Seth,.and

Shaffer, 1981) show that missile generation can be modeled and the probability can be strongly in-fluenced by inservice testing and inspection frequencies.

Hope Creek SSER 6

Appendix U

l4

During the past few years, the results of turbine inspections at operating nuclear facilities indicate that cracking to various degrees has occurred at the inner radius of turbine discs of Westinghouse design.

Within this period, a Westinghouse turbine disc failure occurred at one facility owned by the Yankee Atomic Electric Company (NUREG/CR-1884).

More recent inspections of GE turbines have also discovered disc keyway cracking (Northern States Power Co.,

1981).

Stress corrosion has been identified by both manufacturers as the operative cracking mechanism.

In view of operating experience and NRC safety objectives, the NRC staff has shifted emphasis in the reviews of the turbine missile issue from the strike and damage probability (PqxPs) to the missile generation probability (P> ) and, in the process, has attempted to integrate the various aspects of the issue into a single, coherent evaluation.

Through the experience of reviewing various licensing applications, the staff has concluded that PqxPs analyses provide only "ball park" or "order-of-magnitude" values.

On the basis of simple estimates for a variety of plant layouts, the staff also concludes that the strike and damage probability product (PqxPa) can be reasonably taken to fall in the characteristic narrow range that is depen-dent on the gross features of plant layout with respect to turbine generator orientation; that is, (1) for favorably oriented turbine generators, PqxPa tends to lie in the range of 10-~ to 10-~yr-~ and (2) for unfavorably oriented turbine generators, PqxPs tends to lie in the range of 10-to 10-~yr-'.

In addition, detailed analyses such as those discussed in this evaluation show that, depend-ing on the specific combination of material properties operating environment, and maintenance practices, Pz can have values from 10-~ to 10-~ per turbine-year depending on the turbine test and inspection intervals.

For these

reasons, in the evaluation of P< (PqxPqxPs),

the probability of unacceptable damage to safety-related systems from potential turbine missiles, the staff is giving credit for the product of the strike and damage probabilities of 10-ayr-~ for a favorably oriented turbine and 10-~yr-'or an unfavorably oriented turbine, and is discouraging the elaborate calculation of these values.

The staff believes that maintaining an initial small value of P> through tur-bine testing and inspection is a reliable means of ensuring that the objectives precluding turbine missiles and unacceptable damage to safety-related structures,

systems, and components can be met.

It simplifies and improves procedures for evaluating turbine missile risks and ensures that the public health and safety is maintained.

To implement this shift of emphasis, the staff recently has proposed guidelines for total turbine missile generation probabilities (Table U. 1) to be used for determining (1) frequencies of turbine disc ultrasonic inservice inspections and (2) maintenance and testing schedules for turbine control and overspeed protection systems.

It should be noted that no change in safety criteria is associated with this change in emphasis.

3 SCOPE OF REVIEW There are essentially two modes of turbine disc failure that can result in tur-bine failure; one resulting from rotor material failure at approximately the rated operating

speed, or one resulting from failure of the overspeed protection systems resulting in excessive rotor speeds.

Hope Creek SSER 6

Appendix U

~ '

Failures of turbine discs at or below the design

speed, nominally 120K of normal operating

speed, can be caused by small flaws or cracks left during fabrication or those that initiate during operation and grow to critical size either by fatigue crack growth, by stress corrosion crack growth, or by a combination of both of those mechanisms.

Cracks in the bore or hub region of turbine discs could eventually lead to disc failure.

Failures of turbi ne discs at the destructive overspeed can result from a fail-ure of the governor and overspeed protection systems consisting of speed sensing and tripping systems and steam valves, If the turbine is out of control, its speed can increase unti 1 failure occurs.

For unflawed discs, destructive over-speed is reached at about 180 to 190K of the normal operating speed.

In general, failures that occur at destructive overspeed are caused by stresses that exceed the materials tensile strength.

If a turbine disc should burst, high-velocity, missile-like fragments may break through the turbine casing, possibly generating secondary missiles.

These mis-siless have a potential for damaging reactor safety systems.

Alternately, the disc fragments could be arrested and contained by the turbine itself.

Hence, in evaluating the risk associated with turbine disc rupture, it is necessary to determine whether or not missiles external to the casing can be generated by postulated disc ruptures.

This appendix considers the above possibilities and summarizes the review and evaluation of the GE report, which describes GE procedures for estimating (1) the design speed missile generation probability, (2) the destructive overspeed missile generation probability, and (3) the perforation of the turbine casing by turbine disc burst fragments.

4 OI SCUSS ION/EVALUATION This appendix presents an overview of the methodology in Section 2 of the GE report where three major components of the methodology are considered:

(1) probability of turbine overspeed (2) wheel burst probability (3) probability of casing penetration The probability of a wheel burst and the probability that a wheel fragmen<<ill penetrate the casing will depend on the speed at which a wheel bursts.

T<<>>ne speed is close to 1800 rpm under normal operating conditions;

however, when an abnormal event occurs, such as load rejection and/or failure of the control system to function properly, turbine speed may reach 180 to 190K of th<<ate speed.

The probability of attaining these various turbine overspeed levels therefore, is a major component of the methodology.

Another major component:of the methodology is the probability of a wheel b<<

at various operating conditions, which are defined by two important parame<<rs:

speed and wheel temperature.

The primary failure mode of the turbine whee>>s assumed to be brittle fracture caused by the presence of a stress corrosion crack in the keyway near the bore of the shrunk-on wheel.

The fracture mec>>"

ics calculations include variations in the toughness of the wheel material the depth of the crack, in the likelihood of crack initiation, in the abil y

to detect crack sizes during inservice inspections, and in the. rate of crack growth during subsequent service.

Hope Creek SSER 6

Appendix U

The third major component of the methodology is the probability of a wheel fragment penetrating the turbine casi ng, given the wheel burst at a particular speed.

The missile penetration probabilities are based on energy methods (Gonea, 1973) and laboratory tests.

The variations involved in these calcula-tions lead to a probabilistic estimate of casing penetration as a function of burst speed.

Section 3 of the GE report describes overspeed protection systems.

GE nuclear steam turbines are equipped with three speed-sensing devices for defense against turbine overspeed.

(1)

Normal overspeed protection is achieved through the control valves, inter-cept valves, and check valves.

(2)

An emergency overspeed protection device is set to close all steam valves if the speed reaches 110 to ill% of the operating level.

(3)

A backup overspeed protection device is set to close all steam valves if the speed exceeds the emergency trip setpoint (112K).

Both mechanical hydraulic control (NHC) and electrohydraulic control (EHC) sys-tems are employed.

Failure models for HHC and EHC systems are analyzed by a fault tree method, and the probability of attaining a given speed is calculated.

Section 4 considers wheel burst in both brittle and ductile modes.

Operating experience shows that the primary failure mode of the turbine wheels is assumed to be brittle fracture resulting from the presence of stress corrosion cracks in the keyway near the bore of the shrunk-on wheel.

After ascertaining the fracture toughness property at various depths, calculations are made to deter-mine crack length at a particular time from the initial service.

Considerations in the'robability analysis are given to variations in the likelihood of crack initiation, in the ability to detect and size cracks during inservice inspec-

tions, and in the rate of crack growth during subsequent service.

The statistical distribution is applied to crack initiation and growth behavior data obtained from inservice inspections performed on the majority of wheels of operating GE nuclear low-pressure turbines.

The relevant information can be extracted from these statistical distributions to arrive at a given value for any assigned probability or vice versa.

Because of various parameters in-volved, the time to crack initiation varies significantly from wheel to wheel.

Tests on wheels with laboratory-produced stress corrosion cracks and on those retired from service were used to define the ability of ultrasonic testing (UT) methods to detect and size wheel cracks.

The GE analysis of the data shows that the crack depth is 0.07 in. larger on the average than the measured value for the wheel hub.

The crack initiation distribution is influenced by the oxygen concentrati.on in the steam and the type of locking ring that covers the keyways.

The Weilbull distribution was fitted to the observed field data, and the characteristic life, a Weilbull parameter, is approximated.

Because of the limitations of UT equipment, undetected cracks might have initiated, and when these undetected cracks are taken into account and combined with the average crack growth rate from these initiation times, the actual distribution of crack depths can be estimated.

Hope Creek SSER 6

Appendix U

'he report synthesizes stress corrosion crack growth with fracture appearance transition temperature (FATT), excess temperature versus K>C, and the calculated K>, the stress intensity factor at various operating conditions.

FATT is determined from the test results on retired wheels and other laboratory-generated test data.

The FATT value increases with distance from the surface to the interior of the wheel.

The prediction of deep-seated FATT values is based on the regression

analysis, which takes into account the range of three nickel alloys.

The distributions of points about the median lines are normal with a standard deviation of 28'F.

The overall standard deviation is 35'F when the cooling rate, ultimate tensile strength, percent

carbon, and percent nickel error-distributions are taken into account.

The toughness of the wheel material can be ascertained from toughness curves based on excess temperature (material temperature minus FATT) and the data generated from valid American Society for Testing and materials specimens.

A semilog relation fits the data below 100 F excess temperature.

The data are more widely scattered at a lower excess temperature than at the higher values.

Here, the natural logarithm of standar d deviation is a linear function of excess temperature.

A lognormal relation is used for all upper-shelf values utilizing the Rolf-Novak relation for all the GE shrunk-wheel service data.

The stress intensity factor K> is determined from a relationship involving a crack shape factor, the stress, the crack depth, and the geometry of the part near the crack.

The general shape of stress corrosion cracks is assumed to be

, elliptical.

They are quarter-elliptical at corners and semielliptical in the interior.

An average aspect ratio of depth of crack (half the minor axis of the ellipse} to the half-length along the surface (half the major axis) is assumed to be about 0.4, on the basis of a study of three wheels that had several stress corrosion cracks.

The average crack shape factor for corner cracks in the keyway under the hub was calculated to be 1.85.

The average shape factor of 1.71 for semielliptical cracks under the web was calculated.

The log standard deviation for both of these factors is taken to be 0.01.

The corrosion crack branching factor distribution is derived from test data on retired wheels and other data reported in the literature.

The nominal bore stress is assumed to be lognormal with a standard deviation of 0.02.

The keyway geometric function is based on the weight function method applied to the results of finite element analyses.

After obtaining the probability of a crack initiating at time t and knowing crack depth "a" at inspection time t>,

and using the Weilbull distribution for growth rate, the probability of having a crack depth "a" at time tz regardless of when it initiates is obtained by multiplying these two probabilities and integrating over the range from zero to tz.

Multiplying the probability of having a crack depth "a" at time t~ by the probability of not detecting a

crack depth "a" and integrating the product from zero to infinity for all possible crack depths, the probability of missing a crack of any depth at time tz is obtained.

Thus, dividing the probability of missing a crack of depth "a" by the probability of missing a crack of any depth at tz will give the density function of any undetected cracks at 'time tz.

Various combinations 'of temperatures and locking devices result in a median value of 0.03 in. with a lognormal standard deviation of 0.24.

This shows that there is a 50K proba" bility of the undetected crack size being less than 0.03 in.

Hope Creek SSER 6

Appendix U

0 The probability of cracks existing when no indication is found is computed by dividing the probability of missing any depth crack at tz by the sum of the probability of missing any depth crack and the probability of no crack existing at time t>.

This probability is the same as the probability of missing a crack at inspection time t>.

The difference between the true crack initiation distri-bution and the observed crack initiation distribution is considered as a per-centage difference for a given time.

Thus, the percentage of cracked wheels is higher for the true crack initiation distribution than for the observed distribution.

After adjusting the field data based on true crack initiation distribution, the Wei lbull distribution as a function of the temperature parameter, reciprocal to temperature, reactor type, and type of locking ring, showed that the Wei lbull slope was close to, unity and the characteristic growth rate distribution for the third iteration remains indistinguishable from that =of the first iteration.

The probability of wheel burst at any time is a function of speed and tempera-ture during a cycle between two refueling outages.

The cumulative probability of burst increases in time since the last inspection.

The probability of wheel burst at time t>, PB(t>), can occur either when the wheel bursts at normal operation PBN(t2) or it bursts at abnormal operation PBA(t<).

However, burst at abnormal speed will occur only if there is no burst at normal speed.

The

. annual rate of missile generation during normal operation is calculated by multiplying PBN(t2) by the probability of a missile given a burst at normal speed.

The probability of burst for abnormal events is derived from the assump-tion that a burst will not occur until the cumulative burst probability exceeds the level attained during normal operation.

An abnormal event occurs at a given temperature and a given maximum speed.

This probability difference is summed up for all temperature levels for this abnormal event.

Further, summing up for all abnormal events gives the probability of external missile generation P (t>),

which depends on the speed at which the wheel bursts.

Hence, the event (missile) must be integrated over the speed ranges for a given temperature.

This differ-ence must be multiplied by the probability of speed and temperature occurring, and summed for all temperatures that can occur'for the abnormal event.

This probability must be again multiplied by the annual probability of an abnormal event occurring and summed for all possible abnormal events.

Thus, the proba-bility of a missile resulting from abnormal events is obtained.

The final probability P~ is the sum of the probability of a missile resulting from normal and abnormal events.

The second mode of failure is ductile fracture of the wheel during an abnor-mally high overspeed occurrence.

Failure occurs when the average tangential stress across the wheel section exceeds the tensile strength of the material.

Since both brittle and ductile modes are statistically independent, the com-bined probability of failure is expressed as a standardized normal distribution.

Section 5 of the GE report discusses the values of the casing escape probability of each shrunk-on wheel of nuclear turbines manufactured by GE.

Earlier analyses assumed that the energy absorption was due to a gross deformation of many compo-nents of the low-pressure turbine casing.

However, present tests show that the absorption is a local "punching" mechanism.

Electric Power Research Institute Hope Creek SSER 6

Appendix U

5

~

I

full-scale casing penetration tests consisted of accelerating a 120 segment of an actual turbine wheel at 180K speed of the turbine.

Test results show that empirical formulas are overly conservative (HcHugh,

Seaman, and Gupta, 1983).

The actual penetration of the missile is only halfway through the wall when a

8300-lb missile at 450 ft/sec strikes the wall.

The range of final energy vari-ation (energy remaining after absorption) is based on normal distribution with two sigma limits.

Section 6 of the report gives an overall determination of a wheel burst proba-bilityy that is a function of time, temperature, and speed.

During a typical normal operating cycle, the temperature varies from 50'F at the start (0 speed) to 220'F at full loading (1800 rpm), then to 120~F after the coastdown.

The probability of the annual failure rate is calculated for both the normal and abnormal operating conditions.

By combining these two probabilities, the proba-bility P>, the generation of an external missile, is derived.

Section 7 of the report discusses typical results of calculations.

To provide further insight into the influence of various factors involved in the method, missile probability calculations have been made for a typical GE turbine used with a boiling-water reactor.

Two tables summarize the information for each of the 32 wheels used on the turbine.

The median value of calculated deep-seated FATT is given for each wheel together with the measured values of sur-face FATT and tensile strength.

The type of locking ring used with the axial key is also noted.

Tables also describe the wheel temperature under full-load conditions and the median value of crack growth rate, which is calculated using this design temperature.

Another table describes the results of missile proba-bilityy calculations for each wheel of the low-pressure rotor turbine at various times since the last inspection.

On the basis of these calculations, the risk of missile generation for each rotor and the unit can be estimated.

5 CONCLUSIONS AND RECONMENOATIONS The methodology used in the GE report for the calculation of disc rupture and turbine missile generation probabilities is a straightforward application of probabilistic concepts to variations in surface FATT and deep-seated

FATT, overspeed due to load rejection, and/or failure of the control system to func-tion properly.

The fracture mechanics calculations include the statistical variations in the toughness of the wheel material, in the depth of the crack, in the likelihood of crack initiation, in the ability to detect and to size cracks during inservice inspections, and in the rate of crack growth during subsequent service.

Because of the mixing of surface FATT and the deep-seated FATT values, the overall standard deviation is a larger value than the staff would anticipate.

In this way conservatism is introduced at each step.

The population of experimental tests and the actual data from the retired wheels are still small, and this results in a large standard deviation, thereby giving a conservative estimate.,

The staff finds that the GE crack growth equation gives a somewhat lower growth rate than that by another vendor;

however, the allowable crack length is only one-half the critical crack length for the deter-mination of an inspection interval.'gain it should be emphasized that the upper-shelf value of toughness is code allowable (200 Ksi-in. ), which is again a conservative value.

To arrive at the final probability of missile generation under normal and ab-normal operating conditions, a series of numerical integrations is required Hope Creek SSER 6

Appendix U

and this may introduce some uncertainty.

However, the missile penetration formula used is conservative (Moodfio, 1983) so that disc fragments as heavy as 4600 lb at velocities as great as 300 mph penetrated less than half the thickness of walls at impact velocities that would have produced complete perforation according to other formulas.

The staff has completed its review of the GE report after it met with GE per-sonnel at Schenectady, New York, to resolve some questions.

The staff believes that various safety factors. or margins used in arriving at the final inspection interval are adequate and the report describes an acceptable method to determine such inspection intervals.

Therefore, the staff concludes that the report may be used in determining the inspection interval for turbine discs in operating and new reactor plants.

The inspection interval will vary from plant to plant on the basis of the type of turbine in service and the previous inspection results.

Applicants or licensees who wish to reference this report should commit to the turbine inspection intervals determined by GE and should submit a brief summary of how the GE method is used for their specific turbines.

The summary should include a plot of missile probability versus inspection interval.

6 REFERENCES Burns, J. J., Jr, "Reliability of Nuclear Power Plant Steam Turbine Overspeed Control Systems,"

1977 ASME Failure Prevention and Reliability Conference, Chicago, Illinois, September

1977, p.

27.

b b,b.ll.,

"P bbllly b

N N

1 t p,"~NR ft, 14(3):

May-June

1973, p.

187.

.,"AR fi 1

-N Pll P bbitiy,"~NR lf 19(6}:

November-December 1978, p.

681.

Clark, M. G., Jr.,

B.

B. Seth, and D.

H. Shaffer, "Procedures for Estimating

. the Probability of Steam Turbine Disc Rupture From Stress Corrosion Cracking,"

ASME/IEEE Power Generation Conference, St. Louis, Missouri, October 4-8, 1981.

Code of Federal Re ulations, Title 10, "Energy," U.S.

Government Printing Off>ce, Mash~ngton, D.C.

Gonea, D. C.,

"An Analysis of the Energy of Hypothetical Wheel Missiles Escap-ing From Turbine Casings,"

General Electric Company, Turbine Department

Report, February 1973.

Kalderon, D,, "Steam Turbine Failure at Hinkley Point A," Proceedin s of the Institution of Mechanical En ineers, 186(31/72):

1972, p.

4

'cHugh, S.,

L.

Seaman, and Y. Gupta, "Scale Modeling of Turbine Missile Impact.

Into Concrete," Electric Power Research Institute, Final Report NP"2746, February 1983.'orthern States Power Co., Preliminary Notification of Event or Unusual Occur"

rence, PNO-III-81-104, "Circle in the Hub of the Eleventh Stage Mheel in the Main Turbine," Monticello Nuclear Power Station, November 24, 1981.

Hope Creek SSER 6

Appendix U

'e ~

4

Southern California Edison and San Diego Gas 8 Electric Co.,

Licensee Event Report No.82-132, Docket No. 50-361, "Failure of Turbine Stop Valve 2UV-2200E To Close Fully," San Onofre Nuclear Generating Station, Unit 2, November 29, 1982.

U.S. Nuclear Regulatory Commission, NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," July 1981.

---, NUREG/CR-1884, "Observations and Comments on the Turbine Failure at Yankee Atomic Electric Company, Rowe, Massachusetts,"

March 1981.

Woodfin, R. L., "Full-Scale Turbine Missile Concrete Impact Experiments," pre-pared by Sandia National Laboratories under Electric Power Research Institute Research Project 399-1, Final Report NP-2745, February 1983.

Table U. 1 Turbine system reliability criteria Probability, yr-'avorably oriented turbine (A)

Pg

< 10-4 Unfavorably oriented turbine Pg

< 10"s Required licensee action This is the general, minimum re-liability requirement for loading the turbine and bringing the system on line.

(B) 10-4

< P,

< 10-s 10-s P

< 10-~

(C) 10 Pz

< 10 10

< P]

< 10 If this condition is reached during operation, the turbine may be kept in service until the next scheduled

outage, at which time the licensee is to take action to reduce Pq to meet the appropriate A criterion (above) before returning the turbine to service.

If this condition is reached during operation, the turbine is to be isolated from the steam supply within 60 days, at which time the licensee is to take action to reduce P~ to meet the appropriate A cri-terion (above) before returning the turbine to service.

(D) 10-~

P 10-s Pg If this condition is reached at any time during operation, the turbine is to be isolated from the steam supply within 6 days, at which time the licensee is to take action to reduce Pz to meet the appropriate A

criterion (above) before returning the turbine to service.

Hope Creek SSER 6

10 Appendix U

0 II