Text

Auxiliary Feedwater Sys Reliability Analysis
	ML18052A359
Person / Time
Site:	Palisades
Issue date:	03/21/1986
From:	; CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:	;
Shared Package
ML18052A357	List: ML18052A356; ML18052A359;
References
	NUDOCS 8603280238
	Download: ML18052A359 (149)
	v • d • e

ATTACHMENT Consumers Power Company

-Palisades Plant Docket 50-255 AUXILIARY FEEDWATER SYSTEM RELIABILITY ANALYSIS March 21, 1986 8603280239 860321 PDR ADOCK 05000255 P

PDR 131 Pages IC0286-0001K-NL01

1.0 2.0 3.0 4.0 5.0 A.

B.

c.

D.

E.

F.

G.

PALISADES PLANT AUXILIARY FEEDWATER SYSTEM RELIABILITY ANALYSIS TABLE OF CONTENTS BACKGROUND RELIABILITY ANALYSIS 2.1 METHODOLOGY 2.2 FAULT TREES 2.3 CRITERIA AND ASSUMPTIONS 2.4 DATA SOURCES 2.5 CORRECTIONS TO FAULT TREES 2.6 RESULTS MSLB AFW MODEL CONCLUSIONS REFERENCES APPENDICES SYSTEM UNAVAILABILITY RESULTS MSLB AFW MODEL CUTSETS FIGURES AND DRAWINGS HARDWARE FAULT TREE TEST AND MAINTENANCE FAULT TREE ELECTRICAL FAULT TREES DATA IC0286-0001K-NL01 Page 1

2 2

3 4

5 5

7 9

13 14

1.0 BACKGROUND

AUXILIARY FEEDWATER SYSTEM RELIABILITY ANALYSIS 1

As a result of the Palisades Main Steam Line Break submittal, concern has been raised, by the NRG, regarding the adequacy of the existing Palisades auxiliary feedwater system (AFW).

This concern is based on the evaluation of the AFW model used in the Main Steam Line Break (MSLB) submittal.

Because of the importance of the issue, this report was created to clarify any potential misinterpretation of the results of the AFW system model analysis included in the MSLB submittal.

The intent of this report is to provide information in support of the position that the AFW system model, as used in the MSLB submittal, should not be construed to represent the reliability of the system.

This report focuses on two main elements 1) an analysis which more closely represents our state of knowledge regarding the reliability of the AFW system design and operation, and 2) a discussion of the results derived for the MSLB AFW model and why a significant portion is inappropriate in the context of the overall system reliability (refer to sections 2.1 and 3.0).

In order to accomplish item 1), a separate analysis of the AFW system was conducted using the guidelines of NUREG-0635.

The reasons for using NUREG-0635 are; a) to maintain consistency in the method of analysis (the system has undergone two previous analyses using these criteria).

b) the system has been significantly modified since the first analysis, using the same criteria allows direct comparison of the new results to the original results.

c) the results of the new analysis can be compared to the results for other plants already analyzed using the same criteria.

As indicated in a) above, two previous reliability analyses have been conducted.

The purpose of the second analysis was to demonstrate the level of increased reliability attainable from proposed modifications to the system.

A recent review of this second analysis showed that the fault tree models already developed could be used for an analysis of our existing system.

Necessary corrections and alterations to the models were made and are identified in section 2.5.

As indicated in b) above, modifications to the system to improve reliability by minimizing the failure effects of human error, common causes, and single-or double-point vulnerabilities were completed after NUREG-0635 was published. Therefore, the results obtained by the original analysis are no longer accurate.

Several of the significant modifications are listed below.

IC0286-0001K-NL01

2

1.

Addition of a third dedicated AFW pump.

2.

Manual or automatic flow initiation on receipt of low steam generator water level, and manual or automatic isolation of the depressurized steam generator following secondary system line breaks.

3.

Safety grade AFW flow indication to the main control room.

4.

Redundant emergency power supply for the electrical equipment, instrumentation, and control circuits associated with the modifications.

5.

Testability of AFW control circuits.

6.

Seismic and environmental qualification to meet applicable Palisades guidelines.

2.0 RELIABILITY ANALYSIS 2.1 METHODOLOGY Fault tree analysis was used to identify those potential failures that could be chief contributors to AFW system unreliability during the three transient conditions listed below.

LMFW - Loss of main feedwater with concurrent reactor trip and with offsite power available.

LMFW/LOOP -

LMFW with concurrent reactor trip and loss of offsite power (LOOP).

Onsite emergency power sources remain available.

LMFW/LOAC -

LMFw and concurrent loss of all alternating current power (LOAC), except that which is battery derived.

The model used in the current analysis is not the same as the model used in the MSLB submittal.

The reasons for using a different model are detailed below.

1)

The time interval of interest as stated in NUREG-0635 is the unavailability of the AFW system during period of time to boil the steam generator dry which for Palisades has been established as 15 minutes.

The model used in the MSLB submittal is based on a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time and therefore introduces significant contributions from failures of the system to continue to function

IC0286-0001K-NL01

2) 3 The model used in the MSLB submittal is a modified version of the complete AFW fault tree. A discussion of the differences is provided in section 3.0 "MSLB AFW Model".

However, a major difference in the models is due to an arbitrary assumption that the failed steam generator was unavailable.

This assumption effectively eliminates the redundancy in flow paths from the AFW pumps to the steam generators.

3)

The level of detail in the current plant model goes well beyond the level of detail prescribed by NUREG-0635.

Since part of the concern is based on the degree of reliability as compared to other plants or proposed goals, it was decided that the reliability analysis should be completed in a manner that allows such comparisons.

As additional insight, each model was evaluated with two sets of data.

The first set of data is generic as provided by NUREG-0635.

The second set includes plant specific data where such data was available.

When plant specific data was not available, generic data was used.

This allows comparison of the relative impact of the use of plant specific data to generic data.

Analysis of the fault trees was conducted using the WAMCUT computer code.

2.2 FAULT TREES Three fault tree models were used.

The fault trees include random failures of electrical and mechanical components and the effects of testing and maintenance, and human error.

The fault trees are shown in appendices D, E, and F.

Th.e trees were examined for causes of specific component failure modes and evaluation of their likelihood of occurrence.

The causes considered were:

Random independent failures; Test and maintenance; and Human error.

Each of the three master trees was developed for the loss of main feedwater (LMFW) transient condition.

For other transient conditions -

LMFW with loss of offsite power (LMFW/LOOP) or LMFW with loss of all alternating current power (LMFW/LOAC) -

some systems or components are unavailable.

Those systems or components were deleted before analysis.

NUREG-0635 was used to establish the top event of the master fault tree, set the initiating events, and as the basic guide for the analysis.

The top event is taken from NUREG-0635 which states; IC0286-0001K-NL01

4 The time interval of interest for all transient events considered is the unavailability of the auxiliary feedwater system during the period of time required to boil the steam generator dry. (Reference 2, page III-10)

The fault tree models were peveloped assuming statistical independence for hardware/operator failures, human error, and test and maintenance failures.

2.3 CRITERIA AND ASSUMPTIONS The following analytical criteria and assumptions were used.

AFW system availability is defined as successful system startup within the steam generator boil dry time of 15 minutes.

The availability conditions for AFW system power sources during the analyzed transients were as follows;

1)

LMFW - All alternating and direct current power available.

2)

LMFW/LOOP -

Two diesel generators and battery backup available.

3)

LMFW/LOAC - Direct current and battery-backed alternating current available (instrument and control power available only)

Although water from the fire protection system and service water system is available to backup the AFW system condensate storage tank, these sources were not considered in the fault tree analysis.

All component and operator actions were assumed to be either successes or failures.

No partial successes were considered.

Top event failure probability will be calculated by summing the failure probabilities from hardware, test and maintenance, and human error contributions.

The probabilities for each category are rare event approximations.

Human error probability has been considered in the Hardware and Test and Maintenance fault trees.

Component outage due to maintenance will only be considered for active components (pumps, control valves, etc).

Maintenance on manual valves is considered negligible

IC0286-0001K-NL01

2.4 5

DATA SOURCES Data used for the component failure rates in the hardware and test and maintenance trees was taken from the NRC.data found in Appendix III, Table III-3 of NUREG-0635.

Electrical tree component data was taken from IEEE Std 500.

Human error probabilities were drawn from NUREG-1278 and NUREG-0635.

Specific component failure data is listed in Appendix G.

2.5 CORRECTIONS TO FAULT TREES 2.5.1 2.5.2 As part of the preparation for this analysis, the fault trees utilized in the second reliability analysis were reviewed for accuracy.

Several discrepancies were identified and corrected.

Changes made are indicated on the fault trees and discussed below.

Hardware fault tree

1)

Operator errors had been treated as independent events.

Since each operator error in this tree involved operator response to a failure of the automatic initiation of the system, it was decided that a high degree of dependence was involved.

Based on this decision, all operator actions were grouped into three basic types; a) failure to actuate the system from the control room, b) failure to actuate the system locally, and c) failure to manually operate components.

2)

T~e original hardcopy of the model did not identify the primary events representing the failure of pref erred ac power for instrumentation and control. These events were added to the model.

3)

The failure mode for the motor-operated valves in the AFW flow paths was originally identified as fail to open.

These valves are normally open and should be identified as fail to remain open. The correction to the fault trees did not get accomplished.

However, in the examination of the system cutsets it was noted that the failure of these valves did not contribute significantly to the system unavailability.

Therefore, no corrections were made since the only impact was a slight conservatism in the numerical results and relative ranking of cutsets of intermediate to low contribution.

Test and maintenance fault tree

1)

As in 2.5.1 (1) above, the human error associated with restoration of the outlet valves from the condensate storage tank to the AFW pumps was treated as independent for each valve.

Because of the location and basis for restoration (ie if isolation was necessary at that point then both valves must be closed and restored), the separate events were combined into one.

IC0286-0001K-NL01

2.5.3

2) 6 Credit was taken for a manual valve which bypasses the pressure control valve in the steam line to the turbine-driven pump.

The current PRA model does not take credit for successful operation of this valve.

While it may be possible to control steam inlet pressure to the turbine driver by manually regulating a gate valve, the ability to do this efficiently and consistently has not been demonstrated and it was deleted from the model.

3)

In several cases, maintenance on valves was included when a) it is not physically possible to isolate these valves during power operation or b) isolation would disable 2 of the 3 pumps which is not allowed by Technical Specifications.

Each of these valves was removed from the WAMCUT input deck and are shown lined-out in the model in Appendix E.

Electrical_ fault trees.

The majority of the failure probabilities for electrical components were derived by treating the components as standby with a monthly testing interval.

Since several. of the components are performing their normal function and failures associated with them would be immediately detectable, while this treatment is inaccurate its importance was not obvious.

Since the failure of power is represented in the master tree as basic events with a probability derived from the output of the evaluation of the appropriate electrical tree, the impact of this treatment was determined by reevaluating the electrical trees and by examining the cutsets from the three transient cases using generic data to determine the importance of loss of power as a contributor to system unavailability.

The reevaluation of the electrical trees was accomplished by changing the failure probability of components which do not experience demands to probabilities of mission time failures of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months (first reevaluation) and 15 minutes (second reevaluation).

In general the changes resulted in reduced unavailabilities for the electric power sources.

The examination of system cutsets disclosed that the only case where the failure of electric power was identified as a significant contributor (>1%) to system unavailability was for the transient initiator loss of main f eedwater with concurrent loss of offsite power.

In this case, the failure of bus lD and/or bus lC contributed substantially to the system unavailability.

However, the change in unavailability (using 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or 15 minute mission times) for these buses under loss of offsite power conditions was insignificant (changed from 3.06E-02 to 3.05E-02).

The reason for the lack of difference is that the dominant failures for these buses tinder loss of offsite power are actual demand failures of the diesel generators and their output breakers

IC0286-0001K-NL01

2.6 2.6.1 2.6.1.1 7

Based on these results, the system fault trees were not rerun with the revised electrical failure data.

The results from the analyses with the initial electrical data were retained while recognizing that they were numerically conservative with respect to the electrical failures.

RESULTS The results of the analyses of the system fault trees are included in Appendix A and are discussed in the following sections.

The information provided in Appendix A is arranged as follows.

Page 1 is a presentation in table form of the numerical unavailabilities of electrical power and the system for each transient case analyzed for both generic and plant specific data.

The contributions from hardware, maintenance, and human error were derived by an arbitrary reorganization of cutsets.

The reorganization was completed by 1) moving all cutsets containing an operator error to a separate group (human error), 2) of the remaining cutsets any which incuded maintenance were separated into another group (maintenance), and 3) the remaining cutsets were identified as hardware.

The remainder of the Appendix is comprised of listings of the cutsets for each transient case.

Pages two through seven involve the output from the use of generic data.

Pages eight through thirteen is the output from plant specific data.

For each type of data, three pages represent unavailabilities from the master hardware tree for each transient and three pages for unavaila-bilities from all considerations for each transient. 'Each page includes a listing of dominant cutsets and the contribution of each (cutset unavailability/system unavailability) and a listing of the basic events which contribute substantially to the system unavailability (sum of the unavailabilities of the cutsets containing the basic event/system unavailability).

Results from Generic Data Evaluation General Results The analysis indicates the factor having the greatest impact on the unavailability in all three cases was failure of the relief valve at the discharge of pumps P8A and P8B failing to remain closed, either as a single or in combination with the unavailability of pump P8C or its flow paths.

Other significant contributors are: failure of P8C either as a pump failure or due to loss of bus lD; maintenance on control valves or check valves; operator error; and various causes of P8C or P8B pump trains (ie maintenance, power failure, or valve failures)

IC0286-0001K-NL01

2.6.1.2 2.6.1.3 2.6.1.4 2.6.2 2.6.2.l 2.6.2.2 8

Loss of Main Feedwater The dominant failure modes for this transient are double faults.

The most significant cutset contribution is the failure of the pump discharge relief valve to remain closed and the failure of P8C to start.

The relief valve failure represents the common mode failure of pumps PSA and P8B.

Primary event contributors in order of significance are: failure of the relief valve; failure of P8C to start; maintenance on control valves, check valves and PSC; and operator errors involving restoration of valves after testing or maintenance.

Loss of Main Feedwater/Loss of Offsite Power The dominant failure modes for this transient are also double faults.

The most significant cutset contributor is the relief valve and the loss of power to PSC. Primary event contributions in order of importance are: the relief valve; loss of power from bus lD; PSC fail to start; loss of power from bus lC; maintenance on control valves, check valves, or PSC; operator restoration errors; and maintenance on PSB, a pressure regulating valve, and a check valve.

Loss of Main Feedwater/Loss of all AC The dominant failure modes for this transient are single faults. The dominant contributors are: the relief valve; maintenance on P8B, its check valve,*and its pressure regulating valve; and P8B fails to start and operator restoration errors.

Results from Plant Specific Data Evaluation General Results The failures representing the largest contribution to unavailability in all three transients is pump fails to start.

Other general contributors are: the relief valve failing to remain closed; failure of the auto start circuitry and the operator error associated with placing the system in service.

Loss of Main Feedwater The dominant failures modes for this transient are triple faults.

The most significant contribution is made by the first cutset (approximately 24%).

This cutset represents the combination of all three pumps failing to start.

The more important primary event contributions in order of significance are: P8C fails to start; P8A fails to start; P8C fails to start; the relief valve fails to remain closed; and failure of the auto start circuit and the associated operator error in response to the failure of the start circuitry.

IC0286-0001K-NL01

9 2.6.2.3 Loss of Main Feedwater/Loss of Offsite Power 2.6.2.4 2.6.3 3.0 The dominant failure modes for this transient are again triple failures.

The largest contribution to the system unavailability (approximately 47%) is identified in the first four cutsets.

These cutsets represent failure of all three pumps.

They include combinations of pumps failing to start and loss of power to P8A and/or P8C.

The significant primary event contributions include:

P8B fails to start; loss of power from bus lC; loss of power from bus ID; P8C fails to start; and ~BA fails to start.

Loss of Main Feedwater/Loss of all AC The dominant contributors to this transient are single faults.

The most significant contribution is the failure of P8B to start (approximately 72%).

Other contributors are: maintenance on P8B, its steam pressure regulating valve, or its discharge check valve-;

and operator restoration errors associated with test and maintenance.

General Conclusions In comparing the results from generic data versus plant specific data, the calculated system unavailability is not significantly different.

The major difference in the results was a reorganization of the importance of the primary events in their contribution to the system unavailability.

In the analyses using generic data, the failure of the pump discharge relief valve for P8A and P8B is the dominant contributor in both cutset and primary event contribution.

For analyses using plant specific data, the combination of all available pumps failing to start is the dominant contributor in both cutsets and primary event contribution.

In evaluating the results from the analyses using plant specific data, no serious deficiencies were identified.

There were no single point vulnerabilities associated with hardware or maintenance identified.

Any further changes considered should be made only after careful evaluation of costs, benefits and importance in relation to the results of the analysis of the plant integrated risk model.

MSLB AFW MODEL In this section, the reliability of the auxiliary feedwater system as developed for examination of main st.earn line break issues is discussed (ref CPC to NRG May 23, 1985).

The purpose of the main steam line break logic models was to determine the risks associated with steam generator blowdown events and to determine the benefits of various backfits being proposed to minimize these risks.

In this regard," assumptions were made that significantly alter the system IC0286-0001K-NL01

i

10 configuration (ie eliminated redundant portions of the system) and therefore bias the numerical results of the analysis in a way that make it inappropriate to use these logic models for comparison with other risk based AFW reliability analyses such as that presented in the preceding section.

Some of the more significant assumptions include:

those particular to the main steam line break transient which artificially enhance the benefits of some of the proposed

backfits, those conservative with respect to system reliability that had no affect on the outcome of the main steam line break analysis and were therefore left uncorrected, the exclusion of any repair or recovery of failed hardware and an explicit attempt to model common cause events (those component failures which result from common manufacturer, function, etc).

The auxiliary feedwater cutsets extracted from the main steam line break report are included in appendix B.

They are rearranged into sections to permit an understanding of the contributors to AFW failure (as developed in that specific evaluation) and to identify where the assumptions outlined above had an effect.

A brief description of these cutsets follows including a discussion of their contribution to AFW unavailability.

The first group of cutsets include those independent to the auxiliary feedwater system.

The independent module (AUX3IT) will be discussed in detail later.

The remaining cutset contains a single operator error -

AFVOT - which represents failure to increase the flow to the intact steam generator.

This cutset results from the assumption that the failed steam generator is isolated following the steam line break event and remains disabled as a viable heat sink throughout the transient.

In reality, feedwater can be supplied to this generator, particularly during non-steam line break transients and this operator error should not be a single.

In the normal system configuration -

AFVOT - would be part of group of doubles in which the second event represented the failure of the redundant flow path from a given pump train.

This cutset, therefore, is a result of assumptions made that are peculiar to the steam line break evaluation.

Additionally, preliminary analyses in support of the upgrade of emergency procedures indicate that the flow supplied automatically through a single AFW train may be sufficient for decay heat removal.

The second group of cutsets are associated with makeup to the condensate storage tank.

Given that there is normally several hours of condensate available in the tank, these failures are more closely associated with the long term functioning of the auxiliary feedwater system than the failures which would be identified in other reliability analyses (such as NUREG 0635).

This part of the steam IC0286-0001K-NL01

11 line break analysis did not take credi~ for operator action to supply makeup from available systems including service water and the fire system, as outlined in plant procedures.

In the normal system configuration with service water and fire water included as backups, these cutsets would become substantially lower in their contribution to the system unreliability.

These cutsets, Xherefore, are a result of simplifying assumptions made with respect to auxiliary feedwater reliability that had little effect on the outcome of the steam line break evaluation.

The last group of cutsets identify power dependencies coupled with failures of pumps and flow control valves.

The AC power system failures involve disabling of an emergency bus (Bus lC) which in these models is assumed to take out one motor driven pump and the air pressure to steam supply valves for the steam driven pump.

The models conservatively ignore the nitrogen backup to instrument air supply to the steam driven pump valves as well as the ability to operate these valves locally by hand.

In the normal system configuration these cutsets would be ANDED with failures of the turbine driven pump train or an operator action to manually admit steam to the pump.

Consequently, these cutsets result from uncorrected assumptions which had no affect on the outcome of the steam line break study plus a lack of accounting for repair and recovery actions.

Additionally, two of the cutsets contain flow control valve failures which, like AFVOT discussed above, appear because it is assumed that only one steam generator is available.

In the normal system configuration these cutsets would also include failures of the redundant flow path from the respective pump train.

The cutsets which remain are those which make up the independent module, AUX3IT, introduced above.

The first group presented are those associated with the attempt to explicitly quantify common cause failures in the steam line break evaluation.

Common cause events were developed for various classes of equipment in the AFW system including the pumps, air operated valves, and instrumentation required to actuate the system.

Generic industry data was used to quantify these events and they end up making up the bulk of the independent module in terms of its probability.

Setting the appropriateness of these values aside, there are a number of features of the plant design which deserve some discussion for which credit could be taken to mitigate these failures.

Diversity in the pump design has been provided by including both turbine and motor drivers, for example.

Also, the motor driven pumps are located in separate areas of the plant minimizing location dependencies.

Failure of flow controllers and instrumentation can be overcome by operator action to maintain level in the steam generators rather than concentrate on AFW flow only.

In addition, the valves themselves can be operated locally if necessary

IC0286-0001K-NL01

/".

12 The next cutset is associated with spurious FOGG actuation (Feed Only Good Generator).

The assumption that only one steam generator is available enters in to the generation of this cutset.

Given that two steam generators are normally available this cutset should be ANDED with failures of components in the other flow trains.

In the normal system configuration, this event would be represented by a group of triples involving spurious actuation AND failure of two flow paths. Additionally, it should be noted that FOGG signals for the two steam generators are interlocked such that FOGG isolation of one generator precludes this spurious FOGG signal for the other generator.

This interlock was not included in the steam line break logic.

The next group of forty cutsets involve the loss of both flow paths to the unaffected steam generator.

Again, this is a set of failures which results from assuming that only one steam generator is available as a heat sink throughout the transient.

These cutsets should in fact be coupled with corresponding failures in the flow paths to the other steam generator.

In the normal system configuration these cutsets would change to 3d and 4th order cutsets which represent combinations of a pump train and two flow paths; or four flow paths; or three flow paths and an operator action.

The next cutsets deal with the potential for flow diversion in the AFW pump suction. In fact, these failure modes are incorrect.

A conservative assumption was made that a Y-strainer in the suction line to the AFW pumps, if left open following maintenance could lead to sufficient diversion of condensate to fail a portion of the system.

Subsequent investigation reveals that the line from the strainer is small and will not divert sufficient flow to cause pump suction to drop significantly, is not only valved but capped, and if it were to be left open would result in condensate to pour on the floor of the turbine building where it would be difficult not to notice.

These cutsets are a result of conservative modeling

assumptions that had no affect on the outcome of the steam line break evaluation and were left uncorrected in the analysis..This failure mode has been deleted from the model.

The next group of cutsets represent human error in the calibration of instrumentation associated with AFW pump and flow control valve operation.

Similar to the common cause failure of flow control

.instrumentation, miscalibration of this equipment will result in the operator taking feedwater flow control into manual in order to maintain steam generator inventory.

This recovery action was not included in the steam line break logic.

The pump suction pressure miscalibration should be a single event (as was noted in the staffs review of these cutsets).

Nevertheless, it should be noted that testing of these instruments independent of their calibration occurs frequently during pump surveillance tests.

Further, even if these monthly surveillances were to fail to uncover the deficiency, normal operator response to low suction trip of the AFW pumps would be to provide fire or service water pressµre to the pump s.uction IC0286-0001K-NL01

4.0 13 effectively eliminating the low pressure condition.

Additionally, steam supply to the turbine driven pump can be provided locally even in the presence of a low suction signal.

Again, recovery actions such as these were not incorporated in the steam line break models.

The final group of cutsets found in the independent module are the random pump and valve failures similar to those associated with the reliability analysis presented in the preceding section.

Given the preceding discussion, it should be clear that the main steam line break logic models were not developed with the intention of demonstrating the overall reliability of auxiliary feedwater.

Assumptions specific to the main steam line break transient, assumptions that conservatively enhance the benefits of various backfits and conservative assumptions that had no affect on the outcome of the main steam line break evaluation bias the bottom line results.

Explicit attempts to model common cause and a lack of obvious repair and recovery actions result in additional bias.

While the modelling was sufficient for the purpose of evaluating main steam line break issues, it is not appropriate to use them to draw conclusions as to the strengths and weaknesses of the system for a spectrum of more common transients.

CONCLUSIONS As indicated in section 1.0, the purpose of this report is to provide an analysis of the reliability of the AFW system and justification for not equating the results of the MSLB AFW model with system reliability.

In section 2.0, the results of a separate reliability analysis are discussed.

The results indicate that the system as modified is reliable.

Additionally, in a qualitative context the system includes multiple trains any of which is capable of removing decay heat, is automatically actuated, and has no single point vulnerabilities except for perhaps some human errors associated with calibration.

These are the features of an AFW system "characterized as having a high reliability" as explicitly outlined in section 4.6.1 of NUREG-0635.

In section 3.0, inconsistencies between the MSLB model and a reliability model were presented.

The differences between the special case MSLB model and a general case reliability model are significant and cause a substantial disparity in both numerical and qualitative results.

The MSLB model represents the system under unique conditions which do not allow an accurate derivation of the system reliability.

In addition, substantial improvement in the system reliability has been achieved through the completion of modifications as identified in section 1.0.

In conclusion, we believe the system is reliable and that the results of the reliability analysis have not disclosed any ~erious deficiencies in the current system.

IC0286-0001K-NL01

14

5.0 REFERENCES

1.

Guide to the Collection and Presentation of Electrical, Electronic, and Sensing Component Reliability Data for, Nuclear Power Generating Stations, IEEE Std 500(1977), Institute of Electrical and Electronics Engineers, Inc.

2.

Generic Evaluation of Feedwater Transients and Small Break Loss of Coolant Accidents in Combustion Engineering Designed Operating Plants, NUREG-0635, U.S. Nuclear Regulatory Commission, January 1980.

3.

Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications, NUREG/CR-1278, U.S. Nuclear Regulatory Commission, April 1980.

4.

Reactor Safety Study: An Assessment of Accident Risks in U.S.

Commercial Nuclear Power Plants, WASH-1400, U.S. Nuclear Regulatory Commission, 1975.

5.

Equipment Availability Component Cause Code Summary Report for the Ten-Year Period 1967-1976, EEI Publication 77-64A, January 1978.

6.

Clarification of TMI Action Plan Requirements, NUREG-0737, U.S.

7.

Nuclear Regulatory Commission, October 1980

Auxiliary Feedwater System (PWR), NUREG-0800, Standard Review Plan 10.4.9, U.S. Nuclear Regulatory Commission, July 1981.

IC0286-0001K-NL01

1.0 2.0 3.0 4.0 5.0 PALISADES PLANT AUXILIARY FEEDWATER SYSTEM RELIABILITY ANALYSIS TABLE OF CONTENTS BACKGROUND RELIABILITY ANALYSIS 2.1 METHODOLOGY 2.2 FAULT TREES 2.3 CRITERIA AND ASSUMPTIONS 2.4 DATA SOURCES 2.5 CORRECTIONS TO FAULT TREES 2.6 RESULTS MSLB AFW MODEL CONCLUSIONS REFERENCES APPENDICES A.

SYSTEM UNAVAILABILITY RESULTS B.

MSLB AFW MODEL CUTSETS C.

FIGURES AND DRAWINGS D.

HARDWARE FAULT TREE E.

TEST AND MAINTENANCE FAULT.TREE F.

ELECTRICAL FAULT TREES G.

DATA IC0286-0001K-NL01 Page 1

2 2

3 4

5 5

7 9

13 14

1.0 BACKGROUND

AUXILIARY FEEDWATER SYSTEM RELIABILITY ANALYSIS 1

As a result of the Palisades Main Steam Line Break submittal concern has been raised, by the NRC, regarding the adequacy of the existing Palisades auxiliary feedwater system (AFW).

This concern is based on the evaluation of the AFW model used in the Main Steam Line Break (MSLB) submittal.

Because of the importance of the issue, this report was created to clarify any potential misinterpretation of the results of the AFW system model analysis included in the MSLB submittal.

The intent of this report is to provide information in support of the position that the AFW system model as used in the MSLB submittal should not be construed to represent the reliability of the system.

This report focuses on two main elements 1) an analysis which more closely represents our state of knowledge regarding the reliability of the AFW system design and operation, and 2) a discussion of the results derived for the MSLB AFW model and why a significant portion is inappropriate in the context of the overall system reliability (refer to sections 2.1 and 3.0).

In order to accomplish item 1) a separate analysis of the AFW system was conducted using the guidelines of NUREG-0635.

The reasons for using NUREG-0635 are; a) to maintain consistency in the method of analysis (the system has undergone two previous analyses using these criteria).

b) the system has been significantly modified since the first analysis, using the same criteria allows direct comparison of the new results to the original results.

c) the results of the new analysis can be compared to the results for other plants already analyzed using the same criteria.

As indicated in a) above, two previous reliability analyses have been conducted.

The purpose of the second analysis was to demonstrate the level of increased reliability attainable from proposed modifications to the system.

A recent review of this second analysis showed that the fault tree models already developed there could be used for an analysis of our existing system.

Necessary corrections and alterations to the models were made and are identified in section 2.4.

As indicated in b) above, modifications to the system to improve reliability by minimizing the failure effects of human error, common causes, and single-or double-point vulnerabilities were completed after NUREG-0635 was published. Therefore the results obtained by the original analysis are no longer accurate.

Several of the significant modifications are listed below.

IC0286-0001K-NL01

2

1.

Addition of a third dedicated AFW pump.

2.

Manual or automatic flow initiation on receipt of low steam generator water level, and manual or automatic isolation of the depressurized steam generator following secondary system line breaks.

3.

Safety grade AFW flow indication to the main control room.

4.

Redundant emergency power supply for the electrical equipment, instrumentation, and control circuits associated with the modifications.

5.

Testability of AFW control circuits.

6.

Seismic and environmental qualification to meet applicable Palisades guidelines.

2.0 RELIABILITY ANALYSIS 2.1 METHODOLOGY Fault tree analysis was used to identify those potential failures that could be chief contributors to AFW system unreliability during the three transient conditions listed below.

LMFW - Loss of main feedwater with concurrent reactor trip and with offsite power available.

LMFW/LOOP -

LMFW with concurrent reactor trip and loss of offsite power (LOOP);

Onsite emergency power sources remain available.

LMFW/LOAC -

LMFW and concurrent loss of all alternating current power (LOAC), except that which is battery derived.

The model used in the current analysis is not the same as the model used in the MSLB submittal.

The reasons for using a different model are detailed below.

1)

The time interval of interest as stated in NUREG-0635 is the unavailability of the AFW system during period of time to boil the steam generator dry which for Palisades has been established as 15 minutes.

The model used in the MSLB submittal is based on a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time and therefore introduces significant contributions from failures of the system to continue to function

IC0286-0001K-NL01

2) 3 The model used in the MSLB submittal is a modified version of the complete AFW fault tree. A discussion of the differences is provided in section 3.0 "MSLB AFW Model".

However, a major difference in the models is due to an arbitrary assumption that the failed steam generator was unavailable.

This assumption effectively eliminates the redundancy in flow paths from the AFW pumps to the steam generators.

3)

The level of detail in the current plant model goes well beyond the level of detail prescribed by NUREG-0635.

Since part of the concern is based on the degree of reliability as compared to other plants or proposed goals, it was decided that the reliability analysis should be completed in a manner that allows such comparisons.

As additional insight, each model was evaluated with two sets of data.

The first set of data is generic as provided by NUREG-0635.

The second set includes plant specific data where such data was available.

When plant specific data was not available, generic data was used, This allows comparison of the relative impact of the use of plant specific data to generic data.

Analysis of the fault trees was conducted using the WAMCUT computer code.

2.2 FAULT TREES Three fault tree models were used.

The fault trees include random failures of electrical and mechanical components and the effects of testing and maintenance, and human error.

The fault trees are shown in appendices D, E, and F.

The trees were examined for causes of specific component failure modes and evaluation of their likelihood of occurrence.

The causes considered were:

Random independent failures; Test and maintenance; and Human error.

Each of the three master trees was developed for the loss of main feedwater (LMFW) transient condition.

For other transient conditions -

LMFW with loss of offsite power (LMFW/LOOP) or LMFW with loss of all alternating current power (LMFW/LOAC) -

some systems or components are unavailable.

Those systems or components were deleted before analysis.

NUREG-0635 was used to establish the top event of the master fault tree, set the initiating events, and as th~ basic guide for the analysis.

The top event is taken from NUREG-0635 which states; IC0286-0001K-NL01

4 1'.he time interval of interest for all transient events considered is the unavailability of the auxiliary feedwater system during the period of time required to boil the steam generator dry. (Reference 2, page III-10)

The fault tree models were developed assuming statistical independence for hardware/operator failures, human error, and test and maintenance failures.

2.3 CRITERIA AND ASSUMPTIONS The following analytical criteria and assumptions were used.

AFW system availability is defined as successful system startup within.the steam generator boil dry time of 15 minutes.

' The availability conditions for AFW system power sources during the analyzed transients were as follows;

1)

LMFW - All alternating and direct current power available.

2)

LMFW/LOOP - Two diesel generators and battery backup available.

3)

LMFW/LOAC - Direct current and battery-backed alternating current available (instrument and control power available only)

Although water from the fire protection system and service water system is available to backup the AFW system condensate storage tank, these sources were not considered in the fault tree analysis.

Use of these water systems would require successful operation of manual valves, which is difficult within the 15-minute boil~dry time limit.

Al.l component and operator actions were assumed to be either successes or failures.

No partial successes were considered.

Top event failure probability will be calculated by summing the failure probabilities from hardware, test and maintenance, and human error contributions.

The probabilities for each category are rare event approximations.

- Human error probability has been considered in the Hardware and Test and Maintenance fault trees.

' Component outage due to maintenance will only be considered for active components (pumps, control valves, etc).

Maintenance on manual valves is considered negligible

IC0286-0001K-NL01

2.4 5

DATA SOURCES Data used for the component failure rates in the hardware and test and maintenance trees was taken from the NRC data found in Appendix III, Table III-3 of NUREG-0635.

Electrical tree component data was taken from IEEE Std 500.

Human error probabilities were drawn from NUREG-1278 and NUREG-0635.

Specific component failure data is listed in Appendix G.

2.5.

CORRECTIONS TO FAULT TREES 2.5.1 2.5.2 As part of the preparation for this analysis the fault trees utilized in the second reliability analysis were reviewed for accuracy.

Several discrepancies were identified and corrected.

Changes made are indicated on the fault trees and discussed below.

Hardware fault tree

1)

Operator errors had been treated as independent events.

Since, each operator error in this tree involved operator response to a failure of the automatic initiation of the system, it was decided that a high degree of dependence was involved.

Based on this decision all operator actions were grouped into three basic types - a) failure to actuate the system from the control room, b) failure to actuate the system locally, and c) failure to manually operate components.

2)

The original hardcopy of the model did not identify the primary events representing the failure of preferred ac power for instrumentation and control. These events were added to the model.

3)

The failure mode for the motor~operated valves in the AFW flow paths was originally identified as fail to open.

These valves are normally open and should be identified as fail to remain open. The correction to the fault trees did not get accomplished.

However, in the examination of the system cutsets it was noted that the failure of these valves did contribute significantly to the system unavailability.

Therefore, no corrections were made since the only impact was a slight conservatism in the numerical results and relative ranking of cutsets of intermediate to low contribution.

Test and maintenance fault tree

1)

As in 2.5.1 (1) above the human error associated with restoration of the outlet valves from the condensate storage tank to the AFW pumps was treated as independent for each valve.

Because of the location and basis for restoration (ie if isolation was necessary at that point then both valves must be closed and restored), the separate events were combined into one.

IC0286-0001K-NL01

2.5.3

2) 6 Credit was taken for a manual valve which bypasses the pressure control valve in the steam line to the turbine-driven pump.

The current PRA model does not take credit for successful operation of this valve.

While it may be possible to control steam inlet pressure to the turbine driver by manually regulating a gate valve, the ability to do this efficiently and consistently has not been demonstrated and it was deleted from the model.

3)

In several cases, maintenance on valves was included when a) it is not physically possible to isolate these valves during power operation or b) isolation would disable 2 of the 3 pumps which is not allowed by Technical Specifications.

Each of these valves was removed from the WAMCUT input deck and are-shown lined-out in the model in Appendix E.

Electrical fault trees.

The majority of the failure probabilities for electrical components were derived by treating the components as standby with a monthly testing interval.

Since several of the components are performing

.their normal function and failures associated with them would be immediately detectab~e*, while this treatment is inaccurate its importance was not obvio.us.

Since the failure of power is represented in the master tree as basic events with a probability derived from the output of the evaluation of the appropriate electrical tree, the impact of this treatment was determined by reevaluating the electrical trees and by examining the cutsets from the three transient cases using generic data to determine the importance of loss of power as a contributor to system unavailability.

The reevaluation of the electrical trees was accomplished by changing the failure probability of components which do not experience demands to probabilities of mission time failures of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months (first reevaluation) and 15 minutes (second reevaluation).

In general the changes resulted in reduced unavailabilities for the electric power sources.

The examination of system cutsets disclosed that the only case where the failure of electric power was identified as a significant contributor (>1%) to system unavailability was for the transient initiator loss of main feedwater with concurrent loss of offsite power.

In this case the failure of bus lD and/or bus lC contributed substantially to the system unavailability.

However, the change in unavailability (using 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or 15 minute mission times) for these buses under loss of offsite power conditions was insignificant (changed from 3.06E-02 to 3.05E-02).

The reason for the lack of difference is that the dominant failures for these buses under loss of offsite power are actual demand failures of the diesel generators and their output breakers

IC0286-0001K-NL01

.1_ --

2.6 2.6.1 2.6.Ll 7

Based on these results the system fault trees were not rerun with the revised electrical failure data.

The results from the analyses with the initial electrical data were retained while recognizing that they were numerically conservative with respect to the electrical failures.

RESULTS The results in Appendix information of the analyses of the A and are discussed in provided in Appendix A system fault trees are the following sections.

is arranged as follows.

in~luded The Page 1 is a presentation in table form of the numerical unavailabilities of electrical power and the system for each transient case analyzed for both generic and plant specific data.

The contributions from hardware, maintenance, and human error were derived by an arbitrary reorganization of cutsets.

The reorganization was completed by 1) moving all cutsets containing an operator error to a separate group (human error), 2) of the remaining cutsets any which incuded maintenance were separated into another group (maintenance), and 3) the remaining cutsets were identified as hardware.

The remainder of the Appendix is comprised of listings of the cutsets for each transient case.

Pages two through seven involve the output from the use of generic data.

Pages ei'ght through thirteen is the output from plant specific data.

For each type of data three pages represent unavailabilities from the master hardware tree for each transient and three pages for unavailabilities from all considerations for each transient.

Each page includes a listing of dominant cutsets and the contribution of each (cutset unavailability/system unavailability) and a listing of the basic events which contribute substantially to the system unavailability (sum of the unavailabilities of the cutsets containing the basic event/system unavailability).

Results from Generic Data Evaluation General Results The analysis indicates the factor having the greatest impact on the unavailability in all three cases was failure of the relief valve at the discharge of pumps PSA and P8B failing to remain closed, either as a single or in combination with the unavailability of pump P8C or its flow paths.

Other significant contributors are: failure of P8C either as a pump failure or due to loss of bus lD; maintenance on control valves or check valves; operator error; and various causes of P8C or P8B pump trains (ie maintenance, power failure, or valve failures)

IC0286-0001K-NL01

2.6.1.2 2.6.1.3 2.6.1.4 2.6.2 2.6.2.1 2.6.2.2 8

Loss of Main Feedwater The dominant failure modes for this transient are double faults.

The most significant cutset contribution is the failure of the pump discharge relief valve to remain closed and the failure of P8C to start.

The relief valve failure represents the common mode failure of pumps PSA and PSB.

Primary event contributors in order of significance are: failure of the relief valve; failure of P8C to start; maintenance on control valves, check valves and PSC; and operator errors involving restoration of valves after testing or maintenance.

Loss of Main Feedwater/Loss of Offsite Power The dominant failure modes for this transient are also double faults.

The most significant cutset contributor is the relief valve and the loss of power to PSC. Primary event contributions in order of importance are: the relief valve; loss of power from bus lD; PSC fail to start; loss of power from bus lC; maintenance on control valves, check valves, or P8C; operator restoration errors; and maintenance on P8B, a pressure regulating valve, and a check valve.

Loss of Main Feedwater/Loss of all AC The dominant failure modes for this transient are single faults. The dominant contributors are: the relief valve; maintenance on P8B, its check valve, and its pressure regulating valve; and P8B fails to start and operator restoration errors.

Results from Plant Specific Data Evaluation General Results The failures representing the largest contribution to unavailability in all three transient is pump fails to start.

Other general contributors are: the relief valve failing to remain closed; failure of the atito start circuitry and the operator error associated with placing the system in service.

Loss of Main Feedwater The dominant failures modes for this transient are triple faults.

The most significant contribution is made by the first cutset (approximately 24%).

This cutset represents the combination of all three pumps failing to start.

The more important primary event contributions in order of significance are: PSC fails to start; P8A fails to start; PSC fails to start; the relief valve.fails to remain closed; and failure of the auto start circuit and the associated operator error in response to the failure of the start circuitry

IC0286-0001K-NL01

9 2.6.2.3 Loss of Main Feedwater/Loss of Offsite Power 2.6.2.4 2.6.3 3.0 The dominant failure modes for this transient are again triple failures.

The largest contribution to the system unavailability (approximately 47%) is identified in the first four cutsets.

These cutsets represent failure of all three pumps.

They include combinations of pumps failing to start and loss of power to P8A and/or P8C.

The significant primary event contributions include:

P8B fails to start; loss of power from bus lC; loss of power from bus lD; P8C fails to start; and P8A fails to start.

Loss of Main Feedwater/Loss of all AC The dominant contributors to this transient are single faults.

The most significant contribution is the failure of P8B to start (approximately 72%).

Other contributors are: maintenance on P8B, its steam pressure regulating valve, or its discharge check valve; and operator restoration errors associated with test and maintenance.

General Conclusions In comparing the results from generic data versus plant specific data, the calculated system unavailability is not significantly different.

The major difference in the results was a reorganization of the importance of the primary events in their contribution to the system unavailability.

In the analyses using generic data the failure of the pump discharge relief valve for P8A and P8B is the dominant contributor in both cutset and primary event contribution.

For analyses using plant specific data the combination of all available pumps failing to start is the dominant contributor in both cutsets and primary event contribution.

In evaluating the results from the analyses using plant specific data no serious deficiencies were identified.

There were no single point vulnerabilities associated with hardware or maintenance identified.

Any further changes considered should be made only after careful evaluation of costs, benefits and importance in relation to the results of the analysis of the plant integrated risk model.

MSLB AFW MODEL In this section the reliability of the auxiliary feedwater system as developed for examination of main steam line break issues is discussed (ref CPC to NRG May 23, 1985).

The purpose of the main steam line break logic models was to determine the risks associated with steam-generator blowdown events and to determine the benefits of various backfits being proposed to minimize these risks.

In this regard~ assumptions were made that significantly alter the system IC0286-0001K-NL01

10 configuration (ie eliminated ~edundant portions of the system) and therefore bias the numerical results of the analysis in a way that make it inappropriate to use these logic models for comparison with other risk based AFW reliability analyses such as that presented in the preceding section.

Some of the more significant assumptions include:

those particular to the main steam line break transient which artificially enhance the benefits of some of the proposed

backfits, those conservative with respect to system reliability that had no affect on the outcome of the main steam line break analysis and were therefore left uncorrected, the exclusion of any repair or recovery of failed hardware and an explicit attempt to model.common cause events (those component failures which result from common manufacturer, function, etc).

The auxiliary feedwater cutsets extracted from the main steam line break report are included in appendix B.

They are rearranged into sections to permit an understanding of the contributors to AFW failure (as developed in that specific evaluation) and to identify where the assumptions outlined above had an effect.

A brief description of these cutsets follows including a discussion of their contribution to AFW unavailability.

The first group of cutsets include those independent to the auxiliary feedwater system.

The independent module (AUX3IT) will be discussed in detail later.

The remaining cutset contains a single operator error - AFVOT - which represents failure to increase the flow to the intact steam generator.

This cutset results from the assumption that the failed steam generator is isolated following the steam line break event and remains disabled as a viable heat sink throughout the transient.

In reality, feedwater*can be supplied to this generator, particularly during non-steam line break transients and this operator error should not be a single.

In the normal system configuration -

AFVOT - would be part of group of doubles in which the second event rep~esented the failure of the redundant flow path from a given pump train.

This cutset, therefore, is a result of assumptions made that are peculiar to the steam line break evaluation.

Additionally, preliminary analyses in support of the upgrade of emergency procedures indicate that the flow supplied automatically through a single AFW train may be sufficient for decay heat removal.

The second group of cutsets are associated with makeup to the condensate storage tank.

Given that there is normally several hours of condensate available in the tank, these failures are more closely associated with the long term functioning of the auxiliary feedwater system than the failures which would be identified in other reliability analyses (such as NUREG 0635).

This part of the steam IC0286-0001K-NL01

11 line break analysis did not take credit for operator action.to supply makeup from available systems including service water and the fire system, as outlined in plant procedures.

In the normal system configuration with service water and fire water included as backups these cutsets would become substantially lower in their contribution to the system unreliability.

These cutsets, therefore, are a result of simplifying assumptions made with respect to auxiliary feedwater reliability that had little effect on the outcome of the steam line break evaluation.

The last group of cutsets identify power dependencies coupled with failures of pumps and flow control valves.

The AC power system failures involve disabling of an emergency bus (Bus lC) which in these models is assumed to take out one motor driven pump and the air pressure to steam supply valves for the steam driven pump.

The models conservatively ignore the nitrogen backup to instrument air supply to the steam driven pump valves as well as-the ability to operate these valves locally by hand.