ML20044G028
| ML20044G028 | |
| Person / Time | |
|---|---|
| Site: | Grand Gulf  |
| Issue date: | 02/12/1992 |
| From: | Murley T Office of Nuclear Reactor Regulation |
| To: | Binz R BABCOCK & WILCOX CO., Public Service Enterprise Group |
| References | |
| GL-89-10, NUDOCS 9306010340 | |
| Download: ML20044G028 (29) | |
Text
.
/B/F X
/Jo uag'o, 5
UNITED STATES
. [ " 3,q ~j NUCLEAR REGULATORY COMMISSION WASHINGTON. D. C. 20555 g
- p t
f February 12, 1992 Mr. Robert Binz, Chairman BWR Owners' Group Public Service Electric and Gas Company P.
O.
Box 236 Hancocks Bridge, New Jersey 08038
SUBJECT:
Consideration c2 Valve Mispositioning in Response to Generic Letter 89-10
Dear Mr. Binz,
In the BWROG's letter of March 14, 1991, regarding Generic Letter (GL) 89-10, " Safety-Related Motor-Operated Valve (MOV) Testing and Surveillance," you stated that the BWROG continues to believe that consideration of position-changeable valves is not warranted based on technical concerns, and that the staff has not justified such consideration in accordance with the Backfit Rule (10 CFR 50.109).
Responding to your concerns, the staff has reevaluated the technical basis for including valve mispositioning within the recommendations of the generic letter and the process for backfitting that was conditeted for GL 89-10 regarding valve mispositioning.
TECHNICAL REVIEW The staff contracted with the Brookhaven National Laboratory (BNL) to conduct a study including a probabilistic risk assessment (PRA) to determine if valve mispositioning in BWRs is significant to safety.
The report of that study is attached.
BNL performed the study of two BWRs: Peach Bottom Atomic Power Station and the Grand Gulf Nuclear Station.
BNL tabulated the results of the study in Table 5,
" Failure Rate Sensitivity Analysis for Risk Significant MOVs."
In Section 3.4,
" Sensitivity Analysis,"
BNL stated that the values of the risk increase ratio (RIR) depend on the probabilities assumed for three factors:'
1.
The MOV must be moved to an incorrect position.
i 2.
There must be a high differential pressure or high 1
flow condition at the valve.
l t
'Other possibilities could be included as noted in the siudy, but these three factors are considered to be the major i:
elements.
j
T
. February 12, 1992 3.
The valve must then fail to reposition when (and if) j recovery is attempted.
A probability of 1.0 would bound all cases for items 2 and 3.
NUREG/CR-1278, " Handbook of Human Reliability Analysis With Emphasis on Nuclear Power Plant Applications," indicated that the probability of an operator error that could rerult in mispositioning a valve from the control room ranges from 0.001 to 0.1 for conditions with no undue time pressures or stresses related to accidents.
Therefore, based on the BNL results combined with bounding values of these three factors, the staff would consider that the incremental increase in risk under low operator stress conditions due to failing any of the valves studied to be statistically insignificant considerating the 4
uncertainty inherent in the PRA modeling and analysis methods.
In severe stress conditions, such as after a large break loss-of-coolant accident, with the probability of an operator error between 0.1 and 1.0, certain valves in the study could be significant to risk.
However, the progression cf the event (e.g.
pressure or flow changes) may be such that valve realignment or other recovery actions are possible, thus leading to probabilities of items 2 and 3 above to be less than 1.0.
FurthermorE, if an MOV is considered active and is already included in the MOV program, the probability of its failure to realign would be less than 1.0 whenever the design basis conditions bound the mispositioning conditions.
Thus, the likelihood of all three factors equal to a probability of 1.0 simultaneously is low.
The results of the sensitivity analysis of Table 5 indicate that a lack of consideration of valve mispositioning in BWR plants would not increase significantly the core melt frequency unless a probability of close to 1.0 is assumed for all three factors of RIR.
BACKFITTING ANALYSIS The BWROG letter stated that an adequate backfitting analysis has not been performed to justify reviewing position-changeable valves.
The BWROG expressed concern that the NRC did not provide an estimate of the safety benefit or cost when it performed the analysis to justify GL 89-10 recommendations for position-changeable valves (NUREG/CR-5140, "Value-Impact Analysis for Extension of NRC Bulletin 85-03 to Cover All Safety-Related MOVs").
The attached BNL study indicates that the previous conclusion in NUREG/CR-5140 was correct in that an increase in core melt frequency can be demonstrated.
In NUREG/CR-5140, the staff concluded that more detailed PRAs addressing valve mispositioning errors and the higher values of valve failures i
i
L.
l l Y l
l
' February 12, 1992 identified as a result of MOV testing would demonstrate that the ratio of value to impact calculated would be even more favorable.
The staff did not measure the actual impact in NUREG/CR-5140.
The absence of direct review of a single aspect of a value-impact analysis does not constitute an inadequate backfitting process for this issue.
However, the BWROG acted appropriately in requesting the NRC to further review the issye and consider the points made in your March 14, 1991, letter 1
1 INSPECTION EXPERIENCE l
In 1991, the NRC conducted a number of inspections on GL 89-10 I
programs and found that licensees are including all MOVs in safety-related piping systems within the scope of GL 89-10 programs.
Most licensees are reviewing safety analyses, emergency procedures, and other plant documentation for those MOVs to determine the fluid conditions under which the MOVs may l
be called upon to function either intentionally or inadvertently.
l l
The staff has also found licensees to be addressing inadvertent valve positioning by one or more of the following methods:
1.
Ensuring MOVs can operate if inadvertently mispositioned.
2.
Preventing the inadvertent operation of MOVs by using keylock switches or switch covers, or by removing control power at the breakers.
3.
Setting valve operator switches appropriately to prevent damage during a mispositioning event and demonstrating the capability of the MOV to be repositioned.
The NRC believes that these actions are reasonable and j
appropriate because they provide assurance to the control room l
operators that they may rely on a valve to operate if conditions necessitate positioning a valve.
The staff encourages those BWR licensees who are not addressing valve mispositioning as part of their MOV programs to evaluate their safety-related systems for valve mispositioning vulnerabilities identified in Table 5 of the BNL study.
In addition, consideration should be given to their statement that facilities outside the study might be subject to unique vulnerabilities.
2 l
The BWROG submitted the letter as a possible backfitting l
appeal referencing NRC Manual Chapter 0514-044, "NRC Program for l
Management of Plant-Specific Dackfitting of Nuclear Power Plants."
However, the issue of concern is a generic backfitting item.
1 l
l
. February 12, 1992 CONCLUSIONS The results of the study indicate that the risk associated with position-changeable valves is insignificant unless each of the probabilities for the three factors of the RIR are assumed to be close to 1.0.
Therefore, the NRC accepts the BWROG argument that the licensees for BWRs need not include in the programs for GL 89-10 consideration of valve mispositioning from the control room.
Nevertheless, the staff believes that consideration of valve mispositioning benefits safety.
Modifying the provisions in GL 89-10 for valve mispositioning does not affect the GL 89-10 provisions for licensees to review safety analyses, emergency procedures, and pther plant documentation to determine the design basis fluid conditions under which all MOVs in safety-related piping systems may intentionally be called upon to function.
This position also does not supersede the NRC's generic recommendations or regulations on valve mispositioning that pertain to other issues such as intersystem loss-of-coolant accidents (ISLOCA) or fire protection (10 CFR 50, Appendix R).
The BNL study addresses only BWR plants. Supplement 4 to GL 89-10 provides the modified staff position for BWRs (see attached).
The BWROG may complete the design basis reviews consistent with the position herein.
Sincerely, S/
Thomas E. Murley, Dire er Office of Nuclear Reactor Regulation
Enclosures:
As stated 3Design basis conditions are both normal operation and abnormal events within the design basis of the plant.
W i
I I
l SAFETY SIGNIFICANCE OF INADVERTENT OPERATION i
OF i
MOTOR OPERATED VALVES IN SAFETY-RELATED PIPING SYSTEMS i
l IN
-.I BOILING WATER REACTORS l
8 i
by i
t C.J. Ruger, W. Shier, and J.C. Higgins j
4
~
October 1991 I
i l
Engineering Technology Division Brookhaven National Laboratory Upton, NY 11973 i
e 8
i f
1'
F*
1.
INTRODUCTION Concerns about the consequences of valve mispositioning were brought to the forefront following the event at Davis Besse in 1985. The concern relates to the ability to reposition " position changeable" motor operated valves (MOVs) in the event of their inadvertent operation from the control room. He mispositioned MOVs may not be able to be returned to their required position due to high differential pressure (dP) or high flow conditions across the valves. The inability to reposition such valves may have significant safety consequences as in the Davis Besse event.
The
- position changeable" valves under consideration include all MOVs in safety related systems that are not prevented from inadvertent operation from the main control room (i.e.,
keylock switch, breaker racked out, etc.). Dese MOVs may be considered as active or passive.
Consistent with ASMS,Section XI definitions, active valves are considered to be valves which are required to change position in order to perform a specific function in shutting down the reactor to a cold shutdown condition or in mitigating the consequences of an accident. Passive valves are not required to change position to accomplish a specific function. Mispositioning of valves with either active or passive safety functions is of concern. Mispositioning can occur prior to an event (e.g.,
test valve left open after completing a test) or during the course of an event.
After the Davis Besse event, the NRC staffissued Bulletin 85-03m, which recommended that licensees establish programs to ensure that MOV switch settings for several high pressure safeti-1 related systems were selected, set, and maintained correctly to accommodate the expected maxinium differential pressures during both normal and abnormal events wit'dn the plant's design basis. He bulletin also indicated that inadvertent equipment operations (such as valve closures or openings) that are within the plant design basis should be assumed when determining maximum dPs.
Supplement Im to Bulletin 85-03 clarified which valves were to be included when verifying the ability to recover from mispositioning and dcfined inadvertent equipment operations as discussed above.
l After evaluating the responses to Bulletin 85-03 and performing a Regulatory Analysis, the t
NRC staffissued Generic Letter 89-10m, which extended the recommendations of Bulletin 85-03 and its supplement to "all safety-related MOVs as well as all position-changeable MOVs."
Supplement 1* to Generic Letter 89-10 limited the scope to all MOVs which are both in safety-I related piping systems and which can be mispositioned by operators from the control room.
ne Regulatory Analysis for Generic Letter 8910 included a value-impact analysis of the proposed expansion of the scope of Bulletin 85-03 to all safety-related systems as presented in NUREG/CR-5140*. Since Bulletin 85-03 already included the valve mispositioning issue, the value-l impact analysis did not separately consider the value-impactjustification of the inclusion of position changeable valves. Further, current probabilistic risk assessments (PRAs) rarely include errors of l
commission, such as the inadvertent mispositioning of a valve. Therefore, a comprehensive quantitative evaluation of the effect on core melt frequency resulting from the inclusion of position i
changeable valves would require substantial remodeling of the PRA and was not performed in NUREG/CR-5140.
However, it was qualitatively concluded that the inclusion of valve mispositioning in the analysis would enhance the benefit (value) obtained for the expansion of Bulletin 85-03 to all safety-related MOVs.
1 l
l t_
I The Boiling Water Reactor Owner's Group (BWROG) agreed to address mispositioning of nine MOVs under Bulletin 85-03, but has subsequently argued that valve mispositioning need A o GL 89-10. Among the BWROG arguments is not be considered in the licensees' responses t
the statement that the PRA analysis in NUREG/CR-5140 does not clearly indicate that consideration of additional position changeable valves under GL 89-10 would decrease the probability of core melt to an extent which would justify the additionallicensee costs. As discussed earlier, the analysis in NUREG/CR-5140 was performed to extend Bulletin 85-03, which already considered position changeable valves, to all safety-related systems. Therefore, that analysis did not separately justify the consideration of valve mispositioning. The present program attempts to evaluate the safety signi6cance associated with BWR valve mispositioning.
i 2.
PROGRAM OBJECTIVE, OUTLINE, AND SCOPE The objective of this program is to use PRA techniques to determine if valve mispositioning in BWRs is a safety significant issue. It was clear from the outset that a comprehensive evaluation of all mispositionable MOVs would not be possible using existing PRAs. Current PRAs rarely include errors of commission such as inadvertent mispositioning of valves. This is due to the difficulty in modeling such errors, which have an extremely large number of possibilities. However, within program constraints, the risk significance of a sampling of the more important, active and t
passive, position changeable, MOVs can be estimated.
The approach selected utilizes a simpli6ed PRA model to determine the change in core rnelt frequency (CMF) of selected position changeable MOVs. The 6rst step identifies all active and passive position changeab!c valves in the PRA. They are then failed (failure rate increased to 1.0 failures per demand) one at a time, and the resulting change in CMF is calculated. This initially assumes that the probability of both inadvertent operation and the inability to subsequently reposition (due to high dP or flow) is a certainty (probability = 1.0). Valves which are not risk signi6 cant can then be screened out. For those valves, where this first step results in a noticeable change in CMF, a parametric sensitivity study is used to estimate the effects of the probabilities of mispositioning (e.g., due to operator error) and the failure to correctly reposition due to differential pressure and flow conditions.
The PRA initially selected was the NUREG-1150W Peach Bottom model on the Integrated Reliability and Risk Analysis System (IRRAS)@ and the System Analysis and Risk Assessment System (SARA)*. IRRAS/ SARA contains PRA data for the dominant accident sequences for the NUREG-1150 power plants. The above approach should therefore identify the most risk-significant valves. However, this position changeable valve identification process will not be exhaustive, as described below.
First, certain passive MOVs may not be modeled, even in the full PRA, because theywere not perceived to have a risk signi6 cant safety function, (e.g., motor operated drain valves).
Secondly, since the IRRAS/ SARA model only contains the dominant accident sequences for each plant, both active and passive MOVs in the remaining non-dominant sequences will not appear.
Before truncation, these non-dominant sequences were quantified using standard PRAMOV failure
'IRRAS 2.5 and SARA 4.0 were used for this analysis. Use of SARA is equivalent to the use of the sequence /cutset analysis portion ofIRRAS.
l 2
W rates (approximately 10 to 104 failures per demand.) These sequences were not risk significant 4
with these standard MOV failure rates, but could possibly be more significant if the higher valve failure rates appropriate to the mispositioning issue were used. For the same reason, certain MOVs in the dominant sequences are also not included. Rese are valves which are in cutsets that were truncated from the sequence, when using the standard failure rates. Again, use of larger failure rates would make these cutsets more significant. Finally, since the dominant accident sequences and system designs are plant specific, consideration of one or two plants also limits the systems and valves considered.
These limitations on the identification and quantification of position changeable MOVs, which were recognized from the beginning of the program, are addressed to a certain extent as follows. Most of the truncated valves are identifiable from either the system Dow diagrams or from a visit to an actual BWR plant control room simulator. Once identified, their relative risk-significance (at a failure rate of 1.0 failures per demand) can be determined by failing the function modeled in the PRA, which is affected by the MOV failure. For example,if a normally open MOV in a pump suction line is to be evaluated in a failed closed position, but it does not specifically appear in the PRA, the change in CMF due to its failure can be approximated by the failure of the pump. This procedure theoretically can be used to evaluate valves in truncated cutsets and valves which were not modeled.
Peach Bottom is a BWR-4 with a High Pressure Coolant Injection (HPCI) System. The Peach Bottom IRRAS/ SARA modelis dominated by a small number of sequences, and as a result, only a few systems are included in the final cutsets. Therefore, valves in the missing systems cannot be evaluated either directly or by failing functionally equivalent components. Because of the small number of systems in the final Peach Bottom cutsets, a second NUREG-1150 plant model (Grand Gulf) was used for this program. Grand Gulfis a BWR-6 with a High Pressure Core Spray (HPCS)
System instead of a HPCI system for high pressure injection. Since the Grand Gulf PRA dominant accident sequences include some different systems than the Peach Bottom PRA, some additional valves were able to be evaluated. Consideration of these two PRAs via the IRRAS/ SARA model should include a good sampling of risk-significant MOVs in BWRs.
An investigation was also performed to evaluate the possibility of including directly and specifically all the position changeable MOVs. IRRAS is a PRA model development and analysis tool that gives the user the ability to create and analyze fault trees and accident sequence. Ideally, MOVs in sequences or cutsets truncated in IRRAS/ SARA could be evaluated for their risk-significance by increasing their failure rates to 1.0, one at a time, and regenerating the cutsets and sequences using IRRAS. In addition, unmodeled valves could be evaluated by developing new fault i
trees and generating the sequence cutsets.
He investigation determined that the use ofIRRAS to regenerate sequence cutsets that would include truncated or previously unmodeled valves was not practical given the time constraints of the present program. He creation of fault trees and their use in IRRAS is a time-consuming Additionally, the regeneration of cutsets from existing fault trees in IRRAS involves process.
several steps. In one step, operator recovery actions must be manually inserted in IRRAS. That is, when cutsets are regenerated, the recovery actions are not automatically included and are missing from the analysis. Herefore, regeneration of truncated cutsets with increased valve failure rates, 3
G even without new fault trees, would involve a detailed recovery action analysis. His was considered to be beyond the limitations of the current program. De substantial effort involved, while including more valves, would not necessarily include any valves of higher risk.signiScance than by using the existing cutsets in IRRAS/ SARA alone.
Therefore, the approach used relies on the Peach Bottom and Grand GulfIRRAS/ SARA models with the existing dominant sequences and cutsets. MOV failure rates are adjusted and, where necessary, functionally equivalent components are failed as well. The appropriate MOVs and components are determined through reviews of the PRAs, system flow diagrams, and a visit to the Shoreham (which is a BWR-4 with HPCI) control room simulator. He risk-significance of the identified position changeable MOVs is then determined and evaluated. 'inally, those valves which produce a noticeable change in CMF when their failure rates are increased to 1.0 failures per demand, are further analyzed using a parametric sensitivity study to estimate the effects of the probability of mispositioning and the probability of not repositioning due to high dP or flow conditions. his process should identify most of the risk-significant position-changeable MOVs in BWRs, and will provide a quantitative estimate of the risk importance of mispositioning the individual MOVs. However, it should be clear that the results are not intended to be a comprehensive list of all mispositionable valves that must be included under GL 89-10.
3.
SAFETY SIGNIFICANCE OF MOVs As discussed in Section 2, the NUREG-1150 PRA models for the Peach Bottom and Gr'and Gulf plants have been analyzed with IRRAS/ SARA to evaluate the risk-significance ofinadvertent mispositioning from the control room of position-changeable MOVs in safety-related piping systems. De base case IRRAS/ SARA models for both Peach Bottom and Grand Gulf were truncated at a sequence frequency of 1.0 x 104/ year. His truncation process has resulted in the elimination of various systems and components that did not make a significant contribution to the overall CMF. Thus, these PRA models do not include a complete representation of all MOVs included in the plant design. However, the most risk-significant MOVs are represented.
He IRRAS/ SARA model was used to identify and evaluate the safety significance of those MOVs appearing in both the Peach Bottom and Grand Gulf plants. Additionally, some unmodeled and truncated valves were included by approximating the effects of their failure by failing the equivalent function modeled in the PRA, which is affected by the MOV failure, as discussed in Section 2.
3 In identifying valves for evaluation, only single valve mispositionings were considered. An investigation revealed that no single control could operate valves in different system trains.
i nerefore, it was not considered credible for this analysis that an operator would inadvertently misposition more than one valve. Here is multiple control of some valves in series,i.e., in the same piping with the same function. However, these are usually isolation valves where the inadvertent closing of two valves would have the same effect as closing one. Also, valves which are aligned in series with another valve having the same function, but with separate controls, were not evaluated in cases where inadvertent operation of both was required for system degradation.
Inadvertent opening of one of two MOVs in series would not change the dP across it. An example of this would be the condensate storage tank test return valve (MV21) and the pump discharge to the suppression pool valve (MV31) in the Peach Bottom plant. These are both normally closed and inadvertent opening of either valve alone would not provide a path to the suppression pool.
j 4
l
3r Both active and passive valves were considered. Mispositioning of passive valves, which are not required to change position to accomplish a speci5c shutdown or axident mitigation function, are certainly candidates for mispositioning. However, valves that perform an active safety function are also capable of being mispositioned. After an active valve performs its required function during an event, either by manual or automatic activation, the potential exists for a subsequent mispositioning (either inadvertently or intentionally due to misdiagnosis) by the operator, back to its original position. Also note that many mitigation systems are in a standby mode during normal i
operation, with relatively low dP and flow conditions. Sometime later during a scenario, after initial t
valve actuation, higher dP or flow conditions may develop that could prevent recovery from a subsequent mispositioning, even though the valve initially actuated from its standby condition. In analyzing their MOVs under Generic Letter 89-10, licensees may not have considered such mispositioning of active valves, and hence, may not have addressed the worst case dP and flow conditions.
Some utilities have used the practice of blocking a passive valve from inadvertent operation to prevent its mispositioning. This can be done by several means such as, keylock switches, physically locking the valve, and racking out the circuit breaker to the motor operator. However, since the location of blocked valves is very plant.speciSc and their identification is difficult, no credit for valves prevented from inadvertent operation from the mntrol room is taken in the present analysis. Herefore, all active and passive MOVs which could be identi5ed as capable of degrading safety systems by the process outlined above, were evaluated for their risk significanes.
Section 3.7 discusses some safety implications of blocking practices.
3.1 Peach Bottom Results Table 1 provides the results for the risk-significant MOVs identified directly from the IRRAS/ SARA analysis of the Peach Bottom plant. The Peach Bottom " point estimate" of total ChE for internal events is 3.62 x 104 events /Rx year. Note that the point estimate of ChF is j
different from, and slightly lower than, the statistically derived mean value of ChE. The risk increase ratio indicated in the table represents the ratio between the ChE with the failure rate of that valve set to 1.0 failures per demand and the ChF of the base case PRA model (with the standard valve fai!ure rate), herefore, this quantity is a measure of the relative risk-importance of each of the MOVs listed in the table. As an example, a failure of the HPCI injection valve, MV19, will result in a ChF of i
2.6 x (3.62 x 104 events /Rx year) = 9.41 x 104 events /Rx year.
The increase in CNE due to failure of this MOV is thus (9.41 - 3.62) x 104 = 5.79 x 104 events /Rx year.
Also shown in the table are the position of each valve during normal operation and its function as art active or passive valve.
5
He Peach Bottom results in Table 1 indicate that only two systems, HPG and emergency service water (ESW), were identified as having MOVs that, when failed, noticeably increased the plant ChE. He importance of these two systems reDects the fact that the ChE for Peach Bottom is dominated by the station blackout (SBO) and anticipated transients without scram (ATWS) sequences. These two sequences contribute 91% of the total core melt frequency for Peach Bottom.
Both the SBO and ATWS sequences rely on the HPCI and the ESW system for core protection during the event. In particular, the HPG system provides high pressure injection to the primary system during both sequences, and the ESW system provides cooling for important components (e.g., diesel generators) during the SBO sequence. However, as shown in Table 1, the ESW system is ofless importance to the CMF than the HPG system. His result is expected due to the redundancies in tbc ESW system.
He effect of truncation on the PRA modeling of the HPCI and ESW systems was evaluated by comparing the results of this review with a list of component failures that were included as basic events in the original NUREG-1150 model to determine those that were subsequently truncated in the IRRAS/ SARA model. He system Dow diagrams for these systems were also resiewed to identify any additional MOVs, which were not represented in the PRA model. He MOVs identified in these reviews are listed in Table 2.
It was determined that any MOV whose mispositioning can functionally make the HPCI system inoperable should be included. In addition, since these valves were not included in the finalIRRAS/ SARA cutsets, the risk importance of th'ese valves oculd not be determined explicitly; however the system flow diagrams were reviewed to determine a component that was modeled in IRRAS/ SARA, whose failure would affect a similar function as failure of the valve. This component was used to approximate the importance of these MOVs. Rese results are indicated for four HPCI MOVs in Table 2, along with the function (component) used for the approximation. No component was found in IRRAS/ SARA which had a similar function to a valve in the HPCI system (MV31) and a vahc in the ESW system (MV1).
Herefore, this valve is included in Table 2, but its risk-significance was not calculated.
An additional analysis of the Peach Bottom PRA was performed with IRRAS/ SARA to identify any additional systems which, when failed, result in noticeable increases in the ChT. Rese systems were then reviewed to determine if they contained MOVs that had not been included in the PRA or that had been eliminated during the truncation process discussed previously, his analysis identified the following additional systems as making important contributions to the Peach Bottom ChT:
Engineering Safety Feature Actuation System DC Power System Emergency Heating, Ventilation and Air Conditioning system Standby liquid Control System (SLC)
AC Power System A review of system flow diagrams from the PRA for each of these systems did not identify any MOVs, and thus, these systems at Peach Bottom have no effect on the present analysis. Although the SLC system does not have any MOVs in the Peach Bottom design, some other plants do have MOV suction valves in the SLC system which could have risk-significance. Hence, the SLC MOVs have also been added to Tables 2 and 5. These were approximated by failing the SLC system which 6
1 l
is possible; but, depending on the piping arrangement and MOV location, may give. conservatively high numbers for the increase in ChT.
3.2 Grand Gulf Results Table 3 summarizes the results for the risk-signi6 cant MOVs identified directly from the 1
IRRAS/ SARA analysis performed for the Grand Gulf plant. Rese results show four systems that were identi6ed as having MOVs whose failure could noticeably increase the plant CMF. Rese systems include the standby service water (SSW), HPCS, the reactor core isolation cooling (RCIC) and the emergency heating and ventilation system (EHV). Since the MOVs in the EHV system are in low pressure air lines (outside air intakes to EDG rooms) they werc excluded from the analysis as recommended by Supplement 1 to Generic Ixtter 89-10. He risk increase ratio is indicated in Table 3 for each valve in the same manner as the Peach Bottom results.
He " point estimate
- CMF for Grand Gulf is 2.% x 10' events /Rx year, and is strongly i
dominated by the SBO sequence (approximately 97%), with most of the remaining 3% being contributed by the ATWS sequence. Thus, the systems identi6ed in Table 3 represent the plant systems required for core protection, particularly during the SBO event.
As in the Peach Bottom analysis, the system flow diagrams for the SSW, RCIC, HPCS an.d i
EHV systems and the IRRAS/ SARA data base were reviewed to determine if any risk signi6 cant MOVs could be identi6ed in the system designs that may have been truncated frora the IRRAS/ SARA PRA model or perhaps not modeled in IRRAS/ SARA for these systems. The results for the HPCS and RCIC MOVs shown in Table 4 include an approximation of the risk-signi6cance (risk increase ratio) of the valves, as determined by failing a component in the IRRAS/ SARA model, which fails a function similar to the MOV. As with the single train Peach Bottom HPCI system, it was determined that any MOV which can fail and make HPCS or RCIC inoperable should be included here. No component was found in IRRAS/ SARA which had a i
function similar to two valves in the SSW system (MV14A and B). Therefore, the risk. significance of these two valves was not calculated.
Finally, the remaining systems, which were identified as important contributors to CMF, were reviewed to determine if additional system MOVs were included in the PRA model that may have been truncated. This review included the following risk important systems:
DC Power System Engineered Safety Feature Actuation System AC Power System Control Rod Drive System No additional MOVs were identified during this review.
3.3 Shoreham Control Room Simulator In order to determine if any significantly important MOVs were omitted by the valve identification process used in the preceding sections, a visit was made to the LILCO Training Center in Central Islip, New York. This center contains a control room simulator for the Shoreham Nuclear Power Plant. Shoreham is a typical BWR-4 design, similar to the Peach Bottom Plant.
7
)
.1
He intent of the visit was to identify any MOVs, which muld be mispositioned from the control room, that were not previously identified. Attention was concentrated on the systems which i
were important to the CMF in the IRRAS/ SARA Peach Bottom and Grand Gulf models. These j
systems include those in Tables 1-4 and those listed in Sections 3.1 and 3.2. Only valves in these l
systems can be evaluated for their risk-significance by the approach used in this analysis. Also, valves in other systems would be o' relatively low risk significance as compared to those considered.
He following observations were made from the control room simulator visit.
[
t In the HPCI system, the outboard steam isolation valve has a warmup MOV around it, which must be opened before the isolation valve itself can be opened. In addition, a single HPCI isolation button closed three MOVs; the outboard isolation valve, its warmup valve, and the HPCI injection valve. However, the effects ofinadvertently closing all these valves during HPCI operation has the same risk-signi6cance as closing only the injection (or admission) valve. Hence, the evaluation of valve MV19 in Section 3.1 (item 1 in Table 1) is sufScient to determine the risk signi6cance of inadvertent HPCI isolation after system initiation. However, the repositioning probability would be affected by the necessity of opening three valves. His should be kept in mind when reading the Sensitivity Analysis in Section 3.4. He isolation logic for the RCIC system at i
Shoreham is the same as for the HPCI system.
ne Shoreham mntrol panel indicated a HPCI system turbine exhaust MOV, which was controlled by a keylock switch. This valve did not appear as an MOV in the Peach Bottom HPQ i
flow diagram, which indicated that an identical function was served by a check valve and manual valve. However, as noted in Section 3.1, this MOV can make HPCI inoperable and hence should be included. His MOV would have the same risk-significance as inadverte:
eclosing the turbine steam supply valve, MV14 (item 2 in Table 1) if it was present and not key.ceked.
i Steam line and radwaste drain line valves at Shoreham were air-operated, but could be
^
motor operated at other plants. However, these valves appear as two in series and the diameter of the drain lines (1 inch diameter) is much smaller than the main system piping (10 inch diameter).
Herefore, since inadvertent opening of one would not affect system operation or develop additional dP, and since the Dow through the line would be small, these drain valves were not considered in the present analysis as having the potential to be risk significant through inadvertent operation.
i A review of the Shoreham ESW system revealed two normally open MOVs in series that close in an accident situation to separate the system into two trains with each train capable of i
supplying the safety-related loads (diesels, ventilation, and closed cooling water). Similarly, two normally closed MOVs in series exist to separate the ESW from the normal (non-safety) service water system. These MOVs also receive a close signal under accident conditions. If any one of these ESW MOVs was inadvertently mispositioned during an event, it would not have an impact on the function due to the series configuration.
An examination of the ventilation system indicated the presence of MOVs on the supply to the diesel areas. Although plant operators indicated they had problems with these valves, they were not operated from the control room, and were therefore excluded from this analysis. The presence of locally operated MOVs is a rather uncommon situation at nuclear power plants, but it does occur.
8
)
The chilled water system cools area coolers for ECCS equipment. His system was reviewed j
for MOVs which could potentially affect multiple safety systems. Redundant paths are prosided to common areas such as core spray and residual heat removal, making the misoperation of any one valve not risk significant.
4 The crosstic MOV between the two residual heat removal loops was indicated by the operators to have a large impact on risk ifinadvertently operated. For this reason, this valve is locked closed,with the breaker deenergized. Derefore,it is not position-changeable at Shoreham.
Also, a similar valve did not emerge from the PRA analyses performed in Section 3.1 and 3.2.
In summary, the visit to the Shoreham control room simulator identiSed only the HPCI system turbine exhaust valve as an additional MOV not speci5cally identiSed earlier. However, it was generally identi5ed since it is an HPCI MOV. Rus, the simulator visit confirmed that most risk-signi5 cant MOVs capable of mispositioning were included in the study already. However,it did highlight that even similar plants can have different valve con 5gurations (e.g., the HPCI turbine exhaust valve). His shows that plant-specific reviews willlikely be needed if plants are not going to address allposition-changeable MOVs. Plant specificlimitations are briefly discussed in Section 3.6.
3.4 Sensitivity Analysis The results described in Sections 3.1 and 3.2 can be used to determine the increase in'the plant CMF, assuming that any one of the identined MOVs is mispositioned and a differential pressure or flow condition exists that prevents the valve from returning to its required position. In the previous sections, when calculating the risk importance of the position-changeable MOVs, the failure rate of these MOVs was increased to 1.0 failures per demand. This was a simpli5 cation and i
can more properly be expressed as follows.
First, one assumes that an initiating event for a particular PRA accident sequence (e.g.,
station blackout) has occurred. For the valve to fail through the mispositioning scenario considered in this analysis, the following must occur:
1.
The MOV must be moved to an incorrect position.
(Probability = P.,,y,
)
I 2.
Here must be a high dP or high flow condition at the valve.
(Probability = Pn,,)
j 3.
He valve must then fail to reposition when (and if) recovery is attempted.
(Failure Rate, FR = FR,,y,_)
Thus the correct expression to use for the failure rate of the MOVs in the PRA calculations would be 1
2 FR ru = P.,,y,, x P n,, x FR,,,,,
i 5
9
As stated above, the initial calculation, performed separately for each valve, assumed that both probabilities were 1.0 and that FR was 1.0 failure per demand. One should note also, that even this more detailed expression is somewhat of a simpli6 cation. For example, other possibilities that could be considered are the failure of the operators to even attempt repositioning, or normal hardware failures of the MOV during an attempted repositioning.
% s quite difficult and i
He actual determination of probability values for P.
and P beyond the scope of this project. Also FR _ may not be as high as 1.0 failures per demand.
Therefore a sensitivity study was performed to determine the effect on Ch6 as the value FR u = P_ x Pm, x FR,
r is varied between the lower base case PRA values and the high value of 1.0 failures per demand used in the earlier sections.
He PRA base case values for MOV failure rates are in the range of 1 x 10'5 to 3 x 10-8 failures per demand. He sensitivity study was done for three values of FR ru between 10 and 1.0 failures per demand. One valve in the Peach Bottom ESW system (item 6 in Table 1) was not further evaluated because its risk increase ratio for a failure rate of 1.0 failures per demand was very near 1.0. The results are shown in Table 5 and indicate that, for the most risk-significant valves listed at the top of Table 5, the ChE is approximately doubled for a combined MOV fail,ut;e rate of 1.0 x 104 failures per demand. One should note that, if multiple MOVs were assumed te be mispositioned (even at failure rates less than 1.0 failures / demand), the increases in core melt frequency would be noticeably higher than shown in the attached tables. However, only single MOV mispositioning was considered credible for this analysis, as explained in Section 2 above. If possible, a more detailed evaluation of the probability of mispositioning a valve and of the probability of the inability to recover, should be performed to obtain a more complete understanding of the risk significance of the BWR valve mispositioning issue.
To illustrate the use of the risk increase ratio and to help understand the results of Table 5, an example for item I in Table 5 is shown in more detail in Table 6. For this particular valve, the risk increase ratios corresponding to each assumed failure rate are multiplied by the Grand Gulf base case ChE of 2.06 x 104 events /Rx year to give the ChE corresponding to each failure rate.
The change (A) in ChE is thea obtained by taking the difference between this CMF and the base i
case Ch E.
3.5 BWR High Pressure Makeup System MOVs Considered for Mispositioning Under Bulletin 85-03 In Reference 8, the BWROG has considered the repositioning of selected MOVs in high pressure makeup systems covered by Bulletin 85-03, resulting from inadvertent operation. A total of nine valves in the HPCS, HPCI, and RCIC systems were included. For completeness, this section correlates these valves to the valves in the present analysis or discusses why they were not directly considered, but how they could be evaluated. These nine valves are:
1.
HPCS System Condensate Storage Tank Suction Valve 2.
HPCS System Suppression Pool Test Return Isolation Valve 10 i
l i
3.
HPG System Condensate Storage Tank Suction Valve 4.
HPCI System Injection Valve Test Valve 5.
HPG Turbine Exhaust Isolation Valve 6.
RCIC System Condensate Storage Tank Suction Valve 7.
RCIC System Injection Valve Test Valve 8.
RCIC System Turbine Exhaust Isolation Valve 9.
RCIC System Trip and Throttle Valve The HPCS System Condensate Storage Tank Suction Valve and Suppression Pool Test Return Isolation Valve were included in the Grand GulfIRRAS/ SARA model. Rese are hW1 and MV23; item 7 in Table 3, item 1 in Table 4, and items 5 and 6 in Table 5, respectively.
j The similar HPCI suction and test valves were included in the Peach Bottom IRRAS/ SARA j
model as valves MV17 and MV20; items 4 and 3 in Table 1 and items 8 and 9 in Table 5, respectively. The HPG Turbine Exhaust Isolation Valve does..ot appear in the analysis because the Peach Bottom HPCI flow diagram indicates that a check valve and manual valve serves this function at Peach Bottom. However, as indicated in Section 3.3, inadvertent closure of this valve j
during HPCI system operation would have the same risk-importance as inadvertent closure of the Turbine Steam Supply Wlve (MV14); item 2 in Table 1 and item 7 in Table 5.
The RCIC System Suction Valve was modeled in Grand GulfIRRAS/ SARA as MV10; item 14 in Table 3 and item 4 in Table 5. The Grand Gulf plant does not appear to contain a RCIC System Injection Valve Test Valve, but its risk-signiScance would be equivalent to that of MV10 discussed above. The RCIC System Turbine Exhaust Isolation Exhaust Isolation Valve was truncated from the Grand Gulf IRRAS/ SARA model (MV68) but was evaluated as item 2 in Table 4 and item 3 in Table 5. The RCIC System Trip and Throttle Valve was not explicitly modeled in i
the Grand Gulf IRRAS/ SARA model, but its inadvertent closure during sy: tem operation would have the same risk-importance as closing MV45; item 13 in Table 3 and item 4 in Table 5. Thus allvalves in Reference 8 are covered by this analysis and all appear to be somewhat risk significant.
1 3.6 Plant Speelfic Limitations The approach in this analysis used somewhat simplified PRAs of two BWR plants. As previously discussed, the use of two plants places certain limitations on the valves identified and the risk-significance of mispositioning them. First, as indicated earlier, different plants may employ different valve configurations. (e.g., manual vs motor operated HPCI Turbine Exhaust Valve). In addition, the IRRAS/ SARA models concentrate on the dominant accident sequences and the relevant systems for each specific plant.
As is well known by PRA analysts, individual plants often have plant specific vulnerabilities which result in sequences or cutsets becoming risk significant at those plants which are not generally risk signiScant in the industry. It is anticipated that this would also occur in the area of position.
11
changeable MOVs. Some types of these potential plant specific vulnerabilities can be predicted, such as SLC suction MOVs, as mentioned earlier. Also, since HPCI, HPCS and RCIC are single train systems, any additional plant speciSc mispositionable MOVs in these systems should be included. Other plant.specificvulnerabilities may be too plant-unique to be foreseen ahead of time.
J For these reasons, the results of this study should not be used to dctermine a restrictive list of position changeable valves to be included under Generic Letter 89-10. These results should only be used to obtain a representative measure of the risk-significance attached to the mispositioning of these valves.
3.7 Safety Implications of Blocking Passive MOV's to Prevent Inadvertent Mispositioning In Supplement I to NRC Bulletin 85 03, action item "a" was clarified to indicate that each MOV must be able to recover from an inadvertent mispositioning, unless it was blocked from inadvertent operation. Valves that are considered
- passive" are candidates for blocking, because they will not have to automatically change position on automatic system operation. A utility may choose to block a passive valve in order to avoid the need for a Generic letter 89-10 analysis.
However, the blocking of even passive MOVs can cause concerns, since it limits the flexibility that operators have in reconfiguring the system in response to ongoing events and component / system level failures. As a result, the three passive MOVs in attached tables were reviewed to determine the potential for, and consequences of, blocking them. This review was brief and based only on thie simplified PRA system drawings.
~
1.
Peach Bottom HPCI Pump Discharge Valve (MV 20)
This valve is normally open and remains <> pen during system operation. Closure should not 1
be required for any system operational situation. Hence, blocking this valve open does not appear to increase risk.
2.
Peach Bottom ESW Pump Discharge Cross Connect Valve (MV-1)
This valve is normally open and remains open during system operation to provide flexibility of ESW supply. A possible scenario requiring its closure would be a line break downstream of the valve. "Dris is a very low probability and hence, blocking the valve does not appear to particularly increase risk.
3.
Grand Gulf HPCS Pump Test Discharge Valve to Suppression Pool (MV23)
This valve is normally shut and remains shut during HPCS operation. It is only needed during testing of HPCS and hence, blocking the valve shut should not increase risk..
The review of these three passive valves did not reveal any likely risk significant scenarios caused by blocking the valves. However, as noted above, there can be cases where blocking may be undesirable. Therefore, blocking should be approached with caution and each case should be carefully evaluated.
1 12 D
H
4.
SUMMARY
Simpli5ed PRA models of two BWR plants were reviewed to identify both active and l
l passive MOVs which could have a noticeable effect on core melt frequency if they are inadvertently mispositioned and are unable to be repositioned due to high differential pressure or flow conditions.
The failure rate of each MOV in the simplified PRA models was increased to 1.0 failures per demand in order to identify those valves whose individual failure could noticeably effect the ChE.
i Using this method, two systems in the Peach Bottom model (High Pressure Coolant Injection. Emergency Service Water) and four systems in the Grand Gulf model (Standby Service Water, High Pressure Core Spray, Reactor Core Isolation Cooling, Emergency Heating and Ventilation) were found to contain MOVs important to risk. Further, some additional valves in these systems, which were truncated from the PRA model, were evaluated by *failing" modeled components that had an equivalent function to the truncated valves. Some of these MOVs were j
also noted to be important to risk. Flow diagrams of these and other systems having an important effect on the ChF of these two plants were reviewed to determine if any MOVs were present that were not modeled or truncated in the PRA. A few additional MOVs were found. The analyses performed showed that in the single train safety systems, HPCI, HPCS, and RCIC, any MOV whose failure can result in the functional failure of the system, is somewhat important. The other systems identified have selected MOVs that are important. All MOVs identified are outside of primary containment except for two valves (HPCI and RCIC inside containment isolation valves, MV15,and MV63).
The Shoreham (a typical BWR-4 plant) control room simulator was visited to determine if l
l any significantly important MOVs were omitted from the analysis performed as described above.
One MOV, the HPCI System Turbine Exhaust Valve,was found which did not appear as an MOV in the Peach Bottom or Grand Gulf HPCI System Flow diagrams. This valve was operated by a keylock switch at Shoreham, but could be evaluated for risk importance from a functionally similar valve,if mispositionable at other plants. This finding was in line with that for the HPCI system above.
The visit to the simulator confirmed that most risk.significant MOVs capable of l
mispositioning were already included in the study.
The results of the initial calculations using valve failure rates of 1.0 failures per demand were tabulated, for each identified MOV, in the form of a risk increase ratio. This ratio represents l
the ratio between the ChE with the valve failure rate set to 1.0 failures per demand and the ChE of the base case PRA model(Peach Bottom base CMF = 3.62 x 104 events /Rx year and Grand Gulf base CMF = 2.06 x 10* events /Rx year), which uses the standard valve failure rate. The multiplication of the base case ChE by the risk increase ratio gives the ChE with that particular valve in a failed condition.
These results assume that it is a certainty that an MOV is mispositioned and that a high differential pressure or flow condition exists that prevents the valve from returning to its required position. In actuality, these events are not certain and can be represented by a probability, which is less than 1.0. The determination of these probabilities is difficult and beyond the scope of this study. Therefore, a sensitivity study was performed to determine the effect on ChE as the MOV 4
failure rate in the PRA is varied between the lower base case values (in the range of 1.0 x 10 to 1.0 x 10 failures per demand) and the high value of 1.0 failures per demand used initially. The 4
results of the sensitivity study are tabulated for each risk-significant MOV as a risk increase ratio 13 l
l
for e..in of four assumed MOV failure rates. Clearly some judgement is required.in determining v+ach MOV mispositioning failure rate so ase and hence, what sne ultimate risk signincance of this issue is.
Nine valves already considered for mispositioning by the BWROG are related to the MOVs of this study. Rey are all covered in the present analysis and all appear to be somewhat risk-signi6 cant.
Care should be used in employing these results. The purpose of this study was to provide input to iesolution of the BWROG's questioning of the risk-signi5 cant of the MOV mispositioning issue. The results provide a representative measure of the risk-signi6cance of the issue derived from a sampling of valves. He study is limited in the number of valves by plant specific considerations and the characteristics of the PRA models used. Different plants may employ different valve con 6gurations than the two plants considered here. In addition, individual plants
<ften have plant speci5c vulnerabilities which determine which sequences or cutsets are risk-signi5 cant. Also, PRA modeling assumptions and the PRA truncation process may have eliminated some risk-signi6 cant MOVs from the models used. For these reasons, the results should be used to identify and quantify representative important MOVs and not to determine a restrictive list of position-changeable valves to be included under Generic Letter 89-10.
4 I
i f
14 i
l l
l
REFERENCES 1.
U.S. Nuclear Regulatory Commission, " Motor-Operated Valve Common Mode Failures During Plant Transients Due to Improper Switch Settings," IE Bulletin 85-03, Of6ce of Inspection and Enforcement, November 15,1985.
2.
U.S. Nuclear Regulatory Commission, " Motor-Operated Valve Common Mode Failures During Plant Transients Due to Improper Switch Settings," NRC Bulletin No. 85-03, Supplement 1 April 27,1988.
3.
U.S. Nuclear Regulatory Commission, " Safety-Related Motor-Operated Valve Testing and Surveillance," Generic letter No. 89-10, June 28,1989.
4.
U.S. Nuclear Regulatory Commission " Supplement 1 to Generic letter 89-10: Results of the Public Workshops," Jurm 13,1990.
4 5.
Higgins, J.C., Ruger, CJ., MacDougall, E.A., and Huszagh, D.,"Value-Impact Analysis for Extension of NRC Bulletin 85 03 to Cever All Safety-Related MOVs," NUREG/CR-5140, Brookhaven National Laboratory, July 1988.
6.
Ietter from GJ. Beck, Chairmcn, BWROG, to Ledyard B. Marsh, NRC. 'Nef, Mechanicil Engineering Branch *Desiga Bas s Assumptions for BWR Residual Heat Removal System i
Differential Pressure Methodoiogy Evaluation for Generic Letter 89-10," June 13,1990.
7.
12tter from GJ. Beck, Chairman, bWROG, to Thomas E. Murley, Director of NRR, NRC, "BWR Owners' Group Design Basis Assumptions for BWR MOV Evaluations Under Generic letter 89-10," March 14,1991.
8.
Howard, R.W., "BWR Owners' Group Report on the Operational Design Basis of Selected Safety-Related Motor-Operated Valves," NEEC-31322. Supplement 1, July 1988.
9.
U.S. Nuclear Regulatory Commission. " Severe Accident Risks: An Assessment of Five U.S.
Nuclear Power Plants," Final Summary Report, NUREG-1150, December 1990.
10.
Russell, K.D., et al., " Integrated Reliability and Risk Analysis Systers (IRRAS),"
NUREG/CR-5300, EG&G Idaho, Inc., February 1991.
e 15
l l
Table 1,. Rist Significant MOVs Identified frum Peach Bottom IRRAS/ SARA Model Valve No.
System Valve Description Valve Position Function Risk During Normal (Active /
Increase Plant Operation Passive)
Ratio 1
IIPCI Injection valve MVl9 Closed Active 2.6 l
2 IIPCI Tmbine steam supply MV14 Closed Active 2.6 3
IIPCI Pump discharge valve MV20 Open Passive 2.4 4
IIPCI Pump suction line from condensate storage MV17 Open Active 2.4 tank 5
IIPCI Pump suction from suppression pool MV57 Closed Active 2.4 6
ESW Emerge;.cy cooling water pump discharge MV3 Closed Active 1.04 l
l l
i
.__.______.___m
_..J
Table 2. Other Risk-Significant MOVs Based on the Peach Bottom Analysis Valve No.
System Valve Description Va!ve Position Function Risk SARA During Normal (Activel.
Incitase Approximated Plant Passive)
Ratio Component Operation 1
11PCI Steam line containment MV15 Open Active 2.6 MV14 isolation valves MV16 2
IIPCI Pump suction from MV58 Closed Active 2.4 MV57 suppression pool 3
ESW Pump discharge cross MV1 Open Passive connect Closed Active 8.9 SLC System 4
SLC Pump suction valves
- No equivalent component represented in IRRAS/ SARA l
l l
9 l
Tabic 3. Risk-Significant MOVs identified fmm Grand Gulf IRRAS/ SARA Model Valve No.
System Valve Description Valve Position Function Risk During Normal (Active /
Increase Plant Operation Passive)
Ratio I
SSW Outlet of dicsci gelcrator cooler and high MV11 Closed Active 10.9 pressure core spray room cooler 2
SSW Discharge of service water system Pump A and MVIA Jiosed Active 6.7 MVID Pump D MVSA Closed Active 6.7 3
SSW ESF equipment train A outlet MV5B Closed Active 6.7 4
SSW ESF equipn ent train U outict 5
SSW Inlet to dicscl generator jacket cooler MV18A Closed Active 6.7 MVl8B 6
ilPCS Outlet of IIPCS pump to pressure vessel MV4 Closed Active 2.6 7
IIPCS Pump suction from condensate storage tank MV1 Open Active 2.6 8
IIPCS Pump suction from suppression pool MVIS Closed Acsive 2.6 MV12 Closed Active 2.6 9
lIPCS Pump min-flow to suppression pool MV13 Closed Active 3.0 10 RCIC Injection valve MV46 Closed Active 3.0 11 RCIC Inlet to tube oil cooler MV19 Closed Active 3.0 12 RCIC Pump min-flow to suppression pool MV45 Closed Active
~2 13 RCIC Turbiec steam supply MV10 Open Active 3.0 14 RCIC Pump suction from condensate storage tank 15 RCIC Pump suction from suppression pool MV31 Closed Active 3.0
, V64 Open Active 3.0 d
16 RCIC Steam line containment. isolation valve
Table 4. Other Risk-Significant MOVs Based on the Grand Gulf Analysis Valve Position Valve No.
System Valve Description Dudng Function Risk SARA' Normal Plant (Active /
Increase Approximated Operation Passive)
Ratio Component 1
IIPCS Pump test discharge to MV23 Closed Passive 2.6 MV12 suppression pool 2
RCIC Turbine exhaust to MV68 Open Active 3.7 Turbine driven suppression pool pump trip 3
RCIC Steam line containment MV63 Open Active 3.0 MV45, MV64 isolation valve 4
SSW Cooling to RIIR IIx MV14A Closed Active MV14B
- No equivalent component represented in IRRAS/ SARA 4
~.
4 Table 5. Failure Rate Sensithity Analysis for Risk Significant MOVs Failure Rate (failures /dernand)
No.
System MOV Active / Passive 10 10-1 0.5 1.0 8
Risk Increase Ratio
- Grand Gulf 1.
SSW MV11 Active 1.07 2.0 5.9 10.9 2.
SSW MVIA.MV1B MVSA.MV5B Active 1.04 1.6 3.8 6.7 MV18A.MV18B 3.
RCIC MV68 Active 1.01 1.2 2.2 3.7 4.
RCIC MV10,MV13 MV19,MV23 Active 1.01 1.2 2.0 3.0 MV31.MV45, MV46,MV63, MV64 5.
HPCS MV1,MV4, Active 1.01 1.2 1.8 2.6 MV12.MV15 6.
HPCS MV23 Passive 1.01 1.2 1.8 2.6 Risk Increase Ratio
- Peach Bottom 7.
HPCI MV14,MV15, Active 1.01 1.2 1.8 2.6 MVI6,MV19 8.
HPCI MV17,MV57, Active 1.01 1.1 1.7 2.4 MV58 9.
HPCI MV20 Passive 1.01 1.1 1.7 2.4 10.
SLC Pump Suction Active 1.05 1.8 4.9 8.9
- The risk increase ratio indicated in the table represents the ratio between the CMF with the failure rate of that valve set to 1.0 failures per demand and the CMF of the base case PRA model with the standard valve failure rate. The " point estimate" base case CMF is 2.06 x 10'* cventdRx yr for Grand Gulf and 3.62 x 104 events /Rx yr for Peach Bottom.
Table 6. Example of CMF Values for MV11 of the Standby Service Water (SSW)
System at Grand Gulf MOV Failure Rate CMF ACMF (fallure/ demand)
Risk Increase Ratio (event /Rx yr)
(event /Rx 37) 1.0 10.9 2.2E-5' 2.0E 5 5.0E-1 5.9 1.2E-5 1.0E-5 1.0E-1 2.0 4.1E-6 2.1E-6 1.0E-2 1.07 2.2E-6 1.4E-7
- 2.2E-5 = 2.2 x 10 5 e
f l
l l
I 1
~,-.__m j
-l
4 UNITED STATES.
1 NUCLEAR REGULATORY COMMISSION 1,1 g WASHINGTON, D. C. 20555 d
Q!
l
\\,, * /
February 12, 1992
(
ALL LICENSEES OF OPERATING NUCLEAR POWER PLANTS AND HOLDERS OF CONSTRUCTION PERMITS FOR NUCLEAR POWER
]
TO:
PLANTS
'?2NERIC LETTER 89-10, SUPPLEMENT 4,
SUBJECT:
" CONSIDERATION OF VALVE MISPOSITIONING IN BOILING WATER REACTORS" i
In Generic Letter (GL) 89-10, " Safety-Related Motor-Operated Valve' (MOV) Testing and Surveillance," the staff recommended, among other things, that any MOV in a safety-related system that is not blocked from inadvertent operation from either the control room, the actor control center, or the valve itself be considered capable of being
~
to as position-changeable MOVs) and be j
mispositioned- (referredincluded in licensees' MOV programs. - When determ i
the differential pressure or flow for position-changeable.MOVs, licensee should consider the fact that the MOV aust be able to i
Supplement 1 to GL 89-10 limited the recover from mispositioning.
prevention of inadvertent MOV operation within the context of the generic letter to the potential for MOV mispositioning from the l
control room.
'f The Boiling Water Reactors Owners' Group (BWROG) submitted a backfit appeal on the ' recommendations for position-changeable j
valves.
The staff, with the assistance of ~ Brookhaven National
~
Laboratory (BNL), has reviewed and evaluated the-issues concerning mispositioning of valves from the control room and has determined' l
that the recommendations in GL 89-10 should be changed-for boiling The BNL study, which used probabilistic water reactors (BWRs).
risk assessment techniques, and the staff's evaluation were included in a letter from NRC to the BWROG dated this same date.
The staff no longer considers the recommendations for inadvertent f
operation of MOVr,from the control room to be within the scope GL 89-10 for BWRs.
of valve mispositioning benefits safety.
Modifying the provisions in GL 89-10 for valve mispositioning does not affect the GL 89-10 provisions for licensees to review safety analyses, emergency procedures, and other plant documentation to
)
i i
l 9202070037-n w
w s
L f February 12, 1992 fluid conditions under which all MOVs 1
determine the design basis in safety-related piping systems may intentionally be called upon This position also does not supersede the NRC's generic recommendations or regulations on valve mispositioning that to function.
.'ssues such as intersysten loss-of-coolant pertain to other or fire protection (10 CFR 50, Appendix R).
accidents (ISLOCA)
This modification to the recommendations addresses only BWR plants.
a similar review for pressurized water performThe NRC staf f will review results of the PWR study The NRC will and may revise GL 89-10, if warranted, appropriately to clarify the reactors (PWR).
NRC's position regarding consideration of valve mispositioning The BWROG may complete the within the scope of GL 89-10 for PWRs.
design basis reviews consistent with the position herein.
This generic letter contains no information collection requ Reduction *Act of 1980 (44 U.S.C.
3501 et seq.).
1 Jane a G. Partlow Associate Director for Projects office of Nuclear Reactor Regulation l
Design basis conditions are those conditions during both 1
normal operation and abnormal events that are within the design basis of the plant.
LIST OF RECENluf ISSUED GENERIC LETTERS Date of Generic Issuance Issued To Letter No.
Subject 58-01 NRC POSITION ON INTER-02/04/92 ALL LICE'NSEES OF OP BWRs & HOLDERS OF SUPPLEMENT 1 GRANULAR STRESS CORROSION CONST. PERMITS FOR BWRs 91-19 INFO TO LICENSEES RE: NEW 12/19/91 ALL HOLDERS OF OP LICENSES OR CONST.
TELEPHONE N05. AT NRC PERMITS FOR NPRs WHITE FLINT NORTH BLDG.
91-18 INFO TO LICENSEES RE TWO 11/07/91 ALL NUCLEAR PWR REACTOR LICENSEES NRC INSP MANUAL SECTIONS AND APPLICANTS ON RESOLUTION OF DEGRADED AND NONCONFORMING CONDITIONS AND ON OPERABILITY 91-17 GENERIC SAFETY ISSUE 29, 10/17/91 ALL HOLDERS OF OP LICENSES OR CONST
" BOLTING DEGRADATION OR PERMITS FOR NUCLEAR FAILURE IN NUCLEAR POWER POWER PLANTS PLANTS" 91-16 LICENSED OPERATORS' AND 10/03/91 HOLDERS OP LIC OR CONSTR. PERMITS FOR OTHER NUCLEAR FACILITY NUC PWR/NPRs AND ALL PERSONNEL FITNESS FOR DUTY LICENSED OPERATORS
& SENIOR OPERATORS 91-15 OPERATING EXPERIENCE 09/23/91 ALL P0kER REACTOR LICENSEES AND i
FEEDBACK REPORT, 50LEH01D-APPLICANTS OPERATED VALVE PROBLEMS AT US REACTORS 91-14 EMERGENCY TELECOMMUNICA-09/23/91 ALL HOLDERS OF OP f
LICENSES OR CONST.
TIONS PERMITS 91-13 REQUEST FOR INFO RELATED 09/19/91 LICENSEES AND APPLI-CANTS Braidwood, Byron TO RESOLUTION OF GI130, Catawba, Cor.anche Peak i
" ESSENTIAL SERVICE WATER SYS FAILURES AT MUTLI-UNIT Cook, Diablo, McGuire SITES"PURSUANTTO10CFR50.54(f) 91-12 OPERATOR LICENSING KAT.
08/27/91 ALL PWR REACTOR AND APPLICANTS FOR EXAMINATION SCHEDULE AN OPERATING LICENSE 91-11 RESOLUTION OF GENERIC 07/18/91 ALL HOLDERS OF OPERATING LICENSES ISSUES 48, "LCOs FOR CLASS 1E VITAL INSTRUMENT BUSES,"
and 49, "IKTERLOCKS AND LCOs FOR CLASS 1E TIE BREAKERS" PURSUANTTO10CFR50.54(f)
-