ML20027C168

Nonproprietary Version of Evaluation of Impact of Reduced Testing of Turbine Valves

ML20027C168
Person / Time
Site:	Farley
Issue date:	09/30/1982
From:	Rahe E WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:
Shared Package
ML19301B787	List: ML20027C166 ML20027C168
References
TAC-48973, TAC-52539, TAC-53434, WCAP-10162, NUDOCS 8210130535
Download: ML20027C168 (77)

Text

.'...gs.., l l jT-)',k. j h, }.Y.p. " Q u';

?l f., f:.,%.fli r

'Y.f.;- ) k'?-l';} ~~ $l : Ofi'Y"':^ l 'f:?: ^:l l Z::f.':

'[,

i

. s s s s - w -

1 4

.t s.

s icy;.0yQ,,

% ".; A.. O f.-M:X':;. O W^Q.&& GOR-:QJW4%.W. s.'MW a

g

a. 1 w: eg #,; 'ag m - ge n A -6 ~

4 w3%.a % 1 @.Must..S T'

4 p%4 -

NPr !N

~

F* ( ;;d."- 2: ~::- ;;ll - : ':- : % :::::Y:

G ; J{ 'ry: Py% ' ::f::f.'tN X,.%'.Y.V.f'*W.%.%X,%'J,%','

.p*,%.%&'%._.%,%;; ; _.:-;,l:. _. ;. ; y ;;... ;..._.

'- :fy ? F ?-f.;-;.K.% y ; ; :-.b.s %;-

p

,.,,y..g ;.

_- ~.;

... : y,a y c);

.1,.,, ; G; ;

y:

s. ;.y ;; y y..y,. py x,.3 _.;., y.,, y r

?,r Y,c ' :/, '.:

y x;,~ ~ ;-; ;-. ;.;,s.,~ ;. y;.m.;.:. ;...y ;.

,.x y,. _. :.. ;;.: p 7:.

, _ ; : ; ;. p

: :, 3 A.,,, a g..

v

-;

: ;q:y.t.:-

,s

,ij,:. q :l,; ', -. ; -

[h

~I '

A I

M e

L ) L %w% M rL r )

r a c.

')f K A ;dff'F. O _

'O

'h*.' t(( j '

J

_..).

1 i

- )

.a a

..'.:. A,TE,,,g -.g

.... 4 j

.g, ;,,, g 3 j.;, u.y 4 47 -.,

A.

7.

,. ~,..

1, O

O~~ ' O O-O O

s).

O' c>

Q O

O O

o

. h'?~;* '"t W'Yl:.. h. y d.. L, D'd,+ :% ?;.G;;c.-y-y

'.: b~ Wye - :: -ri p j9n,c I

1(4,.

f,.'i hF,',.s. -;,,".,,'

<,.w L; & n.;,

,s

..,. q'.h..g.-e.' s _ :

t

' W q :. ; ' V: c.( 9 : 1.

p p

- 4 :.,.

,.g. y a

'. ; ay,(

. -9,.g.9s.,

y,<,.

.'p..,.

.<, y-2 : y ::,. ;.~,

, C 4

fj

', /

%. ',. ! '. 7,.y-

, f y ?'i.,., %,.' h:r - -.>..,,+.:

's',%ck.' g, a,;..;/. @ i

.n' g:., L, *.,. '..

.s

.c.

t

'i."

4+

bi.

,h..'

c. -

4. M(.'s,4.

y.,..

c s

t.-

c.,

+

4'

'.('l$.,ft;d.!,i'..l l l,

. b'ha

.. ;u,- -

?'n _,.-:. R.. E.

,. g.

.T'. Nh. Y W.,-... ':L i.. ? l.

e, um we w HOk

-O O

O O.

')

')

..,' i l :

c'.

21

. ~,..

?,

v, w.

)

')

o.

9 O

- O n.

,e i.. ;p*,;f. 7'N \\

4,y,, f.7.:!.q.J y.,'.. '(.

'/.%" f*:q. W.: F:.h y

l

~.,. '.

.G

,v,

., 7,;', f.

.G..-

% /:

x. ' <.

. c:: :... :.

,r..: s. s. ; e. -

W:*r,.c:.

Mo!'h(i, 'a,

'.0..+ ' ^ '..L' 'bx,. p(h. e x(,',h,, M,...,

..; L

. 'M, 4.i.J,

.L' e:,-.'.<i..

.:n.

v,

.s...~,...

3.

e y,(.,... p. t

...e..

.f ! gh,[N$ d.^,).!

.'.' ; j I

~

. W..

. 9. '...,... _

+

,Nv

...u t

, 4 p' c,;c.. ::. : A..m..

s

, y.*

g g ;.

~

h.

l.

. 'f.,

f.h.~

',2 Q t

'[...k

- f,. ~

'..). [:

f

[f.

.... 'L i

< c y.,. u :.,.,.. '..

..: t,.s g r.

c.c s._

wt..., s. 3.,,......n

,a.

uy;

,, +

,6,'.

_w

.+

e y.%

fp. :.{g ;. ;; fc. -; ', '

?'

l q

{J.

Q w.;

} -.f c :

t

,,,y.,c j[,,.

g.,. g.,

s., ; -

j. -

..., 7. -.. ;

c y, f, y.

_, ;l

,M y' n

... ;.... g..,.m w. y w,.. s

.V..

7:., - n.4

..-.c i

s,. m.,..,;

. : O >. ~.:.. :.:., g.v,c.;

<.c s.w

.9:.y :.:.

J

$.;.,... qq Q; '.q.

/

.... : x-4:., ty.;.py%..~.,,:e em9

,i

.-<4,.

.c v,x Y v..,e,:,,

...~.: y..

,e, y

g ;.a z.,j<. e w,f.,y.y.p.y

4.., s

.

• q g 4,#

c

.s, M,cp, A,q s.^,.,..

-.ep v.f.

Avy

%. :#qq..d

,p.

, jy+ t

. w.4 4-

. A ge. +.

3,,r o

n O

O O

s,w

!.. sty G

O O

O.

\\ O.

3 e

3

, MMF8&Jh Ut U

O U+

f D-D D

D L

?

c

^ht GO. :'Af.c.;: '.

u..

9

4. O t

(v..:.:.

.c.

- ~: -.

n'_. k ~..; -..... m. -

&,. Fn M,,t M y k. V-

-t.

~ ~ - - - -

n e...,4, a,,6 &,, o. S,a <~. ;v . y ty. p,6 t-s. c.-.. g

). ;......

c-i',, t o

.t

.......z

?.

o

1. A o.., n. n.. e e.

<m

. m.

- ^

^

h$

h I

5 e,, u R.,jg.

.. :.:.v.

1 og,.:,ya,f;:,.

...: :.. : c: s....:. - :...: ;.:.:. - - -

n. >

. ~...

-...c.

a v.

e.

c...

.u

.;.,t..,.,.. y....

...y,:7./,,...; y / ;;.

./.....:.:.y y : 4 y 4.: y,. s.;.:...y

.y.

. +

. y.:.;.c _.;

L;'fG,RN',,~Q;& '.f.:~.?.Q '%$:,:Q<. Ql.%l. _..

.x. /,.y. e,%,4,.4<.4..,.

,y u,,

, s.,.

> g ) l.l'W.D,.- t

$$%,%,,,,aq; 7,.,. 44..

</.<

<a -

r:

.v....

.. s.. -

.<$ff&%

&$&fp,,k,.&$f&S l-s

_ fO

. M W M F W. 6. 7Amma(tegg D hMW 11 F Weegt $sefend O R W What'..

..t.

~-. -- - - - --.

4

~,,

~

,_[,',.

9,

.._,.g 3,

g.

's. **

k.

y

,{

g i

t:

~

g

^

t y

t..

?

g..

p.

-s 3d.,

g '

~

0

^

4 e

- 4x e

f_. _

._y q f t s

t,

.,. s... +p -

vi

l. O j,

~

~

%. ?g i

. -. ' 4 i

^

'i!'

)

D. 3.h

?;

[k.

.s

,,- s s' w

-.......h

.. w

~

..ws s,

w

, e.. p,g.

3_x.

y, y

y, 8,,.

.: /

.c.

) '

,'.s 0.., '

'~a T.

1 r

'f W%,

l'l, _

y_

' e.

. -l h ' N dY f' )9.-

j ~

<l. k.

."m

[-(

,g,d g.f 2

j

.s..'.

.T, 2

,s-,.,...

3..,.

~

"__.,..j

)

-;i,. :

1I

'a

.,. T t

.o

,e q

(

d

?.

. )

s

.t

,,p, -

)

4 V A sad i

F-7 i

!g '. ?

=^

e r

e,.

,b

• ~.

d

[ M.

~

s

+

e

.N.

+

o,.-.

.e

.i.',

'. w: - 5

.f'.'*

.. - _ s.

y 4

A

% - G'

. 4 j%-

93, i..

5+,.

' +

I*

g 7

(

f y

ek a

4*

(

j -

i j.

<\\.

f v 3-

'Ny.

• ,3 g

.. i

^

<? '- '

.p r

7

, y

_o g.

a.,

. !s 4

• J

. g' y

i e-e c

a e

?

~.. ',,.,.

, N; :,.,

f

~

.+

,' i '

s c

't.

e

, l c.

~

? y' 'sp e'

. L' ~

s p

^

r

- [1; v

u.,

g o'.

6

• q'

, g g

. b

. f,.

?

c

,1(-

m s...

C*

..e,

~p p

O f

t*

5tf0f)l0ustNuclearEnel'gySystems -

.?

,.~,

--A S

b.

r..

=

.N '

.2' 4

g *. ' '>.

-i' '.

.- ' l., '.4qf _ '

s I

j e, e

'y

• y S

' ~

.;;. _.;. Y,,,

~

e g.

~

.4

' ',.']N k

3a.

4

~

~ y t'

_','),

g%

.4 7.

~

j w/ ".

i.

r

= 3; wMg--

y..,.

W.y i 7. y s.;vyg <

,f,.+.. L...., T..;;

,.' i ;,

,,1.

, y,y,

. j.,,. ;,. ;.. ;.. j j.3 g.

WESTINGHOUSE PROPRIETARY CLASS -3 Si 5

'T 9

a.

6.

a:

EVALUATION OF IMPACT OF REDUCED TESTING OF TURBINE VALVES September, 1982 a

APPROVED:

E. P. Rahe, Manage Nuclear Safety This document contains infonnation proprietary to Westinghouse Electric Corporation; it is submitted in confidence and is to be used solely for This the purpose for which it is furnished and returned upon request.

document and such information is not to be reproduced, transmitted, disclosed or used otherwise in whole or in part without authorization of Westinghouse Electric Corporation, Nuclear Energy Systems.

4 Westinghouse Electric Corporation

~

Nuclear Energy Systems P.O. Box 355 Pittsburgh, Pennsylvania 15230

WESTINGHOUSE PROPRIETARY CLASS 3 PROPRIETARY NOTICE This document contains material that is proprietary to the Westinghouse Electric Corporation.

The. basis for making the information proprietary and the basis on which the information may be withhela from pulatic disclosure is set forth in the affidavit of A. R. Coil ter, Pursuant ta the provisions of Section 2.790 of the

' Commission's regulations, this affidavie is attached to the application for withholding f rom public disclosure which accompanied this document.

This information is for your internal use only and should not be released to any persons or organizations outside the Office of Nuclear Reactor Regulation and the ACRS without the prior approval of Westinghouse Electric Corporation.

Should it become necessary to obtain such approval, please contact A. R. Collier, Manager of Commercial Operations. Steam Turbine Generator Division, Westinghouse Electric Corporation, P. O. Box 355, Pittsburgh, Pennsylvania 15230.

e

WESTINGHOUSE PROPRIETARY CLASS 3 TABLE OF CONTENTS SECTION TITLE PAGE 1.0 Introduction and Summary 1.

2.0 Turbine Systems and Main Steam Line -Isolation 2-1 Valves 2.1 Turbine and Valves 2-1 2.2 Turbine Contrai and Protection System 2-2, 2.3 Turbine Operation 5 2.4 Turbine Overspeed 2-7 2.5 ' Main Steam Line Isolation Valves 2-9 3.0 Testing and Valve Failure Modes 3-1 3.1 Valve Testing 3-1 3.2 Surrogate Valve Testing 3-2 3.3 Valve Failure Modes and Impact of Testing 3-2 4.0 Failure Data and Analysis of Failure Probability 4-1 4.1 Failure Data and Component Failure 4-2 Probabilities 4.1.1 Failure Data 4-2 4.1.2 Component Failure Probabilities 4-5 4.2 Fault Tree Analysis 4-12 4.2.1 Fault Tree Construction 4-12 t

4.2.2 Fault Tree Quantification 4-12 4.2.3 Evaluation of Results 4-14 4.3 Statistical Evaluation of Testing Interval 4-22 and Valve Failure 5.0 Safety Analysis and Missile Generation Probability 5-1 5.1 Missile Generation Probability 5-1 5.1.1 Turbine Overspeed Probabilities 5-1 5.1.2 Turbi ne Mi ssile Generation-5-3 5.1.3 Conclu sions 5-4 5.2 Non-LOCA Analysi s 5-4 5.2.1 Method of Analysis 5-5 5.2.2 Case A 5-7 5.2.3 Case B 5-8 5.2.4 Case C 5-9 4

5.2.5 Case D 5-9 5.2.6 Individual SAR Transients and 5-10 Accidents t

i SEPTEMBER, 1982

s

. WESTfMGHOUSE : PROPRIETARY CLASS 3.'

TABLE OF' CONTENT'S.(Conti nued1

-SECTION

-TITLE

.PAGE 5.3 LOCA A'naly si s.

5-13 5.4 Multi-Steam Generator Blowdown 5-15 6-1 6.0~

Corclusions 6-1 6.1 Valve Testing 6-1 6.2 ' Turbine Overspeed and Missile Generation 6-3 6.3 Safety Analysi s 6-3 6.4 Summary 4

i-l f

I l

i i

l I.

I il SEP TEMBE R. 19H2

ESTINGHOUE PROPRIETARY CLASS 3 LIST OF FIGURES FIGURE TITLE PAGE 2-1 Turbine and Turbine Valve Arrangement 2-11 2-2 Turbine Autostop and Electrohydraulic Fluid 2-12 Sy stems 2-3 Main Steamline Isolation Valve 2-13 4-1 Destructive Overspeed Fault Tree 4-27 4-2 Design Overweed Fault Tree 4-28 4-3 Intermediate (130%) Overspeed Fault Tree 4-29 5-1 Flow Diagram 5-16 5-2 Typical TWAP - FSAR A naly si s Ca se A 5-17 5-3 Typical RWAP - No TT on RT, MSIV Closed, Ca se B 5-18 5-4 Typical RWAP - No TT on RT, MSIV Failure, No Stuck 5-19 Rod, Ca se C 5-5 Typical RWAP - No TT on RT, MSIV Failure, Stuck Rod, S-20

~

QwD

/

=

l iii SE PTEMBE R, 1982

WESTINGHOUSE-PROPRIETARY CLASS 3

-LIST'0F TABLES TABLE

-TITLE PAGE 4210 4.1.1

_ Basic Fault Tree Event Failure. Modes

~

4.1-2:

Basic Event Service Experience.

4-11

.4-17 4

4.2-1 Fault Tree: Basic Events _

.4.2-2 Basic Event Input Probabilities 4-18 a

4-19.

'4.2-3 Input Probabilities for Basic Events Sensitive

' to Valve Testing Interval Assumptions

'4-20' 4.2-4 Design Overspeed Probabilit.ies 4.2-5 Intennediate (130%) Overspeed Probabilities 4-20 4.2-6 Destructive Overspeed Probabilities s4-21 t

t

=i I

4 4

i L

4 1

9 n

f SEPTEMBER, 1982 iv

WESTINGliOUSE PROPRIETARY CLASS 3

1.0 INTRODUCTION

AND

SUMMARY

Historically, Westinghouse has recommended that turbine valves ce tested

- periodically.

A weekly test. recommendation originated in the mid-1950's

~

primarily as a result of service experience associated witn fossil plant application at that time and in recognition _of the importance of re-liable turbine generator operation as it relates to operating personnel arid equipment protection.

The importance of frequent valve testing to maintenance of the i.ntegrity of systems necessary for the safe operation of nuclear plants has never been clearly established.

Nevertheless, the periodic valve testing recommendation has evolved into a license requirement for certain recent nuclear power plants by virtue of its inclusion as part of plant tecn-nical specifications.

The technical specification requirement appears to be arbitrarily applied-in some cases - weekly test intervals, in others - monthly, and in still others - no requirement at all.

Furthermore, Alabama Power Company has inaicated that periodic valve testing as a license requirement poses a not insignificant economic curden arising from the necessity to reduce plant power on an inflexible schedule, the potential for tripping the plant of f-line with the atten-dant undesired cycling of plant equipment, and the associated quality control measures needed in performance of a license condition.

For these reasons, AlaDama Power Company requested that Westingnouse evaluate the need for periodic turbine valve testing on the'Farley Units as a licensing requirement as distinct from equipment and personnel protection.

This report documents the results of that study and forms the basis for the conclusion that periodic on-line valve testing is not warranted as a licensing requirement and can be eliminated from the Farley plant technical specifications. This conclusion is supported by the following:

1-1 SEPTEMBER 1982

-WESTINGHOUSE PROPRTETARY CLASS 3 A.

There is no indication that on-line valve testing influences valve reliability or f ailure rates. Except where deposits are involved, valve exerti se does not arrest degradation leadi ng to a recognized valve f ailure mode and has little demonstrated value in detecting an incipient condition leading to f ailure.

In other words, valve test-ing primarily yields a binary result, i.e., the valve has f ailed or it hasn't.

e B.

Tne primary benefit of valve testing is a calculated improvement in valve availability due to the potential for detection and correction of f ailed valves.

C.

The turbine trip system i s a highly reliable feature 'and trip un-availability i s extremely low, even udthout on-line valve testing.

D.

Periodic valve inspection and maintenance i s of primary importance to the detection and correction of valve f ailure precursors and, hence, to assuring low valve f ailure rates during plant operation.

In that regard, periodic valve inspection continues to be re-commended as a highly effective means of assuring turbine trip re-li ability.

E.

Transients imposed on the plant due to f ailure to trip the turbine even under postulated accident conditions are not severe and in no case constitute a significant contribution to overall public risk.

F.

Alabama Power Co. has indicated that the cost associated with peri-l odic on-line valve testing as a license requirement can be sig-nificant.

I G.

Alauana Power Company has indicated that the economic interest of the operating utility to assure turbine trip reliability cir-cumscribes any need for specific licensing requirements.

I Westinghouse continues to recommend periodic on-line valve testing for l

neasons of equipment and personnel protection.

1-2 SEPTEMBER 1982 f

l

WESTINGH0USE PROPRIETARY CLASS 3 2.0 TURBINE SYSTEMS AND MAIN STEAM LINE ISOLATION VALVES The turbine system is composed of many individual but interrelated sys-tems that function to control and protect the turoine.

The turoine valves control steam flow into the turbine and isolate the turbine in the event of adverse conditions.

The turbine valves are themselves controlled by a combination of electrical and hydraulic systems.

To understand the significance of eliminating the valve test licensing requirement, it is beneficial to discuss the various systems and their interrelations.

This section of this report,provides an introduction to the turbine systems and additionally, the main steam line isolation

~

valves (MSIV).

The following discussions are particular to the Farley turbine generator complex.

2.1 TURB1NE AND VALVES The Farley turbine generator is designea to convert the enermal energy of the steam generated by the NSSS into electrical energy.

It consists

~

of a Westinghou,e 1800 rpm, tandem-compound, four-flow exhaust turbine with 44-in. last stage blades mecnanically connected to tne electrical generator.

The turbine is designed at maximum calculated flow to accept up to 11,710,478 lb/hr of throttled steam at a pressure of 750 psia, temperature of 510.9 F and 0.4 percent moisture for a maximum output of 895,843 kw by the generator.

It is intended for a base loaded operation with capabilities for load following wnen required.

Saturated steam from the steam generators flows through a douDie-flow high-pressure turbine and then through four combination moisture sepa-rator-reheaters (MSRs) to two double-flow, low-pressure turbines wnich exhaust to the main condenser.

There are two stages of feedwater re-heating off the high-pressure turoine and four stages of feedwater re-heating off the low-pressure turbines.

)

The ac generator is a direct-coupled, 60 cycle, 3-phase, 22,000 V unit 2-1 SEPTEMBER 1982 I

WESTINGHOUSE PROPRTETARY CLASS 3

~

1,045,000 KVA at 0.85 power f actor and has a s'nort circuit rated at ratio of 0.58.

The generator shaft is oil sealed to prevent nydrogen le akage.

The generator,has its own shaf t-driven excitation equipment.

The turbine lubricating oil system supplies oil for lubricating the-bearings.

Typically a bypass stream of turbine lubricating oil flows continuously through an o'il conditioner to remove water and other im-purities.

High pressure steam enters the turbine through four throttle valves and four governor valves. Two turbine throttle and two governor valves form a single assembly called a steam chest.

There are two steam chests.

The steam exhausts from the high pressure cylinder, flows through the reheaters and re-enters the turbine througn four -reheat stop and four interceptor valves.

The turbine is equipped with an emergency trip system which is designed to trip the throttle, governor, reheat stop and interceptor valves to a closed position in the event of turbine overspeed, low bearing oil pres-sure, low vacuum or thrust oearing failure.

An electric solenoid trip is provided for remote manual trips and for various automatic trips.

2.2 TURBINE CONTPOL AND PROTECTION SYSTEM The turbine generator system is equipped with a digital electrohydraulic The con-(DEH) control system to control steam flow to the turbine.

troller consists of seven (7) functional subsystems as follows:

A.

Digital reference system B.

Primary speed channe!

C.

Throttle valve positioning system D.

Transfer control E.

Governor valve positioning system F.

Manual controllers and error detectors G.

Auxiliary speed channels 2-2 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 The digital reference system r'eplaces tne normal speed / load changer it is an all' solid state system using digital logic.

The con-motor.

trol for tne digital reference consists of a setter / counter comparator, pulse generator and up/down reference counter.

The up/down counter controls solid state switching to develop the actual reference voltage.

The reference' display will read out the setting of the up/down reference counter.

This digital reference approach permits the selection of desireo speed and acceleration rates.

4 The primary speed channel uses signals proportional to the speed 05-tained from a variable reluctance pickup coupled magnetically to a notched wheel on the turbine roto..

These pulses are converted to a r

The difference between speed and digital speed number in the software.

reference is the primary input to the valve positioning syst, ems.

The throttle valve system consists of an automatic controller and posi-tion controls for each valve.

The voltage output of the automatic con-troller establishes the desired valve position and is proportional to the speed error. The speed error input to the throttle valve system provides wide-range speed control during starting. All. throttle valves are positioned in unison during starting by means.of individual servo amplifiers.

Control of the unit is transferred from the throttle to governor valves prior to synchronizing.

The governor valve system is similar to the throttle valves.

The input voltage to the servo amplifiers is derived from the automatic con-troller.

By individually biasing the input of the servo amplifiers, the governor valves are positioned in sequence as required by the turbine

~

design requirements.

The manual controllers with automatic tracking serve as a backup and In the event of provide direct operator control over valve position.

2-3 SEPTEMBER ~1982

WESTINGHOUSE PROPRIETARY CLASS 3

~

certain contingencies, such as loss of the computer, the control of the unit is, switched automatically to the manual backup controllers. The manual control mode permits on-line' maintenance of i nput channels and automatic controllers.

An auxiliary speed channel (part of the overspeed protection controller) converts the frequency pulses generated by a separate variable re-luctance pickup to a proportional analog signal for the control of.over-speed. The overspeed protection controller operates to close the inter-ceptor and governor valves when the turbine speed becomes excessive, but has not attained tripping speed.

It will also operate when there is an excessive imbalance between turbine load estimated from crossover pres-sure and generator output measured with a watts transducer.

The steam flow is controlled at the main and reheat inlets by con-ventional valve arrangements.

The position control actuators for each valve are of the electrohydraulic (EH) type. A separate hydraulic sup-ply system delivers high pressurc fl0id to the actuators.

This fluid pressure, acting on the. actuators, produces the valve positioning fo rce s.

The DEH controller computes control signals to position the valves by comparing speed, first-stage pressure and generator-output with reference values.

The high pre ssure fluid supply system is of the unloading type and is completely separate from the lubr'cating oil system. A dual pump system is used with one serving as a complete backup. The backup pump starts automatically from low header fluid pressure.

The high pressure fluid trip headers connected to each valve actuator assembly are controlled by a diaphragm operated emergency trip valve and solenoid valves.

Turbine trip i s accomplished by dumping auto stop oil which, in turn, dumps EH fluid initiating quick closing of throttle, governor, intercept and reheat stop valves.

The interf ace between auto stop oil and EH fluid is realized utilizing a diaphragm valve and in backup, an auto 2-4 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 w

stop oil pressure switen operating a solenoid valve in the EH fluid system.

Typical installed turbine trip signals are low vacuum, low bearing oil, high thrust bearing wear and as discussed in section 2.5, turbine overspeed. A solenoid trip and solenoid trip valve allow remote tripping for normal turbine shutdown, turbine trip ort reactor trip, etc.

At Farley, this remote trip capability is also used to trip the turbine whenever an electrical f ault occurs that causes generator output breakers to open. An additional feature is an interlock which delays

^

i opening of generator output 'oreakers for 30 seconds following turbine trip for reasons otbar than electrical f ault.

During this period the turbine is allowed to motor and turbine speed is governed by grid frequency.

2.3 TdRBINE OPERATION Operation of the turbine-generator as described herein relates only to the nit and does not cover the numerous operator actions required in other areas of the plant. With the unit at rest awaiting startup, the

~

~

fWst step is to place the unit on turning gear to enable the operators to check that the eccentricity of the high pressure rotor is within acceptable limits. Before admitting steam to the turbine and rolling off Jurning gear, the unit is latched so that the governor, reheat stop and interceptor valves fully open.

The throttle valves remain closed.

Once these steps are completed, the unit is rolled to approximately i

1700' rpm.

During this period the governor valves are fully open and speed of-the unit is controlled by pilot valves in the main plugs of the throttle valves.

At 1700 rpm speed control is transferred to the-l governor valves and the throttle valves go to the fully open position.

I Speed is then increased to 1800 rpm, the unit is synchronized to-the system and is ready to be loaded as required by system demand. Once the i

unit is connected to the system, load is regulated by the governor I

valves with throttle, reheat stop and interceptor valves in the fully open position.

Whenever the unit is operating under load, the DEH control system posi-J tions the governor valves as required by load demand signals and can i

2-5 SEPTEMBER 1982

1 WESTINGHOUSE PROPRIETARY CLASS 3

orerate the unit in the integrateo plant control mode, the turbine follow' mode.or the ieactor follow mcde as requireo.

Time' required to roll a unit to speed and to make specific increases or:

decreases-in load is governed by operating instructions provided by the turbine-generator, manufacturer.

'4 Shutdown of the unit is usually accomplished using these same in-structions by unloading the turbine to a predetermined low lo'ad and manually cripping -the u' nit. By using this procedure, the operator. is able to exercise many of the components 'of the trip system thus :en-hancing the likelihood of detecting a potential malfunction before it occurs:on an e:nergency demand.

When the-unit trips the sequence of events will be influenced by the source of the trip signal. Usually, if there are no.nalfunctions, a signal causing the turbine to trip first, followed by the generator trip

~-

In will~ result in lower overspeed than if the generator tr.ips first.

addition, a chort period of deliberate motoring will further limit over-Thus, the speed in a trip initiated through the turoine trip solenoid.

sequence of events and the resulting overspeed are largely dependent on the trip signal source and the unit load.

For example, in the event of a large loss of load, two event sequences can be considered:

The loss of l'o'ad transient indirectly causes a,reacto'r trip which in A.

turn, trips the turbine and 30 seconds later, the generator output -

breakers open.

The loss of load occurs due to an electrical f ault which causes the B.

generator output breakers to open and the turbine to trip whicn trips the reactor.

Through the reactor and turbine trip and generator ouptut breakers open

~

initial turbine overspeed would oe more procaole in in either event, case 8 than case A.

For case A design overspeed is unlikely.

SEPTEMBEd i982 2-6

)

WESTINGHOUSE PROPRIETARY CLASS 3 2.4 TURBINE OVERSPEED

\\

The Digital Electro-Hydraulic Centrol System contains a turbine shaft l

speed transducer and is the basic control system for turbine overspeed.

At 103 pen:ent of rated shaft speed this system releases the electro-hydraulic fluia pressure to move the governor and interceptor valves toward the closed position in an attempt to maintain shaft speed at less 2

then the trip speed.

Backup control is supplied by an overspeed trip valve and mechanical overspeed trip mechanism sich consists of a spring-loaded eccentric weight mounted in the end of the turbine shaft. At 111 percent of rated shaft speed, centrifugal force moves the weight outward to mechanically actuate the overspeed trip cup valve which ' Jumps auto-stop oil pressure and in turn releases the electrohydraulic fluid pressure to close the throttle, governor, reheat stop and interceptor valves.

The supply ster.::: prassure acts to hold the throttle and governor valves closed.

Upon loss of tne EH fluid pressure an air pilot valve closes the ex-traction nonreturn valves to the feedwater heaters having valves in their extraction lines.

The secondary backup overspeed control is provided by the electro-hydraulic control system if the turbine speed exceeds approximately 111.5 percent of rated speed. At thi s point the solenoid trip is en-ergized to dump the auto-stop oil dich in turn dumps the EH fluid pres-sure closing the throttle, governor, reheat stop and incerceptor valves.

Under nomal operating conditions, turbine speed is maintained at 100%

of rated speed, generally for domestic units being 1800 rpm for a nuclear plant and 3600 rpm for a fossil plant, and is controlled by the a

sy stem.

If for any reason the load is lost and the circuit breaker opens, turbine speed will increase above rated speed.

Loss of load

~

above 30 percent initiates the overspeed protection controller to close all the governor valves and interceptor valves.

Simultaneously, the main speed governing system initiates closing c' the governor valves in 2-7 SEPTEM8f.R 1982

WESTINGHOUSE PROPRIETARY CLASS T3 response to a signal indicating overspeed.

In addition. if the -turbine speed exceeds 103% of the rated speed the overspeed protection con-If troller signals the governor valves and interceptor valves to close.

the command of the overspeed protection controller is-properly executed, all the governor and interceptor valves will be closed and the turbine speed sho'uld be kept below 111%.

If some of tne governor.ano inter-ceptor' valves are not closed, the turbine speed will continue to increase, and at approximately 111% of rated speed the mechanical emer--.

gency trip ' device commands all throttle, governor, interceptor and reheat stop valves to close.

At approximately 111.5% (i.e., almost simultaneously) the electrical emergency trip device commands all the valves to close.

If all the steam inlet valves are closed by an emer-gency trip mec'hanism, the turoine speed should not exceed the design overspeed of 120%.

However, if the steam continues to flow into the turbine due to some malfunction, tne turbine speed will continue to increase beyond the 120% level, and could accelerate to destructive overspeed oof approximately 195%.

Design Overspeed The turbine speed will reach design overspeed if:

A.

During normal operation load is lost, the output breakers open and a turbine trip does not occur at event onset.

B.

Both-the speed control and overspeed prntection systems fail to close at least one or more governor valves or one or more inter-ceptor valves.

C.

The emergency trip system functions properly and interrupts the steam flow into the turbine.

Intermediate Overspej The conditions that lead to 130% of rated speed, gi ven a full-load sys-tem separation are:

2-8 SEPTEMBER 1982

ESTINGHOUSE PROPRIETARY CLASS 3 A.

All throttle or governor valves are closed before design overspeed i s reached.

B.

One or more steam lines from the HSR's to the LP turbines remain open after the unit trips.

f De structive Overspeed The turoine speed ragy reach the destructive overspeed if the following events occur simultaneously:

A.

System separation with sufficient steam supply into the turbines, e.g, this can happen if the load is lost and the breaker opens dur-ing nonnal operation, and B.

A combination of f ailures in the overspeed protection ano emergency trip sys: ems, causing a high pressure turbine inlet to be kept open.

Since the destructive overspeed condition can occur only if steam con-tinues to flow to the high pressure turbine, only the governor and throttle valves need to be considered. For this reason the interceptor and reheat stop valves need not be considered for the destructive over-speed condition.

2.5 MAIN STEAM LINE ISOLATION VALVES The main steam isolation valves are installed in the main steam lines from the steam generators.

For the Farley units, two valves are in-stalled in each main steam line, downstream from the safety relief valves, outside the contairment.

The i solation valves are 32-i n., 600-lb, full-flow, swing-check, non-return-type valves with pneumatic actuators. Each valve is provided with air supply and vent piping with solenoid valves as shown in Figure 2-3.

2-9 SEPTEMBER 1982

WESTINGHOUSL PRUPkitlAMT LLM33 J During normal plant. operation the valves are <ept open against a spring force by air pressure over the piston in the actuator cylinder. Uron receipt of an engineered safety features actuation signal or manual trip signal, the air pressure in the cylinder is relieved and the valve is closed' by action of the spring to stop the forward flow of steam tnrougn the valve.

Piant instrument air at 80-100 psig pressure is supplied to the actuator cylinder.

Each of the redundant isolation valves has its own means of closing and venting the air supply to relieve tae cylinder pressure and close the valve. Each isolation valve is provided with a nonnally open solenoid valve in its air supply line and a nonnally closed solenoid valve in its air vent line. Each of tne redundant isolation sets of supply and vent solenoid valves is supplied from a separate 125V-dc power system and receives a separate signal from the engineered safety features actuation system.

The two valves in the isolation valve bypass lines are also closed by a signal from the engineered safety features actuation system to stop steam from escaping through these lines.

The main steam line isolation valves are capable of isolating the steam generators within five seconds of receiving the signal from the en-In the event of a steam line gineered safety features actuation system.

break, this action should prevent continuous uncontrolled steam release from more than one steam generator.

Protection is afforded for breaks inside or outside the containment even when it is assumed that there is a f ailure of one of the isolation valves.

Two redundant control signals are supplied by the engineered safety features actuation system to close the redundant isolation valve and tne bypass line valves.

The two valves in the bypass line for each pair of isolation valves are closed simultaneously with the isolation valves to stop steam from escaping througn this line.

The loss of air supply at the valve operator should close the isolation valves and the bypass line valves.

2-10 SEPTEMBER 1982

8 A

A a

u

,egren I 5

2 x

, i

~,

i, U

? a!.i

]

c 5

\\ 0 E

5! I

=. ' veven i

~34

=

m s

-2

3. i j?

>/ 3 3

j, e

\\

(

2

\\

e U

t

~^^

= ' v5 men i E

[

X X

ge g

!X X

6 8

W:

e:at i 2Q C^C EE oE

~

5 g

z e

a a

a g>

3

.a.

.a.

=E E

2."

EI

l

=

m g,;

a g

k a= /

'ga egr NE

/

OI

@3 33 33 3@

5 g

s.i t!

1 1 1 1 1 1 1 1 e

g e

e g

w e

e 8:

e o

e o

8; si 3

g.

t

.I":

2 Es

-Et e

E ;. <

I*

t O

sja II e

Ei I

l 3

E ej=

5m*

• 5 Cr5, :

3::

y:-

I*

/

\\

I e

j 6

+a c WESTIf1GH00SE PROPRIETARY CLASS 3 FIGURE 2-2. TURBIflE AUTOSTOP AND ELECTR0llYDRAULIC FLUID SYSTEl15.

2-12 september.1982

WESTINGHOUSE PROPIETARY CLASS 3 r----------

q HS J

p S

$4' J' N# N#

Y l

V HS l

Q_ __ __ I s

$"pPty l

s SV S. L.I. A.S.

sm a n:

AIR f

f yff-AIR p

AIR SUPPLY

~

Y

~~~]

TEST PAL PSL CYLINDER

[

l g

~

5 l

HV MAIN f

I CYLINDER g PSL PAL ll 5

g b

l 2,

~

{~~

]

S.L.I. A.S.

gy M

'M HS 2

I I

g DC I

I l

ZS l

ZS I

l q

l

{}

l l

d I

j I

I s

w_____ _ _

s I

VENT - h h -

1 HS L_ ___ STEAM LINE ISOLATION ACTUATION SIGNAL l

AIR gy l

SUPPLY 1

AIR l

SUPPLY LEGEND:

l HS HAND SWITCH STEAM LINE ISOLATION PAL LOW PRESSURE ALARM ACTUATION SIGNAL PSL LOW PRESSURE SWITCH S

SOLENOID l

SV SOLENOID VALVE ZS POSITION SWITCH Figure 2-3 Main Steamline isolation Valve 2-13 September,1982

WESTINGHOUSE PROPRIETARY CLASS 7 3.0 TESTING AND VALVE FAILURE MODES Testing is conducted to verify that equipment is capable of performing its intended function. The turbine valves, as discussed in the previous section, function to control and protect the main turbine. To do so requires the valves to move freely and be CapaDie of responding to Con-trol and protection signals.

Valve testing ideally tests these abil-ities, or detects non-perfonnance of these abilities. Thera are two degrees of performance or non-performance that testing may potentially demonstrate:

A.

Equipment failure - the complete non-performance of equipment function.

B.

Equipment f ailure precursors - identification of equipment con-ditions tnat will eventually lead to f ailure if not corrected.

A test which only identifies equipment f ailure is useful'in limiting the time af ter f ailure that reliance is made on the f aulty equipment. A test which identifies f ailure precursors impacts the time between and number of f ailures if the precursors are acted on.

This section of the report addresses turbine valve testing and its implications on valve failure rate.

3.1 VALVE TESTING Periodic test'ng of turbine valves consists of movement of each of the turbine valves through one cycle (from the valve position prior to test-ing, to full close, and returning to the original position). Typi cally, this test is conducted by the control room operator with an observer at the valve.

Valve testing verifies freedom of movement of the valve stem ard plug, the actuator rod and piston and verifies proper operation of either the servo valve or dump valve, depending on which valve is being tested, and the associated EH drain line (return line) to the EH res-ervoir.

Testing verities full closure of the turbine valves as testing is now constituted, i.e., nothing is inhibiting full closure.

This type of testing is beneficial for, (1) detecting non or sluggish operation of the 3-1 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 valves, and (2) identification of gross outward appearance of valve condition.

~

In addition to periodic testing, periodic valve inspections are also perf ormed.

Valve inspections entail at a minimum, partial dismantling of the valve and valve nousing to observe internal valve conditions.

Valve inspections are the primary means of detecting distress or con-ditions' that would lead to future valve f ailure.

Valve inspections obviously require shutdown conditions and cannot be performed during operation.

3.2 SURR0 GATE VALVE TESTING Periodic valve testing primarily demonstrates the ability of the valve to respond to a signal and close upon demand.

Therefore, any operation of the valve wnich also demonstrates these abilities is a canoidate for consideration as a surrogate test. The operation most similar to valve testing is that of a turbine trip. Tripping the turbine requires oper-ation of portic7s of the autostop oil system, the EH fluid system and demonstrates valve closure.

The only significant differences between a turbine trip and a typical test are the absence of an observer at the valves and the position of the governor valves. Westinghouse has determined that stationing an observer at the valves during turbine trip while shutting down qualfies as a surrogate valve test provided there has been no evidence of malperformance of governor valves during normal l

operation. Other evidence of proper valve operation is obtained from unobserved turbine trip if following trip the valves are verified to be closed.

3.3 VALVE FAILURE MODES AND IMPACT OF TESTING The dominant f ailure modes that have been experienced for the valves of the type present at Farley Nuclear Station and that could cause valve failure are:

3-2 SEPTEMBER 1982

'L

WESTINGHOUSE. PROPRIETARY CLASS 3 A.

movement or loss of valve seat inserts B.

cracking or breaking of the muffler C.

seal ring - bonnet liner distress 0.

misalignment of valve linkage.

These conoitions are primarily internal to the valves and periodic test-ing would identify these conditions only to the extent tnat they are apparent to an observer or that they prevent valve operation. ' Data collected indicated these conditions nave seldom been detected by test-ing unless a valve f ailure nas resulted.

In other words periodic test-For ing most of ten identifies f ailures but not failure precursors.

example, a cracked muffler could potentially result in later muffler f ailure and subsequent internal valve binding, however, this " precursor" could not be detected during testing, only the subsequent f ailure of the valve could be detected.

For the above reasons, periodic valve testing does not have an impact on valve f ailure rate for these types of valves in that it has not readily identified failure precursors, only f ailures.

Therefore increasing the periodic test interval will have no adverse impact on observed f ailure rates or valve lifetime.

Testing that does not identify repairable defects cannot influence valve degradation and therefore valve f ailure Westinghouse, after considering f ailure modes and testing rate.

methods, is confident that less frequent testing will not adversely impact turbine valve reliability.

O e

3-3 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 4.0 FAILURE DATA AtlD ANALYSIS OF FAILURE PROBABILITY Based on the data reviewed, less frequent valve testing does not appear to influence valve failure rate, it does theoretically impact the time interval after failure and before detection during which the valves would be incapable of performing the intended function. To determine.

the impact of this decrease in valve availability, a quantitative fault tree analysis of potential overspeed conditions was performed.

This analysis considered the probability of:

1.

Destructive overspeed/no turbine trip 2.

Design overspeed - 120 percent uverspeed 3.

Intermediate overspeed - 130 percent overspeed.

4 Each of these conditions is uniquely different from the others due to

. the failures or successes that must occur for the condition to occur, hence necessitating consideration of all three.

The ramificatons of each of these conditions is also very different.

Each is addressed in this report section.

An integral part of performing a probability analysis is the use of appropriate data.

In this case, the data relates to the observed failure rates and associated failure probabilities of the equipment.

constituting the valves and valve control systems.

This section of the report details the data used in the fault tree analysis, it's sources and the statistical techniques used to calculate failure probabilitie's.

The final part of.this report section describes a statistical test of the Westinghouse position that an increased test interval does not adversely impact ' valve failure rates.

This study statistically evalu-ates failure rates for different test intervals obtained from plant data.

4-1 SEPTEMBER 1982

WESTINGHOUS~ PROPRIETARY CLASS 3 -

4.1 FAILURE DATA AND COMPONENf f (LURE PROBABILITIES 4.1.1 FAILURE DATA-The " Basic Event Service Experience" tabulation used to develop the March 1974 Westinghouse report titled " Analysis Of The Probability Of The Generation And Strike Of Missiles From A Nuclear Turbine" was updated with data obtained f rom the following Westinghouse sources.

A.

Field incidents Report - A hard copy sort, by month, of the inci-i dents reported by Westinghouse Steam Turbine Generator Division (STGD) based on information received from District Offices and customer plant sites.

B.

Outage Data System - A computerized data systen that reports outage and availability data by unit or any group of units.

The system also provides detailed lists of outages by unit, groups of units, time period, or other categories. The data is obtained weekly-f rom

. District Offices, which contact utilities for the previous weeks i nf o rmation.

C.

STGD Data Bank - A computerized generic file of turbines and their components where used reports and service histories can be produced -

for specific components.

The data is obtained f rom internal records and f rom District Offices.

D.

A panel of five knowledgeable engineers and engineering managers with an average of 25 years experience in turbine controls and val ves.

E.

1982 survey of owners of operating Westinghouse nuclear turbines - a detailed questionnaire requesting valve testing operation and maintenance information was sent out.

4-2 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 F.

Summary of a. Westinghouse Generic Reliability Data Bank search - A summary report of valve related incidents in the Data Bank was reviewed by STGD for relevant valve and control system malfunctions.

~

The data for the service years contained in the tabulation of basic event service experience includes botn fossil and nuclear unit experienc e.

For all components except the steam valves the service application and environment is identical, therefore, combining these experiences is appropriate. At the time of the original issue of this tabulation, plug type valves of similar construction, whether used on fossil or nuclear units, formed the data base for the Throttle Valve, and Governor (Control) Valve events.

At that time (1973) the preponder-ance of data were on fossil plug type valves.

This experience is valid since the fossil valves experienced a duty and an environment which was more severe, or at minimum equally severe, as that of nuclear units.

When the data were updated for this report, both fossil and nuclear valve data were included in the additional years of experience for

~

Throttle Valves and Governor (Control) Valves. For Interceptor and Reheat Stop Valves only, the data base was changed to nuclear valves exclusively since the type of valves used with nuclear turbines are not of the same type used in fossil applications, and a reasonable amount of experience years has been accumulated on these nuclear Interceptor and Reheat Stop Valves. The resultant probability of failure based on this nuclear valve data is expected to be conservative since this valve type has an excellent servica record but the service years are limited compared to those of other valves.

The data for the service (period years) was updated from the data referenced in the afore mentioned report for each of the basic events listed in Table 4.1-1.

The updated data is provided in Table 4.1-2.

E vents 1, 2, 12, 13, and 14 used [

la,c years as a conservative estimate of the accumulated e'xperience up to 1973 for these items. To this number, the additional experience for the units in service at the 4-3 SEPTEMBER 1982

'4EST!NGHOUSE. PROPR!ETARY CLASS 3 end of 1972 and for the units _placed in serv _ ice from 1973 through 1981 The new total became [

3a,c years.-

-wa*. added.

~

Events 3, _4, 6,- 7, 9,10 and 23 have service experience equal to the.

number of unit years of units with EH control systems.~ This number was-updated by adding to the original number the additional experience of those unt ts that were in service at. the end-of 1972 and the experience of those units placed into sevice between 1973-1981.

The new value becomes [

3a,c, Events 5, 8, 22 and -24 were updated in a manner similar to the. previous events. A factor of 3 times the unit years of experience was used because each turbine contains three identical or very similar devices.

Event 11 is based on sixteen times the number of EH unit years since each valve actuator contains a dump valve and there is an average of 16 actuators per turbine.

Events 16 and 19 were updated by adding to the previous number the addi-tional valve years for the units making up the original number plus the valve years for units put into service between 1973-1981. The new number of [

]a,c valve years includes all fossil and nuclear plug type valve experience.

Events 17 and 18 are based on 8 times the EH unit years, because there is an average of 8 servo valves and servo valve circuits on each EH unit.

Event 20 is based on 17 times the number of EH unit years. Each of these units has one check valve per actuator for an average of 16 per unit plus one check valve between the ETF headers.

Event-21 is based on the number of EH unit years minus 9 units with EH control systems of a design that had a different. speed detection circuit.

44 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 Event 25.is based on the experience of nuclear Interceptor Valves and Reheat Stop Valves that were put into service between 1969-1981.

These two valves are identical in design.

The malfunctions shown in the Basic Event Service Experience tabulation are defined as follows.

Any failure of the component to perform its designated function when called upon to do so.

These malfunctions are designated as relevant incidents. As applied to turbine steam inlet valves, relevant incidents or malfunctions are defined as f ailure of the valve to close on demand.

The number of malfunctions indicated considered all the sources identi-fied in paragraphs A thru F above.

4.1.2 COMPONENT FAILURE PROBABILITIES Every component was assigned to one of two failure classes -- failure on demand or time-related (stendby) failure.

The calculations performed to obtain probabilities for these two failure classes involve somewhat different approaches and so will be discussed separately.

In many cases, the computation for a single component was done both ways for comparison with generic f ailure data, which vary in this choice.

One selection was finally made for each component, however, as shown in the final column of Table 4.1-1.

4.1.2.1 Time-Related (Standby) Failure Calculations For components assigned to this class, failures werc assumed to occur at a constant rate, e.g., f ailures per million hours. The point estimate 50 percent and 95 percent upper confidence bounds (UCB) for these component failure rates were calculated using the equations:

4-5 SEPTEMBER 1982

L WESTINGHOUSE PROPRIETARY. CLASS 3 :

~

I

.i=

Poi nt 'E stimate T'

2f+2,0.50f 50 percent x( 0,5). = x 2T

2f+2,0.05) ~

95 perrent UCB x(0.95) =.x 2T'~

- Where:

f '= Number of. Observed Failures T' = Operating Time 2

and the arguments of the x distribution-are the number of degrees of. f reedom, taken as 2f+2, and the upper tail area of the distribution.

~

The latter is given by (1-confidence level), since we here calculate ~a one-sided i nterval.

For all components, the historic operating time T' was t.aken to be 0.78 times the calendar service time T calculated. f rom the.date of.com--

mercial operation, i.e. :

T' = 0.78 T For a. single component subject to f ailure at a constant rate' x and tested at intervals of a time units, its unavailability A is given by:

K = le

l 4-6 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS' 3 This is not the probacility that the device is in a f ailed state at the.

time of testing, gi ven by :

1-e **'re but the average risk that the device will be inoperable when a demand arri ves (the probability per. unit time bei ng assumed constant i.e.,

system separations are assumed to occur uniformly over the testing i nterval ).

4.1.2.2 Failure on Demand Calculations For components subject to f ailure on demand, the calculation is simi-lar.

Using p to distinguish the f act that the result is a probability we have:

Point Estimate p=

MT 2(2f+2,0.50) p(0.5) = y 50 percent 2MT p(0.95) = x ( 2f+2,0.05) 95 percent UCB gg Where the denominator MT is the number of demands, calculated from the actual calendar year service time T and a value M for the annual number of demands.

This value was conservatively derived by SIGD using engineering judgement and experience, f

The method by which the demand rate M was chosen is as follows:

4-7 SEPTEMBER 1982.

WESTINGHOUSE PROPRIETARY CLASS 3 The overspeed trip valve is tested monthly per Westinghouse's recoanen-dation.

In addition, every turbine trip opens this valve so that pos-sibly a dozen more challenges per year may be incurred.

The very con-servative choice of M = 6/yr was chosen for this valve.

All remaining components for which a demand failure probability was calculated were assumed to be tested annually for purposes of this report.

4.1.2.3 Selection Between High And Low Estimates Of Failure Experience The f ailure rates calculated f rom STGD data utilized in every case only the known f ailure occurrences.

In some cases, for this report:much higher incidence rates were conservatively assigned by SIGD to account for unreported f ailures.

These were in most cases comparable in magnitude to the 95 percent upper bounds applied to known f ailures, so that in the end, they were discarded as less amenable to verification, i.e., less reproducible or scrutable.

(They were, however, considered in verifying the data.)

A particularly useful comparison was made of f ailure rates for simi.lar components.

In some cases, the selection was made of a higher f ailure rate experienced in the similar component, where the degree of physical similarity and commonality in operating environment could be established.

4.1.2.4 Generic Data Search For every component an attempt was made to compare STGD's failure exper-ience with f ailure information from generic data sources.

The mainstay of this work was nuclear utility operating experience, as documented in the Westinghouse Generic Reliability Data Source which includes data from the Nuclear Plant Reliability Data System, the NRC Licensee Event Reporting System, the NRC Gray Book Reports and data collected inoependently by Westinghouse.

No attempt was made to adjust the data for trends in service time.

Thi s i s conservati ve si nce "i nf ant f ailures" decrease wi th time.

4-d SEPTEMBER 1982

WESTINGil0VSE PROPRIETARY CLASS 3 4

~ 1n addition-to the computer data base, a number of reports and other Campilations were used frequently.

These included in particular

[~EI-500, 4ASil-1400, the series of NUREG reports reflecting LER reports, and l prop rieta r/ f ailure flata compilations previously made by.

^

• lesti ng house.

Af ter a thorough review of STGD and generic data, a f ailure rate selec-tion was made.

Af ter di scussion with STGD eng: reers, apparent dif-ferences between Westinghouse and generic f ailure data were in every

. case-resolved in f avor of the Westinghouse data, which is obviously of maximum relevance. and which in every case showed adequate statistical preci sion.

Higher f ailure data f rom generic soun:es were examined with special attention before the STGD experience was adopted.

q en 1

k I

e 0 9 SEPTEMBER 1982 w

w

WESTfNGHOUSE. PROPRIETARY CLASS :3-

- TABLE 4.1-1

~

BASIC FAULT TREE EVENT FAILURE MODES BASIC EVENT DEVICE FAILURE MODE FAILURE TYPE 1.

Mechanical Trip Mechanism FT0 D.

2.

Auto Stop 011 Cup Valve FTO D

3.

20/AST Solenoid FTO D

4.

20/AST Actuation Train FT0 0

Fails Low D

5.

Speed Detector 6.

Interface Valve FTO-D

.7.

Interface ETF Drain Clogged S

FT0 0

8.

20/ET Solenoid FT0 S

9.

Pressure Switch 10.

Primary ETF Drain Clogged S

FT0 S

11.

Dump Valve 12.

ETF Drain to Trip Diock Clogged S

13.

Auto Stop Oil Clogged S

14.

Dump Valve Drain Clogged 5

15.

Not Applicable FTC

~S 16.

Throttle Valve FT0 S

17.

Servo Valve 18.

Servo Valve Circuitry Failed S

FTC S

19.

Governor Valve FTO D

20.

Check Valve 21.

Loss of Load Detection Failed S

22.

OPC or ET Speed Detection Fails Low S

l Failed S

23.

OPC Actuation Train FT0 0

24.

20/0PC Solenoid FTC S

25.

Reheat Stop/ Interceptor Valve I

FTC - Fails to Close l

FT0 - Fails to Operate - 1, 2, 3, 4, 8, 9, 11, 17, 24 FT0 - Fails to Open - 6, 20 i

S

- Standby Failure f

D

- Failure on Demand re or vnr:r t og?

+ ' < -

WESTINGHOUSE PROPRIETARY CLASS 3 TABLE 4.1-2 BASIC EVENT SERVICE EXPERIENCE Event Number Service = n-Malfunctions

~

~

a,c 2

3

~

4 5

6 7

8 9

10 11

~

12 13 14 15 16 17 18 19 20 21 22 23 24 25 0

4-11 SEPTEMBER 1982

-J

'ESTINGHOUSE-PROPRZETARY CLASS 3 4.2 FAULT TREE ANALYSIS This section discusses the fault tree analysis that was performed to estimate the probability of turbine overspeed and to determine the sensitivity of this event to changes in the valve test frequency. The following subsections discuss tree construction and quantification.

Results and conclusions are also presented.

4.2.1 FAULT TREE CONSTRUCTION Fault trees were constructed for three turbine overspeed conditions:

design overspeed, destructive overspeed, and intermediate (130 percent).

overspeed. These top events and the system failures associated with them are defined in Section 2.4 of this report.

The fault trees, presented as Figures 4-1 through 4-3, were developed in accordance with the system f ailure logic. For example, design overspeed occurs when the overspeed protection system fails at 103 percent overspeed, but the emergency trip system succeeds at 111 percent overspeed. Consequently, the design overspeed tree requires that one or more governor valve or interceptor valve remains open so that a steam path exists to E!ther a high or low pressure turbine.

The Westinghouse GRAFTER code was used to edit and maintain the fault trees on file.

Basic events were established that reflect the level of detail determined to be appropriate for this study.

These basic events, listed in Table 4.2-1, largely correspond to those developed in the 1974

-Westinghouse study previously mentioned.

It is these events for which failure probability estimates have been calculated as the initial step in the quantification process.

4.2.2 FAULT TREE QUANTIFICATION Table 4.2-2 lists the input probabilities calculated for each basic The statistical methods used in deriving these values are

. event.

4-12 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 explained in Section 4.1 The values in the Case A column of Table 4.2-2 were obtained using 95 percent confidence limits, while the the Case a values represent a 50 percent level of confidence.

Certain basic event probabilities depend on valve testing interval assumptions, that is, these elements are involved in the test procedure, and their input probabilities will be reduced if testing is done more frequently. These basic events are listed in Table 4.2-3.

Events 16 through 19 are dependent only on governor and throttle valve testing; events 11,14, and 25 are dependent only on interceptor and reheat stop valve testing.

Three testing intervals were examined in this study: yearly, monthly, and weekly testing.

Sensitivity runs were made for both the 50 percent and 95 percent confidence values. Each fault tree was therefore quanti-fied six times, with the following case designations:

A1 - 95 percent confidence values, yearly testing A2 - 95 percent confidence values, monthly testing A3 - 95 percent confidence values, weekly testing B1 - 50 percent confidence values, yearly testing B2 - 50 percent confidence values, monthly testing B3 - 50 percent confidence values, weekly testing

. System separation with sufficient steam supply is a precondition for. any overspeed event. This is represented in the fault trees by an "and" gate under the top event, and the trees have been quantified with the assumption of three separations per year. Also implicit in the quantification is the assumption that, for design and intermediate overspeed, the emergency trip system stops all steam flow to the high pressure turbine.

This latter assumption is treated in these trees as an undeveloped event with probability one.

Quantifications were performed using the WAMCUT computer code, and results are presented in Tables 4.2-4 through 4.2-6.

4-13 SEPTEMBER 1982

WESTINGHGUSE PROPRfETARY CLASS 3 -

4.2.3 EVALUATION OF RESULTS In addition to top event probabilities, Tables 4.2-4 through 4.2-6' list -

the dominant basic events for.each case.

This infomation,- detemined through examination of the fault tree cutsets, 'is meaningful in that it-identified the major contributors to turbine overspeed probability, and provides physical explanation of the demonstrated degrees of sensi-ti vi ty'.

Results for each overspeed condition are discussed below.

4.2.3.1 Design Overspeed The probability of design overspeed is conservatively estimated by the f ault tree analysis perfomed for this study to be no greater than 3.8 x This value is taken from Table 4.2 4, Case A1, in 10-2 per year.

which 95 percent confidence values are used,- an annual testing interval is assumed and system seperation (initiating event) that does not result Thi s in immediate turbine-trip is assummed to occur 3 times per year.

latter assumption is extremely conser'.ative for the Farley plant. As

. discussed in section 2.0 a sys+.em seperation at Farley results in a turbine trip.

Not having the ':urbine tripped at the onset of an -

overspeed condition is necessary for design overspeed to occur.

Nevertheless, for purposes of evaluating the sensitivity of design overspeed probability to valve testing frequency, this feature may be ignored.

It will be considered however in discussions of missile generation probability.

As shown in the table, design overspeed is relatively insensitive to valve testing interval.

If monthly rather than yearly testing is assumed, the top event probability is reduced by less than a factor of 3.

Furthemore, increasing the testing frequency from once per month to

.once per week - Cases A2 to A3, and B2 to 83 -- has -virtually no effect on the. top event value.

i The reason for this insensitivity is that the basic events that contri-

.bute most to the design overspeed probability, [

]a,c, are not involved 4-14 SEPTEMBER 1982

. =...

~

WESTINGliOUSE PROPRIETARY CLASS 3 in the valve test procedure.

Failure of [

3a,c is a tertiary contributor to design overspeed. This event is sensitive to valve testing and is the source of the approximately [

~

la,c reduction in top event probability from yearly to monthly te sti ng.

4.2.3.2 Intemediate Overspeed As shown in Table 4.2-5, the probability of intermediate (130 pen:ent) overspeed is conservatively estimated to be no greater than 6.8 x 10-5 per year, assuming annual valve testing and using 95 percent confidence values. A more realistic estimate, based on 50 percent con-fidence values, provides a probability of 7.2 x 10-6 per year.

Also shown in the table is the sensitivity of the top event to changes in testing frequency.

Intemediate overspeed demonstrates significant sensitivity -- approximately a factor of 20 -- if yearly and monthly cases are compared.

The monthly to weekly sensitivity, however, is little more than a factor of 2.

This phenomenon is due to the presence, in the yearly testing cases (Al and 81), of dominant cutsets involving

[

3.a,c The magnitude of these cutsets is reduced in going from yearly to monthly testing.

The reduction in relative importance of these cutsets also explains why further decreasing the testing interval from monthly to weekly testing has relatively min,or impact.

4.2.3.3 Destructive Overspeed The probability of destructive overspeed, listed in Table 4.2-6, is conservatively estimated (Case A1) to be no greater than 6.7 x 10-6 per year, and a more realistic estimate (Case B1) can be taken as approximately 2.2 x 10-6 per year.

Destructive overspeed, similar to intermediate overspeed, exhibits significant sensitivity if one considers yearly versus monthly testing.

Again, the sources of this sensitivity are dominant cutsets involving 4-15 SEPTEMBER 1982

WESTfNGH00SE PROPRKETARY-CLASS :3' two elements -- fe. [

Ja,c' __ both of which -are involved in the valve test procedure.

These sensitive cutsets are greatly reduced in' relative importance.for the monthly cases (A2 and B2).

Consequently. little L

-e'ffect is observed, with respect to ~ top event probability, when the testing interval is further reduced from-one month to one week.

4.2.3.4 ; Summary In summary, it has been shown that design overspeed demonstrates ' rela-tive insensitivity to valve test frequency.

Intermediate and destruc-tive overspeed, conversely, do exhibit significant sensitivity to changes in testing frequency.

However, it should be noted that the probability estimates for these eve'nts are consistent with guidelines 4

established in Regulatory Guide 1.115, " Protection Against Low Trajectory Turbine Missiles".

The relationship.of overspeed probability to missile generation, and the i

contribution of fault tree analysis to the conclusions of this study are.

~

discussed in ' subsequent sections of. this report.

i 1

4-16 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 TABLE 4.2-1 FAULT TREE BASIC EVENTS EVENT NUMBER EVENT JESCRIPTION 1

Mechanical Trip Mechanism failure 2

Auto Stop 011 Cup Valve failure 3

20/AST Solenoid failure 4

20/AST Actuation Train failure 5

Speed Detector failure 6

Interface Valve failure 7

Interf ace ETF Drain clogged 8

20/ET Solenoid -f ailure 9

Pressure Switch failure 10 Primary ETF Drain clogged 11 Dump Valve stuck closed 12 ETF Drain into Trip Block clogged 13 Auto Stop 011 clogged 14 Dump Valve Drain clogged 15 Not applicable to study 16 Throttle Valve stuck open 17 Servo Valve f ailure 18 Servo Valve Circuitry failure 19 Governor Valve stuck open 20 Check Valve failure e

21 Loss of Load Detection failure 22 OPC or ET Speed Detection failure 23 OPC Actuation Train failure 24 20/0PC Solenoid Pair failure Reheat Stop/ Interceptor Valve stuck

~

25 open 4-17 SEPTEMBER 1982

m WESTINGH00SE PROPRIETARY CLASS 3..

I I

TABLE 4.2-2~

BASIC EVENT INPUT PROBABILITIES

'i EVENT.

CASE A (95 PERCENT)

(CASE B (50 PERCENT) 4 k

~

&,C 3

g.

'3 I

4.

5

-6 7

8 9

10

~

11 12 13 a

p

'14 15 16

~

17 18 19-20-4 21 22 23 t

24 25 4-18 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3..

TABLE 4.2-3

. INPUT PROBABILITIES FOR SASIC EVENTS SENSITIVE TO VALVE TESTING INTERVAL ASSUMPTIONS CASE A (95 PERCENT)

(CASE B (50 PERCENT)

EVENT 11 a,c

1) Yearly Testing

2) Monthly Testing

3) Weekly Testing EVENT 14

1) Yearly Testing

2) Monthly Testing

3) Weekly Testing EVENT 17

1) Yearly Testing

2) Monthly Testing

3) Weekly Testing EVENT 18

1) Yearly Testing

2) Monthly Testing

3) Weekly Testing EVENTS 16 AND-19 i

1) Yearly Testing

2) Monthly Testing

3) Weekly -Testi ng EVENT 25

1) Yearly Testing

2) Monthly-Testing

3) Weekly Testing 4-19 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 TABLE 4.2-4

. DESIGN OVERSPEED PROBABILITIES CASE PROBABILITY DOMINANT BASIC EVENTS a,c A 1.

3.8E -2 4

A2

1. 6E -2

-A3

1. 4E.

81

1. 2E-2 82 4.SE-3 B3 4.3E-3 TABLE 4.?-5 INTEREDIATE (130 PERCENT) OVERSPEED PR08A81LITIES CASE-PROBABILITY DOMINANT BASIC EVENTS a,c A1

6. 9E-5 A2 3.4E -6 A3

1. 5E-6 81 7.2E-6 82 5.5E-7 B3 2.9E -7

~

l.

1 4-20 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 TABLE 4.2-6 o

OESTRUCTIVE OVERSPEED PROBABILITIES CASE PROBABILITY DOMINANT BASIC EVENTS l

a,c A1

6. 7E-6

-A2

3. 5E -7 A3

1. 4E -7 81 2 '. 2E -6 B2

8. 3E -8 B3

'. 1E -8 j

4-21 SEPTEM8ER 1982

1 i

WtSilNbNuubC PKUVKICIMMt bLnJJ J 4.3 STATISTICAL EVALUATION DF TESTING INTERVAL AND VALVE FAILURE The data can be represented as follows:

Testing Schedule Exposure (valve-hours)

Failures a,C Weekly Monthly Every 2 weeks Not regular i

These data invite the computation of f ailure rates (number of failures

. per valve-hour) for each testing schedule followed by appropriate com-

' pari sons. The question of whether the calculated rates are sufficiently different to constitute evidence of real differences among schedules naturally arises. This section discusses this question and related

,i ssues.

The working assumption for this discussion is that within any testing schedule, failures occur randomly over time at a constant rate which is characteristic of the particular schedule. This is a very natural assumption that is used f requently in dealing with data involving the Based on this occurrence of a more or less rare event over time.

assumption, the number of f ailures in exposure-time t while using a given testing schedule has a Poisson distribution with parameter The quantity A is the f ailure rate mentioned above and assuaed a = At.

constant within any testing schedule.

Using the weekly schedule as an example, there was [

]a,c valve-hours.

Denoting parameter estimates as a and A we have

~

a,c i

f ailures per valve-hour, l

t w

Once an estimate for A, i.e.

A, is available, one can estimate the

[

parameter of the Poisson distribution that would govern the number of failures under a weekly testing schedule for any number of valve-hours l

SEPTEMBER 1982 4-22 t

I w

WE5TINGHOUSE PROPRIETARY CLASS 3 For example, the number of f ailures in [

3a,c of exposure.

valve-hours would be estimated to have a Poisson distribution with

].a,c Notice parameter [

that the monthly schedule had an exposure of about [

b 3,c was observed.

Does this mean that the monthly schedule involves a lower failure rate than the weekly, or does the variability inherent in the Poisson distribution readily explain this discrepancy ? This exemplifies the kind of question to be dealt with in the remainder of this section.

One way to summarize the information about the underlying failure rate

( A) contained in a given set of data is to compute a confidence interval for this unknown parameter.

Using classical methods one can state that if 1-failure has been observed then a 95 percent confidence interval for the Poisson parameter a is 0.25 < u < 5.57 Since u = at this means that 0.25/t < x < 5.57/t with 95 percent confidence. For the weekly data then, since [

3,a,c we find 3 'C ( weekly) 8

[

while for the monthly data [

]b,c we find 3a,c (monthly).

[

These intervals convey what we know about the values of 1 under the two Each interval schedules in a way that reveals the uncertainty involved.

gives the values of x that are reasonably consistent with the corres-The chosen confidence coefficient of 95 percent ponding set of data.

sets the standard for what is to be regarded as " reasonable".

For given 4-23 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 data, incre6 sing the coefficient merely enlarges the interval.

The confidence intervals for the failure rates under weekly and monthly testing have a considerable overlap. This says that the difference

• between the observed rates [

3a,c could easily arise f rom chance alone in the absence of any real difference. While

~

the two confidence intervals are of interest in themselves as a summary of what the data say about the individual f ailure rates, a more direct approach for the comparison of the two failure rates is available.

Under the Poisson assumptions, it is possible to calculate a confidence interval for their ratio. The ratio of the weekly to the monthly f ailure rate may be estimated from the data to be [

]a,c and the 95 pen:ent confidence interval is

[

Ja,c (weekly / monthly ).

For the f ailure rates to be judged different on the present data, this interval would have to exclude the value 1.

This shows once again that even though the observed rates are different [

3a,c such a result is quite consistent with the true rates being equel (p = 1).

Of course, the confidence interval is quite bread.

This means that the amount of data is not sufficient to give a very precise cocparison of the two rates.

Ironically, the precision would improve if there were more f ailures. On the other hand, a greater exposure would not help the precision of the comparison.

Greater exposure would, however, help the precision of the estimates of the individual rates.

This points to the importance of considering the magnitudes of the individual rates as well as their compari son.

If they are both quite small, it is not possible to make a precise comparison; correspondingly, in such a case it probably does not matter which rate is larger.

The data for the other testing schedules do not add much to the above analysi s.

The every-other-week schedule is based on only one unit and hence does not have a ~ sufficiently broad base to be analyzed by itself 4-24 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 while the non-regular testing regimen suf fers from the data-paucity syndrome mentioned above [

3.a,c For completeness we will combine the first three data sets into one which represents the practice of regular testing and compare this with the remaining set The data which represents the absence of a regular-testing schedule.

may then be represented as Regular Testing Exposure (valve-hours)

Failures

~

a,c Yes

'No The 95 percent confidence intervals for the individual failure rates are:

9 a,c (regular)

(not regular) a Again there is considerable o,verlap between these intervals, and there-fore the data fail to reject the propositon that the two testing regi-mens have the same underlying f ailure. rates. The 95 percent confidence interval for the ratio of the two f ailure rates is

[

]a,c (regular /nct regular)

With an estimated value of $ = 1.12.

The interval does not exclude the value 1 and therefore provides no basis for concluding.that the underlying rates are different.

The overall failure rate estimate based on all the data (that'is, assuming there is no dependence of failure rate on testing regimen) is

[

la,c f ailures per million valve-hours. The 95 percent confidence interval for this overall A is

[

3a,c (overall) 4-25 SEPTEMBER 1982

'ESTINGHOUSE PROPRIETARY CLASS 3 Based on this analysis we conclude-that these data.give no evidence of a dependence of f ailure rate on -testing interval. - Moreover, under the assumption of a single failure rate these data would put that rate at

].a,c between [

i 4

4-26 SEPTEliBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3

, =, - - -

T

1..

,.E

.i A

o.

., ~_

. i.

u f

g ig

..ga

-.- L

... a g Q--

.a

-_~

l 6

~. -.

N

- m s

,,O g

O

[..,_. _

=

I 1,

i I

t I,

I v.

n.

\\

. :::.* *=

l== a- !.:.:- ===

:t -

.:. = _

.=

2=

t

. :.a."

a I

l l

P f

Figure 4-3. Intermediate (130%)

Overspeed Fault Tree

.i i

4-29 September 1982

l 6-

..L.-CD-j!

'l i,

i 9

i

-! -O,i L

~!

'sI' s!

ii 4

~

'I

~

s I

I

.i ii F

~k-~lI h~

l 3

'I g

1 it II l!

G 8

I O

[

~

~

..I 5!

i, al g

~

g

~s g!

l<

i e

Il

--CD-!. 4!

-0,i

-! -0.1 11

-l' 2

4-4l e

~._

t, Il 3

s s

-8, -<E-li.!4' 18 il -Oi!

i.

i!

-l dl l

l, lll O

-

WESTINGilot SE PROPRIETARY CLASS 3 H.

Complete Loss of Flow. This transient may result from a simultane-ous loss of electrical supplies to all reactor coolant pumps.

The inenediate effect of loss of coolant flow is a rapid increase in the coolant temperature, but the reactor trip on reactor coolant pump bus undervoltage avoids any fuel damage. A comparison of the core flow and power with and without offsite power for steamline break accident (WCAP-9226), showed the case with offsite power is more limiting than the case without offsite power.

Hence, the FSAR DESLB analysis will bound the cooldown phase of complete loss of flow.

5.2.6.2 Accidents Considered It has been demonstrated that potential failure of the turbine stcp valves is a very low probability event.

In considering the transients additional f ailures were assumed to increase the severity of the tran-The various accidents (Condition III and IV events) include sients.

events where a break is assumed in the secondary piping and those events where the secondary side is not breached.

r For those events where the secondary side is intact, the results are very similar to those presented for the transients.

Namely, the con-sequences are nearly identical to those presented in the FSAR if all the MSIV's function and if further conservative assumptions are raade, the results will be only slightly worse than the SAR case.

For the steamline break and the feedline break, the SAR results will be bouriding if all the MSIV's function or if the MSIV fails in the faulted loop. The assumed case of a failed MSIV pair in another loop, causing multiple steam generator blowdown is discussed in Section 5.4.

5.3 LOCA ANALYSIS The impact of no turbine trip on small or large break LOCA and steam generator tube rupture was qualitatively assessed with the following results:

5-13 SEPTEMBER 1982

WESTING 110VSE PROPRIETARY CLASS 3 A.

For all cases, proper operation of the MSIV's wili preclude any significant ef fect.

Steamline isolation occurs very early in the-

.c large break LOCA accident, thus mitigating any cooldown at its start.

Steamline isolation'would occur as a result of the blowdown for many of the small break cases initially allowing a cooldown to This cooldown would result in greater heat removal capabil-occur.

ity in the steam generators which would be a-benefit improving analytical results.

In the case of a steam generator tube rupture, MSIV's closing may be accomplished either manually by procedural action or automatically due to the blowdown.

In any event, the blowdown would be short term and have only minor impact.

1 B.

In the extreme situation that one steam generator remains unisolated and the turbine does not trip, small break LOCA would again be benefited by the increased blowdown.

For large break LOCA, a blowdown of a steam generator, in addition to the LOCA, could result in some small increase in calculated peak clad temperature.

However, the impact would not result in a significant increase in radiological release.

The consequences of failure to isolate a steam generator in conjunc-tion with no turbine trip are probably most significant for the case of a steam generator tube rupture.

If the blowdown occurred in the faulted steam generator, releases would be. increased and the break flow would continue until the primary system could be depressurized to nearly atmospheric pressure.

If the blowdown occurred in a non-faulted steam generator, the consequences of a tube rupture would not be significantly different.

The scenarios in B above for a typical plant are extremely unlikely.

The three events of concern must first occur, followed by failure to isolate one steam generator and additionally, f ailure to trip the turbine.

For a plant with a single MSIV in each steam line, the most i

likely of these scenarios would occur with a probability of approximately 10-9 For the special case of Farley Nuclear Plant, the w

WESTINGHOUSE PROPRIETARY CLASS 3 redundant MSIV's in each steamline preclude a single MSIV f ailure The scenarios in 8 resulting in non-isolation of a steam generator.

then would became even more improbable. For the Farley Plant, failure of the turbine to trip following a LOCA or tube rupture would not exceed the licensing basis, even assuming single f ailure of a MSIV.

~

HULTI-STEAM GENERATOR BLOWDOWN 5.4 Westinghouse in conjunction with the Westinghouse Owner's Group (,WOG),

has been involved in evaluating the ramifications of multi-steam generator blowdown. Westinghouse is preparing an emergency operating procedure for the WOG which will eventually be submitted to the Nuclear It Regulatory Commission along with the appropriate basis document.

should be noted that Farley Nuclear Plant has redundant MSIV's in each stemnline, i.e. a single failure will not result in an unisolated steam generator.

O 1

t 0

O k

5-15 SEPTEMBER 1982 r-

WESTINGHOUSE PROPIETARY CLASS 3 0

~

t INITIATING TRANSIENT TURBINE TR NO (~10 5)

L YES S

( ~ 10~4)

(FOR TWO_MSIV IN SERIES)

YES TUCK OD

( ~ 10-4)

NO SECTION SECTION SECTION SECTION 5.2.S 5.2.4 5.2.3 5.2.2 l

{

l Figure 51 Flow Diagram September,1982 i

t

WESTf?!GHOUSE PROPRTETARY CLASS 3 L

.29000

~

22500h l

~

20000 +

[

~$

17500 J

~~

15000 --

5E 12500 -

i 10000 -

u

[

g5

.07500 -

o *

.05000 -

02500 -

0. 0 i

2500.0 l

i 2000.0 -

g a$q 1500.0 -

x uS 1000.00 -

S-u, v*

500,00 - -

G. 0 e

600.00 550.00 -

g 500.00 ~

w 450.00 - -

-w a

.i!! M 400.00 - -

~~

350.00 -

300.00 - -

t an.00 a

e o

e oo o

o e

o 8

d_

d 5

5 N

a

~

l TIME (SEO FIGURE 5-2 TYPICAL RWAP - FSAR ANALYSIS CASE A September,1902 5-17

WtdtIribnUUdt. FRuPKitlAKY LLM33 J

.25000 I

22500 -

T 7

EE 20000 -

cj

, 17'00 7

.15000 -

y

-[8 12500 - -

- w 10000 - -

• 5 1

. 07500 -

L 1

.05000 -

f 32500 - -

G. 0 2500.O

~

2000.0 -

w

$0q 1500.0 - -

w=

• me 1000. 00 -

-~

m

(.o

~~

500.00 - -

0. 0 1

600.00

+

~

~~

550.00 -

C 500.00 - -

450.00 -

-wo I a 400. 00 - -

350.06 -

300.00 -

258'

• 5 g

i N

8 8

8 8

8 8

c

~

~

l 1114E (SEC i

NO TT ON RT,itISV CLOSED l

FIGURE 5-3 TYPICAL RWAP CASE B i

(

S-10 l

September.1982

-4ESTINGHOUSE PROPll!El ARY C1. ASS 3 23000 'I 22500 EE 20000 I I

O g 17500 - -

15000 - -

7 o

12500 - -

w y

10000 -

~

W=

.07500 -

.05000 - -

.025c0 - -

m

0. 0 l

l l

2500:0 l

l 2000.0 - -

w*

1

s l

Oq 1500.0 - -

w

= mg 1000,00 -

e u

500.00 - -

I

a. a -

I 600.00

\\

t

(

550.00 -

3 500.00 -

450.00 -

"J ug 400. 00 - -

=

~~

350.00 -

=-

300.00 -

E

e. -- -

e 250.00 y

8 e

o a

o e

s_

s s

a, S

8 o

m

~

TIME (SEO l

l l

FIGURE 5-4 TYPICAL RWAP - NO TT ON RT, MSIV FAILURE, NO STUCK l

R00 -

CASE C l

t September.1082 5-19 1

__ _ _ ~

WESTINGHOUSE PROPRIETARY CLASS 3 L-

. M,000 22500 -

7~

5g 20000 -

cc

!7500 -

l 15000 -

f 3~'~

~~~ ~

~

s y,25 12500 -

\\

/

10000 -

v g $

.07500 -

s

.05000 - -

v

.02500 -

0. 0 f

2500.O

^

s n

2000.0 -

w B

l2 q 1500.0 -

i N3

%(

e 1000.00 -

0

~

a*

500.00 -

0. 0 600.00 550.00 -

3 500.00 -

N

_ _ s.

_i 450.00 - -

s a

W_ 40C. 03 -

350.00 - -

300,00.- -

4 8

8 8

8 8

s_.

8 s

8 8

8 a

o

=

~

m I

l TIME (SEC)

---

DESLB TIME AT TRIP OF RWAP = START OF STEAMLIffE BREAK

• =

i TYPICAL RWAP - NO TT ON RT, MSIV FAILURE, STUCK l

FIGURE 5-5 ROD - CASE D l

September,1032 c-20 a

WESTINGH0USE PROPRIETARY CLASS 3

6.0 CONCLUSION

S The intent of this report was to evaluate the influence of turbine valve testing on turbine trip system reliability and discuss the necessity of having technical specification requirements on turbine valve testing.

The approach taken was to evaluate based on current data the physical aspects of testing, the probabilistic aspects of testing and the analytical aspects of testing.

To aid in summarizing the results of these various sections of the report, each will be discussed individually followed by an overall summary.

6.1 VALVE TESTING In Section 3 it was concluded that valve failure is independent of periodic valve testing. This conclusion was based on the undemonstrated ability of valve testing to identify f ailure precursors and influence valve lifetime by identifying necessary repairs.

This conclusion was supported statistically in Section 4 by comparing observed failure rates for different testing schemes.

The result of this statistical evalua-tion was that there was no difference in valve failure rates for weekly, monthly or irregular testing. Westinghouse then, is confident in stat-ing that though' periodic testing does influence calculated valve avail-ability, periodic testing does not influence valve failure rate and that increasing the test interval will have no adverse impact on the valve f ailure rates.

6.2 TURBINE OVERSPEED AND MISSILE GENERATION Three cases of overspeed were evaluated to detennine the impact of increasing the valve test interval on turbine overspeed probability.

Those cases were destructive overspeed, design overspeed and intennedi-ate (130 percent) overspeed. Further each overspeed event was viewed the with respect to the ability to generate a missile assuming that particular overspeed event occurred.

These overspeed events are dis-cussed separately below.

6-1 SEPTEMBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 Destructive Overspeed The probability of destructive overspeed (which is also the probability of no turbine trip) was shown to be less than 7 x 10-6 per year considering yearly testing of turbine valves, using a 95 percent UCB estimate of valve failure rate and 3 separations per year. Assuming a missile is generated whenever destructive overspeed is reached results in a missile generation probability of the same value

(<7 x 10-6 per year).

This value is well below missile generation probability guidelines established by Spencer H. Bush in, " Probability of Damage to Nuclear Components Oue to Turbine Failure" and Regulatory Guide 1.115, " Protection Against Low' Trajectory Turbine filssiles".

Intermediate (130 percent) Overspeed - The probability of a 130 percent overspeed event using a 95 percent UCB was shown to be approximately 7 x 10-5 without on-line valve testing.

A true probability of missile generation at 130 percent overspeed was not available for this report, however, it is believed that the conditional probability of generating a

~

missile at 130 percent overspeed would be at least one order of msgnitude lower than the conditional probability of generating a missile at destructive overspeed.

This value would be approximately equal to that for missile generation at destructive overspeed.

Design Overspeed - The probability of missile generation at design overspeed has been shown to be [

3a,c using the fault tree approach, taking credit for the particular protective features at Farley and using a P2 value associated with a five year inspection interval of LP discs.

Using operating experience and assuming a five year LP disc inspection results in a missile generation probability of

[

]a,c per demand.

Using either approach results in a low design overspeed missile probability.

Concerning the impact of increasing valve test interval, the evaluation of design overspeed showed little sensitivity to performance of less l

frequent testing i.e. this event is not driven by the frequency of t'esting but rather the probability of component f ailure which is

WESTINGHOUSE PROPRIETARY CLASS 3 independent of test interval. The insensitivity of this event to test interval does not support maintenance of f requent testing now being perfomed.

s Missile generation probabiliues for all cases of overspeed analyzed for this report are low when compared to published guidelines even consideri ng yearly testing. The current requirement to test turbine values weekly is not supported by these results.

6.3 SAFETY ANALYSIS Section 5 of this report demonstrated the acceptability of not tripping the turbine in terms of the accident analysis.

For Condition 1, 11, 111 and IV non-LOCA events (excluding continued multi-steam generator blow-down) the FSAR was shown to be bounding.

In the case of LOCA type events and multi-steam generator blowdown the Farley MSIV arrangement precludes a single f ailure resulting in an unisolated steam generator rendering the consequences of no turbine trip insignificant.

Addi tion-ally these events were shown to be highly improbable.

6.4 StiMMARY Based on the results of this study Westinghouse is confident that test-ing turbine valves no more frequently than yearly is adequate to satisfy any concerns associated with turbine trip system malfunction as it impacts licensi ng requirements.

This conclusion is primarily based on the high reliability of the turbine trip system and the minimal conse-quences associated with its failure.

Concerning technical specification requirements on turbine valve testing the following should be considered. An evaluation of the f requency of occurrence of turbine shutdowns showed that on the average a plant shuts down 6 times a year. Even if a plant shuts down only to refuel, the average refueling period is 1 year and the turbine value test require-ment is satisfied and, it might be added, independently of technical 6-3 SEPTE.MBER 1982

WESTINGHOUSE PROPRIETARY CLASS 3 l

specification requirements.

Based on the foregoing discussion, Westing-house does not see a need for continuance of the technical specification requirement on turbine valve testing.

e O

O