ML20034G923
| ML20034G923 | |
| Person / Time | |
|---|---|
| Site: | Beaver Valley |
| Issue date: | 02/28/1993 |
| From: | Gore B, Lloyd R, Moffitt N, Rossbach L, Sena P, Vehec T, Vo T Battelle Memorial Institute, PACIFIC NORTHWEST NATION, NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | Office of Nuclear Reactor Regulation |
| References | |
| CON-FIN-L-1310 NUREG-CR-5835, PNL-7925, NUDOCS 9303120101 | |
| Download: ML20034G923 (40) | |
Text
.
-1 PNL-7925 l
a Auxiliary Feedwater System g
Risk-Based Inspection Guide for Lthe Beaver Valley, Units 1 and 2 Nuc~ ear Power Plants 1
~
'f l
- j Prepared by -
R. C. Lloyd, T. A. Vehec, N. E. Moffitt, B. F. Gore, T. V. Vo/PNL
_l L W. Rossbach. P. P. Sena III/NRC Pacific Northwest Laboratory Operated by Battelle Memorial Institute-Prepared for U.S. Nuclear Regulatory Commission l
1;
~
i
{BA**8ssZi88llg4
E e
AVAILADILITY NOTICE Avallabiltty of Reference Matonats Cited in NRC Pubitcations Most documents cited in NRC publications will be available from one of the following sources:
1.
The NRC Public Document Room,2120 L Street, NW.. Lower Level, Washington, DC 20555 2.
The Super 6ntendent of Documents, U.S. Government Printing Off6ce, P.O. Box 37082, Washington, DC 20013-7082 3.
The National Technical information Service, Springfield, VA 2216t Although the !! sting that follows represents the majority of documents cited in NRC publications, it is not htended to be exhaustive.
Referenced documents aval:able for inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda; NRC bulletins, circulars, information notices, inspection and hvostigation notices; heensee event reports; vendor reports and correspondence; Commis-slon papers; and applicant and licensee documents and correspondence.
The following documents in the NUREG series are avaltable for purchase from the GPO Sales Program; formal NRC staff and contractor ieports, NRC-sponsored conference proceedings, international agreement reports, grant publications, and NRC booklets and brochures. Also eval!able are regulatory guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission issuances.
Documents aval!able from the National Technical information Service include NUREG-series reports and technical reports prepared by other Foo9ral agencies and reports prepared by the Atorr:lc Energy Commis-slon, forerunner agency to the Nuclear Regulatory Commission.
Documents available from public and special technical libraries hclude all open !!terature items, such as boolcs, joumal articles, and transactions. Federal Register notices Federal and State legislation, and con-gressional reports can usually be obtained from these libraries.
Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference pro-ceedings are available for purchase from the organlZation sponsoring the publication cited.
Single copies of NRC draft reports are avaflable free, to the extent of supply, upon written request to the Office of Admhistration, Distribution and Mall Services Section. U.S. Nuclear Regulatory Commission, Washington, DC 20555.
Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, for use by the public. Codes and standards are usually copyrighted and may be purchased from the originating orgarcation or, if they are American National Standards, ftom the American National Standards Institute,1430 Broadway, New York, NY 10018.
DISCLAIMER NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government.
Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, er. pressed or imphed, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights.
NUREG/CR-5835 PNIr7925 Auxi:Liary Feecwater Sys':em Risk-Basec Insaection Guide for
~:ne Beaver Valey, Units 1 ancL 2 Nue:Lear Power P an=s Prepared by R. C. Uoyd, T. A. Vehec, N. E. Moffitt. II. F. Gore, T. V. Vo/PNL L W. Rossbach, P. P. Sena III/NRC Pacific Northwest Laboratory Operated by Battelle Memorial Institute Prepared for U.S. Nuclear Regulatory Commission 788 '!8an 38888 6 Q
l E
L l
P
[
i AVAILABluTY NOTICE Availability of Reference Materials Cited in NRC Pubhcations l
Most documents cited in NRC publications will be available from one of the following sources:
1.
The NRC Public Document Room. 2120 L Street, NW., Lower Level, Washington, DC 20555 2.
The Superintendent of Documents U.S. Government Printing Office, P.O. Box 37082, Washington, DC 20013-7082 3.
The National Technical information Service, Springfield, VA 22161 Atthough the listing that fobows represents the majority of documents cited in NRC publications, it is not f
latended to be exhaustive.
Referenced documents avaEable fer inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda: NRC bulletins, circulars, information notices, inspection and investigation notices; licensee event reports; vendor reports and correspondence; Comrnis-slon papers; and applicant and licensee documents and correspondence.
The following documents in the NUREG series are available for purchase from the GPO Sales Program:
formal NRC staff and contractor reports, NRC-sponsored conference proceedings, intemational agreement '
reports, grant publications, and NRC booklets and brochures, Also avaltable are regulatory guides. NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission issuances.
Documents available from the National Technical informatlun Service include NUREG-series reports and l
technical reports prepared by other Federal agencies and reports prepared by the. Atomic Energy Commis-alon, forerunner agency to the Nuclear Regulatory Commission.
3 I
Documents available from public and special technical libraries include all open literature items, such as
[
books, journal articles, and transactions. Federal Register notices Federal and State legislation, and con-l gressional reports can usually be obtained from these libraries.
Documents such as theses, dissertations, foreign reports and trans!ations, and non-NRC conference pm-ceedings a,'e available for purchase from the organization sponsoring the publication cited.
i Single copies of NRC draft reports are available free, to the extent of supply upon written request to the Office of Administrat6on, Distribution and Mall Services Section. U.S. Nuclear Regulatory Commission,
+
Washington, DC 20555.
r Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library,7920 Norfolk Avenue, Bethesda. Maryland, for use by the public. Codes and j
standards are usually copyrighted and may be purchased from the originating orgardration or, if they are American National Standards, from the American National Standards institute,1430 Broadway, New York, NY 10018.
j i
i DISCLAIMER NOTICE l
This report was prepared as an account of work sponsored by an agency of the United States Government.
Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclorAd in this report, or represents that its use j
by such third party would not infringe privately owned rights.
l S
i A
y
__a 3
i NUREG/CR-5835 PNL-7925 Auxiliary Feedwater System Ris1-Based Inspection Guide for the Beaver Valley, Units 1 and 2 Nuclear Power Plants Manuscript Completed: January 1993 Date Published: February 1993 j
Prepared by R. C. IJoyd, T. A. Vehec, N. E. Moffitt, H. F. Gore, T. V. Vo, Pacific Northwest l2boratory L W. Rossbach, P. P. Sena III, U.S. Nuclear Regulatory Cornmission Pacific Northwest Laboratory Richland,WA 99352 Prepared for Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555 NRC FIN L1310 9
?
. _.. =
i l
1 i
Ahstniet i
i t
in a study sponsored by the U.S. Nuclear Regulatory Commission (NRC), Pacific Northwest laboratory has developed j
l and applied a methodology for deriving plant-specific risk-based inspection guidance for the auxiliary feedwater t
(AFW) system at pressurized water reactors that have not undergone probabilistic risk assessment (PRA). This methi odology uses existing PRA results and plant operating experience information. Existing PRA based inspection puid-'
ance information recently developed for the NRC for various plants was used to identify generic component failure modes. This information was then combined with plant specific and industry-wide component information and failurc l
i data to identify failure modes and failure mechanisms for the AFW system at the selected plants. Beaver Valley Units 1 and 2 were selected as two of a series of plants for study. The product of this effort is a prioritized listing of AFW failureswhich have occurred at the plant and at other PWRs. This listingis intended for use by NRC inspectors in the
{
preparation of inspection plans addressing AFW risk-important components at Beaver Valley Units 1 and i
'k i
W 9
1 1
i b
r L
1 i
lii NUREG/CR-5835 I
l 1
d
-. u a
r
?
t Contents
'f
)
L
.......,......................iii Abstract.
i
........................................ VU Summary.
r i
1 Introduction.
' 1.1 2 Beaver Valley AFW System......
2.1 2.1 System Description Beaver Valley Unit 1..........
2.1 '
2.2 j
2.2 System Description Beaver Valley Unit 2...
2.3 Success Criterion......................
2.3 i
2.3=
2.4 System Dependencies.
' 2.3
}
2.5 Operational Constraints....
.r.
3.1 3 Inspection Guidance for the Beaver Valley AFW System t,
3.1 Risk Important AFW Components and Failure Modes......
3.1 i
3.1.1 Multiple Pump Failures due to Common Cause.....................................
.3.1 3.1.2 'Ibrbine Driven Pumps P.2 or 22 Fail to Start or Run........
3.2 3.1.3 Motor Driven Pumps 3(23)A or 3(23)B Fail to Start or Run.............
3.3 3.1.4 Pumps Unavailable Due to Maintenance or Surveillance..
3.4 3.1.5 Air Operated Flow Control %1ves Pail Closed...................
3.4 -
i 3.1.6 Motor Operated Isolation and Throttle Valves Fail As.ls.......
3.5 t
3.1.7 Manual Suction or Discharge Valves Fail Closed.....................................
3.6 3.1.8 1.cakage of Hot Feedwater through Check Valves:........................
3.6
.q r
3.7
{
3.2 Risk Important AFW System Walkdown 'Pable..,...............
4 Generie Risk insights From PRAs.............
4.1 1
4.1 Risk Important Accident Sequences invoh-ing AFW System Failure................
4.1 4.1.1 Loss of Power System....
4.1 4.1.2 Ransient-Caused Reactor or Wrbine Rip............................................
4.1 '
j 4.1.3 Loss of Main Feedwa ter.......................................................
4.1 l
4.1.4 Steam Generator %be Rupture (SGTR)........
4.1 1
4.2 Risk Important Component Failure Modes......
4.1
.r 5 Failure Modes Determined From Operating Experience.........................................
5.1 1
5.1 Beaver Valley Units 1 and 2 Experience..............................................
5.1 -
l 1
r
?
v NUREG/CR.5835 i
5.1.1 M o t o r D r ive n P u m p Fa il u res......................................
5.1.
5.1.2 "Ihrbine Driven Pump Failures.......................,
'5.1' 5.1.3 Flow Control and Isolation %lve Failures.............................................
' 5.1 5.1,4 Thrbine Driven Pump Steam Supply, Admission, and Control Wlvc=.....................
5.1 5.1.5 Check %lves..........
5.7.
5.2 Industry Wide Experience........
5.2.
5.2.1 Common Cause Failures..
5.2 5.2.2 Iluman Errors.........
5.4 5.2.3 Design /Enginecting Probicms and Errors 5.4 5.2.4 Onnponent Pailures...................
5.5 -
6 R e fe re nce.s..................................
6.1 NUREG/CR.5835 vi
)
i Figures 2.4 -
2.1 Beaver Valley unit 1 auxiliary feedwater system..........................
2.5 2.2 Beaver Valley 2 auxilliary feedwater system.............................
Thbles 3.1. Risk important walkdown table for Beaver Valley Unit 1 AFW system components................
3.8 3.2. Risk important walkdown table for Beaver Valley Unit 2 AFW system components.................
3.11 4
i I
E
-i v
t t
I I
i i
t i
-+
l t
vil
' NUREG/CR-5835 i
t 9
F 1
i 4
-e ev,-
m m
l 1
Summary
.i This document presents a compilation of auxiliary feedwater (AFW) system failure information which has been screened for risk significance in terms of failure frequency and degradation of system performance,11 is a risk-prioritized listing of failure events and their causes that are significant enough to warrant consideration in inspection planning at the Beaver Wiley plants. This information is presented to provide inspectors with increased resources for inspection planning at Beaver Valley.
The risk importance of various component failure modes was identified by analysis of the results of probabilistic risk.
i assessments (PRAs) for many pressurized water reactors (PWRs). However, the component failure categories identi-ficd in PRAs are rather broad, because the failure data used in the PRAs is an aggregate of many individ ual failures having a variety of root causes. In order to help inspectors focus on specific aspects of component operation, mainte-nance and design which might cause these failures, an extensive review of component failure information was performed to identify and rank the root causes of these component failures. Both Beaver Valley and industly-wide failure information was analyzed. Failure causes were sorted on the basis of frequency of occurrence and seriousness of consequence, and categorized as common cause failures, human errors, design problems, or component failures.
l l
This information is presented in the body of this document. Section 3.0 provides brief descriptions of these risk-important faiiure causes, and Section 5.0 presents more extensive discussions,with specific examples and references.
The entries in the two sections are cross-referenced.
i An abbreviated system walkdown table is presented in Section 3.2 which includes only components identified as risk
[
important. This table lists the system lineup for normal, standby system operation.
This information permits an inspector to concentrate on components important to the prevention of core damage.
However,it is important to note that inspections should not focus exclusively on these components. Other compo-nents which perform essential functions, but which are not included because of high reliability or redundancy, must also be addressed to ensure that degradation does not increase their failure probabilities, and hence their fisk importance.
t
[
t i
r i
l i
ix NUREG/CR-5835 i
g
i L
i 1 Introduction nis document is one of a series providing plant-specific risk important components and their lineup for normal, l
inspection guidance for auxiliary feedwater (AFW) sys-standby system operation is also provided.
l tems at pressurized water reactors (PWRs). This guid-i ance is based on information from probabilistic risk The remainder of the document describes and discusses assessments (PRAs) for similar PWRs, industry-wide the information used in compiling this inspection guid-operating experience with AFW systems, plant-specific ance. Section 4.0 describes 1he risk important informa-l AFW system descriptions, and plant-specific operating tion which has been derived from PRAs and its sources.
i experience. It is not a actailed inspection plan, but As resiew of that section will show, the failure events rather a compilation of AFW system failure information identified in PRAs are rather broad (e.g., pump fails to l
which has been screened for risk significance in terms of rtart or run, valve fails closed). Section 5.0 addresses failure frequency and degradation system performance.
the specific failure causes which have been combined The result is a risk-prioritized listing of failure events under these broad events.
I and the causes that are significant enough to warrant consideration in inspection planning at Beaver Wiley.
AFW system operating history was studied to identify.
l the various specific failures which have been aggregated i
This inspection guidance is presented in Section 3.0, fol-into the PRA failure events. Section 5.1 presents a sum-lowing a description of the Beaver Valley Unit I and 2 mary of Beaver Valley failure information, and Sec-
.AFW systems in Section 2.0. Section 3.0 identifies the tion 5.2 presents a resiew ofindustry-wide failure infor-risk important system components by Beaver Valley mati'n. The industry-wide information was compiled identification number, followed by brief descriptions of from a variety of NRC sources, including AEOD analy-each of the various failure causes of that component.
ses and reports,information notices, inspection and en-These include specific human errors, design deficiencies, forcement bulletins, and generic letters, and from a vari.
and hardware failures. The discussions also identify ety ofINPO reports as well. Some Licensee Event l
where common cause failures have affected multiple, Reports and NPRDS event descriptions were also re-1 redundant components. These brief discussions identify viewed. Finally,information was included from reports specilic aspects of system or component design, opera-of NRC-sponsored studies of the effects of plant aging, tion, maintenance, or testing for inspection by observa-which include quantitative analyses of reported AFW tion, records review, training observation, procedures system failures. This industry-wide information was review, or by observation of the implementation of pro-then combined with the plant-specific failure informa-ecdures. An AFWsystem W Ikdown table identif ing tion to identify the various root causes of the broad fail-3 ute events used in PRAs,which are identified in
}
Section 3.0.
f e-6 t
i e
I f
5 i
l.1 NUREG/CR-5835
[
i 3
i i
i 2 Beaver Valley AFW System f
1 This section presents an overview description of the a recirculation flow system,which prevents pump dead-Westinghouse three loop Beaver Valley Unit I and 2 heading. In the event of a failure of the main recircula-i AFW systems, including simplified schematic system dia-tion line, recirculation through the oil cooler is designed t
grams. In addition, the sysicm success criterion, system to provide enough short term cooling to prevent pump dependencies, and administrative operational con-damage until the pump can be shutdown.
straints are also presented.
Auxiliary feedwater is supplied to each steam generator through two redundant supply headers, each containing i
2.1 System Description Beaver Valley a motor operated throttle valve. The supply headers join Unit 1 downstream of the thr ttle valv s and auxili ry feed-water flows through a flow measuring device, a check valve and a manual isolation valve, before connecting The AFW system provides feedwater to the steam gene-with the main feed line downstream of the main feed rators (SG) to allow sectmdary-side heat removal from line containment isolation valves.
the primary system when main feedwater is unavailable.
The system is capable of functioning for extended peri-A dedicated non-safety grade AFW pump (FW-P-4)is ods, which allows time to restore main feedwater flow or also provided and is capable of providing demineralized j
to piacced with an orderly cooldown of the plar.t I water to the three steam generators within ten minutes where the residual heat removal (RHR) system can following a loss of the main feedwater and the AFW remove decay heat. A simplified schematic diagram of pumps (FW-P-2,3A and 3B) due to loss of offsite power the Beaver Valley Unit 1 AFW system is shown in and an AFW area fire or loss of associated control or 1
Figure 2.1.
power circuitry. The dedicated pump is powered from the 4160 V ERF Substations, Bus lH. The AFW pump He system is designed to start up and establish flow (FW-P-4) takes suction from demineralized water stor-automatically. All pumps start on receipt of a steam age tank WT-TK-11 or 26. Additional makeup water.
t generator low-low level signal. (The turbine-driven may be provided by water tanker trucks. The AFW pump starts on low level in one SG, whereas, two SG pump (FW-P-4) discharges into the main feed system i
low level signals are required for a motor-driven pumps downstream of the first point heaters and flow is man-I to start.) The single turbine-driven (TD) pump starts on ua'ly controlled at the feedwater bypass manifolds.
I undervoltage on two of the three reactor coolant (RC) pump buses and an ATWS Mitigation Actuation Signal The Primary Plant Demineralized Water (PPDW) stor-
^
(AMSAC). The motor-driven (MD) pumps start on a age tank WT-TK-10 (152,000 gallon capacity) is the nor-
+
trip of the electric main feedwater pumps (MFW), a mal source of water for the AFW System and is required safety injection signal, or an AMSAC signal.
to store a minimum of 140,000 gallons of demineralized water to maintain the reactor coolant system (RCS) at
^i Separate lines from the Primary Demineralized Water hot standby conditions for 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> with steam discharge Storage Tank (WT-TK-10) supply each motor-driven to atmosphere. All tank connections except those i
pump and the turbine-driven pump. Isolation valves in required for instrumentation, auxiliary feedwater pump these lines are locked open. WT-TK-10 Makeup valve suction, chemical analysis, and tank drainage are located LCV-WT-104A fails open on a loss of Instrument air or above this minimum level. AFW suction may also be Vital Bus II. Power, control, and instrumentation ass ~
manually switched to the engineered safety feature ciated with each motor-driven pump are independent River Water System. There is now a biocide program from one another. Steam for the turbme-driven pump is for the River Water supply to the AFW system to pre-supplied by steam p ucrators A,B, and C, from a point vent fouling by asiatic clams.
upstream of the maiu steam isolation valves, through valve MOV-MS-105. Each AFW pump is equipped with 2.1 NUREG/CR-5835 I
~
t Beaver Valley 2.2 System Description BeaverValley equipped with a recirculation flow system, which pre- -
Unit "'
vents pump deadheading. In the event of a failure of the main recirculation line, recirculation through the oil cooler is designed to provide enough short term cooling The AFW system provides feedwater to the steam gene-fjg, gg pg. cat pump damage until the pump can be I
rators (SG) to allow secondary-side heat removal from shutdown.
the primary system when main feedwateris unavailable.
I The system is capable of functioning for extended peri' Auxiliary feedwater is supplied to each steam generator ods, which allows time to restore main feedwater flow or through two redundant supply headers, each containing i
to proceed with an orderly cooldown of the plant to a hydraulically operated throttle valve. AFW pump I
where the residual heat removal (RHR) system can P23A and P-22 normally supply feed to each S/G I
remove decay heat. A simplified schematic diagram of through HCV-100 A,C,& E. These valves are powered I
the Beaver Valley Unit 2 AFW system is shown in from 480V train A. Control power for the valves is sup-Figure 2.2.
plied from Vital Bus 1. AFW pump 23B normally sup-plies feed to all S/G's through HCV-100 B, D, & E t
The system consists of two motor-driven pumps and one These valves are powered from 480V train B. C(mtrol steam turbine-driven pump along with its associated power for the valves is supplied from Vital Bus 11P-22 l
piping, valves, and instrumentation and controls. It is and supplies both headers by opening manual isolation designed to start up and establish flow automatically.
valve 102. The supply headers join downstream of the I
All pumps start on receipt of a steam generator low-low throttle valves and flow through a ilow restricting i
level signal. (The turbine-driven pump starts on low orifice / measuring device, a venturi flow device, and a level in one SG, whereas, two SG low level signals are check valve, before connection with the main feed line required for a motor-driven pumps to start.) The single downstream of the main feed line containment isolation I
turbine-driven (TD) pump starts on undervoltage on valves.
I two of the three reactor coolant (RC) pump buses and l
an ATWS Mitigation Actuation Signal (AMSAC).The A dedicated non-safety grade AFW pump (FW-P-4) is i
motor-driven (MD) pumps start on a trip of the electric also provided and is capable of providing demineralized i
main feedwater pumps (MFW), a safety injection signal, water to the three steam generators within ten minutes or an AMSAC signal. Control power to the motor following a loss of the main feedwater and the AFW l
driven pumps is provided from 125VDC Bus 1 (orange) pumps (FW-P-22,23A and 23B) due to loss of offsite i
for pump 23A and 125VDC Bus 2 (purple) for power and an AFW area fire or loss of associated con-i pump 23B.
trol or power circuitry. The dedicated pump is powered from the 4160 V ERF Substations, Bus Ib. The AFW f
Separate lines from the Primaty Demineralized Water pump (FW-P-24) takes suction from demineralized Storage 'Pank (WT-TK-210) supply each motor-driven water storage tank WT-TK-11 or 26. Additional make-l pump and the turbine-driven pump. Isolation valves in up water may be provided by water tanker trucks.The these lines are locked open. TK210 Makeup valve AFW pump (FW-P-24) discharges into the main feed 2WTD-LCV104 A fails closed on a loss of Instrument air system downstream of the first print heaters and flow is or Vital Bus IV. Power, control, and instrument. tion manually controlled at the feedwater bypass manifolds.
associated with each motor-driven pump are independ-ent from one another. Steam for the turbine-driven The Primary Plant Demineralized Water (PPDW) stor-pump is supplied by steam generators A,B, and C, from age tank WT-TK-210 (140,000 gallon capacity) is the i
a point upstream of the main steam isolation valves, normal source of water for the AFW System and is through three parallel paths, one from each steam line, required to store a minimum of 127,500 gallons of with 2 SOV's in each line. Both SOV's are required to demineralized water to maintain the reactor coolant sys-operate in order to supply steam to the Steam Driven tem (RCS) at hot standby conditions for 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> with I
AFW pump from a Main Steam line. The SOV's are steam discharge to atmosphere. All tank connections normally closed and energized. The SOV's fail open on except those required for instrumentation, auxiliary t
a loss of DC control power. Each AFW smp is feedwater pump suction, chemical analysis, and tank
[
)
NUREG/CR-5835 2.2 h
Berver Wiley _
drainage are located above this minimum level. AFW in the safe direction, therefore safety grade backup -
suction may also be manually switched to the engineered systems are not necessary. Steam availability is required safety feature River Water System. There is now a bio-for the turbine-driven pump.
cide program for the River \\Wier supply to the AFW system to prevent fouling by asiatic clams.
2.5 Operational Constraints 2.3 Success Criterion When the reactor is critical the Beaver Valley Technical Specifications require that all three AFW pumps and Sysicm success requires the operation of at least one associated flow paths are o,yerable with each motor-pump supplying rated flow to at least two of the three driven pump powered from a different vital bus. If one steam generators.
AFW pump becomes inoperable, it must be restored to operabic status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the plant must shut down to hot standby within the next twelve hours.
2.4 System Dependencies The Beaver Valley Technical Specifications require a The AFW system depends on AC and DC power at var-nine hour supply of water to be stored in the PPDW -
ious voltage levels for motor operation, valve c4mtrol, si rage tank. With the PPDW storage tank havingless monitor and alarm circuits, and valve / motor control cir-than 140,000 gallons, restore water volume or demon-cuits. Instrument Air is required for several pneumatic strate operability of the river water system and restore control valves. Air operated valves are designed to fail the PPDW storage tank water volume within seven days,.
or be in hot shutdown within the next twelve hours.
8 I
c t
i b
i 2.3
t Beaver V lley i
I SNG.
S\\o SNC A
B C
k l
1FM-156R ll 1FM-15GB gru.15GC i
~
i gFROM FROM NTM 1FM-1SOR 1FM-159 B 1m-150 C.
TO MFW LINE BEDICHTED UPSTRERN OF 1FM-42 STM-43 1N-44 U
FM-P-4 FMise l
RECIRC 1FM-626 1FM-C27 1FM-624 tru c2s 1FM-622 SFM-G23 1FM-151D STM-1519 G49 gru.151F M
M n
n 3
j SFM-151E 1FM-151C 1FM-151R g4 639 G43 MI uI TK TK L
?R y
q p gry.4g q p f
~
FMA2
>-1 NOV-MS t e9 MS185R 1FM-P-2 1FM STM-P-3R MSte5B x
1 f
ur227 S2e S19 g,HS1B RM2OO RM218 RM209 j
q p S15 MStG MS17 j
RM287 i
+
+
+
0 1
SNC SNO SNC 8M288 jg 1R 1B SC RIVER MRTER l'igure 2.1 Beaver Valley Unit 1 auxiliary feedwater system NUREG/CR-5835 2A l
i
- Beaver Valley
~
i c z e
-z c
f i!E i
Es$
EES 95$
y y
~
0 m
w o
m
)
0 F
O P
m o O P
e ox< -
'e e
oxa -
'e e
exa -
'e a
e w&
O Y~
't g5 O
Y" C
4 O
Y~
u.
w m
me
's e
me
'g
'g g
ue Q
06 Q
Q 06 04 v.
E Ee5 E
EeE v.
E Xe5 y-E O
9-O 9~
9 9'
y
>q
>q q
e e
s g
s2 s2 h
('
^
s.-
<25 52e
- Ee rwm Wwm s,
Wwa l
C J
b 4
k k
k 4
k
.f 5
R 2
E' w
u.
o o
m S
8 8
2 8
8 19 8
8 DME Odhh U$b DME Ddk5D$h-z5 z5 z5 e
j!
JE JE' e
i E
ss sg
.s s
8e 8e 8e e
i mm mm mm 5
d 1
N b
)
w'
+
1 i.
f 85 1
X
$8 I e X*
g' n
2 X
R fS(
,~ 5 F
E@ s {
~g G j.
a
~
~
~
m j
2
?
EL L 4 sw s a
e IEW8 E"
2 E"E Y E
i a$
ew<
a g!$@
te te a
p ig g g.
3XE 8X 2X R MI X's s
Ne -6C Dl X
"$ se i
8s54 I
e c
m<
EE$$5
-[
2.5 NUREG/CR-5835 i
f 1
h
i t;
i 3 Inspection Guidance for the Beaver Valley AFW System -
1 l
In this section the risk important components of the 3.1.1 Multiple Pump Failures due to Common Beaver Valley ARV system are identified, and the Cause important failure modes for these components are briefly described. These failure modes include specific The following listing summarizes the most important l
human errors, design deficiencies, and types of hardware multiple-pump failure modes identified in Section 5.2.1, i
failures which have been observed to occur for these Common Cause Failures, and each item is keyed to components, both at Beaver Valley and at PWRs entries in that section.
throughout the nuclear industry. The discussions also identify where common cause failures have affected mul-Incorrect operator intervention into automatic tiple, redundant components. These brief discussions system functioning, including improper manual identify specific aspects of system or component design, starting and securing of pumps, has caused failure of operation, maintenance, or testing for inspection act*
all pumps, including overspeed trip on startup, and ties. These activities include observation, records review, inability to restart prematurely secured pumps.
training observation, procedures review, or by observa-CC1. ~
t tion of the implementation of procedures.
Inspection Suggestion - Observe Abnormal and h
Tables 3.1 and 3.2 are abbreviated ARV system walk' Emergency Operating Procedure (AOP/EOP).
l down tables which identify risk-important components.
simulator training exercises to verify that the These tables list the system lineup for normal (standby) operators comply with procedures during ob-
~
system operation. Inspection of the components identi-served evolutions. Observe surveillance testing fied in the walkdown tables addresses essentially all of on the ABV system to verify it is in strict the risk associated with ARV system operation.
compliance with the surveillance test procedure.
t Valve mispositioning has caused failure of all
+
3.1 Risk Ifnportant AFW Components pumps. Pump suction, steam supply,and instru-and Failure Modes ment isolation valves have been involved. CC2.
Common cause failures of tuultiple pumps are the most Inspection Sugestion - Verify that the system valve risk-important failure modes of ARVsystem compon-alignment, air operated valve mntrol and valve actu-r ents. These are followed in importance by single pump ating air pressures are correct using 3.1 Walkdown failures, level control valve failurcs, and individual check Table, the system operating procedures, and opera-valve backleakage failures.
tor rounds logsheet. Review surveillance procedures that alter the standby alignment of the ARV system.
he following sections address each of these failure Ensure that an adeauste return to normal section CXISIS-modes,in decreasing order of risk-importance. Hey present the important root causes of these component failure modes which have been distilled from historical Steam binding has caused failure of multiple pumps.
records. Each item is keyed to discussions in Section 5.2 This resulted from leakage of hot feedwater past.-
where additional inform' tion on historical events is pre, check valves and motor operated valves into a corn-a sented.
mon discharge header. CC10. Multiple-pump steam binding has also resulted from improper valve i
lineups, and from running a pump deadheaded.
l CC3.
i 3.1 NUREG/CR-5835 -
l
inspection Guidance 1
Inspection Suggestion - Verify that the pump dis -
despite the existence of adequate static net positive charge temperature is within the limits specified on suction head (NPSH). CC7. Design reviews have the operator rounds logsheet. Assure any instru-identified inadequately sized suction piping which l
ments used to verify the temperature by the utility could have yielded insufficient NPSH to support -
are of an appropriate range and included in a cali-operation of more than one pump. CC8.
l bration program. Verify affected pumps have been vented in accordance with procedures to ensure inspection Suggestion - Assure that plant conditions steam binding has not occurred. Verify that a main-which could result in the blockage or degradation of tenance work request has been written to repair the suction flow path are addressed by system main-leaking check valves.
tenance and test procedures. Examples include,if the AFW system has an emergency source from a Pump control circuit deficiencies or design modifi-water system with the potential for bio-fouling, then a
cation errors have caused failures of multiple pumps the system should be penodically treated to prevent -
to auto start, spurious pump trips during operation, buildup and routinely tested to assure an adequate and failures to restart after pump shutdown. CC4.
flow can be achieved to support operation of all 1
Incorrect setpoints and control circuit calibrations pumps, or inspected to assure that bio-fouling is not have also prevented proper operation of muhiple occurring. Design changes that affect the suction pumps. CC5.
flow path should repeat testing that verified an ade-quate suction source for simultaneous operation of Inspection Suggestion - Resiew design change imple-all pumps. Verify that testing has, at sometime, mentation documents for the post maintenance test-demonstrated simultaneous operation of all pumps..
i ing required prior to returning the equipment to Verify that surveillances adequately test all aspects sersice. Assure the testing verifies that all poten-of the system design functions, for example, demon-tially impacted functions operate correctly, and strate that the AFW pumps will trip on low suction.
includes repeating any plant start-up or hot func-
- pressure, tional testing that may be affected by the design change.
3.1.2 Thrbine Driven Pumps P-2 or 22 Fail to Start or Run Loss of a vital power bus has failed both the turbine-
+
1 driven and one motor-driven pump due to loss of Improperly adjusted and inadequately maintained i
control power to steam admission valves or to tur-turbine governors have caused pump failures. HE2.
bine controls, and to motor controls powered from Problems include worn or loosened nuts, set screws,
~
the same bus. CC6.
linkages or cable connections, oil leaks and/or -
contamination, and electrical failures of resistors, Inspection Suggestion - The material condition of the transistors, diodes and circuit cards, and erroneous electrical equipment is an indicator of probabie reli-grounds and connections. CF5. Internal corrosion ability. Review the Preventative Maintenance (PM) in the governor has resulted in speed control records to assure the equipment is maintained on an problems at Beaver Valley Unit 1.
appropriate frequency for the environment it is in
{
and that the PM's are actually being performed as Inspection Suggestion - Review PM records to assure.
required by the program. Review the outstanding the governor oil is being replaced within the desig-I Corrective Maintenance records to assure the defic-nated frequency. During plant walkdowns carefully sencies found on the equipment are promptly inspect the governor and linkages for loose fasten-corrected.
ers, leaks, and unsecured or degraded conduit. Re-view vendor manuals to ensure PM procedures are Simultaneous startup of multiple pumps has caused performed according to manufacturer's recommen-i oscillations of pump suction pressure causing dations and good maintenance practices.
multiple-pump trips on low suction pressure, NUREG/CR-5835 3.2 g
II v
Inspection Guidance
. 'lbrbines with Woodward Model PG-PL governors valves, (MS-105A,105B), have resulted in failure of have tripped on overspeed when restarted shortly the turbine driven pump to perform properly at af ter shutdown, unicss an operator has locally Beaver %11ey Unit 1.
depressed the pushbuttons, (per procedure), to drain the oil from the governor speed setting Inspection Suggestion - Carefully inspect the TTV -
c3 nder (Unit 2 only). Automatic oil dump valves overspeed trip linkage and assure it is reset and in ii are now available through Tbrry and have been good physical condition. Assure that there is a good installed on Unit 1, PGD Woodward Governor.
steam isolation to the turbine, otherwise continued DE4 turbine high temperature can result in degradation '
of the oilin the turbine, interfering with proper Inspection Suggestion - Observe the operation of the overspeed trip operation. Review training procc-turbine driven Aux Feed pump and assure that the dures to ensure operator training on resetting the governor is reset as directed in 2OM-24.4 by depres-TIV is current.
sing the governor oil drain pushbuttons prior to re-start after an overspeed trip. Assure the turbine is lxw lubrication oil pressure resulting from heatup not coasting down,which can result in refillof the due to previous operation can prevent pump restart speed setting cylinder.
due to failure to satisfy the protective interlock.
DE5.
Condensate slugs in steam lines have caused turbine overspeed trip on startup. Tests repeated right after Inspection Suggestion - Irw oil pressure is a trip that such a trip may fail to indicate the problem due to is in senice at all times for the turbine driven AFW warming and clearing of the steam lines. Surveil-pump on Unit 1. Unit 2 does not have a low oil lance should exercise all steam supply connections.
pressure trip. Verify that low pressure trip is reset DE2.
at the pump. Iflubricating oil type is changed, en-sure that this is not a problem. Low oil pressure Inspection Suggestion - Vctify that the steam traps due to a plugged filter will also cause a trip. Review are valved in on the steam supply line. For steam PM records to assure the filter is replaced at the traps that are on a pressurized portion of the steam required intenals.
line, check the steam trap temperature (if unlagged) to assure it is warmer than ambient (otherwise it 3.1.3 Motor Driven Pumps 3(23)A or3(23)B may be stuck or have a plugged line). If the steam Fail to Start or Run trap discharge is visible, assure there is evidence of l
liquid discharge.
Control circuits used for automatic and manual pump starting are an important cause of motor j
Tlip and throttle valve (TTV) prob 1 ems, and Steam driven pump failurcs, as are circuit breaker faDures.
admission trip valve problems (MS-105A,105B)
CF7. Spurious false starts resulting from control cir-
- i which have caused failures of the turbine driven cuit failures have occuned at Beaver Valley Unit 1.
pump include physically bumping the valves, failure to reset the TIV following testing, failures to verify Inspection Suggestion - Review corrective mainten-i ccmtrol room indication of reset. HE2, and inadver-ance records when control circuit problems occur to i
tent opening of the steam admission trip valve duc determine if a trend exists. Every time a breaker is i
to spurious de-energization of the solenoid. Wheth-racked in a PMTshould be performed to start d;e.
cr either the overspeed trip or TTV trip can be reset pump, assuring no control circuit problems have without resetting the other, indication in the ccmtrol occurred as a result of the manipulation of the.
room of TrV position, and unambiguous localindi-breaker. (Control circuit stabs have to make up cation of an overspeed trip affect the likelihood of upon racking the breaker, as well as cell switch these errors. DE3. Foreign objects under the seat, damage can occur upon removal and reinstallation seat wear, and diaphragm failure in the steam supply of the breaker.)
i
)
3.3 NUREG/CR-5835
L l
Inspection Guidance b
?
1 Mispositioning of handswitches and procedural de-3.1.5 Air Operated Flaw Control Valves Fail -
=
ficiencies have prevented automatic pump start.
Closed-IIE3. At Beaver Valley Unit I, mispositioning of control switches has caused inadvertent pump starts.
TD Pump Train: 1-FW-107 MD Pumtvilains: 1-FW-103A.B Inspection Suggestion - Confirm switch position using Table 3.1 Review administrative procedures These normally-open air operated valves (AOVs) con-concerning documentation of procedural deficien~
trol Unit 1 AFW pump recirculation flow to the primary cies. Ensure operator training on procedural plant demineralized water storage tank. They fail closed I
changes is current.
on loss ofInstrument Air.
Low lubrication oil pressure resulting from heatup Control circuit problems have been a primary cause due to previous operation has prevented pump re-of failures, both at Beaver Valley Unit 1/2 and else-'
l start due to failure to satisfy the protective inter' where. CF9. Valve failures have resulted from lock. DES. Hot bearings have caused problems at blown fuses, failure of control components (such as i
Beaver Valley Unit 1.
current / pneumatic convertors), broken or dirty con-tacts, misaligned or broken limit switches, control ~
3.1.4 Putnps Unavailable Due to Maintenance power loss, and calibration problems. Degraded or Surveillance operation has also resulted from improper air pres-
[
sure due to air regulator failure or leaking air lines.
[
Both scheduled and unscheduled maintenance remove pumps from operability. Surveillance Inspection Suggestion - Check for control air system requires operation with an altered line-up, although alignment and air leaks during plant walkdowns.
+
a pump train may not be declared inoperable during (Regulators may have a small amount of external' testing. Prompt scheduling and performance of bleed to maintain downstream pressure.) Check for maintenance and surveillance minimize this cleanliness and physical condition of visible circuit.
unavailability.
elements. Resiewvalve stroke time surveillance for l
adverse trends, especially those vahres on reduced Inspection Suggestion - Review the time the AFW testing frequency. Resiew air system suncillances -
l system and components ate inoperable. Assure all moisture content of air is within established limits.
maintenance is being performed that can be per-Out-of. adjustment electrical flow contrcliers have ~
I formed during a single outage time frame, avoiding multiple equipment outages. The maintenance caused improper valve operation, affecting multiple should be scheduled before the routine surveillance trains of AFW. CCl2.
test, so credit can be taken for both post mainten-ance testing and surveillance testing, avoiding exces-Inspection Suggestion - Review PM frequency and sive testing. Review suneillance schedule for fre-records, only upon a trend of failure of the quency and. adequacy to verify system operability controllers.
t requirements per TLchnical Specifications.
I h
t i
I NUREG/CR-5835 3.4 h
i
L
?
Inspection Guidance Valve motors have been failed due to lack of, or im-Leakage of hot feedwater through check valves has
=
caused thermal binding of flow control MOVs.
proper sizing or use of thermal overload protective AOVs may be similarly susceptible. CF2.
devices. Bypassing and oversizing should be based on proper engineering for desien basis conditions.
Inspection Suggestion - Covered by 3.1.1 bullet 3.
CF4.
' Multiple flow control valves have been plugged by Inspection Sugestion - Review the administrative
+
clams when suction switched automatically to an controls for documenting and changing the settings alternate, untreated source. CC9.
of thermal overload protective desices. Assure the information is available to the maintenance.
Inspection Sugestion - Covered by 3.1.1 bullet 6.
planners.
3.1.6 Motor Operated Isolation and Throttle Out-of-adjustment electrical flow controllers have.
Valves Fail As-Is caused improper discharge valve operation, affecting multiple trains of AFW. CCl2.
"A" Manifold Throttle Valves: 1-FW-151 B.D.F f
e "B" Manifold Throttle Valves: 1-FW-151 A.QJ Grease trapped in the torque switch spring pack of Dedicated AFW Pumm 1-FW-160 Limitorque SMB motor operators has caused motor l'
"A" Manifold Valves: 2.-AFW-100 A.C.E burnout or thermal overload trip by preventing
'B" Manifold Valves: 2-AFW-100 B.D.F torque switch actuation. CF8.
- i These normally open MOVs throttle or isolate flow to Inspection Suggestion - Resiew this only if the MOV the steam generators. They fail as-is on loss of power.
testing program reveals deficiencies in this area.
I Beaver Valley has had no history of this type of
,l
' Common cause failure of MOVs has resulted from problem.
failure to use electrical signature tracing equipment I
to determine proper settings of torque switch and Manually reversing the direction of motion of torque switch bypass switches. Failure to calibrate operating MOVs has overloaded the motor circuit.
i switch settings for high torques necessary under Operating procedures should provide cautions, and desien basis accident conditions has also been circuit designs may prevent reversal before each stroke is finished. Unit 1 MOV's receive an OPEN involved. CC11. At Beaver %lley Unit 1/2, most failures have been due to normal wear of the valve signal upon receipt of an AFW Auto initiation seats, however there have been failures due to im-signal. The valves are normally OPEN. (Unit 2 i
proper torque switch adjustment.
receives no open signal) DE7.
Inspection Suggestion - Review 1he MOV test Inspection Sugestion - This event could on]y occur on Unit 1 if the MOV's were closed at the time of records to assure the testing and settings are based on dynamic system conditions. Overtorquing of the AFW initiation and the operator attempted to over.
valve operator can result in valve damage such as ride the Auto OPEN signal to close an MOV. This cracking of the seat or d.isc. Review the program to is an unusual set of circumstances,but it is possible.
i assure overlorquing is identified and corrective Check procedural guidance and precautions to see if.
i this is discussed, actions are taken to assure valve operability follow.
ing an overtorque condition. Review the program to assure EQ seals are renewed as required during the restoration from testing to maintain the EQ rat-ing of the MOV.
i i
3.5 NUREG/CR-5835
. Inspection Guidance i
i 3.1.7 Manual Suction or Discharge Valves Fail Failure to log the manipulation of sealed valves
+
7 Closed i
Failure to follow good practices of written task i
+
TD P-2 Pump 'Itain: 221,225.36.39 assignment and feedback of task completion MD 3A Pump Train: WT 223,226.37,40 information MD 3B Pumo Train: WT 222.227.38.41 Dedicated AFW Pump: WT 648,639.643 Failure to provide easily read system drawings,legi-SLG Isolation Valves: HCV-58A.B,C ble valve labels corresponding to drawings and pro-cedures, and labeled indications of local valve These manual valves are normally locked open, except p sition for WT-643. For each train, except for the dedicated AFW pump, closure of the first and second valve listed 18SPection Suggestion - Review the administrative would block suction from PPDW storage tank controls that relate to valve positioning and scaling, WTTK-10. Closure of the third and fourth valves for system restoration following maintenance, valve the TD and MD pump trains would block pump labeling, system drawing updating, and procedure -
discharge except recirculation to the PPDW storage revision, for proper implementation.
tank. The motor operator has been removed from valve FW 158 B and is currently operated manually. The 3.1.8 Leakage of Hot Feedwater through '
- motors have been removed from the operators on valves Check Valves:
l HCV-FW 158 A and C. Valve position indication is still i
available in the control room for these valves.
At MFW Connections: FW 42,43.44 Discharce of Pumps 3A,3B: TD Pump: FW 34.35.33 Valve mispositioning has resulted in failures of mul-Discharce of Pumns 23A,23B: TD Pump: AFW tiple trains of AFW. CC2. It has also been the 123A,B: 122 dominant cause of problems identified during "A" Manifold: Valves FW 622.624.626 5
operational readiness inspections. HEl. Events "B" Manifold: Valves FW 623,625,627 have occurred most often during maintenance, cali-bration,or system modifications. Important causes Leakage of hot feedwater through several check
+
of mispositioninginclude:
valves in series has caused steam binding of multiple pumps. Leakage through a closed level control Failure to provide complete, clear, and specific pro-valve in series with check valves has also occurred, cedures for tasks and system restoration as would be required for leakage to reach tbc motor.
driven punips A and B. CC10.
J Pailure to promptly resise and validate procedures, training, and diagrams following system Inspection Suggestion - Covered by 3.1.1 bullet 3.
modifications Slow leakage past the final check valve of a series
+
Failure to complete all steps in a procedure may not force the check valve closed. Other check
=
valves in series may leak similarly. Piping orienta-Failure to adeqt.ately review uncompleted pro-tion and valve decign are important factors in cedural steps after task completion achieving true series protection. CF1.
Failure to verify support functions after restoration Inspec " n Suggestion - Covered by 3.1.1 bullet 3.
Failure to adhere scrupulously to administrative procedures regarding tagging, control and tracking of valve operations NUREG/CR-5835 3.6
Inspection Guidance 3.2 RiskImportant AFW System However,it is essential to note that inspections should n i f ms mlusively on these mmponents. ther mm-Walkdown Table ponents which perform essential functions, but which are absent from this table because of high reliability or "Pables 3.1 and 3.2 present an AFW system walkdown redundang, must also be addressed to ensure that their table for Beaver Valley Units 1 and 2, including only risk importance are not increased. Examples included components identified as risk important. His informa-the (open) steam lead isolation valves upstream of tion allows inspectors to concentrate their efforts on MOV-MS-105, and an adequate water level in the components important to prevention of core damage.
PPDW storage tank.
i t
I
-1 3.7 NUREG/CR-5835
t inspection Guidance i
Table 3.1. Risk important walkdown table for Heaser Valley Unit 1 AFW system components Component #
Component Name Required Position Actual Position 3A Motor-Driven Pump Racked in/Open 3B Motor-Driven Pump Racked In/Open Valves FW 36 TDP 2 "A" Header Disch Locked Open l
FW37 MDP 3A "A" Header Disch Locked Open i
RV 38 MDP 3B "A" Header Disch Closed f
FW 39 TDP 2 "B" Header Disch Closed FW 40 MDP 3A "B" Header Disch Closed l
i FW 41 MDP 3B "B" Header Disch Locked Open
-I WT 221 PPDW lsol to TDP 2 Locked Open WT 222 PPDW isol to MDP 3B Locked Open WT 223 PPDW lsol to MDP 3A Locked Open WT 225 PPDW Isol to TDP 2 Locked Open WT226 PPDW Isol to MDP 3A Locked Open WT227 PPDW lsol to MDP 3B Locked Open FCV-BV 102 TDP 2 Recirculation Auto 5
FL -RV 103B MDP 3B Recirculation Auto FCV-FW 103A MDP3A Recirculation Auto l
RW 206 River Water Suction Isol Locked Closed RW 207 River Water Suction Isol Closed RW 208 River Water Suction isol Closed NUREG/CR-5835 3.8
~
?
inspection Guidance
- i e
1 Table 3.1 (Continued)
Component #
Component Name Required Position Actual Position
-l
'RW 209 River Water Suction Isol Closed t
i RW 210 River Water Suction Isol Closed-HCV-FW 158 A 1 A S/G isolation Valve Locked Open HC%FW 158 B 1B S/G 1 solation Valve Locked Open HCV-FW 158 C IC S/G isolation Valve Locked Open -
MO%FW 151 A 1C SG Throttle (B Hdr)
Open MO%FW 151 B 1C SG Throttle (A Hdt)
Open i
MOV-FW 151 C IB SG Throttle (B Hdr)
Open
[
MO%FW 151 D 1B SG Throttle (A Hdr)
Open MO%FW 151 E 1 A SG Throltic (B 1idr)
Open j
i MO%FW 151 F 1 A SG Throttle (A Hdr)
Open j
l MS 15 TDP Steam Supply from 1 A Locked Open -
MS 16 TDP Steam Supply from IB Locked Open MS 17 TDP Steam Supply from IC Locked Closed MO%MS 105 TDP Trip and Throttle %1ve Open f
T%MS 105A TDP Steam Admission Valve Closed.
f T%MS 105B TDP Steam Admission Valve Closed FW 42 Piping Upstream of Check %)ve Cool FW 43 Piping Upstream of Check %1ve Cool i
FW 44 Piping Upstream of Check Vake
- Cool FW 622 Piping Upstream of Check %1ve Cool FW 623 Piping Upstream of Check %1ve Cool l
- j 3.9 NUREG/CR-5835 1
e J
_ _,_i___-_______
. _ - -... ~. =.
-~.. -.
.i':
i
~i Inspection Guidance j
i 4
i Table 3.1. (Continued) :
i Component #
Comp (ment Name '
' Required Position Actual Position' l
FW 624 Piping Upstream of Check Valve Cool I!
FW 625 Piping Upstream of Check Valve Cool i
13V 626 -
Piping Upstream of Check Valve Cool FW 627 Piping Upstream of Check Valve Cool FW 33 Piping Upstream of Check Valve Cool FW 34 Piping Upstream of Check Valve Cool FW 35 Piping Upstream of Check Valve
- Cool NUREG/CR-5835 3.10
'I Inspection Guidance j
i
-i i
Table 3.2. Risk important walkdown table for lleaver Valley Unit 2 AFW system components Component #
Component Name Required Position Actual Position
'i i
P23A Motor-Driven Pump Racked In/
i 4160V Bus 2AE Bkr 2E18 Open P23B Motor-Driven Pump Racked In/
4160V Bus 2DF Bkr 2F18 Open Valves
~
I 2-FW-36 TDP 22 "A" Header Disch Locked Open 2-FW-37 MDP 23A"A" Header Disch Locked Open 2-FW-38 MDP 23B *B" Header Disch Locked Open 2-FW-102 TDP 22 "B" Header Disch Locked Closed l
WT93 PPDW isol to TDP 22 Locked Open WT 94 PPDW isol to MDP 23A Locked Open i
WT95 PPDW lsol to MDP 23B Locked Open WT 110 PPDW Isol to TDP 22 Locked Open WT 109 PPDW lsol to MDP 23A Imcked Open WT 111 PPDW lsol to MDP 23B 1mcked Open 7
j FCV-FW 122 TDP 22 Recirculation Auto i
FCV-FW 123B MDP 23B Recirculation Auto i
i FCV-FW 123A MDP 23A Recirculation Auto
'I RW 90 P-22 River Water Suction Isol Imcked Cicsed
}.t RW 91 P-23A River Water Suction Isol Imcked Closed RW 92 P-23B River Water Suction Isol Imcked Closed RW 98 River Water Suction Isol Locked Open f
v i
i t
3.11 NUREG/CR-5835
]a i
n
. Ittspection Guidance Table 3.2. (Continued)
Component #
Component Name Required Position Actual Position 2-FW-99 1 A S/G Isolation Valve Locked Open 2-FW-100 1B S/G isolation Valve Locked Open 2-FW-101 1C S/G lsolation Valve Ixcked Open 2-HCV-100A 1C SG Throttle (A Hdr)
Open 2-HCV-100B IC SG Throttle (B Hdr)
Open 2 HCV-100C 1B SG Throttic (A Hdr)
Open 2-HCV-100D 1B SG Throttle (B Hdr)
Open 2-HCV-100E 1 A SG Throttle (A Hdr)
Open 2-HCV-100F 1 A SG Throttle (B Hdr)
Open 2-MS-15 TDP Steam Supply from 2A Locked Open 2-MS-16 TDP Steam Supply from 2B Locked Open 2-MS-17 TDP Steam Supply from 2C locked Open 2 SOV-105A TDP Steam Supply from 2A Closed 2-SOV-105B TDP Steam Supply from 2B Closed 2-SOV-105C TDP Steam SupplyIrom 2C Closed 2 SOV-105D TDP Steam Supply from 2A Closed 2 SOV-105E TDP Steam Supply from 2B Closed 2 SOV-105F TDP Steam Supply from 2C Ch> sed 2-FWE-TTV22 P-22 TDP T/r Valve Open
' 2-FW-122 Piping Upstream of Check Valve Cool
' 2-FW-123A Piping Upstream of Check Valve Cool 2-FW-123B Piping Upstream of Check Valve Cool
.NUREG/CR-5835 3.12
Inspection Guidance Thble 3.2. (Continued)
Component #
Component Name Required Position Actual Position 2-RV-42A Piping Upstream of Check Valve '
Cool-2-FW-42B Piping Upstream of Check Valve Cool 2-RV-43A Piping Upstream of Check Valve Cool j
2-RV-43B Piping Upstream of Check Valve '
Cool i
2-RV-44A Piping Upstream of Check Valve Cool 2-RV-44B Piping Upstream of Check %1ve Cool
.!i FW-99 Piping Upstream of Check Valve Cool FW-100 Piping Upstream of Check Valve Cool 4
FW-101 Piping Upstream of Check Valve Cool -
l
-i Li i
i
?
fj a
f I
i 4
I'!
t I
1
~-
'l 3.13 NUREG/CR-5835
)
i I
4 Generic Risk Insights From PRAs PRAs for 13 PWRs were analyzed to identify risk-4.1.3 la ss of Main Feedwater importam accident sequences involving loss of AFW, and to identify and risk-prioritize the component failure Afredwarceline break drains the common water modes involved. The results of this analysis are source for MFW and ARV. The operators fail to described in this section. They are consistent with provide feedwater from other sources, and fail to results reported by INEL and BNL (Gregg et al 1988, initiate feed-and-bleed cooling, resulting in core and Travis et al,1988),
damage.
A loss ofmainfeedwater trips the plant, and ARV
+
4.1 Risk Important Accident Sequences fails due to operator error and hardware failures.
Involving AFW System Failure The operators faH to initiate feed-and-bleed cooling, resultmg m core damage.
4.1.1 l>>ss of Power System 4.1.4 Steam Genemtor'Ibbe Rupture (SGTR)
- A loss ofoffsitepower is followed by failure of ARV.
A SGTR is followed by failure of AFW. Coolant is Due to lack of actuating power, the power operated gg relief valves (PORVs) cannot be opened preventing adequate feed-and-bleed cooling, and resulting m storage tank (RWST) is depleted. High pressure core damage.
injecdon (M) faHs simc re&ulatmn cannm be established from the empty sump, and core damage
- #h "" *'
A station blackout fails all AC power except Vital
- AC from DC invertors,and all decay heat removal systems except the turbine-driven AFW pump.
AFW subsequently fails due to battery depletion or 4.2 Risk Important Component Failure hardware failures, resulting in core damage.
Modes A DC busfails, causing a trip and failure of the The generic component failure modes identified from power conversion system. One ARV motor-driven PRA analyses as important to AFWsystem failure are pump is failed by the bus loss, and the turbine-listed below in decreasing order of risk importance.
driven pump fails due to loss of turbinc or valve l
control power. AFW is subsequently lost (1) 'Ibtbine-Driven Pump Failure to Start or Run.
completely due to other failurcs. Feed-and-bleed i
cooling fails because PORV control is lost, resulting (2) Motor-Driven Pump Failure to Start or Run.
In core damage.
(3) TDP or MDP_ Unavailable due to Test or 4.1.2 Transient-Caused Reactor or'Ihrbine Maintenance.
Trip (4) AFW System Valve Failures 1
A transient-caused trip is followed by a loss of the steam admission valves power conversion system (PCS)and AFW. Feed-and-bleed cooling fails either due to failure of the operator to initiate it, or due to hardwarc failures, trip and throttic valve resialling in core damage.
4.1
Lj
. Generic Risk
'f I[
_ flow control valves in addition to individual hardware, circuit, or instru-f
++
ment failures, each of these failure modes may result j
' pump discharge valves from common causes and human errors. Common 1
cause failures of AFW pumps are particularly risk pump suction valves important. Valve failures are somewhat less important j
a due to the multiplicity of steam generators and connec-valves in testing or maintenance.
tion paths. Human errors of greatest risk importance involve: failures to initiate or control system operation l
(5) Supply / Suction Sources when required; failure to restore proper system linenp
-l after maintenance or testing; and failure to switch to
)
ccmdensate storage tank stop valve alternate sources when required.
+
i hot wellinventory J
+
suction valves.
{
-l I
~ f i
t i
1 f
I I
i v
NUREG/CR-5835 4.2 l
i h
i F
e p--t
J, 5 ~ Failure Modes Determined From OperaMng Experience t
t-This section describes the primary root causes of AFW 5.1.2 hrbine Driven Pump Failures system component failures, as determined from a review of operating histories at Beaver Valley and at other Evelve events have occurred from 1980-1991 that have PWRs throughout the nuclear industry. Section 5.1 de-resulted in decreased operational readiness of the tur-scribes experience at Beaver Valley Units 1 and 2 from bine driven pump. Failure modes involved failures in 1980-1991. Section 5.2 summarizes information com-instrumentation and c(mtrol circuits, electrical faults, piled from a variety of NRC sources, including AEOD system hardware failures,and human errors. The tur.
analyses and reports, information notices, inspection bine driven pump has tripped or failed to reach proper and enforcement bulletins, and generic Ictters, and from speed as a result ofinternal rust and corrosion and cor-a variety of INPO reports as well. Some Licensee Event roded contacts. Pump aging and wear has resulted in Reports and NPRDS crent descriptions were also re-high bearing temperature. Failure of valve diaphragms viewed. Finally,information was included from reports and loose parts in the steam supply have necessitated of NRC-sponsored studies of the effects of plant aging, pump shutdown and repair.
which include quantitative analysis of AFW system fail-ure reports. His information was used to identify the 5.1.3 Flow Control and Isolation Valve various root causes expected for the broad PRA-based Failures failure events identified in Section 4.0, resulting in the inspection guidelines presented in Section 3.0.
There have been seven events from 1980-1991 that re-suited in impaired operational readiness of the air oper-ated recirculation flow control and motor operated iso-5.1 Beaver Valley Units 1 and 2 lation valves. Principal failure causes were equipment Experience wear, instrumentation and control circuit failures, valve hardware failures, and human errors. Valves have failed The AFW systems at Beaver Valley Units 1 and 2 have to operate properly due to failure of ccmtrol compo-experienced failures of the AFW pumps, pump dis.
nents (such as 1/P c(mvertors), broken or dirty ccmtacts, charge flow control valves, the turbine steam admission valve packing, misaligned switches, and valve operator and supply valves, turbine trip and throttle valve, pump calibration problems liuman errors have resulted in discharge isolation valves, river water backup supply improper control circuit calibration and limit switch valves, and numerous steam system check valves. Fail.
adjustment.
ure modes include electrical, instrumentation and con-trol, hardware failures, and human errors.
5.1.4 hrbine Driven Pump Steam Supply, Admission, and Omtrol Valves 5.1.1 Motor Driven Pump Failures More than seventeen events from 1980-1991 have re-There have been six events from 1980-1991 which in-sulted in degraded operation of steam isolation and volved failure of the rnotor driven pumps during several steam flow ccmtrol valves. Bilure types included fail-modes of operation. Failure modes involved instrumen-urcs due to aging. Flow control and isolation valve seats tation and control circuit failures, pump hardware fail-were found to be steam cut, and isolation valves were ures, and human failures during maintenance activities.
found to leak through due to cut or worn seats or ob-Improper or inadequate maintenance has resulted in structions under the seats. Air leaks or misadjusted air j
high thrust bearing temperatures requiring pump shut-pressure regulators have prevented proper valve down and repair.
operation.
i 5.1 NUREG/CR-5835 y
)
l Failure Modes j
t i
5.1.5 Check Valves tested with the abnormal, cross-connected steam supply
]
lineup which resulted.) In the Rojan event the operator Three events of check valve failure have occurred in ihe incorrectly stopped both AFW pumps due to misinter-main steam supply to the TDARV pump from 1980-pretation of MRV pump speed indication. The diesel 1991. Normal wear and aging was cited as the failure driven pump would not restart due to a protective fea.
.)'
mode, resulting in leakage. Approximately twenty ture requiring complete shutdown, and the turbine- -
events of check valve failure have occurred in the ARV driven pump tripped on overspeed, requiring local reset system since 1980. In all but a few cases, normal wear of the trip and throttle vnive. In cases where manualin-1; and aging was cited as the failure mode, resulting in tervention is required during the early stages of a tran-
- leakage, sient, training should emphasize that actions should be -
i performed methodically and deliberately to guard against such errors.
I 5.2 Industry Wide Experience CC2. Valve mispositioning has accounted for a signif-i icant fraction of the human errors failing multiple trains j
Human errors, design / engineering problems and errors, is mcludes closure of nonnaHy open suctbn and component failures are the primary root causes of or steam supph des, and oUsolation vakes m
{
n ARV System failures identified in a review ofindustry sens n a g c ntmMations. Inmrrect handswdi wide system operating history. Common cause failures, p sitioning and madequate temporary wirmg changes which disable more than one train of this operationally redundant system, are highly risk significant,and can re-pantep automa& stans of multipk pumps.
ave a Factors identified m studies of misposit,omng errors m, -
j i,
sult from all of these causes.
clude failure to add newly installed valves to valve.
j checklists, weak administrative control of tagging, re, This section identifies important common cause failure s ration, mdependent verification, and locked valve -
modes, and then provides a broader discussion of the 1 gging, and madequate adherence m pmcedures. llleg-single failure effects of human errors, design /
able or confusing local valve labeling, and insufficient engineering problems and errors, and component fail-training in the determination of valve position may ures. Paragraphs presenting details of these failure modes are coded (e.g., CC1) and cross-referenced by m.-
cause or mask mispositioning, and surveillance which does not exercise complete system functioning may not spection items in Section 3.0.
reveal mispositionings.
5.2.1 Common Cause Failures CC3. At ANO-2, both AFW pumps lost suction due to steam binding when they were lined up to both the CST The dominant cause of AFW system multiple-train fail-and the hot startup/ blowdown demineralizer effluent urcs has been human error. Design / engineering errors (AEOD/C404,1984). At Zion 1 steam created by run-and component failures have been less frequent, but ning the turbine-driven pump deadheaded for one min-
~
nevertheless significant, causes of multiple train failures.
ute caused trip of a motor-driven pump sharing the r
f same inlet header, as well as damage to the turbine-CCl. Human error in the form ofincorrect operator in' driven pump (Region 3 Morning IEeport,1/17/90). Both tervention mto automatic ARV system functioning dur-events were caused by procedural inadequacies.
ing transients resulted in the temporary loss of all safety-grade AFW pumps during events at Davis Besse CC4. Design / engineering errors have accounted for a (NUREG-1154,1985) and Dojan (AEOD/T416,1983).
smaller, but significant fraction of common cause fail _
In the Davis Besse event, improper manual initiation of utes. Problems with control circuit design modifications i
the steam and feedwater rupture control system at Farley defeated AFW pump auto-start on loss of t
(SFRCS) led to overspeed tripping of both turbine-main feedwater. At Zion-2, restart of both motor driven i
driven AFW pumps, probably due to the introduction of pumps was blocked by circuit failure to deenergize when i
condensate into the AFW turbines from the long, un-the pumps had been tripped with an automatic start
.[
heated steam supply lines. (He system had never been signal present (IN 82-01,1982). In addition, ARV
[
NUREG/CR-5835 5.2 t
. - ~ = -.. -.
i t
i Failure Modes j
control circuit design resiews at Salem and Indian Point well as surveillance testing which duplicates senice con.
l have identified designs where failures of a single compo ditions as much as is practical, can help identify such j
nent could have failed all or multiple pumps (IN 87-34, design errors.
~
1987).
CC9. Asiatic clams caused failure of two ARV flow I
CC5. Incorrect setpoints and control circuit settings re-control valves at Catawba-2 when low suction pressure i
sulting frem analysis errors and failures to update proce-caused by starting of a motor-driven pump caused sue-dures have also prevented pump start and caused pumps tion source realignment to the Nuclear Senice Water i
to trip spuriously. Errors of this type may remain unde-system. Pipes had not been routinely treated to inhibit
}
teeted despite surveillance testing, unless surveillance clam growth, nor regularly monitored to detect their i
tests model all types of system initiation and operating presence, and no strainers were installed. The need for conditions. A greater fraction ofinstrumentation and surveillance which exercises alternative system opera-control circuit problems has been identified during tional modes, as well as complete system functioning, is j
acttal system operation (as opposed to surveillance test-emphasized by this event. Spurious suction switchover i
ing) than for other types of failures.
has also occurred at Callaway and at McGuire, although l
l no failures resulted.
i CC6. On two occasions at a foreign plant, failure of a l
balance-of. plant invertor caused failure of two ARV CC10. Common cause failures have also been caused by j
~
pumps. In addition to loss of the motor driven pump component failures (AEOD/C404,1984). At Surry-2, l
whose auxiliary start relay was powered by the invertor, both the turbine driven pump and one motor driven the turbine driven pump tripped on overspeed because pump were declared inoperable due to steam binding the governor valve opened, allowing full steam flow to caused by leakage of hot water through multiple check a
the turbine. This illustrates the importance of assessing valves. At Robinson-2 both motor driven pumps werc
{
the cffects of failures of balance of plant equipment found to be hot, and both motor and steam driven
'l which supports the operation of critical components.
pumps were found to be inoperable at different times.
l The instrument air system is another example of such a leakage at Robinson-2 passed through closed motor-system.
operated isolation valves in addition to multiple check j
valves. At Parley, both motor and turbine driven pump CC7. Multiple ARV pump trips have occurred at casings were found hot, although the pumps were not Millstone-3, Cook-1,'ilojan and Zion-2 (IN 87-53, declared inoperable. In addition to multi-train failures, l
1987) caused by brief, low pressure oscillations of suc-numerous incidents of single train failures have oc--
i tion pressure during pump startup. These oscillations curred, resulting in the designation of
- Steam Binding of occurred despite the availability of adequate static Auxiliary Feedwater Pumps" as Generic issue 93. This i
NPSH. Corrective actions taken include: extending the generic issue was resolved by Generic letter 88-03 time delay associated with the low pressure trip, re-(Miraglia,1988),which required licensees to monitor moving the trip, and replacing the trip with an alarm ARV piping temperatures each shift,and to maintain and operator action.
procedures F r recognizing steam binding and for restor.
ing system operability.
J CCA Design errors discovered during ARV system re-analysis at the Robinson plant (IN 89-30,1989) and at CC11. Common cause failures have also failed motor Millstone-1 resulted in the supply header from the CST operated valves. During the totalloss of feedwater being too small to provide adequate NPSH to the event at Davis Besse, the normally-open ARV isolation pumps if.more thaa one of the three pumps were op-valves failed to open after they were inadvertently i
crating at rated flow c(mditions. This muld lead to mul-closed. The failure was due to improper setting of the i
tiple pump failure due to cavitation. Subsequent torque swiwh bypass switch,which prevents motor trip reviews at Robinson identified a loss of feedwater tran-on the high torque required to unseat a closed valve-i sient in which inadequate NPSH and flows less than de-Previous problems with these valves had been addressed 1
sign values had occurred, but which were not recognized by increasing the torque switch trip setpoint - a fix which l
at the time. Event analysis and equipment trending, as failed during the event due to the higher torque required i
5.3 NUREG/CR-5835 l
i r
1 Failure Modes due to high differential pressure across the valve. Sim-HE3. Motor driven pumps have been failed by human ilar common mode failures of MOVs have also occurred errors in mispositioning handswitches, and by procedure in other systems, resulting in issuance of Generic Letter deficiencies.
)
89-10," Safety Related Motor-Operated Valve Tbsting and Surveillance (Partlow,1989)." This generic letter 5.2.3 Design / Engineering Problems and i
requires licensees to develop and implement a program Errors to provide for the testing, inspection and maintenance of all safety-related MOVs to provide ass rance that del. As noted above, the majority of ARV subsystem j
theywill function when subjected to design basis failures, and the greatest relative system degradation, conditions.
has been found to result from turbine-driven pump fail-ures. Overspeed trips of'Ibtry turbines controlled by CCl2. Other component failures have also resulted in Woodward governors have been a significant source of ARV multi-train failures. These include out-these failures (AEOD/C602,1986). In many cases these of. adjustment electrical flow controllers resulting in overspeed trips have been caused by slow response of a improper discharge valve operation, and a failure of oil Woodward Model EG governor on startup, at plants 1
cooler cooling water supply valves to open due to silt where full steam flow is allowed immediately. This over-accumulation.
sensitivity has been removed by installing a startup.
steam bypass valve which opens first, allowing a con-5.2.2 Hurnan Errors trolled turbine acceleration and buildup of oil pressure.
to control the governor valve when full steam flow is HE1. 'nie overwhelmingly dominant cause of problems admitted.
identified during a series of operational readiness eval-uations of ARV systems was human performance. The DE2. Overspeed trips of Terry turbines have been majority of these human performance problems resulted caused by condensate in the steam supplylines. Con-from incomplete and incorrect procedures, particularly densate slows down the turbine, causing the governor with respect to valve lineup information. A study of valve to open farther, and overspeed results before the valve mispositioning events involving human error iden-governor valve can respend, after the water slug clears.
tified failures in administrative control of tagging and This was determined to be the cause of the loss-logging, procedunl. ec mpliance and completion of steps, of-all-ABV event at Davis Besse (AEOD/602,1986),
i verification of support systems, and inadequate procc-with condensation enhanced due to the long length of dures as important. Another study found that valve mis-the cross-connected steam lines. Repeated tests fol-positioning events occurred most often during main-lowing a cold-start trip may be successful due to system tenance, calibration, or modification activities.
heat up.
Insufficient training in determining valve position, and in administrative requirements for controlling valve DE3. Turbine trip and throttle valve (TTV) problems positioning were important causes, as was oral task as-are a significant cause of turbine driven pump failures signment without task completion feedback.
(IN 84-66). In some cases lack of TTV position indica-tion in the control room prevented recognition of a HE2. Thrbine driven pump failures have been caused by tripped TTV. In other cases it was possible to reset human errors in calibrating or adjusting governor speed either the overspeed trip or the TTV without resetting control, poor governor maintenance, incorrect adjust-the other. This problem is compounded by the fact that ment of governor valve and overspeed trip linkages, and the position of the overspeed trip linkage can be mis-errors associated with the trip and throttle valve. TTV-leading, and the mechanism may lack labels indicating i
associated errors include physically bumping it, failure when it is in the tripped position (AEOD/C602,1986).
to restore it to the correct position after testing, and failures to verify control room indication of TTV posi-DE4. Startup of turbines with Woodward Model PG-tion folkming actuation.
PL governors within 30 minutes of shutdown has re-sulted in overspeed trips when the speed setting knob i
NUREG/CR-5835 5.4
Failure Modes was not exercised locally to drain oil from the speed set-5.2.4 Component Failures ting cylinder. Speed controlis based on startup with an empty cylinder. Problems have involved turbine rota-Generic issue II.E.6.1,"In Situ Testing Of Valves
- was tion due to both procedure violations and leaking sicam.
divided into four sub-issues (Beckjord,1989), three of "Ibrry has marketed two types of dump valves for auto-which relate directly to prevention of AFW system matically draining the oil after shutdown (AEOD/C602, component failure. At the request of the NRC,in-situ 1986).
testing of check valves was addressed by the nuclear in-dustry, resulting in the EPRI report," Application At Calvert Cliffs, a 1987 loss-of-offsite-power event re-Guidelines for Check Valves in Nuclear Power Plants quired a quick, cold startup that resulted in turbine trip (Brooks,1988)? This extensive report provides in-due to PG-PL governor stability problems. The short-formation on check valve applications, limitations, and term corrective action was installation of stiffer buffer inspection techniques. In-situ testing of MOVs was ad-springs (IN 88-09,1988). Surveillance had alwap been dressed by Generic letter 89-10, " Safety Related Motor-preceded by turbine warmup, which illustrates the im-Operated Valve Testing and Surveillance" (Partlow, portana of testing which duplicates service conditions 1989) which requires licensees to develop and imple-as much as is practical.
ment a program for testing, inspection and maintenance of all safety-related MOVs. ' Thermal Overload Protec-DES. Reduced viscosity of gear box oil heated by prior tion for Electric Motors on Safety-Related Motor-operation caused failure of a motor driven pump to start Operated Valves - Generic Issue II.E.6.1 (Rothberg, due to insufficient tube oil pressure. Imwering the pres-1988)* ccmcludes that valve motors should be thermally sure switch setpoint solved the problem, which had not protected, yet in a way which emphasizes system func-been detected during testing.
tion over protection of the operator.
DE6. Waterhammer at Palisades resulted in AFWline CF1. The common-cause steam binding effects of check -
and hanger damage at both steam generators. The AFW valve leakage were identified in Section 5.2.1, entry spargers are located at the normal steam generator level, CC10. Numerous single-train events provide additional and are frec uently covered and uncovered during level insights into this prob!cm. In some cases leakage of hot i
fluctuations. Waterhammers in top-feed-ring steam MFW past multiple check valves in series has occurred generators resulted in main feedline rupture at Maine because adequate valve-seating pressure was limited to
}
Yankee and feedwater pipe cracking at Indian Point-2 the valves closest to the steam generators (AEOD/C404, (IN 84-32,1984).
1984). Ai Robinson, the pump shutdown procedure was changed to delay closing the MOVs until after the check DE7. Manually reversing the direction of motion of an valves were seated. At Farley, check valves were operating valve has resulted in MOV failures where changed irom swing type to lift type. Check valve re-such loading was not considered in the design (AEOD/
work has been donc at a number of plants. Different C603,1986). C(mtrol circuit design may prevent this, re-valve designs and manufacturers are involved in this quiring stroke completion before reversal.
problem, and recurring leakage has been experienced, even after repair and replacement.
DE8 At each of the units of1he South Texas Project, space heaters provided by the vendor for use in prein-CF2. At Robinson, heating of motor operated valves by stallation storage of MOVs wete found to be wired in check valve leakage has caused thermal binding and fail-parallel to the Class IE 125 V DC motors for several ure of AFW discharge valves to open on demand. At AFW valves (IR 50-489/89-11; 50-499/89-11,1989). The Davis Besse, high differential pressure across AFW in.
valves had been environmentally qualified, but not with jection valves resulting from check valve leakage has the non-safety-related heaters energized.
prevented MOV operation (AEOD/C603,1986).
5.5 NUREG/CR-5835
\\
I r
i Failure Modes I
j f
s CF3. Gross check valve leakage at McGuire and transistor or resistor failures due to moisture intrusion, Robinson caused overpressurization of the AFW suc-erroneous grounds and connections, diode failures, and tion piping. At a foreign PWR it resulted in a severe a faulty circuit card.
waterhammer event. At Palo Verde-2 the MFW suction l
piping was overpressurized by check valve %Kqe from CF6. Electrohydraulic-operated discharge valves have
.j the AFW system (AEOD/C404,1984). Gross check performed very poorly, and three of the five units usmg valve leakage through idle pumps represents a ponential them have removed them due to recurrent failures.
~)
diversion of AFW pump flow.
Failures included oil leaks, contaminated oil, and hy-l draulic pump failures.
CF4. Roughly one third of AFW system failures have been due to valve operator failures,with about equal CF7. Control circuit failures were the dominant source i
failures for MOVs and AOVs. Almost half of the MOV of motor driven AFW pump failures (Casada,1989).
l failures were due to motor or switch failures (Casada, This inchides the controls used for automatic and 1989). An extensive study of MOV cvents (AEOD/
manual starting of the pumps, as opposed to the instru-C603,1986) indicates continuing inoperability problems mentation inputs. Most of the remaining problems were l
caused by torque switch / limit switch settings, adjust-due to circuit breaker failures.
ments, or failures; rnotor burnout; improper sizing or use of thermal overload devices; premature degradation CF8. " Hydraulic lockup" of Limitorque SMB spring i
related to inadequate use of protective devices; damage packs has prevented proper spring compression to actu-due to misuse (valve throttling, valve operator hammer-ate the MOV torque switch, due to grease trapped in the ing); mechanical problems (loosened parts, improper as-spring pack. During a surveillance at 'llojan, failure of sembly); or the torque switch bypass circuit improperly the torque switch to trip the TTV motor resulted in trip-installed or adjusted. The study concluded that current ping of the thermal overload device, leaving the turbine i
methods and procedures at many plants are not ade-driven pump inoperable for 40 days until the next sur-quate to assure that MOVs will operate when needed veillance (AEOD/E702,1987). Problems result from under credible accident conditions. Specifically, a sur-grease changes to EXXON NEBULA EP-0 grease, one veillance test which the valve passed might result in un-of only two greases considered environmentally qual-l detected valve inoperability due to component failure ified by Limitorque. Due to lower viscosity, it slowly mi-(motor burnout, operator parts failure, stem disc sep-grates from the gear case into the spring pack. Grease aration) or improper positioning of protective devices changeover et Vermont Yankee affected 40 of the older (thermal overload, torque switch, limit switch). Generic MOVs of which 32 were safety related. Grease relief Letter 89-10 (Partlow,1989) has subsequently required kits are needed for MOV operators manufactured licensees to implement a program ensuring that MOV before 1975. At Limerick, additional grease relief was
[
switch settings are maintained so that the valves will required for MOVs manufactured since 1975. MOV re-e operate under design basis conditions for the life of the furbishment programs mayyield other changeovers to plant.
EP-0 grease.
i CF5. Component problems have caused a significant CF9. For AFW systems using air operated valves, number of turbine driven pump trips (AEOD/CS)2, almost half of the system degradation has resulted from 1986). One group of esents involved worn tappet nut failures of the valve controller circuit and its instrument I
faces, loose cable connections, loosened set screws, im.
inputs (Casada,1989). Failures occurred predominantly l
properly latched TTVs, and improper assembly. An-at a few units using automatic electronic controllers for
.i other involved oil !caks due to component or seal fail-the flow controlvalves,with the majority of failures due l
ures, and oil contamination due to poor maintenance to electrical hardware. At 'Ihrkey Point-3, controller
-l activities. Governor oil may not be shared with turbine malfunction resulted from water in the Instrument Air j
lubrication oil, resulting in the need for separate oil.
system due to maintenance inoperability of the air
.l changes. Electrical wmponent failures included dryers.
t NUREG/CR-5835 5.6 S
P
l Failure Modes -
f f
i CF10. For systems using diesel driven pumps, most of -
Inspections have identified inadequate testing of check the failures were due to start control and governor speed -
valves isolating the safety-related portion of the lA sys-control circuitty. Half of these occurred on demand, as tem at several utilities (Letter, Roe to Richardson).
opposed to during testing (Casada,1989).
Generic Letter 88-14 (Miraglia,1988), requires licen-
' t sees to verify by test that air-operated safety-related CF11. For systems using AOVs, operability requires the components will perform as expected in accordance with_
availability of Instrument Air (IA), backup air, or
. all design-basis events, including a loss of normal IA.
- l backup nitrogen. However, NRC Maintenance Tham i
f f
e i
t 1
i t
N
?
y I
r 5.7 NUREG/CR-5835 i
P p
m..
I i
6 Referente.s Beckjord, E. S. June 30,1989. Closcout ofGenericIssue AEOD Reports -
H.E.6.I, in Situ Testing of Vaires'. Letter to V. Stello, Jr., U.S. Nuclear Regulatoiy Commission, Washington, AEODIC404. W. D. Lanning. July 1984. Steam Bindmg DC ofAuriliary Feedwater Pumps. U.S. Nuclear Regulatory Commission, MSshington, DC Brooks, B. P.1988. Application Guidelinesfor Check Valres in Nuclear Power Plants. NP-5479, Electric AEODIC602. C Hsu. August 1986. Opr. eta alErper-Power Research Institute, Palo Alto, CA.
icnce Involving Turbine Overspeed Trips. t J.S. Nuclear Regulatory Commission, Washington, DC
~
Casada, D. A.1989. Auriliary FeedwaterSystem Aging Study Volume 1 OperatingErperienceandCurrent AEODIC603. E.J. Brown. December 1986. A Review AfonitoringPractices. NUREGICR-5404. U.S. Nuclear ofMotor-Operated Valve Perfonnance. U.S. Nuclear Regulatory Commission, %hshington, DC Regulatory Commission, Washington, DC t
Gregg. R. E. and R. E. Wright.1988. Appendis Review AEOD/E702. E.J. Brown. March 19,1987. MOVFail-for Daninant Generic Contributors. BLB-31-88. Idaho ure Due to Hydraulic Lockup From Excessive Grease bs National Engineering Laboratory, Idaho Falls, Idaho.
Spring Pack. U.S. Nuclear Regulatory Commission, Washington, DC Miraglia, E.J. February 17,1988. Resolution ofGencric Safety issue 93,
- Steam Binding ofAuxiliary Feedwater AEODfT416. Jannaty 22,1983. Loss ofESFAurdiary l
Pumps'(Generic Letter SS-03). U.S. Nuclcar Regulatory Feedwater Pump Capability at Trojan on January 22, I
Commission, %hshington, DC 1983. U.S. Nuclear Regulatory Commission, Washing-q ton, DC Miraglia, E J. August 8,1988. Instnament Air Supply i
System Problems Affecting Safety.Related Equipment (Generic Letter #S-14). U.S. Nuclear Regulatory Com-Information Notices
- mission, Washington, DC i
IN 82-01. 3anuary 22,1982. Auxiliary Feedwater Pump Pastiow,J. G. ]une 28,1989. Safety-Related Motor-Lockout Resultingfrom Wstinghouse W-2 Switch Circuit Operated Valve Testing and Surveillance (Generic Letter Modification. U.S. Nuclear Regulatory Commission, 89-10). U.S. Nuclear Regulatory Commission, Wash-Washington, DC ington, DC IN 84 32. E. L Jordan. April 18,1984. Autiliary Feed-Rothberg,0. June 1988. ThermalOvvioadProtection water Sparger and Pipe Hangar Damage. U.S. Nuctcar for Electric Motors on Safety.Related Motor-Operated Regulatory Commission, Washington.1C ibives - Generic Issue II.F 6.1.- NUREG-1296. U.S.
Nuclear Regulatory Commission, Washington, DC IN 84-66. August 17,1984. Undetected Unavailability of I
the Turbine-Driven Auriliary Feedwater Train. U.S.
"Ravis, R.and J. Taylor.1989. Development of Nuclear Regulatory Commission, Washington, DC Guidancefor Generic, Functionally Oriented PRA-Based Team inspectionsfor BWR Plants.ldennfication ofRisk-1N 87-34. C E. Rossi. July 24,1987. Single Failurcs in.
important Systems, Companents and Human Actions.
AuriliaryFeedwaterSystems. U.S.Nuclcar Regulatory TLv A-3874-TGA Brookhaven National Laboratory, Commission, Washington, DC Upton, New York.
6.1 NUREG/CR-5835 l
i e
?
References t
IN 87-53. C E. Rossi. October 20,1987. Auriliary inspection Report Feedwater Pump Trips Resultingfrom Low Suction Pressure. U.S. Nuclear Regulatory Commission, IR 50-489/89-11; 50-499/89-11. May 26,1989. South l
Washington, DC Texas Project inspection Report. U.S. Nuclear
[
Regulatoiy Commission, \\Wshington, DC.
IN 88-09. C. E. Rossi. March 18,1988. Reduced l
Reliability ofSteam-Driven Aiailiam Fredwater Pumps Caused byInstability ofIf bodward PG-PL Tspe NUREG Report
]
Governors. U.S. Nuclear Regulatory Commission,
\\Wshington, DC NUREG-1154.1985. Loss ofMain andAuxiliary Feedwater Event at the Davis Besse Plant on June 9,1985.
IN 89-30. R. A. Azua. August 16.1989. Robinson Unit U.S. Nuclear Regulatory Commission, Washington, 2 Inadequate NPSH ofAuriliary Feedwater Pumps. Also, l
Event Notification 16375, August 22,1989. U.S.
.l Nuclear Regulatory Commission, TWshington, DC
=!
.I 1
t E
a r
h I
+
i I
t
~!
1 NUREG/CR-5835 6.2
I NUREG/CR-5835 PNL-7925 l
Distribution j
- No. of No. of Copies Copies
.I i
I OFFSITE 5
Beaver Vallev Resident inspector Office.
{
20 U.S. Nuclear Rerulatorv Commission J. B::kel
~
EG&G Idaho, Inc.
l K. Campe RO. Box 1625 -.
OWFN 1 A2 Idaho Falls, ID 83415 i
l 10 J.Chung Dr. D. R. Edwards i
OWFN 10 E4 Professor of Nuc1 car Engineering University of Missouri - Rolla E Congel Rolla, MO 65401 OWFN 10 E4 i
R. Gregg -
l B. K. Grimes EG&G Idaho, Inc.
OWFN 9 A2 E O. Box 1625 Idaho Palls ID 83415 l
G. M. Holahan i
OWFN 8 E2 J. H. Taylor Brookhaven National Laboratory A R. Johnson Building 130 j
OWFN 14 D1 Upton,NY 11973
~i
'f' W. T. Russell R. Travis OWFN 12 E23 Brookhaven National 1.aboratory Building 130 A C. Thadani Upton, NY 11973 f
OWFN 8 E2 i
ONSIT8 e
2 B. E. Thomas OWFN 12 H26 24 Pacific Northwest Laboraton'
-[
.t R. H. Wessman S. R. Doctor
'l
- OWFN 14 D1 L. R.'Dodd
- i' B. E Gore (10) 8 U.S. Nucicar Reculatory Commission -
' R. C. Lloyd Rerion 1 N. E. Maguire-Moffitt
' B. D. Shipp l
C. W. Hehles E A Simonen M. W. Hodges T. A Vehec W. E Kane T.V.Vo W. D. Lanning Publishing Coordination -
T I Martin Technical Report File (5)
G. W. Meyer L. W. Rossbach i
R R Sena III l
?
l 1
a Distr.1
-j i
Ii
.a.
~.
L.
NQC ronu 335 U.S. NUCLE AR REGULATORY CoMMISSloN 1, RE PORT NUMBE R kRC
- 1102, mN ff en m,nn BIBLIOGRAPHIC DATA SHEET NUREG/CR-5835
<see ratructium on ene rmrus yy7_y925
- 2. TITLE AND SUBTITLE Auxiliary Feedwater System Risk-Based Inspection Guide for the Beaver Valley, Units 1 and 2 Nuclear Power Plants 3.
DATE REPORT PUBLISHED MON 1 H VLAR February 1993
- 4. FIN oR GR ANT NUMBER L1310
- 5. AUTHOR (S)
- 6. TYPE OF REPORT R. C. Lloyd, T. A. Vehec, N. E. Moffitt, B. F. Gore, T. V. Vo, Technical L.
W. Rossbach*, P. P. Sena Ill*
- 7. PE RloD COV E R E D fondusree Derest 1/92 through 1/93 B.,PE R F O RulNG,.o.om.ANIZ AT eon - N AM E AND ADDR E SS for NRC onwide oivosoon. ona ar neeron. u.s Nucear Reputerary commewon. and meihne nderra. tr eon RG or.,,,,d,, u a
Pacific Northwest Laboratory
- U.S. Nuclear Regulatory Commission Richland, WA 99352 Washington, DC 20555
- 9. SPONSORING oRG ANIZATlON - f4AME AND ADDR ESS (n esc. eror %me m sho.c~. er contracror, pro,ue Nac D,vasion, on,c. or serion,. u.a Nureer seguarory commess,an, and un,,aa-a Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555
- 10. SUPPLEMENT ARY NOTES
- 11. ABSTR ACT (200 words or ami In a study sponsored by the U.S. Nuclear Regulatory Commission (NRC), Pacific Northwest Laboratory has developed and applied a methodology for deriving plant-specific risk-based inspection guidance for the auxiliary feedwater (APW) system at pressurized water reactors that have not undergone probabilistic risk assessment (PRA). This methodology uses existing PRA results and plant operating experience information. Existing PRA-basec inspection guidance information recently developed for the NRC for various plants was used to identify generic component failure modes. This information was then combined with phnt-specific and industry-wide component information and failure data to identify failure modes and failure mechanisms for the APW system at the selected plants. Beaver Valley Units 1 and 2 were selected as two of a series of plants for study. The product of this effort is a prioritized listing of AFW failures which have occurred at the plant and at other PWRs. This listing is intended for use by NRC inspectors'in the preparatiot of inspection plans addressing AFW risk-important components at Beaver Valley Units 1 and 2.
- 12. KL Y WORDS/DESCR:P1 ORS fust waros orphreses ther wist assist meerrem en snennna reer report.J u Av AsLAmul y 51 AT E u(N1 Unlimited
~^"
Inspection, Risk, PRA, Beaver Valley, Auxiliary Feedwater (AFW) run v.o >
Unclassified cina naoorn Unclassified Ib. NUMBER OF PAGES
- 16. PRICE SdRC FORW 3.% G493
Printed on recycled paper Federal Recycling Program-4
- NUREG/CH-5835 AUXILIARY FEEDWATER SYSTEM RISK-BASED INSPECTION GUIDE FOR FEBRUARY 1993 TIIE IIEAVER VALLEY UNITS I AND 2 NUCLEAR POWER PLANTS UNITED STATES L^$$
^'L NUCLEAR REGULATORY COMMISSION POSTAGE AND E S PAfD WASHINGTON, D.C. 20555-0001 USNRC-PERMIT NO. G 67 CFMCIAL BUSINESS PENALTY FOR PRIVATE USE, $300 190559137531 1 IfN1"O tq N 9c -O a m f{y pelg 6 cGBLIC.*TIONS EV.~
t T r s rig e -N!F G y$, iNr. TON CC I"5M
_... _,. - _. ~..... _.
..~..~..a......
NUREC/CR-5835 AUXILIARY FEEDWATER SYSTEM RISK-BASED INSPECTION GUIDE FOR FEBRUARY 1993.
F.
~
TIIE BEAVER VALLEY UNITS 1 AND 2 NUCLEAR POWER PLANTS UNITED STATES -
NUCLEAR REGULATORY COMMISSION po((gGE At D ST E S PAID WASHINGTON, D.C. 20555-0001 USNRC PERMIT No. G 67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE $300 3pn555137531 1 laNir G Mjy)Eif[ouBLICATIONS SVCE Trg-poo-NUne3 c ^11 CC
^"*"5 WASHINGTON
- ~~
.