ML20057E592

Auxiliary Feedwater System RISK-BASED Inspection Guidance for the DAVIS-BESSE Nuclear Power Plant

ML20057E592
Person / Time
Site:	Davis Besse
Issue date:	09/30/1993
From:	Gore B, Hopkins J, Moffitt N, Nickolaus J, Vo T Battelle Memorial Institute, PACIFIC NORTHWEST NATION, Office of Nuclear Reactor Regulation
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-L-1310 NUREG-CR-5829, PNL-7905, NUDOCS 9310120332
Download: ML20057E592 (38)

Text

.

NUREG/CR-5829-PNL-7905 r

Auxiliary Feedwater System Risi-Basec. Inspection Guidance for the Davis-Besse Nuclear Power Plant I

Prepared by

[

J. R. Nickolaus, N. E. Moffitt, B. E Gore. T. V. Vo/PNL i

J. B. Hopkins/NRC i

Pacific Northwest Laboratory i

Operated by Battelle Memorial Institute I

- Prepared for

, U.S. Nuclear Regulatory Commission 4

I ZBA 1888R 32838846 G

PDR

i 3

?

AVAILABluTY NOTICE Availability of Reference Materia!s Cited b NRC Publicatons Most documents cited in NRC publications wlR be avaltable from one of the fo5owing sources:

1.

The NRC Public Document Room, 2120 L Street, NW, Lower Level. Washington, DC 20555-0001 2.

The Superintendent of Documents, U.S. Govemment Prbting Office, Mal Stop SSOP, Washington, DC 20402-9328 3.

The National Techrdcal in'ormation Service, Springfield, VA 22161 Although the Noting that follows represents the majortty of documents cited in NRC pubucations, it is not intended to be exhaustive.

E a

Referenced documents avaRable for inspection and copying for a fee from tne NRC Pubilo Document Room include NRC correspondence and internal NRC memoranda: NRC Office of inspection and Enforcement bulletins, circulars, information notices, inspection and investigation notices: Uconsee Event Reports; verb dor reports and correspondence: Commission papers; and applicant and Scensee documents and corre-spondence, 5

The foRowing documents in the NUREG series are available for purchase frorn the GPO Sales Program:

formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and F

brochures. Also avaBable are Regulatory Guides. NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission issuances.

Documents available from the National Technical information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commis-mion, forerunner agency to the Nuclear Regulatory Commission.

Documents avagable from pubDe and special techrdcal libraries include an open ilterature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legisla-tion, and congressional reports can usualty be obtained from these abraries.

l DocLments such as theses, dissertations, foreign reports and translations, and non-NRC conference pro-coedings are available for purchase from the organl2ation sponsoring the publication cited, Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Information Resources Management Distribution Section U.S. Nuclear Regulatory Commission, Washhgton, DC 20555-0001.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Ubrary,7920 Norfolk Avenue, Bethesda, Maryland, and are available there for refer-ence use by the pubuc, Codes and standards are usualty copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards institute,1430 Broadway, New York, NY 10018, i

DISCLAIMER NOTICE This reoort was prepared as an account of work sponsored by an agency of the United States Govemment.

Neither the United States Government nor any agency thereof, or any of their errployees, makes any warranty, expresed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of i

such use, of any information, apparatus, product or process disciored in this report, or represents that its use by such third party would not infringe privately owned rights.

l

NUREG/CR-5829 PN L-7905 i,...,..,..... -....,,....,,..,....,....,...,,.

,,..,,,,...a,.,

-,,,.-,e Auxi:iary Feecwa:er Sys:em Ris1-BasecL Insaec^ ion Guic ance d'o:r ::he Davis-3 esse Nuc~ ear Power Zarr:

.mmmmanumane.imasensnaman.miransummurasmmunum m mmm.

m Prepared by J. R. Nickol.:us. N. E Mof fitt, IL E Gore.1. Y. VoJPNL

3. H. Hopkms NRC Pacific Northue.st Laboratory Operated by llattelle Memorial In.stitute Prepared for U.S. Nuclear Regulatory Commission 9310120332 930930 PDR ADOCK 05000346 G

PDR

I i

i s

l AVAILABluTY NOTICE I

i Availatwirty of Reference Matenats Cited in NRC PubhcatKris Most documents cited in NRC publicatK>ns will be available from one of the fo5owing sources:

{

1.

The NRC Public Document Room 2120 L Street, NW, Lower Level, Washington, DC 20555-0001 i

2.

The Superbtendent of Documents, U.S. Govemment Printing Office, Mall Stop SSOP, Washington,

[

DC 20402-9328

?

u 3,

The National Technical information Service, Springfield, VA 22161 I

Although the listbg that follows represents the majority of documents cited h NRC publications, it is not intended to b6 exhaustive.

Referenced documents available for inspection and copyhg for a fee from the NRC Pubi6c Document Room j

include NRC correspondence and internal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, information nottecs, inspection and investigation notices; Ucensee Event Reports; ven-dor reports and correspondence; Commission papers; and applicant and licensee documents and corre-spondence.

i The following documents in the NUREG series are available for purchase from the GPO Sales Program:

i formal NRC staff and contractor reports NRC-sponsored conference proceedings, and NRC booklets and

{

brochures. Also ava!!able are Regulatory Guides, NRC regulations h the Code of Federal Regulaf!ons, and l

Nuclear Regulatory Commission issuances.

l Documents available from the National Technical information Service include NUREG series reports and te,hnical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commis-l Won. forerunner agency to the Nuclear Regulatory Commission.

i 4

Documents available from pubuc and special techrdcal libraries include all open Itterature items, such as books, joumal and periodical articles, and transactions. Federal Register notices, federal and state legista-tion, and congressional reports can usualty be obtained from these libraries.

j I

Documents such as theses, dissertat6ons, foreign reports and translations, and non-NRC conference pro-j j

ceedings are avaDable for purchase from the organization sponsoring the publication cited.

l 4

Single copies of NRC draft reports are available free, to the extent of suppty, upon written request to the f

3 Office of information Resources Management. Distribution Section, U.S. Nuclear Regulatory Commission, l

Washington, DC 20555-0001, Copies of industry codes and standards used in a substanthie manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for refer-j ence use by the public. Codes and standards are usualty copyrighted and may be purchased from the l'

originating organtration or. If they are American National Standards, from the Amer}can National Standards 5

Institute,1430 Broadway, New York, NY 10018.

i i

DISCLAIMER NOTICE i

This report was prepared as an account of work sponsored by an agency of the United States Government.

1 Neither the United St.ses Govemment nor any agercy thereof, or any of their employees, makes any warranty, erpresed or implied, or assumes any legal liabihty of responsibility for any third party's use, or the resuits of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights.

i b

~

4

NUREG/CR-5829 PNL-7905 Auxiliary Feedwater System Risk-Based Inspection Guidance for the Davis-Besse Nuclear Power Plant Manuscript Completed: August 1993 Date Published: September 1993 Prepared by J. R. Nickolaus. N. E. Moffitt, B. E Gore, T. V. Vo. Pacific Northwest Laboratory J. B. Hopkins, U.S. Nuclear Regulatory Commission J. Chung. NRC Program Manager Pacific Northwest Latr 3ry Richland WA 99352 Prepared for Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 NRC FIN L1310 t

I

4 4

l l

i 4

i Abstract f

in a study sponsored by the U.S. Nuclear Regulatory Commission (NRC). Pacific Northwest l_aboratory has developed and applied a methodology for deriving plant-specific risk. based inspection guidance for the auxiliary feedwater (AFW) system at pressurized water reactors that have not undergone probabilistic risk assessment (PRA). This methodology uses existing PRA results and plant operating experience information. Existing PRA-based inspection guidance information recently developed for the NRC for various plants was used to identify generic component failure modes. This information was then combined with plant-specific and industry-wide component information and failure data to identify failure modes and failure mechanisms for the AFW system at the selected plants. Davis-Besse was selected as one of a series of plants for study. The product of this effort is a prioritized listing of AFW failures which have occurred at the plant and at other PWRs. This listing is intended for use by the NRC inspectors in preparation of inspection plans addressing AFW risk-important components at the Davis-Besse plant.

i t

I 4

i i

r l

e I

r I

l i

1 I

i i

t iii NUREG/CR-5829 i

.1

Y L

i b

)

i i

l I

Contents iii l

Abstract.

Summary vii i

Acknowledgments ix 1 Introduction 1.1

[

r 2 Davis-Besse AFW System.

2.1

2.1 System Description

2.1 2.2 Success Criterion 2.2 2.3 System Dependencies 2.2 2.4 Operational Constraints 2.2 3 Inspect 6n Guidance for the Davis-Besse AFW System.

3.1 3.1 Risk Inportant AFW Components and Failure Modes.

3.I 3.1.1 Multiple Pump Failures Due to Common Cause 3.1 3.1.2 Turbine Driven Pumps Fails to Start or Run 3.2 3.1.3 Motor Driven Pump Fails to Start or Run 3.3 3.1.4 Pump Unavailable Due to Maintenance or Surveillance..

3.4 3.1.5 Air Operated Values Fail Closed.....

3.4 3.1.6 Motor Operated Control Valves Fail Closed.

3.4 3.1.7 Solenoid Valves Fail to Operate 3.6 3.1.8 Manual Suetion or Discharge Valves Fail Closed 3.6 3.1.9 Leakage of Hot Feedwater Through Check Valves...

3.7 3.2 Risk Important AFW System Walkdown Table.

3.7 4 Generic Risk Insights from PRAs 4.1 4.1 Davis-Besse lPE...

4.1 4.2 Risk Important Accident Sequences involving AFW System Failure 4.1 4.3 Risk Important Component Failure Modes.....

4.2 5.1 5 Failure Modes Determined from Operating Experience 5.I Davis-Besse Experience 5.1 5.1 5.1.1 Multiple Driven Pump Failures.

5.1.2 Motor Driven Pump Failures 5.1-5.1.3 Turbine Driven Pump Failures 5.1 5.1.4 Flow Control and Isolation Valve Failures 5.1 v

NUREG/CR-5829

i 5.1.5 Check Valve Failures.

5.2 t

5.1.6 Human Errors..

5.2 j

5.2 Industry Wide Experience 5.2 t

i 5.2.1 Common Cause Failures 5.2 i

5.2.2 Human Errors.

5.4 6

5.2.3 Design / Engineering Problems and Errors.

5.4 5.5 i

5.2.4 Component Failures l

6 References 6.1 l

Figures l

2.1 Davis-Besse Auxiliary Feedwater System 2.3

}

2.4 j

2.2 Auxiliary feedwater steam supply..

i I

Tables i

3.1 Risk importance AFW system walkdown table for Davis-Besse AFW system components.

3.8 l

i I

l I

i i

t l

1 i

i i

NUREG/CR-5829 vi

-ve.-

.-----.---.m

-+ -

w

-~

l F

Summary his document presents a compilation of auxiliary feedwater (AFW) system failure information w hich has been screened 4

for risk significance in terms of failure frequency and degradation of system performance, it is a risk-prioritized listing of failure events and their causes that are significant enough to warrant consideration in inspection planning at the Davis-Besse plant. This information is presented to provide inspectors with increased resources for inspection planning at Davis-l 4

Besse.

The risk importance of various component failure modes was identified by analysis of the results of probabilistic risk assessments (PRAs) for many pressurized water reactors (PWRs). Ilowever, the component failure categories identified

)

in PRAs are rather broad, because the failure data used in the PRAs is an aggregate of many individuals failures having a variety of root causes. In order to help inspectors to focus on specific aspects of component operation, maintenance and design which might cause these failures, an extensive review of component failure information was performed to identify and rank the root causes of these component failures. Both Davis-Besse and industry-wide failure information was analyzed. Failure causes were sorted on the basis of frequency of occurrence and seriousness of consequence, and categorized as common cause failures, human errors, design problems, or component failures.

This information is presented in the body of this document. Section 3.0 provides brief descriptions of these risk-important failure causes, and Section 5.0 presents more extensive discussions, with specific examples and references. The entries in the two sections are cross-referenced.

i An abbreviated system walkdown table is presented in Section 3.2 w hich includes only components identified as risk important. This table lists the system lineup for normal, standby system operation.

i This information permits an inspector to concentrate on components important to the prevention of core damage.

However, it is important to note that inspections should not focus exclusively on these comporents. Other components w hich perform essential functions, but which are not included because of high reliability or redundancy, must also be addressed to ensure that degradation does not increase their failure probabilities, and hence their risk importances.

i

]

i vii NUREG/CR-5829

i 4

I Acknowledgments The authors wish to thank Ken Filar. Eugene Matranga George Honma Jeff Blay, with special thanks to Cindy Blay and Scott Schuerman all of the Toledo Edison Company for reviewing and validating this document. Their input to sections 2, 3, and 4 make this report a more useful inspection tool. Their cooperation is greatly appreciated.

l t

l l

t l

t i

i a

/

i ix NU' REG /CR-5829 I

i 1 Introduction i

l l

His document is one of a series providing plant-specific testing for inspection by observation, records resiew, j

inspection guidance for auxiliary feedwater (AFW) training obsenation, procedures review, or by obsena-

- I systems at pressurized water reactors (PWRs). His tion of the implementation of procedures. An AFW j

guidance is based on information from probabilistic risk system walkdown table identifying risk important compo-l assessments (PRAs) for similar PWRs, industry-wide nents and their lineup for normal, standby system operating experience with AFW systems, plant-specific operation is also provided.

AFW system descriptions, and plant-specific operating experience. It is not a detailed inspection plan, but rather he remainder of the document describes and discusses a compilation of AF%' system failure information which the information used in compiling this inspection guid-l has been screened for risk significance in terms of failure ance. Section 4.0 describes the risk importance informa-frequency and degradation of system performance. He tion which has been derived from PRAs and its sources.

result is a listing of failure events and their causes that are As review of that section will show, the failure events signiScant enough to warrant consideration in inspection identified in PRAs are rather broad (e.g., pump fails to planning at Davis-Besse.

start or run, valve fails closed). Section 5.0 addresses the l

specific failure causes which have been combined under Based on the results of the Davis-Besse IPE (Filar,1993),

these broad events.

?

the AFW System was identified as one of the important l

I systems in terms of preventing core-damage. %e AFW AFW system operating history was studied to identify the System plays a vital role in the removal of decay heat and various specific failures which have been aggregated into j

sensible heat from the RCS in the event MI'W is not the PRA failure events. Section 5.1 presents a summary available. AFW is important in transient initiated of Davis-Besse failure information, and Section 5.2 i

sequences as well as LOCAs, SGTRs and ATWS presents a review of industry-wide failure information.

sequences.

The industry-wide information was compiled from a variety of NRC sources, including AEOD analyses and This inspection guidance is presented in Section 3.0, reports, information notices, inspection and enforcement j

following a description of the Davis-Besse AFW system in bulletins, and generic letters, and from a variety of INPO j

Section 2.0. Section 3.0 identifies the risk important reports as well. Some Licensee Event Reports and i

system components by Davis-Besse identification number, NPRDS event descriptions were also reviewed. Finally, l

followed by brief descriptions of each of the various information was included from reports of NRC-sponsored i

potential failure causes of that component. Rese include.

studies of the effects of plant aging, which include i

specific human errors, design deficiencies, and hardware quantitative analyses of reported AFW system failures.

' l failures. He discussions also identify where common his industry-wide information was then combined with 4

cause failures have affected multiple, redundant compo-the plant-specific failure information to identify the j

nents. Rese brief discussions identify specific aspects of various root causes of the broad failure events used in system or component design, operation, maintenance, or PRAs, which are identiSed in Section 3.0.

t h

4 1

i t

t 1.1 NUREG/CR-5829 a

f

-&y p-++

yt

.,-p

.y

-i-c

-vp 7.

q..e y

i i

a 2 Davis-BeSSe AFW System This section presents an overview of the Davis-Besse continuous recirculation flow and TDAFW bearing l

AFW system, including a simplified schematic system cooling sptem, which prevents pump deadheading and j

diagram. In addition, the system success criterion, system bearing overheating. Se:Tice Water valves (SW 9 and dependencies, and administrative operational constraints SW 10) may be manually aligned for backup TDAFW i

are also presented. It should be noted that this inspection pump bearing cooling.

guide is limited to the components associated with the AFW System and its suction sources. As such, it does not ne system is designed to start up, establish, and control include components associated with the Steam and SG level automatically. He MDFW pump must be i

Feedwater Rupture Control System (SFRCS) which manually started. Both TDAFW pumps will start upon provides for automatic initiation of AFW.

any of the following conditions and initiate auxiliary feedwater flow:

Either SG level less than 23.5" as indicated on startup _

1

2.1 System Description

range instrumentation.

The AFW system consists of two turbine (TDAFW) and less of au four RCPs.

~

a one motor driven (MDFW) pump which is used in the event that both TDAFW pumps are not available. He AFW system provides feedwater to the steam generators Either SG pressure 177 psig greater than main l

(SG) to allow secondarj-side heat remoul when main feedwater pressure.

feedwater is not available and to promote natural circula-tion of the Reactor Coolant System (RCS) in the event of Either SG pressure less than 620 psig.

a a loss of all four reactor coolant pumps. He system is capable of functioning for extended periods during a total pligh SG level of 240" on startup range mstrumentation.

loss of offsi:e power or a loss of the main feedwater system. This allows time to restore offsite power or main feedwater flow or to proceed with an orderly cooldown of Each TDAFW pump discharges through check valves to r both SGs. He TDAFW pumps are normally ne the plant to the point where the decay heat removal system (DliR) can remove decay heat. Simplified schematie's of aligned to supply their respective SG, however, depending the Davis-Besse AFW system and TDAFW pumps steam up n plant conditions, pump isolation valves and cross c nnect valves (AF 3869. AF 3870, AF 3871, and AF supply are shown in Figures 2.1 and 2.2, respectively.

3872) can be manually realigned to feed both SGs with The AFW system consists of two turbine-driven pumps either TDAFW pump or to feed each SG with the opposite (TDAFW), a motor-driven feed pump (MDFW) that TDAFW pump. The AFW line for both SGs is equipped with a flow element, flow transmitter, and a flow control provides feedwater to the steam generators if both turbine driven pumps are unavailable, two Condensate Storage valve that controls AFW flow at a predetermined SG I'**I-Tanks (CSTs), and associated piping, valves and instru-mentation. Feedwater is supplied to the TDAFW and MDFW pumps from the CSTs through a common suction The #1 Main Steam line supplies both the #1/#2 TDAFW header. The TDAFW and MDFW pumps are capable of pumps via MS 106/107A. The #2 MS Line supplies both supplying either steam generator. Steam is supplied to the #2/#1 TDAFW pumps via MS 107/106A. Norrnally both TDAFW turbines from either SG or the auxiliary MS 106A and MS 107A are open and MS 106 and MS steam system, through automatically controlled motor 107 are closed. Depending on which Steam Feed and operated valves (MS 106,106A,107, and 107A) located Rupture Control System (SFRCS) trip occurs, both upstream of the main steam isolation valves. The TDAFW pumps can be supplied from both MS lines TDAFW and MDFW pumps are equipped with a simultaneously (MS 106,106A,107,107A all open) or 2.1 NUREG/CR-5829

Davis-Besse AFW System both TDAFW pumps can be supplied from either MS line train is aligned to feed it's respective SG and the feed-(MS106/107A open and MS 107/lO6A closed or MS water supply valves do not need to change position. On 106/107A closed and MS 107/106A open).

the steam supply side, oniy the TDAFW pump steam admission valves MS5889A & B need to open to com-In addition to dual, redundant steam supply and discharge mence turbine operation. Instrument Air is required for headers. power. control and instrumentation associated the Main Steam Admission valves (MS 5889A/#). MS i

with the two AFW system trains are independent from 5889A/5889B fail open on a loss of Instrument Air and each other.

start their respective TDAFW pump. Steam availability is required for the TDAFW pumps. He condensate storage The two condensate storage tanks are the normal source of tanks are the normal saction source for the AFW System.

water for the AFW system. The tanks are required to Service Water is avadable as an automatic backun suction store a sufficient quantity of demineralized water (250,00 source in the event the CSTs are not available. Room gallons) to maintain the reactor coolant system (RCS) at cooling is also provided to ensure continued equipment hot standby conditions for 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> and then to cool the operability.

RCS to 280* F, at which point the DHR system is put in service. The administratively controlled, locked open and locked closed valve configuration requires that one CST 2.4 Operational Constraints discharge valve (CD 167 or CD 168) be locked open to supply the AFW system. Backup AFW supply is When the reactor is in MODES 1, 2, or 3 (liot Standby automatically provided by the Service Water system (on a through Power Operation), Davis-Besse Technical low pressure condition of 2 psig for 10 seconds. Service Specifications require two independent TDAFW pumps i

Water valves, SW 1382/1383, will automatically open t and associated flow paths (steam and water) and the supply the respective pump). Additionally, the Fire MDFW pump and associated flow path to the AFW Protection system can be manually aligned to provide system to be OPERABLE. If one train of AFW or the backup supply to the AFW system.

MDFW pump or flow path becomes inoperable, it must be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the unit must be placed in hot shutdown within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

2.2 Success Criterion With any TDAFW Inlet Steam Pressure Interlocks inoper-able, the interlocks must be returned to OPERABLE Both TDAFW pumps and the MDFW are full capacity status within 7 days or the unit must be in hot shutdown auxiliary feedwater putnps capable of supplying feedwater within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

to either SG. As such, system success requires operation of one pump, supplying a minimum of 600 gpm, to one of Davis-Besse Technical Specifications require the conden-the two steam generators within 40 seconds following a sate storage facilities (CST) to be operable with a mini-l loss of main feedwater.

mum contained water volume of at least 250,000 gallons.

l l

2.3 System Dependencies with the condensate storage facilities inoperable. within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> either the condensate storage facilities are to be returned to OPERABLE status or the service water system The AFW system depends on AC and DC power at vari.

is to be demonstrated to be OPERABLE as a backup sup-ous voltage levels for TDAFW turbine governors, the P y to the AFW system and the condensate storage facili-l MDFW pump, motor operated valve control circuits, sole.

ties are to be returned to OPERABLE status within 7 days noid valves, and monitor and alarm circuits. He normal AFW system configuration is such that each AFW or place the tmit in hot shutdown within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

I t

l NUREG/CR-5829 2.2 k

i

m M AF 39 AF 72 M AFg Q

AF 17 I

,X

--I t b X

ll To CST y

AF rA8 AF 3870 0

S AF 19 TDAFW 1-1 PS S

Y r,

k

)%

G Ac 73 AF 3969 AF 6452 Jf m

](AF 21 d

0 0

fL d'F SW 5 M

i SW 1382 i

i To CST H [

'[

I SW9 M 'd

!J co m

M AF 43 VAF 22 g

Sw to 170 y

jZ

[AF 74 ylp T

c

^

S I383 O

H FEE T

AF 3871 S

SW 6 PROT M

s AF20 o

p PS Es7 M

)

T

~

1 -2 cst h

AF 6451 4

11 AF 75 y FW 790 TDAFW 1-2 g

CD AF 49 AFS2 l

><}->To CST 2

CST AF 3872 AF 10 AF 18 AF 59 FW 6397 Y6398 Frp SWS

{MS FW87 FW ea

)(FP 91 Z

FW 6460 s FW 6459 F

y W

y FW 6325 A SW 6?91 y.

FW 1008 X

MDFP FW 1000

)[SW 6892 FW 6393 3

FW 6396 e

X M

To MFW g

f*>

b c

a

'En B

Figure 2.1 Davis-Hesse ainiliary feedwater system

y9gb0 gv.L l

i 2

b B

A 8

9S@

3 3

SC C

I I

C D

8 9

D"S m

3 3

S 0

C C

3 2

A I

9 I

2h 1

0 9

9 S

3 8

S M

a le 45 8

M S

1 1

"S 1

S

'0 0

0 1

M 3 9

M 1

01 7

7 10 0

l 1

,1 0

3 2

,S S

S :

M S

S S

M M

M M

M

(

(

)

)

O 3,

m g

3 e

S7 t

A2 s

XM y

0 UT W

A1 s

1 AS hI 1

}

1 m

S A

S C

6 C

a 0

I e

I A

1 t

7 s

0 S

1 M

re S

r

[

4 8

n t

M a

3 2

w 7

d S

e s

h M

e m

f yra i

9 x

(

l ph i

(

x h) u A

6 7

0 0

2 1

1 2

S S

M M

eru ig F

l 3

J 3G 11 0

2 1

r L

PA yCc; s4O<

i. i i

3 Inspection Guidance for the Davis-Besse AFW System In this section the risk important components of the Davis-3.1.1 Multiple Pump Failures due to Hesse AFW system are identified, and the important fail ~

Common Cause ute modes for these components are briefly described.

?

Risk important components are defined as those compon-The followine listing summarizes the most important ents whose function is important with respect to successful multiple-pump failure modes identified in Section 5.2.1,

~

operation of the AFW System. These failure modes in-Common Cause Failures, and each item is keyed to l

clude specific human errors, design deficiencies, and entries in that section.

types of hardware failures which have been observed to occur for these compcnents, both at Davis-Besse and at Incorrect operator intervention into automatic system PWRs throughout the nuclear industry. The discussions functioning, including improper manual starting and also identify w here common cause failures have affected securing of pumps, has caused failure of all pumps, multiple, redundant components. These brief discussions includine overspeed trip on startup, and inability to identify specific aspects of system or component design, restart prematurely secured pumps. At Davis desse,

~

operation, maintenance, or testing for observation

• control switch mispositioninghas caused both of the records review, training observation, procedures review, TDAFW pumps to trip on overspeed. CC1.

or by observation of the implementation of procedures.

inspeaion Suggestion - Observe Abnormal and Emer-Table 3.1 is an abbreviated AFW system walkdown table gency Operating Procedure (AOP/EOP) simulator which identifies risk-important components. This table training exercises to verify that the operators comply lists the system lineup for normal (standby) system opera-with procedures during observed evolutions. Observe tion. Inspection of the identified components addresses surveillance testing on the AFW system to verify it is essentially all of the risk associated with AFW system in strict compliance with the surveillance test pualmn.

procedure.

l i

Valve mispositioninghas caused failure of all pumps.

3.1 Risk Important AFW Components pump suction, steam supply, and instrument isolation and Failure Modes valves have been involved. CC2.

Common cause failures of multiple pumps are the most Inycaion Suggestion - Verify that the system va ve risk-important failure modes of AFW system components.

alignment, air operated valve control and valve actu-These are follcnved in importance by single pump failures, ating air pressures are correct using 3.1 Walkdown level control valve failures, and ind'ividual check valve Table, the system operating procedures, and operator leakage failures.

rounds logsheet. Review surveillance procedures that alter the standby alignment of the AFW system.

The following sections address each of these failure Ensure that an adequate return to normal section exists.

modes, in decreasing order of risk-importance. 'Ihey present the important root causes of these component failure modes which have been distilled from historical Steam binding has caused failure of multiple pumps.

records. Each item is keyed to discussions in Section 5.2 This resulted from leakage of hot feedwater past where additional information on historical events is check valves into a common discharge header, with j

several valves involved including a motor-operated presented.

3.1 NUREG/CR-5829 l

i

Inspection Guidance discharge valve. (See item 3.1.8 below.) CClo.

Simultaneous startup of multiple pumps has caused Multiple-pump steam binding has also resulted from oscillations of pump suction pressure causing 1

improper valve lineups, and from running a pump multiple-pump trips on low suction pressure, despite deadheaded. CC3.

the existence of adequate static net positive suction head (NPSH). CC7. Design reviews have identified Inspeaion Suggestion - Verify that the pump inadequately sized suction piping which could have discharge temperature is within the limits specified on yielded insufficient NPSH to support operation of the operator rounds logsheet (< 100*F). Assure any more than one pump. CC8.

instruments used to verif;v the temperature by the utility are of an appropriate range and included in a Inspecion Suggestion - Assure that plant conditions calibration program. Verify affected pumps have which could result in the blockage or degradation of been vented every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to ensure steam binding the suction flow path are addressed by system has not occurred. Verify that a maintenance work maintenance and test procedures. Examples include, request has been written to repair leaking check if the AFW system has an emergency source from a valves.

water system with the potential for bio-fouling, then the system should be periodically treated to prevent Pump control circuit deficiencies or design buildup and routinely tested to assure an adequate modification errors have caused failures of multiple flow can be achieved to support operation of all pumps to auto start, spurious pump trips during pumps, or inspected to assure that bio-fouling is not operation, and failures to restart after pump occurring. Design changes that affect the suction shutdown, CC4. Incorrect setpoints and control flow path should repeat testing that $

fied an ade-circuit calibrations have also prevented proper quate suction source for simultaneo,.s operation of all operation of multiple pumps. CC5.

pumps. Verify that testing has, at sometime, demon-strated simultaneous operation of all pumps. Verify Inspection Suggestion - Review design change that surveillances adequately test all aspects of the implementation documents for the post maintenance system design functions, for example, demonstrate testing required prior to returning the equipment to that the AFW pumps will trip on low suction service. Assure the testing veri 6es that all potentially pressure.

i impacted functions operate correctly, and includes repeating any plant start-up or hot functional testing 3.1.2 Turbine Drisen Ptunp Fails to Start or that may be affected by the design change, Run 1.oss of a vital power bus has failed both the turbine-e Improperly adjusted and inadequately maintained

{

driven and one motor-driven pump due to loss of turbine governors have caused purnp failures. HE2.

control power to steam admission valves or to turbine Problems include worn or loosened nuts, set screws, I

controls, and to motor controls powered from the linkages or cable connections, oil leaks and/or same bus. CC6.

contamination, and electrical failures of resistors, transistors, diodes and circuit cards, and erroneous In3pection Suggestion - The material condition of the grounds and connections CF5. Improperly adjusted electrical equipment is an indicator of probable governors have occurred at Davis-Besse.

reliability. Review the Preventative Maintenance (PM) records to assure the equipment is maintained Inspection Suggestion - Review PM records to assure on an appropriate frequency for the environment it is theI overnor oilis being replaced within the desig-g in and that the PM's are actually being performed as nated frequency. During plant walkdowns carefully j

required by the program. Review the outstanding inspect the governor and linkages for loose fasteners.

Corrective Maintenance records to assure the leaks, and unsecured or degraded conduit.

deficiencies found on the equipment are promptly corrected.

NUREG/CR-5829 3.2

l t

Inspection Guidance i

)

Review vendor manuals to ensure Ph1 procedures are overspeed trip operation. Review training procedures to performed according to manufacturer's recommendations ensure operator training on resetting the TTV is current.

and good maintenance practices.

Turbines with Woodward hiodel PG-PL governors Terry turbines with Woodward hiodel EG governors have tripped on overspeed when restarted shortly after have been found to overspeed trip if full stearn flow is shutdown, unless an operator has locally exercised the allowed on startup. Sensitivity can be reduced if a speed setting knob to drain oil from the governor startup steam bypass valve is sequenced to open first.

speed setting cylinder (per procedure). Automatic oil Davis-Besse AFW pump turbines use Woodward dump valves are now available through Terry. Davis-model PGG governors. del.

Besse AFW pump turbines use Woodward model PGG governors. DE4.

Inspection Suggestion - Observe the operation of the TDAFW pump and assure that the governor is reset Inspection Suggestion - Observe the operation of the as directed in DB-OP-06233, " Auxiliary Feedwater TDAFW pump and assure that the governor is reset System" as directed in DB-OP-06233, " Auxiliary Feedwater System".

Condensate slugs in steam lines have caused turbine Stress corrosion cracking caused failure of the overspeed trip on startup. Tests repeated right after such a trip may fail to indicate the problem due to turbir e-driven pump, allowing the final stage shaft warming and clearing of the steam lines. Surveillance sleeve to rub and eventually become friction welded should exercise all steam supply connections. DE2.

to the stationary final stage piece of the pump.

(

Inspeaion Suggestion - Verify that the steam traps are 3.1.3 Motor Driven Pump Fails to Start or valved in on the steam supply line. For steam traps Run that are on a pressurized portion of the steam line, check the steam trap temperature (if unlagged) t Control circuits used for automatic and manual pump assure it is warmer than ambient (otherwise it may be starting are an important cause of motor driven pump stuck or have a plugged line). If the steam trap dis-failures, as are circuit breaker failures. CF7.

charge is visible, assure there is evidence of liquid discharge.

Inspection Suggestion - Review corrective i

maintenance records when control circuit problems Trip and throttle valve (TTV) problems which have occur to determine if a trend exists. Every time a failed the turbine driven pump include physically breaker is racked in a Ph1T should be performed to bumping it, failure to reset it following testing, and start the pump, assuring no control circuit problems failures to verify control room indication of reset.

have occurred as a result of the manipulation of the HE2. Whether either the overspeed trip or TTV trip breaker. (Control circuit stabs have to make up upon can be reset without resetting the other, indication in racking the breaker, as well as cell switch damace can the control room of TTV position, and unambiguous occur upon removal and reinstallation of the bre$ker.)

local indication of an overspeed trip affect the likelihood of these errors. DE3*

hiispositioning of handswitches and procedural i

=

deficiencies have prevented automatic pump start.

Inspection Suggestion - Carefully inspect the TTV

yg3, j

overspeed trip linkage and assure it is reset and in good physical condition. Assure that there is a good Inspeerion Suggestion - Confirm switch position using steam isolation to the turbine, otherwise continued Table 3.1. Review ministrative procedures turbine high temperature can result in degradation of concerning documentation of procedural deficiencies.

the oil in the turbine, interfering with proper Ensure operator training on procedural changes is -

l current.

3.3 NUREG/CR-5829

l Inspection Guidance Low lubrication oil pressure resulting from heatup tacts, misaligned or broken limit switches, control due to previous operation has prevented pump restart power loss, degraded solenoid valves, and calibration due to failure to satisfy the protective interlock. DES.

problems. Degraded operation has also resulted from improper air pressure due to the wrong type of air Inspeaion Suggestion - low oil pressure is a trip that regulator being installed or leaking air lines.

is in service at all times for the metor driven AFW pump. Normally the low oil pressure occurs at Inspection Suggestion - Check for control air system approximately 1400 rpm and serves to protect the alignment and air leaks during plant walkdowns.

pump from low R PM operation, however low oil (Regulators may have a small amount of external pressure due to a plugged filter will also cause a trip.

bleed to maintain downstream pressure.) Check for Review PM records to assure the filter is replaced on cleanliness and physical condition of visible circuit the designated frequency.

elements. Review valve stroke time surveillance for adverse trends, especially those valves on reduced 3.1.4 Pump Unavailable Due to Maintenance testing frequency. Review rir system surveillances l

or Surveillance moisture content of air i ain established limits.

t Both scheduled and unscheduled maintenance remove In dequate air pressure regulation has resulted in con-1

=

pumps from operability. Surveillance requires trol valve failure to operate.

operation with an altered line-up, although a pump train may not be declared inoperable during testing.

InSPeaion Suggestion - Covered by 3.1.5 bullet 1.

f Prompt scheduling and perfc,rmance of maintenance and surveillance minimize this unavailability.

leakage of hot feedwater through check valves has

=

caused thermal binding of normally closed flow

{

c ntrol MOVs. AOVs may be similarly susceptible.

l Inspection Suggestion - Review the time the AFW CF2

[

system and components are inoperable. Assure all maintenance is being performed that can be per-formed during a single outage time frame, avoiding Ingeaion Suggestion - Verify Table 3.1 check valve

{

multiple equipment outages. The maintenance should P2Pmg is cool.

r be scheduled before the routine surveillance test, so credit can be taken for both post maintenance testing 3.1.6 Motor Operated Valves Fail Closed and surveillance testing, avoiding excessive testing.

Review surveillance schedule for frequency and TDAFW Pumt Discharce Isolation: AF 3870. 3872 c

adequacy to verify system operability requirements SG Isolation valves: AF 599. 608 per Technical Specifications.

TDAFW Pumn Discharee Cross-connect valves: AF 3869.3871 j

Service Water suetion Isolation: SW 1382.1383 3.1.5 Air Operated Valves Fail to Open Steam Supply Isolation Valves: MS 106.106A.107.

I TDAFW Steam Admission valves: MS 5889A.

107A

{

5889B The SG Isolation valves (AF 599, AF 608) are normally l

These normally closed air operated valves (AOVs) Admit I cked open with control power removed and are used to steam to the TDAFW turbine. They fail open on loss of is late AFW to the SGs. The TDAFW Pump Discharge Instrument Air.

Isolation valves (AF 3870,3872) are open and aligned to feed their respective SG. The TDAFW pump discharge Control circuit problems have been a primary cause cross-connect valves (AF 3869. AF 3871) are closed and i

~

of failures. CF9. Valve failures have resulted from realign with a faulted SG. The Service Water Isolation blown fuses, failure of control components (such as valves (SW 1382, SW 1383) are normally closed valves.

current / pneumatic convertors), broken or dirty con-NUREG/CR.5829 3.4 I

i

Inspection Guidance Two of the Steam Supply Isolation valves (MS106,107)

Grease trapped in the torque switch spring pack of the are normally closed, MS 106A and 107A are normally operators of MOVs has caused motor burnout or open.

thermal overload trip by preventing torque switch actuation. CF8.

Common cause failure of MOVs has occurred at Davis-Besse and elsewhere, from failure to use In3peaion Suggestion - Review this only if the MOV 3

electrical signature tracing equipment to determine testing program reveals deficiencies in this area.

l proper settings of torque switch and torque switch bypass switches. Failure to calibrate switch settings Manually reversing the direction of motion of for high torques necessary under design basis accident operating MOVs has overloaded the motor circuit.

conditions has also been involved. Davis-Besse tests Operating procedures should provide cautions, and with the Valve Operation and Test Evaluation System circuit designs may prevent reversal before each (VOTES). CCI1.

stroke is finished. DE7.

In3pecion Suggestion - Review the MOV test records inspraion Suggestion - Review operating procedures to assure the testing and settings are based on and operator performance of valve positioning.

dynamic system conditions. Overtorquing of the Space heaters designed for preoperation storage have valve operator can result in valve damage such as cracking of the seat or disc. Review the program to been found wired in parallel with valve motors which assure overtorquing is identified and corrective ac-had not been environmentally qualified with them tions are taken to assure valve operability following present. DES.

an overtorque condition. Review the program to assure EQ seals are renewed as required during the Inspection Suggestion - Spot check MOV's during l

restoration from testing to maintain the EQ rating of MOV testing to assure the space heaters are the MOV.

physically removed or disconnected.

Valve motors have been failed due to lack of, or Multiple flow control valves have been plugged improper sizing or use, of thermal overload protective by clams when suction switched automatically to devices. Bypassing and oversizing should be based an alternate, untreated source. CC9.

l on proper engineering for design basis conditions.

j CF4.

Inspection Suggestion - Assure that plant conditions i

which could result in the blockage or degradation of Inspecion Suggestion - Review the administrative the suction flow path are addressed by system controls for documenting and changing the settings of maintenance and test procedures. Examples include, thermal overload protective devices. Assure the if the AFW system has an emergency source from a information is available to the maintenance planners.

water system with the potential for bio-fouling, then the system should be periodically treated to prevent Out-of-adjustment electrical flow controllers have buildup and routinely tested to assure an adequate caused improper discharge valve operation, affecting flow can be achieved to support operation of all multiple trains of AFW. CCl2.

pumps, or inspected to assure that bio-fouling is not occurring. Design changes that affect the suction Inspraion Suggestion - Review PM frequency and flow path should repea' testing that verified an ade-records, only upon a trend of failure of the quate suction source for simultaneous operation of all controllers.

pumps. Verify that testing has, at sometime, demon-strated simultaneous operation of all pumps. Verify i

P 4

3.5 NUREG/CR-5829 Y

Inspection Guidanec i

that surveillances adequately test all aspects of the system Inspection Suggestion - Check for control air system design functions, for example, demonstrate that the AFW alignment and air leaks during plant walkdowns.

pumps will trip on low suction pressure.

(Regulators may have a small amount of external bleed to maintain downstream pressure.) Check for 3.1.7 Solenoid Operated Valves Fail to cleanliness and physical condition of visible circuit J

elements. Review valve stroke time surveillance for j

Operate adverse trends, especially those valves on reduced TDAFW Flow Control valves: AF 6451. 6452 testing frequency. Review air system surveillances moisture content of air is within established limits.

MDFW Pump mwr Control valves AF 6459. 6460 The TDAFW Flow Control valves (AF 6451, AF 6452, improper lubrication has resulted in many SOV

=

AF 6459,6460) control SG level. AF 6451 and AF 6452 failures. Errors include the wrong choice of lubricant, unauthorized use ofincorrect lubricant, and are normally failed open with control power removed.

use f excessive amounts oflubricant.

AF 6459 and 6460 are normally in Manual at 0%

Demand.

Inspc-tion Suggestion - Review maintenance records Common cause failures hase resulted from subjecting and practices for correct use of and application of lubricants.

SOVs to ambient temperatures in excess of their original desien envelope. Failures have occurred be-cause the estimated service lives did not properly in-3.1.8 Manual Suction or Discharge Valves clude the life-shortening effects of heatup resulting Fail Closed from continuous coil energization. DE9.

TDAFW Pump Train 1 & 2: FW 786. 790. CD 170 The following failure modes are from NUREG 1250.

167.168: AF 59 They have not been uniquely identified to AFW systems.

MDFW Pumir FW 6393. CD 167,168: FW 1008.

6397. 6348. FW 6306 Operating pressure differentials that could or did prevent SOVs from operating have been found.

These manual valves are normally locked open. For each I

train, closure of the first valves would block pump suction SOVs have spuriously opened due to high back-and closure of the second valves would block pump pressure, due to the directional requirements of the discharge (FW 6396 and AF 59 are minimum flow SOVs.

recirculation valves). The CST Suction Isolation valves (FW 786 and FW 790) are MOVs which are presently SOVS used in safety-related equipment are not given stem locked open with control and operating power prominent attention because that are used as removed.

i pieceparts oflarger equipment. Specific preventive Valve mispositioning has resulted in failures of maintenance requirements are not readily available for them. SOV failures have occurred as a result of the multiple trains of AFW. CC2. It has also been the lack of maintenance or replacement of such dominant cause of problems identified during unrecognized SOVs.

operational readiness inspections. HEl. Events have occurred most often during maintenance, calibration, l'

Inspection Suggestion - Review preventative or system modifications. Important causes of maintenance records to verify piecepart SOVs are mispositioninginclude:

included in the Preventative Maintenance program.

Failure to provide complete, clear, and specific SOV contamination resulting from particulates, procedures for tasks and system restoration i

moisture, and hydrocarbons in the instrument air system have been a source of SOV failures.

l NUREGICR-5829 3.6 1

4

Inspection Guidance

• Failure to promptly revise and validate procedures, in series with check valves has also occurred, as would be training, and diagrams following system modifications required for leakage to reach the motor driven or turbine driven pumps. CCIO Failure to complete all steps in a procedure Insperrion Suggestion - Covered by 3.1.1 bullet 3 Failure to adequately review uncompleted procedural Slow leakage past the final check valve of a series steps after task completion may not force upstream check valves closed, allowing leakage past each of them in turn. Piping orientation Failure to verify support functions after and valve design are imponant factors in achieving restoration true series protection. CF1.

Failure to adhere scrupulously to administrative Inspection Suggestion - Covered by 3.1.1 bullet 3.

procedures regarding tagging, control and tracking of valve operations i

3.2 Risk Important AFW System Failure to log the manipulation of sealed valves Failure to follow good practices of written task assignment and feedback of task completion Table 3.1 presents an AFW system walkdown table information including only components identi6ed as risk important.

This information allows inspectors to concentrate their Failure to provide easily read system drawings, eff rts on components important to prevention of core legible valve labels corresponding to drawines damage. However, it is essential to note that inspections and procedures, and labeled indications of ly should not focus exclusively on these components. Other

]

valve position c mponents which perform essential functions, must also l

be addressed to ensure that their risk importances are not l

Inspection Suggestion - Review the administrative increased. An example includes verifying an adequate

{

water level exists in the CST.

I controls that relate to valve positioning and sealing, system restoration following maintenance, valve labeling, system drawing updating, and procedure revision, for proper implementation.

3.1.9 Leakage ofIlot Feedwater through Check Valves MDFW Pump Trains: AF 43. 39 TDAFW Pump Train 1: AF 19. 39 TDAFW Pump Train 2: AF 20. 43 Leakage of hot feedwater through several check valves in series has caused steam binding of multiple pumps. Leakage through a closed level control valve 1

l 1

I l

1 3.7 NUREG/CR-5829

'l Inspection Guidance i

i

)

Table 3.1, Risk importance AFW system walkdown table for Davis-Besse AFW system components Component #

Component Name Required Position Actual i

Electrical i

Motor-Driven Pump Racked in/ Closed Control Room Valves AF 6451 TDAFW pump 2 level Control valve Auto AF 6452 TDAFW pump 1 level Control valve Auto AF 3869 TDAFW pump 1 Disch to SG 2 Stop Valve Closed l

AF 3870 TDAFW pump 1 Disch to SG 1 Stop Valve Open l

AF 3871 TDAFW pump 2 Disch to SG 1 Stop Valve Closed I

AF 3872 TDAWF pump 2 Disch to SG 2 Stop Valve Open MS 106 MS Line I to TDAFW pump 1 Isolation Closed

[

MS 106A MS Line 2 to TDAFW pump 1 Isolation Open

)

MS 107 MS Line 2 to TDAFW pump 2 Isolation Closed MS 107A MS Line 2 to TDAFW pump 2 Isolation Open MS 5889A Steam Admission valve to TDAFW pump 1 Closed MS 5889B Steam Admission valve to TDAFW pump 2 Closed i

+

- SW 1382 SW to TDAFW pump 1 Closed SW 1383 SW to TDAFW pump 2 Closed i

FW 6460 SG 2 MDFW Ievel Control Manual 0% Demand -

]

FW 6459 SG 1 MDFW Ievel Control Manual 0% Demand i

Control Room Yalves l

AF 599 AFW to SG 2 Line Stop valve Open AF 60S AFW to SG 1 Line Step valve Open l-NUREG/CR-5829 3.8 I

i

l i

Inspection Guidance s

Table 3.1. (Continued)

Component #

Component Name Required Position Actual Local Valve - Room 303 (51echanical Penetration 3)

AF 608 AFW to SG 1 Line Stop Valve Locked Open l

AF 39 SG 1 check valve Cool ( < 100 deg)

Local Valve - Room 314 (Mechanical Penetration 4)

AF 599 AFW to SG 2 Line Stop Valve Locked Open AF 43 SG 2 cbeck valve Cool ( < 100 deg)

Local Valves - Area 345 (CST)

CD 167 CST I to AFW and Startup Feed Pumps Locked Open*

CD 168 CST 2 to AFW and Startup Feed Pumps locked Open*

AF 59 TDAFW Recire to CST Ovediow locked Open Local Valves - Room 252 (TDAFW 1 Area)

CD 170 CSTs to Aux and Startup Feed Pumps Locked Open Isolation Local Valves - Room 238 (TDARY pump 2)

MS 728 TDAFW 2 Steam Inlet Header Cross Connect Locked Closed Isolation Valve AF 22 TDAFW pump 2 Recire isolation Locked Closed AF 10 TDAFW 2 Min Flow RO Inlet Isolation valve Locked Open FW 790 TDAFW pump 2 Suetion Isolation locked Open with Stem Lock ICS.

Trip Throttle valve for TDAFW pump 2 locked, Reset Open AF 18 TDAFW pump 2 Mini Flow RO Outlet Locked Open Isolation Valve 3.9 NUREG/CR-5829

i l

l i

Inspection Guidance j

1 Table 3.1. (Continued)

{

Component #

Component Name Required Position Actual AF 14 TDAFW pump 2 Normal Bearing Cooling lected Open Water Isolation j

AF 67 TDAFW pump 2 Cooling Water Supply locked Open i

t Control Room Vahes SW6 TDAFW pump 2 Service Water Supply locked Open f

i AF4 TDAFW pump 2 Cooling Water Return Line locked Open Valve AF8 TDAFW pump 2 Cooling Water locked One Turn Open AF 66 TDAFW pump 2 Gov Cooling Water Supply locked Open

[

IA 234 Air Bleedoff Valve for MS 5889B. Steam Locked Open

[

Admission Valve to TDAFW pump 2 AF 20 TDAFW pump 2 discharge check valve Cool (< 100 deg)

{

'f Local Valves - Room 237 (TDAFW pump 1)

AF9 TDAFW pump 1 Min Flow RO Inlet locked Open I

l AF 13 TDAFW pump I Normal Beanng Cooling locked Open l

Water Isolation i

AF 64 TDAFW pump 1 Cooling Water Supply locked Open AF 17 TDAFW pump 1 Min Flow RO Outlet Iso locked Open SW5 TDAFW pump 1 Service Water Supply Line locked Open l

Isolation Valve FW 786 TDAFW pump 1 Suction locked Open with Stem lock AF 21 TDAFW pump 1 Recire Stop Valve locked Closed AF7 TDAFW pump 1 Cooling Water Supply Locked Closed j

i AF3 TDAFW pump 1 Cooling Water Return locked Open NUREG/CR-5829 3.10

i Inspection Guidance I

f Table 3.1. (Continued)

Component #

Component Name Required Position Actual i

1 AF 65 TDAFW pump 1 Gov Cooling Supply Locked Open ICS 38C Trip Throttle valve for TDAFW pump 1 Latched, Reset, Open e

MS 733 TDAFW pump 1 Steam Inlet Header Cross Locked Closed l

Connect Isolation valve IA 233 Air Bleedoff Valve for MS 5889A. Steam lecked Open Admission to TDAFW pump 1 AF 19 TDAFW pump 1 discharge check valve Cool ( < 100 deg) l Turbine Building 585 ft. Elevation i

FW 87 MDFW pump Mini Recire to CST Throttle Iecked Open FW 88 MDFW pump Mini Recirc to CST Throttle locked Open Turbine Building 565 ft. Elevation FW 6393 MDFW pump CST suction isolation locked Open FW 1008 MDFW pump discharge isolation locked Open

- FW 6396 MDFW pump Recire stop valve locked Closed FW 6325 MDFW minimum flow Locked Throttled FW 6397 MDFW pump discharge isolation locked Open 3

FW 6398 MDFW pump discharge isolation locked Open FW 1017 AFW Line 2 to Flow Test Line Isolation locked Closed FW 1018 AFW Line I to Flow Test Line Isolation locked Closed 3.11 NUREG/CR-5829

I l

l l

4 Davis-Besse IPE and Generic Risk Insiglits from PRAs The uavis-Besse Individual Plant Exammation (IPE) safety-related de power (due to local bus faults or station (Filar,1993) and PRAs for 13 PWRs were analyzed to blackout scenarios with eventual depletion of the identify risk-important accident sequences involving loss batteries), in which the flow contiol valve (s) for AFW of AFW, to identify and risk-prioritize the component would fail open and have the potential to affect both failure modes involved. The results of this analysis are turbine-driven pumps due to carryover of water into the described in this section. They are consistent with results steam lines.

reported by INEL and BNL (Gregg et al 1988, and Travis et al,1988).

High transient initiating event frequencies also play a role making this an important sequence for Davis-Besse. While the initiating event frequency associated with the loss of 4.1 Davis-Besse IPE MFW is dominated try events occurring prior the June 1985 outage, the frequency is higher than most generic i

The Davis-Besse IPE indicates that approximately 869 of data sources. In these sequences, the demands on the the total core-damage frequency was assessed to be due to AFW System are heightened.. It should be noted that there sequences initiated by transients with the remainder has been a significant decline in the number of plant trips divided among loss-of coolant accidents, steani generator f 11 wing restart from the June 1985 outage. It is tube ruptures. and internal floods. The frequency of expected that this trend and resultant changes in initiating core-damace resulting from transients was determined to event frequencies willimprove the overall risk profile for Davis-Besse.

be due largely to two types of functional sequences. One of these sequences involves the loss of heat removal via the steam generators followed by failure of direct core cooling by injection from the makeup system (referred to 4.2 Risk Important Accident l

as makeup /HPI cooling). This ftmetional sequence would Sequences Involving AFW Systern entail a loss of main feedwater, either as an initiating Fa. lure i

event or as a consequence of another initiating event; all three of the pumps in the auxiliary feedwater system (two turbine-driven and one motor-driven) would have to be Loss of Power System unavailable to supply feedwater flow to the steam A 1 ss f ffsite n wer and main feedwater is generators; and finally, makeup /HPI cooling, which can be accomplished by various redundant pathways, would f 11 wed by failure of AFW. Due to lack of actuating have to fail. While this sequence is responsibIe for a Power, the power operated relief valves (PORVs) large fraction of the total core-damage frequency, an cannot be opened preventing adequate feed-and-bleed j

examination of the cut sets indicates that it is not c oling, and resulting in core damage.

dominated by one or a few initiating events, component faults or other plant features. Many different types of A stati n blackout fails all AC power except Vital AC minimal cut sets contribute to this functional sequence, fmm DC invertors, and all dec > beat removal sys-and no single or small number of plant features stands tems except the turbine-driven AFW pump. AFW subsequently fails due to battery depletion or hard-out.

ware failures, resulting in core damage.

Some of the more dominant failure modes of the AFW system include common cause failures of the turbine A DC bus fails, causing a trip and failure of the driven pumps to start or run, inadequate operator actions Power conversion system. One AFW motor-driven associated with starting the MDFW, maintenance pump is failed by the bus loss, and the turbine-driven unavailabilities and independent start and run faults Pump fails due to loss of turbine or valve control associated with the three pumps, and a loss of one train of power. AFW is subsequently lost complewly due to 4.1 NUREG/CR-5829 i

Risk Insights other failures. Ived-and-bleed cooling fails because listed below in decreasing order of risk importance.

PORV control is Icst, resulting in core damage.

(1) Turbine-Driven Pump Failure to Start or Run.

Transient-Caused Reactor or 7urbine Trip (2) Motor-Driven Pump Failure to Start or Run.

l (3) TDAFW pump or MDFW pump Unavailable due to A transient-caused trip is followed by a loss of the Test or Maintenance.

pow er conversion system (PCS), main feedwater, and (4) AFW System Valve Failures 4

AFW, Feed-and-bleed cooling fails either due to

]

failure of the operator to initiate it, or due to steam admission valves l

a hardware failures, resulting in core damage.

trip and throttle valves loss ofMain Feedwater flow control valves a

A feedwater line break drains the common water c

source for MFW and AFW. The operators fail to pump discharge valves provide feedwater from other sources, and fail to initiate feed-and-bleed cooling, resulting in core pump suction valves a

damage. At Davis-Besse, there is no common suction source for MFW and AFW. MFW takes suction valves in testing or maintenance.

from the DST while AFW takes suction from either the CST or the Service Water System.

(5) Supply / Suction Sources A loss of main feedwater trips the plant, and AFW condensate storage tank stop valve fails due to operator error and hardware failures. The operators fail to initiate feed-and-bleed cooling.

suction valves resulting in core damage.

In addition to individual hardware, circuit, or instrument Steam Generator Tube Rupture (SGTR) failures, each of these failure modes may result from conunon causes and human errors. Common cause I

A SGTR is followed by failure of AFW. Coolant is failures of AFW pumps are particularly risk important.

lost from the primary until the borated water storage Valve failures are somewhat less important due to the tank (BWST)is depleted. High pressure injection multiplicity of steam generators and connection paths.

(HPI) fails since recirculation cannot be established Human errors of greatest risk importance involve:

from the empty sump, and core damage results.

failures to initiate or control system operation when required; failure to restore proper system lineup after maintenance or testing; and failure to switch to altemate 4.3 Risk Important Coniponent sources when required.

Failure Modes The generic component failure modes identified from PRA analyses as important to AFW system failure are NUREG/CR-5829 4.2

5 Failure Modes Determined from Operating Experience This section describes the primary root cause of AFW after a loss of all main feedwater, this caused both system component failures, as determined from a review TDAFW pumps to trip on overspeed.

i l

of operating histories at Davis-Besse and at other PWRs l

throughout the nuclear industry. Section 5.1 describes 5.1.2 Motor Driven Pump Failures experience at Davis-Besse. Section 5.2 summarizes information compiled from a variety of NRC sources, There have been two events of motor-driven pump failure i

including AEOD analyses and reports, information since 1987. One resulted in tripping the MDFW pump notices, inspection and enforcement bulletins, and generic breaker. 'Ihe failure was caused by dirty contacts. The letters, and from a variety ofINPO reports as well. Some other event required the MDFW pump to be rebuilt afte' Licensee Event Reports and NPRDS event descriptions it had run without a suction source due to a procedural were also reviewed individually. Finally, information was inadequacy.

included from reports of NRC-sponsored studies of the effects of plant aging, which include quantitative analysis 5.1.3 Turbine Driven Pump Failures of AFW system failure reports. This information was used to identify the various root causes expected for the More than forty events have occurred since 1977 that have broad PRA-based failure events identified in Section 4.0, resulted in decreased operational readiness of the AFW resulting in the inspection guidelines presented in system. Failure modes involved failures in power fases, Section 3.0.

instrumentation and control circuits, pump hardware failures. turbine hardware failures, mechanical wear, design deficiencies, procedural deficiencies, and human 5.1 Davis-Besse Experience failures during maintenance activities. Improper or inade-quate maintenance has resulted in improper adjustment of The AFW system at Davis-Besse has experienced failures a governor slip clutch, and high outboard bearing of the AFW pumps and pump governors, pump discharge temperatures which have required pump shutdown and isolation valves, turbine trip and throttle valves, and repair.

system check valves. Failure modes include electrical, instrumentation and control, hardware failures, and 5.1.4 Flow Control and Isolation Valve human errors. It should be noted that substantial changes Failures to plant systems and procedures were made as a result of the concerted response to the 1985 loss-of-feedwater Approximately sixty-three events since 1977 have resulted event. During the 18 months in which the plant was in impaired operational readiness of the motor operated shutdown, numerous hardware modifications were isolation valves. Principal failure causes were equipment implemented, new procedures were developed, and testing wear, corrosion, instrumentation and control circuit and maintenance programs were enhanced. Changes were failures, manufacturer defects, valve hardware failures, aimed at improving system performance and availability.

inadequate test procedures which did not account for As such, many of the failures associated with the system differential pressure across valves, and human errors.

before that time period no longer apply.

Valves have failed to operate properly due to failure of control components, broken or dirty contacts, limit switch 5.1.1 Multiple Ptunp Failures bypass contacts opening. misaligned or broken limit switches, dirty and improperly lubricated valve stems, There has been an incidence of an operator actuating torque switch settings, and calibration problems. Human SFRCS on low steam pressure instead of low SG level 5.1 NUREG/CR-5829

i k

Failure Modes i

errors have resulted in improper control circuit repairs.

and component failures have been less frequent, but limit switch adjustment, and installation of the wrong type nevertheless significant, causes of multiple train failures.

l of air pressure regulator.

CC1. Human error in the form of incorrect operator 5.1.5 Check Valve Failures intervention into automatic AFW system functioning during transients resulted in the temporary loss of all Two events of check valve failure have occurred since safety-grade AFW pumps during events at Davis Besse 1977. The failure mode cited was normal wear and (NUREG-1154,1985) and Trojan (AEOD/T416,1983).

f aging, dirty components, and improper or inadequate In the Davis Besse event, improper manual initiation of maintenance.

the steam and feedwater rupture control system (SFRCS) led to overspeed tripping of both turbine-driven AFW

[

5.1.6 Iluman Errors Pumps, probably due to the introduction of condensate into the AFW turbines from the long, unheated steam There have been approximately seven events affecting the Supply lines. (The system had never been tested with the AFW system since 1977. The most serious of these abnormal, cross-connected steam supply lineup which caused multiple pump failures as discussed in Section resulted.) la the Trojan event the operator incorrectly 5.1.1. Personnel have overpressurized a SG while in a stopped both AFW pumps due to misinterpretation of wet layup condition, mispositioned locked valves, MFW pump speed indication. The diesel driven pump reversed electrical leads, inadvertemly tripped a pump w uld not restart due to a protective feature requiring during maintenance, tripped power supplies to flow complete shutdown, and the turbine-driven pump tripped verspeed, requiring local reset of the trip and throttle n

transmitters, and mispositioned control switches during operation. Both personnel error and inadequate valve. In cases ubere manual intervention is required I

~

procedures have been involved.

dun the early stages of a transient, training should emphasize ti:at actions should be performed methodically _

and delibera'ely to guard against such errors.

5.2 Industry Wide Experience 1

CC,.. Valve misposit.tomng has accounted for a significant fraction of the human errors failing multiple Human errors, design / engineering problems and errors, trains of AFW. This includes closure of normally open and component failures are the primary root causes of suction valves or steam supply valves,and ofisolation AFW System failures identified in a review of industry valves to sensors having control functions. Incorrect wide system operating history. Common cause failures, handswitch positioning and inadequate temporary wiring which disable more than one train of this operationally changes have also prevented automatic starts of multiple l

redundant system, are highly risk significant, and can pumps. Factors identified in studies of mispositioning result from all of these causes.

errors include failure to add newly installed valves to valve checklists, weak administrative control of tagging, This section identifies important common cause failure restoration, independent verification, and locked valve modes, and then provides a broader discussion of the logging, and inadequate adherence to procedures.

single failure effects of human errors, design / engineering Illegible or confusine local valve labeling, and insufficient problems and errors, and component failures. Paragraphs training m the deterrnination of valve position may cause presenting details of these failure modes are coded (e.g.,

or mask mispositioning, and surveillance which does not CCl) and cross-referenced by inspection items in Section exercise complete system functioning may not reveal 3-mispositionings.

5.2.1 Common Cause Failures

. CC3. At ANO-2, both AFW pumps lost suction due to steam binding when they were lined up to both the CST The dominant cause of AFW system multiple-train and the hot startup/ blowdown demineralizer effluent failures has been human error. Design / engineering errors (AEOD/C404,1984). At Zion-1 steam created by NUREGICR-5829 5.2

.. - -. - ~ - -,

I Failure Modes t

running the turbine-driven pump deadheaded for one CC8. Design errors discovered during AFW system minute caused trip of a motor-driven pump sharing the reanalysis at the Robinson plant (IN 89-30,1989) and at same inlet header, as well as damage to the turbine-driven Millstone-1 resulted in the supply header from the CST l

pump (Region 3 Mon,ing Report,1/17/90). Both events being too small to provide adequate NPSH to the pumps if l

were carsed by proceduralinadequacies.

more than one of the three pumps were operating at rated.

flow conditions. This could lead to multiple pump failure i

CC4. Design / engineering errors have accounted for a due to cavitation Subsequent reviews at Robinson smaller, but significant fraction of common cause failures.

identified a loss of feedwater transient in which inadegnte l

Problems with control circuit design modifications at NPSH and flows less than design values had occurred, but Farley defeated AFW pump auto-o.t on loss of main which were not recognized at the time. Event analysis feedwater. At Zion-2, restart of both motor driven pumps and equipment trending, as well as surveillance testing was blocked b; circuit failure to deenergize when the which duplicates service conditions as much as is 1

pumps had bem tripped with an automatic start Anal practical, can help identify such design errors.

present (IN 82 01,1982). In addition, AFW cont: d circuit design reiews at Salem and Indian Point have CC9. Asiatic clams caused failure of two AFW flow identified designs where failures of a single compc,nent control valves at Catawba-2 when low suction pressure l

could have failed all or multiple pumps (IN 87-34,1987).

caused by starting of a motor-driven putnp caused suction source realignment to the Nuclear Service Water system.

CC5. Incorrect setpoints and control circuit settings Pipes had not been routinely treated to inhibit clam resulting from analysis errors and failures to update growth, nor regularly monitored to detect their presence, procedures have also prevented pump start and caused and no strainers were installed. The need for surveillance pumps to trip spuriously. Errors of this type may remain which exercises alternative system operational modes, as undetected despite surveillance testing, unless surveillance well as complete system functioning,is emphasized by tests model all types of system initiation and operating this event. Spurious suction switchover has also occurred

I conditions. A greater fraction ofinstrumentation and at Callaway and at McGuire, althouch no failures 4

q control circuit problems has been identified during actual resulted.

l system ope ation (as opposed to surveillance testing) than for other types of failures.

CC10. Common cause failures have also been caused by I

component failures (AEOD/C404,1984)..At Surry-2, CC6. On twc occasions at a foreign plant, failure of a both the turbire driven pump and one motor driven pump balance-of-ph nt inverter caused failure of two AFW were declared inoperable due to steam binding caused by pumps. In acdition to loss of the motor dris en pump backleakage of hot wates through multiplecheck valves.

whose auxiliary start relay was powered by the invertor, At Robinson-2 both motor driven pumps were found to be the %bme driven pump tripped on overspeed because the hot, and both motor and steam driven pumps were found governor valve opened, allowing full steam flow to the to be inoperable at different times. Backleakage at Robin-turbine. His illustrates the importance of assessing the son-2 passed through closed motor-operated isolation effects of failures of balance riplant equipment which valves in addition to multiple check valves. At Farley, supports the operation of criti al components. The both motor and turbine driven pump casings were found instrument air system is anothr example of such a hot, although the pumps were not declared inoperable. In system.

addition to multi-train failures, numerous incidents of single train failures have occurred, resulting in the desig-CC7. Multiple AFW pump trips have occurrA at nation of " Steam Binding of Auxiliary Feedwater Pumps" Millstone-3, Cook-1. Trojan and Zion-2 (IN 87-53,1987) as Generic issue 93. His generic issue was resolved by caused by brief, low pressure oscillations of suction Generic Letter 88-03 (Miraglia,1988), which required pressure during pump startup. These oscillations licensees to monitor AFW piping temperatures each shift, occurred despite the availability of adequate sta:ic NPSH.

and to maintain procedures for recognizing steam binding Corrective actions taken include: extending the time delay and for restoring system operability.

associated with the low pressure trip, removing the trip, and replacing the trip with an alarm and operator action.

4 5.3 NUREG/CR-5829

Failure Modes i-i CCl1. Common cause failures have also failed motor control, poor governor maintenance, incorrect adjustment j

operated valves. During the total loss of feedwater event of governor valve and overspeed trip linkages, and errors at Davis Besse, the normally-open AFW isolation valves associated with the trip and throttle valve. TTV-associ-failed to open after they were inadvertently closed. The ated errors include physically bumping it, failure to failure was due to improper setting of the torque switch restore it to the correct position after testing, and failures bypass switch, which prevents motor trip on the high to verify control room indication of TTV position i

torque required to unseat a closed valve. Previous following actuation.

l problems with these valves had been addressed by increasing the torque switch trip setpoint - a fix which HE3. Motor driven pumps have been failed by human failed during the event due to the higher torque required errors in mispositioning handswitches, and by procedure due to high differential pressure across the valve. Similar deficiencies.

common mode failures of MOVs have also occurred in other systems, resulting in issuance of Generic letter 89-5.2.3 Design / Engineering Problems and 10, " Safety Related Motor-Operated Valve Testing and Errors Surveillance (Partlow,1989)." His generic letter requires licensees to de; op and implement a program to del. As noted above, the majority of AFW subsystem provide for the testing, 2spectionand maintenance of all failures, and the createst relative system degradation, has i

safety-related MOVs tc provide assurance that they will been found to result from turbine-ddven pump failures.

[

~

function when subjected to design basis conditions.

Overspeed trips of Terry turbines controlled by Wood-ward governors have been a significant source of these CCl2. Other component failures have also resulted in failures (AEOD/C602,1986). In many cases these over-l AFW multi-train failures. These include out-of-adjustment speed trips have been caused by slow response of a Wood-t electrical flow controllers resulting in improper discharge ward Model EG governor on starr2p, at plants where full 6

valve operation, and a failure of oil cooler cooling water steam flow is allowed immediate!y. His oversensitivity i

supply valves to open due to silt accumulation.

has been removed by installint,a startup steam bypass f

valve which opens first, allowing a controlled turbine 5.2.2 Human Errors acceleration and buildup of oil pressure to control the j

governor valve when full steam flow is admitted. Davis-

)

HEl. The overwhel ningly dominant cause of problems Besse AFW pump turbines use Woodward model PGG t

identified during a series of operational readiness evalua-governors.

tions of AFW systems was human performance. The majority of these human performance problems resulted DE2. Overspeed trips of Teny turbines have been caused I

from incomplete and incorrect procedures, particularly by condensate in the steam supply lines. Condensate with respect to valve lineup information. A study of valve slows down the turbine, causing the governor valve to mispositioning events involving human ermr identified open farther, and overspeed results before the governor failures in administrative control of tagging and logging, valve can respond, after the water slug clears. This was procedural compliance and completion of steps, veri 6ca-determined to be the cause of the loss-of-all-AFW event at tion of support systems, and inadequate procedures as Davis Besse (AEOD/602,1986), with condensation en-j important. Another study found that valve mispositioning hanced due to the long length of the cross-connected events occurred most often during maintenance, calibra-steam lhes. Repeated tests following a cold-start trip may j

tion, or modification activities. Insuf5cient training in be successful due to system heat up.

determining valve position, and in administrative require-ments for controlling valve positioning were important DE3. Turbine trip and throttle valve (TTV) problems are causes, as was oral task assignment without task comple-a significant cause of turbine driven pump failures (IN 84-tion feedback.

66). In some cases lack of TTV position indication in the control room prevented recognition of a tdpped TTV, In HE2. Turbine driven pump failures have been caused by other cases it was possible to reset either the overspeed human errors in calibrating or adjusting governor speed trip or the TTV without resetti.2g the other. His problem NUREG/CR-5829 5.4

Failure Modes r

v is compounded by the fact that the position of the AFW valves (IR 50-489/89-11: 50-499/89-11,1989).

t overspeed trip linkage can be 'sleading, and the mecha-The valves had been environmentally qualified, but not i

nism may lack labels indicating when it is in the tripped with the non-safety-related heaters energized.

position (AEOD/C602,1986).

i DEo. Many SOV failures have resulted from subjecting D E4. Startup of turbines with Woodward Model PG-PL SOVs to ambient temperatures in excess of their original governors within 30 minutes of shutdown has resulted in design envelope. Such failures have resulted from local-t overspeed trips when the speed setting knob was not iz.ed steam leaks, incorrect estimates of ambient temperat-

[

exercised locally to drain oil from the speed setting ures, and failure to account for ventilation system l

c)linder. Speed control is based on startup with an empty malfunctions. Because the useful qualified lives of the cylinder. Problems have involved turbine rotation due to short-lived parts of SOVs are halved by every temperature j

both procedure violations and leaking steam. Terry has rise of 18"F, ' minor' increases in ambient temperature marketed two types of dump valves for automatically above those conside:ed in the SOY design may increas-draining the oil after shutdown (AEOD/C602,1986).

the risk of premature failures (NUREG-1275).

At Calvert Cliffs, a 1987 loss +f-offsite-power event

[

required a quick, cold startup that resulted in turbine trip 5.2.4 Component Failures due to IGPL governor stability problems. The short-term corrective action was installation of stiffer buffer Generic Issue II.E.6.], "In Situ 'lesting Of Valves" was springs (IN 88-09,1988). Surveillance had always been divided into four sub-issues (Beckjord,1989), three of preceded by turbine warmup, w hich illustrates the which relate directly to prevention of AFW system importance of testing which duplicates service conditions component failure. At the request of the NRC, in-situ L

as much as is practical.

testing of check valves was addressed by the nuclear industry, resulting in the EPRI report, " Application i

pg. Reduced viscosity of gear box oil heated by prior Guidelines for Check Valves in Nuclear Power Plants operation caused failure of a motor driven pump to start (Brooks,1988)." This extensive report provides informa-l due to insufficient lobe oil pressure. Iwwering the tion on check valve applications, limitations, and inspec-3 pressure switch setpoint solved the problem, which had tion techniques. In-situ testing of MOVs was addressed j

not been detected during testing.

by Generic 1_etter 89-10 " Safety Related Motor-Operated l

Valve Testing and Surveillance" (Partlow,1989) which DE6. Waterhammer at Palisades resulted in AFW line requires licensees to develop and implement a program for i

and hanger dan. age at both steam generators. The AFW testing, inspection and maintenance of all safety-related j

spargers are located at the normal steam generator level, M OVs. " Thermal Overload Protection for Electric and are frequently covered and uncovered during level Motors on Safety-Related Motor-Operated Valves -

fluctuations. Waterhammers in top-feed-ring steam Generic issue ILE.6.1 (Rothberg,1988)" concludes that j

generators resulted in main feedline rupture at Maine valve motors should be thermally protected, yet in a way Yankee and feedwater pipe cracking at Indian Point-2 (IN w hich emphasizes system function over protection of the 84-32, 1984).

operator.

DE7. Manually reversing the direction of motion of an CFl. 'Re common-cause steam binding dects of check operating valve has resulted in MOV failures where such valve leakage were identified in Section 2.1, entry loading was not considered in the design (AEOD/C603, CClo. Numerous single-train events r,rovide additional e

1986). Control circuit design may prevent this, requiring insights into this problem. In some rases leakage of hot stroke completion before reversal.

MFW past multiple check valves in series has occurred because adequate valve-seating pressure was limited to the i

DES. At each of the units of the South Texas Project, valves closest to the steam generators (AEOD/C404, space heaters provided by the vendor for use in pre-1984). At Robinson, the pump shutdown procedure was installation storage of MOVs were found to be wired in changed to delay closing the MOVs until after the check parallel to the Class IE 125 V DC motors for several 5.5 NUREG/CR-5829 p

. = _ _

Failure Modes valves were seated. At Farley, check valves w ere ensuring that MOV switch settings are maintained so that changed from swing type to lift type. Check valve rework the valves will operate under design basis conditions for has been done at a number of plants. Different valve de-the life of the plant.

signs and manufacturers are involved in this problem. and recurring leakage has been experienced, even after repair CF5. Component problems have caused a significent and replacement.

number of turbine driven pump trips (AEOD/C602, 1986). One group of events involved worn tappet nut CJ2. At Robinson, heating of motor operated valves by faces, loose cable connections, loosened set screws, check valve le-kage has caused thermal binding and fail-improperly latched TTVs, and improper assembly.

ure of AFW discharge valves to open on demand. At Another involved oil leaks due to component or seal fail-Davis Besse, high differential pressure across AFW injec-ures, and oil contamination due to poor maintenance

)

tion valves resulting from check valve leakage has pre-activities. Govemor oil may not be shared with turbine vented MOV operation (AEOD/C603,1986).

lubrication oil, resulting in the need for separate oil changes. Electrical component failures C_F. Gross check valve leakage at McGuire and Robin-included transistor or resistor failures due to moisture son caused overpressurization of the AFW suction piping.

intrusion, erroneous grounds and connections, diode fail-At a foreign PWR it resulted in a severe waterhammer ures, and a faulty circuit card.

event. At Palo Verde-2 the MFW suction piping was i

oserpressurized by check valve leakage from the AFW CF6. Electrohydraulic-operated discharge valves have system ( AEOD/C404,1984). Gross check valve leakage performed very poorly. and three of the five units using l

through idle pumps represents a potential diversion of them have removed them due to recurrent failures. Fail-AFW pump flow.

ures included oil leaks, contaminated oil, and hydraulic pump fat lures.

,CJ_4. Roughly one third of AFW system failures have

[

been due to valve operator failures, with about equal fail-CF7. Cor, trol circuit failures were the dominant source of J.

ures for MOVs and AOVs. Almost half of the MOV fail-motor driven AFW pump failures (Casada,1989). 'Dris ures were due to motor or switch failures (Casada,1989).

includes the controls used for automatic and manual start-An extensive study of MOV events (AEOD/CliO3,1986) ing of the pumps, as opposed to the instrumentation

[

indicates continuing inoperability problems caused by:

inputs. Most of the remaining problems were due to cir-torque switch / limit switch settings, adjustments, or fail-cuit breaker failures.

l ures; motor burnout; improper sizing or use of thermal

[

overload devices: premature degradation related to inade-CF8. " Hydraulic lockup" of Lirmitorque SMB spring i

quate use of protective devices: damage due to misuse packs has prevented proper spring compression to actuae l

(valve throttling, valve operator hammering); mechanical the MOV torque switch, due to grease trapped in the l

problems Goosened parts, improper assembly); or the spring pack. During a surveil'anee at Trojan, failure of torque switch bypass circuit improperly installed or the tor]ue switch to trip the 'ITV motor resulted in trip-l adjusted. The study concluded that current methods and ping of the thermal overload device, le.aving the turbine procedures at many plants are not adequate to assure that driven pump inoperable for 40 days until the next surveil-l MOVs will operate when needed under credible accident lance (AEOD/E702,1987). Problems result from grease i

conditions. Specifically, a surveillance test which the changes to EXXON NEBULA EP-0 grease, one of only valve passed might result in undetected valve inoperability two greases considered environmentally qualified by l

due to component failure (motor bumout, operator pans Limitorque. Due to lower viscosity, it slowly migrates

{

failure, stem disc separation) or improper positioning of from the gear case into the spring pack. Grease change-l prc,tective devices (thermal overload, torque switch, limit over at Vermont Yankee affected 40 of the older MOVs switch). Generic letter 89-10 (Partlow,1989) has subse-of which 32 were safety related. Grease relief kits are quently required licensees to implement a program needed for MOV operators manufactured before 1975. At 1

NUREG/CR-5829 5.6 w

m...-

.-.c

i i

i l

Failure Modes i

i Limerick, additional grease relief was required for MOVs control circuitry. Half of these occurred on demand, as manufactured since 1975. MOV refurbishment programs opposed to during testing (Casada,1989).

may yield other changeovets to EP-0 grease.

j CF11. For systems using AOVs, operability requires the

)

ff_9. For AFW systems using air operated valves, almost availability of Instrument Air, backup air, or backup l

half of the system degradation has resulted from failures nitrogen. However, NRC Maintenance Team Inspections t

of the valve controller circuit and its instrument inputs have identified inadequate testing of check valves isolating (Casada,1989). Failures occurred predominantly at a few the safety-related portion of the IA system at several utili-i units using automatic electronic controllers for the flow ties (Letter, Roe to Richardson). Generic letter 88-14 control valves, with the majority of failures due to elec-(Miraglia,1988), requires licensees to verify by test that

[

trical hardware. At Turkey Point-3, controller malfunc-air-operated safety-related components will perform as tion resulted from water in the Instrument Air system due expected in accordance with all design-basis events, inclu-l' to maintenance inoperability of the air dryers.

ding a loss of normal IA.

CF10. For systems using diesel driven pumps, most of the failures were due to start control and govemor speed f

l

\\

i

.5 P

I i

5.7 NUREG/CR-5829 i

I i

6 References i

i Beckjord, E. S. June 30.1989. Closcout tf Gencric Travis, R. and J. Taylor. 1989. Development cf hsuc II.E.6.1, 'In Situ Testing <f Vahrs' Letter to V.

Guidancefor Generic, Functionally Oriented PRA-Based Stello, Jr., U.S. Nuclear Regulatory Commission.

Team inspectionsfor BWR Plants-identification ofRisk-Washington, DC.

Important Systems, Components and Human Actions.

TLR-A-3874-TUA Brookhaven National Laboratory, Brooks, B. P. I988. Apphcation Guidelinesfor Check Upton, New York.

Vahrs in Nuclear Power Plants. NP-5479, Electric Power Research Institute, Palo Alto, California.

AEOD Reports Casada, D. A. 1989. Auxiliary Fredwater System Aging Study. Volume 1. Operating Experience and Current AEOD!C404. W. D. Lannmg. July 1984. Steam Afonitoring Practices. NUREGICR.5404. U.S. Nuclear Binding ofAuxiliary Fredwater Pumps. U.S. Nuclear

+

Regulatory Commission, Washington, DC.

Regulatory Commission. Washington, DC.

t Filar, K. A.1993. Davis-Besse AFWRisk-Based AEOD/C602. C. Hsu. August 1986. Operational Inspecion Guide. Toledo Edison Company, Oak Experience invohing Turbine Overspeed Trips. U.S.

I Harbour, Ohio.

Nuclear Regulatory Commission, Washington, DC.

3 Gregg, R. E. and R. E. Wright.1988. Appendit Review AEOD/C603. E. J. Brown. December 1986. A Review for Dominant Generic Contributors. BLB-31-88. Idaho ofMotor-Operated Yahr Performance. U.S. Nuclear National Engineering Laboratory, Idaho Falls, Idaho.

Regulatory Commission, Washington, DC.

i Miraglia, F. J. February 17,1988. Resolution of AEOD/E702. E. J. Brown. March 19,1987. MOV Generic Safety Issue 93,

• Steam Binding ofAuxiliary FailureDue to HydraulicLoclasp From Excessive Grease i

Feednater Pumps" (Generic Lener SS-03). U.S. Nuclear in Spring Pack. U.S. Nuclear Regulatory Commission, Regulatory Commission, Washington, DC.

Washington, DC.

Miraglia, F. J. August 8,1988. Instmment Air Supply AEODIT416. January 22,1983. Loss of ESF Antillary System Problems Afecting Safety-Related Equipment Feednater Pump Capability at Trojan on January 22, (Generic Letter SS-14). U.S. Nuclear Regulatory 1933. U.S. Nuclear Regulatory Commission, Washing-Commission, Washington, DC.

ton, DC.

l Partlow, J. G. June 28,1989. Safety-Related Motor-Operated Vahr Testing and Suncillance iGeneric Lener Information Notices 89-10). U.S. Nuclear Regulatory Commission, Washington, DC.

IN 82-01. January 22,1982. Aariliary Feedwater Pump Lockout Resultingfrom Westinghouse W-2 Switch Circuit R.othberg, O. June 1983. 7hermal overload Protection Modification. U.S. Nuclear Regulatory Commission, for Electric Motors on Safety-Related Motor-Operated Washington, DC.

Vahrs - Generic issue ILE.6.1. NUREG-1296. U.S.

Nuclear Regulatory Commission, Washington, DC.

IN 84-32. E. L. Jordan. April 18,1984. Antillary Feedwater Sparger and Pipe Hangar Damage. U,5.

Nuclear Regulatory Commission, Washington, DC.

L l

r a

6.1 NUREG/CR-5829 j

i

I f

References

'l IN 84-66. August 17,1984. Undetected Unasuilability of laspection Report' the Turbine-Driven Auxiliary Fecdwater Train. U.S.

i Nuclear Regulatory Commission, Washington. DC.

IR 50-489/89-11; 50499/89-11. May 26,1989. South Tcxas Project inspection Report. U.S. Nuclear IN 87-34. C. E. Rossi. July 24,1987. Single Failures Regulatory Commission. Washington, DC.

in Antiliary Fredwater Systems. U.S. Nuclear Regulatory Commission. Washington, DC.

NUREG Report IN 87-53. C. E. Rossi. October 20.1987. Antiliary Feedwater Pump Trips Residtingfrom law Suction NUREG-1154. 1985. Loss <fbiain and Auxiliary Pressure. U.S. Nuclear Regulatory Commission, Tecdwatcr Event at the Davis Besse Plant on June 9

{

Washington, DC.

19S5. U.S. Nuclear Regulatory Commission,

]

Washington, DC.

IN 88 09. C. E. Rossi. March 18,1988. Reduced Reliability ofSteam-Driven Auriliary Feedwater Pumps NUREG-1275. 1991. Operating Experience Feedback i

Cauwd by Instability <f Woodward PG-PL Type Report - Solenoid-Operated Valve Problems. U. S.

Governors. U.S. Nuclear Regulatory Conunission, Nuclear Regulatory Commission, Washington, DC.

1 Washington. DC.

IN 89-30. R. A. Azua. August 16.1989. Robinson Unit 2 Inadequate NPSH <f Auxiliary Feedwater Pumps. Also, Event Notification 16375, August 22,1989. U.S.

Nuclear Regulatory Commission, Washington, DC.

i l

i NUREG/CR-5829 6.2

1 NUREG/CR-5829 I

PNL-7905 Distribution l

No. of No. of Copin copies OFFSITE 4

Davis Besse Resident inspector Office i

20 U.S. Nuclear Reculatory Commission J. H. Taylor Brookhaven National Laboratory B. K. Grimes Building 130 OWFN 11 E4 Upton, NY l1973 j

F. Congel R. Travis OWFN 10 E2 Brookhaven National laboratory Building 130 A. C. Thadani Upton, NY l1973 OWFN 8 E2 R. Gregg R. J. Barret EG&G Idaho, Inc.

I OWFN 8 H7 P.O. Box 1625 l

Idaho Falls,ID 83415 G. M. Holahan OWFN SE2 D. R. Edwards Professor of Nuclear Engineering l

J. B.Ilopkins University of Missouri-Rolla i

OWFN 13 E21 Rolla. MO 65401 K. Campe ONSITE OWFN 10 E4 22 Pacific Northwest Laboratorv J. Chung OWFN 12 GIS (10)

L R. Dodd 1

B. F. Gore (10)

J. N. Hannon N. E. Maguire-Moffitt j

OWFN 13 E21 J. R. Nickolaus B. D. Shipp B. Thomas F. A. Simonen I

OWFN 12 H26 (2)

T.V.Vo l

l Publishing Coordination 2

U.S. Recalatory Commission Technical Report File (5) i Recion 3 H. J. Miller i

E. G. Greenman i

i Distr.1 l

w w

w

'w 9

w>

+

y w-

NRC Fomp 335 U.S. NUCLE AR REGULATORY COMMISSION

1. E EPORT NUMEE R kp$1102 m Numnera nei. nc2 BIBLIOGRAPHIC DATA SHEET iser mstructions on rse reverse)

NUREGlCR-5829

2. TITLE AND SUBTITLE PNL-7905 Auxiliary Feedwater System Risk-Based Inspection Guidance for the Davis-Besse Nuclear Power Plant 3.

DATE REPORT PUBLISHED

{

uowt tan September 1993

4. FIN oR GR ANT NUMBER L1310

5. AUTHOR (53

6. TYPE OF REPoPT J.R. Nickolaus, PNL Technical N.E. Moffitt, PNL i

B.F. Gore, PNL

7. eE Rico cove R eD u,.., o,,,,

T.V. Vo, PNL J.B. Hopkins, NRC 7/91 to 7/93 8 PE RF oRMING ORG ANIZ AT 40N - N AME ANo ADDP ESS (n 4RC. prow,oe Dwauon. Orfee or Aeron. u.3 4erseer Argusemry Commess,on. ana me, imp adaress af contracror. proper eigme med W edoresk/

1 Pacific Northwest Laboratory P.O. Box 999 Richland, WA 99352 9.SPO OR G G ANIZATION - N AME AND ADDR ESS in NaC. repe sene as enove~ et contractor. pro ear 48C Devason. Onore or Regen. U.S mucseer aerwerary commes.m Division of Safety Systems and Analysis Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555

10. SUPPLEMENT ARY NOTES

11. ABSTRACT (200 woras or sessf In a study sponsored by the U.S. Nuclear Regulatory Commission (NRC), Pacific Northwest Laboratory has developed and applied a methodology for deriving plant-specific risk-based inspection guidance for the auxiliary feedwater (AFW) system at pressurized water reactors that have not undergone probabilistic risk assessment (PRA). This methodology uses existing PRA results and plant operating experience information.

Existing PRA-based inspection guidance information recently developed for the NRC for various plants was used to identify generic component failure modes.

This information was then combined with plant-specific and industry-wide component information and failure data to identify failure modes and failure mechanisms for the AFW system at the selected plants. Davis-Besse was selected as one of a series of plants for study. The product of this effort is a prioritized listing of AFW failures which have occured at the plant and at other PRRs. This listing is intended for use by NRC inspectors in the preparation of inspection plans addressing AFW risk-important components at the Davis-Besse plant.

12. KE Y WORDS/CESCR:P f 0RS (test woros or poroses ener n ass,se resesseners sa mcar np ree reporr.J u aw A4Afout y ST aitMEN T Inspection, Risk, PRA, Davis-Besse, Auxiliary Feedwater (AFW)

Unlimited

14. $4CUpt1T v CLA&S & CA1 eOrw iihtt Pepel Unclassified a r,,,, ne on, Unclassified Ib. NUMBER OF PAGES

15. PRICE A8tc FORM 235 (7492

c a

W I

Printed

• On recycled paper Federal lecycling Program

NUREG/CR-5829 AUXILIARY FEEDWATER SYSTEM RISK-BASED INSPECTION GUIDANCE SEl'rEMBER 1993 FOR Tile DAVIS-11 ESSE NUCLEAR POWER PIANT UNITED STATES FIRST CLASS MAIL NUCLEAR REGULATORY COMMISSION POSTAGE AND FEES PAtO WASHINGTON, D.C. 20555-0001 USNRC PERMIT NO. G-67 i

OFFICIAL BUSINESS PENALTY FOR PRNATE USE. $300 f

A h l "'

1 TICNS gggtICS 1

nsss

%13b-~u=o cc r-212 I

LASHING

~~~=-an

' ~ " - ~ ~. _., _,, _

NUREGICR-5829 AUXILIARY FEEDWATER SYSTEM RISK-HASED INSPECTION GUIDANCE SEITEMIER 1993 -

FOR TIIE DAVIS-11 ESSE NUCllAR POWER PLANT UNITED STATES POSYAGE A NUCLEAR REGULATORY COMMISSION D E S PAID WASHINGTON, D.C. 20555-0001 USNRC PERMIT NO. G-67 OFFICIAL BUSINESS l-PENALTY FOR PRIVATE USE. $300 i

I kI41b '

170(f hb TIC ICA es - v m %ggg,

-sss

,{.pDP'N CC c-%un pSHI i

i