ML19340B124
| ML19340B124 | |
| Person / Time | |
|---|---|
| Site: | Zion File:ZionSolutions icon.png |
| Issue date: | 10/07/1980 |
| From: | PLG, INC. (FORMERLY PICKARD, LOWE & GARRICK, INC.) |
| To: | |
| Shared Package | |
| ML19340B123 | List: |
| References | |
| PRA-801007, NUDOCS 8010210464 | |
| Download: ML19340B124 (96) | |
Text
__.
I...
dickard,I,6weandGarrick,Inc.._
' ZION / INDIAN POINT
.,_2, i :- e
. ; October; 7,- 1980
.PROBABILISTIC RISK ASSESSMENT-
- 'JWS DRAFT I-
?
t l
l
' ZION 1 AND 2-CCMPONENT' FAILURE AND~ MAINTENANCE DATA Sections B.1, B.2, and B.3' i
l
^
l:
t.
i r
t.
I
.o :
.F-o i
l f --
ZION 1 AND 2 COAPONENT FAILURE AND MAINTENANCE DATA l
l
(
Page
(
B.1 Site-Specific Failure Data Base Development 1
- 1. -
Component Failure Data 1
j 1.1 Failure Definition 1
l' l.2 Failure Data Sources 1
2.
Component Operability Tests and Service Hours Data 4
2.1 Data Base Definition 4'
2.1.11 Operating Modes 4
l 2.1.2 Testing Frequencies 4
(
2.2 Component Test Data Synthesis 5
l 2.3 Component Service Hours Data Synthesis 6
.3.
Component Failure Mode Definition 12 i.
4.
Data Base Applicability 14 5.
Plant-Specific Component Failure Mode Data 15 Summaries l
B.2 Zion'1 and 2 Generic and Updated Plant Data 58 B.3 Component Maintenance Data 66
-1.
Data Base Development Methodology 67 L
1.1 Data Base Definition 67 1.1.1 General Considerations 67 l
.l.1.2 Frequency of Maintenance 69
[
1.1.3 Duration of Maintenance 69 i
1.2 Data Base Specialization 70 l
1.3 Comparison with Methodology Used in WASH-1400 71 l
l 2.
Component Maintenance Prior Distributions 73 2.1 Frequency of Maintenance 73 2.2 Duration of Maintenance 73 2.3 Comparison with Distributions Used in WASH-1400 73 3.
Site-Specific Component Maintenance Data 75-t J
e/
e L
ZION 1 AND 2 B.1 SITE-SPECIFIC FAILURE ~ DATA BASE DEVELOPMENT j
1 COMPONENT FAILURE DATA 1
'l. l' FAILURE DEFINITION
,The site-specific component failure information developed in this data base ~is. utilized as a basic input to the Bayesian. specialization of available generic component' failure distributions. These specialized distributions are then applied to the-corresponding components in each of
- the system fault trees during the quantification of hardware failure
~
contributions to system unavailability. As framed in this context, the definition'of component failures as it applies to this data base is restricted,to include'only those hardware failures which can be identified as attributable to an intrinsic property or state of the t
component or subsystem being analyzed. Specifically excluded from this
' data base are failures attributable to:
3-e Personnel errors and procedural errors: These failures are included in the analysis of human interactions with components and.. systems during operation, testing and maintenance
- activities.
t
<Causes gen 2 rated by systems or components external to the e
4 component being analyzed:.These failures are identified and' included in the. analysis of these interfacing components and systems, and.their effects are quantified through the analysis of system interdependencies and common cause initiators.
e
. Design, fabrication, and installation errors (for which e
documented-corrections have been. implemented and for which sufficient operating experience has been accumulated to demonstrate-the efficacy of such corrections) : Corrected errors are not considered 'as contributors to failure; consideration and quantification of unidentified or latent
. uncorrected design, fabrication and installatics errors are-included in each system analysisfindependently of hardware failures.
- In all cases, descriptions of the specific failures included and, if
. appropriate, excluded from this data-base are provided with the individual component _ failure: mode' data summaries presented in section 5.
- 1.2. FAILURE' DATA SOURCES =
0
.The primary; source of basic' component failure data utilized in this study fwas c the Licensee Event: Reports (LERs). required by the Technical a
c Specifications:and plant' operating license reporting criteria to be.
I 4
4 e
m g
s
-)--
t l
m.,
4 4
--'ve-s
N submitted to the NRC as documentation of all significant events impacting directly upon plant safety or upon those systems designed to maintain the plant in'a safe condition. A compilation of all LERs submitted by Zion Units 1 and 2 from pre-startup construction (1969) through December 1979 provided the basic event descriptions from which the corresponding failure items were reduced and evaluated for inclusion in the data base.
The information contained in any. source document cannot be directly applied to the synthesis of a specific failure data base without first identifying, documenting, and understanding the constraints and implications associated with that information. Those constraints are discussed below. Meanwhile, the LERs provide significant advantages over j
other primary failure data sources for use in probabilistic risk assessment work.
The reporting criteria specify that all events impacting upon e
safety systems accident mitigation capabilities must be reported. Since this study is specifically concerned with the l
investigation of these capabilities, all LER items should be directly relevant to the development of this data base, Failures are generally reported during the plant operating e
j modes of primary concern in this study: power operation and, l
in some cases, hot shutdown or hot standby.
l l
e-The LERs are a source of relatively consistent, reviewed, and l
generally complete event descriptions. Because each obvserved j
event must be evaluated relative to common reporting criteria, the items reported in the LERs provide a relatively consistent information base to be applied between different systems in any given plant. To a much-lesser extent, due to the inherent subjectivity of intent interpretation and due to subtle dif-l ferences in the criteria applied and Technical Specifications i
limitations imposed at different plants, these general j
reporting c.iteria also provide a basis for broad consistency in the types and applicability of events reported from several plants.
(It must be recognized, however, that direct l
comparisons of these reports cannot be made without full j
evaluation of the bases for and application of the specific reporting criteria as they are implemented at each individual station.)
l f
The LERs provide a fully verifiable source of primary component e
failure data. Because all of the other available sources of failure information are generally subject to many of the same l
limitations identified with respect to the LERs,.a principal
-advantage for use of the LERs in this specific study is that l
they jrovide,a uniquely verifiable source of data which is readily available to all potential users and review personnel.
l A number. of -additional sources of primary component failure data were also. utilized as references for specific items requiring more 2
1
/.
detailed informatiuon than was available in the LER summaries. These sources included control room equipment operating logs, component maintenance records, testing re' cords and station internal event reporting documents (Deviation Reports). The Deviation Reports (DVRs) represent a
'large volume of raw data pertaining to a wide range of abnormal occurrences documented during all phases of plant operation and, as such, provide a complete record of all component failures observed at the station.
(The DVRs constitute the initiating documents for all failures ultimately reported as LERs.) However, due to the volume, variability and lack of deta 1 in much of the information presented in the DVRs, they were utilized primarily as reference documents for this study, and no detailed effort was made to reduce their information content to a form directly appli:able to this data base.
The prime concerns in the development of this site-specific lata base were that it must be:
(1) self-consistent and (2) fully verifiable. In light of these concerns, any modifications, additions or deletions made to the failure data reported in the LERS have been applied only when specific documentation was available to fully justify such modifications. In all such casas, this documentation or a direct reference to its source is provaded with the affected component failure mode data summary.
It is important to make a few observatiens about the limitations of existing data sources, including LERs, with respect to probabilistic risk assessment work. First, there does not exist a ecmprehensive deta The collection system designed from the ground up to support PRA.
existing systems have all evolved from either licensing related criteria or plant performance analysis requirements. For example, PRA does not draw boundaries around systems according to safety system classifications
-or-technical-specifications. Rather, the scenarios and event sequences determine the systems and hence the data of interest. The result is that some failures and failure modes may not get reported
'u, the plant sticks only to safety criteria. The same applies to plant operating conditions.
A second observation is that, regardless of the data system, there is always judgment involved. All failures require some interpretation by the plant staff--was it a failure; is it a reportable event; what is the mode, the apparent cause, etc.
Recognizing the limitations of LERs as a data source for PRA, an effort was made to review detailed station records at Zion to ensure that the Zion LERs provided a representative data base for Zion. It is believed that the data base employed is sound and where uncertainties exist the probabilistic framework accomodates quantification of such uncertainties.
4 3
J
o t
2.'COMPONEUT OPERABILITY TESTS AND SERVICE HOURS DATA 2.1 DATA BASE DEFINITION
- 2. l'.1 Coerating Modes The distinction in plant operating modes between the cold shutdown and non-cold-shutdown.(i.e., hot shutdown, hot stanoby, or power operation) conditions is. vital for the development of a site-specific failure data base using the LERs as the primary source of component failure information.
The principal reasons for distinguishing these two modes (as opposed to modes, for example, such as power cperation vs. shutdown, or critical vs.
non-critical) are:
LER event reportability criteria are modified significantly e
when the. plant enters the cold shutdown condition.
(Very few events are reportable in cold shutdown.)
The Technical Specifications operability criteria for safety e
systems and components generally specify cold shutdown as the condition in which all operability restrictions are removed.
Operating, maintenance and system testing procedures and prac-e tices are modified significantly when the plant enters the cold shutdown condition.
The plant operating mndes of primary concern in this Ludy are e
power operation and, in some cases, hot shutdown or hot standby.
(i.e., non-cold-shutdown modes).
Table 1 summarizes the periods since initial reactor criticality during which Zion Unit 1 was.in the cold shutdown mode of operation Table 2 provides this infonnation for Unit 2.
Only operating times between initial criticality l
(June 120, 1973 for Unit 1; December 25, 1973 for Unit 2) and December 31, 1979 i
were included in this failure data base, due to the availability of failure event information from the LERs, coupled with the operability, testing and reporting criteria specifically applied following initial criticality.
2.1.2 Testing Frequencies Feriodic testing required by the plant Technical' Specifications is-generally performed monthly (during power operation), quarterly (during any calendar quarter for which the unit was not in continuous cold shutdown),
' annually, or.during regular refueling outages. Variable frequency testing not required by the Technical Specifications is performed as specified in the individual. test procedures and as plant operating conditions allow. For 1
the application of periodic testing data,;use of the operating periods sum-marized in Tables *1 and 2.in conjunction with the general testing frequency criteria outlined above results in the development of the periodic testing data shown in Table 3.
As an example of the-use of this frequency data, consider 4
~
E
?
4 Component "X", which, according to the station's periodic testing procedures, is tested monthly on each unit during power operation. The total number of tests performed on Unit 1 Component "X" between initial criticality and the end of 1979 is thus 67, and the number of tests of Unit 2 Component "X"
is 61.
If sir'lar Component "Y" is tested quarterly on each unit, then the total' number of component tests for "X" and "Y" together, combining all Unit 1 and Unit 2 tests, is 176.
2.2 COMPONENT TEST DATA SYNTHESIS Specific details of the number of component tests performed at each of the periodic testing intervals are provided with the individual component failure mode data summaries in Section 5.
The number of tests listed for each interv'al is the total number of component tests performed at that interval for each of the units. The total number of component tests performed for both units during the data base period is obtained from the product of this periodic test data and testing frequency data presented in Table 2.
As an example of this process, consider the following:
e Test No. 1 is performed monthly and verifies the operability of 3 motor operated valves on each unit.
e Tests No. 2 and No. 3 are each performed quarterly and verify the operability of 1 and 18 motor operated valves, respectively, on each unit.
No other tests are performed which verify motor cyerated valve e
operability.
e The total number of valve tests p6c month for each unit is 3.
(This number would appear as the monthly testing frequency for motor operated valves in the failure mode data summary.)
The total number of valve tests for the data base period is:
e 3 (67 + 61) + 19 (25 + 23) = 1296 valve tests, including all tests performed on both units between 1973 and 1979.
A review of all the station's periodic test procedures was performed in order.to identify the-specific components tested and the failure medes veri-fled by each of these procedures. For many of the failure modes presented in the data base (e.g., motor driven pump failure to start on demand), specific operations performed'during the testing process provided direct evidence of component operability (e.g.,. start Pump "X"). For a large number of failure modes, however, no analogous specific operations were provided to directly verify component successes,' and the number of corresponding actual component tests was determined.through a combined analysis of the testing procedure, noting the success criteria and monitored parameters specified, and the applicable system piping and instrumentation diagram's, with flowpath configu-rations altered,. if necessary, nas they are affected by the testing procedure.
Successful component tests were counted only if:
(1) the testing procedure provided direct evidence of' successful operation or an unfailed state of the component and (2) a failure of the component would have resulted in an*
- ur successful test which would have been reportable as an LER.
As an example of this methodology of test data synthesis, consider the component failure mode " manual ~ valve transfers closed". ' Referring to the example piping diagram shown'in Figure 1, a system flow test is performed to verity the
-5
t 4
operability of Pump X by closing motor operated Valve A and running the pump on recirculation flow.
Successful performance of the test requires that the pump start and that adequate flow be observed at flow gauge F.
This test, in addition to verifying Pump X operability to start and run, provides the following test data information:
e The piping from the suction source through the recirculation line is not plugged.
'e Check Valve C opens successfully.
e Manual Valves M1, M2 and M3 are open.
The test does not provide any information regarding the status of motch i
operated valva A or manual valve M4, since they are not included in the test flowpath.
(Excessive leakage through A could be detected if a ficwpath was available downstream from A, if Valve M4 had not failed closed, and if the leakage were sufficient to degrade the flow through F.
However, this failure of A would not be detected if Valve M4 had also failed, and since this test
-cannot detect this failure of M4, these valves are not included in the success data.)
This general process was applied to all of the systems analyzed in this study during all periodic testing and normal operating configurations to develop the successful testing data to be combined with these (generally passive) component failure modes.
In all such cases, the application of this methodology is specifically referenced in the data surma-ies for the applicable component failure modes.
2.3 CCMPONENT SERVICE HOURS DATA SYNTHESIS The service hours data reported in the component failure mode data summaries was developed through the analysis of the following three general states of operability verification:
o Components whose operability is monitored continuously due to normal plant operating conditions.
e components whose operability is verified during periodic testing and whose state does not change between tests.
e components whose operability is verified only over the duration of the periodic tests.
For those components in continuous service during normal plant operation, the only periods of time' included in the service hours are those during which failure of the component would be reportable as an LER (e.g., if Pump "X".-is normally running during all modes of unit operation, and the Technical Specifications require its failure to be reported during non-cold-shutdown periods only, the cold shutdown running hours are excluded from the pump' service hours data.) For those components whose state remains unchanged
- between periodic tests, the service hours include only the periods between l
6 4
such tests during which the component failure would.he reportable as an
- LER, (e.g., Valve "Y" is verified open during a quarterly system flow test as described in Section 2.2, and a failure of the subsystem of which "Y"
is a portion is required to be reported only during non-cold-shutdown periods.
If the unit is placed in cold shutdown for one month between quarterly tests, the total service period applied to "Y" during that quarter is only two months, since a failure detected during the cold shutdown month - by any method - would not be reported, and since a system operability verification test required to be performed prior to leaving cold shutdown establishes "Y"'s operability for the remainder of the period.)
For those components whose operability is verifiable only during the periodic tests, the service hours include only the - applicable test operating times -(e.g., if Pump "Z" is operated only during a monthly flow test, the service hours applied to the pump failure mode " fails during operation" include only the actual pump monthly operating hours.)
In all cases, the criteria used to establish the component service hours data for the specific failure mode reported are documented with the failure mode data summaries in Section 5.
7
\\
i
' t
(-
l TABLE 1.~
ZION UNIT 1 COLD SHUTDOWN PERIODS (1973-1979)
Date Reason for Shutdown 1973:
'1/1 - 6/19
-Prior to Initial Criticality 8/2 - '8/11 8/30'-
9/9
. Reactor' Coolant Leakage j
9/21 - 10/1 Main Steam Check valve Inspection.
l 10/21 - 10/30 Main Steam Check Valve Inspection l-12/9 - 12/31 Main Generator Repair 1974:-
1/1 - 4/13 Main Generator Repair 5/25 - 6/3
-Main Steam Check Valve Replacement 8/26 - 9/7 Pressurizer' Spray' Valve Leak 1975:
2/25 -~ 3/28 - Steam Generator Chemistry Control Modifications 5/24 - 6/5 Reactor Coolant Pump Seal Inspection 6/6 7/10 IA Reactor Coolant Pump Motor l
9/19 - 9/25 Reactor Coolant Isolation Valve Inspection 1976:
3/5 - 5/26-Refueling Outage 6/4 6/18 9/25 - 10/21 Feedwater Hanger Replacement l
l 1977:
9/9 - 11/30 Refueling Outage -
1978:
3/31 - 4/2 Bit Recirc. Line Replacement 5/28 - 6/1 Stemn Generator Ebot Valves Replacement 9/14 - 10/28
_ Refueling Outage 1979:
3/28~-- 4/3 Maintenance Outage j
6/8 - 6/16.
Maintenance Outage i
~
j 10/6 - 12/31 Refueling.and Feedwater Nozzle Repair i.
. 8' t
h g---w-
,-,---w
-1 4
- Y TABLE 2.
ZION UNIT 2 COLD SHUTDOWN PERIODS (1973-1979)
-Date Reason for Shutdown 1973:
.1/1 - 12/24 Prior to Initial Startup-12/26 - 12/31 -Maintenance Outage 1974:
1/1 1/5.
Maintenance Outage 1/16 - 2/12 3/2 - 3/13 Main Steam Check Valve Inspection 4/5 4/16 Reactor Coolant Leakage 4/17 - 8/20 Main Generator Repair 10/12 - 10/21 Maintenance Outage 10/22 - 10/30 11/28 - 12/14 Steam Generator Chemistry Control Modifications 12/16 - 12/31 1975:
1/1 1/9 2/15 2/7 2/17 - 2/24 3/19 - 3/24 Condenser Tube Leaks 4/5 - 4/15 condenser Tube Leaks 6/6 6/30 Reactor Coolant Pu.mp and Condenser Repairs 8/30 - 9/22 Reactor Coolant ~ Loop Isolation Valve 1976:
1/16 - 2/15 Steam Generator Inspection 4/1 - 4/12 Turbine Bearing Replacement 4/12 - 5/9 Turbine Bearing Replacement 6/11 Reactor Coolant Pump Seal Repair 6/1
.8/8
' 8/13-9/19 - 10/27
'2A' Diesel Eenerator Replacement 1977:
1/7 - 3/24 Refueling Outage 1978:
2/4
. 4/9-Refueling Outage 2/13' 'High Steam Generator Conductivity 1979:
2/9
- 3/10 - '4/16' Refueling Outage 10/27 - 12/31 Feedwater. Nozzle Repair
-l 1
1
TABLE 3.
ZION UNITS.1-& 2 COMPONENT. PERIODIC TESTS (1973-1979)
I Unit 1 Periodic Tests Number of Tests l
Testir.g Frequency Performed in Study Period Monthly
- 67 i'
Quarterly **
25
[
Annually 7
l=
Refueling 4
Unit 2 Periodic Tests l
Number of Tests Testing Frequency Performed in Study Period Monthly
- 61 Quarterly **
23 i
Annually 6
Refueling 3
i
- During power operation i
- During any calendar quarter in which the unit was not in continuous l
cold shutdown.
L l
f2 l
-10 7
3-L-
m -. _
,.}
~
4 t
~
'O e
r
~
TO
>. RECIRC FLOW F
- MANUAL VALVE M3 w
H 3
CHECK-VALVE C SUPPLY I
rI e
VE 1 MOV MANUA L MANUAL
.{
( SUCTION FROM A
VALVE M4 VALVE M2 PUMP X i
FIGURE 1.
FLOW TEST DATA EXAMPLE SYSTEM t
i m.
g i
l
.3. COMPONENT FAILURE MODE DEFINITION In most cases, the specific component failure mode of interest in
(-
this study has been defined by the type of component and its function within l
the system being analyzed (e.g., " check valve fails. to open").
In some
!~
cases, however, the reported failure modes have been defined through a com-l' bination'of influences including.the level'of detail to which the systems are modeled in the fault tree analyses and the level of detail for which the l
corresponding generic failure data distributions are available.
i In principle, the site-specific failure data should be traceable to not only a specific component, but also to-a sub-component and a "sub-failure" l
level (e.g., Check valve "X" failsd to open because 3/4" bolt "A" became j
corroded-due to interaction with caustic solution "Q"
... etc.).
Howe,ver, j
the ' system fault trees are not developed to this level of detail, since this microscopic analysis generally results in an actual reduction in the i
overall understanding of the relevant system failure modes and dominant failure contributors and focuses attention rather on a narrewly defined analysis of aggregates of individual sub-componente.
It must also be recognized that,.in the majority of cases, the actual data is nct as well-i defined at this microsecpic level of detail as it is at the macroscopic l
' bolt corrosion or because of hinge pin swelling, but it did fail to open).
component level (e.g., the check valve may have failed to open because of L
Thus, the actual state of knowledge of component failures is often most clearly defined only for an aggregate of sub-component failure modes which are manifested in an cbservable, verifiable and simply documentable effect.
In addition, as a~ practical :ensideration, in most cases the generic data distributions to be specialized with the site-specific failure data are not available in the literature at the level of detail which can be generated from the site-specific failure data sources.
In most of these cases, similar component types and failure modes have been combined in the site-specific data base to provide consistency and~ compatibility between these two data sources.
l f
Specific examples of items for which the site-specific component failure mode definition has been strongly influenced by the available level
- of_ generic data include e
Motor operated _ valves failure to operate on demand. The generic data distribution for motor operated valve cetive failures is best defined.for the failure mcde " fail to operate",
which includes the failure modes " fail to open" and " fail to
(-
.close".. Because we cannot discern the precise contributions of each of these modes to the generic data and because both of these failure modes actually define.a failure of the' valve to change states upon demand, the site-specific data available for these detailed failure modes hac ret 03mbined into the i
single " fail to operate" mode.
(In this case, although a test which fully cycles a valve open-closed-open strictly constitutes one test each of the failure modes " fail to close"~and " fail to open", because either of.these failures.would'be reported as a " failure to operate" and because only one failure would be reported for the: test, the entire cyclic test is conservatively counted as a single test of: the valve failure mode " fail to oper-
' ate".)
I 12
'l 4<
A l
l l
e Motor operated valves and manual valves transfer closed. Because l
the failure causes are physically sbmilar for motor operated valves and manual valves (no evidence is available fram the site-specific i
data to indicate that spurious operation of the motor operator l
contributes significantly to differences between the two valve l
types), and because only a single generic distribution is available F
for this failure mode, manual valves and motor operated valves are combined into a single component category for this failure mode.
(Air operated valves are documented separately, however, due to their identifiable failure causes being physically different from those associated with manual and motor operated valves.)
e Power supply circuit breakers, 31ectrical and mechanical controls, motors, pump shafts, and other pump mechanical components are combined-into a single component defined as a " pump", since the generic failure data does not differentiate among failures uniquely attributable to each of these sub-cc=ponent categories.
l Thus, a pump failure to start could be due to a circuit breaker failure, low oil pressure or a ruptured shaft, but each of these failures would be categorized simply as a failure of the pump to t
start.
The component failure mode data reported for motor driven pumps deserves special attention because of the fact that these pumps are combined for one l
type of failure mode, but are retained as independent components for another j
failure mode. All motor driven centrifucal pumps analyzed in this study, with the exception of the motor driven Auxiliary Feedwater pumps, are combined in the development of a single "failura to start" failure mode, since only a single well-defined generic distribution is available for this failure mode and-since the observed starting failure causes for all but the Auxiliary Feed-water pumps are physically identical (e.g., circuit breaker failures, control circuit failures, contact failures, etc.). The data base for this specific failure mode.thus does not differentiate betueen motor driven pumps in systems other than the Auxiliary Feedwater system because all of these other motor driven pumps, as s group, exhibit the same failure characteristics on starting. However, *ven though only a single generic distribution is avail-able for the failure of motor driven pumps during operation, the motor driven pumps in each of the systems analyzed in this study exhibit unique operating characteristics attributable to such factors as their design, orientation, physical location and normal operating duty. Therefore, the failure data base has been defined independently for each of these pump types during pump
' operating periods in order to take credit for and provide full acknowledge-ment of these physical' differences (e.g., a large vertical shaft pump under continuous service will exhibit significantly different operating failures from a horizontal pump-located in an adverre environment and subjected to.
only. intermittent starts). By specializing the single generic distribution for pump failure data (which essentially indicates a relatively diffuse prior state of knewledge with respect to differences between the pumps)
I with the. individual pump site-specific-failure rate information, these physically observable differences are thus retained as uniquely identifiable contributors to each pump's availability during operation.
13
,7 w
4 DATA BASE APPLICABILITY In general, tl.e site-specific data presented in this data base is strictly defined or
- within the context of its use in this study. Because of the limitations inherent in the use of component failure data from the LERs, the data base development methodology used in this study has applied specific criteria to the synthesis of both failure and success data in order to produce a self-consistent, realistic, conservative presentation of the available state of knowledge of component hardware failure rates as they are chserved at Zion Units 1 and 2.
Although the consistent application of our methodology provides a basis for the comparison of the Zion data with that reported for the other plants anayl:ed in this stady, such a comparison is possible only within the specific framework of our analysis and is not directly adaptable to other applications.
14
4 1 -
4 5 PLANT-SPECIFIC COMPONENT FAILURE MODE DATA SUMMARIES Component Type Failure Mode Page Manual Valves Transfer closed 17 r
Check, Valves Fail to open 18 Fail to seat
'19 Relief / Safety Valves 1 Premature opening 20 Motor Operated Valves,
' Failure to operate 21 except CVCS and CS Chemical and Volume Control-Failure to operate 22 System Motor Operated Valves Containment Spray System Failure to operate 23 Motor Operated Valves Motor Operated Valves Transfer closed 24-Transfer open 25 Air Operated Valves Failure to operate 26 Transfer closed 27
. Pumps-Motor Driven, except Failure to start 28 Auxiliary Feedwater Motor Driven Auxiliary Failure to start, 29 Feedwater Pumps Turbine Driven Auxiliary.
Failure to start 30 Feedwater Pumps Diesel ~ Driven Containment.
Failure to start 31 Spray Pumps-Safety Injection' Pumps.
Fail.during operation 32 Residual Heat Removal-Pumps Fail during operation 33
~
Centrifugal Charging Pumps Fail during operation 34-Component Cooling Pumps rail during operation 35 ~
'. Service Water Pumps Fail during operation-36
' Motor. Driven Containment:-
Fail during operat' ion 37 Spray Pumps
-15 1
J
4 Component Type Failure Mode Page Diesel Driven Containment Fail during operation 38 Spray Pumps Motor Driven Auxiliary Fail during operation 39 Feedwater Pumps 40 Turbine Driven Auxiliary Fail during operation Feedwater Pumps Containment Fan Coolers Failure to start 41 Fail during operation 4'2 Containment Fan Cooler Failure to transfer 43 Dampers 44
!! cat Exchangers Rupture Plugged - tube side 45 Plugged - shell side 46 Diesel Generators Failure to start 47, 48, 49 Fail during operation 50 Dus Feed Circuit Breakers Fail to close 51 Fail to open 52 Transfer open 53 AC Power Tra?.isformers Fail during operation 54 Instrument Bus Inverters Fail during operation 55 DC Power Batteries Fail during operation 56 Battery Chargers Fail during operation 57 16 4
s
F
=
W Component Typer MANUAL VALVES
~
Failure Mode Transfer Closed e
Total Component Service Hours in Period: 7.87 x 106 Basis: Data base includes service hours for valves verified to be open by actual fluid flow through valve during periodic test or normal operation. Standby system valves remaining open between flow tests are included for the duration of the intertest periods, since performance of tne test would detect failure. Service hours exclude periods during which failure would not be reportable or during which actual flow verification was not required (e.g., cold shutdown periods for several systems).
e Failure Data for Given Failure Mode: No failures reported.
e Test Data Source: Test review and unit operating status summary.
e' Failure Data Source: LERs 17
I i
te l
l l
Componen' J : CHECK VALVES l
Failure Mode: Failure to Open on Demand l
l l
e Test Data: Number of Tests Per Month:
54 Quarter:
0 Year:
0 Refueling:
8 Total Number of Tests in Period: 6,968 e
Failure Data for Given Failure Mode: No failures reported.
I e
Test Data Source: Test review.
e Failure Data Source: LERs l
l l
l I
i I
i W
l l
.' 18 p-y.
m W
Component Type: CHECK VALVES Failure Moder Failure to Seat / Excessive Reverse Leakage e
Total Component Service Hours in Period: 6.08 x 105 Basis: Data Base includes service hours during which valves are verified to remain closed through perodic system flow testing or normal operation, and. includes only those periods during which the valves are subjected to pressure or flow conditions. Valves whose failure during normal operation would not result in reportable system degradation are excluded from the data base.
e Failure Data for Given Failure Mode No failures reported, o
Test Data Source: Test review and unit operating status suminary.
e Failure Data Source: LERs 19 4
O
%F t
l l
Component Type: RELIEF / SAFETY. VALVES Failure Modes-Premature Opening or Leakage e
Total Component Service Hours in Period: 6.19 x 105 Basis: Data base includes service hours for valves of shnilar l
type to those in systems analyzed in this study and whose l
failures would be reportable under normal system operating con-l ditions. Valve service hours during periods for which failure would not result in reportable system degradation or reportable corrective actions are excluded from the data base. The specific valves included in the data base are e
Accumulator Relief Valves e
Letdown Relief Valve e
RHR Pumps Suction Relief Valve j
e RHR Pumps Discharge Relief Valves e
Charging Pumps Suction Relief Valve l
e Failure Data for Given Failure Mode l
l I
l l
Date Reported Failure Cause 6/6/75 Letdown Relief Valve IVC 8117 Unspecified 10/6/76 RHR System Relief Valve Unspecified l
l e
Test Data Source: System drawings and unit operating status
[
summary.
e Failure Data Sources LERs 20 4
O Component Type MOTOR-OPERATED VALVES, EXCEPT CONTAINMENT SPRAY AND
~
CHEMICAL AND VOLUME AND CONTROL Failure Mode Failure to Operate on Demand e
Test Data: Number of Tests Per Month:
56 Quarter:
79 Year:
0 Refueling:
50 Total Nug.ber of Tests in Period: 11,310 e
Failure Data for Given Failure Mode Date Reported Failure Cause 8/19/74 LMOV-SI8803B Limitorque setting too low 1/26/77 1MOV-SI8808A Auxiliary contacts stuck 1/28/77
.lMOV-SI8808B Auxiliary contacts stuck 1/28/77 1MOV-SI8808C Auxiliary contacts stuck 4/21/78 LMOV-RH8700B Thermal overload tripped 2/16/74 2MOV-SWO102 Torque setting too low 8/29/74 2MOV-8I8803B Dirty contacts on control switch 10/22/74 2MOV-8I8803B Unspecified 2/13/76 2MOV-SI8923B Dirty auxiliary contacts 11/27/76 2MOV-SI8801B Stem binding S/19/77 2MOV-SI8800D Limitorque operator failure 6/4/77 2MOV-RH8700B Auxiliary contacts stuck 7/18/79 2MOV-SI8811A Failure of limit interlock 8/17/77 2MOV-RH8700B Limit switch failure a
e Test Data Sources. Test review.
e Failure Data Source: LERs 21 h -
r
~
t i
O Component Type: CHEMICAL AND VOLUME CONTROL SYSTEM MOTOR-OPERATED VALVES Failure Modes Failure to Operate on Demand e
, Test Data Number of Tests Per Month:
10 Quarter:
8 Year:
0 Refueling:
8 Total N'32ber of Tests in Period: 1,720 e
' Failure Data for Given Failure Mode:
Date Reported Failure Cause 04/10/74 1MOV-VC8106 Packing binding 12/08/77 1MOV-VC8106 Packing binding 08/19/74 2MOV-VC8106 Stem binding 02/13/76 2MOV-VC8106 Dirty contacts at MCC 05/20/77 2MOV-VC8111 Torque setting too low 09/05/78 2MOV-VC8105 Limitorque operator jammed 09/06/78 2MOV-VCll2E Unspecified Test Data Source: Test review.
e 4
e Failure Data Source: LERs j
22-
O
'a t'
.O Component Types CONTAINMENT SPRAY SYSTEM MOTOR-OPERATED VALVES Failure Modes -Failure to Operate on Demand e
Test Data Number of Tests Per Month:
9 Quarter:
9 Year:
0 Refueling:
9 Total Number of Tests in Period: 1,647 e
Failure Data for Given Failure Mode:
Date Reported Failure Cause 12/03/74 1MOV-CS0005 Stem binding 01/03/75 LHOV-CS0005 Stem binding
'09/14/76 LMOV-CS0005 Stem binding 01/21/77 1MOV-CS0002 -
Stem binding 11/11/73 1MOV-CS0009 Unspecified 10/27/74 IMOV-CS0002 Loose contacts at torque switch 05/03/78 1MOV-CS0002 Stem binding 10/22/75 2MOV-CS0002 Torque setting too low 10/23/75:
2MOV-CS0006 Torque setting too low 03/31/74 2MOV-CS0004 Unspecified e
Test Data Source: Test review.
e Failure Data Source: LERs 23 e
b/
l
~
r O
l l
Component Type: MOTOR-OPERATED VALVES Failure Mode: Transfer Closed e
Total Component Service Hours in Period: 3.22 x 106 Basis: Data base includes service hours for valves verified to be open by actual fluid-flow through valve during periodic test or normal operation. Standby system valves remaining open between flow tests are included for the duration of the intertest periods, since performance of the test would detect failure. Service hours exclude periods during which fal*ure 1
would not-be reportable or during which actual flow verification was not required (e.g., cold shutdown periods for several systems).
e Failute Data for Given Failure Mode: No failures reported.
l'-
e Test Data Source: ' Test review and unit operating status summary.
i j
e-Failure Data Source: LERs 24 r
'O.
4 Component Type: ilOTOR-OPERATED VALVES Failure Mode: Transfer Oren/ Excessive Leakage Through Valve e
Total Component Service Hours in Period: 6.95 x 105 Basis: Data base includes service hours during which valves are verified to remain closed through periodic system flow testing or normal operation, and includes only those periods during which the valves are subjected to pressure or flow conditions (e.g., valves closed for a flow test and reopened after the test is completed are included only for the duration of the flow test). Valves whose failure during normal operation would not result in reportable system degradation are.
excluded from the data base.
e Failure Data for Given Failure Mode: No failures reported.
l
)
e Test Data Sources Test review and operating status summary.
e Failure Data Source: LERs
-25
a Component Type: AIR OPERATED VALVES-
-Failure Mode: Failure to Operate on Demand e-
. Test Datar. Number of Tests Per Month:
5 Quarter:
17 Year:
0 Refueling:
12 Total Number of Tests in Period: 1,540 i
e Failure Data for Given Failure Modes i
I f
Date Reported Failure Cause 01/07/76 1AOV-SI8880 Internal Galling 05/18/76 1AOV-SI8880 Internal Galling 09/16/76 1AOV-SI8875B Unspecified I
1 l
l i
l l
l i
i e
-Test Data Source: Test review.
l e
Failure Data Source: LERs
'il i_
26
s 9
Component Type: AIR-OPERATED VALVES Failure Mode: Transfer Closed (mechanical failures other than those due to air pressure variations) e Total Component Service Hours in Period:
2.13 x 106 Basis: Data base includes service hours for valves verified to be open by actual fluid flow through valve during periodic test or normal operation. Standby system valves remaining open-between flow tests are included for the duration of the intertest periods, since performance of the test would detect failure. Service hours exclude periods during which failure would not be reportable or during which actual flow verification was not required (e.g., cold shutdown periods for several systems).
e Failure Data for Given Failure Mode: No failures reported.
e Test Data Source: Testreviewandunitoperatingstakus summary.
e Failure Data Source: 'LERs 27
1
- Component Type: PUMPS - MOTOR DRIVEN, EXCEPT AUXILIARY FEEDWATER-Failure Modq-Failure to Start on Demand
~
s' Test Data': -Number of Tests Per Month:
14 Quarter:
26 Year:
0 Refueling:
14 Total Number of Tests in Period:
3138 e
Failure Data for Given Failure Mode:
Date' Reported Failure Cause 09/10/73 1B Charging Pump-Breaker Malfunction 04/29/78 1A Servic,e Water Pump Dirty Contacts 10/08/78 2B Service Water Pump Breaker Failure e
Test Data Source: Test Review.
e Failure Data Source: LERs i.
9 1
e 28
.)
H
Component Type: MOTOR-DRIVEN AUXILIARY FEEDWATER PUMPS Failure Mode: Failure to Start on Demand e
Test Data: Number of Tests Per Month:
2 Quarter:
4 Year O
3 Refueling:
2 a
Total Number of Tests in Period: 462 e
Failure Data for Given Failure Modes bate Reported Failure Cause 09/19/74 1C Auxiliary Feedwater Pump Pump internals damaged 09/25/79 1C Auxiliary Feedwater Pump Unspecified 03/12/74 2B Auxiliary Feedwater Pump Low oil pressure 12/07/77 2B Auxiliary Feedwater Pump Unspecified 4
4 4
I e
Test Data Source: Test review.
j.
e Failure Data Source: LERs 4
1 29
.= -
.-Component Type: TURBINE-DRIVEN AUXILIARY FEEDWATER PUMPS JFailure Mode: Failure to Start on Demand e
Test Data: Number of Tests Per Month:
1 Quarter:
2 Year:
0 Refueling:
1 Total Number of Tests in Period: 231 (119 Tests for Unit 1, 112 Tests for Unit 2) e Failure Data for Given Failure Mode:**
- It is noteworthy that all of the LER reported failures to start of the
. turbine-driven auxiliary feedwater pumps are attributable to the 1A pump.
(The number of tests performed for each unit is summarized in the test data in order to develop pump-specific failure rates for the two pumps.)
Data base also excludes failure of lA Auxiliary Feedwater Pump reported on 7/11/74 due to failure caused by human error, since the data base is developed for hardware failures only.
Date Reported Failure Cause 05/14/74 1A' Auxiliary Feedwater Pump Trip valve closed 06/06/74 1A Auxiliary Feedwater Pump Trip valve closed 03/05/76 1A Auxiliary.Feedwater Pump Turbine waterbound 08/08/76 1A Auxiliary Feedwater' Pump Overspeed due to sticky governor 12/03/77 1A Auxiliary Feedwater Pump Steam' control solenoid valve 12/08/77 1A Auxiliary Feedwater Pump Steam control solenoid valve e
Test Data Source: Test review.
e Failure Data Source: LERs 30 2
4 -
Component Type: DIESEL-DRIVEN CONTAINMENT SPRAY PUMPS Failure Mode:. Failure to Start on Demand e
Test Data: Number of Tests Per Month:
1 Quarter:
-l*
Year:
0 Refueling:
1 Total Number of Tests in Period: 183
- 0ne. start per quarter is included with the monthly test data, since the
^
monthly test is normally performed in conjunction with the quarterly test.
e Failure Data for Given Failure Mode:
Date Reported Failure Cause 08/25/75-IC. Containment Spray Pump Low starting battery voltage i
i t
I o
Test Data Source: Test review.
o Failure Data Scurce: LERs 1
i f
31 e
Component Type SAFETY INJECTION PUMPS Failure Mode: Fail During Operation e
Total Component Service Hours in Period: 46 Basis: Since the operation of these pumps is formally documented only during periodic operability verification tests, the pump service hours include only pump operating times during these tests. The pumps may be operated sporadically for the performance of auxiliary functions during normal plant operation, but these operating times are documented only in control room logs, and are, therefore, difficult to verify.
e Failure Data for Given Failure Mode: No failures reported l
l e
Test Data Source: Test review.
e Failure Data Source: LERs i
32 i
s Component Type: kESIDUAL HEAT REMOVAL PUMPS Failurm Modet ~ Fail'During. Operation e
Total-Component Service Hours in Period:
3.25 x 104 Basis: Since one Residual Heat Removal pump is required to remain in operation during all periods of cold shutdown, and since failure of the operating pump during these periods should Rbe reported, the data base includes the service hours for these l
pumps during periodic operability verification testing and cold l
shutdown operating periods.
l~
e Failure Data for Given Failure Mode: No failures reported.
e Test Data Source: ~ Test review and unit operating status
- summary, e
Failure Data Source: LERs
~33
4 s
Component Type: CENTRIFUGAL CHARGING PUMPS
- t Failure Moder Fail During Operation e
Total Component Service Hours in Period:
7.60 x 104 Basis: Although.the charging system is normally in service under all plant operating conditions, the service hours for these pumps include one pump operating continuously during non-cold shutdown periods only, since failures of these pumps would be reported only during these periods.
h o
Failure Data for Given' Failure Mode: No failures reported.
e Test Data Sourner Test review and unit operating status summary.
e-Failure Data Source: LERs 34-
-Component Type: COMPONENT COOLING PUMP-Failure Mode: Fail During Operation e'
Total Component Service Hours in Period:
7.60 x 104 Basis: ' Although the Component Cooling system is normally in service under all plant operating conditions, the service hours for these pumps include one pump per unit operating continuously during non-cold shutdown periods only, since
' failures of these pumps would be reported only during these periods.
e
-Failure Data for Given Failure Mode: No failures reported.
e.
Test Data Source: Test review and unit op'*ating status summary.
e Failure Data Source: LERs 35
Component Type SERVICE WATER PUMPS Failure Mode: Fail'During Operation e
Total' Component Service Hours in Period: 1.52 x 105 Basis: Although tne Service Water system is normally in service under all plant operating conditions, the service hours for these pumps include two pumps per unit operating continuously during non-cold-shutdown periods only, since failure of these pumps would be rep'rted only duringLthese periods.
e Failure Data for Given Failure Mode: No failures reported.
e Test Data Source: Test review and unit operating status summary.
e Failure Data Source: LERs
'36
Component Tyoe MOTOR-DRIVEN CONTAINMENT SPRAY PUMPS Failure Mode Fall During Operation e
Total Component Service Hours in Period: 66 Basis: Since the operation of these pumps is formally documented only during peridic operability verification tests, the pump service hours include only pump operating times during-these tests.
e Failure Data for Given Failure Mode: No failures reported.
l J
l e
Test. Data Source: Test review.
e Failure Data Source: LERs 37
Component Type: DIESEL-DRIVEN CONTAINMENT SPRAY PUMPS Failure Mode: Fail During Operation 4
J e
Total Component Service Hours in Period:
33 Basis: Since the' operation of these pumps is formally
-documented only during periodic operability verification tests, the pump service hours include only pump operating time during these tests.
4 e
Failure Data for Given Failure Mode:
Date Reported Failure Cause 12/26/78 1C Containment Spray Pump Cooling water hose failure 11/08/78 2C Containment Spray Pump Cooling water hose failure Test! Data Source s - Test review.
e e-Failure Data Source: 'LERs
- 1
~
38
l Component Type: MOTOR-DRIVEN AUXILIARY FEEDWATER PUMPS Failure Mode: Fail During Operation e
Total Component Service Hours in Period: 3,800
' Basis: Since the Auxiliary Feedwater system is normally in service during all periods of hot shutdown, the service hours for these pumps include one motor driven pump operating continuously during all hot shutdown period hours. The number of hours in hot shutdown was estimated from a review of the station power history summaries, but no detailed compilation of the precise number of hot shutdown hours was performed.
o Failure Data for Given Failure Mode:
Date Reported Failure Cause 8/8/76 1C Auxiliary Feedwater Pump Plugged Suction Strainer e
Test Data Source: Test review and unit operating status
- summary, i
e Failure Data Source: LERs l
l l
39 i
i e--
T
Component Type: TURBINE-DRIVEN AUXILIARY FEEDWATER PUMP Failure Mode Fail During Operation e
Total'Compone.it Service Hours in Period: 1,900 Basis: Since the turbine-driven Auxiliary Feedwater pump is generally operated in conjunction with a motor driven pump only during'startup and shutdown transients (due to the need for additional feedwater flow during these periods and due to its steam demand), the service hours for these pumps include approximately one half of the total hot shutdown period hours.
The number of hours in hot shutdown was estimated from a review of the station power history summaries, but no detailed compilation of the precise number of hot shutdown hours was performed.
o Failure Eeta for Given Failure Mode: No failures reported.
~
e Test Data Source: Test review and unit operating status
- summary, e
Failure Data Source: LERs l
l 40
Component Type: CONTAINMENT FAN COOLERS l
Failure Mode Failure to Start on Demand (Low Speed) e Test Data ' Number.of Tests Per Month:
5 Quarter:
10-Year:
0 Refueling:
5 Total Nunber of Tests in Period: 1,155 l
e Failure Data for Given Failure Mode:
Date Reported Failure Cause 07/20/74 1C Fan Cooler Dirty contacts 09/14/78 1C Fan Cooler Dirty contacts l
l I
l e
Test Data Source: Test Review.
f e
Failure Data Source: LERs
(
i l-5 g'
- 41
1 I
l I
Component Type: CONTAINMENT FAN COOLERS
. Failure Modes Fail During Operation e
Total Component Service Hours in Period:
1.52 x.105 i
I Basis: Although the Fan. Coolers are normally in service under l
all plant conditions, the service hours for these units include two fan coolers per unit operating continuously during non-cold shutdown periods only, since failures of these units would be reported only during these periods. Although the operating times used here apply strictly to operation at high speed under normal environmental conditions, motor, fan, bearing and other i
operational failures would be observed under these conditions and would be reported due to their impact upon fan cooler l
operability.
I e
Failure Data for Given Failure Mode: No failures reported.
l l
l l
e Test Data Source: Test review and unit operating status summary.
Failure Data' Source: LERs e
l v
s v
t a
b
-. 4-42 p
. ~..
i Component Type: CONTAINMENT FAN COOLER DAMPERS Failure Mode: Failure to Transfer to Accident Mode Positions e-
' Test Data: Number of Tests Per Month:
5
. Quarter:
10 Year:
0 Refueling:
5
' Total Number of Tests in Period: 1,155 Failure Data for Given Failure Mode:*
e Date Reported Failure Cause 08/25/75 One Set of Damp.ars (Uni. 1)
Sticking Actuators 09/23/76 One Set of Dampers (Unit 1)
Sticking Actuators 09/14/78 ;lB Fan Cooler Dampers Mechanical Binding
- Data base excludes failure of "some dampers" reported on 8/15/74 for Unit 2 due to failure caused by corrected installation error (poor actuator orientation).
e Test Data Source: Test review.
e Failure Data Source: LERs s
1 43
l.
l l
l Component Type: HEAT EXCHANGERS i
Failure Modet. Rupture / Excessive Leakage e
Total Component Service Hours in Period:
2.68 x 105 Basis: Data base includes service hours for all three Component Cooling heat exchangers when neither unit was in cold shutdown, both Residual Heat Removal heat exchangers per unit j
during non-cold shutdown periods, and one Residual Heat Removal heat exchanger per unit during cold shutdown periods, since leakage or rupture-of these heat exchangers would be detectable and reportable during-these operating periods.
e Failure Data for Given Failure Mode: No failures reported.
I l
l e
Test Data Source: Unit operating status summary.
e Failure Data Source: Lens 44
Component Type HEAT EXCHANGERS Failure Mode Plugged - Tube Side e
Total Component Service Hours in Period: 1.16 x 105 Basis: Data base includes. service hours for all Component Cooling heat exchangers when neither unit was in cold shutdown and one Residual Heat Removal heat exchanger per unit during cold shutdown and periodic testing periods, since plugging of these heat exchangers would be detectable and reportable during these operating periods.
i.
e Failure. Data for Given Failure Mode: No failures reported.
4 5
4 I
l i
e Test Data: Source: Unit operating status summary.
)
's Failure Data Source: LERs I
\\
l l
.i>
_g.
45 l
l
~
~
I I
l Component Type: HEAT EXCHANGERS Failure Mode Plugged - Shell Side l
Total' Component Service Hours in Period: 1.16 x 105 l
e l
Basis: Data base includes service hours for all Component l
Cooling heat exchangers when neither unit was in cold shutdown j
and one Residual Heat. Removal heat exchanger per unit during i
cold shutdown and periodic testing periods, since plugging of these heat exchangers would be detectable.and reportable during
-these operating periods, i
l i
I e
Failure Data for Given Failure Mode: No failures reported.
l' 1
s e
Test Data Source: Unit operating status summary.
e Failure Data Source: LERs.
461 s
1
~
Component Type: DIESEL GENERATORS (sheet 1 of 3)
~
Failure Mode: Failure to Start on Demand e
Test Data: Number of Tests Per Month:
2.5*
Quarter:
6*
Year:
0 Refueling:
6 *.
Total Number of Tests in Pericd: 1693*
e Failure Data for Given Failure Mode:**
Date Reported Failure
.Cause 08/17/73 Diesel Generator O Trip Setting Too High 10/08/73 Diesel Generator LA Governor Speed Sensor Failure 10/08/73 Diesel Generator 1B Turbocharger Oil Pressure Low 07/16/74 Diesel Generator 1B Voltage Regulator Terminal Loose
-07/18/74 Diesel-Generator 1B Dirty Contacts on Voltage Regulator 07/22/74 Diesel Generator 13 Voltage Regulator Relay Failure 01/18/75. Diesel Generator 1B Generator Exciter Grounded 08/11/75 Diesel Generator lA Water Leaking into Oil System 09/24/76 Diesel Generator 0 Unspecified 01/03/78 Diesel Generator 1B Defective Solder Joint 01/16/78 Diesel Generator LA Water Leaking into Oil System 07/17/78 Diesel Generator lA.
Water Leating into Oil System 08/01/78 Diesel Generator 1B Starting Air Valve Leak
- 09/14/78 Diesel' Generator lA Lube Oil Pressure Relay Failure 12/05/78 Diesel Generator 1B Control Air Leak 03/07/79-Diesel-Generator 1B.
Overspeed Trip Setpoint Drift
..i 47 4
Component Type: DIESEL GENERATORS (sheet 2 of 3)
Faiiure Mode: Failure to Start on Demand I
Date Reported Failure Cause 09/18/74 Diesel Generator 2A Unspecified 11/26/74 Diesel Generator 2A Control Air Leak 01/14/75 Diesel Generator 2B Vibration Trip Switch Failure 01/13/75 Diesel Generator 0 Unspecified 05/07/75 Diesel Generator 2A Control Air Leak 4
06/10/75 Diesel Generator 2B Air Driven Fuel Pump Failure 04/27/77 Diesel Generator 2B Governor Jammed 11/10/77 Diesel Generator 0 Water Leaking into Oil System 11/17/77 Diesel Generator 0 Control Air Leak F
01/06/78 Diesel Generator 2A Voltage Regulator Relay Failure 01/09/78 Diesel Generator 2B Governor Jammed 05/17/78 Diesel Generator 2A Voltage Regulator Drift 03/10/79 Liesel Generator 2A Voltage Regulator Amplifier 08/06/79 Diesel Generator 2B Governor Oil Leak e
Test Data Source: Test review and maintenance history summary e
Failure Data Source: LERs
- Diesel Generator O'is started only once per month and is loaded into each Unit's 4KV bus during this single run.
It is started separately from each Unit's safeguards logic during quarterly and refueling safeguards systems testing.
Since the Technical Specifications require immediate and daily operability verification for the redundant diesel generators whenever one 1
48
- 1 4
s Component Type: DIESEL GEN 2RATORS (sheet 3 of 3)
Failure Mode: Failure to Start on Demand diesel generator is removed from service for maintenance, station l
maintenance records were reviewed to determine the number of additional i
diesel generator starts for these verifications during the period from September 1975 through the end of 1979.- Only maintenance performed i
during non-cold shutdown periods was included in this review. Of the 1693 reported tests, 650 were performed ac routine periodic operability l
tests and 1043 were performed for operability verification during or following maintenance. The tests performed during maintenance are identical to the periodic operability tests (each diesel generator is started, loaded and operated under load for a specified period of time),-
and these tests are fully documented in the testing files for each diesel generator. Failures observed during these maintenance tests would be reported due to the Technical Specifications requirements for unit j
shutdown if more than one diesel generator is inoperable.
- Data base excludes failures reported on 08/23/73, 10/01/73, 02/17/74 and 10/26/79 due to failures caused by human error, failure of Diesel Generator 1B reported on 09/02/78 due to corrected installation error, and' failures of Diesel Genere*er 2B reported on 01/11/75 and 01/13/75 due to redundant reports of sin lure cause indenti-and reported on 01/14/75.
Since the only failures reported are those which would have prevented a l
diesel generator from starting or operating under safeguards actuation I
conditions, any failures which may have been observed in addition to those reported should not have contributed to diesel generator failure for the event categories analyzed in this study.
i l
49
Component Type DIESEL GENERATORS Failure Moder Fail During Operation e
Total Component Service Hours in Period: 1,340 Basist Since the diesel generators are normally operated under load only during the routine periodic and maintenance operability verification tests, the service hours include only operating time during these testing periods.
(Prior to 1980, approximately 30 minutes per diesel generator test and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> during each refueling test.)
Routine operation of the diesel generators during unit startup and shutdown is performed in an unloaded state and is, therefore, excluded from these service hours.
e Failure Data for Given Failure Mode:
Date Reported Failure Cause 10/08/73 Diesel Generator lA Unspecified 07/16/74 Diesel Generator lA Reverse power relay failure 12/15/74 Diesel Generator 0 Low oil pressure 01/16/78 Diesel Generator 0 control air leak 12/01/75 Diesel Generator 2A Lube oil filter gasket rupture 05/06/77 Diesel Generator 2A CJatrol air leak e
Test Data Source: Test review and maintenance history summary, o
Failure Data Source: LERs t
50
Component Typer BUS FEED CIRCUIT BREAKERS Failure Mode Failure to Close on Demand e
Test Data: Number of Tests Per Month:
3 Quarter:
32 Year:
0 Refueling:
23 Total Number of Tests in Period:
3,124*
- Data base includes only the operations of bus feed circuit breakers verified during routine periodic and diesel generator maintenance operability verification tests. Circuit bseakers supplying power to individual components are not included in this data base, since the failures of these breakers are included in the specific component failure data bases. Operations of these circuit breakers associated with routine unit startup and shutdown operations are not included.
e Failure Data for Given Failure Mode:
Date Reported Failure Cause 10/03/74 D/G 0 Feed Breaker to Bus 147 Synchronizing relay failure 07/20/74 Bus 149 Feed to Bus 139 Loose wire 02/17/74 D/G 2B Feed Breaker to Bus 249 Closine relay blockage 01/07/79 Bus 248 Feed to Bus 238 Dirty contacts-02/22/79 Bus 248 Feed to Bus 238 Dirty contacts e
Test Data Source: Test review and maintenance history summary.
e Failure Data Source: LERs 1
i 51 S
t Component Type BUS FEED CIRCUIT BREAKERS Failure Mode Failure to Open on Demand l
e Test Data: Number of Tests Per Month:
3 l
Quarter:
32 Year:
0 I
Refueling:
23 Total Number of Tests in Period:
3,124*
l
- Data base includes only the operations of bus feed circuit breakers verified during routine periodic and diesel generator maintenance operability verification tests. Circuit breakers supplying pawer to i
individual components are not included in this data base, sinee the l
failures of these breakers are included in the specific component failure data bases.. Operations of these circuit breakers associated with routine unit startup and shutdown operations are not included.
I l
e Failure Data for Given Failure Mode Date Reported Failure Cause 02/22/79 ' Bus 248 Feed from Bus 243 Dirty contacts e
Test Data Source: Test review and maintenance history summary.
j e
Failure Data Source: LERs i
l i
52
Component Type: BUS FEED CIRCUIT BREAKERS Failure Modes. Transfer Open' 1
e Total Component Service Hours in Period: 1.30 x 106 7
1 Basis: Data base includes service hours for the bus feed i
breakers during all modes of unit operation, since failures of these breakers would affect offsite power supply to the essential power buses and should be reported under all.
operating conditions. Circuit breakers supplying power to individual components are not included in this data base, since the failues of these breakers are included in the specific component failure data bases. The breakers included in this data base are the (normal or reserve)
- feed breakers to 4 kV buses 42, 43, and 44; the two series feed breakers to each of i
the 4 kV essential buses 47, 48, and 49; and the feed breakers to the 480 v essential buses 37, 38,'and 39 for each unit.
- 0ne of these breakers must be closed during all modes of unit operation.
e Failure Data for Given Failure Moder No failures reported.
e Test Data Source: System drawings and unit operating status summary.
e Failure Data Source: LERs i
53 f
' Component Type:.AC POWER TRANSFORMERS Failure Mode Fail During Operation e
Total Component Service Hours in Period:
4.34 x 105 Basis: Data base includes service hours for the following
~
transformers during all sc 'es of unit operation, since failures of these transformers would affect offsite power supply to the essential power buses and should be reported under all operating conditions. The transformers included in this data l
base are the System Auxiliary Transformers and the 4 kV/480 V
. station service transformers supplying essential buses 37, 38, l
and 39 for each unit.
[
l l
j e
Failure Data for Given Failure Mode:
l l
Date Reported Failure Cause 01/13/80 System Auxiliary Transformer 242 Spurious deluge system actuation caused flashover i
e Test Data Source: System drawings and unit operating status summary.
I e
Failure Data Sources. LERs 54
- i
Component Type INSTRUMENT BUS INVERTERS l
Failure Modes Fail During Operation.
e Total Component Service Hours in Period: 3.04 x 105
.Basist Data base includes instrument. bus inverter service hours.during non-cold shutdown operating periods only, since failures of these components would be reported only during these periods.
i Failure' Data for Given Failure Mode:
e Date Reported Failure Cause 8/11/79 Inverter 114 5 KVA Transformer Failure 1/12/79 Inverter 114 2.5 KVA Section Failure l
8/20/77 Inverter 213 2.5 KVA Transformer Failure l
l l
e Test Data Source: System drawings and unit operating status summary.
F:ilure Data Source: Leks.
.55:
i t
l Component Type: DC POWER BATTERIES I
Failure Modes Fail During Operation l
l t
e Total Component Service Hours in Periods 2.02 x 105 l
l l
Basis: Data base includes battery service hours during non-cold shutdown operating periods only, since failures would be reported only during these periods. The service hours for Battery 011 include all times during which at least one of the units was not in cold shutdown, since this battery is required to be operable unless both units are in cold shutdown.
l e
Failure Data for Given Failure Mode: No failures reported.
l l
l l
l l
l e
Test Data Source: System drawings and unit operating status summary.
e Failure Data Source: -LERs 56 s'
n -
1 Component Type BATTIT.Y CHARGERS Failure Moder Fail During Operation e
Total Component Service Hours in Period:
2.02 x 105 Basis: Data base includes battery charger service hours during non-cold shutdown operating periods only, since failures would be reported only during these periods. The service hours for Battery Charger 011 include all times during which at least one of_the units was not in cold shutdown, since this battery charger is required to be operable-unless both units are in cold shutdown.
e Failure Data for Given Failure Mode: No failures reported.
o Test Data Source: System drawings and unit operating status summary.
e Fait"re Data Source:' LERs
'Y 57
4 B.2 ZICN 1 AND 2 GENERIC AND UPDATED PLANT DATA This appenuix discusses the generic data, references their sources and shows the updated plant data after they were specialized using Bayes' theorem.
-The derivation of prior distributions for the failure rates involves an extensive literature survey and, of course, the use of judgment.
Table B.2-1 identifies some of the key sources. For many' components there does not exist'a single source which has all the_ data required in this analysis in a form that would allow an unambiguous selection of the prior distribution. For example, it is not always specified what failure modes are represented,.the environments for which the data are applicable,'etc.
. Most of the generic data on valves, pumps and diesel generators were obtained from the NUREG data summaries (References B.2-1, B.2-2, and B.2-3).
The approach taken in this study was to use the mean values reported in the NUREGs as.the mean values of the generic population and to use the ratio of the 95th to the 5th percentile-reported in WASH-1400 (Reference B.2-4) as the ratio of the 80th to the 20th percentiles of the population variability curves. The lognormal curves from WASH-1400 are regarded as the known results of experiments on populations. They are frequency distributions representing the variability stemming from different manufacturers, different models, different operating and maintenance conditions, as well as the random fluctuations occurring in presumably identical components. Namely, if a large population of valves, pumps, or diesel generators were tested and if the frequency of specific failures were plotted, that plot would turn out to be a lognormal curve.
Data for electronic, electrical, and sensing component were obtained from IEEE STD-500 (Reference B.2-5),
The reported values were mainly synthesized from the opinions of some 200 experts (a form of the Delphi procedure was used). Each expert reported a low, recommended, and high value.of the failure rate under normal conditions and a maximum value which would be applicable under all conditicas (including abnormal ones). The pooling of the estimates was done using geometric averaging techniques, e.g.,
"n
~ 1/n (B.2-1)
='
-(( $t 1(MAX i= l '
MAX,1 J
58
h '
TABLE B.2-1.
KEY GENERIC RELIABILITY DATA SOURCES
-Item Key Data Sources Reference Electrical IEEE STD-500 B.2-5 Electronic IEEE STD-500 B.2-5
~
Instruments IEEE STD-500, WASH-1400 B.2-4, B.2-5 Valves NUREG/CR-1363, WASH-1400 B.2-1, B.2 4 Pumps NUREG/CR-1205, WASH-1400 B.2-2, B.2-4 Diesel Generators NUREG/CR-1362, WASH-1400 B.2-3, B.2-4 Mechanical WASH-1400, NPRDS B.2 4, B.2-6 SS
This method of averaging was' judged to be a better representation of the expert estimates, which were often given in terms of negative powers of ten. In effect, the usual arithmetic averages of the exponents were used.
The IEEE STD-500 does not recommend a distribution. The method of averaging, however, indicates that it would tur consistent to assume a legnormal distribution. For this analysis, the " Recommended" value was used as the median and the " Maximum" value as the 80th percentile of the L
population variability curve. These two values were-then used to l
generate the 20th percentile.
In some cases where there was no applicable data in the NUREGs or in IEEE STD-500, the WASH-1400 5th and_95th percentile values were used as the 20th and 80th percentiles of the population variability curve.
The historical plant specific data' listed in Appendix B.1 in' terms of the number of failures and the number of demands or total service time was updated using generic prior distributions to obtain a specialized l
posterior distributiot The methodology for perforcing this specialization is dissussed in the main report. The results are listed in Table B.2-2 which contains the following information:
e Component description and failure mode.
Plant evidence (historical plant data).
e Updated plant data (failure rate means and variances for l
posterior distribution).
l-
-e The generic prior distribution used to update the plant evidence and the sources of the generic data.
l l
l.
60
REFERENCES B.2-1 Hubble, W. H. and C. F. Miller,-" Data Summaries of Licensee Event Reports of-Value at U. S. Commerical Nuclear Power Plants, January 1, 1976 to December 31, 1978," NUREG/CR-1363, EGG-EA-5125, June 1980.
B.2-2 Sullivan, W. H. and J. P. Poloski, " Data Summaries of Licensee Events Reports of Pumps of.U. S. Commercial
~
Nuclear Power Plants, January 1, 1972 to April 30, 1978,"-
NUREG/CR-1205, EGG-EA-5044, January 1980.
B.2-3 Poloski, J'.' P. and W. H. Sullivan, " Data Summaries of Licensee Event Reports of Diesel Generators at U. S.
-Commercial Nuclear Pcwer Plants, January 1, 1976 to
' December 31, 1078," NUREG/CR-1362, EGG-EA-5092, GM.
~
B.2-4 USNRC, Reactor' Safety Study - An Assessment of Accident Risks in U. S. Commercial Nuclear Power Plants, Appendix III, Failure Data, WASH-1400, October 1975.
B.2-5 Nuclear Power Engineering Committee of the IEEE Power Engineering Society, IEEE Guide to the Collection and Presentation of' Electrical, Electronic, and Sensing Component Reliability Data for Nuclear Power Generation Stations, IEEE STD-500,.1977.
B.2-6 Southwest Research Institute ANSI Subcommittee, Nuclear Plant Reliability Data System, 1976 Annual Reports of System and Component Reliability,' Annual Report ( A03) of.
Component Reliability, May 1977.
i.
61-i% ^. *
'l
_.. = _. _ -
I-TABLE B.2-2.
' ZION - 1 AND 2 SPECIALIZED COMPONEHT IIARDWARE FAILURE DATA ~
Shect l' of 4 -
t I.
Plant' Speci fic
' Generic s
Service Ugalated Hours or Mean 180/120
[C mgonent Description and Failure Mode Demarxis -
Mean
' Variance (1201 (180)
' Ccaments - Data Source 1 ).. Systems l All '
0 1.11(7)
- 4. 99 (-8) 2.48(-15)
( 2. 8 (-8) l 12.8 (-7) ]
W-1400.
Fail to remain open. Plugged.
i L
Congonent, Types Manual Valves, Motor-Operated hrs.
A5 = 3(-5). 195 = 3(-4)/ den used
. Valves 1 dem/45 days to convert to I hour.
. Failure Mode 'TrennFer Closed-5 = 2.8(-8).
95 = 2.8(-7)/hr b
. 2 ).. Systems A11..
2 (-8) 100 N-1363. Manual valves. External leakage l1
. Component' Type: Manual Valves.
PWH's X = 21-8)/hr.
..Fallure Moder ' Transfer Open/ Excessive (N(
DATA FOUNI. I W-1400. MOV's. External leakage / Rupture l:
Leakage Through valve 15 = 1(-9)-
195 = 14-7)
's)
Systems All.--
0
- 6. % 8(3) 4.09(-5) 2.40(-9).
1(-4) 10 N-1363 Check valves. Fail to open. ' PWRs.
('
Component Type Check Valves
'dem.
i = 1(-4)
(,
Failure Mode ' Failure to Open on Demand W-1400 Check valves.. Failure to ogen.
15 - 3 (-5) 195 = 3(-4) l 4h System All 0
6.08(5) 2.76(-7)'
,1. 44 (-13) 3(-6) 10 N-1363 Check valves. Internal leakage.
i Ctaponent Type:. Check Valves hrs.
PWRs.
X = 3(-6)
' Failure Modes'cFailure to Seat / Excessive Leakage W-1400 Check valves. Reverse leak.
5 = 3 (-6) 95 = 3 (-5) :
I
- 5), Systems All 2
2.67(6) 8.51(-7) 2.63(-13) 5(-7) 10 N-1361 PWR mafety valves. Premature Component Type:.Helief/ Safety valves hrs.
opening. X = 5(-7)
' Failure Modes' Premature Opening or Leakage W-1400 Relief valves (all Rn types).
Pre-mature opening.
5 = 1(-7) 95 = 1(-6) 6)' Systems' All. Except Containment Spray and 14 1.131(4)
- 1. 26 (- 3 )
2.13(-8) 4(-3) 10 N-1363 PWR - Hemote operated plus MOV.
Chemical and Volume Control dem.
No connand f aults. Fail to cierate.
C<mponent Type Motor Operated Valves X = 4(-3)
Failure Mode Failure to Operate on Demand W-1400 Failed to operate.
15 = 3(-41 195 = 3(-3)
. 7)'
systems All.
0 6.19(5)
Component Type Motor Operated Valves hrs.
External leakage X = 11-7)
Failure Modes Transfer Open/ Excessive' W-1400 MOV's External' leakage / rupture Irakage Thsough Valve 15 = 1(-91 495 = 1 (-7)
H)' System All 3
1540 1.471-11 7.87(-7) 9(-4) 10 N-1363 ADV. Failed'to opearate PWR Component Type: Air Ogerated Valves dem.
X = 9(-4)
Failure Mode Failure to Operate on Demand W-1400 AOV. Fails to operate.
45 = 1(-4) 195 = 1(-1)
(
- 9) Systems All 0
2.15(6) 1.07(-7) 1.H5(-14) (2.8(-8))
[ 2.8 (-7) j W-1400 AOV.Pluq. Failute to remain open.
Component Type: Air Operated Valves hrn.
Used I dem 145 days to convert to I hour.
Failure Modet Transfer Closed, Pluqqed 4 5 = 3(-5) = 2.8 (-8) 195 = 3(-4) = 2.R(-7)
- 10) Systems All 1(-7) 100 N-1363 AOV. Fxternal leakaqe X = 1(-7)
Component Type Air Operatew-l Valves W-1400 AOV. Fxtern.n l - le.skaqe/ruptun e (H) DATA N 4
Failure Mi>1er Transfer Open. External l
A5 = 1(-9) n95 = 1(-7) 1.eakage l
NurE
't.23(4) indicates 1.23 x 10
-W-1400 WAsti-1400, Table III 2-1.
R N-1363: NOREG/CR-1363, Table 23, page 63.
N-1205: NUREG/CR-1205, Table 14, page 35.
,4 g-i N-1362: NUREG/CR-1362, Table 20, page 51.
w.:
J-
+
r
TABLE B.2-2 (continued) r Shet 2 of 4 Plant Specifnc Generic Service (tplat ed tiousa or Mean 180/A20 Component Description and Failure Mode Demands Mean Variance
[120]
(180]
Cornents - Data Source
!!) System All, Except Ausfliary Feedwater 3
3.138(3) 7.39(-4) 1.89(-7) 5(-4) 10 N-1205 Standby system. Does not start.
Cm ponent Type: Pumps-Motor Driven dem.
No command faults X = 5(-4)
Failure Modes Failure To Start On Demand W-1400 Electric motor. Failure to stast.
15 = 1(-4) 195 = 1(-1)
- 12) Systems Auxiliary Feedwater 6
2.31(2) 2.31(-2) 7.241-5) 4(-3) 100 N-1205 Standby System. No cmmand l'aults.
Component Tyge Turbine Driven Auxiliary dem.
Does not start. R = 4 (- 3 )
Feedwater Pump abo /A20 l>ased on engineering judgment.
Failure Males Failure to Start on Demand
!!) Systems Safety injection 0
4.6 (1) 1.51(-5)
- 2. 56 (-8 )
2 (-5) 100 N-1205 Al ternating System.
"Mes not Component Types. Safety injection Pumps hrs.
q= rate given start X = 2(-5).
Failure Moile Fall During Oleration W-1400 pump (w/o motor) Failure to run
- 14) System Pesidual Heat itemoval O
3.25(4) 2.12 (-6 )
3.45(-11) 21-5) 100 Same as 913 Component Typee Residual Heat Removal Pumps hrs.
Failure Moder Fall During O[eration
- 15) Systein Component Cooling o
7.4(4) 1.34(-6) 9.70(-12) 2(-5) 100 Same as $13 Cmpment Type: Component Looling Pumps hrs.
Failure Mole Fall During Operation
- 16) Systems Service Water 0
1.52(5) 9.04(-7) 3.55(-12) 2(-5) 100 Se % as $13 Cmponent Ty[>es Service Water Pumps hrs.
Failure Mmie: Fall Durirva Operation
- 17) System: Containment Spray 0
6.6 (1)
- 1. 46 (-5) 1.H6(-R) 2(-5) 100 Same as 413 Cmponent Type: Containment Spray Pumps, hrs.
Motor-Driven Faijure Moie: FatI During Operation
- 13) System: Auxiliary Feedwater 1
1.R(3) 1.05(-4) 2.05(-8) 2 (-5) 100 Same as $13 Comument Types Motor Driven Auxiliary brs.
Feedwater Pumps rallure Maler rail Du r t wa oper at ion
- 19) System: Auxiliary Feedwater O
1.9(3) 7.26(-6) 1.21(-9) 2(-5) 100 same as 913.
Tusbine-driven pump failure Compment Types Turbine Driven Auxiliary
- hrs, during operation similar to motor driven Veedwater Pump pump during operat ion.
Failure Mole Fail Durinq Operation
/0) Systems Containment Fan Coolers 2
1.155(3)
- 1. 20 (- 3 )
7.72(-7)
(l(-4)]
(l(-3)l W-1400 Electric motor f ailure to start.
Cmp >nent Type: Containment Fan Cnoters dem.
15 = 1(-4)
Failure Males Failure to Start on Demand-n95 = lt-3)
Motor Failures 4
p trE:
1.23 (4) irelicat es 1.23 x 10 W-1400:
WASH-1400, Table 111 2-1.
N-1363: NUREG/CR-1363. Table 23, page 63.
H-1205: NUPEG/CR-1205, Table 14, page 35.
1 0
h N-1362: NUREG/CR-1362. Table 20, page 51.
g
TABLE B.2-2 (continued)
Sh ut 3 of 4 Plant Fpecific Generic Service U[ dated ikurs on hean 180/A20 Fall-Comptinent Descr ipt ion and failare. Mcwle De mands Mean Variance
[120]
lA80]
Comments - Data Sources ures
- 21) System Containment Fan Coolers 0
1.52(5) 1.53(-6) 1.33(-11)
(1(-4))
(l(-2)]
W-1400 Electric motor.
Failure to run.
Compor.ent Type: Containment fan Coolers hrs.
Extreme envirorument.
Failure Moder Fast During Operation A5 = 1(-4) 195 = 1(-2)
- 22) System: All 0
4.13(5)
- 2. 71 (-7 )
- 3. (>6 (- 13 )
4.56(-6) 100 NPkDS page 34 2 = 4.56(-6)
Cunpsnent Types Heat. Exchangers brs.
180/120 based on ergineering judgment.
Failute Mode: Leakage
- 23) Systems All 3
1.16(5)
Negligibly small failure rate. Estimated Cednpsnent Type Heat Exchangers hrs.
on the basis of engineering judgment.
Failure M(des Plugged (Tube Side)
- 24) System: All 0
1.16(5)
Negliglialy small failure rate. Estimatest Component Types Heat Exchangers brs.
on the basis of engineering judgment.
Failure Mode: Plugged (Shell Side)
- 25) syst em: Diesel Generators 30 1.691(3) 2.06(-2) 1.8 3 (-6) '
3(-2) 10 N-3 362 Mont hly testire.
csel generator Comp >nent Type: Diesel Generators dem.
fails to start. No consmand faults.
Failure Memle: Failure to Start on Demarvi X=
3(-2)
W-1400 Diesel generator. Failure to start 15 = 1(-2) 195 = 1(-1) m 26)- System: Diesel Gene-rators 6
1.34(1) 5.97 (- 3 )
4. 06 (-ti) 2 (-2) 100 N-1.162 Stonthly testirvj. Diesel generator.
Compn.ent Typer Diese 1 Generat >rs hrs.
Ibes not c<sntinue t o run. vers command Failute Modes Fall During Operat.lon faults. X = 2(-2)
W-1400 diesel generator. Failure to run.
15 = 3 (-4) 195 = 3(-2)
- 27) Systems AC Elev.ric Power 5
3.124(1) 1.26(-3) 2.87(-7)
- 11. 0 (-7) ]
(1(-5))
IEEE-500 Int er ior design. AC bresker falls Component Type: Bus Feed Breakers dem.
to close. Page 148.
Failure Modes Failure to Close on Demarm!
Rec = 1(-6) Max = 1(-5)
- 28) System: AC Electrlc Power 1
3.124(3) 3.44(-4)
H.5)(-8)
f ails to open.
Page 148.
Failure Mode Failure to Open < n Demand Max = 2.27 (-3)
Rec = 2.276-4) 2'))
System: AC Electric Power O
- 1. '10 (6)
- 9. 6H (-H )
4.H9(-14)
- 3. 08 (-9) l 16.0(-7)]
IEEE-500 Interior design.
AC Lacaker Compenent Type: Hus Feed Breakers b r s.
spirious operation. Page 148.
Failure Mode: Transfer Open Rec = 4. 3 (-8)
Max = 6(-7)
NOTEi 1.23 (4) indicates 1.21 x 10 W-1400:
WASH-1400, Table til 2-1.
N-1363: NUREG/CR-1363, Taale 23, page 63.
H-120$a NUREG/CR-1205, Taale 14, page 35.
N-1362: NUREG/CR-1362, Te ile 20, page 51.
i O
TABLE B.2-2 (continued)
Sheet 4 of 4 Plant S w ific Generic T
Service Updated Hours or Mean A80/120 Crep>nent Descript ion and Failure Mode
~
Demands Mean Variance (120)
(A80)
Comments - Data Sources
- 20) Systems AC Electric Power 1
4.34(5)
- 1. 4 3 (-6) 1.95(-12) 11.44(-7)llt.51(-6)1 IEEE-500 Transformers (bolv-15kv). All Crag,nent Type: Transformers hrs.
modes. Page 300.
Failure Mode Fall During Operation tbc = 4.67(-7)
Max = 1.51(-6)
- 31) Systems AC Electric Power 3
's.04 t *>)
8.82(-6) 6.66(-17?
13(-7)]
(3(-5)]
W-1400 Solid state device. 111gh gewer Component Types Inverters hrs.
application. Fails to function.
Failure Modes Fall During Operation A5 = 3(-7)
A95 = 3 (-5)
- 32) System DC Electric Power O
2.02(5)
- 7. 39 (-8) 4.29(-14) l 4.95 (-9) l l8.74(-8)]
IEEE-500 Itat t eries-Icad-acid. Page 104.
Comgonent Type: Batteries hrs.
Stationary types for f2c.st s.ervice Failure Mode Fall During Operation itec = 2.08 (-8 )
M.ex = N.74(-8)
- 13) Systems DC Electric Power 0
2.02(5) 6.04(-7) 4.42(-12) I I. 78 (-8) lli. 25(-4) )
IEEE-500 Rectifiers. Station.sry tyge.
C(mp>nent Type: Itattery Chargers hrs.
All modes.
Page 90.
Fallere Mawle Fall During Operation Rec = 1.49(-6)
Max = 1.25(-4) m U1 4
t#frE:
1.23 (4) indicates 1.23 x 10 W-1400: WAsti-1400, Table III 2-1.
N-1363: NUREG/CR-1363, Table 23, page 63.
N-1205: NUREG/CR-1205, Table 14, page 35.
N-1362: NUREG/CR-1362, T.g 20, page 51.
3 1
l s
e B.3 COMPONENT MAINTENANCE DATA Maintenance activities which remove components from service and alter
- the normal configurations of mechanical systems can provide a significant contribution to the overall unavailability of those systems. - Although plant operating and maintenance records provide a source of detailed informatioriL for. specific maintenance events, a review of these records
. indicates that, for-many of the standby safeguards equipment systems of I
specific concern in this study, the site-specific information alone provides a relatively small and inconclusive data base..As an extension of the j
l general methodology discussed in Appendix D.2 for component failure data, l'
it was decided to apply the techniques of Bayesian specialization to the available site-specific component maintenance data, in order to develop a more_ meaningful representation of the actual state of maintenance at Zion' Units 1 and 2 than would be available from either the site-specific l
or generic information alone.
l
?
p l
l l.
~
i l
i i
66 1
4 f
a
11 DATA BASE DEVELOPMENT METHODOLOGY 1.1 -DATA BASE DEFINITION 1.1.1 General Considerations The only maintenance activities included in this data base are those activities performed during non-cold-shutdown periods which actually place a system in a degraded condition with respect to the performance of its safeguards functions as analysed in this study. Only non-cold-shutdown (i.e., power operation, hot standby or hot shutdown) periods are included
- for the following reasons:
e Operating, maintenance and system testing procedures and practices are modified significantly when the plant enters the cold shutdown condition.
e The Technical Specifications operability criteria for safety systems and components generally specify cold shutdown as the condition in which all inoperability restrictions are removed.
j e
The plant operating modes of primary concern in this study j
are power operation and, in some cases, hot shutdown or hot standby (i.e., non-cold-shutdown modes).
o Specific plant shutdown and'startup times were most readily l
available for periods during which the plant was placed in i
~old shutdown.
Each maintenance event vac analyssd for its effects upon system operability by examining the restrictions or abnormal configurations l
imposed upon the system during the maintenance activity. A given l..
maintenance event which, for example, required a pump to be either l
mechanically or electrically isolated rendered the pump unavailable for service within'its system and was included in the data base. However, an event during which only the motor operator.for a valve was de-energized, I
with the valve remaining in the required position for safeguards actuation, l.
was not included, because the activity resulted in no impairment of. the j
valve's ability.to permit flow under emergency conditions.
(The activity j
- would have been included if the. valve had been de-energized in the non-safeguards position.)
In general, maintenance performed on' valves has not been-included as
[-
_a distinct; category within.this data base. The most common forms of valve i-
- maintenance performed during non-cold-shutdown periods are packing adjustment and repairs of the control circuitry and valve operators for t
motor operated'and air operated valves. Nearly all of these maintenanca
_ activities are performed with the associated valve remaining in its
. safeguards-position 1throughout the maintenance period.and are.thus l'
inapplicablefto this data base. Because of the time criteria for unit
- shutdown impased byithe plant's Technical Specifications, major valve 67 y
+
~._..m_
maintenance involving full packing. replacement of repairs of the valve body and internals is generally postponed, if possible, until the unit -
I is placed in the cold shutdown condition either for refueling or for a planned maintenance outage. Repairs which cannot be postponed until a' planned shutdown and which affect the operability of an entire
. system require the unit to be shutdown and are,-therefore,-also excluded
.from this data base. ' (The maintenance event records reviewed at Zion fully support these general' practices with respect to individual valve maintenance events.) Maintenance on valves which affect only portions of a safety system may be performed during non-cold-shutdown periods withiO the component and system inoperability limitations imposed by the plant's Technical Specifications.. However, in the majority of these cases, the maintenance activity requires the removal from service of the pump in the flowpath of which the valve is a part (e.g., for pump suction
~
protection or for. personnel protection at the pump's discharge) and, from a practical applications standpoint, is thus indistinguishable from maintenance performed on the pump itself. Although valve repairs generally raquire less time to complete than pump repairs, the infrequent nature of l
individua1 ' valve maintenance and.the inability to precisely differentiate between maintenance events for pumps and valves in the site-specific data records have provided justification for the inclusion of valve maintenance with the' associated pump maintenance data base. Therefore, for the purposes of this study, maintenance performed on a " pump" is defined as l
any maintenance performed on any component in,the unique flowpath of that
. pump which requires the pump to be removed from service, and individual j.
valve maintenance. events are not generally considered as a distinct l
category.
(Two important exceptions to this general methodology as it l
applies to Zion involve the alternate Service Water supply piping to the suction of the Auxiliary Feedwater Pumps and the sodium hydroxide addition l
piping to the Containment Spray pumps, since these lines may be isolated without adversely affecting the associated pumps.)
The majority of the maintenance performed upon the plant's electric
(
power system, with'the exception of the diesel generators, is performed l
during cold shutdown periods during which the electrical load upon the system is reduced and the plant's Technical Specifications inoperability l-criteria are relaxed. Most of the' maintenance during non-cold-shutdown
-periods'is performed upon individual bus circuit breakers. During these
~
infrequent events, a spare circuit breaker is installed in the maintained L
breaker's cubicle,. thereby maintaining the operability of the affected power supply and excluding this type.of maintenance from the data base.
l
. Maintenance performed upon other components of the electric power system is similarly excluded from the-data base because ~ of the extremely l
infrequent nature of these events, the operability restrictions imposed by the plant's Technical Specifications, and the ability to maintain the associated power supply' buses energized through redundant supply circuits and manual l bus interconnections.
Based upon-the criteria outlined above, the' component maintenance date base for Zion Units 1 and 2 was. developed only for non-cold-shutdown l
periods and applies ~only to the. diesel generators, pump flowpath components, and thre pecial piping configurations analyzed in this study.
s 68, y
v w
1.1.2 Frequency of Maintenance The frequency at which maintenance is performed upon a given component during non-cold-shutdown periods is generally dependent upon three major factors:
The normal service duty of the component and its associated failure rate necessitate unscheduled maintenance events for the repair of gross failures or major component degradation.
Regularly scheduled plant preventative maintenance and inspection programs may be instituted for certain components.
The duration of component inoperability allowed by the plant's e
Technical Specifications affects the frequency of maintenance.
The precise impact of the Technical Specifications upon maintenance frequency is highly dependent upon the general practices adopted by the plant's maintenance personnel to compensate for the imposed time limitations and may vary widely between plants. A relatively short inoperability limit (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, for example) may result in either a relatively high frequency of very short duration events during which maintenance personnel perform very minor repairs and preventative maintenance, or a low frequency of maintenance determined by the component's failure rate under conditions of minimal preventative maintenance. In the former case, plant personnel attempt to avoid events of long duration by scheduling many controlled events of shorter duration, while in the latter case, these personnel are willing to accept infrequent failures requiring unit shutdown in order to avoid frequent events during which the possibility of imposed shutdown exists due to unforeseen delays. Whether the former or the latter (or some intermediate) case prevails at a given plant is fully dependent upon that plant's general operating and maintenance practices and thus cannot be easily generalized.
1.1.3 Duration of Maint6 nance As applied in this data base, the duration of a maintenance event includes the entire time period during which the affected component is unavailable for operation. This period is defined from the time when the component is originally isolated or otherwise removed from service to the time when the component is returned to service in an operable state, and, in many cases, it may be only weakly dependent upon the actual time required for maintenance personnel to effect the repairs. The duration of a maintenance event performed during non-cold-shutdown periods is thus generally dependent upon four major factors:
The magnitude of the failure determines the minimum tbne.
required for maintenance persontel to effect repairs ind may affect the complexity and duration of the tag-ou. and return to service operations.
69
t e
-The availability of maintenance personnel affects the duration of.the period between ecmponent failure and initiation of repairs and also affects the duration of the repair job.
'(e.g., If maintenance personnel are regularly available from 7:00 AM until.ll:00 pM, repairs cannot be.quickly initiated during the 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> off-shift.)
General plant maintenance scheduling and prioritizing e
practices influence the sequence in which corponents are
' repaired and the relative effort expended toward repairing a given component within a fixed time period.
e The duration of component inoperability allowed by the plant's Technical Specifications directly affects the relative
- priorities assigned to certain maintenance events.
It is notewoichy that the availability. of personnel and the prioritizing practices in effect at a given plant of ten dominate the determination of maintenance duration (as opposed to the relatively ideal case in which
- duration is directly proportional to complexity of repair). The impact of the Technical Specifications upon the relative priorities assigned to maintenance activities cannot be over-emphasized. A major repair effort of a component allowed to be inoperable for a maximum of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> will thus often be completed within a shorter time frame than a minor adjust-ment of a. component effectively allowed to be inoperable indefinitely, even
~
i l
if both components function as portions of engineered safeguards systems (however, with apparently different importance or available redundancy, as indicated by the differing Technical Specifications limitations).
l Because of these influences and because each plant has its own unique personnel and procedural ~ limitatio'ns, it is extremely difficult to l
generalize maintenance duration data to several planta, even if it is applied to otherwise physically identical components.
l j.
1.2 DATA BASE SPECIALIZATION Detailed site-specific cc e.ponent maintenance date was obtained throuch an extensive review of the Zion Unit 1 and Unit 2 operating and maintenance l
records. While this review provided nearly five complete years of specific l
component maintenance information for each of the units, it was discovered
(
that, due to the infrequent nature of maintenance performed on standby cafety systems components during non-cold-shutdown periods, this site-i specific data was in many cases sparse and relatively inconclusive (due to the high variability exhibited by the small sample of events). Because of these generally small, variable. sample sizes, it was decided to utilize l'
'the techiques of Bayesian speciali=ation as described in the main repo t r
to integrate the site-specific ir. formation with generalized prior data j
distributions, thereby developing an expression for the state of.kn.owledge about maintenance activities at Zion which applies the correct' weighting
~
factors ' to. both the detailed evidence and the.available prior information.
70
9 As discussed in sections 1.1.2 and 1.1.3 above, the frequency and duration of maintenance events sre determined relatively independently through the combined effects of numerous influences (the Technical Specifications allowed duration of inoperability being one important common influence). Both frequency and duration info: mation is necessary for the evaluation of maintenance activities as they impact upon the systems analyzed in this study; the frequency of maintenance defines the rate at which components are removed from service and serves as a basis for the evaluation of recovery factors and human interac; ions considerations, while the duration and frequency combined determine the compor.ent unavail-ability to be applied in the quantification of system hardware failures during maintenance activities. Because the frequency and duration of maintenance are not directly related, it was decided to develop a separate specialized distribution for each of these parameters as it applies to each of the components included in the data base.
The prior distributions for maintenance event frequency were specialized using the Zicn Unit 1 and Unit 2 maintenance data through the direct appli-cation of Bayes' Theorem as described in the methodology discussion presented in the text of the main report.
While the general principles of Bayesian specialization apply eaually well to the maintenance duration data, because of the uncertainty in its variability, it is necessary to apply the procedure using a slightly elif ferent methodology than described in the main report.
(This methodology is currently being applied to the data base for Zion and it will be fully documented, along with the resulting distributions, in a forthcoming supplement to dhis report.)
1.3 COMPARISON WITH METHODOIDGY USED TU WASH-1400 The developmental methodology employed in the WASH-1400 treatment of component maintenance data is similar in many respects to that used in this study, although the detail and depth of specialization available in WASH-1400 was necessarily limited due to the broad applicability of the data base. Separate distributions for the frequency and duration of maintenance were developed based upon discussions with plant maintenance personnel and utilizing data from a review of the maintenance records of four plants during 1972. Due to the broad scope of the WASH-1400 study, this site-specific data was not directly included in the data base, but served rather in the development of a log-normal distribution model for maintenance event duration and to provide general information for typical repair time distributions for four classifications of components.
A single broad distribution for maintenance event frequency was assigned uniformly to all component types. Because of the varied influences upon maintenance frequency discussed above, three general prior distributions for frequency have been developed in this study, with each prior distribution assigned to a specific component type, based upon the conditions under which the component is operated at each plant (including the specific Technical Specifications limitations applied).
71
r The assigned prior distribution is then specialized using the available site-specific data to produce a unique description of the maintenance frequency directly applicable to the component being analyzed.
The WASH-1400 distributions for maintenance event duration were developed for four general component. classifications: pumps, valves, diesel generators and instrumentation. The pump classification was further sub-divided into two specialized distribittions, one applicable to pumps having a 24-hour Technical Specifications inoperability time limit and one for. pumps with a 72-hour time Ibnit, in recognition of the strong influence of the Technical Specifications upon event duration. As discussed above, the site-specific evidence and increased experience with general plant maintenance practices have led to the general combination of pump and. valve maintenance events into.a single category of maintenance associated with a pump flowpath. In this study, a total of four general prior distributions for maintenance event duration have been developed and specialized to the applicable components analyzed at each plant.-
Thus, because the current study is concerned with the analysis of specific components in a single plant, and because the level of detail available frc.s. the site-specific data may be directly applied to this data base, the' methodology for maintenance data development presented in this study, while generally similar to that discussed in WASH-1400, provides the'1evel of specificity necessary to directly interface with the detailed analysis of each of the plant safety systems.
r
^
2 -COMPONENT MAINTENANCE PRIOR DISTRIBUTIONS 2.1 FREQUENCY OF MAINTENANCE' c,
Prior distributions 'for the frequency of component maintenance were developed for three general component catv,ories based upon the component type, its normal service duty,.and the applied Technical Specifications inoperability limitations. These distributions are described in Tables B.3-1 through B.3-3.
2.2 DURATION OF MAINTENANCE 4
Since the plant Technical Specifications provide the most important influence upon_the duration of all but the most complex repair work, prior distributions for the duration of component maintenance were developed for four general componenc categories based primarily upon their applied inoperability time limitations. These distributions are described in Tables B.3-4 through B.3-7.
Although the distributions presented in Tables B.3-4 and B.3-5 do not apply directly to any of the components analyzed at Zion, they have been included to illustrate the application of the general prior distri-bution development methodology over the full range of the most commonly observed Techaical Spee!fications inoperability time limitations.
2.3 COMPARISON WITH DIETRIBUTIONS UJED IN WASH 1400 The maintenance frequency. distribution applied to all components in the WASH-1400 study is characterized by the following log-normal parameters (WASH-1400, page III-54):
5th Percentile:
1 month between events
'95th Percentile: 12 months between events mean:
4.6 months between events This distrubition corresponds most closely to_ the prior distribution presented
-in' Table B.3-3 for continuous service components and components subjected to a high frequency of maintenance. Since the WASH-1400 distribution was developed from the maintenance event summaries from four units during a single year of operation, this distribution may be somewhat unrealistically
' biased toward a-relatively high frequency of maintenance occurrence. This is especially true in the case' of standby components having very restrictive inoperability time limitations and reflects the (expected) lack of evidence of maintenance ' performed on these components in just four reactor-years of maintenance data. While tha distribution ~in WASH-1400 may correctly model the frequency of maintenance as it applies to a broad collection of -
component types'in several systems, it must be recognized that this generally observed maintenance can be dominated by a relatively small. subset of components with relatively high maintenance frequencies. The distribution
' is _therefore not necessarily uniformly applicable to any given component in a specific' system, regardless of the component's normal operating status or its imposed inoperability restrictions.
73 4
s i
t l
i s
The WASH-1400 distributions forL component' maintenance ' event duration include two cases for pumps, one with a 24-hour inoperability time limit, l
and one-with a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> limit, and one-case for diesel generators, with.
3 essentially:a'72 hourcinoperability limit. The parameters characteri=ing these log-normal distributions are (WASH-1400, Table III 5-3) :
Pumps, 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> time limit:
l 5th Percentile:
0.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> / event 95th Percentile 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> / event Loan 6.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> / event Pumps, 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> time limit:
5th Percentile:
0.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> / event l
l l
95th Percentile: 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> / event l
l mean 18.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> / event Diesel Generators:
l 5th Percentile:
2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> / event ll:
95th Percentile: 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> / event l
means-21.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> / event
[.
The distributions for the pump cases compare favorably with the corresponding L
' prior distributions presented in Tables B.3-4 and B.3-5, although' the WASH-1400 distributions tend to include more optimism toward accomplishing maintenance within a short time frame than do-the distributions in this study.
(due, possibly, to the inclusion of tag-out and return to service
- times in the component unavailability durations for this study). The differences between the distributions for the diesel generators are attributable primarily to.the longer allowable inoperability period l
applied in this study as compared to that used in WASH-1400.
The prior distributions for maintenance frequency'and duration developed in Ed31s study thus compare favorably with the information presente'd in WASH-1400 if-the differences in their levels of specificity are taken into consideration. The principal advantage of the more detailed' distributions is that they provide specific information regarding the maintenance characteristics of a-given component type at a given
' plant and thus present a more realistic. representation'of the' actual variability of maintenance practices than is 'available through the broadly applicable distributions which were, of necessity, employed in WASH-1400.
74
t
'3 SITE-SPECIFIC. COMPONENT MAINTENANCE DATA The maintenance data presented in Tables B.3-8 through B.3-19 was
- obtained through an extensive review of~all available equipment out-of-service card _ records in effect during non-cold-shutdown periods at Zion Unit 1 and _ Unit 2 between September 4,1975 and Jure 30, 1980. The out-of-service _ card records were utilized because they provide a single source of information detailing (1),the specific components affected by a given maintenance event, (2) the resulting effects upon the system (e.g., the positions of valves, which circuit breakers were tagged out, etc.), (3) the entire duration of component-unavailability, including the required tag-out and return to service periods, and (4) the times and dates spanned by the. maintenance period (for correlation with unit power operation records).
The information presented in these Tables includes:
e
. Reporting Hours: the total number of non-cold-shutdown calendar hours in the given year for which maintenance data was availables (may be less that the total number of non-cold-shutdown hours due to missing or otherwise unavailable records).
e Component Hours: the total number of non-cold-shutdown componsnt service hours in the reporting period (obtained from the product of the reporting hours and _ the number of components available for the given type being analyzed).
j e
Maintenance Events:
the' number of individual maintenance events performed on the given component type during the l
reporting period.
e Total-Maintenance Hours: the total duration of the maintenance events -performed during the reporting period.
The-data is presented on an annual basis to. allow the identification of l
possible trends or unique _ cases which may.not be representative of the normally observed maintenance practices at the plant.
i 1
o l
l t
l, L
75 4
4 v
e TABLE B.3-1
-PRIOR DISTRIBUTION FOR MAINTENANCE PPEQUENCY Component Typer Standby pump or valves, tested monthly or
~
quarterly Distribution:
Log-Normal
~
5th Percentile:
3.86 x 10 event /hr (1 event /36 months)
~
95th Percentile:
' 1.54 x 10 event /hr (1 event /9 months)
~
Means 8.42 x 10 event /hr (1 event /16.S months)
~
Variance:
1.37 x 10 Basis:
Discribution range is indicativ of very light duty components subjected to relativs..y frequent test starts which would detect component failurcs. A minimal preventative maintenance program is applied due to the standby nature 'of these components and the Technical Specifications inoperability criterit. applied to maintenance performed during non-cold-shutdown periods.
Applicable to Zion Units 1 and 2 e
Containment Spray Pumps Safety' Injection Pumps e
e NaOH Addition Lines to Containment-Spray
.e.
. Residual Heat Removal Pumps *
- Alth;ough these' pumps are operated continuously during all cold shutdown. periods, they are purely standby pumps during non-cold-shutdown periods, and maintenance performed during these periods would apply,to failures detected duriz.g testing.
76 6
4
4
.T'BLE B.3-2 A
PRI'OR DISTRIBUTION.FOR MAINTENANCE FREQUENCY
~
Component Typer
. Alternating service pump or valves, tested monthly or quarterly Distribution:
Log-Normal i
~
Sth-Percentile:
5.79 x 10 event /h'r (1 event /24 months)
~
95thLPercentile:
2.31 x 10 event /hr (1 event /6 months)
~
- Maan:
1.26 x 10 event /hr (1 event /11 months)
Variance:
3.09 x 10 '
~
Basis:
Distribution range is indicative of medium d'uty components subjected to periodic testing. A nominal preventative maintenance frequency of approximately one event per 18 months' of pump operation is included to account for routine inspections, lubrication programs, etc. performed during non-cold-shutdown periods due to the generally less restrictive Technical Specifications inoperability criteria applied to these components.
Applicable to' Zion Units 1 and 2 Components:
e Auxiliary Feedwater Pumps o.
Service Water Lines to Auxiliary Feedwater Pumps' Suction *
- Although these lines provide only-a standby source of water.
to the ' Auxiliary Feedwater Pumps, failures of the isolation valves (primarily 'through leakage) could be detected during pump operating periods, due to service water contamination of the. steam generators. These valves are also tested at the_same frequency-as.the pumps, placing them in the same general service' duty category.
.J 4
s E
L
.yy s
T
~.,,.
o e
?
L TABLE'B.3-3 PRIOR' DISTRIBUTION FOR' MAINTENANCE FREQUENCY I
Component Types :
Continuous service components and components
- subject to high frequency of maintenance
' Distribution:
Log-Normal-5th Percentile:
7.72 x 10'. event /hr (1 event /18 months) 95th Percentile: 4.63 x 10~
event /hr (1 event /3 months) i
-4 Mean:
2.19 x 10 event /hr (1 event /6.3 months)
Variance: 1.66 x'10~
' Basis:
Distribution. range 'is~ indicative of continuous service -
l components or components requiring relatively frequent routine maintenance. A nominal preventative maintenance fregimency of approximately one event per 12 months of component service ~ time is included to account for the l
necessary periodic inspections, routine repairs and
~
general. overhauls typically performed on these components during non-cold-shutdown periods due' to their relaxed Technical Specifications inoperability criteria.
Applicable'to Zion Units l'and 2 Comnonents:
o!
Service Water Pumps l-e Component Cooling Pumps l-L le Centrifugal Charging Pumps i
ey Fan Cooler Units
- e Diesel Generators **
L
- Although the fan cooler units are located inside the containment
[
.and.are relatively. inaccessible during power operation, they are.in continuous service,-and maintenance is expected to be-required on'such items as circuit breakers, starting controls, service water supply-and return. valves,- etc., all of which
.equipmentiis accessible ~for routine maintenance and repair during non-cold-shutdown periods.
'**The diesel--gene'rators.are-tested frequently, are subject to minor failures and-degradation requiring routine maintenance, and are generally overhauled or tuned'up'according;to a nominal fpreventative maintenance schedule.
~
78
..r 3
s 4
$d ~-
1
TABLE B.3-4
- PRIOR DISTRIBUTION FOR MAINTENANCE DURATION Component Inoperability Time Limit:
24 hourc
-Distribution:
Log-Normal 5th Percentile:
-2' hours / event 95th Percentile 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> / event-Mean:
9.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> / event variance:
65 Basis:
Only the most routine maintenance can be performed with a component unavailability time (including. removal and
~
~
~
return to service operations) of less than two hours.
- The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> time limit for operation dictates that major scheduled maintenance will be performed.only during-periods of col.d shutdown. Any major non-routine maintenance or repairs requiring more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to Lcomplete.will necessitate unit shutdown. Since the
'date: base excludes all maintenance performed during cold shutdown, if. a maintenance event requires significancly-longer than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to comple'te, the extended repair time is not included 'in the data base.
Applicable to Zion Units 1 and 2 Components: -None "79-L2..
L.
,.'O_',,
c.
TABLE B.3-5
-PRIOR DISTRIBUTION FOR MAINTENANCE DURATION
~ Component Inoperability Time Limit: -72 hours
-Distribution:
. Log-Normal 5th' Percentile:
2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> / event 4
95th Percentile: L60 hours / event Mean:
18.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> / event Variance:
668 Basis l.
' Only-the most routine maintenance can be performed with.
a component unavailability time (including removal and return to service operations) of less than-two hours.
The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> time limit for operation dictates that major maintenance and repair' activities will'be performed during cold shutdown periods. Because of this limit, j
.the maximum duration of any single event included in the data base is 92 hours0.00106 days <br />0.0256 hours <br />1.521164e-4 weeks <br />3.5006e-5 months <br />,~ since.the unit would be l
placed in the cold shutdown condition within this approximate time limit. The majority of relatively routine maintenance and some extensive repairs will be completed within 2-1/2 days, given the high priority assigned.to returning the equipment to-service within 4
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />..
Applicable to-Zion Units 1 and 2 Components: None h
9 c
80' 9-x y
.n
6 TABLE B.3-6 PRIOR DISTRIBUTION FOR MAINTENANCE DURATION Component Inoperability Time Limit: 7 days Distribution:
Log-Normal 5th' Percentile: 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> / event 95th Percentile:
120. hours / event Mean: 33.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> / event variance:
4.18 x 10 Basis:
Only the most routine maintenance can be' performed with a component unavailability time (including removal and return to. service operations) of less than two hours.
The 7 ' day time limit for unit operation dictates that most maintenance will be prioritized to be completed within approximately 5 days to allow for possible unforeseen delays. Furthermore, since most scheduled major maintenance and equipment overhaul.is performed during the Monday-Friday work week, the 5 day time limit applies to most of these planned activities as well.
Applicable to Zion Units 1 and 2 Components:
e
' Diesel Generators.
e Service Water Pumps e
Containment Spray Pumps e
Residual Heat Removal Pumps o.
Saf9ty Injection Pumps e
. Centrifugal Charging Pumps o'
. Auxiliary Feedwater Pumps *
- A revision to the plant's Technical Specifications has been submitted' for NRC approval to apply a -7 day' time limit for unit. operation if any one-of the Auxiliary
.Feedwater Pumps.is inoperable.
81 e
- Y
o i.
TABLE B.3-7 PRIOR DISTRIBUTION FOR :*.AINTENANCE DURATION
!~
Component Inoperability Time Limit:
None Distribution:
Log-Normal 5th Percentile: 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> / event 95th Percentile:
336 hours0.00389 days <br />0.0933 hours <br />5.555556e-4 weeks <br />1.27848e-4 months <br /> / event Mean: 91 hours0.00105 days <br />0.0253 hours <br />1.50463e-4 weeks <br />3.46255e-5 months <br /> / event Variance:
4.23 x 10 Basis:
Given the relatively low priority generally assigned to maintenance of these components (with respect to more restrictive components),. the approximate minimum time l
required for performance of' most maintenance, including removal and return to service operations, is four. hours.
~The majority of maintenance events, including major
. repairs or component replacement, should be accomplished
~
within two weeks, 'given only moderate priority. A L
number of events could, of course, otake considerably l-longer to. complete, buc these events are the exceptions and should not account for more than 5% of all maintenance activities.
i l
Applicable to Zion Units 1 and 2 Components:
l' L
e Fan Cooler-Units l
~
o-NaOH Addition Lines to Containment Spray Component Cooling Pumps e
Service Water Lines to Auxiliary Feedwater Pumps' j
suction
- t t
- Although a revision to the plant's Technical Specifications
]
has been submitted'for NRC approval to apply a 7 day time
' limit for unit operation if one Auxiliary Feedwater Pump is inoperable, the reserve Service Water supplyfvalves have'been separated from~the pumps' operability criteria in this revision and-are-required to be' operable only'if the normal source of water supply from-the.Condersate Storage Tank becomes. unavailable.
82 J
....m
wi TABLE B.3-8 COMPCJENT. TYPE: MOTOR DRIVEN AUXILIARY FEEDWATER PUMPS.
Reporting Hours Component Maintenance Total Maintenance Year Unit 1 :. Unit 2 Hours Events Hours 1975 2688 2400 10,176 1
'190*
1976~
5760 5736 22,932 7
294*
-1977' 6768-6912 27,360 7
184 1978 7488
_7200 29,376 2-2 1979 6288 6144 24,864 5
308*
1980
.2216 2448 9,328 4
242
- A revision to the_ Technical Specifications for Zion Units 1 and'2 has been submitted for NRC approval which would require unit shutdown if one of the Auxiliary Feedwater Pumps. remains inoperable for more than 7 days. The reactor would be. required to cool down below 3500F within L12 hours of this-shutdown..The maximum total elapsed' time from the initiation of maintenance to cold shutdown is thus approximately 190 hours0.0022 days <br />0.0528 hours <br />3.141534e-4 weeks <br />7.2295e-5 months <br />. Since-the revised Technical specifications will apply to all
-future maintenance performed on these pumps, the historical data.has been modified to account'for this maximum allowable inoperability-period by truncatingfall mhintenance-events extending'beyond 190 hours0.0022 days <br />0.0528 hours <br />3.141534e-4 weeks <br />7.2295e-5 months <br /> to this time-limit. This truncation was applied to one event in 1975 of durationJ336; hours, Lone event in 1976 of duration 1224 hours0.0142 days <br />0.34 hours <br />0.00202 weeks <br />4.65732e-4 months <br />, and one event in 1979 of duration 343 hours0.00397 days <br />0.0953 hours <br />5.671296e-4 weeks <br />1.305115e-4 months <br /> to obtain the given times.
s
~ 83 '
\\
t
l' l'
-TABLE B.3-9 COMPONENT TYPE: TURBINE: DRIVEN AUXILIARY FEEDWATER PUMPS Reporting Hours Component Maintenance Total Maintenance Year' Unit l-
-Unit 2' Hours Events-Hours l
1975 2688
-2400-5,088 0
0 1
'l'976 5760 5736 11',496 5
88 I
1977' 6768 6912'
'13,680 5
40 1978 7488 7200 14,688 9
396*
1979 6288 6144 12,432 13 1248*
1980 2216-2448 4,664 9
607*
- A revision to the Technical Specifications.for Zion Units 1 and 2 has been submitted'for NRC. approval which would require unit shutdown if one of the-Auxiliary Feedwater Pumps remains inoperable for more than 7 days.
The_ reactor would be required to cool down below 3500F within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of this shutdown. The maximum-total elapsed time from the initiation of maintenance to cold shutdown is-thus approximately 190 hours0.0022 days <br />0.0528 hours <br />3.141534e-4 weeks <br />7.2295e-5 months <br />. Since the j
' revised Technical Specifications will apply to all future maintenance performed on-these pumps, the historical data has been modified to l
account for this maximum ~ allowable inoperability period by. truncating l-
.all-maintenance events. extending beyond.190 hours0.0022 days <br />0.0528 hours <br />3.141534e-4 weeks <br />7.2295e-5 months <br /> to this time limit.
This truncation was applied to one event in 1978 of duration 1084 hours0.0125 days <br />0.301 hours <br />0.00179 weeks <br />4.12462e-4 months <br />, two events in 1979 of durations.352 hours0.00407 days <br />0.0978 hours <br />5.820106e-4 weeks <br />1.33936e-4 months <br /> and 208 hours0.00241 days <br />0.0578 hours <br />3.439153e-4 weeks <br />7.9144e-5 months <br />, and one event.
in 1990 of duration 685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> to obtain the given times.
84 1
J Y
2 f
i.
e l
TABLE'B.3-10 COMPONENT. TYPE: CENTRIFUGAL CHARGING PUMPS m
Reporting Hours; Component-Maintenance Total Maintenance Year
' Unit 1 ~ Unit 2 Hours.
Events Hours
-3 104 s
1975
.2688 2400.
10,176.
i 1976 5760
'5736.
22,992 2
104
. 1977-6768-6912 27,360
- 6 152 l
l 1978 L7488 7200 29,376 2
'86
~ 19'i9 6288'.
'6144 24,864 4
143-
- 1980, 2216 2448.-
9,328 0
0 l
/
9 85.
j g,
g t
F q
-),
r
TABLE B.3-ll COMPONENT' TYPE: COMPONENT _ COOLING PUMPS 4
Reporting Component" Maintenance Total Mainter.ance Year Hours
- Hours Events Hours 1975 2760 13,800 3
152 1976 6984 34,920 14 1378**
i 1977 8760 43,800 9
127 1978 8688 43,440 7
43 l-1979 7008 35,040 12 3612***
1980
_3888 19,440 1
3888***
~*since.the Component Cooling system is shared between both units, all Technical Specifications inoperability restrictions are removed from all five of the Component Cooling Pumps only when both units are in--
cold shutdown.-
(One pump may remain inoperable indefinitely with both l.
units operating; two pumps may remain inoperable indefinitely with one unit operating.) The reporting period for these components thus includes all times during_which at least one of the units was not in cold shutdown.
- Includes one event of duration 768 hours0.00889 days <br />0.213 hours <br />0.00127 weeks <br />2.92224e-4 months <br />.
i t
- Includes one event of total' duration 5712 hours0.0661 days <br />1.587 hours <br />0.00944 weeks <br />0.00217 months <br />, excluding cold shutdown period for both units from 10/27/79 - 1/19/80.
(Component Cooling Pump OB -out of service from 8/13/79 through end of data base period.)
J 86~
s-if
~
t
e ng TABLE B.3-12
. COMPONENT TYPE: CONTAINMENT' SPRAY PUMPS
' Reporting' Hours
- Component-
. Maintenance Total ~ Maintenance Year.-
Unit 1. -Unit 2 Hours Events Hours
~
'.1975
.2688-'
J2400.
15,264 3
56
.1976 c5760 5736
.34,488
=0 O'
1977-
'6768
.6912
~ 41,040 2
16 1978 7488
- 7200 44,064
.1 4
-1979 6288 6144 37,296 3
62
~
.1980 2216 2448 13,992 2
24 s
,_A 4
J.
87~
4 4
=
1
'o TABLE B.3-13' COMPONENT TYPE: RESIDUAL HEAT. REMOVAL PUMPS-Reporting Hours Component Maintenance Total Maintenance-Year ~
Unit 1.
Unit 2 Hours Events Hours 1975:
2688 2400.
'10,176 0
0 1976:
25760 5736'
~22,992 1*
72 1977' 6768'
,6912 27,360' 0'
O 1978.
7488' 7200-
-29,376 0
0 1979
'6288 61'4
~24,864 5*-
392 4
1980 2216 2448 9,328' O
O
- All maintenance events apply to Unit 2 pumps only; no maintenance was iperformed on the Unit 1 pumps during-the data base reporting period.
88 I
'l
^.a
<.3..
..L
- g'
-.. I t
i.-
t TABLE B.3-14 COMPONENT TYPE: SAFETY' INJECTION PUMPS-
~
I.
L.
- Reporting. Hours-Component Maintenance Total Maintenance.
l'
' Unit l~
Unit'- 2
-Hours.
Events' 2 Hours-Year 1975L
~2688
.2400 10,176'
- 0 '
'O 1976 57'60 5736~
-22,992 1
24-l, 1977-6768'-
6912-27,360 0.
0
)
1978 7488
'7200:
29,376-0 0
l
'1979.
- 6288
'6144
'24,864' O.
0
~
1980' L2216 2448~
9,328' O
O-
~
.A t
Y r
_89 _
. I x
.g f
f s
^ ~. e,.
e.
TABLE B.3-15 COMPCNENT TYPE:. SERVICE WATER PUMPS Reporting Hours Component Maintenance Total Maintenance
~
Year
- Unit.1' Unit'2.'
. Hours:
. Events Hours 1975-2688L
'2400 15,264-8 112
.1976:
5760.
- 5736, 34,488-3 40
-1977-
'6768 16912 41,040 4
'27 1978' 7588 7200 44,064 7
177 1979 6288-
-6144-37,296 1
12 1980 12216 2448 13,992 1
11 t-
'\\
l 5
-6..
F N
q.
,i_.
LQ 90 A =
- q f
4-.
y a
7-.
a
,O-c_, :--
. e; l
l l.
r u-lTABLE~B.3-16 COMPONE'IT TYPE: ; FAN COOLER. UNITS.
r t.
l
. Reporting' Hours Component.
MaintenanceL Total Maintenance' l:
Year '-
. Unit.1-. Unit 2i 1 Hours Events-Hours
- 1975' 2688 2400'
._25',440 9
72 1976' 5760'.
5736 57,480
'4 368*
i 1977.
6768' 6912
'68,400 1
3
- 1978
'7488
.7200 73,440 0
0
~
1979-
'.6288 6144
'62,160'.
0 O
1980
'2216 l2448 23,320 0
0 l
- Includes one event of duration 312 ' hours.
I l
I-i h
T j
N 3:
91
^f5 t
+
4 i
'l
- L,
- e.
l TABLE ~B.3-17 COMPONENT TYPE: DIESEL' GENERATORS
. -Reporting Hours.
Component-Maintenance Total Maintenance Year Unit'l Unit 2.
Common
- Hours Events Hours 1975 2688 2400 2760-123936:
15 384 1976' 5760 5736' 6984 29,976 22 848 1977
'6768 6912 8760 36,120 20 536 1978 7488 7200 8688
'38,064 36 1112 1979
.f288 6144 7008 31,872 30 1503 l
1980 2216 2448 3888 13,216 14 492
- Since Diesel Generator O is shared between both units, all Technical Specifications inoperability restrictions are removed from this diesel
- generator only when both units are in cold shutdown. The common reporting hours applied to Diecel Generator O thus include all times during which at least one of the units was not in cold shutdown.
i 1
l t
92
'l?
p
g - -.
g9 TABLE,B.3-18 COMPONENT TYPE:.NaOH ADDITION LINES-TO CONTAINMENT SPRAY
, Reporting Hours
_ Component Maintenance-Total Maintenance
' Year Unit l' Unit 2 Fours-Events Hours 1975 2688.
'240b
'15,264 4
272*
'1976 5760--
5736 34,488
-2 16
-1977 6768 6912 41,040 0
0 1978 7488 7200 44,064 1
24 1979 6288:
6144 37;296 0'
O 1980' 2216.
2448 13,992 0
0
- Includes one event-in which one addition line was isolated for 216 hours0.0025 days <br />0.06 hours <br />3.571429e-4 weeks <br />8.2188e-5 months <br />.
l 1
l i
93-r.
.y.
m.,
10 TABLE B.3-19 COMPONENT TYPE: SERVICE WATER LINES TO AUXILIARY FEEDWATER
. PUMPS' SUCTION Reporting' Hours.
Component Maintenance Total Maintenance
' Year Unit 1 ' Unit 2 Hours Events Hours 1975
'2688 2400 15,264 0
0 1976 5760
,5736 34,488 2
840*
l'977 6768 6912-41,040_
2 8712*~
1978
'7488 7200 44,064 0
0 1979 6288 6144 37,296 2
528**
1980 2216 2448 13,992 0
0
- Includes one event spanning 1976 and 1977 in which one service water supply
'line was isolated for a total of 9432 hours0.109 days <br />2.62 hours <br />0.0156 weeks <br />0.00359 months <br />.
- Includes'one event of duration 408 hours0.00472 days <br />0.113 hours <br />6.746032e-4 weeks <br />1.55244e-4 months <br />.
i l
94 e
.-