ML20058F892

Auxiliary Feedwater System RISK-BASED Inspection Guide for the J.M. Farley Nuclear Power Plant

ML20058F892
Person / Time
Site:	Farley
Issue date:	10/31/1990
From:	Gore B, Harrison D, Pugh R, Vo T Battelle Memorial Institute, PACIFIC NORTHWEST NATION
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-L-1310 NUREG-CR-5617, PNL-7349, NUDOCS 9011090201
Download: ML20058F892 (34)

Text

- - - - .- . . . - - . .. , . .

N Y h -.kN .j .,o #

Jt

.y/ a/ h m%.ay .^ ,

r

- 34, f,/-  %.1.,

. Ly ,("h - % . m m - m u ,

f.h o w' . fi ',

3 H h'j< j $ ,[ h,[ '/*7 I I# I

\/ $ d

}{ \I . J[

a ' n,'d gM W wj d  ?? Q.%g  %:Y- #)k i Q:

qQfh:wn ag% cxcMiw m DLU , , W , V W^' n , a [, ' oM y it wmn w: a, v y '

na y -

x x; - -

A wwA

%4Mr$q.M p cp*-mw n sn w v

- a mw 3 ar~

, i

>h MMMMm, tW %, i l ' @ ~

c_ V.-

NURNG/CRi,5617

A

- w , +

n wg wg t w _ Q i#c

>, E ,

PNIM7349? J._

i.' b hy I 9 f i

.}Op m. > q !\,f e! J ;=- ~'w W ^ % .\

, v 4;c ' 1. .f ,%. . . - 3* , , r , -

aw+o%

'f dm&a&rQn .,m. p >

d '. F . -

3 1.N

, 33 7yi jI .

N j ji, f

w. g ;qvww!w' qww  ;

$s

,- L a

-op , x -s:

y , ,

) . pv).

i p4 -

.g

..:..e

{' =ec-y p i c. G i

-M-.. . ~ ..-. . .

b

• Ti a s :w: pn,w M n ,&" :@jr b ,.O,d

~

Wt

^

< s <

i:il

@),p1WmgFnkilifryT.

,_{_skEBs Eli n.~n, s s . .. - n se ,

&,In ,

s p ec ti o wG u id Feed 9 A, ,,

1

, ,.e apfp#.sth'e

1. s:W;;;8 w u pm,  ; . M. ,,.Farlew nus y i, s . ar w

.N Q+w eW y.

wn , v . . .,J o Mma n elom e

agg a 4.

w

&W"rn-M, ~ +u c

m, -

6ar s

h

<.d y; f, m m c.ow'-ms,nPlan, .t'.

ieNJ m q.;a

-? ? : p l~i '. . ,

• uu m '

,, av

,t m ;' ,

• s '

g,..

. M,,~,q'.,ms .

yj Qk Qet N.& aq b .,; ' '4\'t ,s x

p

'Wh epMyp L, e m p;OL7; 8 ::p; e a.s q b "i , ,

n. . - N w c Pp s?s s 3, it"

,1

, .t t

> ! icNj Mew ,a ,.,+M M.n. >>^a s @e y N' s W, , wv,W F - W: a- mWWM4 4

n w -a s a%

w M.v..

s M: nlm Ww 7J M e<nm, o 2 -

.~my w . m . n.A -

$$m'yW:v&:q%uwy QW

'r w M,a:N%.

g.SQWa,h yW p%w &n e, ops q ,

, +J ' ,

Mga afg$$5iiM $d M,'UTihM ![w,f s ..

. . . .m Ei ' ,

," ' M N$ ' ' ' N ^

7 $iOM X*~W MM

, 1

@M M.mu g,. m wdM,' s m$,~ q h; . .

M $ @W N - v,a M wyW,

,b.

i  % w< k n.o-; t.

M W x W m

' 6 e * ,

M xW' "M7 +

aWW n M, w A> - vEs

%g a > >

i,v- < ,e n '- t.

o . ,- < 1 ,

1 ms-1 n, e! ,:y: s s w

a-euv w.x pwc34 ma ww . j

-m a , - , + ,n m'E rd Y -4;,Mr Vi y# . , ,.. .

,h ' ~ 'V ,' #,4 !3 09 h.

k 5 '

93, P s!'

4 c.{ . p' '

r Yqs.j myw% nhp(v,cC 3 %p+g4'; bgg / g!';

f ist:

g, rt

.o. e s e,

)' a,, y 3  ; .y... \'1 11 $ ,

i c

s s N ,r , z

:p:

g MMX W M ! . -:- .Wi. ?y4: k f .1 % . m e. fi ,

@, y m" 4 1 i

":L g!) s d.,.%g,n m - 4s y D,

'tt g

s. ,

s 3 s ,

C'T,.d.

A + ,' L@s , '

g,L Prepared b WV.No, K Pugh; Bi Fi Gor,e,,1D' . O. Harrison ( l 'M Q n %wuM6 m gW m , u w s u m o .- .:u m ,s, g %' w n . &"A e

o q M m mm;%

mo

' ,_w.- y<p! _%y. m ny e x 8 ,,,

i p pSA e pa mA4. %m, >:y s.s -

g, s 3 @+, - - , i a2 ,cto,

g. m+a,7q2 q n.usf-s: wqgN  ; ,8

~,

m: g y m . mi _ aw- w. nqs q.Lt.-

i m :& qc. e .., m.A < w/n4'ai

.c 3 - . n. -

q. .

s pt ,

.,gg j, D. %, -(.1 d

[fc 4 ,yhni 4 p$[}iMWW 4 *,t Md3$fy i

' ] h;q . . .'g, s 'l d,'~

i y, ,

E; &u y G $ s 4. ;.' M,; 9 N F@jn;63

@hPacific;No/% rth

.ww Eg h @$

,<g 4

3 .

h/ Optated(y@ west Laboratorysy _ r D Ed # M%4

, s i , . Wt N" HMBattelle m o. Memorial Instituteh . a

, ,. r, . %,, . .. x Wv.a

& .NI h5MN,w,g.hf[jfW:g;;h,kkm ygg&mM,k Ly tm

% % m um n @a- ~y~ .pn ~y~

m M M ' Q' a -

'a+vs

~d' M-m;

i N ',SiU ;mpp y.O

• m s Nm w t afs o' ,

n5 .kn: .J - , +

mw s m' m v F

- ~- ,u wy :q f awx J{ c y n ,, 3, - .

w. c - -

pm mgnm amkyku%m m2:u;pp%& ,

7 mM

' . y sgPrepared forMZL . -

" 1J E

- t ' @pt

$pd.11SLNuclear -

+ Regulatory m .. Conimissibnl u..

5 o

.a r

wdv gg%,i gr. -

i bitw<, wl::r q < '- - -

N mnw s... - 4:- a>

p w <$

Nem;,..< wiv m i ja - t' e ' ,

m n ~s W @ w< " c

.o bn jg M M f: ,/1

, F p n; & 9 1..  ;

h'ff Qn,yo w, .

?? .

k:yl oa- a w.

h. r 7p  ; o m f s s 9 :4 7 [

jf

~

4

'{

N? 'sf-9011090201 901031 1 T4 PDR ADOCK 05000348 1 4

Y G PDR g M

ry s t r4 r cy u nn yy

,o ,

jq 1 M, 4 ,0 p F e&" wh nm +;.4 y@,.:b yg n..v, ; ec.. ;[y,p f,pe,s . : n e,

9a u  ;. .

t-. , sj -,-

.c n n u t .( a

. + t- a i a *.. 4. --.--x- . 4 - t - n -+ ,..We. + vi =

ma g n 3:qh W

&g % g fy, N-y o ' c&wu r%" , , s 4, m " c, ym e , m 3.'1 O , w h-, u.

-. m Je . .

4-v s r .y hNO NbAp4Yb W? cW?nf* t ' , 'Y$b A :Y W :E%

' Y$ 1y' "< J' h b^' '

5 W

W SC?

% hw W <> +'

+-s

~

f

.c r s 4 d'>

<F -

s i

w$l Q h@w:&W f [j;w^ & ,

W '

R t

p q % wmk.. v-n 4e c t

@ gtt ,,4DE ' + , ,

~+

ffhhykh dw ',

i 1 m

q w opw r , ,s W -"'

@4QhM W@KIC

@ MrdMMi Mn e -

. AVAILABILITY NOTICE ;

a '

hab.w-i

' T 2p pu e' : u I ., .. ..

Availabihty.of Beforerte Materials Cned in NRC Putk,abons

,M

• Y@

wy- M D n. ril ' . ng as &m y ,+ , u ., . , .

h .hh,M$, } Most dosuments'clied in NRC publications wel be avatable from one of the foRowing sources: ,

. . . . . . m ..u.- -

$phw %TM/ IM jThe t4RC PubRc Document Room 21201. Street. NW. Lower Level. WasNngton/DC 20555 ,

ayWRp% - ,

o hk$$ Mk F2dThi Superintendent of Documents /d.S. Government Printing Off6ce. P.O. Box 37082. Washington.

' M DC ' 20013-70821 ,

I e

$'n JM,NQp 4 p.m 4. i ' ~ , , , , ' , .

Qya =m,:

WM 9ft c ~. , .

f b3qThe National Technical Information Service. Springfield. VA .22161 f5 hqMng Ql ww ti:E , %, . > . .

4 t

, .y

+

'T:

4 pys to-.

1 ,

- gg@l.

C Mthough:the listing,that foRows represents the majority of documents cited in.NRC publications..it is,not? u

"~

v.fNl[yhkMN Q htended to be exhaustive' i ,  ; * . i u

h # ll$ L ? @ % o , J > ..  ?,',. ' '

hhpgW

% Referenced documents sYanable for inspection and copying for. a fee from the NRC Public Document Room ,

i linclude NRC] correspondence and intomal NRC memoranda; NRC Office.of Inspection and Enforcementj HMh[y@

Ngg G y butetins,'carculars; Information noticesTInspection and investigation notices) Ucensee Event Reports! ven-Vdor reports!and correspondencef Commission l papers; and appucant and licensee documents and corre. .

i4 ', ~ ' ' ' '

1. u h$NM!k eMwM[h Jn $nspondenop a synivh o% g.wg nir&s gm7,m f g '.,.j, ff s

Of s  ; .a tm , . , s .. <, . . . . , , . . . , , , <

w w m%m4 h@.yji p$The following~ documents In~the(NUREG series are avaRable for purchaso.from the GPO' Sales Program: .

,  ; 4 Mh j j formal NRC staff and contractor, reports; NR> sponsored conference proceedngstand NRC booklets landa, p "; y g%QQ@p&

Q%

g gi mh M brochures @Also 'avasable are Regulatory Guides; NRC regulations in the Codee'^W, Muclear Reg'utetory Commisslorrissuanceu , '

of federal Regulaflons, and p y

• 4 ,

M K Ljg .QNju&I%& bf . ; ,1 , . . - w .pl y3 Y '.

w M[Documerds aval(able' from the Natbnal> Technical Information: Service ineb>de NUREG n , , ..

[dh p

Mn?Md Meloni [h b

,itechnical reports' prepared by Oor $doral' agencies and reports prepared by the Atomic Energy Commise

~

• $p' qN%1h forerunner agency to the Nuclear Regulatory Commission.' '

y,

{' '/

,O

?

k k bhk hb# dbMM '. E M '

M M bA . [' E / A- N a n. iL : . <., '

s M NpMMy[ h h. Documents booksdoumal ava8 table and periodical article?[and from trans' pubhcactions / 'and Federalspecial Register i1tices technical federat and Ibraries shte legista- include laR 4op

@eps wtion, and .ongr.ssionai r.p no can usu.ny 6. obtain.d from these Abrui.sa x '

w w t

fh h 'h$f&hhkhQ &jfl.. hy h&lh-$& $ h Q , , ,q j,.

f  % , i.h . . Q x qhihis O@i. Documents such as theses, desertations/ g

.f.

organitation foreign reports and translations; and non-NRC 'W! confere ' ?g V

@M@W N^n M y .b W

A &,W W~.i@hn coedngs ma are avaAable'for, purchase

% *.C,f"m. A ' M, ; ,l<i kW=

- r from'the am sponsoring

' ' i

m. M, the pubucauon bAw-""

i- ,

citedJ

..~ * % '- m. ~1 < m r.~

c

1. • W s

> l 'o -

.s.y N&.dg ,h @

7 Single copiss'of .NRC draft reports are aveNable freef to the extent of supply /upon, written request to the 1

,8 [ Office of Information Resources Management { Distribution Sectioni U.Sl Nuclear Regulatory Commission;U >

( ,

'LF ,Q'4 "^

Nd ashingtc 4 hG &6 ?, =/ !.A" -j' s M,Mp.jfk m %4 W QWlWsy>hDCi20$$$d W ..in..m , ~

u " m' N. 4[@$Ml%cd .e .Q\ +N',

s

.l, '

s. '.2, vs . . , . ; 5, , . 4 M., . s o M

d Mr NWA M SCopies of industry codes and standards used in a, substantive manner in,the NRC regulatory process are i h ip

~

h immentabd at the NRC Ubrary/7920 Norfolk Avenue. Bethesda',' Maryland [and are;avagable'there for refer. N .g hyg@g

/

gence use by the publicyCodesjand, standards are usuaIV copyrighted and may be purcssed from.the ;

6 originating organization or; if they are Amerloan NationalStandards, from the' American_ National, Standards?

i *

']

A M mnsutq0 Broadwan New%WM8? ' ' '

i >

y g.

kk@dfkW

%segg

$ 2 We m - m

^w 7 T;

$W$gM ' A(?

wq hy s . mm , . 3 i .

SM M_ Mw.an E i C M, g%%m 7 p aNM / DISCl. AIMER NOTICE $ ;d i N gh~

%y spy 3

,s

&~

~

s%&ce-W. . . Sw am 0..Js ' .,p n RThis report was prepared' a,s an, account of work sponsored ty an agency of the United 9mes;Govemment. -

O $Mg%

$$@4)iy%N 6 $Neitherit$ted Statos Govemmsnt nor any agency thereof, or any of thek employees, makes any warranty, ;

1 expresed or Imptiod, or assumes any legal. itability of responsibility for any third party's use, or the results of

'{

?

hith r % t Yauch usefoi any information, apparatus, product or process discfosed in this report, or represents that its use .

, / by such third party would not infringe privately owned rights.

3 y

$$jffh or s

s 1 s y f b? \.1,. !!

3pm' %pp

$mm 15 h QSMe,d e, ,

s l

V fun @ Sl: r

$ f b "i -

%mx

%MyW::. .P: ',~ n

$]+hW-m da%... r ,, ,

, a n, .

., m 1>

NUREG/CR-5617 PNL.-7349 i

Auxiliary Feedwater System Risk-Based Inspection Guide for the J. M. Farley Nuclear Power Plant Manuscript Completed: September 1990 Date Published: October 1990

' V Vo, R. Pugh, B. F. Gore, D. O. Flarrison Pacific Northwest laboratory Richland,WA 99352 Prepared for Division of Radiation Protection and Emergency Preparedness -

Omce of Nuclear Reactor Regulation

- U.S. Nuclear Regulatory Commission Washington, DC 20555' NRC FIN L1310 -

1 P ' A _

i 1

SUMMARY

This document presents a compilation of auxiliary feedwater (AFW) system failure information which has been screened for risk significance in terms of l failure frequency and degradation of system performance. It is a risk- i prioritized listing of failure events and their causes that are significant enough to warrant consideration in inspection planning at the the J.M. Farley pl ant. This information is presented to provide inspectors with increased resources for inspection planning at J.M. Farley.

l The-risk importance of various component failure modes was identified by analysis of the results of probabilistic risk assessments (PRAs) for many pressurized water reactors (PWRs). However, the component failure categories  !

identified in PRAs ar rather broad, because the failure data used in the PRAs  ;

is an aggregate of many individuals failures having a variety of root causes, l in order. to help inspectors to focus on specific aspects of component j operation, maintenance and design which might cause these failures, an i extensive review of-component failure information was performed to identify I and rank the root causes of these component failures. Both J.M. Farley and industry-wide failure information was analyzed. Failure causes were sorted on 1 the basis of frequency of occurrence and seriousness of consequence, and l categorized as common;cause failures, human errors, design problems, or component failures. 1 This information is presented in the body of this document. Section 3.0 provide brief descriptions of these risk-important failure causes, and Section '

-5.0-presents more extensive discussions, with specific examples and references. The entries in the two sections are cross-referenced.

An abbreviated system walkdown table is presented in Section 3.2 which includes only components ~ identified as risk important. This. table lists the

- system lineup for normal, standby system operation.

'This information permit's an inspector to' concentrate on components important to the prevention of_ core damage. However, it is-important to note that inspections should not focus exclusively on these components.- Other components which perform essential functions, but which are not included because of high-reliability or redundancy, must also be addressed to ensure that-degradation does not increase their failure probabilities, and hence their risk importances.

i l

l \

l l

CONTENTS T

SUMMARY

.................................................... ........... iii

1.0 INTRODUCTION

..................................................... 1 2.0 J.M. FARtEY ArW SYSTEM ........................................... 2

_ 2.1 SYS1EM DESCRIPTION .......................................... 2 2.2 SUCCESS CRITERION ........................................... 4 2.3 SYSTEM DEPENDENCIES ......................................... 4 2.4 OPERATIONAL CONSTRAINTS ..................................... 4 3.0 INSPECTION GUIDANCE FOR THE J.M. FARLEY AFW SYSTEM ............... 5 3.1 RISK IMPORTANT AFW COMPONENTS AND FAILURE MODES ............. 5

/ 3.1.1 -MUTLIPLE PUMP FAILURES DUE TO COMMON CAUSE ........... 5

. 3.1.2 TURBINE DRIVEN PUMP FAILS TO START OR RUN ............ 6 3.1.3 MOTOR DRIVEN PUMP A OR B FAILS TO START OR RUN ....... 7 3.1.4 PUMP UNAVAILABLE DUE TO MAINTENANCE OR SURVEILLANCE ...................................... 7 3.1.5 AIR OPERATED FLOW CONTROL VALVES Fall CLOSED ......... 7 3.1.6 MOTOR OPERATED ISOLATION VALVES FAIL CLOSED .......... 8

,, 3.1.7 MANUAL SUCTION OR DISCHARGE VALVES FAIL CLOSED ....... 8 3.1.8 LEAKAGE OF HOT FEEDWATER THP00GH CHECK VALVES ........ 9 3.2 RISK IMPORTANT AFW SYSTEM WALKDOWN TABLE .................... 9 l 4.0 GENERIC RISK INSIGHTS FROM PRAs .................................. 13 r

4.1 RISK IMPORTANT ACCIDENT SEQUENCES INVOLVING AFW SYSTEM FAILURE .............................................. 13 4.2 RISK IMPORTANT COMPONENT FAILURE MODES ...................... 14 5.0 FAILURE MODES DETERMINED FROM OPERATING EXPERIENCE ............... 15

__ 5.1 J.M. FARLEY EXPERIENCE ...................................... 15 V

C m -

CONTENTS (Continued) 5.1.1 MULTIPLE PUMP FAILURES ............................... 15 5.1.2 MOTOR DRIVEN PUMP FAILURES ........................... 15

? 5.1.3 TURBINE DRIVEN PUMP FAILURES ......................... 15 5.1.4 FLOW CONTROL AND ISOLATION VALVE FAILURES ............ 16 L 5.1.5 TURBINE DRIVEN PUMP STEAM SUPPLY, ADMISSION AND CONTROL VALVES.......................... 16 5.1.6 CHECK VALVES ......................................... 16 5.1.7 SERVICE WATER BACKUP SUPPLY VALVES ................... 16

_ 5.2 INDUSTRY WIDE EXPERIENCE ..................................... 16 Li 5.2.1 COMMON CAUSE FAILURES ................................

17 5.2.2 HUMAN ERRORS ......................................... 19 5.2.3 DESIGN / ENGINEERING PROBLEMS AND ERRORS ............... 20 5.2.4 COMPONENT FAILURES ................................... -21 REFERENCES ............................................................. 27 vi i'.

T l

l

1.0 INTRODUCTION

This document is the second of a series providing plant-specific inspection

-guidance for auxiliary feedwater (AFW) systems at pressurized water reactors (PWRs). This guidance is based on information from probabilistic risk assessments-(PRAs) for similar PWRs, industry-wide operating experience with AFW systems, plant-specific AFW system descriptions, and plant-specific

~

cperating experience. ' It is not a detailed ins)ection plan, but rather a c>mpilation of AFW system failure information w11ch has been screened for risk

-significance in terms of failure frequency and degradation system performance.

Tne result is a risk-prioritized listing of failure events and the causes that f re significant enough to warrant consideration in inspection planning at J.M.

tarley.

This-inspection guidance is presented in Section 3.0, following a description of the J. M. Farley AFW system in Section 2.0. Section 3.0 identifies the risk important system components by J. M. Farley identification number, followed by brief descriptions of each of the various failure causes of that component.. These include specific human errors, design deficiencies, and hardware failures. The-discussions also identify where common cause failures have affected multiple, redundant. components. These brief discussions identify specific aspects of system or component design, operation, maintenance, or testing for inspection by observation, records review, training observation, procedures review, or by observation of the implementation of procedures. An AFW system walkdown table identifying risk important. components and their lineup for normal, standby system operation is also provided.

The remainder of the document describes and discusses the information used in compiling this inspection guidance. Section 4.0 describes the risk importance information which has been derived from PRAs and its sour.es. As raview of that section will-show, the failure events: identified in Pi%s are rather broad (e.g., pump fails to start or run, valve fails closed). Section 5.0 addresses the. specific failure causes which have been combined under these broad' events.

AFW' system operating history was studied to identify the various specific failures which have been aggregated into the PRA failure events. Section 5.1 presents a summary of J. M.- Farley failure information, and Section 5.2 presents a review of industry-wide failure information. The industry-wide information was compiled from a -variety of NRC sources, including AE00 analyses -and reports, information notices, inspection and enforcement bulletins, and generic letters,: and from a variety of INP0 reports as well.

Some- Licensee Event Reports,and NPRDS event descriptions were also reviewed individually. Finally,' information-was included from reports of_ NRC-sponsored studies of the effects of plant aging, which include quantitative analyses of _ -

reported AFW system failures. This-industry-wide information was then

" combined with the plant-specific failure information to identify the various root causes of the broad failure events used in PRAs, which are identified in Section 3.0.

I 1

2.0 J. M. FARLEY AFW SYSTEM This section presents an overview description of the J.M. Farley AFW system, including a simplified schematic system diagram. In addition, the system success criterion, system dependencies, and administrative operational constraints are also presented.

2.1 System Description The AFW system provides feedwater to the steam generators (SG) to allow secondary-side heat removal from the primary system when main feedwater is l

unavailable. The system is capable of functioning for extended periods, which u allows time to restore main feedwater flow or to proceed with an orderly b

cooldown of the plant to where the residual heat removal (RHR) system can remove decay heat. A simplified schematic diagram of the J.M. Farley AFW system is shown in Figure 2.1.

The system is designed to start up and establish flow automatically. All pumps start on receipt of a. steam generator low-low level signal. (The motor-driven pumps start on low level in one SG, whereas, two low level signals are required for.a turbine-driven pump start.) The motor-driven (MD) pumps start injection signal, or on aa'loss trip of of offsite major power.

feedwater The pumps single (MFW) pumps, a safety (TD) pump starts on turbine-driven undervoltage of two of the three reactor coolant (RC) pump buses.

A common header supplies both motor-driven pumps, and a separate line supplies the turbine-driven pump. Isolation valves in these lines are locked open. Power, control, and instrumentation associated with each motor-driven pump are independent'from one another. Steam for the turbine- driven pump is supplied by steam generators B and C, from a point upstream of the main steam isolation valves, through. valve 3226. Each AFW pump is equipped with a continuous recirculation flow system, which prevents pump deadheading.

The discharges of the motor. driven pumps are cross connected, and they feed all three steam generators. ' The turbine-driven pum) also feeds all three

' steam generators, but through seperate lines. Each of t1ese six lines contains a flow-limiting orifice which ensures AFW flow will be provided to-l intact steam generators if one is depressurized. Each of the lines from the motor' driven pumps contains two normally-open isolation motor operated valves

.(MOVs)-3764A-F. Isolation valves in the lines from the. turbine-driven -pump are locked open manual valves'. Flow control valves 3227A-C and 3P28A-C are pneumatic. Each 1.ine contains multiple check valves to prevent leakage from

.the.feedwater lines, and the pump saction lines contain relief valves to prevent overpressurization in the case of check valve leakage.

2

SERUICEg tJRTER _a_

Mq 32th I NR,N p

rEE. To aana d * . sea 8 r ,

. so

. E .RC f 1 r

• _g 'n

.ts. F 1R

. N pe tn

>Q; _Q_ w,,h_ _M M1E

. t N

y-- -

p q 1 l,N3784E.17. 1 7

' I ^- '- TO MRIM

.s7a 222.a .=

• r

)sYuan lS W b=. 1 1

a , w . w. RECIRC+w e s .. t

&l l.. .:

,,s .

___.p' P-

.JE w.

nngg STERM SUFFLY d > m 1 r1> psn rEE. m namn

,r g,7. 322 d I l 1C 7, a g STERPt su -

W_ -,,

.,sc, ,

,ll ;9; l c,

_ ,_,_ . ,, ,,s.C p p,,,4 1

e .E-CE i

-. 4, . -

~ y,,.k,or- - - -

STERP9 SUFFLY O

RECIRC

i. -

"~

.16.

y ..

.C v.

BTORROE

- 2

, y A

5 58 l ' esse q 'm

- s

.,,C s- ,-

c :- m <F

-s -

CDU J.M* FARLEY

=c  ?+FROMSW4"" AUXLIARY FEEDWATER SYSTEM 3486 3226 FIGURE 2.1

A temperature monitoring system is provided to detect hot feedwater leakage through the system check valves which could cause steam binding of the pumps. Temperatures are monitored at the outlet and inlet of each AFW pump

, discharge check valve, and at the inlet of each feed line check valve.

Temperatures are recorded, and a control room alarm is provided to indicate

-leaks. The pump discharge valves are of the lift type which have proven

[ effective in practically eliminating the problem of check valve leak-by.

The condensate storage tank (CST) is the normal source of water for the AFW System and is required to store sufficient demineralized water to maintain the reactor coolant system (RCS) at hot standby conditions for 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> with steam discharge to atmosphere. All tank connections except those required for instrumentation, auxiliary feedwater pump suction, chemical analysis, and tank drainage are located above this minimum level. AFW suction may also be j switched to the service water system.

2.2 Success Criterion

_ System success requires the operation of at least one pump supplying rated flow to at least one.of the three steam generators.

2.3 System Dependencies The AFW system depends on AC and DC power at various voltage levels for motor operation, valve control, monitor and alarm circuits, and valve / motor control circuits. Instrument Air is required for several pneumatic control valves. Steam availability is required for the turbine-driven pump.

2.4 Qpatq11onal Constraints When the reactor is critical the J. M. Farley Technical Specifications require that all three AFW pumps and associated-flow paths are operable with each motor-driven pump powered from a different vital bus.- If one AFW pump becomes inoperable, it must be' restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the plant must shut down to hot standby within the next six hours. If two AFW pumps are inoperable, the plant must be shut down to hot standby within six si'

~

hours. With three AFW pumps inoperable, corrective action to restore at least one pump to operable status must.be initiated immediately. # -

The J. M. Farley Technical Specifications require a nine hour sup)1y of water to be stored in the CST (150,000 gallons). With the CST inopera)1e, the service water system may serve as backup supply for seven days before plant shutdown is required.

4

i 3.0 INSPECTION GUIDANCE FOR THE J. M. FARLEY AFW SYSTEM in this section the risk important components of the J. M. Farley AFW system are identified, and the important failure modes for these components are briefly described. These failure modes include specific human errors, design deficiencies, and types of hardware failures which have been observed to occur for these components, both at J. M. Farley and at PWRs throughout the nuclear industry. The discussions also identify where common cause failures have affected multiple, redundact components. These brief discussions identify specific aspects of system or component design, operation, maintenance, or testing for observation, records review, training observation, procedures  ;

review, or by observation of the implementation of procedures.

Table 3.1 is an abbreviated AFW system walkdown table which identifies risk-important components. This table lists the system lineup for normal (standby) system operation. Inspection of the identified components addresses essentially all of the risk associated with AFW system operation.

3.l' Risk Imoortant AFW Components and Failure Modes Common cause failures of multiple pumps are the most risk-important failure modes of AFW system components. These are followed in importance by single pump failures, level control valve failures, and individual check valve backleakage failures.

The following sections address each of these failure modes, in decreasing order of risk-importance. They present the important root causes of these component failure modes which have been distilled from historical records.

Each item is keyed to discussions in Section 5.2 where additional information on historical events is presented.

3.1.1 Multiple Pumo Failures-due to Common Cause The fol_ lowing listing summarizes the most important multiple-pump failure modes identified in Section 5.2.1, Common Cause Failures, and each item is keyed to entries in that section.

. Incorrect operator intervention into automatic system functioning,-

including improper manual starting-and securing of pumps, has caused failure of all pumps, including overspeed trip on startup, and inability to restart prematurely secured pumps. CCl.

.- Valve mispositioning has caused failure of all pumps. Pump suction, steam supply, and instrument isolation valves have been involved.

C02.

. Steam bindPg has caused failure of multiple pumps. This resulted from leakage of hot feedwater past check valves into a common i discharge header, with several valves involved including a motor-5 l

k operated discharge valve. (See item 3.1.8 below.) CC10. Multiple-pump steam binding has also resulted from improper valve lineups, and from running a pump deadheaded. CC3.

. Pump control circuit deficiencies or design modification errors have caused failures of multiple pumps to auto start, spurious pump trips during operation, and failures to restart after pump shutdown. CC4.

Incorrect setpoints and control circuit calibrations have also prevented proper operation of multiple pumps. C05.'

. Loss of a vital power bus has failed both the turbine-driven and one motor-driven pump due to loss of control power to steam admission valves or to turbine controls,. and to motor controls powered from the same bus. CC6. >

. Simultaneous startup of multiple pumps has caused oscillations of pump suction pressure causing multiple-pump trips on low suction pressure, despite the existence of. adequate static net positive suction head (NPSH). CC7. Design reviews have identified inadequately sized suction piping which could have yielded insufficient NPSH to support operation of more than one pump. CC8.

3.1.2 Turbine Driven Pumo Fails to Start or Run  !

Improperly adjusted and inadequately maintained turbine governors have caused pump failures. HE2. Problems include worn or loosened nuts, set screws, linkcges or cable connections, oil leaks and/or contamination, and electrical failures of resistors, transistors, diodes and circuit cards, and erroneous grounds and connections.

CF5.

Terry turbines with Woodward Model EG governors have been found to overspeed trip if full steam flow -is allowed on startup. Sensitivity can be reduced if a startup steam bypass valve is sequenced to open first. del.

Condensate slugs in steam lines have. caused turbine overspeed trip on startup. Tests repeated right after such a trip may fail to indicate the problem due to warming and clearing of the steam lines.

Surveillance should exercise all steam supply connections. DE2.

Trip and throttle valve (TTV) problems-(FCV-157) which have failed the turbine driven pump include physically bumping it, failure to reset it following testing, and failures-to verify control room indication of reset. HE2, Whether either the overspeed trip or TTV trip can be reset without resetting the other, indication in the control room of TTV position, and unambiguous local indication of an overspeed trip affect the likelihood of these errors. DE3.

6

! . Turbines with Woodward Model PG PL governors have tripped o.i overspeed when restarted shortly after shutdown, unless an operator has locally exercised the speed setting knob to drain oil from the governer speed setting cylinder (per procedure). Automatic oil dump valves are now available through Terry. DE4.

3.1.3 Motor Driven Pumo A or B Fails to Start or Rqn

. Control circuits used for automatic and manual pump starting are an important cause of motor driven pump failures, as are circuit breaker failures. CF7.

. Hispositioning of handswitches and procedural deficiencies have prevented automatic pump start. HE3.

. Low lubrication oil pressure resulting from heatup due to previous operation has prevented pump restart due to failure to satisfy the protective interlock. DES.

3.1.4 hen Unavailthle Due to MairdiraED._Orjurveillance

. Both scheduled and unscheduled maintenance remove pumps from operability. Surveillance requires operation with an altered line-up, although a pump train may not be declared inoperable during testing. Prompt scheduling and performance of maintenance and surveillance minimize this unavailability.

3.1.5 Air OnernLtd Flow Contra.LY.al.yn_Ea1LCl.ns.ed TD Pumo Trains: HV.] R E M MD Pump Trains: HV-3))]A.1[

These normally open air operated valves (A0Vs) control flow to the steam generators. They fail open on loss of Instrument Air.

. Control circuit problems have been a primary cause of f ailures, both at J. M. Farley and elsewhere. CF9. Valve failures have resulted from blown fuses, failure of control components (such as current / pneumatic convertors), broken or dirty contacts, misaligned or broken limit suitches, control power loss, and calibration problems. Degraded operation has also resulted from improper air pressure due to air regulator failure or leaking air lines.

. Out-of-adjustment electrical flow controllers have caused improper valve operation, affecting multiple trains of AFW. CCl2.

. Leakage of hot feedwater through check valves has caused thermal binding of flow control MOVs. A0Vs may be similarly susceptible.

CF2.

7

e Multiple flow control valves have been plugged by clams when suction switched automatically to an alternate, untreated source. CC9.

3.1.6 Motor Operated _Jsolation Val _yes f ail Closed MD Pumo Trains: MOV-3764 A-F

[ Complete SG lsolation: MOV-3350A.tk(

These normally open MOVs isolate flow to the steam generators. They fail as-is on loss of power, e Common cause failure of MOVs has resulted from failure to use electrical signature tracing equipment to determine proper settings L of torque switch and torque switch bypass switches. Failure to b calibrate switch settings for high torques necessary under design basis accident conditions has also been involved. CCll.

. Valve motors have been failed due to lack of, or improper sizing or i use of thermal overload protective devices. Bypassing and oversizing should be based on proper engineering for desian ha.ij1 conditions. CF4.

b e Out-of-adjustment electrical flow controllers have caused improper discharge valve opera +1on, affecting multiple trains of AFW. CCl2.

. Grease trapped in the torque switch spring pack of Limitorque SMB motor operators has caused motor burnout or thermal overload trip by I preventing torque switch actuation. CF8.

e Manually reversing the direction of motion of operating MOVs has overloaded the motor :ircuit. Operating procedures should provide cautions, and circuit designs may prevent reversal before each stroke is finisheu. DE7.

• Space heaters designed for preoperation storage have been found wired in parallel with valve motors which had not been environmentally qualified with them present. DE7.

3.1.7 Manual Suction or Discharoe Valves Fall Closed CST Discharge Valves TD Pumo Traint: Valves V005: V0158.E.: V017A.B.C: or V00lf.H.J MD Pumo inins: Valves V004A.B: V016A.B: V017D.E.F: or V001E.G.J lhese manual valves are normally locked open. For each train, closure of the first valve listed would block suction from CST. Closure of the second valve would block suction from the service water system. Closure of the third and fourth valves would block all pump discharge except recirculation to the i CSi.

f 8

L -

. Valve mispositioning has resulted in failures of multiple trains of AFW. CC2. It has also been the dominant cause of problems identified during operational readiness inspections. HEl. Events have occurred most of ten during maintenance, calibration, or system modifications, important causes of mispositioning include:

. Failure to provide complete, clear, and specific procedures for tasks and system restoration

. Failure to promptly revise and validate procedures, training, and diagrams following system modifications

. Failure to complete all steps in a procedure .

. Failure to adequately review uncompleted procedural steps after task completion

. Failure to verify support functions after restoration

. Failure to adhere scrupulously to administrative procedures regarding tagging, control and tracking of valve operations

. Failure to log the manipulation of sealed valves

. Failure to follow good practices of written task assignment and feedback of task completion information

. Failure to provide easily read system drawings, legible valve labels corresponding to drawings and procedures, and labeled indications of local valve position 3.1.8 Leakaae of Hot Feedwater throuch Check Valves:

At MFW Connections: MOV 3350A.B.C Discharae of Pumps A.B: 10 Pumo: Valves V002A.B: V003 ML Pumo Trains: V0020.E.G TD Pumo Trains: V0020.F.H

. Leakage of hot feedwater through several check valves in series has caused steam binding of multiple aum)s. Leakage through a closed level control valve in series wit) cieck valves has also occurred, as would be required for leakage to reach the motor driven pumps A and B. C010.

. Slow leakage last the final check valve of a series may not force upstream chec( valves closed, allowing leakage past each of them in turn. Piping orientation and valve design are important factors in achieving true series protection. CFl.

3.2 Risk Important AFW System Walkdown Table Table 3.1 presents an AFW system walkdown table including only components identified as risk important. This information allows inspectors to concentrate their efforts on components important to prevention of core damage. However, it is essential to note that inspections should not focus exclusively on these components. Other components which perform essential functions, but which are absent from this table because of high reliability or redundancy, must also be addressed to ensure that their risk importances are not increased. Examples include the (open) steam lead isolation valves upstream of 3226, and an adequate whter level in the CST.

9

TABLE 3.1 Risk Important Walkdown Table for J.M. Farley AfW System Components Required Actual

! Component 6 Component Name Position Position Electrical A Motor-Driven Pump Racked in/

Closed B Motor-Driven Pump Racked In/

l Closed Valve V501 CST Outlet Valve Locked Open V502 CST Outlet Valve Locked Open V001 A MDP A Discharge Valve Locked Open V001 B MDP Cross Connect Valve Locked Open V001 C MDP Cross Connect Valve Locked Open V001 0 MDP B Discharge Valve Locked Open V001 L AfW lsolation Valve Locked Open V001 F AfW lsolation Valve Locked Open V001 G AfW lsolation Valve Locked Open V001 H AFW lsolation Valve Locked Open V001 J AfW lsolation Valve Locked Open V001 K AfW isolation Valve Locked Open V002 TDP Recirculation Valve Locked Open V002 A TDP Main Stream Supply Valve Locked Open V002 B TDP Main Stream Supply Valve Locked Open V005 TOP Suction Valve Locked Open _

V006 MDP Recirculation Valve Locked Open V004 A MDP A Suction Valve Locked Open 10

TABLE 3.1. Risk Important Walkdown Table for J.M. Farley AFW System Components (Continued)

V004 B MDP B Suction Valve Locked Open V008 MDP Recirculation Valve Locked Open V010 TDP Recirculation Valve Locked Open ,.

V0015 A TDP Service Water Suction Valve Locked Open _

V0015 B TDP Service Water Suction Valve Locked Open V0015 E TDP Service Water Suction Valve Locked Open V0016 A MDP Service Water Suction Valve Locked Open V0016 B MDP Service Water Suction Valve Locked Open V017 A AFW lsolation Valve Locked Open V017 B AFW lsolation Valve Locked Open V017 C AFW lsolation Valve Locked Open V017 0 AFW isolation Valve Locked Open V017 E AFW ! solation Valve Locked Open V107 F AFW lsolation Valve Locked Open V0019 A MDP Recirculation Valve Locked Open V0019 B MDP Recirculation Valve Locked Open 3764 A MDP to S/G Open Isolation Valve 3764 B MDP to S/G Open isolation Valve 3764 C MDP to S/G Open isolation Valve 3764 0 MDP to S/G Open Isolation Valve 3764 E MDP to S/G Open Isolation Valve 11

l TABLE 3.1. Risk Important Walkdown Table for J.M. Farley AFW System Components (Continued) 3764 F MDP to S/G Open Isolation Valve 3227 A MDP Flow Opan Control Valve 3227 B MDP Flow Open Control Valve 3227 C MDP Flow Open Control Valve 3228 A TDP Flow Open Control Valve 3228 B TDP Flow Open _

Control Valve 3228 C TDP Flow Open Control Valve 3235 A TDP Steam Supply Valve Open 3235 B TDP Steam Supply Valve Open 3226 TDP Steam Admission Valve Closed 3406 TDP Throttle Trip Valve Open Supply Valves 3209 A Service Water Closed Supply Valves 3209 B Service Water Closed Supply Valves 3210 A Service Water Closed Supply Valves 3210 B- Service Water Closed Supply Valves 3216 Service Water Supply Valve Closed 3350 A Piping Upstream of Check Valve Cool .

I 3350 B Piping Upstream of Check Valve Cool 3350 C Piping Upstream of Check Valve Cool 12 I

l 4.0 GENERIC RISK INSIGHTS FROM PRAs PRAs for 13 PWRs were analyzed to identify risk important accident sequences involving loss of AFW, and to identify and risk-prioritize the component failure modes involved. The results of this analysis are described in this section. They are consistent with results reported by INEL and BNL (Gregg et al 1988, and Travis et al,1988).

4.1 Risk Imoortant Accident Seouences involvino AFW System f ailure loss of Power System

. A loss of offsite power is followed by failure of AFW. Due to lack of actuating power, the power operated relief valves (PORVs) cannot be opened preventing adequate feed and bleed cooling, and resulting in core damage.

. A station blackout fails all AC power except Vital AC from DC invertors, and all decay heat removal systems except the turbine-driven AFW pump. AFW subsequently fails due to battery depletion or hardware failures, resulting in core damage.

. A DC bus fails, causing a trip and f ailure of the power conversion system. One AFW motor driven pump is failed by the bus loss, and the turbine driven pump fails due to loss of turbine or valve control power. AFW is subsequently lost completely due to other failures.

Feed and bleed cooling fails because PORV control is lost, resulting in core damage.

Transient-Caused Reactor or Turbine Trio

. A transient caused trio is followed by a loss of the power conversion system (PCS) and AFW. Feed and-bleed cooling fails either due to failure of the operator to initiate it, or due to hardware failures, resulting in core damage.

Loss of Main Feedwater

. A feedwater line break drains the common water source for MFW and AFW. The operators fail to provide feedwater from other sources, and fail to initiate feed and-biced cooling, resulting in core damage.

A loss of main feedwater trips the plan, and AFW fails due to operator error and hardware failures. The operators fail to initiate feed and bleed cooling, resulting in core damage.

13

Steam Generator Tube Ruoture (SGTR)

. A SGTR is followed by failure of AFW. Coolant is lost from the primary until the refueling water storage tank (RWST) is depleted.

High pressure injection (HPI) fails since recirculation cannot be i

established from the empty sump, and core damage results.

4.2 Bjit_lpoortant ComDonent f ailure Modes The generic component failure modes identified from PRA analyses as =

important to AFW system failure are listed below in decreasing order of risk I importance. ~

l

1. Turbine-Driven Pump Failure to Start or Run.

2. Motor-Driven Pump Failure to Start or Run.

3. TDP or MDP Unavailable due to Test or Maintenance.

4. AFW System Valve f ailures -

e steam admission valves e trip and throttle valve e flow control valves e pump discharge valves e pump suction valves e valves in testing or maintenance.

5. Supply / Suction Sources e condensate storage tank stop valve e hot well inventory .

. suction valves.

In addition to individual hardware, circuit, or instrument failures, each of these f ailure modes may result from common causes and human errors.

Common cause failures of AFW pumps are particularly risk important. Valve failures are somewhat less important due to the multiplicity of steam generators and connection paths. Human errors of greatest risk importance involve: failures to initiate or control system operation when required; failure to restore proper system lineup after maintenance or testing; and failure to switch to alternate sources when required.

14

=

5.0 FAllVRE MODES DETERMINED FROM OPERATING EXPERIENCE This section describes the primary root causes of AFW system component failures, as determined from a review of operating histories at J. M. Farley and at other PWRs throughout the nuclear industry. Section 5.1 describes experience at J. M. Farley. Section 5.2 summarizes information compiled it m

a variety of NRC sources, including AE00 analyses and reports, information notices, inspection and enforcement bulletins, and generic letters, and from a variety of INPO reports as well. Some Licensee Event Reports and NPROS event descriptions were also reviewed individually. Finally, information was included from reports of NRC-sponsored studies of the effects of plant aging, which include quantitative analysis of AFW system failure reports. This information was used to identify the various root causes expected for the broad PRA based failure events identified in Section 4.0, resulting in the inspection guidelines presented in Section 3.0.

5.1 J. M. Farley Experience The AFW system at J. M. Farley had experienced failures of the AFW pumps, pump discharge flow control valves, the turbine steam admission and supply valves, turbine trip and throttle valve, pump discharge isolation valves, service water backup supply valves, and numerous system check valves. Failure modes include electrical, instrumentation and control, hardware failures, and human errors.

5.1.1. Multiole Pumo Failures In one event, both motor driven pumps failed to start due to a combination of mislabeled and mispositioned switches and open links in the balance of plant and hot shutdown panel cabinets.

5.1.2 Motor Driven Pumo failures There have been four additional events since 1977 which involved failure of the motor driven pumps during several modes of operation. Failure modes involved instrumentation and control circuit failures, pump hardware failures, and human failures during maintenance activities. Misalignment between pump and motor has resulted in high vibration making a pump inoperable. Improper or inadequate maintenance has resulted in high thrust bearing temperatures requiring pump shutdown and repair.

5.1.3 Turbine Driven Pumo failures More than twenty events since 1977 have resulted in decreased operational readiness of the turbine driven pump. Failure modes involved failures in instrumentation and control circuits, electrical faults, system hardware failures, and human errors. The turbine driven pump has tripped or failed to reach proper speed as a result of clogged lube oil lines, dirty limit switch contacts, misadjusted speed control settings, shorted relays in the speed 15

control circuit, and di-ty breaker contacts. Pump aging and wear has resulted in high bearing temperatures and on one occasion, pump seizure. Improper part . . .

replacement and inadequate maintenance activities have necessitated pump shutdown and repair.

5.1.4 Flow Control and Isolation Valve Failures More than forty-five events since 1977 have resulted in impaired operational readiness of the air operated flow control and motor operated isolation valves. Principal failure causes were equipment wear, instrumentation and control circuit failures, valve hardware failures, and  :

human errors. Valves have failed to operate properly due to blown fuses, failure of control components (such as 1/P convertors), broken or dirty .

contacts, misaligned or broken limit switches, control power loss, and operator calibration problems. Improper air pressure has caused degraded flow control valve operation in a number of events due to failure of an air regulator or leaking air line. Human errors have resulted in improper control circuit calibration and limit switch adjustment.

E 5.1.5 Turbine Driven Pumo Steam Supply. Admission. and Control Valves

!: More than thirty events since 1977 have resulted in degraded operation of . ,

steam isolation steam flow control valves. Failure types included failures due to aging. Deterioration of system hardware resulted in many occurrrences -

of valve binding, resulting in tripping of overload devices. Flow control valve seats were found to be steam cut, and isolation valves were found to be ,

steam cut, and isolation valves were found to leak due to cut or worn seats.

Dirty, worn, or misaligned limit switch contacts have prevented proper valve operation. Improper air pressure resulting from a failed regulator or air -

r.

line leak has caused failures. Misaligned or out of calibration control circuits and limit switches have resulted in a degraded operational condition.

Improper painting has plugged air exhaust ports preventing full stroking of a valve.

~

5.1.6 Check Valves .

C More than forty events of check valve failure have occurred since 1977.

In all but a few cases, normal wear and aging was cited as the failure mode, resulting in leakage.

~

5.1.7 Service Water Backun Suonly Valves  ; -

Five events have resulted in improper operation of the Service Water -

~

backup supply valves due to system wear and aging, in each case, the build up <

of mud and clams in the service water lines caused improper valve strnking.

5.2 Industry Wide Exoerience Human errors, design / engineering problems and errors, and component failures are the primary root causes of AFW System failures identified in a review of industry wide system operating history. Common cause failures, 6-f

1 which disable more than one train of this operationally redundant system, are highly risk significant, and can result from all of these causes.

This section identifies important common cause failure modes, and then provides a broader discussion of the single failure effects of human errors, design / engineering problems and errors, and component failures. Paragraphs presenting details of these failure modes are coded (e.g., CCl) and cross-referenced by inspection items in Section 3.0.

5.2.1 Common Cause failures The dominant cause of AFW system multiple train failures has been human error. Design / engineering errors and component failures have been less frequent, but nevertheless significant, causes of multiple train failures, h Human error in the form of incorrect operator intervention into automatic AfW system functioning during transients resulted in the temporary loss of all safety grade ATW pumps during events at Davis Besse (NUREG ll54, 1985) and Trojan (AE00/T416, 1983), in the Davis Besse event, improper manual initiation of the steam and feedwater rupture control system ($fRCS) led to overspeed tripping of both turbine driven AFW pumps, probably due to the introduction of condensate into the AfW turbines from the long, unheated steam supply lines. (The system had never been tested with the abnormal, cross-connected steam supply lineup which resulted.) in the Trojan event the operator incorrectly stop)ed both AFW pumps due to misinterpretation of MfW pump speed indication. T1e diesel driven pump would not restart due to a protective feature requiring complete shutdown, and the turbine driven pump tripped on overspeed, requiring local reset of the trip and throttle valve. In cases where manual intervention is required during the early stages of a transient, training should emphasize that actions should be performed methodically and deliberately to guard against such errors.

E Valve mispositioning has accounted for a significant fraction of the human errors failing multiple trains of AFW. This includes closure of normally open suction valves or steam supply valves, and of isolation valves to sensors having control functions. Incorrect handswitch positioning and inadequate temporary wiring changes have also prevented automatic starts of multiple pumps, factors identified in studies of mispositioning errors include failure to add newly installed valves to valve checklists, weak administrative control of tagging, restoration, independent verification, and locked valve logging, and inadequate adherence to procedures, lilegible or confusing local valve labeling, and insufficient training in the determination of valve position may cause or mask mispositioning, and surveillance which does not exercise complete system functioning may not reveal mispositionings.

A At ANO-2, both AFW pumps lost suction due to steam binding when they were lined up to both the CST and the hot startup/ blowdown demineralizer 17

ef fluent ( AEOD/C404,1984) . At Zion-1 steam created by running the turbine-driven pump deadheaded for one minute caused trip of a motor driven pump sharing the same inlet header, as well as damage to the turbine-driven pump (Region 3 Morning Report, 1/17/90). Both events were caused by procedural inadequacies.

E Design / engineering errors have accounted foi a smaller, but significant fraction of common cause failures. Problems with control circuit design modifications at farley defeated AfW pump auto-start on loss of main feedwater. At Zion-2, restart of both motor driven pumps was blocked by circuit failure to deenergize when the pumps had been tripped with an automatic start signal present (lN 82-01, 1982). In addition, AFW control circuit design reviews at Salem and Indian Point have identified designs where failures of a single component could have failed all or multiple pumps (IN 87-34, 1987).

E incorrect setpoints and control circuit settings resulting from analysis errors and failures to update procedures have also prevented pump start and caused camps to trip spuriously. Errors of this type may remain undetected despitt surveillance testing, unless surveillance tests model all types of system initiation and operating conditions. A greater fraction of instrumentation and control circuit problems has been identified during actual system operation (as opposed to surveillance testing) tha,1 for other types of failur,s.

E On two occasions at a foieign plant, failure of a balance-of-plant inverter caused failure of two AfW pumps in addition to loss of the motor driven pump whose auxiliary start relay was p arad by the invertor, the turbine driven pump tripped on overspeed because the governor valve opened, allowing full steam flow to the turbine. This illustrates the importance of assessing the effects of failures of balance of plant equipment which supports the operation of critical component s. The instrument air system is another example of such a system, h Multiple AfW pump trips have occurred at Millstone-3, Cook-1, Trojan and Zion-2 (IN 87-53, 1987) caused by brief, low pressure oscillations of suction pressure during pump startup These oscillations occurred despite the availability of adequate static NPSH. Corrective actions taken include:

extending the time delay associated with the low pressure trip, removing the trip, and replacing the trip with an alarm and operator action.

E Design errors discovered during AfW system reanalysis at the Robinson plant (IN 89-30, 1989) and at Millstone-1 resulted in the supply header from the CST being too s.nall to provide adequate NPSH to the pumps if more than one of the three pumps were operating at rated flow conditions. This could lead to multiple pump failure due to cavitation. Subsequent reviews at Robinson identified a loss of feedwater transient in which inadequate NPSH and flows less than design values had occurred, but which were not recognized at the time. Event analysis and equipment trending, as well as surveillance testing which duplicates service conditions as much as is practical, can help identify such design errors.

18

[_0]L Asiatic clams caused f ailure of two AFW flow control valves at Catawba-2 when low suction pressure caused by stariing of a motor driven pump caused suction source realignment to the Nuclear Service Water system. Pipes had not been routinely treated to inhibit clam growth, nor regularly monitored to detect their presence, and no strainers were installed. The need for surveillance which exercises alternative system operational modes, as well as complete system functioning, is emphasized by this event. Spurious suction switchover has also occurred at Callaway and at McGuire, although no failures resulted.

CC10. Common cause failures have also been caused by component failures (AE0D/C404,1984). At Surry-2, both the turbine driven pump and one motor driven pump were declared inoperable due to steam binding caused by backleakage of hot water through multiple check valves. At Robinson-2 both motor driven pumps were found to be hot, and both motor and steam driven pumps were found to be inoperable at different times. Backleakage at Robinson-2 passed through closed motor-operated isolation valves in addition to multiple check valves. At Farley, both motor and turbine driven pump casings were found hot, although the pumps were not declared inoperable, in addition to multi-train f ailures, numerous incidents of single train f ailures have occurred, resulting in the designation of " Steam Binding of Auxiliary feedwater Pumps" as Generic Issue 93. This generic issue was resolved by Generic Letter 88-03 (Miraglia, 1988), which required licensees to monitor AFW piping temperatures each shift, and to maintain procedures for recognizing steam binding and for restoring system operability.

C011. Common cause failures have also failed motor operated valves. During the total loss of feedwater event at Davis Besse, the normally-open AFW isolation valves failed to open after they were inadvertently closed. The failure was due to impro>er setting of the torque switch bypass switch, which prevents motor trip on tie high torque required to unseat a closed valve.

Previous problems with these valves had been addressed by increasing the torque switch trip setpoint - a fix which failed during the event due to the higher torque required due to high differential pressure across the valve.

Similar common mode failures of MOVs have also occurred in other systems, resulting in issuance of Generic Letter 89-10, " Safety Related Motor-0perated Valve Testing and Surveillance (Partlow,1989)." This generic letter requires licensees to develop and implement a program to provide for the testing, inspection and maintenance of all safety-related MOVs to provide assurance that they will function when subjected to design basis conditions.

CCl2, Other component f ailures have also resulted in AFW multi-train f ailures. These include out-of-adjustment electrical flow controllers resulting in improper discharge valve operation, and a failure of oil cooler cooling water supply valves to open due to silt accumulation.

5.2.2 Human Errors E The overwhelmingly dominant cause of problems identified during a series of operational readiness evaluations of AFW systems was human performance. The 19

majority of these human performance problems resulted from incomplete and incorrect procedures, particularly with respect to valve lineup information.

A study of valve mispositioning events involving human error identified failures in administrative control of tagging and logging, procedural compliance and completicn of steps, verification of support systems, and inadequate procedures as important. Another study found that valve mispositioning events occurred most often during maintenance, calibration, or modification activities. Insufficient training in determining valve position, and in administrative requirements for controlling valve positioning were important causes, as was oral task assignment without task completion feedback.

((LL Turbine driven pump failures have been caused by human errors in calibrating or adjusting governor speed control, poor governor maintenance, incorrect adjustment of governor valve and overspeed trip linkages, and errors associated with the trip and throttle valve. TTV-associated errors include physically bumping it, f ailure to restore it to the correct position after testing, and failures to verify control room indication of TTV position following actuation.

(([L Motor driven pumps have been failed by human errors in mispositioning handswitches, and by procedure deficiencies.

5.2.3 Desian/Encineerina Problems and Errors EL As noted above, the majority of AFW subsystem f ailures, and the greatest relative system degradation, has been found to result from turbine-driven pump failures. Overspeed trips of Terry TM(a) turbines controlled by Woodward TM(b) governors have been a significant source of these failures (AE00/C602,1986).

In many cases these overspeed trips have been caused by slow response of a Woodward Model EG governor on startup, at plants where full steam flow is allowed immediately. This oversensitivity has been removed by installing a startup steam bypass valve which opens first, allowing a controlled turbine acceleration and buildup of oil pressure to control the governor valve when full steam flow is admitted.

EL Overspeed trips of Terry turbines have been caused by condensate in the steem supply lines. Condensate slows down the turbine, causing the governor valve to open farther, and overspeed results before the governor valve can respond, after the water slug clears. This was determined to be the cause of the loss-of-all-AFW event at Davis Besse (AE00/602, 1986), with condensation enhanced due to the long length of the cross-connected steam lines. Repeated tests following a cold-start trip may be successful due to system heat up.

EL Turbine trip and throttle valve (TTV) problems are a significant cause of turbine driven pump failures (IN 84-66). In some cases lack of TTV (a) Terry is a registered trademark of the Terry Corporation, Windsor, CT, (b) Woodward is a registered trademark of the Woodward Govenor Company, Rockford, IL.

20

position indication in the control room prevented recognition of a tripped T1V. In other cases it was possible to reset either the overspeed trip or the TTV without reseting the other. This problem is compounded by the fact that the position of the overspeed trip linkage can be misleading, and the mechanism may lack labels indicating when it is in the tripped position (AEOD/C602,1986),

h Startup of turbines with Woodward Model PG PL governors within 30 minutes of shutdown has resulted in overspeed trips when the speed setting knob was not exercised locally to drain oil from the speed setting cylinder.

Speed control is based on startup with an empty cylinder. Problems have involved turbine rotation due to both procedure violations and leaking steam.

Terry has marketed two types of dump valves for automatically draining the oil aftershutdown(AE00/0602,1986).

At Calvert Cliffs, a 1987 loss of-offsite power event required a quick, cold startup that resulted in turbine trip due to PG PL governor stability problems. The short term corrective action was installation of stiffer buffer springs (IN 88 09, 1988).- Surveillance had always been preceded by turbine warmup, which illustrates the importance of testing which duplicates service conditions as much as is practical.

R Reduced viscosity of gear box oil heated by prior operation caused failure of a motor driven pump to start due to insufficient lube oil pressure.

Lowering the pressure switch setpoint solved the problem, which had not been detected during testing.

E Waterhammer at Palisades resulted in AfW line and hanger damage at both steam generators. The AfW spargers are located at the normal steam generator level, and are frequently covered and uncovered during level fluctuations.

Waterhammers in top-feed ring steam generators resulted in main feedline rupture at Maine Yankee and feedwater pipe cracking at Indian Point-2 (IN 84-32,1984).

E Manually reversing the direction of motion of an operating valve has resulted in MOV failures where such loading was not considered in the design (AE0D/C603,1986). Control circuit design may prevent this, requiring stroke completion before reversal.

E At each of the units of the South Texas Project, space heaters provided by the vendor for use in preinstallation storage of MOVs were found to be wired in parallel to the Class 1E 125 V DC motors for several AfW valves (IR 50-489/89 11; 50-499/89 11, 1989). The valves had been environmentally qualified, but not with the non-safety-related heaters energized.

5.2.4 Component Failures Generic issue ll.E.6.1, "In Situ lesting Of Valves" was divided into four sub issues (Beckjord,1989), three nf which relate directly to prevention of '

AfW system component failure. At the request of the NRC, in-situ testing of check valves was addressed by the nuclear industry, resulting in the EPRI 21

report, ' Application Guidelines for Check Valves in Nuclear Power Diants (Brooks,1988)." This extensive report provides information on check valve applications, limitations, and inspection techniques. In situ testing of MOVs was addressed by Generic Letter 89 10. " Safety Related Motor Operated Valve Testing and Surveillance" (Partlow,1989) which requires licensees to develop and implement a program for testing, inspection and maintenance of all safety-related MOVs. " Thermal Overload Protection for Electric Motors on Safety-Related Motor-Operated Valves - Generic Issue !!.E.6.1 (Rothberg, 1988)"

concludes that valve motors should be thermally protected, yet in a way which emphasizes system function over protection of the operator.

Cf1 The common cause steam binding effects of check valve leakage were identified in Section 5.2.1, entry C010. Numerous single-train events provide additional insights into this problem. In some cases leakage of hot MFW past multiple check valves in series has occurred because adequate valve seating pressure was limited to the valves closest to the steam generators (AEOD/C404, 1984). At Robinson, the pump shutdown procedure was changed to delay closing the MOVs until after the check valves were seated. At Farley, check valves were changed from swing type to lift type. Check valve rework has been done at a number of plants. Different valve designs and manufacturers are involved in this problem, and recurring leakage has been experienced, even after repair and replacement.

CE At Robinson, heating of motor operated valves by check valve leakage has caused thermal binding and failure of AFW discharge valves to open on demand.

At Davis Besse,-high differential pressure across AFW injection valves resulting from check valve leakage has prevented MOV operation (AEOD/0603, 1986).

C& Gross check valve leakage at McGuire and Robinson caused overpressurization of the AFW suction piping. At a foreign PWR it resulted in j a severe waterhammer event. At Palo Verde 2 the MFW suction piping was overpressurized by check valve leakage from the AFW system (AE00/0404, 1984).

Gross check valve leakage through idle pumps represents a potential diversion of AFW pump flow.

C R Roughly one third of AFW system failures have been due to valve operator failures, with about equal failures for MOVs and A0Vs. Almost half of the MOV '

failures were due to motor or switch failures (Casada, 1989). An extensive study of MOV events (AE00/0603, 1986) indicates continuing inoperability  :

problems caused by: torque switch / limit switch settings, adjustments, or i failures; motor burnout; improper sizing or use of thermal overload devices; i premature degradation related to inadequate use of protective devices; damage '

due to misuse (valve throttling, valve operator hammering); mechanical problems (loosened parts, improper assembly); or the torque switch bypass circuit improperly installed or adjusted. The study concluded that current methods and procedures at many plants are not adequate to assure that MOVs will operate when needed under credible accident conditions. Specifically, a surveillan'ce test which the valve passed might result in undetected valve inoperability due to component failure (motor burnout, operator parts failure, stem disc separation) or improper positioning of protective devices (thermal 22

overload, torque switch, limit switch). Generic Letter 8910 (Partlow,1989) has subsequently required licensees to implement a program ensuring that MOV switch settings are maintained so that the valves will operate under design basis conditions for the life of the plant.

EL Component problems have caused a significant number of turbine driven pump trips (AE00/0602, 1986). One group of events involved worn tappet nut faces, loose cable connections, loosened set screws, improperly latched TTVs, and improper assembly. Another involved oil leaks due to component or seal failures, and oil contamination due to poor maintenance activities. Governor oil may not be shared with turbine lubrication oil, resulting in the need for separate oil changes. Electrital component failures included transistor or resistor failures due to moisture intrusion, erroneous grounds and connections, diode failures, and a faulty circuit card.

E Electrohydraulic operated discharge valves have performed very poorly, and three of the five units using them have removed them due to recurrent failures. Failures included oil leaks, contaminated oil, and hydraulic pump failures.

E Control circuit failures were the dominant source of motor driven AFW pump failures (Casada,1989). This includes the controls used for automatic and manual starting of the pumps, as opposed to the instrumentation inputs.

Most of the remaining problems were due to circuit breaker failures.

R " Hydraulic lockup" of Limitorque TM(c) SMB spring packs has prevented proper spring compression to actuate the MOV torque switch, due to grease trapped in the spring pack. During a surveillance at Trojan, failure of the torque switch to trip the TTV motor resulted in tripping of the thermal overload device, leaving the turbine driven pump inoperable for 40 days until the next surveillance (AEOD/E702, 1987). Problems result from grease changes to EXXON NEBULA TM(d) EP 0 grease, one of only two greases considered environmentally qualified by Limitorque. Due to icwer viscosity, it slowly migrates from the gear case into the spring pack. Grease changeover at Vermont Yankee affected 40 of the older MOVs of which 32 were safety related.

Grease relief kits are needed for MOV operators manufactured before 1975. At Limerick, additional grease relief was required for MOVs manufactured since 1975. MOV refurbishment programs may yield other changeovers to EP 0 grease.

E for AFW systems using air operated valves, almost half of the system degradation has resulted from failures of the valve controller circuit and its instrument inputs (Casada, 1989). Failures occurred predominantly at a few units using automatic electronic controllers for the flow control valves, with the majority of failures due to electrical hardware. At Turkey Point 3, controller malfunction resulted from water in the Instrument Air system due to.

maintenance inoperability of the air dryers.

(c) Limitorque is a registered trademark of the limitorque corporation, Lynchburg, VA.

(d) Nebula is a registed trademark of the Exxon Corporation, Houston, TX.

23

,%,,,,,,=,,,-

((12 For systems using diesel driven pumps, most of the failures were due to start control and governor speed control circuitry. Half of these occurred on demand, as opposed to during testing (Casada, 1989).

LElli for systems using A0Vs, operability requires the availability of instrumentAir(IA),-backupair,orbackupnitrogen. However, NRC Maintenance Team Inspections have identified inadequate testing of check valvos isolating the safety-related portion of the IA system at several utilities (letter, Roe to Richardson). Generic letter 8814 (Miraglia,1988), requires licensees to verify by test that air-operated safety related components will perform as expected in accordance with all design basis events, including a loss of normal IA.

24

l l

6.0 REFERENCES

Beckjord, E. S. June 30, 1989. Closeout of Generic Issue ll.E.6.1. 'In Situ Testina of Valves". Letter to V. Stello, Jr., U.S. Nuclear Regulatory Commission, Washington, DC.

Brooks, B. P. 1988. Aeolication Guidelines for Check Valves in Nuclear Power Plants. NP 5479, Electric Power Research Institute, Palo Alto, CA.

Casada, D. A. 1989. Auxiliary Feedwater System Aoina Study. Volume 1.

Operatina Experience and Current Monitorina Practices. NUREG/CR-5404. U.S.

Nuclear Regulatory Commission, Washington, DC.

Gregg, R. E. and R. E. Wright. 1988. Agnendix Review for Dominant Generic Contributors. BLB 31-88. Idaho National Engineering Laboratory, Idaho f alls, Idaho.

Miraglia, F. J. February 17, 1988. Resolution of Generic Safety Issue 93.

" Steam Bindina of Auxiliary feedwater Pumos" (Generic letter 88-03). U.S.

Nuclear Regulatory Commission, Washington DC.

Hiraglia, F. J. August 8, 1988. Instrument Air _ Sucoly System Problems Affectina Safety-Related Eouioment (Generic letter 88 14). U.S. Nuclear Regulatory Commission, Washington, DC.

Partlow, J. G. June 28, 1989. Safety-Related Motor-0perated Valve Testina and Surveillance (Generic letter 89-10). U.S. Nuclear Regulatory Commission, Washington, DC.

Rothberg, O. June 1988. Thermal Overload Protection for Electric Motors on Safety-Related Motor 0perated Valves Generic Issue ll.E.6.1. NUREG-1296.

U.S. Nuclear Regulatory Commission, Washington, DC.

Travis, R. and J. Taylor. 1989. Development of Guidance for Generic.

Functionally Oriented PRA-Based Team Insoections for BWR Plants-Identification of Risk-Imoortant Systems. Components and Human Actions. TLR-A-3874-TGA Brookhaven National Laboratory, Upton, New York.

AE00 Reports AEOD/0404. W. D. Lanning. July 1984. Steam Bindina of Auxiliary Feedwatar Pumos. U.S. Nuclear Regulatory Commission, Washington, DC.

AE0D/C602. C. Hsu. August 1986. Operational Exoerience involvina Turbine Oversoeed Trios. U.S. Nuclear Regulatory Commission, Washington, DC.

AE00/0603. E. J. Brown. December 1986. A Review of Motor-Ooerated Valve Performance. U.S. Nuclear Regulatory Commission, Washington, DC.

AEOD/E702. E. J. Brown. March 19, 1987. MOV Failure Due to Hydraulic lockuo From Excessive Grease in Sorina Pack. U.S. Nuclear Regulatory Commission, Washington, DC.

25

AE0D/T416. January 22, 1983. Loss of ESF Auxiliary feedwater Pumo Capability at Tro.ian on January 22. 1983. U.S. Nuclear Regulatory Commission, Washington, DC.

Information Notices IN 82-01. January 22, 1982. Auxiliary feedwater Pumo Lockout Resulting from Westinohouse W-2 Switch Circuit Modification. U.S. Nuclear Regulatory Commission, Washington, DC.

IN 84-32. E. L. Jordan. April 18, 1984. Auxiliary feedwater Sparaer and Pipe Hanaar Dama.gg. U.S. Nuclear f.egulatory Commission, Washington, DC.

IN 84-66. August 17, 1984. Undetected Unavailability of the Turbine-Driven Auxiliary f eedwater...irain. U.S. Nuclear Regulatory Commission, Washington, DC.

IN 87-34. C. E. Rossi. July 24, 1987. S_ ingle _lailures in Auxiliary Legshfater Systems. U.S. Nuclear Regulatory Commission, Washington, DC.

IN 87-53. C. E. Rossi. October 20, 1987. Auyiliary feedwater Pumo Trios Resultino from Low Sug. tion Pres ar_c. U.S. Nuclear Regulatory Commission, Washington, DC.

IN 88-09. C. E. Rossi. March 18, 1988. Reduced Reliability of Steam-Driven Auxiliary feednier Pumos Caused by_lnlljtbilit.y of Woodward PG-PL Tyne Egyernors. U.S. Nuclear Regulatory Commission, Washington, DC.

IN 89-30. R. A. Azua. August 16, 1989. Robinson Unit 2 Inadeouate NPSH of Auxiliary feedwater Pumos. Also, Event Notification 16375, August 22, 1989.

U.S. Nuclear Regulatory Commission, Washington, DC.

Inipection Report IR 50-489/89-11; 50-499/89-11. May 26, 1989. South Texas Proiect Inspection Renar1 U.S. Nuclear Regulatory Commission, Washington, DC.

NVELG_.Repri NUREG-ll54. 1985. Lass of Main aDL Auxiliarv feedwater Event at the Davis Besse Plant on June 2 ml1%5 U.S. Nuclear Regulatory Commission, Washington, 26

NUREG/CR 5617 1 DISTRIBUTION PNL-7349

)

No. of No. of Copies Copies ,

OFFSITE 4 JM Farley Resident inspector Office U.S. Nuclear Regulatory Commission 0FFSITE U.S. Nuclear Regulatory E. G. Adensam Commission - Region 5 OWFN 14 B20 R. Pate A. El Bassioni A. D. Toth OWFN 10 E4 R. Zimmerman L. F. Miller W. D. Beckner D. F. Kirsch OWFN 10 E4 J. H. Taylor K. Campe Brookhaven National Laboratory  ;

OWFN 1 E4 Bldg. 130 Upton, NY 11973 J. Chung OWFN 10 E4 R. Travis Brookhaven National Laboratory F. Congel Bldg. 130 OWFN 10 E2 Upton, NY 11973 M. C. Cullingford R. Gregg OWFN 12 618 EG&G Idaho, Inc.

P.O. Box 1625 S. T. Hoffman Idaho Falls, ID 83415 OWFN 14 B20 Dr. D. R. Edwards 10 S. M. Long Professor of Nuclear Engineering OWFN 10 E4 University of Missouri - Rolla Rolla, MO 65401 2 K. S. West OWFN 12 H8 ONSITE U.S. Nuclear Regulatory 37 Pacific Northwest Laboratory Commission - Region 1 S. R. Doctor S. Collins L. R. Dodd W. F. Kane i B.G.F.Harrison Gore (5) (5)

D.

U.S. Nuclear Regulatory R. Pugh (5)

Commission - Region 2 N. T. Saltos W. B. Scott F. Jape B. D. Shipp 1 A. Herdt F. A. Simonen T. Peebles T. Vo Vo (10)

Publishing Coordination Technical Report File (5)

Distr-1

w ay.ono u a scuctIna atout atoav cowaisv4 i gt,wgi an ~~

E*EE BIBLIOGRAPHIC DATA SHEET

<3 ,,,,ve,.,. ., IURDG/CR-5617

titta Amo svotiTLt 9 Auxiliary Peedvater System Risk-lased Inspection Guide for 3 cats atront evousato the J. M. Farley Nuclear Power Plant .3 , , ....,

_0ctpbgr _ 1990 e eiw on onAwt wvveta L1310 s autMoRisi 6 tYPt of REPoR1 T. V. Vo, R. Pugh, B. T. Gore, D. G. Harrison Technical 7 Pt R soo Covi R 6 o ,,.e o.en, 1/90 - 9/90

,c ,, ..,. , .

m o, - - v s ., . ,,,

o Pyrgng gwis ation - = AwI amo Acomass ,,, =.c Pacific Northwest Laboratory P.O. Ibx 999 Richland, WA 99352 w ., ,,, ..c % o,, ., ,, y a =,,, . ,, c-e seoggnoawitavion - 8aua ano aoontss ,,, =.c Division of Radiation Protection and Driergency Preparedness Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Conunission Washington, DC 20555 10 SUPPLEW4NtaAY NOT1s i1. A8stM Act (Jan e er .e.,

In a study sponsored by the U.S. Nuclear Regulatory Commission (NRC), Pacific Northwest Laboratory has developed and applied a methodology f or deriving plant-specific risk-based inspection guidance for the auxiliary feedwater (MV) system at pressurized water reactore that have not undergone probabilistic risk ascessment (PRA). This methodology uses existing PRA results and plant operating experience information. Exieting PRA-based inspection guidance recently developed for the NRC for various plants was used to identify generic component failure modes. This information was then combined with plant-specific and industry-wide conponent information and failure data to identify failure nodes and failure mechanismr, for the MM system at the selected plants. J. M. Parley was selected as the second plant for study. The product of this ef fort is a prioritized listing of MM f ailures which have occurred at the plant and at other PWRs. This listing is intended for use by NRC inspectors in the preparation of inspection plans addressing MM risk-important conponents at the J. M.

Parley plant.

is an y wonoseotscairtons it.. . , ,.. . , , is...o ,6avuariuno PRA Unlimited

'a " cua" ' c6*"d 'c^ "o

Risk Analysis PRA Applications Far1ey Onclassified

">= a'a-"

Camponents important to risk Unclassified 16 NUMtta of PAGts 16 PRICE esMC 80RW 3Jn il 49'

L 3,.

~

q ,. ,

~n s -

, ,t- 4

,, [. ' y.w

}' A ' '! (, j !

. < t- l '

J,4 q? h ,' / '

i3 k ,I ' ,., .} i r

' 9;[ . . . - N' *

. .. . . . . , t UNITED STATES : l. ['4 . . '

mm ,m,x,,,um wi

NUCLEAR QE3,4.MORY s4MMISS13N 'ose unis em .

WASHINFl.ON, D.Cn'10titi6 '

W" y . . p. - ,

.yt s> s .y-a ene w o n, nc ,. y

%.  : O TICIAL SUSINESS1 W"

.,4 1.

Np- PENAL M FOR PRIVATE USt. 4300 JN t.

O'(a hg; se p %d 4

9 ?

., . -ti y

+1 ':+4*', ,

j

^ ' ( h IP ,

Tv- ,  :,? ,

L .

]t ye. -

b

, . i.

p h6 h;y  ; p" ~ m a ? _ a l ,, T ,

pl

[ ' ' '

,9 w, '

s n.

5i

, i  !

3 1

.'g a 4

1

/ ,/ <

s st. j; ',4 L 1 f' t Y T g

,,\s' .$

[ 1. <[

N

.. j 4

3 4 )

j . Il >f (

g.i,

. d ';- r s

'.[,

$./,u -6

, , ,. I

's.  ;

r.---y

'_'1h .. ti e;!(

,..  ;  ; , s

, 4 ,

-S,y

~

'l Q [ .Q1 !;' y ...; 3, ,[.j .l' <

^

[ '.,  :)i

'0 3

v- .

.,;p - 14 m

< r-

-/w, , f. i .

'7 1b;-l.. ; a ,i;, >

, > a,

,- ' W ap

, 4 ,s ,

% .pf b '$^ , ,s p '<'r' ,,.j 4 . .

8_ '

W

g s est-jhh ' ,h e ;f I ^ . - . ik x

- <(f'.

,ie -ts ;s . ..

. , .!9  ;< , ' c i.' ' , t ! : ..

Y p

b. Af . 1;- t o 9q' o. rgs t i

' x r,- '

, y . c:

s' t 3. j ,z ' . . .. h{ f; . ni ,-'G>- s; ,

i- ,.

o 1 _

4 .,-.

i

,f h(f 4

=,.'.o. '. i a' , y, +v' S ' ..

ye.

m Q)' s +

[(( '#.

U[b; ,~r in, g[', \ :p* s

-, , s s

s. s j ;, ,

.t.,.c....}<'l g i '( 4 4 L

,-,  : J =das s . i 3

I 't * ' j. %5< (,s I I.., f.

-  ; si,

,')

g ,3.( QlD J t l ' , gu go ,

7 -

.: . n g

,,,;:1,c ' ,.,p ,. .,

.g r, ... ,

, 3,.. ,

,1 y: .,

i n .,

1

%. ue t :41

-o , ,

p . a. . -

. 'N"O 7', ,  : . y= < % ,' h , , n 4', , ,W , i r

~r' jf

• N  !

l )'l 1

1. 1. 3 ,.

, ;/jI . . , , 9 ,NM 2 "P[

]Q;[o. t' k M.f , di , l

• q..

,o1 s. p t ., ., . ; e. . . }e, ._ q .Q s es :, ,', . .. 8 c - p t llg hb. - i ' x hl ;5![.c 4 e il ' Pg+y i , ' . s [.s{ ,' . i ? j.[) - 3 e (j. y ' 4- 3 g i + - j' k-.,' i g 's 4 [' pf tf ' 9: s m -h~ik-,L p) h g x+[  ;,{ t j 8 - '[' 1 , k.' : t' Y 4 34

• ~

_' . /(~' >x, iy , + lI* s;  ;. E g .r$ ,' 7I4 '(.

l -

t i*',.' ' s Q' 2 'a' .j (' '.-f _'. fI fl j ' . ) ,' 's'" ' =d.' ' ' [' c.., j -w ' u' ' * 'k? i . t. ( < l t b i ( '( ' = - h '. i. .- ) , 'i , [j.i I . g s p  ! ', i .U e.s i ( .n: i If ^  ; 2k p .,s.q - 4

U [f'

, t , , t 1 , <\ . J' (' ; 4i 1 J f..-. __d_ i s 9 i' .- -