ML20044C198
| ML20044C198 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  |
| Issue date: | 01/31/1993 |
| From: | Gunther W, Travis R, Villaran M BROOKHAVEN NATIONAL LABORATORY |
| To: | Office of Nuclear Reactor Regulation |
| References | |
| CON-FIN-A-3875 BNL-NUREG-52344, NUREG-CR-5934, NUDOCS 9303190108 | |
| Download: ML20044C198 (55) | |
Text
-
NUREG/CR-5934 BNL-NUREG-52344 High Pressure Coolant Injection (HPCI) System Ris:(-Based Inspection Guic e for Quac-Cities Station, Units 1 and 2 4
l 11 ra, R. Travis, W. Gunther Brookhaven National Laboratory l'repared for U.S. Nuclear Regulatory Commission l
!a 21868R as868134 O
=
AVAllABILITY NOTICE Avanab4hty of Reference Matenals Crted in NRC Pubications Most documents cited M NRC publications will be aval!able from one of the following sources:
1.
The NRC Pubhc Document Room,2120 L Street, NW., Lower Level, Washington, DC 20555 2.
The Superhtendent of Documents, U.S. Government Pnnting Office, P.O. Box 37082. Washington, DC 20013-7082 3.
The National Technical information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC pubhcations, it is not intended to be exhaustive.
Referenced documents aval:able for inspection and copying for a fee from the NRC Pubhc Document Room include NRC correspondence and internal NRC memt.,randa. NRC bulietins, c6rculars, information notices, inspection and investigation notices: licensee event reports: vendor reports and correspondence; Commis-ston papers; and appheant and heensee documents and correspondence.
The following cocuments in the NUREG series are aval:able for purchase from the GPO Sales Program:
formal NRC staff and contractor reports, NRC-sponsored conference proceedings, international agreement reports, grant publications, and NRC booklets and brochures. Also avaliable are regulatory guides, NRC regJiatnons in the Code of Federal Regulatrons, and Nuclear Regulatory Commission Issuances.
Documents aval!able from the National Technical Information Service include NUREG-ser es reports and techncal reports prepared by other Feoeral agencies and reports prepared by the Atomic Energy Commis-sion, forerunner agency to the Nuclear Regulatory Commission.
Documents available from pubhc and special technical libraries include all open hterature items, such as books, Joumal articles, and tranractions. Federal Regrster notices, Federal and State le g station. and con-gressional reports can usually be obtained from these libraries.
Documents such as theses, dissertations, foreigen reports and translations, and non-NRC conference pro-ceedings are avalable for purchase from the organdation sponsoring the pubhcation cited.
Single copies of NRC draft ceports are avaliable free, to the extent of supply, upon written request to the Off ce of Administration, Distribution and Malt Services Section, U.S. Nuclear RegJiatory Commission, Washington, DC 20555, Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library,7920 Norfolk Avenue, Bethesda, Maryland, for use by the pubbc. Codes and standards are usually copynghted and may be purchased from the originating organ 2ation or, if they are American National Standards, from the American National Standards institute.1430 Broadway, New York, NY 10018.
DISCLAIMER NOTICE
- 1. is report was prepared as an account of work sponsored by an agency of the United States Government.
Nedner the United States Government nor any agency thereof, or any of their employees, rnakes any warranty, expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the resutts of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third pa1y would not infringe privately owned rights.
NUREG/CR-5934 BNL-NUREG-52344 High Pressure Coolant Injection (HPCI) System Risk-Based Inspection Guide for Quad-Cities Station, Units 1 and 2 Manuscript Completed: September 1992 Date Published: January 1993 Prepared by M. Villamn, R. Travis, W. G unther J. Chung, NRC Project Manager 13rookhaven National Laboratory Upton, NY 11973 Prepared for Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555 NRC FIN A3875
ABSTRACT The High Pressure Coolant Injection (HPCI) system has been exarnined from a risk
. perspective..A System Risk-Based Inspection Guide (S-RIG) has been developed as_ an aid to.-
HPCI system inspections at Ouad Cities.
Included in this S-RIG is ~ discussion of the role of-a HPCI in mitigating accidents and a presentation of a PRA~ based failure modes.which could prevent proper operation of the system.
The S-RIG uses industry operating experience, including plant-specific illustrative examples -
to augment the basic PRA failure modes. It is designed to be used as a reference for both routine -
inspections and the evaluation of the significance of component failures, d
iii.
...._..ma
b p'
a i
)
- CONTENTS Pace;
- ~
gj ABSTRACT.........
iii.
~ "
SUMMARY
vii '
q ACKNOWLEDGEMENT....................................
' ix n
1 ' INTRO DUCTI ON......................................
1-1 1.1 Purpose........
11 j
1.2 Application to Inspections....................... -.......
~ 11 i
5 s
2 HPCI SYSTEM DESCRIPTION........
2.li 4
3 ACCIDENT SEQUENCE DISCUSSION.................,.......
.3.li 3.1 loss of High Pressure Injection and a
Failure to Depressurize.........................,....
13 1:
j 3.2 Station Blackout (SBO) With Intermediate
?
Term Failure of High Pressure Injection............
-31
{
3.3 Station Blackout with Short Term Failure of High Pressure Injection............
32 I
3.4 ATWS With Failure of RPV Water Level Control at High Pressure.............,,.............
33 3.5 Unisolated LOCA Outside Containment...
33 3.6 Overall' Assessment of HPCI Importance in i
the Preventiori of Core Damage....
3-4
- )
4 PRA-BASED HPCI FAILURE MODES...........................
'41
- i
-r 5
HPCI SYSTEM WALKDOWN CHECKLIST BY RISK IMPORTANCE..
..5-1-.
d h
6.
OPERATING EXPERIENCE REVIEW :.................... c......
61-7 S UMMAR Y..................
17.l f e
S 8
R EFE RENCES............................................
.81:
L':
APPENDICES j:
A.1 Summary ofIndustry Survey of HPCI Operating Expenence I
' HPCI Pump or Turbine Fails to Start or Run......................
- A.1 -
A-2 Selected Examples of Additional HPCI Failure Modes Identified During Industry Survey -....................
A-8 ;
I i
V
- l
~
,,--n
.w
'=
y n.
c 4
g.
.,; ~
T f
d
,F z.-
n LIST OF FIGURES r
PagcI h 2-1 E Simplified HPCI Flow Diagram............... c..... s........ < -
2-2 n
c.
b LIST OFTABLES :
e Eagg'
[
4 Quad Cities HPCI System RIG Summary..............-.......... 3 -
5 Quad Cities HPCI System Cnecklist
' 5-2 6-1 ' HPCI Failure Sum m ary.....................................
6-1
.]
al
'h 6'2 HPCI Pump Turbine Fails to Start or Run l63.
HPCI Failure No.1 Subcategories.
...........s.......-
A-1 ~ HPCI Pump or Turbine Fails to. Start Industry Survey Results........................,.............
' A-2 '
. A-2 Summary ofIllustrative Examples of Additional A-9 :
. HPCI Failure Modes........ -.............................. -
-5.
V!;
. 7 r
s I
,s.
6
SUMMARY
e This System Risk-Based Inspection Guide has been developed as an aid to HPCI system.
inspections at Quad Cities. The. document presents a risk-based discussion of the role of HPCI in' accident mitigation and provides PRA-based HPCI failure modes (Sections 3 and 4). Most PRA oriented inspection plans end here and require the inspector to rely on his. experience and -
knowledge of plant specific and BWR operating history.
However, the system Rf G uses industry operating experience, including illustrative examples,-
to augment the basic PRA failure modes. The risk-based input and the operating experience have-been combined in Table 4-2 to develop a composite BWR HPCI failure ranking. This information can.be used to optimize NRC resources by allocating proactive inspection effort based on risk and :
industry experience. In conjunction, the more important or unusual component faults are reflected' in the walkdown checklist in Section 5. This, along with an assessment of the operating experience found in Section 6. provides potential areas of NRC oversight both for routine inspections and the
- post mortems" conducted after significant failures.
A comparison of Quad Cities and the industry-wide BWR, HPCI failure distributions is-presented in Table 4-2.
Although the plant specific data are limited, certain Quad Cities components exhibit a proportionally higher than expected contribution to total HPCI failures.
These components are candidates for greater inspection activity and the generic prioritization should be adjusted accordingly.
This generic ranking of HPCI failures has not been revised to reflect the presently available Quad Cities LER data, because the plant specific distribution of HPCI failures is expected to change with time.
R As the plant matures, operational experience is assimilated by the utility's staff and reflected --
in the plant procedures. For example, the incidence of inadvertent HPCI;isolations.due to
.j surveillance and calibration activities is expected to decrease. Conversely, aging related faults are
-i expected to become a more dominant contributor to the Quad Cities HPCI failure distribution.-
j The operating experience section, identifies several aging related failures which occurred at Duane -
1 Arnold, hatch, Cooper and Brunswick, generally in the pump and turbine electronics.
+
This report includes all HPCI LERs up to mid-1989. Subsequent LERs can be correlated j
with the PRA failure categories, used to update the plant specific HPCI failure contribution, and 1
compared with the more static HPCI BWR failure distribution. The industry operatit.g experience' is developed from a variety of BWR plants and is expected to exhibit less fluctuatio4with time _
than a single plant. This information can be trended to predict where. additional inspection oversight is warranted as the plant matures.
l
?
I Recommendations are made throughout this document regarding the inspection activities for '
l the HPCI System at Guad Cities. Some are of a generic nature, but some' relate' to specific' maintenance, testing or operational activities ~at Quad Cities.
vil..
1
!J-!J
'I
-g
' ACKNOWLEDGEMENT _
The authors wish to acknowledge the technical assistance of the NRC Program Manager, Dr.
J. W. Chung, as well as Mr. Anthony Hsia of NRR who coordinated the site visit, Gratitude is extended to Messrs. Tom Taylor (Senior Resident Inspector) and Paul Prescott
~
(Resident Inspector) for their constructive criticism of the draft report.
We thank Ms. ' Ann Fort for her efforts in the preparation of this manuscript, iX
L
e F
l 1.
INTRODUC110N 1.1 Purnose This HPCI System Risk-Based Inspection Guide (S-RIG) has been developed as an aid to NRCinspection activities at Quad Cities. The High Pressure Coolant Injection (HPCI) system has -
been examined from a risk perspective. Common BWR accident sequences that involve HPCI are described in Section 3 both to review the system's accident mitigation function and to identify system unavailability combinations that can greatly increase risk exposure. Section 4 describes and prioritizes the PRA-based HPCI failure modes for inspection purposes. = The results of a BWR operating experience review are presented in Section 6 to illustrate these failure modes. Section 6 also provides additional information in related areas such as HPCI support systems, human errors, and system interactions. A list of risk significant components is contained in Section 5, and.
references are provided in Section 8.
1.2 Application to Inspections This inspection guide can be used as a reference for both routine inspections and for identifying the significance of component failures. The information presented can be used to prioritize day-to-day inspection activities, and the illustrative HPCI failures can suggest multiple inspection perspectives. The S-RIG is also useful for NRC inspection activities in response to system failures. The accident sequence descriptions of Section 3 in conjunction with, the discussion of multiple system unava' ability (Section 6), provide some insight into combinations of system outages that can greatly increase risk. The discussion of the operating experience review provides information on the various failure mechanisms, and the corrective actions taken.. This could be useful to the inspector when reviewing a licensce's response to a HPCI system failure. The system RIG can also be used for trending purposes. Table 4-2 provides a summary of the HPCI operating experience, in particular the industry wide distribution of HPCI failure contributions. Those failure modes which account for a larger fraction of the HPCI system failures are candidates for increased.
inspection activity. Since the plant specific failure distribution is expected to vary over time, a mechanism to update and trend the Quad Cities HPCI experience, in comparison to the more static industry experience, is discussed.
1-1 m.
.m 1-
I J
i 2,
llPCI SYSTEM DESCRIPTION.
h The Quad Cities. High Pressure Coolant Injection (HPCI) system is a single train system:
(
consisting of turbine-driven injection and booster pumps, piping, valves, controls. and i
instrumentation. A simplified flow diagram is shown in Figure 2-1. The system is designed to j
pump a minimum of 5600 gpm into the reactor vessel over a range of reactor pressures from 200 j
to 1020 psig when automatically activated by low reactor water level (-59 inches) or high drywell pressure (2.5 psig), or when manually initiated. Two sources of cooling water are available.:
1 Initially, the HPCI pump takes suction from the contaminated condensate storage tank (CCST) j through normally open motor-operated valve. 2301-6. The pump suction automatically transfers to the suppression pool on low CCST level or high suppression pool level.: This transfer is i
accomplished by a signal that opens the suppression pool suction valve,2301-35. Once this valve.
is fully open, valve-position. limit switch contacts automatically close the CCST suction valve.
Events that raise the suppression pool temperature above the system design limits may require'a j
manual suction transfer back to the CCST.
]
l Upon HPCI initiation / the normally closed injection valve, 2201-8, automatically opens.
allowing water to be pumped into the reactor vessel through the main feedwater header. A l
minimum flow bypass is provided for pump protection. When the bypass is open, Cow is directed l
to the suppression pool. A full-flow test line is also provided to recirculate water back to the CCST. The two isolation valves are equipped with interlocks to automatically close the test line l
(if open) upon generation of an HPCI initiation signal.
.l 1
The HPCI turbine is driven by reactor steam. The inboard HPCI isolation valves,2301-4 and i
2301-5, in the steam line to the HPCI turbine are normally open to keep the piping to the turbine at an elevated temperature, thus permitting rapid startup. Upen receiving a signal from the HPCI i
isolation logic, these valves will close and cannot be reopened until the isolation signal is cleared 1
and the logic is reset. Isolation valve 2301-4 is powered from 480V AC power and controlled by an isolation logic system. 2301-5 is powered from 250V DC power and controlled by isolation logic l
system B.
E t
Steam is admitted to the HPCI turbine'through valve 2301-3, the turbine stop valve, and the -
l turbine control valve. These valves are normally closed. Valves 2301-3 and the stop valve are l
opened by an HPCI initiation signal once the auxiliary oil pump starts and generates sufficient oil pressure. Exhaust steam from the turbine is discharged to the suppression pool, while condensed steam from the steam lines and leakage from the turbine gland seals are routed to a gland seal condenser.
The HPCI system is automatically actuated on low reactor water level (level 2) or high drywell pressure, if automatic actuation fails, the system can be manuallyinitiated from the control room.
?
2-1 l
- ~ ~ - -.
hf 5
~
g.
g C.
p- =44~ --
--.~. m _
w n
MEACTOR MO 2301-4...
(F002).
- * * * " ' ' ' /
A.
P UE27 MO 2301-3 WO 2301-6 (F006)
(7003).
o
'. <* MO 2301-9 (F007) 4 WO 2301-3 (F001) rh
.= l +
I
~B
-@n
=.->.
MO 2301 N (F012)
F e, :
,;,ca, g'
WOja0,p10 g
~
800$TE u.m PuuP pgup e-
.,.1
,,,. [
M em coa 6h t
enever.
1 WO 2301-15 {*,
IF0115 M
'M X'
seca B
y....
E y
(E036) j ee es.n. es F
v._cE.
MO 2301 :
(F 2)
W CHA E
""O" T.J'.*4" y
MO 2301 (FOO4)
Q*6
- W ATER LfNE
~ ~ STE AM LtNE Figure 2-1 ' Simplified HPCI Flow Diagram 2-2 i.
_L_
u
q l
-l
- i 3.
ACCIDENT SEQUENCE DISCUSSION The role of the HPCI system in the prevention of reactor core damage is valuable information s
- that can be applied in the ~ normal day-to-day inspection activities. If a -plant has~ its own Probabilistic Risk Assessment (PRA), this information is readily available. Not only are plant ~
q specific' design and operating nuances considered, but the accident sequences, systems-and -
component risk importances are generally quantified and prioritized.
u Since most plants do not currently have PRAs, the application of risk insights is less straight-zj forward. An ongoing PRA-based Team Inspection Methodology for the Risk Applications Branch j
of NRR has developed eight representative BWR accident sequences based on a review of the y
available PRAs'. Because of design and operational similarities, these representative accidents can be applied to other BWRs for risk based inspections. This information can be used to allocate a
inspection resources commensurate with risk importance. In addition, if single or multiple systems are degraded or unavailabic, this methodology can be used to designate those accident sequences
.l that have become more critical due to the unavailability of a key system (s). - This can allow the-j inspector to focus on the remaining systems / components within a sequence to assure continued availability and minimize plant risk. Five of the eight sequences include the HPCI system, for q
mitigation or as a potential initiator and are discussed below.
1 3.1 Inss of Hich Pressure Iniection and Failure to Depressurize
~
l This sequence is initiated by a general transient (such as MSIV closure, loss of feedwater, or.
l loss of DC power), a loss of offsite power, or a small break LOCA. The reactor successfully.
scrams. The power conversion system, including the main condenser, is unavailable either as a.
direct result of the initiator or due to subsequent MSIV closure. The high pressure injection (HPI) systems (HPCI/RCIC) fail to inject into the vessel. The major of unavailability include one system disabled due to test or maintenance, and system failures such as turbine / pump faults, or pump
]
discharge, or steam turbine inlet valves failing to open. The CRD hydraulic (CRDH) system can also be used as a source of high pressure injection, but the failure of the second CRD pump or j
unsuccessful flow control station valving prevents sufficient RPV injection. The operator attempts
_]
to manually depressurize the reactor pressure vessel (RPV) but a common cause failure of the 1
safety relief valves (SRVs) defeats both manual and automatic ~ depressurization'of the reactor:
j vessel. The failure to depressurize the vessel after HPI failure results in core damage due to a lack-l of vessel makeup.
3.2 Station Blackout (SBO) with Intermediate Term Failure ofliich Pressure Iniection This sequence is initiated by a loss of offsite power (LOOP). The emergency diesel generators I
(EDGs) are unavailable, primarily due to hardware faults. Maintenance unavailability is a secondary contributor. Support system malfunctions include EDG room or battery /switchgear
'l room HVAC failures, service water pump, or EDG jacket cooler hardware failures. HPCI and RCIC are initially available and provide vessel makeup.
1 3-1 l
The high pressure injection systems can provide makeup until:
the station batteries are depleted, or the system fails due to environmental 1 conditions 'i.e.,
high lube _ oil temperatures or high turbine exhaust pressure due to the high suppression pool temperature and pressure, or the RPV is depressurized and can no longer support HPCI or RCIC operation.
the HPCI high area temperature logic isolates the system or long term exposure to high temperatures disables the turbine driven pump.
The reactor building environmental conditions can also impact long term HPCI system opera-tion. The reactor building HVAC and HPCI room cooling are dependent on AC power. The plant actions to monitor and control high area temperature should be reviewed, including any calculations necessary to establish a time frame for the implementation of these actions.
These measures, if effectively instituted, should.be very effective in reducing the risk' associated with this sequence. The resident inspector should examine the licensee's surveillance and maintenance programs for the portable diesel generator to assure that they provide a reasonable assurance of availability. In addition, the training program should be periodically. reviewed to confirm that the licensee maintains a_ consistent level of competence regarding portable DG connections, suppression pool swap over/high turbine exhaust bypasses and fire water supply /RHR connections under SBO-type conditions.
3.3 Station Blackout with'Short Term Failure of Hich Pressure Iniection This SBO sequence is similar to the previous sequence except the high pressure injection systems fait early. Station battery failures (including common _ mode) are an important contributor to this sequence, because HPI systems and the EDGs are DC dependent. HPCI unavailability due.
to turbine / pump failures and maintenance unavailability is also significant. Core damage occurs shortly after the failure of allinjections systems.-
This sequence is a major contributor to the Quad Cities core melt risk, primarily because the short term failures of HP1 do not allow sufficient time to align the fire water supply to the vessel.
As such, the Quad Cities HPC1/RCIC availability estimates are a significant influence on the total core damage frequency. The following sections of this report will provide information to assess
- HPCI system and component availability.
3-2 j
u, w
w 1
3 :.
Ilp I
O a
cg q;
!3.41 ATWS' with Failure of RPV Water Level Control at Hieh Pressure fI so
]
his sequence is initiated by a transient with initial or subsequent MSIV closure and a failure
~
L of the reactor protection system. ' Attempts to manually scram are not successful, however the; j
' Standby Liquid Control System (SLCS) is initiated. ' By definition, the condenser and the feedwaterf
' system are unavailable. The BWR Owner's Group Emergency Procedure Guidelines (EPGs) had recommended RPV water level reductions to control reactor power below 5% and the BWRL representative sequence was based on that philosophy.
+
1
' His sequence postulates a failure to ensure sufficient RPV makeup at high pressure to pre '
1 vent core damage. There are several failure modes:
a s,
1.
HPCI is unavailable due to random failures or because of test / maintenance activities.
i 2.
Failure to bypass the HPCI suction transfer logic results in system failure due to high lube oil temperatures.
d t
3.
Failure to bypass the high turbine exhaust trip causes a HPCI system isolation on high back pressure assuming the containment remains intact.
l
~!
The inability to maintain RPV water level above the top of the active fuel (TAF) requires j
manual emergency depressurization, which is expected to result in core ~ damage before the low.
pressure ECCS can inject.
d
.i The continued operability of HPCI during an ATWS event is critical. Within the context of this accident sequence, (i.e., time available for success) the licensee capability to perform the logic 4
bypasses should be evaluated periodically. With regard to HPCI system availability, the remaining l sections will discuss system failures and availability evaluation.~
- 3.5 Unisolated LOCA Outside Containment The initiator is a large pressure boundary failure outside containment with a failure to isolate ;
}
the rupture. The piping failure is postulated in the following systems: main - steam. (60%),-
feedwater (12%), high pressure injection (20%),' and interfacing LOCA (8'7o). The percentages-indicate the estimated relative core damage contribution of each system.
2 3
An interfacing LOCA initiator is defined as the initial pressurization of a low pressure line-which results in a pressure boundary failure, compounded by the failure to isolate the failed line.
l The failure is typically postulated in a low pressure portion of the core' spray (CS). system, the i
LPCI, shutdown cooling and (to a lesser extent), the HPCI or RCIC pump suction or the head :
j spray line of RHR system.
i The unisolated LOCA outside containment results in a rapid loss of the reactor coolant:
!l system (RCS) inventory, eliminating the suppression pool as a long term source of RPV injection.
1
- Piping failures ir, the reactor building can also result in unfavorable environmental conditions for 1
~ he ECCS. Unless the unaffected ECCS systems or the condensate system are available,long term t
RPV injection is suspect and core damage is likely.
i a
i 3-3 j
n..
. ~. -..
4 I
i There have been several HPCI pump suction overpressurization events, primarily during l
surveillance testing of 2301-8, the normally closed pump discharge motor-operated valve.5 This is i
i of particular concern for the configuration with a testable air-operated check valve in series with the normally closed MOV, because of the valve's history of leakage.
l 3.6 Overall Assessment of HPCI importance in the Prevention of Core Damane i
J f
As previously stated, the high pressure injection function (HPCI/RCIC/CRDH) contributes to mitigation of five of the eight representative BWR accident sequences. The system failures for all eight sequences were prioritized by their contribution to core damage (using a normalized Fussell-Vesely importance measure). The HPI function in aggregate was in the high importance category. Other high risk important systems are Emergency AC Power and RPS.The HPCI system ~
[
itselfis of medium risk importance, because of the multiple systems that can successfully provide.
i vessel makeup at high pressure. For comparison, other systems with a medium risk importance i
are: Standby Uguid Control, Automatic / Manual Depressurization Service Water, and DC Power.
t i
i i
i I
l i
l l
9 t
I
'i i
l i
~
.:l 3-4
-l u
<j e
- \\
il i
4.
PRA-BASED HPCI FAILURE MODES PRA models may be used for inspection purposes to prioritize systems, components and hu- -
man actions from a risk perspective. This enables the inspection effort to be apportioned based on a core damage prevention measure called risk importance. The HPCI failure modes for this system Risk-Based Inspection Guide (System RIG) were developed from a review of BWR plant specific RIGS" and the PRA. Based Team inspection Methodology.' The component failure modes are presented in Table 4-1, grouped by risk significance. There are four failure modes of high risk importance, four of medium risk importance, and 15 oflower risk importance, for a total j
of 23 failure modes. The Fussell-Vesely Importance Measure has been used to determine these unavailability with the likelihood that the failure mode / unavailability will occur. Table 4-2 contains rankings.
He importance meausre combines the risk significance of a failure mode or 1
a summary of the operating experience for the industry and for Quad Cities with regard to these j
risk significant failure modes. Appendices A-1 and A-2 provide more detailed information on the'-
failure events, and are sorted by failure mode.
PRAs are less helpfulin the determination of specific failure modes or root causes and do not a
generally provide detailed inspection guidance. This makes it necessary for an inspector to draw on his experience, plant operating history, Licensee Event Reports (LERs), NRC Bulletins, Information Notices and Generic Letters, INPO documents, vendor information and similar sources to conduct an inspection of the PRA.prioritized items. To accomplish this task, Section 6 presents the results of a detailed review of the HPCI operating experience. The aforementioned sources of HPCI information are correlated by PRA failure mode to provide illustrative inspection examples. This information was also used to develop the system walkdown checklist presented in the next scetion.
The failure rankings shown in Table 4-2 were estimated based on PRA-based ~ risk importances. operational input, and current accident management philosophy. The failure mode identified as HPCI pump or turbine fails to start or run was ranked as "high risk importance' (Table 4-1) and also accounted for the largest number of LERs related to the HPCI system identified in the industry survey, Thus, as shown in Table 4-2, this failure mode was analyzed in greater detail to identify the various causes listed.
j
}
'1 1'
i I
4-1
=-
V Table 4-1 HPCI PRA-based Failure Summary
,;(
y COMPONENTS' 2
Hich Risk Imtvrtance Pump or Turbine Fails to Start or Run System Unavailable Due to Test or Maintenance Activities Turbine Steam inlet Valve 2301-3 Fails to Open Pump Discharge Inboard Isolation Valve 2301-8 Fails to Open 2
Medium Risk Importance CST / Suppression Pool Switehover Logic Fails Suppression Pool Suction isolation Valves 2301-35,36 Fail to Open.
Normally Open Pump Discharge Valve 23019 Fails Closed or is Plugged Minimum Flow Valve 2301-14 Fails to Open, Given Delayed Activation of Pump:
Discharge Valve. 2301-8.
Inwer Risk Importance:
CST Suction Line Check Valve 2301.20 Fails to Open
' CST Suction Line Manual Valve 2301-22 Plugged
[
. Pump Discharge Check Valve 2301-7 Fails to Open Suppression Pool Saction Line Check Valve 2301-39 Fails to Open Normally Open Steam Line Containment Isolation Valve (2301-4 or 2301-5) Fails Closed -
Steam Line Drain Pot Malfunctions' j
Turbine Exhaust Line Faults, including:
Fails Closed q
r
- Normally Open Turbine Exhaust Valve 230174 i
Turbine Exhaust Check Valve 2301-45 Fails to Open -
Turbine Exhaust Line Vacuum Breaker (2399-5.6) Fails to Operate False High Steam Line Differential Pressure Signal-False High Area Temperature Isolation Signal False Low Suction Pressure Trip
-l False High Turbine Exhaust Pressure Signal
]
System Ac'uation logic Fails t
Pump Suetion Strainer Blockage
.. i e
' See Section 6 for a discussion of IIPCI human errors.
4 De Fussell-Vescly importance Measure is 'used to rank the system components. _This measure j
2 combines the ~ risk ~ significance of a ' failu're-or unavailability with; the likelihood that the' failure / unavailability will occur.-
f
- 4-2 4
C
-k
--'f)s m-4
m 3
. j s
s tnen u
4 s
^
a C
~
S y
e 1
6 6
0 6
0 3
0 3
0 4
v 2
r 4
u S
y r
t s
s e
u i
t d
i n
C I
d h
a t
u i
Q w
d era p
m o
7 2
2 0
1 0
1 0
1 0
5 C
1 ye vru S
R E
L n
'g re n
t i
+
s y
k S
n a
IC R
'l P
e r
I u
I l
3 ia F
2 N
s t
in
)
U
(
s i
'n e
t o
C i
1 i
t 7
5 4
3 3
3 2
'l 1
0 u
1 d
b 4
a i
s r
u R
t.
Q V
m n
C 2
I l
4 l
bic A
se
~
r l
t+
a u
T i
6 a
1 8
7 5
5 5'
3 2
2 4
F 1
1 6
fo e
s d
g r
n l
e o
ts o
n s
r e
in n
i n r
l a
t l
l t
w i
br u u
v n
o n
t u
t n
l u
p uR a
d e
e i a
o f
t w
T o
I e
r l
a v
c R
s v
r r
ly o
l t l f
l l
c e
h w
i a
s a r
p c
r o d
p s
o r
e k
pr e
p r e ip p
ak l
t o
ig v
uf e
r i
g oL m
s s
o e
lo m
e i
h n A
t el o
h is trT a
p u
e l
mb tr ts ed tr b
d ts I
mt s
s x
aO o'.
i la te o
n i
e uS t
n r
r s e s ST
.r n
i e
e e e
P o iblts o
inp e e n e n
r e
.ul I
f v g B
t n
Pi u a u
u e n i b u ibt w
blt o
. n o
t t
r i r u
c i s r
U e
b e e u ci i
Cl t
a s
r u b
r s v
l rl p
s s r sS
.F r u s
r a
u i uu l
u a o i u o
I F t f l
t r
iI t F t
r f
t f l
md li
'w a
a a
I r
e h
j I'
L -
i M
9' 9
p e
s t
E n
7, 9,
7, 7,
5, 6
e 1
9 m
7, 4
1, 8
5 3
5 4
4 4
mo F
1 C
6 W
m no i
tu s
bir 1
3 3
9 9
0 6
0 3
0 0
0 t
2 no C
9 e
s r
e u
i l
t i
ia C
F dauQ
'seru l
hw i
's a
F f
7 1
1 3
3 0
2 0
1 0
0 0
4 o
r g
b
!T e
mu N
t
'gn i
M k
2 3
n y
a o
1 R
2 3
4 5
6 7
8 9
1 1
. 1 t
eru li y
a F
1 e
y 9,
)%
(
'n l
1 1
o
. 4 7
6 5
5 2
3 2
1 itu 2
eb S
r ir R
lutn W
i o a
y B
FC m
1 1A s
9 e
f r
u l
i 3
0 8
8 3
1 3
2 1
I I
6 aF 4
1 y
fo t'
e e
n s
u e
e ic i
tnl n
g o
n s
e o
b oi n
n d
n v
r s a
i PF e
io J e t
t l
e n
b i
e r
e a
t ul l
O t
le I
p u
l s
Vp i
n la n
in o
Ta' nc o
d ip b s c
s io
)
e ms nl eO t
o a
o b
F oi o
s I ia g
t rl n
i g
't c
lai a
e e' s o Pe o r
t a e eI c
o a
i r
mF Wn s
i i te r r
t r
t Ae ip s
v t
a u
pv el nl a v a
n e
v i S'
t h s e
u r
sr g
Oal r r oal s
l a) o D
a c C
nA h l te1 l
tnI c
w igS ly pv a
0 ci h u T
hi V
pe iVl t
s a
F' 2
u M
igi SV is a I
n eT D
sP igt s nF F
C A
a me
(
e U
l r
r l
l t
t uo e
t s
s r
I f
a ud S h r o) i ml m
I el u
u 2
l ei in(
)
4 l
m e
T lai ig ul g uV tsl ts ls e pa e s e a ma e
/c pi 1 u
en p6 l
t t
s Ti pcB r
i eA e e t
b v e
e s
n s s sh rh o y a y i l
mg l
r m0 a
sff h
a T
l e
a x oxl S w uuI l
l F
ts a
a ei a
b y o FDS TVO P(
a St T
t e
e a
y= d q
4
g.,.
a e
s.
- +
a a
n rs
.y..
(
4
}
x s.g t'
6 F
k 2 -.
c b
C 5.:
g
. 4 oQ.
a.'
c
'?
c' 73
.Dg
+
emp M
E 6
=
'.k
.=
=
a Q
ede e
-.S.
t
-==
'1 u
M
. aus c.
6
'f I
C DZ
-b C
2, -
aM T
a t=
3 e
N M
m
'4 C
O e
&.e 16 g
.=_ e
'.E
.a
.2
.4<
t
+
,e w.
eda 4mm G
i k
P
' e a
e
..C ' C
- J*
W h
S Em
.i
'C
> O
.2.
N w
a y
V
=
see.$
' O
. U..
g
'm gw
~
a N'
<5 '.
'a 3N 6
'e-i
.2_
.P.
. 3 W
. g.
1 4-5 t
w
+
7
- i Table 4-2 Notes
-l 1.
Failure contribution is expressed as a percentage of all significant HPCI failures as developed '
l by the Operating Experience Review.
~
j i"
2.
Failure ranking is a subjective prioritization based on PRA and operational input, recovery potential, current accident management philosophy and conditional failures, as applicable.
3.
Quad Cities significant HPCI failures are based on a review of all available LERs.
l 4.
Although some caution is warranted due to the limited plant specific data, this failure mode seems to comprise a disproportionate fraction of the Ouad Cities HPCI unavailability. 'Ihis area is a candidate for enhanced inspection attention.
j 5.
Failure importance was upgraded from the PRA-based ranking of Table 4-1.
6.
Failure importance was downgraded from the PRA-based ranking of Table 4-1.
HPCI isolation and trip logics are significant contributors to unavail' ability. The system can 7.
be isolated by a single malfunction, yet instrument surveillance intervals can be greater than the more reliable actuation logic.
8.
Unlike the system trip and isolation logic the actuation logic arrangement (one out-of-two twice) diminishes the importance of a single instrument to reliable system operation. At least two low RPV level or two high drywell pressure sensors must fail.. :As discussed in Section 6, availability is more dependent on control power.
9.
The latest BWROG Emergency Procedure Guidelines deemphasize the suppression pool as an injection source.
- 10. Conditional on the delayed opening of the pump discharge line valve, F006.~
- 11. Unlike the rest of the failure modes listed herein," Systems Interactions"is not PRA-based.
It was identified as a significant failtire mechanism during the operating experience review and is discussed in Section 6.
4-6
s.
J.5.
- IIPCI SYSTEMTVALKDOWN CIIECKLIST BY RISK IMPORTANCE -
Table 5.1 presents the HPCI system walkdown checklist for.ui,e by the inspector.' : This-
-- information permitsinspectors to focus their efforts on components important to system availability and operability. Equipment locations and power sourecs are provided to assist in the review of this system.
~
' i 4
i i
f s
t t
f
~
e
'f s
a i
p I
l
. j
. i I
- l 5-1
Table 5-1 Quad Cities Units 1 & 2 HPCI System Walkdown Checklist
'ACIUAL i NO.
NMN '
NER MCE A NMN WANDBY W,W
' DESCRIP110N (Unit 2)
POSI110N.
. POSI110N A. Components et liigh Risk Significance Note: All circuit breakers should be closed (ON) lirbine Steam Isolation Valve F001 IIPCI Room MCC 1 A (2A)
Cimed MO 23013 Rt. Bidg. D 623 Inboard Steam Isolation Valve F002 Containment MCC 191 (291)
Open MO 2301-4 Rx.Ilidg. D.623 Outboard Steam Isolation Vah*e Torus Area by RIIR MCC 1 A (ZA)
Open F003 MO 2301-3 Room Rx. Bldg. D. 623 Purnp inboard Discharge Valve F006 Outside MSIV Room MCC I A (2A)
Ckned MO 23018 Rn. Bldg. D. 623 IIPCI imttter '
PNL901-63 In Passateway by EllC PNL 901-39 On UPS Skids Aux. Dec. Room flow & Pressure Control Station FY-2386 lbrdine Bldg.
IIPCI UPS Energized D. 595' (Outside PNL 901-63 oil storage room)
- 11. Components of Medive Risk Significence i
CCST Suetion Isolation Valve ~
IV04 IIPCI Room MCC 1 A (2A)
Open MO 2301-6 Rs. Bldg. D. 623 Pump Outboard Discharge Vaht IT07 IIPCI Room MCC 1A (2A)
Open MO 2301-9 Rx. Illdg. El. 623 Pump Minimum flow Valve ~
IV12 IIPCI Room MCC 1 A (2A)
Clmed MO 2301-14 Rx. Illdg. El. 623 Pump Suction From Suppension Pool IV42 IIPCI Room MCC 1 A (2A)
Closed -
MO 230135 Rs. Illdg. El. 623 Full Flow lest Valve to CCST F008 IIPCI Room MCC 1 A (2A)
Closed MO 2301 10 Rx. Illdg. G.- 623 Isolation Instrumentatior PNL 2201 Cable Spreading Room MCC 1 A-1 (2A 1) Div.1 Energired 73A.B MCC 1111 (28-1) Div. 2 Rx Bldg. D. 623 i
~
i 31 I
i l
I 6.
. OPERATING EXPERIENCE REVIEW As previously stated, an operating experience review was conducted to integrate recent industry experience with PRA derived failure modes. Approximately 200 HPCI Ucensee Event Reports (LERs) from the period 1985 to mid 1989, were reviewed for applicability to the PRA -
i failure modes for HPCI. Sixty-two LERs did not have a corresponding failure mode. These LERs generally documented successful system challenges, admmistrative deviations, or seismic / equipment i
qualification concerns. The remaining 140 LERs documented 159 liPCI faults or degradations.
{
As presented in Table 6-1, these failures have been categorized by PRA failure mode to provide.
a relative indication of their contribution to all HPCI faults. Each of the fourteen PRA-based failure modes that has cortesponding industry failures is discussed below. Selected LERs.
j identified during the operating experience review, are summarized to illustrate typical failure
- j mechanisms and potential corrective actions. Where applicable, other sources of background.
i information, invuding NRC Bulletins, Information Notices, inspection Reports, NUREGs, and AEOD Reports are cited. Quad Cities failure experience over the plant life is also integrated into ll the discussion of each HPCI failure mode.
i 1
The illustrative LERs for the first failure mode, llPCI Pump or Turbine Fails to Start or Run", are presented in Table A-1; the LERs for the balance of the failure modes are presented in
.j Appendix A-2. The text provides complementary information on the failure distribution within a i
subsystem.
I
}
Table 6-1 IIPCI Failure Summary J
Failure Total llPCIFallureContribution
~
Number Description Failures *
(%)
1 1
Pump or Turbine Fails to Start or Run 64 40 ~
2 System Unavailable Due to Test or Maintenance j
Activities 43 27 3
False 11igh Steam Line Differential Pressure Isolation Signal 10 6-4 Turbine Steam inlet Valve (14101) Fails to Open 8
5 5
Pump Discharge Valve (F006) Fails to Open 8
5 6
Systems Interactions Fail liPCI 3
2 7
System Actuation logic Fails 4
3 8
False Iligh Area Temperature Isolation Signal 3
2
-l 9
False low Suction Pressure Trip 2
1 j
10 False liigh Turbine Exhaust Signal 1
<1 i
11 N >rmally Open Turbine Exhaust Valve Fails Closed 1
<1
{
12 CST / Suppression Pool Switchover logie Fails 1
<1 13 Suppression Pool Suction Valve (F042) Fails to Open 6
4 14 Minimum Flow Valve (F012) Fails to Open 5
3 159 Devek> ped during the llPCI Operating Experience Review which examined liPCI LERs from 1985 to mid 1989.
1 l
l l,
6-1
. l
1 h
- l 6.1 HPCI System Failure Modes
-l t
HPCI Failure No.1 - Pump or Turbine Fails to Start or Run i
The. major contributor to HPCI system unavailability, both from. a risk and operational viewpoint. is the failure of thc turbine driven pump to start or continue running. This failure mode f
includes many interactive subsystems and components which can make root cause analysis' and l
component repair a complex task. This has been reflected in BWR PRAs by the variation in the subsystems that comprise this failure of the pump or tur'ine to start or run. This has resulted in-j some confusion in the application of PRA insights to inspection. For the purposes of this study,.
-l this failure has been dermed as those components or functions that directly support the operation -
.j i
of the pump or turbine. Table 6-2 presents the subcategories that are included in Failure No. I, as well as the number of faults each subcategory contributed. The *HPCI Pump or Turbine Fails to Start or Run" basic event accounted for 64 failures or 41% of the HPCI faults in this operating-experience review.
}
6.1.1 Turbine Speed Control Faults
{
HPCI turbine speed is controlled during all rnodes of operation by providing hydraulic mechanical positioning signals to the turbine control valves to regulate the amount of steam j
admitted to the turbine. A cam position unit positions the control valve via a camshaft in response to speed demand signals from the motor speed changer (MSC) or the motor gear unit (MGU).
The purpose of the MSC is to control the turbine acceleration rate during initiation so that the turbine does not overspeed, to provide speed control during testing, and to serve as a backup to the MGU in the event of a failure of the flow controller. The MGU provides mechanical-hydraulic -
speed control in response to the flow demand signal from the flow controller during automatic r
initiation. It controls flow rate over a turbine speed range of 2000 to 4000 rpm.
- j As indicate.d in Table 6-2, the turbine speed control faults in the industry operatmg expenence
- database are a significant portion of the total failure mode causes. At Quad Citicis, however, these components (EGM and EGR) are related more to the RCIC System. In general, the Quad cities turbine speed control has been fairly reliable.
j At Quad Cities Unit 2, there were three LERs (87-006,87-003, and 85-002) which were related f
to failures of the motor gear unit. Dirty contacts and improper gapping of relay contacts were two I
of the causes of failure.
li
. An expanded search of HPCI LERs back through 1980 yielded four more incidents (all at Unit 1)invohing turbine speed control faults at Quad-Cities in addition to the three mentioned above.
Two events,81-018 and 83-002, originated with mechanical adjustment problems in the motor I
speed changer (MSC). The former was due to a loose locknut on the MSC linkage which led to a misadjusted linkage. The latter was most likely a result of the installation of the low speed stop post too high on the moveable linkage collar. The MSC would not move from its low speed stop due to excessive friction caused by the low speed stop post wedging itself aga nst the low speed j
stop collar.
I li
)
i l
y
r
{
The other two events affected th'e signal converten speed' control circuitry. LER 82-016 -
discussed a failed amplifier circuit board in the signal converter speed control circuitry which -
j caused the HPCI MGU to move to the low speed stop, and could not be kept at its normal 1
shutdown position. ~ De second incident (LER 82-003) originated with a failed power' supply.
resistor and subsequent signal speed control circuitry amplifier malfunction,'also causing the MGU.
to fail to the low speed stop position. The old MGU controller wa's replaced with a new electronic controller to improve system reliability. The new controllers are located in the turbine building (el.
595').
[
l-The HPCI turbine speed control is a complex area that requires specialized attention. The-inspector should confirm that the licensee acknowledges the complexity of the turbine speed l
control by having a trained specialist on staff, a good working relationship with the appropriate l
vendors, and adequate vendor oversight on proposed modifications or repairs.
i Table 6-2 IIPCI Pump Turbine Fails to Start or Run - IIPCI Failure No. I Subcategories i
Subcategory Description LER Failures f
Turbine speed control faults, including l
EG41 control box 6
i Motor speed changer 5
(EG-R actuator remote servo)
Resismr box 2
16 Ramp generator / signal converter box 1
Magnetic speed pickup cable 1
. Speed control potentiometer l'
D Lube oil supply faults 11 Turbine over-speed and auto reset problems
.8 Inverter trips or failures 7-Turbine stop valve failures 5
Turbine exhaust rupture disk failures
'5 Flow controller failures 5
Turbine control valve faults 3
j l_ ass of lube oil cooling 2.
Miscellaneous: Valid high steam flow during testing
_2_
TOTAL 64 6-3
t 6.1.2 Lube' Oil Supply Faults-This subcategory consists ~of eleven failures to provide sufficient lubricating oil to various turbine components. As presented in Table A-1, most of the faults are related to the auxiliary oil.
pump and include two bearing failures and five auxiliary oil pump pressure switch faults. Three -
other events irvolving low bearing oil pressure events were attributed to valve mispositions and oil contamination.
Quad Cities experienced two lube oil supply faults:
q l
1.
LER 81-016 reported a leaky fitting in the oil supply line to the pump bearing. The cause 6
was attributed to misalignment of the piping to the bearing which generated stress on t e bearing.
2.
LER 84-001 described an event where the pump lubricating oil was found contaminated.
with water. No root cause was noted.
6.1.3 Turbine Over-speed and Auto Reset Problems The mechanical overspeed trip function is set at 125 percent of the rated turbine sipeed. He.
displacement of the emergency governor weight lifts a ball tappet which displaces a piston that -
allows oil to be dumped through a port from the oil operated turbine stop valve. This allows the spring force acting on the piston inside the stop valve oil cylinder to close the stop valve. The overspeed hydraulic device is capable of automatic reset after a preset time delay.
Overspeed and auto reset problems contributed eight failures to the turbine' driven pump-failure category. Two events at Quad Cities Unit 1 (LERs85-001 and 87-006) were attributed to -
failure of the electrical termination to the reset solenoid valves.Two other failures were caused by the swelling of the polyurethane tappet in the overspeed trip device tapped assembly head. An additional failure occurred at Dresden 2 in 1987 due to a loose hydraulic control system pressure switch contactor arm.
. Additional sources of information' on turbine overspeed trips are-Information Notice 86 14,' 86-14 Supplements 1 and 2 " and AEOD case Study Report C602."
6.1.4 HPCI Inverter Trips or Failures The HPCI Inverter is powered from a 125V DC bus and ultimately powers the turbine speed control circuit. There have been seven inverter problems. Three.were attributed ta internal electronics faults, and one overheating event due to an integral cooling fan failure. These Licensee Event Reports did not consider the aging of the electronics as a potential root cause. NRC research has concluded that inverter performance is related to ambient temperature and has developed specific inspection and testing recommendations to monitor inverter performance and detect incipient failures." Two additional problems involved short term unavailability of the -
inverter. One was a blown fuse; the other was an inverter trip' because the high voltage trip setpoint drifted low. At the time, the battery charger, supplying power to the inverter, was -
operating in the equalize mode; the input voltage to the inverter was 144V DC.
E L
Quad Cities did not experience any HPCI inverter trips or failures.
l 6-4 e-r e
m
~
W
z__
_z 6.1.5 Turbine Stop Valve Failures The stop valve is located in the steam supply line close to the inlet connection of the turbine.
The primary function of the valve is to close quickly and stop the flow of steam to the turbine when so signated. A secondary function of this hydraulically operated valve is to open slowly to provide a controlled rate of admission of steam to the turbine and its governing valve.
The operating experience data contained 5 failures of the turbine stop valve. Two were caused :
by large oil leaks One failure at Duane Arnold was attributed to the aging of the Buna-N rubber diaphragm in the pilot oil trip solenoid valve.
Two reportable events invohing HPCI turbine stop valves took place at Quad-Cities Unit 2 since 1980. In the first incident (LER 80-032), a pinhole leak was discovered in the outer cast surface of the stop valve cover resulting in a minor oil leak.. In the other event (LER 82-023), the -
turbine stop valve could not be reset following surveillance testing. The cause was traced to corroded contacts on a stop valve hydraulic oil pressure switch. Normal contact arcing was the root cause.
6.1.6 Turbine Exhaust Rupture Disk Failures The HPCI turbine has a set of two mechanical rupture diaphragms in series which protect the exhaust piping and turbine casing from overpressure conditions. When the inner disk' ruptures, pressure switches cause turbine trip and HPCI isolation signals. Iow pressure steam flows past the1 ruptured diaphragm through a rcstriction orifice directly into the HPCI toom. Rupture of the second disk would vent the turbine exhaust into the HPCI pump room without flow restriction.
The nominal rupture pressure is approximately 175 psig.
The five turbine exhaust rupture disk failures that were a part of the operating experience review, all occurred in 1985. One was attributed to cyclic fatigue, two were attributed to water.
hammer due to carryover from the exhaust line drain pot; and the root cause of two other failures was a manufacturing defect.
Here were no rupture disk failures at Ouad Cities.
6.1.7 Flow Controller Failures The flow controller in conjunction with the electro-hydraulic turbine governor, control turbine speed and pump flow. The flow controller senses pump discharge flow and outputs a 4 to 20-milliamp signal to the turbine governor to maintain a constant pump discharge flow rate over the pressure range of operation.
l:
Flow controller faults accounted for five HPCI failures. The dominant failure (3 LERs) was the failure of the flow controller to function in the automatic mode. Manual control was still available, however.
6-5
Ouad Cities Unit 2 reported one incident involv'mg a flow controller failure (LER 80-01B).
The HPCI MGU would not come off the high speed stop during a HPCI operability surveillance test. A failed component in flow controll. FIC 2-2340-1 caused the controller to fail in the high.
~ -,
position. No root cause for the failure was noted. Again, this equipment was replaced (modification M-4-1(2)-85-63A). It is expectd that moving the controls out of the HPCI room to-the turbine building willimprove the controller's reliability.
6.1.8 Turbine Control Valve Faults
~Ihe three control valve faults were attributable to different root causes. A leaking oil supply-line prevented proper operation of the valve. Susquehanna 2 apparently suffered a mechanical
}-
failure during (LER 86 008). The last incident was a potential failure due to broken lifting beam.
bolts. AEOD Report T906" provides additional information on the contributors to the bolt failures. Quad Cities reported no turbine control valve faults.
y' 6.1.9 Iess of Lube Oil Cooling The loss of lube oil cooling can be caused by faults in the cooling water lines to and from the -
cooler, cooler leakage, or flow blockage. A prolonged loss of tube oil cooling can lead to turbine bearing failure. The lube oil temperature is monitored by a temperature indicating switch with.
control room annunciation. This category has two failures, both involving the diaphragm of control valve PCV-F035. Neither of these failures occurred at Quad Cities.
Quad Cities Unit 2 experienced or.e incid_ent of this type in 1984 (LER 84-008). The normal HPCI cooling water eturn valve MO 2-2301-48 could not be reopened from the control room following surveillance 'esting. No cause could be fcund, and the problem could not be duplicated, so the event was classihed as an isolated occurrence.
6.1.10 Miscellaneous-Valid High Steam Flow During Testing Another potential system failure involves the practice of running the auxiliary oil pump to lubricate the turbine bearings or to clear a system ground. Monticello used this practice to attempt -
to clear a ground in the electro-hydraulic governor. When the.ault did not clear, a system test was -
initiated to confirm HPCI operability. When the operator opened the turbine. steam admission
~
valve to simulate a cold quick start, the system isolated on high steam flow. The operation of the-auxiliary oil pump caused the hydraulically' operated turbine stop valve to move from its full closed to its full open position. When the stop valve leaves the fully closed position it initiates a ramp generator that provides a flow signal to the turbine steam admission valve, allowing it to move to the open position. Since the auxiliary oil pump had been run_ning for some-time the ramp generator had timed out and a maximum steam flow demand signal was sent to the control valve.
This prevented the turbine steam admission valve from restricting steam flow at it normallywculd ;
during a turbine start, resulting in high steam flow at.d a system isolation.
Plant procedures address running the auxiliary pump periodically to keep the turbine bearings lubricated. When the auxiliary oil pumpis running, the high pressure coolant injection system will.
isolate if an automatic initiation signal is received at any time after the ramp generator has timed:
out, which occurs after approximately 10 15 seconds. The plant has taken the following corrective-7 actions to address the problem:
6-6
' ' ' ~ * - ~ ~ -
me.---,------
i A modification has been approved that will eliminate ramp generator initiation while the auxiliary oil pump is running unless a valid initiation signal occurs.
The high pressure coolant injection system operating procedures have been revised to include cautions addressing system inoperability when the auxiliary oil pump is running.
The operating procedures that verify system operability have been revised to include precautions about system status before and during the test. The control system ramp generator function during the opening of the steam admission valve is described in these procedures.
In summary, this is a significant concern because a common plant practice has the potential to disable the HPCI system. Even though the control system at Quad Cities is different than the one at Monticello, running the Auxiliary Oil Pump will cause the MSC to increase at a FAST RAISE rate and will control the control valve position. Quad Citics' operating procedures should be reviewed to ensure that the appropriate cautions ar e provided to the operator concerning disabling.
the HPCI system.
6.2 HPCI Failure No. 2 - System Unavailable Due to Test or Maintenance Activities A probabilistic risk assessment develops estimates of system unavailability generally using a~
fault tree. The fault tree is a diagrammatic representation of the known contributors to system -
unavailability. In addition to component failures, the system may not be funesional due to testing-or maintenance (T&M) activities. In a single train system, like HPCI, test and maintenance activities on one component tend to disable the entire system. It is important to keep the HPCI T&M contribution as low as possible because it is as important to system unavailability.
The root sources of excessive HPCI T&M unavailability were examined as part of-this operating experience review. Forty-three examples of test or maintenance errors (27% of all HPCI failures) were divided into three contributors to T&M unavailability. Inadequate maintenance or -
inadequate post-maintenance testing accounted for 22 HPCI failures. The problemsincluded valve-packing leaks, misadjusted torque switch settings, miscalibrations of a steam line differential pressure instrument and an EGR actuator, improper connection of a gland exhauster drain line to.
the tube (high pressure) side of the gland seal condenser, system adjustment without a retest, and a rag left in the turbine sump which disabled t he shaft driven oil pump. Only two of these errors were discovered in an HPCI operational test at low pressure. The bulk of these events occurred during maintenance or surveillance testing af power.
An incident occurred at Quad Cities (LER 86-082) where the operators were forced to declare HPCI inoperable after discovering that the flow controller proportional gain had been adjusted-without a retest of the system. HPCI was returned to service after the retest.
A second T&M category consisting of 4 events, is attributable to human error that:
inadvertently or incorrectly disables the HPCI system. Pertinent examples include the disabling of the wrong HPCI system at a two unit site, mistakedy disabling the auxiliary oil pump due to a-smoke odor in the HPCI room, and valving errors which.later caused a low pump suction trip or i inadequate lube oil pressure.
6-7
The final category, " system inadvertently disabled during testing." consists of thirteen personnel errors that temporarily disabled the HPCI system. These incidents include steam line containment isolation valve closure due to errors during testing of the isolation logic, a valve motor failure due l
to overheating caused by execssive stroking during a surveillance test, and an inverter trip caused by personnel error which resulted in a high voltage condition affecting both Channel C battery chargers. Quad Cities Units 1 and 2 have submitted 7 LERs related to test and maintenance t
practices. The majority of these LERs documented short term HPCI inoperability or repair i
outages due to human errors. These included maintenance or installation errors, inadequate repairs, incorrect operator assessment, and inadequate premaintenance design review.
In summary, the T&M component of system unavailability must be continuously monitored by the inspector to assure it is as low as possible. The licensee should be administratively limiting the time that the HPCI system is in test or maintenance during operation. System restoration should '
be vigorously pursued; HPCI should not be down for days, if it can reasonably be repaired in hours. If feasible, portions of the system should be tested during outages. In addition, HPCI-unavailability can also be minimized by adequate root cause analysis and effective corrective action -
to avoid multiple system outages to address the same failure.
6.3 HPCI Failure No. 3 - False Hieh Steam Line Differential Pressure Isolation Ogral.
The HPCI system is constantly monitored for leakage by sensing steam flow rate, steam pressure, area temperatures adjacent to HPCI steam lines and equipment, and high HPCI turbine exhaust pressure.
He steam flow rate is monitored by two differential pressure switches located across two different elbows in the steam piping inside the primary containment. The flow measurement is derived by measuring differential pressure across the inside and outside radius of each elbow. If a leak is detected, the system isolates the HPCI steam line and actuates a control room annunciator.
This failure category has 101.ERs which constitute 6% of the total HPCI failures. There is a generic concern associated with Rosemount transmitters due to oil leakages that affect -
instrument accuracy. There was one incident in this category (LER 87-017) at Ouad Cities Unit 1 in 1987. A Group IV isolation took place during the performance of the' HPCI monthly -
operability surveillance test due to a failure of the Rosemount differential pressure transmitter that-detects excess flow in the HPCI steam supply line. Transmitter 1-2352, which had failed off. scale low, was returned to Rosemount where the problem was identified as a loss of oil in the transmitter's sensing cell. In February 1989, Rosemount issued a Part 21 notification concerning the loss of oil problem in sensing cells of some of their Model No.1153 and 1154 transmitters.
l l
Additional information can be found in Information Notice 8216" and NRC Bulletin 90-01, l
Supplement I?
6.4 HPCI Failure No. 4 - Turbine Steam inlet Valve MO-2301-3 Fails to Open Motor operated valve 2301-3 is a normally closed <DC powered gate valve. This valve opens on automatic or manual initiation signal, provided the turbine exhaust valve 2301-74 is open, to admit reactor steam up to the turbine stop valve.
6-8
.~
p
- There have been 8~ failures of this valve to open on demand comprising 5% of all HPCI
]
i."
failures, including:
1 two cases of mechanical / thermal binding at Brunswick 1 one stuck valve at Cooper attributed to the restelliting of the disk-one valve motor failure at Fitzpatrick due to insufficient stem lubrication.
r Other failures were attributed to loose torque switch adjustment screws, potentially insufficient -
opening torque concerns, and sucking MCC relays.
~
l j
/7 Unit 1 at Quad Cities reported one event (LER 83-038) in which the HPCI Turbine Steam 1
Supply Valve MO 1-2301-3 (F001) failed to open. During the performance of the monthly HPCI D
valve operability surveillance test OOS 2300 3, the valve could'not be opened. The limit switch contact, which bypasses the torque switch, had opened prematurely preventing the valve frore q
opening. The root cause was attributed to changing torque characteristics of the valve whiot-
- i necessitated readjustment of the limit switch.
6.5 JiPCI Failure No. 5 - Pumo Discharee Valve MO-2301-8 Fails to Ooen Motor operated valve 2301-8 is a normally closed DC powered gate valve that is automatically.
opened upon system initiation. The failure of this valve to open disables HPCI injection into the reactor vessel.
There have been 8 pump discharge failures documented in the operating ~ experience review.
This failure mode accounts for 5% of all system failures.
~
One valve failure was due to a su of mispositioned auxiliary contacts in the. valve motor n
starting time delay relay. Other failures are more generic, including two failed niotors, a ground :
l of the DC control voltage at the torque switch, and inadequate torque concerns due to the use of :
starting resistors in the valve motor circuitry.
Unit 2 at Quad Cities has had three reportable failures of the HPCI pump discharge valve MO L i
2-2301-8 (F006). The first incident _(LER 80-034) occurred while HPCI was being used to help '
3 control reactor pressure following a Group 1 isolation and reactor. scram. _ Valve MO 2-2301-8
'l (F006) was found to be inoperable due to a short circuited motor on the valve operator..
?[
The second event (LER 82-010) took place during performance of the ' monthly HPCI valve' j
operability surveillance, QOS 2300-3, when the valve MO 2-2301-8 would not open. The root cause ti i
of this failure was a broken arm in the torque switch of the valve operator. The third event in thisy
.i category also involved a broken torque switch arm in the valve operator of MO 2-2301-8, LER 85-002. took place during the performance of HPCI valve operability surveillance testing, when.the:
valve failed to open upon a command' signal from the control room. Failure was attributed to a; 1
broken support arm, which holds the *open" finger contact. assembly; in the torque. switch,-
1 Limitorque Corp. Model No. 3B1003-G. Since this is a second recurrence of the torque switch q
support arm problem in this valve operator, it warrants attention in the future.
i i
69 q
am-w
~
j
- ?
si j
-?
6.6 HPCI Failure No. 6'- HPCI Systems Interactions -
Systems interactions refer to unrelated system failures that can disable HPCI. Although there is no associated PRA category, the industry operating experience review identified the following :
system interactions that disabled the HPCI system.
q l
1.
During a tire protection system surveillance. test, approximately one gallon of water' drained onto a battery motor control center (MCC) causing a circuit breaker overload trip
{
and valve inoperability.
i 2.
A cracked flow control valve test coupling sprayed water on a battery MCC and disabled a main steam line drain loss of power monitor. HPCI was disabled when the MCC was-deenergized to inspect and dry the components.
f 3.
An automatic sprinkler system in the HPCI room activated after a system test? The-
.I probable cause was vapor buildup from the leakoff drain system that activated,on ionization detector.
~
4.
Setpoint drift in a Fenwal temperature switch caused activation of a HPCI turbine oil -
reserve deluge system during a.HPCI turbine overspeed test. His incident occurred at' Quad Cities Unit 1 (LER 89-022) in November 1989.
He deluge system was inadvertently activated again when the system was returned to service. 'A pre-action j
system is to be installed to prevent any future inadvertent actuations.
l 6.7 HPCI Failure No. 7 - System Actuation Incie Fails Startup and operation of the.HPCI system is automatically initiated upon detection of either low water level (-59 inches decreasing) in the reactor vessel or high drywell pressure (~-2.5 psig, increasing). The HPCI system can also be manually initiated by arming and then depressing the -
manual initiation switch in the control room. When the manual pushbutton is used, it must be q
~
held down until all valves have repositioned.
Here were four LERs associated with this failure mode.. The l_ERs illustrate that the failure
'of the HPCI actuation logic is more likely due to common causes such as the loss of power.
.;~
Unlike the HPCI trip logic, the redundancy (one out'of two twice) and the diversity (Iow vessel level /high-drywell pressure) of the actuation logic make it less susceptible to individual sensor-failures.
No system actuation logic failures were reported at Quad Cities.
ll 1
6.8 HPCI Failure No. 8 - False Hich Area Temnerature Isolation Sicnal'
-)
1 De HPCI system is constantly monitored for leakage by sensing steam flow rate, stearr.
J pressure, and area temperatures adjacent to the steam line and equipment. If a leak is detected, the system is automatically isolated and alarmed in the control room.' The Quad Cities ambient -
temperature monitoring system initially contained four groups of four temperature switches (16--
4 total). This was modified recently to a one-out-of two taken once logic with only 4 temperature switches.
~
'i H
e 6-10
-i
'l
[
s I
.i s
d a
\\
This category accounted for three HPCI failures (2% of all failures). Two component failures
{
occurred. One was attributed to the failure of a resistor in the power supply for temperature monitoring module N603D. The second failure occurred when E41-N602C (Riley Tempmatie 86 i
module) failed. The failure was considered an isolated event; however, the licensee intends to
-l replace these mod _ules with a newer model. The last steam line isolation occurred during normal' j
operation at Hope Creek. It was attributed to a design error because the temperature differential ~
.j setpoint approximated that of normal operation. The minimum intake temperature setpoint was subsequently increased.
7 q
There were two events at Quad Cities Unit 2 in which minor steam leaks in proximity to the area temperature monitoring switches resulted in HPCI System isolations. The first took place j
during performance of the HPCI hot fast initiation surveillance OOS 2300-13 (LER 87-018); A sms" steam leak at the gland steam seal (pump end) of the turbine was impinging on the area temperature monitoring switches while the turbine was on the turning gear. The second event (LER _88-021) also occurred while pre-warming the turbine o_n ' the turning gear prior-to i
performance of surveillance test OOS 2300-1. A small leak through the gland steam seal of the j
turbine (which is not uncommon for this turbine at very low speeds)in the area of the temperature q
switches caused a system isolation on high area temperature. Modifications and logic changes
,j proposed to correct both of these events, should be followed up for verification ofimplementation.'
6.9 HPCI Failure No. 9 - False low Suction Pressure Trips a
f{
The purpose of the low pump suction pressure trip is to prevent damage to the HPCI pumps
.i due to loss of suction. Pressure switch N010 (this is PS,2360 at Ouad Cities) actuates to cause the' i
turbine stop valve to close.
j There have been two turbine trips attributed to false low suction pressure signals. One-occurred at Cooper because the low suction pressure switch isolation valve was inadvertently j
closed, and the second instance occurred at Brunswick 2,when HPCI isolated immediately after an -
initiation signal. Quad Cities has not had any HPCI (or RCIC) system isolations due to false low suction pressure trips.
j I
6.10 HPCI Failure No.10 False Hich Turbine Exhaust Pressure Sicnal 1
The high turbine exhaust pressure signal is one of several protective turbine trip circuits that j
close the turbine stop valve and isolate the llPCI system. The high turbine exhaust pressure signal i
is generated by pressure switches N017A or B (designated as PS 2368A (B) at Quad Cities). and-1 n
is indicative of a turbine or a control system malfunction.
j The operating experience review for Quad Cities found one LER. Quad Cities 2 (LER 86 L g
004) had a false high turbine exhaust trip that could not be reset.- The cause of_ the trip was q
corrosion of the pressure switch seals (Barksdale diaphragm. type, model 02W-M15055) which1
-3 allowed moisture into the easing and shorted the winng.
l 6-11
i t
6.11 HPCI Failure No.11 - Normally Onen Turbine Exhaust Valve Fails Closed 1
The failure of any of the turbine exhaust valves to open results in a turbine trip due to a valid -
~
high turbine exhaust signal. One acility had a failure of the turbine exhaust line swing check valve.
l r
The valve internals were found wedged in the downstream MOV 2301-7_4 and had the potential to trip the turbine due to high exhaust pressure. The failure was attributed to the forceful cycling of the swing check discs under low flow conditions. Reference 16 can' provide additional background y
information.
j Quad Cities reported no failures in this category that affected HPCI system operability.
3 However, repeated failures of the containment integrated leak rate tests (ILRT) of this valve has resulted in a planned station modification to install a sparger on the turbine exhaust line. This change will take the valve out of the ILRT requirements.
j t
6.12 HPCI Failure No.12 - Condensate Storace Tank / Suppression Pool Switchover Iecic Fr.ils i
In the standby mode, the HPCI pump suction is normally aligned to the contaminated r
condensate storage tank (CCST). Upon a low CCST level signal or a high suppression poollevel signal, the suppression pool suction valves 2301-35,36 automatically open with subsequent closure of the CCST suction valve 2301-6. System operation continues with the HPCI booster pump suction from the suppression pool.
The operating experience review found one example of a degraded HPCI pump suction switchover logic. One of the suppression pool level switches was out of calibration due to a slight amount of foreign material that was deposited on the float.
This PRA-based HPCI failure mode has become less important due to changes in the BWR Emergency Procedures which generally advocate the continued use of water sources that are external to the contaiment. This avoids potential ECCS degradation due to high suppression pool temperature (HPCI high lube oil temperature) while simultaneously increasing suppression pool 1
mass. The end result is that an HPCI pump suction transfer to the suppression pool is no longer that desirable, and the operator, especially in decay heat accident sequences, is likely to bypass the j
switchover logic to maintain the CCST suction source, or to realign if a switchover to the pool has occurred. Derefore, the inspection focus should be on the continued viability of the CCST as an
[
injection source during an accident sequence. For example, does the CCST have sufficient capacity
-j to satisfy long term injection requirements or are procedures and training in place to provide l
makeup?
There were no Quad Cities Station LERs related to CST / suppression pool switchover logic j
failures.
?
6.13 HPCI Failure No.13 - Suppression Pool Suetion Line Valve MO 2301-35 or 2301-36 Fails to -
Open -
i The suppression pool HPCI pump suction valves are normally closed, DC powered valves. At" Quad Cities there are two 250 VDC powered suppression pool HPCI pump suction valves,2301-35
-l and -36, in series with a check valve instead of the MOV and check valve arrangement found at'
. 7 most BWRs. The HPCI system is initially aligned to the contaminated condensate storage tank.
}
6 12 I
-l j
The suppression pool suction valve is opened and the CCST suction valve is closed on a CCST low -
water level or a high suppression poollevel signal. The importance of this HPCI failure mode has been diminished by the current emergency procedure guidelines which emphasize the continued use of outside injection sources. This requires operator action to bypass the HPCI suppression pool switchover logic to prevent the opening of MO 2301-35 (F042) and MO 2301-36. This is especially true for the decay heat removal (non ATWS) sequence where it is likely that the CCST,
makeup can be maintained.
There have been six failures of the suppression pool suction valve to open, representing 41 of all HPCI failures. All occurred during system surveillances. The valve failures are generic in nature and include two motor failures due to insulation degradation, one misadjusted torque switch, a limit switch failure and a valve disk separation. There have not been any reportable events of the HPCI suppression pool suction valves at the Quad Cities Station.
6.14 HPCI Failure No.14 - Minimum Flow Valve MO 2301-14 Fails to Open The minimum flow bypass line is provided for pump protection. The bypass valve,2301-14, automatically opens on a low How signal of < 1200 gpm decreasing when the pump discharge pressure is greater than 125 psig. When the bypass is open, flow is directed to the suppression pool. The valve automatically closes on a high Dow signal (>600 gpm increasing). During an actual system demand, the failure of the minimum Cow valve to open is important only if the opening of the pump discharge valve 2301-8 is significantly delayed. In general, this combination of events is not probabilistically significant. With regard to system operation and testing in the-minimum flow mode, the licensee response to Bulletin 88-04" should be reviewed to ' determine if the design of the minimum flow bypass line is adequate. Unless there is a design concern or a recurring problem with either component, inspection effort should be minimized in this area.
There was only one incident reported by the Quad Cities Unit 1 involving a failure of the.
HPCI pump minimum flow valve MO 1-2301-14 (F012) to open. In this case (LER 87-031) the.
valve failed to open automatically when the HPCI turbine steam inlet valve MO 1-2301-3 (F001) was opened during performance of HPCI valve operability surveillance. test OOS 2300-3. The -
cause of the failure was attributed to air in the sensing lines to the Cow switch (FS 2354) which monitors discharge flow. The work planning department was to incorporate backfilling of HPCI instrument lines into the instrument maintenance outage tasks in order to avoid this problem in the -
future.
The Operating Experience Review did not identify any HPCI failures for the following PRA-based failure modes:
h Normally Open Pump Discharge Valve (F007) Fails Closed or is Plugged -
Pump Discharge Check Valve (F005) Fails to Open CST Suction Line Check Valve (F019) Fails to Open CST Suction Une Manual Valve (F010) Plugged l
+
Suppression Pool Suction Une Check Valve (F045) Fails to Open.
j Normally Open Steam Une Containment Isolation Valve (F002 or F003) Fails Closed Steam Une Drain Pot Malfunctions Turbine E diaust Line Vacuum Breaker (F076, F077) Fails to Operate -
jl Suppression Pool Suction Strainer Blockage
.1 6-13 I
I t
i k
a 1
The PRA-based prioritization of HPCI failures correlates well_with the actual industry failure y
experience. With the exception of the first failure mode (MOV F007), all of the faults that follow l
~ have been designated as " low importance" in the PRA-based ranking of Section 4.
i 6.15 Contribution of Human Error to System Unavailability The potential for human error exists for activities such as, maintenance, calibration, st.rveillance and, of course, operation. Probabilistic Risk Assessments typically emphasize operator error both in fault trees (system failure diagrams) and in the event trees that describe accident As such, these failures are usually gross actions that can fail a complete system.
sequences.
Typical PRA-based HPCI human errors are:
1.
Failure to manually start the high pressure injection system if automatic actuation fails.
2.
Failure of the operator to transfer pump suction from the CST to the suppression pool after a pump trip on low suction pressure due to CST unavailability.
j 3.
Failure to drain HPCI steam line drain pot, given drain valve failures.
1 4.
Failure to provide makeup to the CST during an ATWS event.
5.
Failure to transfer pump suction from the suppression pool to the CST during an event i
with a high suppression pool temperature. There are two cases.when this must be performed, one during an ATWS event and one during a non-ATWS event _with the failure of suppression pool cooling.
6.
Failure to override the HPCI high-temperature isolation logic (for station blackout-4y sequences).
i 7.
Operator recovery from initial failure of HPCI.
j results in false isolation signals.
'{
9.
Failure to reset the HPCI system for operation after testing or maintenance.
f With the exception of the last two entries, these human errors are either: a) conditional, that-
~is, they must be considered within the. context of an HPCI failure or isolation (errors 1,2 and 3),
-l or b) event specific (items 4 through 7). These requirements make direct observation unlikely.The j
potential for these human errors can be evaluated indirectly by a review of the licensee procedures
!)
i and observation of operator performance at a simulator.-
i The last two human errors can occur during normal operation and are, therefore, more j
inspectable. Resident Inspectors routinely examine surveillance, calibration, and. maintenance?
j practices and procedures, and perform ECCS control room and plant lineup _ verifications. HPCI i
operability is confirmed by checking the steam supply and exhaust lineup, pump _ suction and i
discharge lineups and the control function settings (hand / auto station in automatic). ~ In addition,-
j i
the Quad Cities control room annunciation panel also provides information on ECCS availability.
-[
r 6-14 j
I 1
There is a second source of human error that is not readily discernible in most risk assessments because it is not considered as a separate failure. It is the human contribution to component unavailability. The component failure estimates are developed from plant specific experience, if enough data exists, or from other, more generic, data sources. In either case, the unavailability estimate of a standby component is based on the number of failures per total demands. This estimate inherently includes all failures caused by human error. Based on the operating experience review, it is estimated that more than 507c of the HPCI failures have a human error contribution.
\\
As previously indicated, the examination of licensee practices and procedures, as well as the I
application ofindustry experience, can help reduce that portion of the HPCI unavailability that is j
due to human error. In the reactive mode, a thorough root cause analysis and suitable corrective i
measures can prevent similar occurrences in the future.
.L r
6.16 Sunnort Systems Reauired for HPCI Operation l
The high pressure coolant injection system is dependent on other systems (called support systems) for successful operation. These systems are:
DC Power '
For system control (125 V DC) and valve movement (250 V DC).
l 11PCI Actuation RPV level and primary containment pressure instrumentation. for system l
initiation and shutdown.
Room Cooling For HPCI pump room cooling to support long term operations. This function'
]
requires service water (for cooling) and AC power for the fan motor.
1 q
During the HPCI Operational Experience Review the support system influence on HPCI availability was apparent. The loss or degradation of the DC battery or bus that powers HPCI has a straightforward effect. Besides the battery charger problems or fuse openings, the more unusual i
DC system problems included a battery degradation due to corrosion of the plates.- The suspected cause was a galvanic reaction due to plate weld metal impurities. Another concern is insufficient voltage at the load during transients which could trip the station inverters or fail MOVs (Browns Ferry 1, Brunswick 1 & 2 and Nine Mile Point 1). This would be of particular concern during a j
loss of offsite power or a station blackout event.
j S
The effect of the loss of room cooling on continued HPCI operation is not as clear. The system is typically required to support long term HPCI operation. Besides the random failures which can occur at any time, there is one sequence specific effect that should be examined. During station blackout, the room cooling is lost when continued HPCI operation is critical. The licensee t
{.
actions to preserve HPCI operation should be examined.. For example some plants will open-pump room doors to promote convective cooling, but that does not necessarily assure continued HPCI operation. The licensee should have pump room and steam line temperature calculations or have other proceduralized provisions (bypass high temperature isolation) to assure long term
{
HPCI operability.
jl 6-15
There were two reportable events at Quad Cities Unit 2 in which HPCI toom cooler problems forced the HPCI system inoperability. In the first case (LER 85-004), the HPCI toom cooler's fan tripped while a routine HPCI surveillance was being performed.. The fan's motor bearings had seized leading to a ground in the motor windings and subsequent trip. The second event (LER 88-002)-involved an overheated and short circuited control power transformer associated with the HPCI room cooler fan at MCC 29-2. a short circuit in a control relay caused the control power transformer to overheat and short circuit. No root cause was provided in the LER abstract describing this event.
y The RPV level or high drywell pressure instrumentation is required for multiple ECCS systems including HPCI. De operating experience review did not have any pertinent examples of failures of the ECCS actuation logic which directly affected HPCI.
In summary, support system problems can impact HPCI operation sometimes in a less than
{
1
. straightforward manner. In the context of specific accident sequences, these support systems may be more prone to failure. The inspector should verify licensee awareness of these interaction relations and confirm that compensating measures are adequate.
j 6.17 Simultaneous Unavailability of Multiple Systems
}
Multiple system unavailability is of concern because of the increased risk associated with h
continued operation. Although technical specification 3.0.3 tends to limit the risk exposure
-r somewhat, the licensee should avoid planned multiple system outages, if possible.
Within the context of the accident sequences discussed previously (Section 3), certain combinations of system unavailability result in a much greater risk of core damage. For example, j
the HPCI operating experience review had nine LERs that documented simultaneous HPCI and RCIC unavailability. During this period, the probability of core damage is greatly increased for accident sequences that require HPCI and RCIC for mitigation. This would include all the sequences described in the Accident Sequence Description except *Unisolated LOCA"Outsidel Containment." The unavailability of HPCI and an emergency diesel generator'would have similar impact on plant risk. Additionally, the simultaneous unavailability of HPCI and ADS (one LER, j
due to logic testing) somewhat impacts Sequence 1, " Loss of High Pressure Injection and Failure to Depressurize."
Although some of these LER examples of multiple system unavailability were due to random 3
failures, the majority involve licensee decisions to disable a system for surveillance when another i
critical system is not operable. Unless absolutely necessary, these configurations should be avoided,.
j as frequent entry into Technical Specification 3.0.3 greatly increases the risk of core damage, j
.e 6.18 LOCA Outside Containment Unlike the HPCI failures described earlier which describe the unavailability of the system for.
core damage mitigation, four events have occurred where HPCI is a potentialinitiator of a LOCA-
[
outside containmentf These LERs consist of degradations of the steam line isolation function and
.[
. pump suction line overpressurizations. The two steam line isolation problems both occurred at j:
Dresde'n 2. One was a steam line differential pressure transmitter with a non conservative setting.
The other was a failure of the inboard containment isolation valve to close.
j 6 16 1
a
.?
i
~
The remaining two incidents were inadvertent pressurizations of the HPCI low pressure piping..
A pump suction overpressurization occurred at Fermi (LER 87 030) during a system test.' A.
pressure surge of ~ 800 psig occurred in the HPCI pump suction piping after a turbine trip. The.
event was cntibuted to the slow closure of pump discharge lift check valve (F005). The licensee replaced the valve with a swing check, which is expected to close faster.
More recently,(October 31,1989) Dresden 2 declared HPCI inoperable due to elevated piping temperatures in the pump discharge line. The 260'F temperature was caused by feedwater back leakage through the closed injection valves. Discharge piping supports were damaged, attributable.-
to waterhammer caused by steam void collapse upon system initiation. In addition to the potential for piping damage, steam binding of the pumps is also a consideration. Information Notice 89-36" provides additional information on elevated ECCS piping temperature.
In general, the HPCI.LOCA outside containment initiator is a very small contributor to total.
core damage. The diverse steam line break detection logic and the downstream feedwater check.
j valve reduce the potential for an unisolated LOCA outside containment. The examples presented
~
3 above are potential areas ofinspection to assure that plant design or operation does not increase the potential for this initiator.
]
a f
i J
l l
'i
'j 1
[
l 6-17
i 1
a l
7.
SUMMARY
This System Risk-Based Inspection Guide (System RIG) has been developed as an aid to HPCI system inspections at Quad Cities. ' Die document presents a risk-based discussion of the
-l HPCI role in accident mitigation and provides PRA-based HPCI failure modes. In addition, the l
System RIG uses industry operating experience, including illustrative examples, to augment the i
basic PRA failure modes. The risk-based input and the operating experience have been combined in Table 4-2 to develop a composite BWR HPCI failure ranking. This information can be used to optimize NRC resources by allocating proactive inspection effort based on risk and industry l
experience. In addition, component' faults are summarized in Section 6, and provide potential insights both for routine inspections and the " post mortems" conducted after significant failures.
-l A comparison of the reportable HPCI events experienced by the Quad Cities Station with the composite BWR HPCI failure distributions is presented in Table 4-2. 'Although the plant specific data are limited, certain Quad Cities components exhibit a proportionally higher than expected,
contribution to total HPCI failures. These components are candidates for greater inspection activity and the generic prioritization should be adjusted accordingly.
This generic ranking of HPCI failures has not been revised to reflect the presently available Quad Cities LER data, because the plant specific distribution of HPCI failures is expected to -
q change with time.
.j As the plant matures, operational experience is assimilated by the utility's staff and reflected.
]
in the plant procedures. For example, the incidence of inadvertent HPCI isolations due to
]
surveillance and calibration activitics is expected to decrease. Conversely, in time, aging related
'l faults are expected to become a contributor to a plant's IIPCI failure. distribution.
j i
The Quad Cities HPCI failure distribution of Table 4-2 can be periodically updated as the
- j plant matures. This report includes all HPCI LERs up to mid 1989. Subsequent LERs can be correlated with the PRA failure categories, used to update the plant specific. HPCI failure contribution, and compared with the more static HPCI BWR failure distribution. The industry -
operating experience is developed from a variety of BWR plants and is expected to exhibit less fluctuation with time than 'a single plant. This information can be trended to predict where additional inspection oversight is warranted as the plant matures.
i
'l 7-1
,-=m'-
w --
wtw w--
v w
e-2,e-
+-#
e-
--ae w
6-
o n-8.
REFERENCES
- 1. Brookhaven National Laboratory (BNL) Technical Letter. Report, TLR-A 3874-q T6a,' Identification of Risk Important Systems Components and lluman Actions for BWRs,"
August 1989.
- i
[
- 2. Shoreham Nucicar Power Station Probabilistic Risk Assessment, Docket' No. 50-322, Long.
Island Lighting Co., June,1983.
- 3. NRC Case Study Report, AEOD/C502, *Overpressurization of Emergency Core Cooling -
Systems in Boiling Water Reactors," September 1985.
- 4. Brookhaven National Laboratory (BNL) Technical Report A-3453-87-5 " Grand Gulf Nuclear Station Unit 1. PRA. Based System Inspection Plans," J. Usher, et al., September,1987.
- 5. BNL Technical Report A-3453-87-2," Limerick Generating Station, Unit 1, PRA-Based System.
a inspection Plans," A. Fresco, et al., May,1987.
6.
BNL Technical Report A.3453-87-3, "Shoreham Nuclear Power Station, PRA-Based System Inspection Plans,* A. Fresco, et al., May,1987.
1
- 7. BNL Technical Report A-3864-2, " Peach Bottom Atomic Power Station, Unit 2 ' PRA-Based
'[
System Inspection Plan," J. Usher, et al., April,1988.
i
- 8. BNL Technical Report A-3872-T4, " Brunswick Steam Electric Plant, Unit 2,' Risk-Based j
Inspection Guide," A. Fresco, et al..' November,1989.
- 9. NRCinformation Notice 86-14,"PWR Auxiliary Feedwater PumpTurbine Control Problems", -
March 10,1986.
-l
- 10. NRC Information Notice 86-14 Supplement 1, "Overspeed Trips of AFW, HPCI and RCIC -
Turbines", December 17;1986; Supplement 2 August 26,1991.
- 11. NRC AEOD Case Study Report C602," Operational Experience Involving Turbine Overspeed Trips," August,1986.
i
- 12. NUREG/CR 5051, " Detecting and Mitigating Battery Charger and Inverter Aging," W.E.
Gunther, et al., August,1988.
- 13. NRC AEOD Technical Review Report T906, Broken Lifting Beam. Bolts in 11PCI Terry Turbine," April 18,1989.
- 14. NRC Information Notice 82-16, *IIPC1/RCIC High Steam Flow Setpoints," May 28,1982.
- 15. NRC Bulletin 90-01, Supplement 1, " loss of Fill Oil in Transmitters Manufactured by Rosemount," March 9,1990.
i 8-1 t-
f T
C
- 16. NRC Information Notice 82-26. "RCIC and HPCI Turbine Exhaust Check Valve Failures,"-
July 22,1982.
- 17. NRC Bulletin 88-04, Potential Safety Related Pump Imss," May 5,1988.
- 18. NRC Information Notice 89-36, " Excessive Temperatures in Emergency Core Cooling System'-
Piping located Outside Containment," April 4.1989.
n
-i i
?
, h t
e s
s e
'7 I
- i 8-2
?
r
G I
(
\\
g c-9 APPENDIX A-1 l
SUMMARY
OF INDUSTRY SURVEY OF HPCI OPERATING EXPERIENCE' HPCI PUMP OR TURBINE FAILS TO START OR RUN s
9 t
t I
e l
i l
..l 1
A-1 t.
m a
Tabic A-1 IIPCI Pump or Turbine Fails to Staft - Industry Survey Results Fa!!ure Desc.
Itoot Cause Corrective Measures Comments Inspection Guidance
-TURillN11 SPliFD.
CON 11tOL l'AU135 EGM control box malfunction
'tho similar failures attributed to aging EGM printed circuit boards will be Each of these EGM control bos
' effects due to kmg term energizatkm and.
replaced at eight year imervals, failures occurred at older plants smibly elevated ambient temperatures.
Additional IIPCI pump room cooling and appear to be aging related.
An EGM printed circuit board failed and
- added.
caused a false high sacam flow signal The second failure involved the electronics in the control box chassis.
EGM control bos had a ground.
Two printed circuit boards replaced.
Miscalibration of null voltage settings.
Recalibration of voltage settings.
Failed transistor in the EGM control box.
Ilox tcplaced. Surveillann -
procedures being expanded to verify proper functioning of the output tU speed circuit.
Motor speed IIPCI failed auto initiaison surveillance Error was not detected during a changer /EG-R
- because the electrical amnections between previous test at 160 psig. Procedures actuator malfunctions.
gmernor control and governor valve
-revised to functionally test the electrobydraulic servo were in error..
governor control system during the low pressure surveillance testing.
Capacitor failure in motor Fear unit.
Replaced capacitor '
Failure may have been caused by Ambient temperatures in excessive llPCI room equipment areas should be temperature, verified with specifications.
Improper gaping and foreign accumulation.
Component replaced or serviced.
- on contacts.
' _EG R actuator grounded at pin connection Corrosion products removed.
-.due to the accumulation of corroskm
. pralucts.There were three occurrences of this event that have been attributed to a design change in thc actuator pin
.tonnections.
w I
w y
,-,,-w._-m.#
y i=
- v wy wr h i t-g-d g - e +
+r b-*r=
p-r
-v -i-m %
wv t
g Se e; iy yV
,m.
m
.r e.e
=4
-g
=
- u1
. * + = *
.'e i
Table A 1 HPCI Pump or Turbine Fails to Start - Industry Survey Results l
Failure Iksc.
Root Cause Onrrective Measures Comments Inspection Guidance Dropping resistor Resistor box design deficiency special test Resister box modified to ensure assembly problems.
'sixmed output vc.itage insufficient when EGM control box will receive input voltage at design minimum, required voltage under worst case 2 -
conditions.
Resister Failure Resistor component replaced Ramp generatorAignal Simv IIPCI response time attributed Gain and time settings reset.
Settings had not been modifN converter hos incorrect turinne hxy gain and ramp time based on swer ascension test settings.
program.
Magnetic speed Cable damaged during IIPCI maintenance Cable repaired <
pickup cable.
preventing speed feedback to the speed controller.
- Speed control
' loose control room panel terminations.
Repaired panel terminations.
potentiometer, LtmE 011 SUPPIX yy FAUllf3 ~
Auxiliary oil pump -
Microswitch within pressure switch fails.
Microswitch replaced.
2 additional failures due to pressure switch fails.
miscalibration, and one attril.uted to a piece of teflon tape that blocked sensing orifkt d-of switch.
- Inone hydraulic control system pressure Component adjusted.
switch contacting arm.
Auxiliary oil pump Pump bearing failure degraded pump
. Pump replaced.-
Similar event-pump motor failure.
performanceAower discharge pressure, bearing failure was possibly due bearing had been recently replaced-to daily use to supply oil to potential human error.
turbine stop valve. '
Additional low..
Iluman error. All control valves..
bearing oil mssure -
mispositioned.
' Valves correctly positioned, handles.
Two similar events have occurred removed. Surveillance revised to -
at other plants.
-occurrences.
check oil pressure during turbine test.
lebe oi! '
Paraffin in tube oil coated pistort caused.
Piston cleaned [
'the process of periodically '.
wntaminationf binding of hydraulic trip relay, sampling tube oil shouki be verified.
.. -m..
15.E m. %
-e-h,E e.w. w - mwe w m--
-w-re e -
,-wm-+,.,=.,n+-
+ h ess
..,re---r-'t y
e v. es,o en v.,
t-- m m e..-,
e :,+
e, w
s--..
2e,--
-w,-.._
e-
.,,,c,
+..-
g-w-.
Table A-1 HPCI Pump or Turbinc Fails to Start Industry Survey Results Failure Desc.
Root Cause Corrective Measures Comments inspection Guidance TURitlNE OVliRSpFTD AND AUTO RESirr PROBI3IMS Electrical termination '
lowe electrical termination on solenoid Wiring to the solenoids will be lhe corrective action for a failures valve coil disabled the remote reset restrained to reduce strain on the similar earlier event apparently function. Failure attributed to normal terminations did not address the root cause of IIPCI vibration.
tbc failure.
Overspeed trip device' Overspeed trip device tappet assembly Tappet remachined.
Similar occurrence at another tapped binding.
head was binding in vaht body..
plant.
Polyurethane tappet < previously machined Mr GE guidance, had experienced '
additional growth. -
Inose hydraulic control system pressure Repaired camtactor arm.
None.
y switch contactor arm.
L Drain port blocked Erratk stop valve operation. Blocked drain Drain port cleared.
Additional information on port in twerspeed trip and auto reset turbine overspeed trips is piston assembly caused trip mechanism to provided in NRC Information cycle between tripped and normal Notice 86-14 and 8614. Supp.1.
positions.
INVERTER lillPS OR FAILURES Inverter tripped and could not'be reset Replaced inverter.
due to a failed diode.
See Ref.14 for effects of inverter aging and preventative measures.-
Inverter failed due to the failure of an Replaced inverter.
A similar event involving a internal capacitor.
ruptured capacitor occurred at another plant.
Internal electronie -
Inverter twerheating due to a failed Repaired or replaced tuoling fan.
faults integral cooling fan..
Inverter failure due to blown fuse.
Replaced fuse.
g
.. _... -,,, _. ~. -., -
~. J.a.. _ ;,... _,,, a
.L,
..cn.,
u.,
m...
Table A-1 IIPCI Pump or Turbine Fails to Start - Industry Survey Results Failure Desc.
Root Cause Corrective Measures Comments Inspection Guidance Inverter trip dea to high voltaFC SffPoint li ualize voltage was reduced l
drift.
allowing inverter to resei.
TURHINI? S1DP VAINii i All.tJ!tES 1
Cont rol oil leaks.
Oilleak developed at pilot valve llange bollt torqued.
Nmilar event at another plant.
l assemNy/ hydraulic cylmder flange bolts j
were Imwe.
I 1
Pilot oil trip sotenon!
Valve stud open due to disintegration of Valve's cipendable parts now l
valve.
diaphragm that caused valve plunger to scheduled for replacement at every sti(k abmc the seat, third refueline outare.
Valve would not open due to excessive Pistort rings were fabricated from l'urther discussion in IE Circular leakage of piston rings in hydraulic resin impregnated leather. Vendor R0-07.
cylinder actuator, reconmtended replacement every fiw y
years. Potential aging concern.
Mechanical valve Vane and actuator stems separated at split Dalance chamber adjustment was Similar failure occurred inve,lvir.g Overstress and ultimate
(
failurc s.
couptmg. Italance chamber adjustment performed in 1985 per Gli SIL 352, a lotwe valve position sensor fracture will usually extur
}
drtit believed to have caused increased Adjustment will be decked quarterly bracket that caught on actuator at the undercut on the nwmentum and disk overtravei-for a minimum of 3 quartert housing when the valve opened.
coupimg threads due to lhe valve failed in the epcn reducing cross section.
position incipient stem failure may be indicated by circumferential cracks in threaded stem area.
. lUlt BlNE EXilAUST RUP1URE DISK g
Cyclic fatigue.
Inner rupture disk failed due to cyclic Iloth disks replaced with an improved design appears to AEOD Report E402 fatigue (siternating pressure and vacuum improved design that has a structural chminate the cyclic fatigue provides additional within the exhaust hne). Vacuum occurs backing to prevent ficxirig during failure mode.
examples of turbine during cold quick starts with cold piping.
exhaust line vacuum conditions.
exhaust rupture disk failures.
cs,i j.-
e Table A-1 IIPCI Pump or Turbine Fails to Start - Industry Survey Results Failure Desc.
Root Cause Corrective Measures Comments Inspection Guidance Water hammer -
thhaust diaphragm ruptured by water Blocked line cleared; rupture disk A similar event has caurred at induced disk rupture.
cartyover from exhaust line drain pot due -
replaad.
another plant. Duration and to a blocked drain line.
frequency of exhaust line blowdown increased.
.j
'j FLOW COrHROLLER FAILURES l'ailures appear to be eging -
Ambient conditions in Failure to contret in.
Defective empt;fier card and solder joint Repairs performed.
related, yet it appears some areas containing this :
1
- I automatic, attributed to aging.
licensees do not intend to equipment should bc periodically replace sensitive verified against equipment or otherwise address specifications.
the root cause of these failures.
Dropping resistor failed in the instrument Resistors R26, R24 and rener diode l
amplifier circuitry due to normal heat of C24 all appeared to be affected by operation.
ambient temperatures and were -
l teplaced.
Intermittent operation of internal switch The slight oxidized contacts were contacts did not allow the controller to cleaned and lubricated. In the long read the Dow setpoint in auto.
term, permanent jumpers willbe installed to ' ypass the switches.
l o
l' Gear train failure.
luxe fastener caused intermediate gear to procedures will be revised to require unmesh which prevented adjustment of the a periodic check of the gear train controller setting..
and fasteners.
Miscalibration,
riow controller indicated a flow of 400 Controller recalibrated.
ppm when system not in operation. Failure attributed to miscalibration.
1URBINE-.
COBrIROL VALVE FAUllf5 <
1 Control oilleak.
Oil supply line nipple leaking because Nipple repaired; plant personnel-plant personnel stepped on line to gain -
informed of failure cause.
access to control valve.
s__
n
~;s l
Table A lllIPCI Pump or Turbine Fails to Start'e Industry Survej Results.
~
~
I'ailure Desc. '
Root Cause Corrective Measures-u>mments '
Inspection Guidance -.
. Throttle valve hiting'
- 5ia of the eight lifting beam lxdts failed Ucensee to change thread lubricant:
Per AIIOD Report 1906,
~
beam botting failure, due to stress corrosion cracting of-non-metal bearing petroleum jelly improper heat treatment and the improperly heat treated lxifts. 'Ihe
' recommended.
use of a copper based anti-remaining two bolts were cracked.
seizure compound were major contributors to this failure.
1055 Of: 1 UIlf! Oli, PCV_ITL13 had an incorrect diaphragm formation of a procurement Additional LER reported a COOIJNG.
Installed due to inadequate controls to engineering group.
diaphragm failure resulting in a $
l update plant information with industry.
ppm leak. No cause stated.
PCV-lut$ failuret experienm.
' MISC 111 ANT:OUS -
Used auxinary oil pump to flush oit A modification was pretwed to -
De periodic use of the atutiliary Operating procedures 7-through the governor to elcar a ground.
chminate ramp generator initiation oil pump is a common practice -
shotzid be reviewed to ;
-i 5tdweguently, system isolated on startup on auxiliary oil pump startup, unless that can disable the lipCl ensure that cautions 3,
because the oil pump causes the stop and -
a valid initiation signal is present.,
system identify IIPCI system i
control valves to go full open.
inoperability when. the :
.attxiliary oil pump is -
running.
~ >.
Li -
J 1
s 9,
u...
'--A.m a m
7 W-hi-m"*erw IN'
'W4W
^
T
Y8
- T
l
.- i.
APPENDIX A-2 SELECTED EXAMPLES OF ADDITIONAL HPCI FAILURE MODES '
IDENTIFIED DURING INDUSTRY SURVEY A-8
m Table A 2 Summary of Illustrative Examples of Additional fil'CI Failure Modes Failure Desc.
Root Cause Correctrve Measures Comments impretion Guidance IIPCI Failure 3 -
Differential pressure transmitter failed due Amplifier card connection was Rmemont Transmitter NRC Information Notirx.
False liigli Steamline to inadequate exmnection of amplifier secured.
8216 provides additional Differential Pressure _
comfitiott Card was either incorrectly information on steamline isolation Signal seated during imtallation or worked loose, pressure incasurement.
Miscalibration ami a stuck pressure Wrong conversion value caused Rmemont Trammitier indicator disabled toh drviskms of high miscatihrstk.a and was corrected.
$P transmitters.
1.
Transmittet operating outside tolerances.
Recalibrated trammitter Comervatively narrow imirument due to incorrect sclpoint adjustment tolerances were used during the
- i setpoint adjustment-The instrument was a Rosemount Transmitter. -
Setpoint drift cause spminus system Setpoint was adpsted.
Harton transmitter increased calibratics p
isolations freq9eng may be e
necessary.
Setpnint draft caused by nmisture intrusion Unknown Darton transmitter.
through the dial rod shaft seat.
lIPCI Failure 4
- Mechanical / thermal bimling of disk due to Interim cterective action was drilling This failure was attributed to Turbine 5 team inlet inadequate clearances.
a hole in the valve disk. Double procedural and training Valve (FWij fails to disks were to be installed during a inadequacies.
open future refueling outage as a long term solution.
Thermal binding of drsk
. Replaced motor Fears and installed 1he thermal bindmg can octur A four hour system larget power supply cable to motor-for ~2 hours after system is warmup may be required returned to service following a by procedures to w okkwrn.
circumvent 'his prt+1em.
t
. Motor failure '
- Surge protection added to shunt coil Motor fai!ure caused by high of DC motor control circuitry.
voltage transient in shunt cost that occurred when supply
- breaker opened.
Yailures No. 2 amt 6 are discussed in Section 6 of the text. -
.f
-.E-,<
w w
a
..-.E.c
- ~
m E.+
d.m....
- +... m d w-, E e r r=
Table A 2 Summary of Illustiative Examples of Additional llPCI Failure Modes c
' l'ailure Dese.
Root Cause Corrective Measures Comments Inspection Guidsnce liPCI raiture 4 -
Afotor failure.
Vaht repaired and torque switch Motor windings failed due when Other safety related MOVs (cont'd) adjustment screws were correct!y torque setting out of adjustmerit were also affected.
torqued.
due to lorse torque switch Procedures were revhed adjustment screws and torque switch limiter phtes were infalted.
Valve motor failure due to incorrect steem Valve mo:nr was replaced lubrication (Jcemce review determined that valve Remmed step starting resistors Other DC MOVs were ate INPO SER.25-88 and I
might not open due to insufficient torque.
-valuated.
NRC Informainn Nctice 68-72 prtwide further guidance.
IIPCI raiture $ -
Mispmitioned autiliary contacts in starting Replaced ctmtacts.
Pump Dinharge time delay reby for valve motor.
Vaht {ITWl Fads to
_Ogn Valve motor failure Valve motor replaced.
l'ailure attributed to heat related D
breakdown of valve motor y
internsis.
Unensee review determined that valve may Step starting resistors had emt been Potential problem may affect
. INFO SER 25-88 and -
have insufficient torque to open.
considered in the torque analyses.
other DC MOVs NRC Informatices Notice and stre temmtd.
provide additional guidance.
t IIPCI Failure 7 Fuse failure due to cicettical grounding.
Tuse replaced and ground corrected.'
System Actuation '
thic rails System failed to actuate due to inadequate
-Design mcuhfied.
Further discussion in AEOD -
' seal in time.-
Report E407.
'llPCI Failure 8 -
l' ailed power supply tesistor.
Resistor replaced.
Itaise 116 h Area t
Tempera' tere isolation l' ailed temperature monitoring module.
Module replaced.'
..New model replacement -
comidered.
- Signal Design error-Minimum intake setpoint temperature was increased.
. Failures No,' 2 and 6 are discussed in Section 6'of the text,-
L L
i g y v-3
--yr,y g y mrwww Tm.T'e,tte-=+F Y'4N M 'w y
v'T
- f k *-' YW '19 f* W V 1 9 N=='P" I
f i+
w*W'*
W D
4
&r e e-n *- h n <.'.N w e -e e we. e n. r
-3 Y,
s 4-a eM m d w + -e s - e w+ we-ww
- w ++ - E af
(
Table A 2 Summary of I!!ustrative Examples of AdditionalllPCI Failure Modes Failure Dese.
Root Cause Corrective Measures Comments impection Guidance llPCI I?ailure 9 Pressure switch isolation valve None.
Isolated pressure switch actuated False I;w Suction.
inadvertently clased.
due to changing environmental Pressure Trip conditions.
IIPCI l'ailure 10 +
Corrosion of pressure switch senit Pressure switch replaced.
Seal corrosion allowed moisture False fligh Turbine mto casing and shorted wiring.
Inhaust Pressure Signal llPCI Failure 11 -
lixhaust line swing check valve failure Check valve replaced.
Failure of check valve was iteferences (21) and [22]
Normally Open blocked MOV attributed to overstressed cycling prewide further Turbine 11xhaust due to high exhaust pressure.
information.
' Wlve Fails Chwed i
y IIPCI Failure 12
'Irvel switches out of calibration Switches replaced.
Accumulation of foreign material a.
CST /5uppressinn Pool on float can=ed failure.
logie Fails IIPCI Failure 13 -
Motor failure. Winding insulation Replaced motor. Voltage surge liigh vohage transients onurred Suppression Pool degraded due to high waltage transients.
proicction added to circuitry, as supply breaker was opened.
Suction line Valves Fail to Open
' Torque swkch out of adjustment.
Recalibrated.
!)mit switch out of adjustment.
Iteplaced limit switch.
Valve stem separated from ' isk.
Valve repaired.
'1hree bolts failed due to tensile lhese valves were d
overload. Other similar valves manufactured by were inspected.
Associated C4mtrol G uipment, Inc.
l filT! Failure 14 a Valve inoperable due to damaged motor-kitch replaced.
Damage resulted from overtravel Design changes may be Minimum 1%m Valve starter disconnect switch.
of operating handle due to poor '
required as a result of this Fails to Opert design.
failure.
Failures No. 2 and 6 are discussed in Section 6 of the text.
La x i
DISTRIBUTION.
No. of Conies No. of Conies OFFSITE U.S. Nuclear Regulatory 2
B. Gore Commission Pacific Northwest Lab.
Richland, WA 99352 '
A. El Bassoni 1
. D. Baksys..
OWFN 10 E4 Illinois Dept. of Nuc. Safety -
W. D. Beckner 103 S. Outer Park Drive OWFN 10 E4 Springfield, IL. 62704 K. Campe ONSITE OWFN 10 E4 26 Brookhaven National Lab.
10 J.Chung A. Fort (5)'
OWFN 10 E4 W. Gunther (10)
R. Hall A. Thadani J. Higgins 4
OWFN 8 E1 W. Shier (5) --
J. Taylor.
B. K. Grimes R. Travis OWFN 11 El M. Villaran
- Technical Publishing (5)
J. N. Hannon Nuclear Safety Library (2)
OWFN 13 E21 E. V. Imbro OWFN 9 A1 2
H. E. Polk OWFN 12 H26 4
Quad Cities Nuclear Station-Inspectors Office 4
U.S. Nuclear Regulatory Commission ; Region 3
' A.B. Davis, Reg. Admin.
' 2 J. Bickel EG&G Idaho, Inc.
P.O. Box 1625 Idaho Falls, ID ' S3415.
.._m_
1
______._________.__.m__m__-
^--
NRC FO:.u 335 U.S. NUCLE AA RE GUL ATOf(V coMMISSloN
- 1. RE PoR T NUMBE R
'~
fl!4 nm,
'*lT2lllll1""5 ^,%%0T* ""'
m.m BIBLIOGRAPHIC DATA SHEET rsee hurrocr== on er= <emel NUREG/CR-5934
- 2. TITLE AND SUBTITLE BNL-NUREG-52344
. High Pressure Coolant Injection (HPCI) System Risk-Based Inspection Guide for Quad-Cities Station, Units 1 and 2 a.
oATE REPORT eUsLiSsEo MOkl H -
TEAR January 1493
- 4. f IN oR GR ANT NUMBE R AM75 5 AUTHOR (St 6 TYPE OF REPORT I'
M. V111 aran, R. Travis, W. Gunther Technical
- 7. PERIOD ccnrERto r, ca o
e.,
- 8. PE RF oRM1NG oRGANi2AT loN - NAME AND ADORE SS ftr NRC. preens > Demon, Offa or Aspion, us suchu RepuAerary Commasee, and messms ambesa If contruser, swower name andmemne adamsn1 Brookhaven National Laboratory Upton, NY 11973
- 9. SPONSORING ORGANIZATION - NAME AND ADDRESS (#1 WRC, enae *senw as eae e~;Jrcoarewser, paces > waC Demum, Off=, or Repen, ui wuchw Ampuissory Coswneeme and metkne eewreet)
Division of Systems Safety and Analysis Office of. Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washincton. DC 20555
- 10. SUPPLEME NT ARY NoT ES 11 ABSTRACT (200me,in erwas The High Pressure Coolant Injection (HPCI) system has been examined from a risk perspective. A System Risk-Based Inspection Guide (S-RIG) has been developed as an aid to HPCI system inspections at Quad Cities.
Included in this S-RIG is a discussion of the role of HPCI in mitigating accidents and a presentation of PRA-based f ailure modeswhich could prevent proper operation of the system.
The S-RIG uses industry operating experience, including plant-specific illustrative examples to augment the basic PRA failure modes.
It is designed to be used as a reference for both routine inspections and the evaluation of the significance of component failures.
e
- 12. KE Y WORDS/DE SCR:PT OR S sthe woram er persaes sner owtissart sese.-.:_.. da #scarms ene recorr.)
a av Ast As,ul V &i at t ut h1 BWR Type Reactors-Reactor components, BWR Type. Reactors-Reactor-l'nli M t M Safety, Reactor High Pressure Coolant Injection, High Pressure
' * " " ' " " ^ * " " ' "
Coolant Injection-Risk Assessment, Reactor-Risk Assessment, Reactor Cooling Systems, Reactor Accidents, High Pressure Coolant Injection Uncl assi fi ed failures -
Unclassified YNUMBER of PAGES
- 36. PRICE
- NRC tORu 336 O 419)
I ia f
- i
- f e i a
J n
4 1
f 4
.f i
~
P e
Printed i
on recycled 1
Paper i
Federal Recycling Program-1
,..\\
HIGH PRESSURE COOLANT INJECTION (HPCI) SYSTEM RISK-BASED ?
1rsigguyWJt-; ' y
- NUREC/CR-5934 :-
INSPECTION GUIDE FOR QUAD-CITIES STATION, UNITS I AND 2 :
" ~
.- j
' UNITED STATES :
^'L NUCLEAR REGULATORY COMMISSION POS A E A D E S PAfD WASHINGTON,' D.C. 20555 0001 USNRC PERMIT NO. G-67 1 1 a M 1 P P-1 e n 9 5 513 5 31 O[pgg(; RAT!CNsSVCS 0FFICIAL BUSINESS t,
N
^
FENALTY FOR PRIVATE USE. $300 7ph.pDo-NUDFG c-311 PC
'"5E5 WASHINGTON i' '
y-_
yr :lf x u gjw..,
4 s