ML20083C685

Operating Experience Feedback Report - TURBINE-GENERATOR Overspeed Protection System.Commercial Power Reactors

ML20083C685
Person / Time
Issue date:	04/30/1995
From:	Ornstein H NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
References
NUREG-1275, NUREG-1275-V11, NUDOCS 9505180319
Download: ML20083C685 (117)

Text

{{#Wiki_filter:--- NUREG-1275 Vol.11 Operating Experience Feedback ' Report Turbine-Generator Overspeed Protection Systems I ! Commercial Power Reactors U.S. Nuclear Regulatory Commission Office for Analysis and Evaluation of Operational Data II.L Ornstein 1 $$ atooq a i %,,,./ 3885288!!'o 1275 R PDR

y AVAILABILITY NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources: 1. The NRC Public Document Room, 2120 L Street, NW., Lower Level, Washington, DC 20555-0001 o 2. The Superintendent of Documents, U.S. Government Printing Office, P. O. Box 37082. Washington, DC 20402-9328 3. The National Technical Information Service, Springfield, VA 22161-0002 Although the listing that follows represents the majority of documents cited in NRC publica-tions, it is not intended to be exhautrive. Referenced documents available for inspection and copying for a fee from the NRC Public Document Room sm:lude NRC correspondence and internal NRC memoranda; NRC bulletins, circulars, information notices, inspection and investigation notices; licensee event reports; l vendor reports and correspondence; Commission papers; and applicant and licensee docu-ments and correspondence. The follow:ng documents in the NUREG series are available for purchase from the Government Printing Office: formal NRC staff and contractor reports, NRC-sponsored conference pro-ceedings, intemational agreement reports, grantee reports, and NRC booklets and bro-chures. Also available are regulatory guides, NRC regulations in the Code of Federal Regula-tions, and Nuclear Regulatory Commission issuances, k Documents ava.ilable from the National Technical information Service include NUREG-series reports and technical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission, i i Documents available from public and special technical libraries include all open literature items, such as books, journal articles, and transactions. Federal Fegister notices, Federal and State legislation, and congressional reports can usually be obtained from those libraries. Documents such as theses, dissertations, foreign reports and translations, and non-NRC con. ference proceedings are available for purchase from the organization sponsoring the publica-tion cited. Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Administration, Distribution and Mail Services Section, U.S. Nuclear Regulatory Commission, Washington DC 20555-0001. Copies of industry codes and standards used in a swstantive manner in the NRC regulatory process are maintained at the NRC Library, Two White Flint North,11545 Rockville Pike, Rock-ville, MD 20852-2738, for use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards institute 1430 Broadway, New York, NY 10018-3308.

i-NUREG-1275 Vol.11 i Operating Experience Feedback Report Turbine-Generator Overspeed Protection Systems l Commercial Power Reactors Manuscript Completed: October 1994 Date Published: April 1995 i H.L Ornstein Safety Programs Division Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 .r "%. (,M..... )., i i l

i l AUSTRACT This report presents the results of the U.S. higher than previously thought and that the Nuclear Regulatory Commission's Office for bases for demonstrating compliance with Analysis and Evaluation of Operational Data NRC's General Design Criterion (GDC) 4, (AEOD) review of operating experience of " Environmental and dynamic effects design main turbine-generator overspeed and over-bases," may be nonconservative with respect speed protection systems. It includes an to the assumed frequency. GDC 4 requires indepth examination of the turbme overspeed structures, systems, and components impor-event which occurred on November 0,1991, at the Salem Unit 2 Nuclear Power Plant. It also tant to safety to be appropriately protected provides information concerning actions taken against dynamic effects that may result from by other utilities and the turbine manufac-equipment failures and from events and turers as a result of the Salem overspeed ronditions outside the nuclear power plant. In event. AEOD's study reviewed operating pro. addition, compliance with GDC 4 may not cedures and plant practices. It noted differ-have considered fires and flooding associated cnces between turbine manufacturer designs with destructive turbine overspeed events. and recommendations for operations, main. While turbine overspeed protection is only tenance, and testing, and also identified part of the criteria for meeting ODC 4 and significant variations in the manner that compliance may be accomplished in other individual plants maintain and test their ways, improvements in maintenance and turbme overspeed protection systems. testing as noted in the study can enhance the reliability and operability of the main turbine-AEOD's study provides insight into the generators and their overspeed protection shortcomings in the design, operation, mainte-nance, testing, and human factors associated systems, and thus, raise confidence that the P ants comply with GDC 4 by providmg l with turbine overspeed protection systems. assurance that turbine overspeed event Operating experience indicates that the initiator frequency is consistent with frequency of turbine overspeed events is assumptions. iii NUREG-1275, Vol.11

3 a l i ' CONTENTS Puge t i ABSTRACT........................................................................ iil r EXEC UTIVE S U MM ARY............................................................ ix FOREWORD...................................................................... xiii ABB REVI ATI ON S.................................................................. xv 1 I NTR O DU CTI O N.............................................................. 1 t-2 HI STO RI CAL R EVIEW........................................................ 1 3-SALEM UNIT 2 OVERSPEED EVENT.......................................... .7 3.1 Description of the Event..................................................... 7 3.2 Licensee's Response to the Event............................................. 11 33 NRC Responses to the Event................................................. 15 8 3.3.1 Immediat e Actions.................................................... 15 3.3.2 Longer Term Actions................................................. 16 3.4 Root Causes of the Event.................................................. 16 3.4.1 Equ i p me nt Failu re.................................................... 17 3.4.2 Inadequate Preventive Maintenance................................... 17 3.4.3 Inadequate Review and Feedback of Operational Experience.............. 17 3.4.4 - Inadequate Smveillance Testing........................................ 17 3.4.5 Human Factors Deficiencies in Front Standard Testing.................. 17 3.4.6 Te st Leve r............................................................ 17 4 NUCLEAR INDUSTRY INITIATIVES AFTER THE SALEM UNIT 2 OVER S P EED EVENT........................................................... 18 4.1 Public Service Electric and Gas Company at Salem Units 1 and 2................ 18 4.2 Public Service Electric and Gas Company at Hope Creek........................ 18 4.3 Westinghouse Power Generation Business Unit................................. 19 4.4 General Electric Power Generation Division................................... 21 4.5 Nuclear Power Plant Insurers................................................. 22 4.6 Wat erford Unit 3............................................................ 23 4.7 Comanche Peak Units 1 and 2 and Siemens/Allis Chalmers 'Ibrbines............. 25 4.8 Specialized Turbine Overspeed Protection System Solenoid-Operated %1ves...... 26 5 RECENT OPERATING EXPERIENCE........................................... 26 5.1 D i a bl o Ca nyon............................................................. 26 5.1.1 Diablo Canyon Unit 1 Turbine Overspeed Event (September 12,1992)...... 26 5.1.2 Diablo Canyon Unit 2 Test Handle 'Ilrip (January 30,1993)................. 28 5.2 St. Lucie Unit 2............................................................. 30 5.2.1 St. Lucie Unit 2 Thrbine Overspeed Event (April 21, 1992)................ 30 v NUREG-1275. Vol.11

d = CONTENTS (continued) Pkge 5.2.2 St. Lucie Unit 2 Spurious Erbine Dip During Solenoid-Operated Valve Testing (July 10, 1992)............................................ 32 53 Big Rock Poi nt.............................................................. 34 53.1 Big Rock Point Common-Mode Bypass Valve Failures.................... ~34 - 53.2 Big Rock Point Repetitive Failures of the 'Ibrbine Dip System............. 34 533 Big Rock Point long.'Ibrm Unavailability of Emergency Governor Exerciser..................................................... 38' 5.4 Palisades Common Mode Failure of Six Steam Admission Valves................. 38 5.5 Comanche Peak Unit 1 Inadequate Followup to 'Ibrbine Overspeed Protection System 'Ibst Failure (May 16, 1992).................................. 40 6 FINDINGS..................................................................... 41 6.1 Complacency 'Ibward 'Ibrbine Overspeed...................................... 41 6.2 Testing That Defeats Diversity............................................... 41 63 Nonrevealing Surveillance 'Ibsting............................................. 42 6.4 Inadequate Solenoid Operated Valve Maintenance.............................. 42 6.5 Electrohydraulic Control System Fluid Qu'ality................................. 42 6.6 Electrohydraulic Control System Fluid Incompatibility.......................... 44 6.7 Human Factors Deficiencies.................................................. 45 6.8 Surveillance Testing Required By Plant 'Ibchnical Specifications.................. 45 7 CON CLU SI ONS................................................................ 45 7.1 M is siles.................................................................... 45-7.2 Fires. Explosions, Flooding................................................... 46 73 Common-Mode Failure Precursors........................................... 46 7.4 Industry Response to the Salem Unit 2 Overspeed Event........................ 46 7.4.1 Ove rvi ew............................................................. 46 7.4.2 Erbine Manufacturer Actions.......................................... 47 7.43 Nuclear Utility Actions................................................ 47 7.5 Dip Test Lever Human Factors Deficiency..................................... 47 7.6 Overestimate of Design Ufe of hrbine Overspeed Protection System Com pon e n ts................................................................ 47 7.7 Nonconservative Probabilistic Assessments.................................... 48 7.8 Dends in hrbine Overspeed Protection System Testing......................... 48 7.9 Procedures for Shutting Off Steam Supply..................................... 48 7.10 S. c u n a ry................................................................... 48 8 RE FEREN C ES................................................................. 49 NUREG-1275. Vol.11 vi 1 i

i CONTENTS (continued) APPENDICES Page A LIST OF PLANTS BY SUPPLIER-REACTOR, TURBINE, GENERATOR B

SUMMARY

OF SERT REPORT RECOMMENDATIONS C CUSTOMER ADVISORY LETTER 92-02, " OPERATION, MAINTENANCE. TESTING OF, AND SYSTEM ENHANCEMENTS TO TURBINE OVERSPEED PROTECTION SYSTEM" D AVAILABILITY IMPROVEMENT BULLETIN 9301, " STEAM TURBINE OVERSPEED PROTECTION SYSTEM" E HAMMER VALVE F OPERATION & MAINTENANCE MEMO 108, " MAINTENANCE OF MAIN STOP VALVES & REHEAT STOP VALVES" FIGURES 1 W-estimated probability of missile ejection from Salem Unit 2 turbine as a function of valve test interval 5 2 Schematic of Salem turbine contres cystem prior to November 1991.. 9 3 Schematic of Salem type (generic'. emergency and overspeed protection control system prior to November 1991... 10 4 Photograph: Salem Unit 2, showing holes in turbine casing 12 5 Photograph: Salem Unit 2. showing damage to low-pressure turbine... 13 6 Photograph: Salem Unit 2, showing condenser damage.. 14 7 Proposed improvement of Salem type (generic) emergency and overspeed protection control system...... 20 8 Waterford Unit 3 turbine control system................... 24 9 Diablo Canyon turbine steam admission valves............ 27 10 Photographs: Salem Unit 2 front standard panel (original and modified)........... 29 11 St. Lucie block for testing EHC system SOVs independently 33 12 Big Rock Point-Origit al hand-trip solenoid valve................... 37 13 Big Rock Point-Replacement hand. trip solenoid valve.. 39 14 Cross-sectional drawing of Parker Hannifin SOV MRFN 16MX 0834.... 43 vii NUREG-1275, Vol.11

l CONTENTS (continued) TABLES Page 4 1 Tbrbine system reliability criteria 2 U.S. nuclear plant turbine overspeed events................................. 6 3 Precursors to the Salem Unit 2 overspeed event........ 8 4 Major modifications made at Salem Units 1 and 2........ 18 5 7brbine overspeed protection system enhancements made at Hope Creek... 19 6 Big Rock Point failure to trip history before 1992.. 35 NUREG-1275. Vol.11 viii

1 EXECUTIVE

SUMMARY

On November 9,1991, the Salem Unit 2 overspeed events can result in discharges of nuclear power plant experienced a destructive flammable, explosive fluids, and collateral turbine overspeed. The event did not result in flooding. The Salem event reised questions any release of radioactivity or personnel about the adequacy of plant protcetion from injury; however, it did cause extensive damage explosions, fires, and flooding which could to nonsafety-related equipment, and it did result from turbine overspeed events. For-result in a 6-month outage. Safety-related tunately, the exceptional dedicated fire fight-equipment needed to cope with an accident or ing group and the "open" turbine building at shut down the plant was not affected. The Salem helped minimize the effects of the fires overspeed occurred as a direct result of and explosions which occurred. simultaneous common-mode failures of three solenoid-operated valves in the turbine's Although many utilities, including the Salem overspeed protection system. As a result of licensee, have made recent submittals to the the event, a comprehensive review and eval-NRC advocating the position that reducing uation of turbine-generator overspeed protec-the frequency of turbine overspeed protection tion systems at U.S. light-water reactors was system tests will reduce the likelihood for performed by AEOD. destructive overspeed events, the turbine manufacturers have emphasized the necessity AEOD conducted extensive reviews of the for frequent smve,illance testing of turbine Salem event, its causes, and the corrective overspeed protection systems. However, tur-actions taken at Salem and at other nuclear bme overspeed protection system testing as plants, actions taken by major turbine manu-Performed at many plants is mcapable of facturers and by the U.S. Nuclear Regulatory revealm, g the degradation and failure of re-Commission in response to the Salem event. dundant components as experienced at Salem. Furthermore, the turbine overspeed protection system testing required by many nuclear AEOD's review found that there were many plants' Technical Specifications focuses only precursors to the Salem overspeed event. on possible sticking of steam admission or However, before the Salem event, the potential bypass valves and does not address the elec-for c,ompromismg the diverse and redundant trohydraulic control system or its associated turbme overspeed protection systems resultmg hardware. m a destructive overspeed event was con-sidered highly unlikely. The manufacturer of As a result of the Salem event, there has been the Salem Unit 2 mam turb,ne had previously a heightened awareness of the potential for i estimated the likelihood of a turbm, e missile main turbine overspeed. Many utilities have ejection event (primarily caused by a turb, e modified their turbine overspeed protection m overspeed) to be on the order of 10-7 to 104 system maintenance and testing practices and per turbme-year which is well below the NRC the major turbine manufacturers have given staff's evaluation enteria of 10-5 to 10 per their equipment owners guidance to reduce 4 turbine-year. However, the pomt estimate for the likelihood of another destructive turbine a destructive turb,me overspeed event based overspeed event. However, our sample survey on operating experience (one failure at Salem) found that many plants have not effectively is much higher, about 10-3 per turbine-year. implemented the turbine manufacturers' NRC's concerns for turbine hazards have historically focused upon large, high energy AEOD performed indepth examinations of missiles that would damage safety equipment. common-mode equipment failures, and The Salem event (as well as other events) deficiencies in operating, maintaining and f demonstrated that the vibration from turbine testing turbine overspeed control systems, ix NUREG-1275, Vol.11 f.

The root causes of many turbine overspeed Missiles." These analyse's were taken as the protection system malfunctions were: bases to assure that U.S. light-water reactors meet the NRC's requirements that structures, lack of understanding of the sensitivity of systems and components important to safety e hydraulic oil to contaminants be appropriately protected against the effects of missiles that could result from equipment lack of understanding of the limited failures in accordance with the NRC's General e design life of solenoid-operated valves Design Criterion (GDC) 4, " Environmental and dynamic effects design bases"(U.S. Code failure to recognize the need for individ-of Fedeml Regulations, Title 10, Part 50, e ualized testing of redundant components Appendix A). failure to provide backups when defeat-The turbine overspeed frequency assumption e ing protective equipment during testing is a part of many plants' analyses demonstrat-ing plants meet GDC 4. However, compliance failure to provide operators with specific with GDC 4 can be demonstrated by analyz-e instructions on how to proceed when a ing missile trajectories and the physical test anomaly is observed barriers protecting structures, systems, and components important to safety. failure to integrate human factors con-e siderations into a highly stressful test The study questions the completeness of plant f environment safety analysis regarding another aspect of compliance with GDC 4: the issue of damage Important differences were found among from vibration and discharge of flammable, turbine manufacturer practices: for example, explosive fluids and collateral flooding which equipment hardware; physical configuration; can result from turbine overspeed. This issue and guidance for operations, maintenance, is the subject of another AEOD study which smveillance, and testing of turbine overspeed is currently underway. protection systems. Significant plant to plant variations were found in the way turbine The report focuses on deficiencies associated manufacturer guidance was implemented re-with turbine overspeed protection systems. garding maintenance, operations, and testing For example: of turbine overspeed protection systems. e common-mode hardware deficiencies Reviews are provided of the Salem precursor events (Ginna, Crystal River, and Salem) and steam admission valve failures at other similar events that have occurred after Diablo Canyon and at Palisades the Salem overspeed event (events at St. Lucie, Diablo Canyon, Big Rock Point, and sticking of turbine bypass valves at Comanche Peak). These recent events indicate Big Rock Point due to solidification that many of the lessons from the Salem event of Garlock 938 valve packing have not yet been adequately disseminated and learned. They are viewed by AEOD as incompatibility between hydraulic precursors to future turbine overspeed events, fluids and electrohydraulic control system solenoid-operated valves The Salem overspeed event provides a point estimate of turbine overspeed failure rate of overestimation of pressure switch about 10-3 per turbine-year. NRC accepted design life, etc. analyses which assumed a maximum turbine failure rate of 1(H per turbine-year in common-mode testing deficiencies e accordance with Regulatory Guide 1.115, " Protection Against IAw-Trajectory 'Ibrbine methodology NUREG-1275, Vol.11 x

1 fluid cleanliness j effectiveness of testing defeating diversity and/or redun-l Eh..minating the aforementioned deficiencies dancy, " smart testing" can enhance the reliability and operability of i ' human factors the main turbine-generators and their wer- [, speed protection systems, help reduce the procedures frequency of turbine werspecu events, and i thereby raise confidence that the turbine e common-mode maintenance deficiencies werspeed protection systems will operate reliably to assure conformance with assumed l frequency turbine werspeed initiator frequencies in Regulatory Guide 1.115 and compliance with design life GDC4. e [ ) i h e t xi NUREG-1275, Vol.11 l

FOREWORD This report presents the results of an indepth (2) poor periodic testing of turbine control examination of the Salem Unit 2 overspeed and protective equipment. event, subsequent industry initiatives, and recent operational experience. It reviews The Salem event indicates that the likelihood details of the event, the root causes and con-of a damag q overspeed event is higher than tributing causes of the event, precursors, and previously estimated and that the conse-followup actions taken by the licensee at quences of turbine overspeed can go beyond Salem Units 1 and 2 and its adjacent Hope just missile generation. As a result, the Office Creek plant. Information about other more for Analysis and Evaluation of Operational recent events involving turbine overspeed and Data is conducting a parallel study of the turbine control system malfunctions and safety consequences of catastrophic turbine actions taken by the Nuclear Regulatory failures, particularly those resulting in fire, Commission and the U.S. nuclear community flooding, and missiles. is included. This document does not contain any new regulatory requirements. It is being distrib-uted for mformation to assist licensees in The root causes of turbine overspeed were improving performance and enhancing nuclear found to be (1) poor turbine control and safety by incorporating the lessons learned protective equipment maintenance and from operating experience. i xiii NUREG-1275, Vol.11

l 1 l. ABBREVIATIONS AEC U.S. Atomic Energy Commission HTS hand-trip solenoid AEOD Analysis and Evaluation of IN Information Notice Operational Data (NRC's OfGce for) LER Licensee Event Report AIB Availability Improvement LWR light-water reactor Bulletin [ Westinghouse] AIT Augmented Inspection Team MLEA ' Main Line Engineering Associates (NRC) [of Exton, PA) AST auto stop oil MOV motor-operated valve ATT automatic turbine testing MSL main steam line BOP balance of plant NRC U.S. Nuclear Regulatory Commission CAL Customer Advisory Letter NRR Nuclear Reactor Regulation (NRC's [ Westinghouse] Office of) CB containment building CE Combustion Engineering PG&E Pacific Gas & Electric Co. PSE&G Public Service Electric and Gas ~ DEH digital electrohydraulic (control PWR pressurized-water reactor system)[ Westinghouse] EDO Executive Director for Operations (NRC) SERT Significant Event Review Team [ Salem /PSE&G] FCE emergency governor exerciser SOV solenoid-operated valve [ Big Rock Point] EHC electrohydraulic control TII. Technical Information Letter l ESFAS engineered safety feature actuation [ General Electric] system TOPS turbine overspeed protection system FPL Florida Power and Light Company TS Technical Specification l GE General Electric Company GDC General Design Criterion W Westinghouse Electric Corporation l f I xv NUREG-1275, Vol.11 s k..

1 INTRODUCTION S. Bush (Ref.1) published information about 21 main turbine failures that occurred throughout the world between 1950 and 1972. On November 9,1991, a turbm.e overspeed Bush's paper provides the basis for NRC event at the Salem Unit 2 nuclear power plant assumptions about turbine failure rates. caused extensive damage to the turb, e, gen-m erator, and main condenser. The turbine over-Fourteen of the 21 failures generated missiles speed event resulted in a hydrogen explosion that penetrated the turbine casing. Of these and fire, as well as lube oil fires. 14 events,9 were caused by manufacturing defects or design deficiencies in the rotating Although there was no loss of life or personnel parts and occurred near or at normal operat-injury, the event resulted m property damage ng speeds. Bush noted that, due to improved and a 6-month plant shutdown. turbine design and improved manufacturing techniques, most of these failures would be At the request of the U.S. Nuclear Regulato:y y to recur. h other five overspeed un Commission's (NRC's) Executive Director for wents dat generated a,ss, es were caused by d Operations (EDO), the NRC Office for Anal-ennnm faHures-sdeking of stenm ysis and Evaluation of Operational Data cetml and dump vakes. W vaMs were (AEOD) expanded its ongoing study of the Prone to such failures because of the small Salem Unit 2 overspeed event in 1992-clearances around the valve stems and the Presence of foreign material. The small j This report presents the results of an indepth clearances were also aggravated by faulty study of the Salem Unit 2 overspeed event, adjustments, design errors, shop errors, and subsequent industry initiatives, and recent I""hy materials. Information a, bout similar operational experience. The report reviews mam turbme failures appears m a 1973 details of the event, the apparent and root General Electric (GE) memo. Of interest is a l causes of the event, precursors, and followup 1970 event in which a low-pressure rotor of a actions taken by the licensee at Salem Units 1 Mitsubishi turbme undergomg factory testmg and 2 and Hope Creek (an adjacent plant burst at 117 percent of rated speed. An 8-ton owned by the same utility). The report fragment was thrown eight-tenths of a mile. includes information about other more recent Details about a significant overspeed event events involving turbine overspeed and turbine which did considerable damage at Uskmouth control system malfunctions and describes

1. 5 in the United Kingdom m 1956 are also actions taken by the NRC, other utilities, germane. The turbme oversped to 170 per-manufacturers, and the insurance companies cent of rated speed and burst the low-pressute that provide liability and property damage r tor. The event was caused by common-mode coverage to U.S. nuclear power plants. The contammation of the lubncation and hy-report also delineates actions for improving drauhc o,l. F, e iron oxide particles which i

m the reliability of the turbine overspeed resulted from water mtrusion m the oil cooler protection system (TOPS) to reduce the deposited sludge which caused simultaneous likelihood of experiencing a catastrophic stickm, g of hydrauhc control valves and redun-turbine overspeed event. dant oil tnp valves m the emergency over-speed system. Bush (Ref.1) stated that the 2 IIISTORICAL REVIEW Uskmouth failure resulted from stuck steam admission valves which were caused by Tbrbine failures have long been recognized as magnetite buildup. having the potential for throwing off missiles that can cause loss of life, extensive damage, Most of the overspeed events described by long plant outages, and major financial loss. Bush (Ref.1) occurred at non-nuclear Many catastrophic turbine failures have ,, g. b,bility of Occur-occurred because of manufacturing or design port-ilypotheticalTb e Mailes defects, as well as from human error. In 1973, rence. March 14.1973. 1 NUREG-1275, Vol.11

facilities with high-temperature steam experience and the perceived diversity of (~1000 'F). High-temperature steam pro-TOPS (i.e., electronic, mechanical, electro-moted the buildup of " boiler salts"-that is, hydraulic speed sensors and control fluid salts or oxides-on the steam admission subsystems), the AEC/NRC concentrated on valves. The buildup of such foreign materials verification that the steam admission valves would not be expected at the lower tempera-were not stuck, while overlooking other critical tures in light-water reactors (LWRs)(=650 'F hydraulic, mechanical, and electrical sub-steam). In addition, tight control of water system components such as solenoid-operated chemistry at LWRs reduces the likelihood for valves (SOVs), pressure switches, relays, etc. common-mode sticking of turbine steam Although NRC Standard Review Plan 10.2 admission valves. In the U.S., early-vintage (Ref. 2) noted that such components needed to pressurized-water reactors (PWRs) used be testable, the NRC did not require surveil-phosphate-type secondaiy-side water treat-lance testing of these components. Plant ment. The phosphates were found to be a designs were analyzed for turbine failures as a major cause of turbine steam valve sticking. result of which missiles could penetrate the Switching from phosphate treatment to containment building (CB) and affect safety all-volatile treatment reduced the salt buildup systems. To protect against turbine-generated problems and improved turbine valve relia. missiles, the turbines at many plants were bility. Bush also noted that the incidence of oriented in a " favorable direction" with the overspeed events markedly decreased (in axis of rotation perpendicular to the CB so non-nuclear plants) between 1961 and 1972 that turbine-generated missiles would not be because turbine valves were exercised daily or likely to strike the CB. weekly during load change tests. Exercising the valves eliminated the buildup of deposits Using the methodology outlined in Regulatory in the valve stem guide area. Guide 1.115 (Ref. 3) to show that the likeli-hood of turbine missiles causing unacceptable damage to safety-related equipment was less In the early 1970's, when Bush wrote his than 104 per turbine-year, licensees were able paper, experience with main turbine failures to demonstrate that their plants' main led to estimates of turbine missile frequency turbine generators met the NRC's licensing of about 10-4 per turbine per year. However, requirements of General Design Criterion Bush's paper indicated the expectation that (GDC) 4 of Appendix A to Part 50, Title 10 of technological improvements in manufacturing the Code of Fedeml Regulations (10 CFR and testing would reduce the turbine missile [Ref. 4]). The Regulatory Guide 1.115 generation probabilities. The turbines used at methodology is as follows: most U.S. nuclear plants benefitted from advancements in manufacturing and inspec-The probability of a turbine missile tion techniques that were not available for the striking safety related equipment and turbines that failed from 1950 through 1972. If causing unacceptable damage is referred to as P. It is the product of 3 proba-periodic inspections are performed properly 4, bilities (i.e., P = P x P x P ) and defects repaired satisfactorily, catastroph-4 i 2 3 ic main turbine failures would not be expected Pe probabihty that a high energy i to occur at U.S. nuclear plants unless there was a turbine overspeed. Because of earlier turpme nussile will penetrate its turbine fail' ire history, the U.S. Atomic casing Energy Commission (AEC), its successor p2 m Probability that the high energy agency, the NRC, and the licensees focused on steam admission valve operability and diver-turbine missile will strike safety-related equipment (referred to as sity of overspeed protection systerns (types of the " strike" probability) speed sensors) as ways of mimmizmg the damage to the plants from such credible Pe probability that the high energy 3 events. Based upon earlier fossil plant turbine missile strike will cause NUREG-1275, Vol.11 2

i L ~ i r unacceptable damage to safety-strike and damage probabilities for favorably related equipment (referred to as oriented turbines and 10-2 for unfavorably the " damage" probability). oriented turbines. In accordance with Regulatory Guide 1.115,if The turbine system reliability criteria pro-a licensee could demonstrate P to be less vided as guidance in Reference 5 have been 4 than 10-7 assuming P equals 10-4 (based reproduced in Table 1. i upon Bush [Ref.1]), the plant's main turbine-generator was considered to have satisfied A 1987 E topical report sponsored by several GDC 4 turbine missile concerns. Such analy-E turbine ownersib su aported relaxing the ses overlooked vibration-induced fluid leaks frequency with which t le turbine steam (of hydrogen and oflubrication and hydraulic admission valves are exercised. The topical oils) that could accompany a destructive report estimated the probabilities of turbine turbine overspeed. missile ejections due to overspeed at the respective plants. If the November 9,1991, A 1987 NRC staff review of Westinghouse overspeed event at Salem Unit 2 is considered, Electric Corporation (E) topical reports on the E topical report's probabilistic assess-turbine missiles, turbine failures, and turbine ment of turbine missile ejections at Salem overspeed noted that based upon various Unit 2 can be shown to be nonconservative by licensing applications, the turbine missile three to five orders of magnitude (see Fig- " strike and damage probability" (i.e., the ure 1). The assessment is nonconservative and probability of having a high energy turbine therefore invalid because the turbine and its missile strike and cause unacceptable damage overspeed protection system were not main-to safety-related systems) was estimated to be tained and tested in the manner assumed in between 10-3 and 10-2 for unfavorably ori-the analysis. Common-mode errors involving i ia 4 and 10-3 human factors and equipment could not be ented turbines, and between 10 for favorably oriented turbines. The NRC and were not quantified or included in the staff's safety evaluation report (Ref. 5) assessment. This issue is discussed in detail in approved the use of the W topical reports. It Section 7.4 of this report. j provided the foundation for licensing actions in which the Technical Specification (TS) Several turbine overspeed events have oc. 1 requirements for turbine overspeed testing curred at U.S. nuclear power plants, although were relaxed for plants with E turbines, the Salem Unit 2 event is the only one known j Reference 5 noted the large uncertainty in the to have generated missiles. 'Ibrbine overspeed likelihood for turbine missile generation: events at U.S. LWRs are listed in 'Ihble 2. The Salem Unit 2 event caused significant damage ... depending on the specific and resulted in a 6-month outage. Chapter 3 combination of material properties, of this report provides more details. Appen-operating environment, and mainte-dix A contains a list of the manufacturers of nance practices, the P (probability main turbines and generators at all U.S. i of turbine missile generation) can LWRs. j have values between 10-9 to 10-1 per turbine-year depending on test and At U.S. nuclear power plants, main turbines inspection intervals. are categorized as balance of plant (BOP) equipment. However, as noted below, at many The NRC staff's safety evaluation report plants the turbine trip function is part of the (Ref. 5) discouraged the elaborate calculation engineered safety feature actua' ion system of the strike and damage probabilities for low-(ESFAS) instrumentation, the safety-related trajectory turbine missiles. As an alternative it gave credit of 10-3 for the product of the 1525. IYobabilistic Eval $rie-ation tinghouse ivo ii,westinks 2) Report WCAI house Electric Co ation tary Cla l'!brbines with the axis of rotation parallel to the CB. of Reduction in wrbine %!ve Tbst Frequency

• June 1987.

3 NUREG-1275 Vol.11

Table I hrbine system reliability criteria

• P = hrbine missile ejection probalnlity,yr1 i

Favorably. Unfavorably Oriented Wrbine ' Oriented hrbine Required Licensee Action. P < 104 P < 10-5 This is the general, minimum reliability (A) 3 i requirement for loading the turbine and 1 bringing the system on line. (B) 104 < P < 10-3 10-5 < P < 104 If this condition is reached duririg operation, l i i the turbine may be kept in service until the next scheduled outage, at which time the licensee is to take action to ' reduce P to i meet the appropriate A criterion (above) before returnmg the turbine to service. (C) 10-3 < P < 10-2 104 < P < 10-3 If this condition is reached during operation, i i the turbine is to be isolated from the steam - supply within 60 days, at which time the licensee is to take action to reduce P to i meet the appropriate A criterion (above) before returnmg the turbine to service. (D) 10-2 < P 10-3 < P If this condition is reached at any time i i during operation, the turbine is to be iso-lated from the steam supply within 6 days, at which time the licensee is to take action to l reduce P to meet the appropriate A criter-3 l ion (above) before returnmg the turbine to l service. ' Reference 5 (NRC safety evaluation of W topical reports providing probabilistic assessments of turbine failures, turbine overspeed, and turbine missiles). 'Ihese ertieria provide guidana for use in deternunmg turtiine disc inspections and maintenance and testing schedules for turbine control and overspeed protection systems. i t i l NUREG-1275, Vol.11 4 l l 1 i

y,, g, f P l i i. i I i i i i i i i I. I i i i [ 3 io-e 1 ~[ l t T 5 i E 10-7 = l l I I I I I l I I I l i jo-a O 1 2 3 4 5 6 7 8 9 10 11 12 13 INTERML BETWEEN TURBINE WLVE TESTS (months) Figure i H-estimated probability of missile ejection from Salem Unit 2 turbine as a function of valve test interval (reproduced with permission from Westinghouse Electric Corporation) 5 NUREG-1275, Vol.11

.t Table 2 U.S. nuclear plant turbine overspeed events

• i Plant-Date Maximum turbine speed Yankee Rowe

< 1960 (Factory Testing) 120 % Yankee Rowe" 1960-1980 20 events = 111 % San Onofre Unit 1 July 1972 133 % Davis Besse September 1977 > 111 % Haddam Neck January 1982 > 128 % D.C. Cook Unit 2 January 1983 > 112 % Crystal River Unit 3 February 1988 103 % Three Mile Island Unit 1 September 1991 > 109 % Salem Unit 2*" November 1991 160 % St. Lucie Unit 2 April 1992 103 % Diablo Canyon Unit 1 September 1992 104 % Beaver %11ey Unit 1 October 1993 > 111 % 'In tecent years, several destructive turbine overspeed events have also occurred at U.s. fossil-powered plants. Events in which turbine speed exceeded 100 percent but was less than 109 percent are included because they were the result of operational ton equipment malfunctions and some of them are viewed as precursors to more senou (destructnc) overspeed events. This table should not be construed as being complete since other events may not have been reported. f Typically, mechanical ovenpeed testing at 110 percent overspeed is performed once per fuel cycle (W and GE turbine instruction manuals recommend testing every 6 to 12 months and after certain maintenance wosk is performed). l

• • Yankee Rowe sustamed major turbine damage in 1980 (overspeed not involved dunng that event).

"*1he salem Unit 2 event was the only overspeed event that generated missiles which penetrated the casing. function of which is to reduce the potential for after a reactor scram. At some of those plants, severe overcooling transients and mitigate the the P-4 interlock also provides for a turbine consequences of steam generator overfill. Be-trip signal on high steam generator level. cause of concerns about damage from turbine Plants that have TS requirements for periodic overspeed and turbine missiles, TS of many ESFAS surveillance testing of the turbine trip E plants require that at least one TOPS be oper-function are not required to test each train of able, that the steam admission valves undergo turbine trip signals independently. In boiling-t iodic test cycimg and inspection, and that PS channels be calibrated periodically. water reactors (BWRs), the turbine trip fea-ture is integrally connected to the RPS and i It is important to note that, although the tur-the turbine trip function for BWRs is also an ESFAS feature. In PWRs and BWRs, inspec bine trip system serves an ESFAS function and is hnked to the reactor protection system tion and maintenance requirements for mam, - (RPS), the limiting conditions for operation turbine electrohydraulic control (EHC) or for the TOPS instrumentation are not in. auto stop oil (AST) systems and for their cluded in 'I3s. At all E plants and at some component SOVs, pressure switches, etc., PWRs designed by other manufacturers, the associated with turbine trip, are not specific-P-4 interlock provides for a turbine trip sigrial ally addressed in plant TSs. i NUREG-1275, Vol.11 6 l

e As part of their operating licenses, some requires reporting of TS violations and RPS newer plants such as Seabrook and South actuations. As a result,in many cases the Texas have committed to adopt turbine LERs provided little, if any, detail about the maintenance programs recommended by the TOPS anomalies or failures. turbine manufacturer and based on the manu-facturer's missile generation calculations, with the alternative of period volumetr5 inspec-3 SALEM UNIT 2 OVERSPEED tions of alllow-pressure turbine rotors. The EVENT bases for the Seabrook TS requirements state that the TOPS prevents the turbine from 3.1 Description of the Event expenencmg an excessive overspeed which could generate missiles that "could impact Salem Unit 2 is an 1106 MWe E PWR with a and damage safety-related components, equip-E turbine and a GE generator. On Novem-ment or structures." ber 9,1991, while the plant was operating at 100 percent power, the licensee was conduct-In contrast, many plants have virtually no TS ing a monthly test of turbine, mechanical pro-requirements for the main turbines or their tective devices (overspeed trip, vacuum tnp, overspeed protection systems. I w-bearing oil pressure tnp, and thrust bearing trip). In order to perform the test associated reactor tn?*the testing required E "" " p, "*" " Offsettin8 the NRC's limited role in the area i complete isolation of the AST system from the of main turbm.es and TOPS is the fact that failures of the main turbme and its associated turbme control or trip function. An operator systems have the potential to,cause significant isolated the AST system by holding the tur-financial loss and erode pubhc confidence, bine bypass lever (overspeed trip test lever)in The plants are suppose,d to be designed so the test position (see Figure 2). Disabling the that turbine / generator-mduced failures or AST system defeated the mechanical over-hazards do not create conditions outside the speed trip and 12 additional remote trip plants' safety analyses. However, the AEOD signals. During testing, while the mechanical staff have observed situations where turbme overspeed trip is disabled, protection against building hazards could have the potential for overspeed is provided by three redundant affectmg safe plant operation. AEOD is SOVs: ET-20, which is designed to be actu-studymg the issue of turbme building hazards ated on a reactor scram, and OPC 20-1 and and will publish a special report on the issue OPC 20-2, which are designed to actuate at 5000-turbine speeds of about 103 percent (see Figure 3). 'Hiere were many precursors to the Salem Unit 2 overspeed event (see 'Ihble 3). However, On November 9,1991, the licensee had just the lessons to be learned from those events successfully completed testing the mechanical generally went unheeded. In some cases, the protective devices when a momentary licensees' reporting of the events focused on (1.5 second) drop in the AST system pressure the initiating events and did not raise con-occurred. The low AST system pressure cerns about the overspeed potential. The most caused the interface valve to open and relieve likely reasons being the main turbine and the electrohydraulic fluid pressure (see Fig-generator were considered to be nonsafety ure 2). This fluid pressure drop was inter. BOP items, and the possibility of a destructive preted by the RPS as a turbine trip signal and turbine overspeed event resulting in missile generated a reactor scram, signaling the ejection compromising public health and turbine stop valves (TSVs), governor valves, safety was not considered credible. The pre-reheat stop valves, and intercept valves to cursor events that were reported in licensee close. The RPS signaled the EHC system to event reports (LERs) were reported in trip the emergency trip SOV, ET-20. However, j accordance with 10 CFR 50.73 (Ref. 4), which ET-20 failed to respond to the demand signal. 7 NUREG-1275, Vol.11

ZClc Table 3 Precursors to the Salem Unit 2 overspeed event

• L Licensee Event Plant Date Report Number Failure Mode Cause Ginna April 1985 50-244/85-07 "Ibrbine failed to trip on reactor trip Mechanical binding of solenoid valve.

when ET-20 solenoid valve failed to operate on demand. Crystal River February 1988 50-302/88-06 Turbine failed to trip on reactor trip _ Mechanical binding of solenoid valve. when ET-20 solenoid valve failed to operate on demand. Salem Unit 1 August 1988 50-272/88-15 Reactor and turbine trip occurred Clogged AST system supply orifices. because oflow AST pressure during turbine control system testing. Salem Unit 1 September 1990 50-272/90-30 Reactor and turbine trip was induced Mechanical binding of solenoid by an erroneous overspeed signal. valves due to sludge and debris. Followup revealed that OPC 20-1 and OPC 20-2 would not function. Ginna September 1990 50-244/90-012 ~ Ibrbine failed to trip on reactor trip Mechanical binding of solenoid valve because solenoid valve ET-20 failed due to corrosion. on demand. Salem Unit 2 October 1991 50-311/91-017 Deficiency in the OPC solenoid function Inadequate management control, test was not satisfactorily resolved - oversight, communication, and before turbine startup. understanding of test results; failure to follow procedures.

0 a y g_Q~I ! ,,,4 Q g s f g >. y a 553% HN "Y g 5B, 6 h'jhg i E s e.p.rb 6inx ria gi,a e e 5 u per f t f f,a d esl3 tail =m g P i EE d E l L l b O 2 l ls~ b iE 5 =d a. s h,M k i sl ' y ~ B U R E b ON 0 8 gg d gr .E f $l b f 4 a \\ ge gg f g gN - - - - - - - ~ ~ lo L 0:,...........,..g..I.. Eo 7.....,..,,. 3 g E g B' d g h g* : 4 B"I 5ll! 'g l,I eI i 9gg4,........g la $ E ^$ H y c..... n E g g E e gi l h2 a !i o i l 58 5 Ig f_t O 95 e$ ) t, $g M. l c fT 11' l l l gg i "o s Q f 9 NUREG-1275, Vol.11

~\\ .a _ 63 g p TURBINE = lr AST TRIP I INTERFACE VALVE I P y 3 20, TRIP HEADER TRIP ET HP OIL TEST 1 SUPPLY THANDLE ~ ~ (FRONI 7 ~ y Q LUBE Oil 8 SYSlBA) l~~~~ k -eeo -,! A PROTECflON l y I 2 2 CONTROLLER ----- S OPCHEADER LOGIC y Figure 3 Schematic of Salem type (generic) emergency and overspeed protection control system before November 1991 The 30-second reverse power protection timer 11 seconds after the generator output breakers started at the time of the trip signal. When the opened, the TSVs reached the open position 1.5-second low AST pressure perturbation (> 90 percent open). At that time, the cleared, the interface valve closed, the electro-turbine-generator was unloaded (disconnected hydraulic trip fluid repressurized, and the from the grid) and receiving steam through TSVs started to reopen. Because the AST the admission valves. The turbine started to pressure switch 63-3/AST was incorrectly set, overspeed. As the turbine speed approached the turbine's analog electrohydraulic system 103 percent, the overspeed protection con-did not detect the initial turbine trip con-troller signalled for SOVs OPC 20-1 and OPC dition. If 63-3/AST had been set correctly, 20-2 to shift positions to dump electrohy-and had functioned properly, the analog elec-draulic trip fluid to close the intercept and trohydraulic system would probably have governor valves to limit the overspeed con-reduced the governor valve demand to zero dition to 103 percent. However, both SOVs when the initial AST system pressure drop failed upon demand. The operator at the front occurred. The analog electrohydraulic system standard panel continued to hold the trip test could also have prevented the governor valve lever in the test positior., disabling the from reopening by actuating an auto-stop trip. mechanical overspeed trip and the 20/AST However, the failure of the 63-3/AST to electrical turbine trip solenoid valve. actuate allowed the governor valves to reopen when the AST pressure perturbation cleared. The turbine generator oversped to an The main generator output breakers opened estimated 2900 rpm (about 60 percent above as designed (the signal for main generator the design of 1800 rpm). The shaft vibrated i output breakers to open comes from the RPS severely and turbine missiles (blading) with a 30-second time delay). However, about penetrated the 1 1/4 inch-thick carbon steel NUREG-1275 Vol.11 10

1 turbine casing, making two elliptical holes on The RPS functioned per design throughout one side of the turbine casing. Each hole was the event. The only anomalous behavior between 15 and 20 inches across (see Fig-during the post tnp period was a drop in Taye ure 4). There were also two tears 2 to 3 feet requiring main steam line (MSL) isolation. long at the same axiallocation on the other The MSLisolation was performed in side of the turbine. accordance with plant emergency operating procedures and the plant was brought to cold Some missiles landed over 100 yards away shutdown,without any further thermohydraulic from the turbine. (Note that the turbine is complications. located on the roof of an open structure.) One part of the turbine casing (about 15 inches by At all times during the event, the reactor was 20 inches by 1-1/4 inch thick) flew over the maintained safely shutdown. Safety-related moisture separator reheaters, and landed on a systems were not impacted and remained truck about 40 yards away. He low-pressure operable throughout the event and imme-turbme was destroyed (see Figure 5). About 100 condenser tubes were cut by turbm, e blade diately afterwards. There were no radiological releases. The only injury was to a plant secur-shrapnel, and about 2500 condenser tubes had ity officer who suffered smoke inhalation (the to be replaced (see Figure 6). No missiles officer did not require hospitalization). penetrated the CB. The high shaft vibration caused the mechan. The plant was shut down 6 months for repairs ical seals from the hydrogen gas system (used With costs estimated at between $100 and $600 l for generator field cooling) to fail. The hydro. milh,on. l gen gas was released, and it ignited. There was a hydrogen explosion and a hydrogen fire. The generator was severely damaged and it had to 3.2 Licensee's Response to the be replaced. Event The vibration broke the generator bearing seal Within 2 hours of the reactor scram, the oil supply line and the oil was ignited by the licensee convened a Sigmficant Event Review hydrogen fire. Seal and turbine lube oil spilled 'Ibam (SERT). The team s charter was to into the turbine building basement. assess all relevant aspects of the event to pre-vent recurrence of similar events. The SERT The control room operators secured all the effort took 2000 person hours over 4 weeks. turbine lube and seal oil pumps which were feeding the fires. The fire brigade quickly ' Die SERT performed a comprehensive inves-suppressed the initial lube oil fires. Lube oil tigation of the event. It reviewed sequence-fire reignitions occurred for several hours but of-events data and conducted functional tests were quickly extinguished by the licensee's to reconstruct certain aspects of the event onsite, dedicated fire brigade (the dedicated (e.g., cycled SOVs and turbine valves). The fire brigade is made up of full time fire SERT also did an indepth review of the fighters and is shared by Salem and Hope human factors aspects of the event and a Creek which have a shared protected area). thorough review of testing procedures, The fire brigade took prompt action to control manufacturer's recommendations, and plant and extinguish the fires. The automatic fire TSs. The SERT reviewed previous industry suppression systems actuated as designed. operating experience and worked with the During the event, there was dense smoke from equipment suppliers and with several labora-the fires. The turbine's location on an open tories to perform intrusive examination of the deck rather than in an enclosed building failed equipment. The SERT's and the NRC minimized the impact of the smoke from the Augmented Inspection Team's (AIT's) deter-fires. minations of the root causes of the event agree 11 NUREG-1275, Vol.11

(I .g ,.gf g [M[,5 A ~' +, gy c :,..u f dyiG["S'" ---'"'I I- .. m t. .~ >; y-9, ,4 j? '[ ! ' i-e

t(% ' '

i,, j g 0 . a . ( t';)1 ~ 2, A. ~ i:,i [

l ;iff ' L, G f w

-.h, ,',,/ ' 'v th 1, w L., m., ! J., g,

I f

.i-i h i, m e,y yc; J l f f*. AY h pk{g f .g l" r

• 1.1,, -

f,_ - w s7 .v, .4, wy,--

,. a:

.:Mxw Irigure 4 Photograph: Salem Unit 2, showing holes in turbine casing NURiiG-1275, W1.11 12

1 e,.- l l j f , ' t#, (d 4A . wy ,go .jf, -w s J;d 5 j/ .ff<4@.G9h, i i dlE f. 'f l lf .w,y %, t.'l * ;{ e f. N i p[ ~ p f, j l= M 2.-- I h .y;' _ lf l ?. i . $M q't . 4 _[ A .[% I %4 l Vj ' 4 ;_" ,.. j; +.,n 'i / .,, ~ l 7 ', Oi j 4(,;Mj:rg,,1 l:f' 4 g I. I e j 'j th j' [ p, - ;. k t # ;;; j I . f. l b I fl;; ' m ? j b' i -9[I {'-( 'N f.fD V ! 1,. ..pp. SwP - gy i j [4 / )f f ~ e t i i' h'f - g,' g. ;pi gj .e i 1;' j i}.,. .+ r x$t;

m.

h: c. Figure 5 Photograph: Salem Unit 2, showing damage to low-pressure turbine 13 NUREG-1275, Vol.11

l ?;r . f4. gf _ '.- ' ;' ~*t( eg , ? gy: n_ jj v - ; ng a sw. v, o, s ,5,'((.h 'yf : ft s 4.s,. t,3e . M $e

gj:p..u +'t k

g ,q p. c s- .,i f - e Duwoman.. . M',. ^ mamani. - A s> -.... 1 : \\ 4 . :'. H l y9... ~ 7: ;':.y g :. _, m u.. m ~

, 3 yl-

-~. ~= _.y mu : ,,.s., l }fn : .; y ace,e '....,. ; y,.

1. , n g_. p.

~ .,. g '. 4 ,-yt .g r c. ~

p..

1. ?eg:tani.. p.=,:

n

^m O r , w.. i I ~ F ., g '1 . ',..f . /,, : / A. .L p 'g g,; [p '/ 5 ?: L.? y' c .g ,nm ;;p p.~: f.,s;v:' w g,9>. r . ;. w-g n= ~. . gat -. i* -, p y < g -- s., J-W ", / c .,r, . y.w, ..,a O,= .. p : : n. 3 .,q,W.. - %A gra 7,R.; f+ <.l., j " ' %., r

p. A.,, *".,x,., ' y, y.e Af @.

c .P', .p .w. .a.a v.v .1 ,~ I Figure 6 Photograph: Salem Unit 2, showing condenser damage NUREG-1275, Vol.11 14 I l

p closely. Root causes determined by the SERT technical specifications e and AIT appear in Section 3.4 of this report. emergency procedures (including e The SERT report c made 32 recommendations fire fighting) i for corrective action. The recommendations e review and feedback of appear in Appendix B of this report. The first operational experience six recommendations were categorized by the licensee as relating to plant design: The final four SERT recommendations related to personnel. They address human behavior, (1) evaluation of the turbine protec-human factors that contributed to the over-tion systems and design speed event, and the corrective actions needed enhancements to prevent recurrence (e.g., failure to examine OPC 20-1 and OPC 20-2 testing anomalies (2) root cause assessment of SOV during the October 20,1991, testing). They failures and irnplementation of also address the decision to defer replacement corrective actioas to prevent of Unit 2 SOVs during the spring 1991 " mini-recurrence outage," and lessons-learned training regard-ing the November 1991 overspeed event. (3) determ.mation of the source of the foreign material that entered By September 1992, the licensee implemented the AST system and could have most of the 32 recommendations in the SERT caused the AST system pressure report, with almost all of the remaining Perturbation recommendations scheduled for completion before the end of 1992. It is important to note (4) evaluation of the need for cor. that most of the recommendations applied to rectmg human factor deficiencies Salem Unit 1 as well as Salem Unit 2. Sec-at the front standard panel tion 4.1 describes the major hardware, pro-(5) determ.mation of all sources of cedural, and testing modifications made at the i steam that fed into the turbm, e Salem plants as a result of the overspeed event. In addition, the tech tical staff at the which resulted in the overspeed 2 licensee's adjacent plant, Hope Creek, has i event reviewed the SERT report recommendations (6) evaluation of the adequacy of I '. applicability and has taken corrective, AST pressure switch settings action. Section 4.2 of this report summarizes Hope Creek's review and the corrective The next 22 SERT recommendations were actions. categorized as relating to programs. These recommendations address adequacy of, and 3.3 NRC Responses to the Event the need for changes to, programs associated 3.3.1 Immediate Actions with After being notified of the event, the NRC surveillance testmg formed an AIT consisting of two Salem e e maintenance resident inspectors, three regional based a human factors enhancements inspectors, and two engineers from NRC headquarters. The team arrived on site on operator training November 10,1991. e The AIT's primary tasks were to gather the 8'Public sern Electric and Gas Com si nificant Event facts, determine the root causes, and identify Response ' Ram (SEKr) Report No. 91 06, " salem 21 ope Creek is a BWR with a GE turbine and generator. It is Unit 2 Reactor /lbrbine ' Rip and 'Ibrbine/ Generator Failure 1 of November 9,1991," December 20,1991. located on the same site as salem Units 1 and 2. 15 NUREG-1275, Vol.11

~ i k t'; [ potential generic issues. De results of the : . tion of safety-related equipment"? Also [ AIT efforts appear in References 6 and 7. noted was the fact that turbine control systems affect and are affected by RP3 1 When the causes of the overspeed event were logic, whereas NRC inspection programs known, NRC's generic communications - pay little attention to operability and 1 branch issued Information Notice (IN) 91-83 maintenance of BOP systems. ' (Ref,8) to alert licensees to the details of the j event. The licensees were expected to review In response to the NRC Region I Administra-the information for applicability to their tor's letter (Ref. 9), the Associate Director for l plants and consider actions to prevent similar Projects, NRR, noted that according to the ] occurrences. NRC's policy statement on TS improvements, new Standard Technical Specifications "relo-3.3.2 LongerTerm Actions cate requirements for turbine overspeed f protection to licensee controlled documents" - Based upon the AIT's findings, the NRC (i.e procedures). In early 1992, NRR reviewed j Region I Administrator recommended to the the Salem Unit 2 turbine overspeed event. Director of the Office of Nuclear Reactor De review found that the TSs of 18 of 45 E Regulation (NRR) that the generic concerns plants do not require the ESFAS turbine trip i evaluated to determine if regulatory action or noted in Chapter 2 of this report, the P-4 in- ~ raised by the Salem Unit 2 overspeed event be function-the P-4 interlock-to be tested. As generic communications were warranted terlock reduces the potential for severe over-(Ref. 7). The generic concerns included the cooling transients and events that could lead following: to steam generator overfill. It appears that the lack of an adequate test for the P-4 interlock TS inadequacies regarding TOPS contributed to the Salem overspeed event. e Standard Technical Specifications require ne Associate Director for Projects, NRR, ordy one TOPS operable and do not ad-noted (Ref. 9) that with regard to the need for dress redundancy or diversity. In addi-an additional generic communication on l tion, the TSs address only the operability SOVs, IN 91-83 was adequate and that no of the steam admission valves and do not further generic communications on SOVs f require surveillance of the control system were warranted at that time (February 1992). and its components (SOVs, pressure It was also noted (Ref. 9) that NRR was switches, etc.). evaluating the issue of fire vulnerabilities. Re Associate Director for Projects, NRR, noted i e SOV failures that the issues concerning BOP equipment will be covered by the NRC's maintenance Dese failures raise the question of rule (10 CFR 50.65 [Ref. 4]). i whether a generic communication is -i needed to focus licensee's attention on 3.4 Root Causes of the Event j TOPS SOVs with regard to application, i design and design life, maintenance, The NRC-AIT report (Ref. 6) and the SERT l 2 quality, and surveillance. report a were m complete agreement on the r "contributmg causal factors" for the Novem- 'Ibrbine generator fires and their effects ber 9,1991, overspeed event. Sections 3.4.1 to o-upon nuclear safety-related equipment 3.4.6 summarize those " contributing causal factors," many of which can be viewed as root [* causes. BOP equipment e Is enough regulatory attention paid to h Public Service Electric and Gas Comgy ignificant Event r BOP equipment and systems that could ggagiggrert N 06 "salg_ { g , adversely affect or challenge the opera-or November 9,1991. Defe,mber 20.1991. j i NUREG-1275, Vol.11 16 l

3.4.1 Equipment Failure single failure of either SOV. He same was true for simultaneous surveillance All three overspeed system SOVs were testing of ET-20 and AST 20. (The tur-mechanically bound and so could not shift bine manufacturer did not provide any position on demand. Because of testing guidance for testing of SOVs, individually inadequacies or human errors, the failures or as a group.) were not detected by previous testing. (3) Operators and supervisors allowed tur-3.4.2 Inadequate Preventive Maintenance bine startup (October 20,1991) when a surveillance testing indicated malfunc-(1) The licensee failed to recognize the need tions of the TOPS (OPC 20-1 and 20-2). for SOV or AST pressure switch preven-They thought that concurrent failure of tive maintenance. This failure was partly both SOVs was incredible and that due to the absence of manufacturer or something must have been wrong with turbine vendor recommendations for their test procedure, preventive mamtenance. 3.4.5 IIuman Factors Delkiencies in (2) The licensee failed to perform corrective Front Standard Testing and preventive SOV maintenance as identified by Salem Unit 1 operating (1) To perform the test, the necessity to hold experience, in accordance with a pre, the overspeed trip-test lever m, an awk-viously committed to schedule. ward position for about 20 mmutes. ) Furthermore, there was no positive indi-3.4.3 Inadequate Review and Feedback of cation to allow the operator to determine Operational Experience if the overspeed trip-test lever was m, the test or the normal position. In addition, The licensee failed to recognize or follow up the amount of lever movement needed to on five precursor events involving turbine take the lever out of the test position was control systems and SOVs (two events at only about 1 inch. The total range of lever Salem Unit 1, two events at Ginna, and one motion was only 2 inches. Inadvertent event at Crystal River Unit 3 [see Table 3]). movement out of the test position during testing would result in a reactor scram. 3.4.4 Inadequate Surveillance Testing (2) Absence of communication between the (1) Most of the automatic turbine trip signals control room and front standard and features are bypassed during monthly

Operator, testing of the turbine mechanical protec-(3) Absence of turbine speed indication to tive devices. Thrbme overspeed protection the operator at the front standard (a reverts to a backup system with an elec-tachometer at the front standard had trically actuated emergency trip SOV been disconnected and abandoned in (ET-20) and two redundant electrically 1986)-

actuated overspeed protection SOVs (OPC 20-1 and 20-2). However, before 3.4.6 Test Lever performing the monthly tests, the licensee did not verify the operability of the emer-Although the SERT report noted that the root gency trip SOV (ET-20) and failed to cause of the initial reactor scram was foreign recognize that the overspeed protection material blockage of a reducing orifice in the SOVs (OPC 20-1 and 20-2) had both AST system, the licensee noted that it could failed their surveillance tests when they not rule out the possibility that the operator were performed 3 weeks earlier. holding the test lever at the turbine's front standard may have allowed the lever to move (2) Surveillance testing of redundant SOVs slightly, thereby causing the AST system (OPC 20-1 and 20-2) could not reveal a pressure perturbation. 17 NUREO-1275, Vol.11

Corrective actions that were taken by the Electric and Gas Company (PSE&G) formed licensee at both Salem units are described in a SERT to assess all relevant aspects of the Section 4.1 of this report. event to prevent similar events. The SERT thoroughly investigated the root causes of the event and made 32 recommendations for 4 NUCLEAR INDUSTRY ' "*ctive acti n (Section 3.2 and Appendix B I*.*'*P'**"*"'"*""""""**""d***"E' INITINrIVES AFTER THE -tions of those recommendations, respectively). 4 SALEM UNIT 2 OVERSPEED EVENT The licensee implemented almost all of the i SERT recommendations at Salem Units 1 The Salem Unit 2 overspeed event surprised and 2 before the end of 1992. In addition to most people in the nuclear industry. As noted committing to implementing the SERT's ) in Section 2, a destructive overspeed event at 32 recommendations, the licensee imple-3 a U.S. nuclear power plant resulting from mented commitments that it had made in common-mode SOV failures was considered response to the NRC-AIT that investigated very unlikely. Nonetheless, after being alerted the overspeed event (see Section 3.3 for to the fact that the event occurred, most of the discussion of the AIT's activities). persons in the nuclear industrj who were contacted indicated that their organization Table 4 highlights the major hardware, pro-j took positive steps to prevent a recurrence. Erammatic, and procedural modifications that PSE&G has made at Salem Units 1 and 2 as a The amount of attention paid to the issue of turbine overspeed has varied among organiza-result of the overspeed event in accordance tions. The following sections discuss actions w th the SERT s findings and the NRC-AIT's taken by individual utilities contacted, the

findings, major turbine manufacturers, the NRC, and 4.2 Public Service Electric and Gas the major U.S. nuclear insurers.

Company at IIope Creek 4.1 Public Service Electric and Gas Hope Creek is a 1067 MWe BWR with a GE Company at Salem Units 1 main turbine and generator. It is located on and 2 the same site as Salem Units 1 and 2. As noted in Section 3.2, within 2 hours after the turbine overspeed event, Public Service 3some of those commitmena overlap sur recommendations. Table 4 Major modifications

• made at Salem Units 1 and 2 Modifications Made at Salem Units 1 and 2 After the November 9,1991, Overspeed Event Installed turbine speed indication at the front standard e

Improved communication between front standard operator and control room e Installed a backup turbine trip SOV to enable automatic protective turbine trip during testing o o Replaced original 20/AST solenoid e Installed a filter in the AST header Installed a detent handle on the front standard (see Figure 10) Added an additional AST pressure swech e Made system modifications to enable inchpendent, full functional hydraulic operational periodic e testing of all four turbine protection SOW ' Hardware, programmatic, procedural, etc. NUREG-1275, Vol.11 18

A few days after the Salem Unit 2 overspeed generic differences between GE and W event, PSE&G formed a team to perform a designs and guidance.) lessons-learned review of the Salem Unit 2 overspeed event and assess programs asso-The review team did identify some areas ciated with the operation, maintenance, and where enhancements to TOPS procedures, testing procedures for the main turbine at equipment, and testing at Hope Creek would l Hope Creek. The Hope Creek Review Team be appropriate (see Table 5 for a list of the I' also assessed the Salem SERT report for most significant items). applicability to Hope Creek. They also re-viewed Hope Creek's operating procedures for As a result of its reviews, the licensee TOPS relative to the turbine manufacturer's concluded that the turbine testing at Hope (GE's) guidance. Creek had been conducted adequately. With regard to turbine testing vulnerabilities, 4.3 Westinghouse Power Generation the review team found that perhaps the most Business Unit important differences between Salem and Hope Creek turbine testing are that, at Hope Immediately after the Salem Unit 2 overspeed Creek, the GE main turbine mechanical event, H's Salem site representative and overspeed trip is not bypassed during electri-another W turbme engmeer were at the Salem cal overspeed trip testing and, conversely, the site to gather mformation and to help PSE&G clectrical overspeed trip is not bypassed investigate the root causes of the event. Subse-during mechanical overspeed trip testing. quently, at a January 1992 meetmg of H Furthermore, other turbine tri turbme owners from b'oth nuclear and fossil disable the overspeed trips.3g tests do notlP ants, W provided its turbine owners with 3a. Most of the GE main turbine control systems used at details of the Salem overspeed event. nuclear power plants have turbine testing configurations similar to Hope Creek. (The On February 13,1992, E issued an advisory differences between design and gtudance at to their turbine owners, Customer Advisory Salem and Hope Creek are mdicative of Letter (CAL) 92-02, " Operation, Maintenance, Testing of, and System Enhancements to 'Ibr-bine Overspeed Protection System"(reprinted as Appendix C, courtesy of Westinghouse i[a'in$"bE"$s$t$r'nEEn'g*,N"Nmbr 22,'$91. Electric Corporation). CAL 92-02 provided o information about the Salem Unit 2 overspeed Er# MEod" EEiateNth s'a emk$t'II"" P l ""d event and Contained E's recommendations for e "Ihrbine Overspeed Event," January 27,1992. reducing the potential for another overspeed Table 5 Thrbine overspeed protection system enhancements made at Hope Creek TOPS Enhancements Made at Hope Creek After the Salem Unit 2 Overspeed Event Increased the frequency for calibrating control system actuation devices e Developed a procedure to test circuitry of the backup overspeed trip e Developed a procedure to perform full functional testing of the turbine control system logic (instead e j of partial circuitry tests) h Implemented tear-down inspections of critical components to ensure no internal contamination, e corrosion, or worn parts in addition to observing component functionality Implemented procedures to individually test redundant components e I 19 NUREG-1275, Vol.11 c

event. The recommendations addressed opera-valid turbine trip signals during turbine trip tion, maintenance, and testing of EHC system testing (see Figure 7). It is interesting to note SOVs, on-line testing of individual EHC that some E turbines had the second 20/AST system SOVs, maintaining EHC system fluid as part of their basic design (e.g., Waterford quality, AST pressure switch settings, AST Unit 3-see Section 4.6). lube oil system cleanliness, and installation of 4 reverse power relays (to assure dissipation of In discussions with E, AEOD staff learned turbine driving steam before opening the main that E had canvassed allits turbine owners generator circuit breakers). CAL 92-02 also (about 250 fossil and nuclear units) about made recommendations for improving infor-operating experience with EHC system SOVs mation available to the operator at the front (Parker Hannifin spool-type SOVs such as the standard during turbine testing and for ones that had failed at Salem, as well as improving actions to be taken by operators poppet-type units). About 20 percent of the during turbine testing, unit owners responded. They stated that there had been 38 cases of sticking spool pieces in CAL 92-02 also gave utilities information on the Parker Hannifin SOVs. Ten such events turbine control system enhancements such as occurred at one single-unit nuclear power installing coil monitors to check for SOV circuit continuity, installing a latch-in circuit for energizing ET20 SOVs, and installing a +reicg, hone discussion, M. smith, w, and 11.1. ornstein, NR september 14,1992, and April 7,1993. second 20/AST to prevent the bypassing of Proposed Change _ 63 g p TURBINE = ::. AST i TRIP BUDCK k f p INTERFACE VALVE I P i y TRIP HEADER TRIP Qg k ] TEST HP OIL SUPPLY L_J TMOLE ~ y l (FROM M 20-2 Y S 2 AST E / y m ERSee m, 1 1 Proposed _/ PROTEmON l y 2 2 Change g 3 LOGIC y Figure 7 Proposed improvement of Salem type (generic) emergency and overspeed protection control system NUREG-1275, Vol.11 20

station. In contrast, none of the owners After a visit by the author to E Power reported any sticking problems with any of the Generation Business Unit on November 29, poppet-type valves used.5 1994, H has embarked on a program to prepare a new test instruction schedule and In March 1993. E issued Availability Im-procedure. The new test instructions will be provement Bulletin (AIB) 9301, " Steam Tur-added to all E nuclear turbine customers' bine Overspeed Protection System"(reprinted instruction books. as Appendix D, courtesy of Westinghouse Electric Corporation), which superseded CAL 4.4 General Electric Power 92-02. AIB 9301 expanded upon the original Generation Division CAL 92-02 recommendations. It reiterated the importance of on-line testing of individual Examination of technicalinformation pro-SOVs and it informed owners that hardware vided to owners of General Electric Company modifications were available that would allow (GE) turbines (Technical Information Letters individual SOV testing and also permit on-line [TILs], operations, maintenance, and testing replacement of defective SOVs. The bulletin instructions and manuals, etc.) indicated that emphasized the importance of assuring GE has routinely provided its turbine opera-backup or alternate overspeed and trip pro. tors with strmgent requirements and recom-tection during turbine testing and noted the mendations to prevent or minimize the availability of hardware modifications to likelihood of a turbine overspeed event. GE provide such redundancy. AIB 9301 also appears to have excelled in providing its noted the availability of stainless steel poppet. turbine owners with turbine instructions type SOVs to replace the carbon steel spool. specifying what actions to take in the event of type Parker Hannifin SOVs. In the future, E an unsuccessful test; E turbine owners had will fill orders for spool-type SOVs with not received such gu, dance. i poppet-type SOVs as like-for like replace-ments to mount directly m place of the spool-Over the years, GE's guidance to its turbine owners has covered most of the areas which type SOVs. AIB 9301 recommends that mecham, cal trip systems like Salem's low were found to be the apparent or root causes bearing oil, low vacuum, high thrust, and of the Salem overspeed event as noted in { 20/AS'I, trips be tested monthly. PSE&G's SERT report and the NRC-AIT repon. AIB 9301 also recommends that a second Unfortunately, discussions with turbine engi-20/AST be installed in the, system to allow neers at several plants with GE turbines electrical trips to be effective when the test showed a wide variation in how individual handle is held. Furthermore, AIB 9301 ree-plants follow GE's recommendations on ommends that all um,ts have at least tw turbine control systems and their auxiliaries. mdependent means of tripping the umt on an For example, turbine engineers at one plant overspeed. indicated that their plant conscientiously adhered to almost all of GE's guidance. Regarding maintenance and inspection, CAL However, turbine engineers at another plant 92--02 and AIB 9301 both recommend that,if acknowledged that the plant personnel dis-one SOV sticks, all SOVs should be removed, agree with many of GE s testmg and mam, - replaced, or rebuilt, and then retested. Fur-tenance recommendations and, as a result, thermore, W recommends any SOV rebuilding disregard many GE turb, e TOPS and control m should be done "only by valve manufacturer system recornrnendations. approved vendcr. [ sic]" After the Salem overspeed event, GE reviewed its equipment and the guidance it had pro- +rhe nt .r of soV in nuclear and fossil plants with W main vided to users ofits equipment. At a meeting turt>ines is about looo-a of GE turbine owners on May 19,1992, GE spoolg sOVs and 600 groximately 400 rarter iiannifin another manufacturer's poppet-g g 21 NUREG-1275, Vol.11

the Salem event to their customers, noting GE's existing testing and maintenance important differences between the W Salem recommendations, 6a design turbine and the GE design turbine. GE contends that rigorous adherence to guidance 4.5 Nuclear Power Plant Insurers provided by GE to their turbine owners would prevent destructive overspeeds like the one at When the author visited nuclear power plants Salem Unit 2. GE's guidance emphasizes the to discuss licensee actions in the area of tur-necessity of: (1) periodically testing the turbine bine overspeed, the issue of nuclear insurers trip system (testmg requirements as described arose. Subsequently, the author had several in GEK 46527, Revision B, February 1980sa, discussions with the major U.S. nuclear (2) investigating failures that occur during the insurers and visited one, testing and remedying the failures diligently (GE's guidance clearly outlines the actions to The insurers have noted that recent claims be taken in response to equipment failure), history shows many significant insurance com-and (3) sequentially tripping the generator. Pany payouts for the main turbmes and other The circuitry is designed so that the generator BOP equipment 1osses. The insurance com-can be removed from the grid only after the Pames readily pom, ted out that a major reason turbine is tripped, all main and reheat steam f r disproportionate payouts on BOP equi 3-flow has been interrupted, and the generator ment is that the NRC does not scrutinize t le is motoring. GE guidance on installation of BOP equipment closely. The insurance com-control circuitry to assure sequential tripping panies assign staff to each nuclear station. of the turbine has been available since 1980. The functions of this staff are to work with the utilities to promote safe plant operation, to With regard to GE's longstanding emphasis reduce risk,7 and to prevent loss. The insurers' on the need for turbine testing, it is interesting negotiatmg tools are premium adjustments to note that in 1975, GE informed its turbine and penalties. Frequently, utilities disagree 5b owners that "some customers have discon. with their insurers' recommendations and, as tinued testing because of either real or a result, some utilities are willing to take a imaginary problems of false tripping during premium penalty in lieu of doing what the such procedures. These false trios must be insurer recommends. For exam ale, during one t corrected and must not be allowed to serve as plant visit, the author learned 11at the licensee a reason for not testing. [ sic]" had decided not to follow its insurer's recom-mendations regarding maintenance and In discussions with GE,6 AEOD staff learned inspection of the TOPS SOVs. The insurer that GE :eviewed their turbines and TOPS recommended that each trip solenoid valve in and did not find any areas where equipment, the turbine trip system shall [ sic] be removed, procedures, or guidance need to be modified replaced, or rebuilt and tested per manufac-to prevent an overspeed event. However GE is turer's instructions at least every 6 operating conducting a study to identify ways to reduce years. The licensee felt that performing the the likelihood of spurious scrams during auto-maintenance at 6-year intervals is unnecessary matic overspeed testing. It will provide recom-since that station had not had any problems mendations to utilities for the implementation with those valves. The licensee's turbine of specific control system improvements and engineers stated that they had reviewed the will reiterate the need to comply with issue and determined that from a cost effec-tiveness standpoint, rather than performing the maintenance recommended by the insurer, hoeneral acetric com(sf, summary "rbine Instructions, steam Tu " Periodic Operational , GEK 46527, Revi. sion B, February 1980. 6'Ielephone discussion, s. Abchon, GE, and II. L Ornstein,

1. General Electric Thchnical Information letter 769-2 NRC, November 1,1994.

Attachment, "EllC Fluid systems Wlve *Ibsts," March 1975. 'For an insurance company

• risk" 4 defined as direct physical damage, consegmage from t nsients to other components
• Ihghone discussion, s. Abelson, GE, and II. L Ornstein, ential damage ruulting from failure, and segential N, september 22,1994.

NUREG-1275 Vol.11 22

the licensee would pay the adCtional pre-operators noted Waterford's willingness to mium penalty that would be charged if the adopt forthcoming E recommendations for maintenance was not performed. assuring cleanliness of the AST and EHC In discussions with the major insurers in late 1992, the staff learned that, after reviewing the The applicability assessment report noted Salem overspeed event, the major U.S. nuclear that, like Salem's, Waterford's testing proce-plant insurers were modifying their guidance dures were incapable of detecting a single and recommendations for operation, mainte-failed SOV (OPC 20-1 or OPC 20-2). Conse-nance, and testing of turbines and TOPS. quently, the Waterford staff recommended Since the guidance and recommendations pro-that all five SOVs in the turbine overspeed vided to the site representatives are proprie-control system be tested independently. The tary information, this issue is not discussed licensee formulated a procedure to determine further in this report. the operability of each of the OPC SOVs. The first independent test of an OPC 20 SOV was 7b. It revealed 4.6 Waterford Unit 3 performed on Febr.iary 21,1992 a failed SOV (Parker Hannifin MRFN 16MX The Waterford Unit 3 plant has a 1075 MWe 0834, the same model valve as the ones that Combustion Engineering (CE) reactor and a failed at Salem Unit 2). As the Waterford staff E turbine and generator. proceeded to test the second Parker Hannifin MRFN 16MX 0834 SOV, they were anxious After the Salem Unit 2 overspeed event, that it work satisfactorily; otherwise, they Waterford Unit 3 performed an " applicability would have found themselves in a situation assessment" of the Salem Unit 2 overspeed similar to that at Salem Unit 2-performing a 7 event a. The operators noted that the Water-new test, finding both SOVs failed, suspecting ford Unit 3 TOPS is very similar to Salem that the SOVs were really operable, and Unit 2's but it did have a sigmficant design assuming that the surveillance testing proce-improvement. As shown m, Figure 8, an dure was flawed. The surveillance test of the additional SOV,20-2/AST to dump AST fluid second OPC SOV at Waterford Unit 3 found and trip the turbine if a reactor scram or a that it did operate satisfactorily, confirming valid turbine tnp signal is generated by the.l that the new surveillance testing procedure AST system (i.e., vacuum tnp, low bearm, g oi was not flawed and that the first SOV which trip, thrust bearing trip) while the turbine's had been tested had truly failed. mechamcal protective devices are bemg tested (and the trip signals are bypassed by the The licensee examined the failed SOV and operator holding the trip test lever). Conse-sent it to an independent laboratory (Power quently, the Waterford Unit 3 staff concluded Dynamics, Inc. of Harvey, LA) for additional that an overspeed event like the one at Salem inspection and failure analysis. The inspection Unit 2 could be averted by successful and failure analysis 7c found that five areas of operation of the additional 20-2/AST SOV. the SOV were degraded. The licensee did not think that any one area of degradation alone 'Ute applicability assessment report noted was responsible for the failure of the SOV to that, unlike Salem Unit 2, Waterford Unit 3 shift position on receiving a demand signal. cleans the AST and EHC system reservoirs However, the cumulative effects were obvious; before starting up from EACil OUTAGE and that, in accordance with E's guidance, the fullers earth filters in the EHC system are }tgdylN e sta r t t g ,,p,,,,,, normally in service. Furthermore, the March 2,1992. 7cM. shockley, Enter rations, Inc., " Failed Parker Valve Power ics, Inc., memorandum to E. Braumer, 78Entergy Operations. Operations support and Assessments Report 92-005. February 13.1992 Model No. MRFN 0834." August 8,1992. 23 NUREG-1275, Vol.11

Z C =

n DUMP VALVE m

i mRUST BRO tJDWOLPFiESS O ---l VAcuou TAP SOLENOD TRP sEnm g vg mnomE VALVE -j ---i l"" I AsT me g g VALVE ~ l _- _ __ _ _ _.I nn m 1 l EMERTRP l NiY. g ______,i gj m hI l l F W OTE INTERCEPT VALVE Alfr STOP OPERATOR l l '----- ) q.: Tur m E W g q=j P"$s

• a cut or s i

sEn m me ,g g oovengany,tyg VALVE CH g [ 7 o.s. me c TEST LEVER p 4. - - (NTERFACE2h=== 'ALVE i g~1 V i M 3 y s s } O O i 1 SOLENCOS -2 =enesi m an = LUBE ~ ot ELECTRO-HYDRAUUC FLUID SYSTEM AUTO-STOP O!L SYSTEM Figure 8 Waterford Unit 3 turbine control system

(1) Frayed electrical wiring-14 of 17 strands (5) A small piece of nonmetallic material of wire at one termination were frayed, believed to possibly be part of an 0-ring However, no short circuits were found was found in the SOV's pilot port. and laboratory testing found the colenoid able to actuate properly when only three In summary, the licensee postulated that the strands of wire were connected. most probable cause of failure was " sticking of the SOV internals due to contamination." (2) Three of four 0-rings were found ex-truded and swollen. Incompatibility 4.7 Comanche Peak Units 1 and 2 between the O-rings and the hydraulic and Siemens/Allis Chalmers fluid or possibly excessive temperatures lbrbines were suspected as the causes for these Comanche Peak Units 1 and 2 are 1150 MWe degradations. The licensee didn't think that the extruded and swollen 0-rings lY PWRs having Siemens/Allis-Chalmers had blocked any valve ports; however, no m in turbmes and generators. Unit I has been mention was made of the additional operational since 1990. Unit 2 received its resistance to motion that could have been Peratmg b,eense m 1993. j caused by the swollen 0-rings. On learning of the Salem Unit 2 overspeed event from the NRC (IN 91-83 [Ref. 8]), the (3) A strainer on the main plunger of the licensee evaluated its turbine generator pre-i SOV was partially obstructed with a ventive maintenance program. Specifically, the jelly-like' substance. 'Ihe hcensee noted licensee evaluated the need for establishing that the same jelly-like substance had periodic preventive maintenance on the SOVs been previously observed in the EHC in the main turbine's EHC system and on the system and the EHC system had been instrumentation required to trip the main flushed previously to remove the jelly-like turbine. The licensee also evaluated the need substance. The failed SOV had been to " establish surveillance / operational testing" removed during the previous flushing of EHC system SOVs. The evaluation noted 8a operation. It is possible that some of the that the EHC SOVs were not included in any Jelly-like material found on the SOV was preventive maintenance program. Apparently, residual material that bau, not Seen the turbine manufacturer (Siemens/Allis-thoroughly removed during the flushing Chalmers) did not provide detailed guidance operation. (The most likely source of the regarding preventive maintenance of SOVs. Jelly-like substance is hypothesized to be moisture and heating of the Fyrquel EH Comanche Peak uses Fyrquel 220 EHC fluid. fluid (see Section 6.5 of this report).8) The EHC system was supplied with desiccant drying columns and it appears that rigorous (4) The laboratory inspection found that the preventive maintenance recommendations for SOV's manual override button was stick-the EHC fluid were provided by the turbine ing. Because of the disassembly process manufacturer in the operations and in the inspection, the laboratory could not maintenance manual, determine if the SOVs plunger had been sticking during the test. The licensee requested that the main turbine supplier review NRC IN 91-83 and rec-ommend any corrective actions required at Comanche Peak. Siemens provided information which stated 8 that their turbines cannot overspeed for the following reasons: 81n a visit to waterford Unit 3. the author of this report was informed that. carly in the hfe of the plant. the moisture Iurer' sp circ r,a n Er Report, "NRC s ng r I ms I cr. f er ct ic nd s f7 g implementing an aggressive program to assure the lyrquel,s integnty, the license had few, if any, problems with the sbZ. Racie. Siemens Power Corporation. letter to R. T Jenkins, Fyrquel Ell fluid. I U. Electric. March 19,1992. 25 NUREG-1275, Vol.11

F (1) He stop valves on the Siemens units tive maintenance were addressed in a different 9a cannot reopen until the trip signal has letter. In that letter, Siemens listed SOVs cleared and the turbine is manually requiring maintenance every 18 months (full relatched. disassembly and inspection of all valve and solenoid assemblies and replacement of all (2) The Siemens units have redundant elastomers, gaskots, and "other expendables"). emergency trip SOVs whereas W units Apparently, before 1992, the turbine manufac-like Salem's have only one (ET-20). turer had not provided the licensee with guidance for preventive maintenance on (3) The Siemens units have a 107 percent turbine control system SOVs. " Mechanical-Hydraulic Control" speed governor that overrides all other control Siemens emphasized that, to assure proper signals and closes the control valves, operation of turbine protection devices, all components of the TOPS must be inspected in (4) The Siemens units have redundant accordance with the Siemens' operations i 110 percent mechanical trip devices for instruction manual. the TSVs. 4.8 Specialized 'Ibrbine Overspeed During automatic turbine testing (ATT), a Protection System Solenoid-J redundant trip circuit is established and the Operated Valves TSVs will close m, response to a valid tnp signal. However, Siemens acknowledged that On a visit to Germany, the author of this during on-line manual testing of the overspeed report examined an SOV made by Herion and i system, the mechanical and electrical over-used in European fossil unit TOPSs. The speed trips are bypassed. As a result, during Herion valve has been stated to be very manual testing there is no mechanical or reliable.10 ne SOV has a second coil and electrical overspeed protection and overspeed slug. On demand, both plungers are supposed protection is only provided by the operator at to shift. However,if the critical SOV fails to the front standard. Siemens noted that during shift, the second plunger will activate and hit manual testing, "overspeed control is in the the stuck plunger like a hammer. Thus came hands of the expert tester." the name " hammer valve." Additional infor-mation about the hammer valve appears in Siemens noted that, to eliminate dependence Appendix E. on the operator during manual testing, a " dual electrome overspeed protection circuit acting 5 RECENT OPERATING on two tn,p solenoids is go be mstalled durm, g EXPERIENCE the next refuehng outage. Siemens also noted that instrumentation re-5.1 Diablo Canyon quired for tripping the main turbine is exer-5.1.1 Diablo Canyon Unit I hrbine cised and verified operable with each success-Overspeed Event (September 12, ful A'IT. However,if any ATTis unsuccessful, 1992) Siemens must be notified for their " assess-ment and recommended corrective action." Diablo Canyon Unit 1 is a 1073 MWe E PWR Siemens also indicated that all components of with a W main turbine and generator. On the TOPS must be inspected in accordance September 12,1992, while the plant was shut-with the operations instruction manual. tmg down, the turbine oversped to 1870 rpm Siemens' recommendations for SOV preven-(the design speed is 1800 rpm)(Ref.10). ' Grand Gulf has a similar but not identical turbine control sy> M nompso n. siemens Power Corporation, letter to C. Montgonery,T U. Electric, April 29,1992. pee d$ri gYr$i ie i ry o revent n E 8No failure, to function on demand: however. sonx minor pand testing. Range les age had been recorded (see Appendix E). NUREG-1275, Vol.11 26

i The reactor had been tripped, and the turbine 145) both being open resulted in the accelera-l was successfully tripped from the control tion of the turbine to the OPC setpoint of room panel, closing all TSVs and governor 1854 rpm. The OPC system actuated, closing i valves. Subsequently, the operators relatched the governor valve, MS-1-FCV-141. When the the turbine, and the low AST pressure switch OPC trip point was reached (1854 rpm), the (63-2/AST in E system drawings [PS-22B in operators also tripped the turbine; nonethe-Diablo Canyon nomenclature]) failed. (A less, the turbine reached a maximum speed of similar pressure switch,63-3/AST was implj. 1870 rpm before the steam supply was cut off. cated in the Salem Unit 2 and St. Lucie Unit 2 overspeed events, as noted in Sections 3.1 and It is mteresting to note that 6 months earh.er n March 22,1992, the licensee shut down 5.2.1 of this report.) The malfunction of Unit 2 because of an m, operable high pressure 63-2/AST caused the digital electrohydraulic TSV, MS-2-FCV-144 (Westinghouse Electnc (DEH) computer to send a signal to open the Corporation-Model #723-3-119). The TSV governor valves to meet a speed demand of failure was reported in LER 50-323/92-003 1800 rpm. Because of multiple failures m the (Ref.11). The valve disc separated from its EHC system, bypass valve steam leaks, EHC swing-arm. In the March 10,1993, revision of system SOV leaks, and a complicated set of the LER,50-323/92-003, Rev.1 (Ref.12), the evolutions, a main steam stop valve (MS licensee noted that the root cause of the TSV FCV-145) opened and the governor valves, failure had not yet been determined. This MS-1-FCV-139, -140, -141, and -142 opened failure is viewed as a precursor to widespread as well (see Figure 9). The combination of one common-mode failures. There had been governor valve (MS-1-FCV-141) and its asso-similar failures at other plants. In February ciated main steam stop valve (MS-1-FCV-1990, E alerted their turbine owners to this Main Steam l )( Valves Stop FCV-145 FCV-146 _-)(- Valves FCV-142 FCV-141 Control v v HP Turbine / 1)(1 N FCV-140 Control Valves FCV-139 FCV-144 FCV-143 Vanes Stop )( Main Steam Figure 9 Diablo Canyon turbine steam admission valves 27 NUREG-1275, Vol.11

type of problem (Operations & Maintenance eventitb revealed that the AST pressure Memo 108, which is reprinted in Appendix F switch that failed at Diablo Canyon on of this report, courtesy of E Power Genera-September 12,1992, did not fall under any tion Business Unit). This issue is an extremely preventive maintenance program. Preventive important one because, as the licensee noted maintenance at Salem Units 1 and 2, Beaver in the LER, "FCV-144 protects the HP Valley Units 1 and 2, St. Lucie Units 1 and 2, turbine (SB)(TRB) from overspeed if the Waterford Unit 3, and other plants was i associated turbine governor valve (SB)(FCV) similarly deficient. downstream of FCV-144 should fail to close when the overspeed trip or the normal trip 5.1.2 Diablo Canyon Unit 2 Test Handle mechanism operates." The licensee noted that, Trip (January 30,1993) during the spring 1993 outage, the licensee's inspection found other main steam stop valves On January 28,1993, the author of this report which appeared to have signs of degradation visited Diablo Canyon to review turbine over-in areas where FCV-144 had failed Speed issues and turbine building hazards. previously.11 While in the turbine building, the author mentioned to the Diablo Canyon staft that the The September 12,1992, overspeed confirmed Diablo Canyon front standard panel was that all governor valves opening is a credible essentially the same as that of Salem Unit 2 at event. The similarity with the Salem Unit 2 the time of the overspeed event. The author overspeed event of November 9,1991, is rather told the Diablo Canyon staff that the Salem striking; in both cases, the governor valves SERT report indicated that the team had not opened or reopened as a result of a failed ruled out the possibility that t' e operator at AST pressure switch 63/AST Another im-the front standard panel had inadvertently portant data point derives from the data on caused the trip by moving the test lever very turbine control system failure rates in E slightly (about an inch). He also noted the reports WCAP-11525tia and WCAP-11529 human factors enhancements that Salem had (Ref.13). Those reports are probabilistic anal-made after the overspeed event, particularly yses that were submitted to the NRC in 1987 placement of a stationary handle on the front to support E turbine owners' requests to standard. The photographs in Figure 10 show extend the turbine surveillance testing inter-the original front standard panel and the vals. The failure rates given in WCAP-modified front standard panel at Salem 1152511a for the 63/AST pressure switches are Unit 2. The new stationary handle in Fig-higher than the failure rates of all other ure 10 would prevent an inadvertent trip from I turbine control system components listed in operator fatigue during turbine testing (see that report. The author of this report is not Section 3.4.6). Although NRC and industry aware of any guidance provided by W to the reports have been written on the Salem E turbine owners for preventive maintenance overspeed event, inforrr.ation on this par-or change-out of the 63/AST pressure ticular human factors enhancement has not switches. E guidance for maintenance of been disseminated to industry in any NRC or i these pressure switches is limited to only industry report. The author discussed this calibrating them as noted in the recently enhancement with the Diablo Canyon staff provided guidance of CAL 92-02 and AIB during his visit to the plant. Evo days after l 9301(Appendices C and D of this report). the author's visit to Diablo Canyon, Diablo Not surprisingly, Diablo Canyon's lessons-Canyon Unit 2 was testing the loss of con-leamed review of the Salem overspeed denser vacuum turbine trip signal, when the operator who was holding the test lever moved l "'IMephone discussion, C. P. Rhodes, i G&E, and H. L trip from 100 percent power (Ref. "14). i ornsicin. NRc May 4,1993. "*Mstinghouse I'lectric Corporation. (Westinghouse Propri-clary Class 2) Report WCAP-11525, "Probabilistic Evalu-ation of Reduction in 'nirbine Valve Test Frequency," June "bj. Ilinds, PG&E, memorandum to M. Angus and T Grebel, 1987-May 5,1992. l l NUREG-1275, Vol.11 28 l l

',[.. > gj., i n. 3.s _

enm;.

x .m... .Yi Y ? jj l - - +,c ,e s,, j'!;j.i vw 'J . 4 '. ; r(/s _, .....f.'. l$, ., ;&pp W I -3 y 2 g s.. .;m y s y i Q ~; 3 E g e ga . v i .e o { ..fi hk.-.. h ..e u i 1 it' ;[ 9} j O s y "' 7,gjh j, $$1. i

g,.

w, n u. a ~ 2 ,, y 4.. a T C5'a + c 2 N 1 > - [: .:: '- ' ~. ni 1 a j y 4 V.%. 2 l y. y l u r! m e5 l ? 2 l l;.. : g... ~ s In m x I,... V -k2

• • 4

=

s c g m e y,5 w aa + v. ~ ,dat e 1 ~ ) [ .s a Y. l j [ [.-[QJ _ se _9-c g .f.:. ' ; '.

b; ;'

i i l 29 NUREG-1275, Vol.11 l I

= During the spring 1993 outage, Diablo Canyon tripped, the operator had increased the Unit 2 installed a stationary handle on the potential for a turbine overspeed event.u front standard similar to the one that was in-stalled at Salem Unit 2 (as shown in Fig. The licensee took aggressive action to find the ure 10). In a May 4,1993, telephone conversa. root cause of the problem and fix it. The t2 tion, the author learned that the licensee was licensee assembled a large multidiscipline planning to install a stationary handle on the investigation team augmented by H field Unit 1 front standard during the next refueling service. utage Initial troubleshooting found that the ET-20 5.2 St. Lucie Unit 2 SOV had failed to shift position when it received a valid electncal signal. In addition, 5.2.1 St. Lucie Unit 2 Turbine Overspeed the 62/AST-X relay was found to have a loose Event (April 21,1992) connection on one pin (pin no. 6). Pin no. 6 is in the direct circuit for all 20/AST trip signals, St. Lucie Unit 2 is an 839 MWe CE PWR with including the control room trip manual push a E turbine and generator. On April 21,1992, button, generator lockout, DEH turbine after a record 502-day run, St. Lucie Unit 2 control system, de power failure, decreasing had a manual reactor scram from 12 percent AST pressure, steam generator hi-hi level, low power. The manual reactor scram should have steam flow anti-motoring trip, and 108 percent energized the ET-20 SOV and 20 AST electrical overspeed trip. solenoid resulting in draining of EH fluid, closing of the steam admission valves, and The investigation team also found relay tripping of the main turbine. The turbine did 62/AST-X had burned contacts. not trip. Within 2 seconds of tripping the reactor, a reactor operator pressed the turbine Either of these two 62/AST-X relay problems trip button in the control room. The turbine by themselves could have been responsible for did not trip. Several additional attempts were failure of the turbme to tnp when the manual made to trip the turbine using the control tnp push button was pressed in the control room push button, but such actions were in, room. effective. Approximately 1 minute later, the The licensee acknowledgedua that the reactor operator opened the generator output 62/AST-X relay failures could not have been breakers and closed the mam steam isolation valves. Approximately 3 mmutes after the detected by St. Lucie's surveillance program. As a result of the St. Lucie overspeed event, reactor scram, a, nuclear watch engineer the licensee examined the possibility of testing tripped the turbme from the front standard by usmg the emergency trip lever (Ref.15). Be-the control room manual turbine trip push button, the 62/AST-X relay, and the 20/AST cause the generator output breakers were open before the steam supply was shut off, the SOV. In an April 29,1993, telephone discus-14 sion, h,eensee engmeers indicated that hard-turbme ovgped to 1850 rpm (rated speed is ware modifications and changes to surveil-1800 rpm) . S, ce the overspeed protection lance testing procedures are being and have m system was set to actuate at 1854 rpm or 3 percent overspeed, the overspeed protection been made to enable surveillance testing of this equipment while the plant is operating. system was not challenged dunng this event. The licensee staff also noted that they had However, by opening the output breakers unie licensee' um on this event (Ref.15 focused on m before confirming that the turbine had jhgegt,rgi Pg,hgh(8uine*didNerEpNto ,b 1850 rpm. e i, C. Rhodes, PG&E, and 11. L j E*gf. 121',19 rb n 5 9 Ev at ' nip Failure Update," DAs/PsL #6 -92, May 14,1992.

2*D. A. sager, FPL, memorandum to NRC, "st. LAcie Unit 2, Docket ho. 50-389, Event Date April 21,1992,'nzrbine 3*relephone discussion, M. Uttle and L Batsch, FPL, and "Irip FaDure Update," DAs/PsL #697-92, May 14,1992.

II. L Ornstein, NRC, April 29,1993. NUREG-1275, Vol.11 30

i i considered installing a redundant AST not interfere with pilot spool motion. Like solenoid as had been recommended in W ET-20, OPC 20-1 and OPC 20-2 were found CAL 92-02 and AIB 9301(Appendices C and to have some rust particles which did not D of this report), but concluded that the affect valve operation. However, unlike ET-20, redundant 20/AST was unnecessary in view of the OPCs did not have any dirt buildup. He the other improvements being made, such as OPCs' internal ports were unrestricted allow-monthly testing of the 20/AST coil and the ing hydraulic fluid to drain freely when installation of a turbine trip SOV test and energized. MLEA indicated that the OPCs maintenance block to allow individual testing were fully operable and did not have symp-of the ET-20, OPC 20-1, and OPC 20-2 SOVs toms of incipient failure. However, MLEA did while the plant is on line. (The SOV test and note hard, tenacious corrosion deposits on the maintenance bk>ck is discussed below.) poppets inside ET-20 and both OPC 20 SOVs14a,ts. The deposits are typical of hydro-As part of its investigation, the licensee sent lyzed Fyrquel and indicate the presence of the ET-20, OPC 20-1, and OPC 20-2 SOVs to water. Another important observation noted an independent laboratory. Those SOVs were in the laboratory report is the fact that the the same type as the ones that had failed at Parker Hannifin SOVs have extremely tight Salem Unit 2 in November 1991. The inde-clearances and therefore can be very unforgiv-pendent laboratory, Main Line Engineering ing with regard to contaminants. Associates of Exton, PA (MLEA), which per-formed the investigations of the three Parker The laboratory report highlights the Hannifin SOVs that were removed from St. unforgiving aspects of the EHC system and Lucie Unit 2's EHC system, had performed emphasizes the absolute necessity for similar investigations on the Salem Unit 2 maintaining EHC system quality. It was SOVs. particularly concerned that particulates of undetermined origin were present in the Even though St. Lucie appeared to be doing a ET-20 SOV and that products of Fyrquel reasonably good job of maintaining the EHC hydrolysis were present in the SOVs even fluid cleanliness and had replaced the SOVs though before the record 502-day cycle, the laboratory found that ET-20 had stuck because particu. (1) the ET-20, OPC 20-1 and OPC 20-2 late matter was blocking ports inside the SOVs were in service for only one fuel

valve, cycle (extended as it may have been to a record 502 days)

The particulate matter, which was classified as " dirt," consisted of fused plastic, weld slag, (2) the licensee has performed EHC fluid organic fibers, sand, clay, and rust 14a. The flushing during each refueling outage source of the dirt was indeterminate. The flow of the Fyrquel hydraulic fluid through the (3) the licensee had maintained the hydraulic SOV pilot ports "...was either blocked or fluid in a manner which met or exceeded sufficiently occluded by the ' dirt' to substan. E's recommendations tially reduce the flow of hydraulic oil so that the main valve would not open" to dump the The author's discussions with licensee engi-EHC fluid to initiate the closing of the steam neers during his site visit at the heensee's admission valves. MLEA found some rust request durmg the root cause, investigation revealed that the dirt and moisture in the particles in the ET-20 SOV's pilot body and on the pilot spook however, those particles did Parker Hannifin valves were quite likely caused by fine particles from new EHC system filters, Solexsorb filters, which had

• Main tine Engineering Associates Test Report,
• Root malfunctioned and had to be replaced with Cause Failure Investigation for Parker-Ilannifin solenoid Operated Wives Removed From the EllC system of the st.

Lucie statson westinghouse 1brbine." M9000-TR04, DTelephone discussion. J. Murphy. MLEA, and II. t. June 5,1992. Ornstein.NRC. April 30,1993. 31 NUREG-1275, Vol.11

the original type (fullers earth filters). The new a turbine trip solenoid valve maintenance-test Solexsorb filters had been installed to reduce block to enable operators to test the ET-20, moisture, apparently because of previous OPC 20-1, and OPC 20-2 SOVs independ-moisture problems with the EHC fluid. ently while the plant is on line. The licensee designed the test and maintenance block. E After the root cause investigation was con-had been consulted during the block's design cluded, the licensee implemented many hard-

process, ware, procedural, and training improvements.

Some of the most noteworthy modifications and changes made or being made at St. Lucie Units 1 and 2 as a result of the April 21,1992, The test and maintenance block was tested overspeed event at Unit 2 are listed below: successfully before plant restart. However, on July 10,1992, while the plant was on line, the Modified the procedures and conducted licensee used the test and maintenance block e appropriate training to emphasize the to test ET-20 SOV and, contrary to the necessity of confirming that the main design, the testing resulted in a reactor scram. turbine has tripped before opening the The closing of the ET-20 outlet isolation valve i generator output breakers. followed by the successful opening of ET-20 caused a rapid (20 millisecond) pressure decay Installed a " turbine trip solenoid valve that was interpreted by the RPS as a loss of e maintenance-test block" and key switches load. The licensee noted (Ref.16) that the to enable operators to test the ET-20, transient and the resulting reactor scram were OPC 20-1, and OPC 20-2 SOVs unexpected. The modification had been tested independently while the plant is on line. before startup; however, because the RPS pressure switches are not activatcd until the Installed continuously energized monitor-reactor reaches 15 percent power, the e ing lights for 20/AST and ET-20, OPC preoperational testing did not provide a 20-1, and OPC 20-2 to verify circuit warning of the unexpected EHC fluid pressure continuity. spike. Installed a key switch on the governor e pedestal to alk)w monthly testing of 20/AST via the 62/AST-X contacts. As a result of the July 10,1992, reactor scram, the licensee suspended the EHC SOV monthly Added a coalescing filter cartridge to the testing until a reliable on-line testing method e EHC system to further reduce moisture could be developed. Subsequently, the licensee in the EHC Fyrquel system. redesigned the test and maintenance block to eliminate the pressure pulse (see Figure 11). The licensee also pursued the issue of replac- 'Ihe modified test and maintenance block ing the carbon steel Parker Hannifin SOVs isolates trip functions from the SOV being (ET-20. OPC 20-1, and OPC 20-2) with tested but remains available for the other two stainless steel SOVs. E is making such SOVs SOVs, introducing an alternate supply of available. (See Section 4.3 of (his report for a EHC fluid from the EHC supply header. The discussion of this modification and E's other alternate fluid supply eliminates the possibility recommendations.) of feedback to the emergency trip header on the RPS, thereby eliminating the possibility of 5.2.2 St. Lucie Unit 2 Spurious Turbine causing an unwarranted reactor scram. To Trip During Solenoid-Operated minimize human errors, the SOV testing Valve Testing (July 10,1992) requires the use of key switches. The revised test and maintenance bk)ck was tested ex-As noted above, because of the April 21,1992, tensively at Florida Power and Light Com-turbine overspeed event, the licensee installed pany's (FPL's) Manatee fossil plant. In April NUREG-1275, Vol.11 32 l

CLOSING INLET ISOLATION VALVE AltDWS TESTING OF ASSOCIATED SOLENOID VALVE. CLOSING BOTH INLET AND OUTLET ISOLATION VALVES ALLOWS ASSOCIATED SOLENOID VALVE REPLACEMENT VWTH SYSTEM IN OPERATION. TRIP FLtRO FROMTV &RH STOPVALVES TRIP FLlND FROMINTERCEPT GUAGE PRESSURE INDICATESSOLEN010 VALVE POSITION LDW VALVEOPEN HIGH-VALVE CLOSED ~~~~~] ["5E60@ ]l1 ~ ~~ M [lIETlSI ~~] ~ r l"LETlS0@l ! !"d [l I l 1 i, 1, __a __a __a i r__ ~~I'X-0 fi~~c__[-o fi~~c__[-o Il Il Le_9ec j i Lu _e l L__ _eET j i iou u TiSO 1 iou u TiSO 1 iOUuTe0 iVALVE iVALVE y iVALVE _1_ i l g i i __i T l(3S{B_LgC[__3 T l DES [B_lgC[__;l - l T != stb _tgCE __J uA=T. Gt y i I l (Test Mode) l (NomalMode) w i i il i I I i I j_ _ _ _ _ _ _ _ _ _ _ _ _ t _ _ _ _ _ _ _ _ _ _ _ _ _i y i TO DRAIN = = = = NEW PIPING l D0 STING BLDCKP! PING FROMDEHCON0m0NING RLTER SUPPLYHDR. Figure 11 St. Lucie block for testing EIIC system SOVs independently 33 NUREG-1275, Vol.11

5 t6 1993, the revised test and maintenance block After the problem with the turbine bypass was being installed on Unit 1, with Unit 2 isolation valves was discovered, the plant was installation to be done later (with no on-line shut down on November 1,1989, so that other EHC system SOV testing to be performed on valves with Garlock 938 packing could be Unit 2 until after the installation). examined. Garlock 938 was also used on two motor-operated valves (MOVs)in the core 4 5,3 Big Rock Point spray system. Examination of the valves in the Big Rock Point is a 69 MWe BWR with a core spray system found the packing hard-ened, but the valves still able to function. It turbine unique among other U.S. LWRs. The was not clear how much longer the Garlock turbine operates at 3600 rpm and was built by 938 would have had to harden to cause the the GE, Lynn, MA division. GE's Lynn, MA MOVs to be unable to stroke. The licensee division no longer makes steam turbines, and noted (Ref.17) that, after the failures, Garlock no other similar turbines are in service at U.S. representatives still supported the use of nuclear plants. Nonetheless, the failures in the Garlock 938 as an acceptable spacer material. turbine control system at Big Rock Point are 'Ihe licensee also noted that Garlock 938 had very enlightening, and they provide lessons to been used for 40 years as a " severe use" pack-be learned. ing and had also been used as a spacer at Big Rock Point from 1987 to 1989. At a recent 5.3.1 Big Rock Point Common-Mode Bypass Valve Failures Air-Operated Valve Users Group Meeting, l7 the author learned that Garlock Corporation On October 27,1989, the licensee observed Performed extensive laboratory analyses on common-mode failures of the turbine bypass the hardened Garlock 938, but was unable to valve (failed to open on an open signal and on conclusively determine the cause of the October 31,1989, the turbine bypass isolation failures that had occurred at Big Rock Point. valve failed to stroke during a test [Ref.17]). The cause of those two failures wa,s the 5.3.2 Big Rock Point Repetitive Failures licensee s use of Garlock 938 packmg to re-of the 'Ibrbine Trip System pack the valves during turbine maintenance. On June 3,1992, August 24,1992, October 5, Garlock 938 is a compression packing manu-1992, and February 28,1993 (Refs.18 through factured from aluminum tinsel treated with

21) and August 30,199217a, the turbine failed -

natural rubber cement and die formed, then to trip on demand because the hand-trip treated with zinc. The packing hardened and solenoid (HTS) failed. The HTS' function is to was bound to the valve stems, preventing their automatically close the TSV on a reactor operation. At atmospheric conditions, Garlock scram. The HTS is actuated automatically by 938 is flexible and easy to install. However, it automatic trip signals and can be actuated becomes hard and brittle when subjected to manually by a push button on a control room heat and pressure. At Big Rock Point, the panel. The licensee noted17b there had been Garlock 938 became a tenacious ceramic-like eight failures of the HTS before 1992. (See material shortly after being subjected to high 'Pable 6.) temperatures and pressures. The Garlock 938 was installed during an outage. The problem On June 3,1992, the turbine failed to auto-was found during power escalation while the matically trip on a reactor scram (Ref.18). plant was at 31 percent power. Conventional methods for removing the hardened Garlock 938 were unsuccessful. Eventually, it was 8'Diwussion. II. L Ornstein. NRC, and D. D. Crocker, G8'I"k I"" J""' 3 3 3-removed by drilling and using a chisel-an yfagne.7,g'g,"Qa[,giofpRepofp,D operation that took 3-1/2 days to complete. P 1992. 1*Riephone dirussion, L Batsch and M. Uttle. ITL and rNn" 's eo ae 2 b

11. L Ornstein. NRC, April 29,1993.

Close." October 8,1992. 1 NUREG-1275, Vol.11 34 { l l

Table 6 Big Rock Point failure to trip history

• before 1992 M1E EVENT l

04/06/78 The turbine failed to trip from loss of load. Manually tripped stop valve. Replaced coil. 12/31/84 CV-4200 failed to close on signal from push button, tripped from front standard. f The trip coil was found to have an open winding. Upon inspection, it showed four ( score marks corresponding to the location of the mounting screws. Coil replaced. 04/05/85 While shutting down the plant, the turbine stop valve failed to close. Push button and X phase failed. Manually tripped from front standard. The 125 V de solenoid was found energized and the trip mechanism stilllatched. A significant amount of additional force was required to assist the solenoid to trip the handle latch. Mechanically, there seemed to be a misalignment of the solenoid (85-MSS-0019). 02/11/86 Push button and Y-phase failed to trip turbine during shutdown. 'Ibrbine tripped from the front standard. The solenoid was energized during both push button and Y phase attempts. The toggle links were still in locked position. The force exerted by the energized coil was not sufficient to overcome the friction in the mechanical I links t (86-MSS-0011). 07/01/86 Thrbine failed to trip after reactor scram. Push button failed, tripped at front standard. Root cause determined to be worn mechanical links and also out of adjustment. New trip device was installed during 1987 refueling outage (87-TGS-007). 04/08/88 During plant shutdown, the turbine trip failed from the push button, and the Z-phase contacts. This resulted in a 116 OCB trip, but the stop valve failed to close. Subsequently closed from the front standard. (1) Broken lead to the solenoid coil, (2) broken wire strands at crimped wire lugs, (3) aged wires in front standard, (4) broken wire at connection to the are suppression capacitor. 07/01/88 During S/D, the HTS did not function properly. HTS would not trip and the continuity light was out. Bad wiring connection. Installed indicating light in control circuitry. Replaced coil, armature and solenoid link stud mechanism, also the stud spring was locked to a position causing the solenoid link bar to twist the toggle links and latch. 07/18/90 During S/D, the HTS did not trip when manual turbine trip push button was depressed. Tripped using front standard. Wear in mechanical linkage parts caused misadjustment of solenoid trip latch causing linkage binding to the point that the solenoid could not pull up the linkage to release the trip latch. 'Dweet ses i umer Power Company, Deviation Report D-BRP-92-071, *Tailure of"nirbine stop %1ve (CV-4200)Tb ' 35 NUREG-1275, Vol.11

Operator attempts to manually trip the tur-could not determine if the lug had contributed bine using the push button on a control room to the failure. The HTS was replaced with a panel also failed. Subsequent examination of new one which was provided by the manufac-the plant data determined that the HTS had turer's representative. As a result of this received demand signals and that the HTS experience, the licensee planned to have the. had failed. Approximately 1 minute after the HTS manufacturer's representatives perform reactor scrammed, a control room operator future adjustments. found that the generator output breakers were still closed. He opened the output breakers and found that the turbine had not tripped; On October 5,1992, during a plant shutdown, the stop valve was still open. He pushed the control room operators were unable to trip the HTS manual trip button in the control room. turbme usmg the control room push button to When the push button was found to be in-actuate the HTS (Ref. 20). The generator field breaker opened Aga,, the turbm,but the TSV did not tnp. effective, an auxiliary operator was dispatched m e was tripped manually with to the turbine's front standard. Using a hand trip lever, the auxiliary operator successfully the hand trip lever at the front standard. tripped the turbine. Four minutes elapsed from the reactor scram until the turbme was The manufacturer was contacted about the successfully tripped. The turbine had the failure. It was believed that the HTS had ex-potential to overspeed from the time the out-perienced a hydraulic locking. Although there put breakers were opened until the turbine were traces of oil leaking from the stem and was tripped (3 minutes). However, because the bushing interface of the HTS, the leak was not steam admission valves were closing in re-believed to be the cause of the malfunction. 18 sponse to the original transient, the turbine did not overspeed. The licensee also verified that the hydraulic oil was clean.and the failure was not caused by After plant shutdown, the licensee,s root cause contaminants or particulates in the oil. The mvestigation of the event determined that the licensee changed out parts of the hydraulic HTS (manufactured by Ruggles Kimgmann) system to provide less chance for hydraulic had mecham,cally bound. The bcensee dis-locking. In addition, the HTS body was assembled, mspected, readjusted, and success-replaced. However, the SOV plunger shaft was fully tested the HTS. reused. In order to help keep the HTS SOV's piston assembly from sticking, the licensee On August 24,1992, the HTS again failed to increased the HTS spring tension. actuate on demand (Ref.19). He plant was in hot standby and the licensee was performing a On February 28,1993, while shutting down the pre-turbine startup checkout. The actuation plant, the HTS failed again and the turbine signal to the HTS was manually initiated from was again shut down with the hand trip lever the control room panel. The HTS manufac-at the front standard (Ref. 21). 'nie licensee's turer's representative examined the failed root cause failure analysis found that wear on HTS. He noted that the mechanical linkages the internal parts of the solenoid was causing (see Figure 12), which were set in accordance the plunger to hang up. The licensee noted in with the plant's maintenance instructions, did a March 3,1993, conference call with the NRC not meet manufacturer's recommendations. It that after the October 1992 failure, the " top was suspected that the improper setting had works assembly on the HTS had been re-caused the mechanical binding. placed, but that the solenoid and shaft had not been replaced." Furthermore, the licensee When electrical tape from the HTS was re-noted that even though the SOV had failed moved, a terminal lug fell off. The licensee several times before, the SOV's internals had never been inspected for wear until Febru-l*SINEEN EMiSI"p7eI/e"Agu'iSiNNm ary 28,1993. The licensee's staff noted that d wed. they were pursumg two possible corrective NUREG-1275, Vol.11 36 i

e I .i e f5 e o2 at Cat 22222E22 R E II. U mum, a,h..n-,g a l / g,,,, x, 33 q, g . l l .g s i I , L L!i w E 4.m " ' Y s 4 }j.. =: $.l .W j $ ) ~- (mm^ sm; y [ W f o!- .m inir-mu m h ~ \\ ~ l & gk W l c \\. b i L,,,,,,,,lp;;L J n j\\ L 5 i LJ "\\ u e a ,, w - 5: . e i. ee = ....m; i I I 1 llliillilitiililliIIIllilaril Iliilg i !I l il -aavaeweedvWereseveSa#REE8h5RanNR1R 37 NUREG-1275, Vol.11

actions. For the short term, depending on the valves, four intercept valves, and two reheat schedule, the licensee would either replace the stop valves performed sluggishly. The valves, HTS with a refurbished one or replace the which are supposed to close within 1 sec-ond sa, took almost 2 minutes to close. The t HTS with another valve of a simpler type before power ascension (see Figure 13). For management at both Palisades and E turbine the long term, the licensee considered modify-division were sensitive to the problem. The ing the manifold block that housed the HTS licensee's position was that the plant would to allow another valve to be added in parallel not be restarted until the problem was fixed. to the HTS. The extra valve would preclude The licensee initiated an aggressive program another HTS failure from tripping the turbine. to determine the root cause of the problem and followed up by taking prompt corrective 5.3.3 Big Rock Point Long-Term action. Unavailability of Emergency Governor Exerciser The problem was suspected to be caused by flow anomalies in the EHC system or possibly The emergency governor exerciser (EGE)is a malfunctions of the DEH control system backup overspeed trip that is integrated into computer or its software. the turbine control system. It is designed to trip the turbine if a condition requiring a Initial troubleshooting pointed toward "too turbine trip occurs while the plant is on line much flow"in the trip header or possibly a and the turbine's overspeed protection system restriction in a drain line. There was concern is being tested. (During testing, the turbine's that the ET-20 might have stuck in an overspeed protection system is bypassed.) intermediate position. l In Inspection Report 50-155/92-020 (Ref.19), In addition to the E site representatives, sev-NRC inspectors noted that the licensee per-eral E field service engineers were dispatched formed a special test of the EGE indicating to the site. Subsequently, E brought special 19 lights which v.ere not reparable during the equipment to the plant to measure EHC August 1992 outage. The inspectors also noted system flows and measure system pressures. l that the EGE has not been operable and has Assistance was also provided by E personnel not been used for several years. Consequently, at E turbine division headquarters (Orlando, for several years, the licensee has not tested FL). E personnel performed com auter simu-the overspeed protection system while the lator analyses of the Palisades turbine's con-plant was at power. GE strongly recommends trol system. On September 23,1992, the E that for the 1800 rpm turbines, the overspeed site representative stated that overall about I control systems be periodically tested during 150 people for the licensee and E were work-power operation (see Section 4.4). The ing on the problem, including 20 engineers per 3600 rpm Big Rock Point main turbine has a shift plus 4 engineers at Orlando, 20 backup overspeed device (the EGE). which, if operable, would provide protection during The E site representative noted that the EHC l periodic tests of the TOPS during power system had been reasonably well maintained operation. at Palisades. The system was clean. It had been flushed in March 1992, and the ET-20 5.4 Palisades Common-Mode and 20/AG SOVs (equivalent to OPC 20) had Failure of Six Steam Admission Valves The Palisades plant has one 730 MWe CE is'r. Palmisano, Consumer Power Company Ernployee Com-munication. memorandum. -Turbine outage update - reactor with a E turbine and generator. On a bn 1,1992. September 20,1992, during startup testing, the "6 f x s fi: 8 n Elic system flow analyzer. qant performed a trip test of the main tur-T,*,Pgnef,uulon, n.' " u ce o epte une. Six of 16 quick-actmg steam adm,ssion ber 23.p1992. i NUREG-1275, Vol.11 38 i

Il f1 h Name of Part N SERIES 25 1 Body SOLENOID 0.C. 1 2 -tem EXPLOSION j PROOF 3 Piston 4 Spring 5 Spring Retainer & Ph ~ 6 Piston Shaft Tube 7 Piston Shaft "O" Ring 8 Stem Gukle Bushing l 9 Stem Guide Bush ng "O" Ring 10 Stem Guide Bushing Senews gg g 24 Solenoid Assembly -kk \\) 33 Solenoid Housing Gasket \\ I \\ 34 Solenoid Housing Capscrew a 37 Adapter i e 38 Adapter "O" Ring b 8 " P'" U N g 4 40 Adapter Capscrew i -g 3 kf 41 Adapter Protector \\ \\ \\\\\\ l ( N r".'l t i Nr.'l s i Il N R 's k! 1 E !1" 'M.. _-.h6 i m

-,,,q=-

g m. 8 Figure 13 Big Rock Point-Replacement hand-trip solenoid valve I 39 NUREG-1275 Vol.11 l \\

been refurbished by the manufacturer, Parker factorily in the manual mode. Two weeks later llannifin. liowever, about 3 weeks before the on May 30,1992 (as required by TS), the event, the EHC system developed a leak and licensee again tried to perform the TOPS sur-lost about 50 gallons of fluid. In addition, an veillance testing with the ATT and the same SOV in the reheat stop valve controls failed. six faults were indicated again. The TOPS j surveillance tests were then conducted satis-The troubleshooting found EHC flow distri-factorily in the manual mode. As noted in a bution anomalies, but did not find any spe-letter from Siemens2ta and Section 4.7 of this cific component problem. On the basis of the report, manual testing of the TOPS bypasses testing and computer analyses, more EHC the TOPS and puts the responsibility for { fluid drain lines and orifice plates were added avoiding a destructive overspeed solely on the ) to enhance turbine control valve operation. operator. Postmaintenance testing demonstrated sig-nificant improvement in the performance of On June 3,1992, the plant experienced a l the valves that had exhibited sluggish scram which was unrelated to the turbine behavior. The repairs were completed on systems. During the outage, turbine control September 27,1992, and the plant came on system troubleshooting found the problem to line the next day. be not the vacuum switch, but a loose wire in the turbine-generator control cabinet. A sec-In a communication to station employees 20a, ond loose wire was found in the turbine-the plant outage manager noted the positive generator control cabinet (Ref. 22). After the aspects of how the turbine problems were terminals were tightened, the vacuum switch handled. He noted that the turbine testing was and the ATTworked satisfactorily. designed "to verify that important turbine systems are operational and the testing did Three months later, on September 11,1992,a identify the problem." Furthermore, he noted systems engineer determined that one of the that it was fortunate that the problem was loose wires on the turbine-generator control corrected before the plant was on line. "If the cabinet had disabled one train of the P-4 problem had occurred and been undetected, interlock actuation relay (which trips the we could have had a turbine oversreed on a turbine on a reactor scram) and the same subsequent trip." train of the P-14 interlock actuation relay (which trips the turbine on high steam gener-5.5 Comanche Peak Unit 1 ator level). The disabled P-4 and P-14 inter-Inadequate Followup to 'Ibrbine I ek actuation relays are listed in the ESFAS 4 tables f the Comanche Pe k TSs as havmg OversPeed Protection S}' stem allowable outage times of 48 and 12 hours, %st Failure (May 16,1992) respectively. l On May 16,1992, while the reactor was at 100 Although the manufacturer's assessment of percent power, the beensee was performmg the Comanche Peak TOPS indicates that a TOPS testmg with the ATT(see Section 4.7 for additionalinformation on the A'IT). The destructive overspeed is unlikely, failure of the operators at Comanche Peak (as at Salem) to ATT indicated six faults emanatmg pnmarily immediately determine the root cause of a from pressure and vacuum switches. The TOPS testing anomaly placed the plant in a heensee concluded that there was a problem vulnerable position, bypassing the TOPS with the ATE 2 Since surveillance testmg not be completed with the ATE TOPS leaving only manual action available to pre-could,llance testmg was then performed sat,s-vent a destructive overspeed. I survei i In response to AEOD questions about which ]MaQ5l,g5/qrg5Q$$e c "- equipment was affected by the second kxise ociober 1,1992. terminal, the beensee traced the wirmg. In a 2' Form STA 515-1 regarding May 16,1992. event recorded as 218Z. Racie, siemens Ibwer Corturation, letter to R. I Jenkins. ILR 445/92-021 (Ref. 22k T 11 E.lectric. March 19,1992. NUREG-1275, Vol.11 40 l

22 May 27,1993, telephone discussion, the erated missiles. These analyses took credit for licensee informed AEOD that the second diversity and redundancy in the overspeed loose wire in the turbine control cabinet protection systems and did not consider the affected one train (train A) of the generator loss of diversity that may occur when the lockout relay. This relay sends a trip signal to overspeed protection devices are disabled for the turbine control system when the generator testing or because of operator error. These output is disconnected from the grid. (Failure analyses also did not assess correctly to trip the main turbine when the generator is common-mode failures of the overspeed disconnected from the grid could lead to an protection system from contaminated oil overspeed condition.) systems or degraded SOVs and did not recognize that redundancy could be lost It is also important to note that the loose because surveillance testing practices could terminals on the turbine-generator control not detect individual failures of redundant cabinet were essentially degradations of components (SOVs). ESFAS. Although the loose terminal, which was discussed in an LER (Ref. 22), only It is interesting to note that some turbine affected the A train, the LER also noted that operating manuals did not notify the turbine there was another loose wire in the same owners of any specific maintenance or cabinet. In the LER, the licensee noted that replacement requirements for the SOVs of the cause of the loose wiring was unknown, and overspeed protection system. With the that it was a generic concern. Furthermore, possib!c exception of steam dump valve 22 the licensee noted a that the loose wire caus-failures, the estimates of the failures of the ing the inoperable main turbine trip event individual components assumed independence "could have been a precursor to a critically (no coupling or common-mode contributions). consequential event." The analyses implicitly assumed that the degradation or failure of an individual SOV would be detected and that the SOV would be 6 FINDINGS replaced or repaired to an as-good-as-new condition before experiencing a similar failure 6.1 Complacency Toward 'Ibrbine or degradation of its redundant backup. This Overspeed report found industry practice to be incon-s(stent with many of these assumptions. Until November 9,1991, the likelihood that missiles from a main turbine overspeed event 6.2 Testing That Defeats Diversity could penetrate the turbine casing at a U.S. nuclear plant was considered to be very low: Many plants defeat redundant overspeed 10-4 to 10-5 per turbine-year according to protective devices when testmg turbm, es and NRC evaluation criteria (Ref. 5) and 10-5 to TOPS at power, By design, Salem's month 1y 10-9 per turbine-year according to manu. testmg of the turbine's mechanical protective facturers' analyses 22b.22c, devices required bypassing most of the a,uto-matic turbme trip features and deactivatmg Inherent in these analyses were low estimates the turbine's mechanical overspeed trip. for main turbine overspeed events which gen. During the tests, overspeed protection relied only on three SOVs (OPC 20-1, OPC 20-2, 24elerihone discussion. M. Ilanson. Comanche Peak. and II. LOrnstein, NRC, May 27,1993 g g g g 22'4I tgjegij,g-515-1, Category Analysis worksheet, g 2aGeneral Electric Company,"Ihrbine De rtment,

• Memo teClive devices did not appear to be a signifi-Report-il itheticallbrbme Missiles Probability of Cant one. However, the event raised the Occurrence March 14,1973.

industry's awareness of this issue (see Chap- 'iNE#

1. 1. NATY1Y25'$r$aIIsEENn ter 4). Discussion with some utilities indicated R

orleduction inTurbine valve resi rrequency June 1987. a preference for resolving the concern by 41 NUREG-1275, Vol.11

performing TOPS testing less frequently. preventive maintenance or the replacement Many utilities have submitted requests to the interval for SOVs in the main turbine NRC to relax the frequency of testing as a overspeed control system were rare or method of reducing the likelihood of a reactor nonexistent before the Salem overspeed event. trip or an overspeed event. g However, all turbine manufacturers' manuals System Fluid Quality recommend frequent turbine testing, with the The common-mode failures of the OPC 20-1, most emphatic guidance provided by GE (see OPC 20-2, and ET-20 SOVs at Salem Unit 2 Section 4.4). A more prudent approach would were caused by degradation of Fyrquel EHC be to perform the testing wi,th a provision t fluid. Most other U.S. LWRs use the same override any TOPS bypass if a condition EHC fluid; therefore they are vulnerable to anses m which a turbme tnp is needed. Many similar degradations and common-mode fail-plants have such backup overspeed protection, however, many plants have not installed or ures. Fyrquel EHC is a fire-resistant hydraulic fluid 23 developed by Stauffer Chemical Com-enabled such equipment, which is available pany with Electric Power Research Institute from the turbm, e manufacturers. support. Subsequently, the Stauffer Chemical Company sold its Fyrquel interests to AKZO 6.3 Nonrevealing Surveillance Chemicals, Inc., which is the primary supplier Testing of Fyrquel. Fyrquel is a phosphate ester fluid with little tolerance to water. Water intrusion Salem was not the only plant to use the prac-tice of testing two SOVs in a parallel arrange. (e 8., from atmospheric moisture) causes ment so that failure of either valve was unde-hydrolysis of Fyrquel EHC at temperatures of tected if the other valve worked. The issue of about 150 E In addition, phosphate esters inadequate testing of redundant SOVs was are mcompatible with certam, plastics, neo-raised by AEOD in 1991 in Reference 23 with Prene, Buna-N, and polychloroprene rubber. regard to diesel generator air-start systems. It When in contact with hot surfaces (e.g., was learned from discussions with major U.S. > 250 *F), Fyrquel can form solid gelatin-like turb,ne supphers and personnel at other U.S. particles. Moisture entrainment in Fyrquel can i nuclear plants that their surveillance testmg of cause hydrolysis and particulate formation to redundant SOVs in the TOPS was done just begin at lower temperatures. Fyrquel EHC is like that at Salem, and that failure of a heavier than water; therefore, undissolved redundant valve would not have been detected water rises to the top surface in Fyrquel if the other SOV worked successfully (see systems. Chapter 4). The Ginna plant had similar problems with 6.4 Inadequate Solenoid-Operated another phosphate ester hydraulic fluid, Valve Maintenance Houghton Safe-1120. In 1985 (Ref. 24fand 1990 (Ref. 25 and Report FPI-91-101 a), the The issue of inadequate SOV maintenance is main turbine at Ginna failed to trip on a not unique to main TOPS or to the Salem reactor scram due to caroded SOVs. The plant. In Reference 23, AEOD presented spools inside SOVs24 in the main TOPS (ET-many cases where the SOVs are "unrecog-20 and OPC-20s) had corroded most likely I nized" piece-parts and, as such, are not from water, which, being less dense, rested on l adequately addressed in operations and l maintenance instructions for the larger 9,gmmable-it will burn if heated to a high enough equipmerrt w, ch they selve. With regard t l m wraiture Prevention. inc., neErl4 rPI-91-101, noot cause mam turbmes, discussions with personnel at I investigation or Parker inan n Relief valve Irr-20 in the numerous plants and a review of some Turbine Electro-hydraulic Controi system." Revision 1, j j"I*E 'u'?ngn sOMame model as the on "*'# "'I " manufacturers' operations and maintenance i Ia e manuals confirmed that instructions for nt NUREG-1275, Vol.11 42 t i 1

iop of the hydraulic fluid. When contami-nated, the Parker Hannifin SOV illustrated in Figure 14 had the Fyrquel-water interface near the arrow. Corrosion took place in that area. The Ginna plant also found the Houghton V Safe-1120 to be incompatible with the elasto-meric parts of the Parker Hannifin SOVs24a, EHC fluid contamination can cause corrosion i i of system components, causing moving parts i to bind and can generate particles that can i migrate and cause blockage. [ Other contamination scenarios that have been observed are hydrolysis of the hydraulic fluid i and hydraulic fluid attack of incompatible j material;in both cases particles are formed that bind moving parts or cause system i blockage. Failure to continuously maintain the integrity i of the EHC system and of the EHC fluid has compromised main TOPS causing failures and L loss of diversity, or redundancy at Ginna, Salem Units 1 and 2, and St. Lucie Unit 2. I h Discussions with personnel at many plants / indicated a wide range of plant practices with / / regard to EHC fluid and EHC system main- / // tenance. Many plants with E main turbines '2 // originally had meager maintenance and mon- // itoring programs, but troublesome or costly // -- expedences heightened their sensitivity to the // importance of meintaining EHC system / fluid SPOOL SUBJECT fi integrity. As a result of their experiences,in 10 CORROSION most cases, the plants tightened up their EHC

• 7 f /,

/ / fluid / system maintenance. j f Point Beach, a two-unit station with E main = = turbines, implemented a rigorous EHC fluid / N system maintenance and surveillance program and has had reliable EHC system perform-ance (Ref. 26). Plants with GE main turbines have received Figure 14 Cross sectional drawing of Parker Ilannifin SOV MRFN more stringent, detailed guidance regardin8 16MX 0834 EHC fluid / systems than have plants with other manufacturers' turbines. As a result, the FPI-91-101, " Root Cause plants with GE main turbines may have a 24 p ijure Prevention. Inc.. Rehrn Reli f V l Invest ation of Parker Han e a ve ET-20 in the higher degree of awareness of the importance y,(QcQjg*aulic controt syiiern. Revision 1, of maintaining EHC system / fluid integrity. 3 43 NUREG-1275, Vol.11

However, discussions with turbine engineers W has provided some documents to owners of during a visit to a site with GE turbines its main turbines, and its service bulletins revealed that they were performing minimum have provided information about EHC system maintenance on the EHC system and had not experiences. However, a complete review of yet observed any problems. It should be noted the W turbine operations and maintenance that the EHC systems of GE turbines and manuals at the St. Lucie station indicated that newer W systems have certain design features the W manuals did not alert the turbine owner that help retain EHC flu;d integrity (e.g., des-to the seriousness of the consequences of iccant air dryers on the air inlet and full-flow degraded EHC system fluids. filters that the turbbe mani:facturer recom-mends be changed out quarteriy). The impor-6.6 Electrohydraulic Control tance of maintaining the EHC system fluid is System Fluid Incompatibility spelled out very clearly in many operations manuals and technical letters that GE has The EHC fluids most widely used for main provided to the turbine purchasers. For turbine control systems are aggressive phos-example, Technical Information Letter 796-2, phate esters, and are incompatible with many circa 1975 e, states: commonly used elastomers. Laboratory 2 analysis of the Parker Hannifin SOVs that The EHC fluid must [ sic] be kept failed at Salem found that the Fyrquel EHC free of both solid particles as well as fluid had attacked the Buna-N 0-rings, that chemicalimpurities to insure the pieces of the O-rings had been dislodged, and free operation of critical control that this debris caused the SOVs spool pieces 24 overspeed protection devices. to bind (1, Technical Information Letter 877, circa Similarly, the failure of the main turbine to 24 1978 c, states: trip at Ginna in 1985 and 1990 involved fail-ures of ET-20. In both events, ET-20 was EHC Fluid Ouality corroded. The 1990 failure was caused in part by debris from a degraded rubber gasket. The Fluid quality, wMch encompasses debris lodged between the SOV's spool piece solid particic cleanliness as well as and its housing, helping to bind the spool prqu cnemical makeup is of utmost piece. The gasket material, a chlorinated importance. Solid particle contami-rubber, was " chemically attacked" by the nation may lead to one or more EHC fluid, Houghton Safe-1120, which like control devices malfunctioning. In Fyrquel EHC is also a phosphate ester fluid. either of these cases, this can lead to Failure Prevention Inc. noted e that the 24 a possible overspeed event. This has Parker Hannifin SOVs (MRFN 16MX 0834) been previously brought to your used at Ginna contained chlorinated rubber attention in our Technical Informa-gaskets which were not compatible with phos-tion Letter (TIL) 769, 'EHC Fluid phate ester hydraulic fluids. Note that the Systems Valve Tests' dated March Parker Hannifin SOVs that had failed at 1975 and TIL 7%, ' Water Contami-Salem (MRFN 16MX 0834) were designated nation of EHC Fluid Through EHC as ET-20, OPC 20-1, and OPC 20-2 and were Coolers' dated December 1975. the same model valve as the ones that had 2cPublic service Dectric and Gas Com$nany. significant Event Response lham (SERT) Report No. SR 91-06, " salem 2* General Dectric, Technical Information letter 796-2. g"$km 19 e 1 " Water Contammation of EllC Huid Hrough the DIC Coolers," Attachment 1. 2* Failure lhvention. Inc.. Report FPI-91-101. " Root Cause Investigation of Parker liannifin Rehef Valve ET-20 in the 2* General Dectnc.'Itchnical Information letter 877, *DIC hrbine Electro-hydrauhe Control system." Revision 1, Ilydraulic Power Unit." January 17,1991. i NUREG-1275, Vol.11 44

failed at Lbna. (At Ginna, they were referred manual testing, require an operator to hold [ to as ET-20,20/AG-1, and 20/AG-2.) the trip lever during oveispeed trip testing to prevent a reactor trip. In contrast, the testing 6.7 Human Factors Deficiencies of the GE TOPS does not require an operator to hold a trip lever to prevent a reactor trip. The procedures for testing the turbine over-On GE systems and some newer H systems, speed control systems at Salem on Novem-the operators perform overspeed trip testing ber 9,1991, suffered from several human from the control room using simple panel factors deficiencies. One of the most obvious switches. deficiencies was that the front standard panel design required an operator to hold the 6.8 Surveillance Testing Required overspeed trip test lever in an awkward posi-by Plant Technical tion for a long period of time during testing Specifications (20 to 30 minutes). As noted in Section 3.4.6, the Salem SERT report did not rule out the The turbine overspeed events reported in possibility that the operator at the front Spencer Bush's study (Ref.1) focused NRC standard was fatigued and he could possibly attention on steam admission valve failures as have triggered the overspeed event by allowing the weakest link in the TOPS. As a result the the test lever to move slightly. Moving the test TOPS surveillance testing requirements, which lever by about 1 inch or less could have were included in many (but not all) plant TSs, resulted in an AST pressure perturbation were limited to verification of steam ad-which could have imtiated the event. The front mission valve motion, on the premise that standard at Salem (and all other plants with successful motion of the admission valves was H turbines visited by the author) had no indicative of TOPS operability. It was not convenient detent or locking mechanism to recognized that common-mode failures of the show the operator that the trip lever was in EHC system and its redundant components the correct position or also allow the operator could prevent the TOPS from performing its to switch hands if one hand got tired without protective function. Consequently, TSs do not risking a turbine trip. Failure to keep the lever require surveillance testing or detailed exam-in the proper position would also result in a ination of the TOPS control system and reactor trip. The front standard at Salem (and associated piece part components. at all other plants with H turbines visited by the author) had prominent, signs emphasizing 7 CONCLUSIONS the tnp vulnerability associated with the test lever. 7.1 Missiles Another human factors deficiency, the ab-NRC GDC 4 of Appendix A to 10 CFR Part sence of a tachometer visible to the operator 50 (Ref. 4) requires, in part, that " structures, at the front standard could have affected the systems and components important to safety Salem overspeed event. The presence of a shall... [be] appropriately protected against functioning tachometer visible to the operator dynamic effects, including the effects of at the front standard could have warned the missiles, pipe whipping, and discharging fluids operator to release the trip lever to activate that may result from equipment failures...." the mechanical overspeed trip. (The SERT Regulatory Guide 1.115 (Ref. 3) states that report estimated that, during the event, the " failures that could occur in large steam turbine accelerated by ~ 100 rpm /second. A turbines of main turbine-generator sets have tachometer would have provided several sec-the potential for producing large high-energy onds during which the operator could have missiles." In addressing turbine missiles, the terminated the overspeed condition.) NRC has accepted probabilistic analyses that showed the probability of unacceptable It is interesting to note that the H TOPS, like damage from turbine missiles to be less than the Siemens/Allis Chalmers TOPS during or equal to 1 chance in 10 million per plant-45 NUREG-1275, Vol.11

= year. Operating experience has shown that failure mechanisms leading to simultaneous 25 many utilities are not operating, maintaining, failures are the most likely contributors to or testing their turbine generators in accord-turbine overspeed events. Chapter 2 describes ance with the reliability and safety analyses common-mode precursor events prior to the that had been accepted by the NRC as the Salem overspeed event and Chapter 5 bases for meeting GDC 4. Because of describes recent common-mode events. 'Ihe deficiencies in operation, maintenance, and similarities of the events in Chapters 2 and 5 testing, the TOPSs may be several orders of indicate that despite the efforts of industry magnitude less reliable than estimated by W, groups to communicate the lessons of the and as a result, the likelihood for having a Salem turbine overspeed event, corrective turbine overspeed event and, therefore, the actions by some licensees have not climinated risks from turbine overspeed may have been these avoidable events. Common-mode factors underestimated. identified in this report which could contrib-ute to the potential for turbine overspeed 7.2 Fires, Explosions, Flooding include: NRC's concerns about turbine hazards had (1) testing methods which do not detect exist-been primarily focused on large, high-energy ing failures of pressure switches and missiles. The Salem Unit 2 overspeed event redundant SOVs demonstrated for the first time at a U.S. nuclear plant that discharges of hydrogen and (2) degraded EHC and lube oil which can lubrication oil during a turbine overspeed prevent proper operation of TOPS SOVs, cvent can result in explosions and fires. It turbine control valves, TSVs, etc. appears that risks from explosions, fires, and collateral flooding were not considered in an (3) system design with a single pressure integrated manner in previous licensee analy-switch, failure of which defeats redundant ses and NRC reviews of turbine overspeed backup overspeed protection events. Acknowledging the Salem overspeed event, its precursors, and the subsequent (4) lack of a replacement program for SOVs operating events described in Chapter 5, and which may fail due to materialincom-recognizing that the hazards of " discharging patibility, fluid contamination, etc. of fluids" such as hydrogen and lubrication oil from turbine-generators are hazards specific-(5) lack of a replacement program for ally noted in GDC 4, it appears that this issue pressure switches which may fail due to needs to be addressed further. Examination of aging effects many plants' licensing documents and safety analyses indicates that the concomitant (6) steam admission valves identified by hazards have not been addressed. The issue of licensees as exhibiting common-mode turbine building hazards is the subject of failure characteristics another AEOD special study which is currently under way. 7.4 Industry Response to the Salens Unit 2 Overspeed Event 7.3 Common-Mode Failure Precursors 7.4.1 Overview Main turbines are usually protected from The Salem Unit 2 overspeed event resulted in overspeed by redundant systems: a pnmary significant financial losses to the utility and its mechamcal device, usually supplemented by insurers. However, the event had the positive redundant electromechamcal or electrohy-effect of making the nuclear commumty more draulic devices. Consequently, common-mode aware of TOPSs, which, at many plants, had Previously been taken for granted (see Wac pidance regard turbine missiles and turbine eyitem rehabdity criteria are scribed in Section 2. Sections 4.2,4.6, and 4.7). NUREG-1275, Vol.11 46

7.4.2 'Ibrbine Manufacturer Actions (5) guidance for control room and equipment operators to respond to test anomalies As a result of the Salem Unit 2 overspeed event, the major U.S. turbine manufacturers Implementation of selected improvements to reexamined their TOPS. 'Ihey provided their operations and mam, tenance practices for customers with recommendations for hard. TOPS could provide a cost-effective means to ware testing and for maintenance modifi, achieve higher system reliability and improved cations or improvements to minimize the capacity factor. likelihood of similar overspeed events (see Sections 4.3 and 4.4). However, some of the 7.5 ' nip Test Lever Human Factors manufacturers' recommendations are Deficiency incomplete (see Sections 4.4 and 5.1.1). The overspeed trip test lever on the front standard panel of H turbines is difficult to 7.4.3 Nuclear Utility Actions hold in position during testing and has been identified as a contributing causal factor for On the basis of information received from the the Salem turbine overspeed event. Inadvert-NRC, the Institute of Nuclear Power Opera-ent movement of the test lever has also been tions, the turbine manufacturers, and the identified as the cause of an inadvertent insurers, U.S. LWR owners reviewed the reactor trip at Diablo Canyon Unit 2. Based Salem Unit 2 overspeed event and its implica-on those findings, the Salem and Diablo tions for their plants. In many cases, the Canyon licensees have modified the test utilities did a conscientious job of evaluating handle to prevent inadvertent movement of their plants. Most of the plants canvassed the test lever. Although this appears to be an have changed their TOPS testing and mainte-inexpensive and effective modification to nance practices. Many plants have initiated reduce the likelihood of a turbine transient actions to make hardware modifications. during TOPS testing, we are not aware that However, in the sample examined, the reviews this simple modification has been adopted by done by two utilities were less detailed and other licensees. problems remained (see Sections 5.3.2,5.3.3, and 5.5.1). 7.6 Overestimate of Design Life of 'Ibrbine Overspeed Protection In the past, both E and GE have issued System Components recommendations for operations and main-tenance to improve TOPS reliability. Based on Operating experience shows that the 63/AST a review of those recommendations and the pressure switches used in W turbine control lessons learned from operating experience, systems may require periodic replacement individual manufacturer's recommendations rather than just the periodic adjustment may be lacking in the following specific areas: suggested by H in AIB 9301. Three turbine overspeed events support this conclusion:(1) ~ (I) individual testing of redundant valves and Salem Unit 2, November 9,1991; (2) St. Lucie other e - onents Unit 2 April 21,1992 (Section 5.2.1); and (3) Diablo Canyon Unit 1, September 12,1992 (2) purification and monitoring practices for (Section 5.1.1). Data in the W topical report 25 . EHC fluid on turbine overspeed, WCAP-11525 a, indicates that pressure switch 63/AST had the highest failure frequency of any part in the E (3) replacement and refurbishment recom-TOPS. mendations for vulnerable components 258 Westinghouse IJectric Cornoration. (westinghouse Proprie-(4) methods to achieve effective operability tary[ Class 2) Report WCAP-11525. "Probabilistic Ev h,g, "*d"*'"'"i"""*"****"*"*Y""* of TOPS during system tests 47 NUREG-1275, Vol.11

c i 7.7 Nonconservative Probabilistic new condition" when they are found to have Assessments failed or are in a degraded condition. I For many plants, turbine manufacturers' rec. 7.8 ' Rends in Tbrbine Overspeed ommendations for TOPS testing intervals" Protection System Testing and turbine inspection intervals include in their basis the probabilistic analyses of over. Testing to verify TOPS operability which de-speed events (Chapter 2). The Salem Unit 2 tects existing component failures while main-overspeed event and other recent operating taining effective overspeed protection during events demonstrate that the analysis is not the test would reduce the likelihood of an conservative when compared with the actual overspeed event leading to turbine destruc-operating experience. tion and its potential safety consequences. However, current plant testing focuses on the For Salem Unit 2 (assuming monthly valve TS requirement to test steam admission valve exercise tests as presented in WCAP-11525 motion. Some licensees have enhanced their and shown in Figure 1 of this report), y testing practices following the Salem event; estimated the probability of a missile ejection others have not, to be about 2 x 104 per year. The point estimate for a missile ejection from a E Hardware modifications would be necessary, turbine at a U.S. nuclear plant is 1.25 x 10-3 in most cases, to establish the facility to test per year (with a 90 percent confidence interval individual SOVs in the TOPS. FPL (St. Lucie P ant). in cooperation with W. has modified l having a 5.9 x 10-3 upper bound and a 6.4 x 10-5 lower bound). The estimate is based on their TOPS by installing a test and mainte-time Salem Unit 2 overspeed event with an nance block to facilitate testing ofindividual experience base of about 800 turbine years at SOVs. Subsequent St. Lucie SOV testing U.S. nuclear plants with W turbines. Thus the caused a spurious turbine trip as a result of WCAP-11525 estimate is lower by a factor of short-duration EHC system pressure spikes; about 6 x 103 (it is 1/300th of the 90 percent the test and maintenance block has been confidence interval lower bound). further modified to climinate such spurious trips. As noted in Chapter 6. some of the reasons for the nonconservatism are the utilities-7.9 Procedures for Shutt, g oft m operating, testing, and maintenance practices. Steam Supply The probabilistic analyses assum,e sound Several events before and after the Salem mamtenance, operation, and testing of the turbme control systems. The analyses do not Unit 2 event indicate the value of plants account for common-mode failures resultmg having clear, written procedures and operators from inadequate maintenance of the EHC and being trained to assure that the steam supply is cut off to the main turbine before the AST systems, pressure switches, and SO\\ s; inadequate testing which could not reveal generator output breakers are opened (Big It ck Point, Section 5.3.2; St. Lucie Unit 2 eqttipment failures which had resulted in loss of redundancy; loss of diversity caused by Overspeed Event, Section 5.2.1). In addition, testing deficiencies; human errors such as premature relatchmg can cause certam failing to believe unfavorable test results; turbme control systems to reopen the steam inadequate procedures which do not provide admission vahres (Diablo Canyon Unit 1 t guidance about actions to be taken upon Section 5.1.1). observing a failure; and failure to restore 7.10 Summary degraded or used components to 'as good-as Based on the Salem destructive overspeed event and other precursor events, the fre-rs requirements madressing frequency of exercising sicam quency of overspeed events is much higher w admission valves. than that generally assumed m vendor l NUllEG-1275, Vol.11 48 t

E l analyses which were used to show compliance 8 REFERENCES i with Regulatory Guide 1.115 and GDC 4. A destructive turbine overspeed event has the potential to cause damage because of turbine 1. Spencer H. Bush, " Probability of Damage missiles, fires, explosions, and consequential to Nuclear Components Due to Turbine flooding. These concomitant effects have not Failure," Nuclear Safety, Vol.14, No. 3, received attention. However, compliance with May-June 1973. GDC 4 may be accomplished in other ways than preventing a destructive turbine over-2. U.S. Nuclear Regulatory Commission, speed. For example, if the turbine building NUREG-0800, Standard Review Plan contains no equipment needed for safe shut-10.2, Revision 2, "Erbine Generator," down and the surrounding structures can be July 1981. shown to be protected from missiles, fires, explosions, and flooding from a destructive 3. U.S. Nuclear Regulatory Commission, overspeed event, then compliance with GDC 4 Regulatory Guide 1.115. " Protection would be achieved. In such a case, the issue of Against Low-Trajectory Turbine the quality of the TOPS is primarily a com-Missiles," Revision 1, July 1977. mercial issue. However, failure of the TOPS could result in challenges to plant safety 4. U.S. Code of Federal Regulations, Title 10, systems. " Energy," U.S. Government Printing j Office, Washington, D.C., revised periodically. AEOD currently is performing a study of tur- ) bine building hazards. Dat study will evaluate 5. U.S. Nuclear Regulatory Commission, the hazards from hydrogen, lubricating oils, letter from C.E. Rossi to J.A. Martin, and flammable EHC fluids associated with a Westinghouse Electric Corporation, turbine failure. Potential flooding of important " Approval for Referencing of Licensing equipment by water used for fire suppression Ibpical Reports WSTG-1-P, May 1981, and water used for cooling turb, e-generator ' Procedures for Estimating the Proba-m subsystems will be included. Effects of smoke bility of Steam hrbine Disc Rupture will also be considered. From Stress Corrosion Cracking,' March 1974,' Analysis of the Probability of the Generation and Strike of Missiles From a It was generally believed that GDC 4 was met based on the low frequency of destructive tur-Nuclear Erbme,' WSTG-2-P, May 1981, bine overspeed events. That belief contributed ' Missile Energy Analysis Methods for Nuclear Steam Thrbmes,' and WSTG-3-P, in part to past regulatory decisions. This study does not, by itself, negate those decisions, July 1984,' Analysis of the Probability of a because GDC 4 may still be met due to other Nuclear %rbme Reachmg Destructive considerations such as the physical arrange-Overspeed,"' February 2,1987. ment of the plant. The need for NRC and 6. U.S. Nuclear Regulatory Commission, licensees to readdress their bases for com-pliance with GDC 4 will be addressed after Inspection Report 50-311/91-81, Salem j Nuclear Generating Station Unit 2, the study of turbine hazards has been January 7,1992. completed. 7. T. T Martin, U.S. Nuclear Regulatory ] Beyond the issue of GDC 4, the implementa-Commission, memorandum to T. E. tion of efforts to address the concerns raised Murley, " Consideration of Generic Issues i t in this report can result in enhanced operation Resulting From AIT Findings Relative to of the TOPS and will likely result in large the Catastrophic Failure of the Salem l financial benefits because of improved system Unit 2 %rbine-Generator," January 27, operation. 1992. 49 NUREG-1275, Vol.11

8. U.S. Nuclear Regulatory Commission,

17. Consumers Power Company, Ucensee Information Notice 91-83, " Solenoid-Event Report 50-155/89-009, Big Rock Operated Valve Failures Resulted in Point Plant, January 9,1990.

Tbrbine Overspeed," December 20,1591.

18. Consumers Power Company, Licensee 9.

J. G. Partlow, U.S. Nuclear Regulatory Event Report 50-155/92-010, Big Rock Commission, memorandum to T. I Point Plant, July 2,1992. Martin, " Region I Request for NRR Evaluation of Generic Issues Relating to

19. U.S. Nuclear Regulatory Commission, the Salem Unit 2 Thrbine Overspeed Inspection Report 50-155/92-020, Big Event (TAC No. M826%)," February 25, Rock Point Nuclear Plant, September 18, 1992.

1992.

10. Pacific Gas and Electric Company,

20. U.S. Nuclear Regulatory Commission, Licensee Event Report 50-0275/92-018, Region III Daily Report, October 5,1992.

Revision 1, Diablo Canyon Unit 1, February 8,1993.

21. U.S. Nuclear Regulatory Commission, Region III Daily Report, March 1,1993.

11. Pacific Gas and Electric Company, Ucensee Event Report 50-323/92-003,

22. T.U. Electric, Licensee Event Report Diablo Canyon Unit 2, April 20,1992.

50-445/92-021, Comanche Peak Steam Electric Station Unit 1, October 12,1992.

12. Pacific Gas and Electric Company, Lice,nsee Event Report 50-323/92-003,

23. U.S. Nuclear Re8ulato37 Commission, Revision 1, Diablo Canyon Unit 2, March 10,1993' NUREG-1275, " Operating Experience Feedback Report-Solenoid Operated

13. Westinghouse Electric Corporation, Valve Problems," Vol. 6, February 1991.

(nonproprietary) Report WCAP-11529, "Probabilistic Evaluation of Reduction in

24. Rochester Gas and Electric Company, Thrbine Valve Test Frequency," June 1987.

Licensee Event Report 50-244/85-007, R. E. Omna Nuclear Power Plant, May 6,

14. U.S. Nuclear Regulatory Commission, 1985.

Region V, Daily Report, February 1,1993.

25. Rochester Gas and Electric Company,

15. Florida Power and Light Company, Licensee Event Report 50-244/90-012, Ucensee Event Report 50-389/92-001, R. E. Ginna Nuclear Power Plant, Revision 1, St. Lucie Unit 2, June 29,1992 October 26,1990.

16. Florida Power and Light Company,

26. Gene Wellenstein. "The Picture of Licensee Event Report 50-389/92-005, St.

Health," The Nuclear Pmfessional, Vol. 7, Lucie Unit 2, August 7,1992. No. 4, Fall 1992. 1 NUREG-1275, Vol.11 50 i

p tt APPENDIX A LIST OF PLANTS BY SUPPLIER-REACTOR, TURBINE, GENERATOR 1 l i

l'.'. 'I i APPENDIX A LIST OF PLANTS BY SUPPLIER-REACTOR, TURBINE, GENERATOR REACTOR TURBINE GENERATOR - PLANT SUPPLIER SUPPLIER SUPPLIER ANO UNIT 1 B&W W E ANO UNIT 2 C-E GE GE BEAVER VALLEY UNIT 1 E E E BEAVER VALLEY UNIT 2 E E E BIG ROCK POINT GE GE GE BRAIDWOOD UNIT 1 E E E BRAIDWOOD UNIT 2 E E E BROWNS FERRY UNIT 1 GE GE GE BROWNS FERRY UNIT 2 GE GE GE BROWNS FERRY UNIT 3 GE GE GE BRUNSWICK UNIT 1 GE GE GE BRUNSWICK UNIT 2 GE GE GE BYRON UNIT 1 E E E BYRON UNIT 2 E E E CALLAWAY E GE GE CALVERT CLIFFS UNIT ' C-E GE GE CALVERT CLIFFS UNTl. C-E GE GE CATAWBA UNIT 1 E GE GE CATAWBA UNIT 2 E GE GE CLINTON GE GE GE COMANCHE PEAK UNIT 1 E A-S A-S COMANCHE PEAK UNIT 2 E A-S A-S COOK UNIT 1 E GE GE COOK UNIT 2 E BB .BB COOPER GE E E CRYSTAL RIVER UNIT 3 B&W H E A-1 NUREG-1275, Vol.11 l

REACTOR TURBINE GENERATOR PIANT SUPPLIER SUPPLIER SUPPLIER DAVIS BESSE B&W GE GE DIABLO CANYON UNIT 1 E E E l DIABLO CANYON UNIT 2 E E E DRESDEN UNIT 2 GE GE GE DRESDEN UNIT 3 GE GE GE i DUANE ARNOLD GE GE GE FARLEY UNIT 1 E E E FARLEY UNIT 2 E E E 1 FERMI GE GEC GEC FITZPATRICK GE GE GE FORT CALHOUN C-E GE GE GINNA E E E GRAND GULF GE A-S A-S HADDAM NECK E E E HATCH UNIT 1 GE GE GE HATCH UNIT 2 GE GE GE HOPE CREEK GE GE GE HARRIS E E E INDIAN POINT UNIT 2 E E GE INDIAN POINT UNIT 3 E E E KEWAUNEE E E E LA SALLE UNIT 1 GE GE GE LA SALLE UNIT 2 GE GE GE LIMERICK UNIT 1 GE GE GE LIMERICK UNIT 2 GE GE GE MAINE YANKEE C-E E E MC GUIRE UNIT 1 E E E MC GUIRE UNIT 2 E E E NUREG-1275, Vol.11 A-2

l REACTOR TURBINE GENERATOR PLANT SUPPLIER SUPPLIER SUPPLIER L. - MILLSTONE UNIT 1 GE GE GE L ' MILLSTONE UNIT 2 ' C-E GE GE . MILLSTONE UNIT 3 W GE - GE MONTICELLO GE GE GE NINE MILE POINT UNIT 1 GE GE GE NINE MILE POINT UNIT 2 GE GE GE NORTH ANNA UNIT 1 E E E NORTH ANNA UNIT 2 H H H OCONEE UNIT 1 B&W GE GE OCONEE UNIT 2 B&W GE GE OCONEE UNIT 3 B&W GE GE OYSTER CREEK GE GE GE PALISADES C-E E E PALO VERDE UNIT 1 C-E GE GE I I PALO VERDE UNIT 2 C-E GE GE PALO VERDE UNIT 3 C-E GE GE PEACH BOTTOM UNIT 2 GE GE GE 4 PEACH BOTTOM UNIT 3 GE GE GE PERRY UNIT 1 GE GE GE PILGRIM GE GE GE 4 i POINT BEACH UNIT 1 W H H POINT BEACH UNIT 2 H H H ] PRAIRIE ISIAND UNIT 1 E E E PRAIRIE ISLAND UNIT 2 H H H QUAD CITIES UNIT 1 GE GE GE i OUAD CITIES UNIT 2 GE GE GE RIVER BEND GE GE GE f ROBINSON UNIT 2 H H H A-3 NUREG-1275, Vol.11

F REACTOR TURBINE GENERATOR PLANT SUPPLIER - SUPPLIER SUPPLIER SALEM UNIT 1 E H H-SALEM UNIT 2 H H GE SAN ONOFRE UNIT 1 E E E SAN ONOFRE UNIT 2 C-E GEC GEC SAN ONOFRE UNIT 3 C-E GEC GEC SEABROOK H GE GE SEQUOYAH UNIT 1 W H H SEQUOYAH UNIT 2 H H H SOUTH TEXAS UNIT 1 W E E SOUTH TEXAS UNIT 2 H H H ST. LUCIE UNIT 1 C-E E E ST LUCIE UNIT 2 C-E E E SUMMER H GE GE SURRY UNIT 1 E E E SURRY UNIT 2 H H H SUSQUEHANNA UNIT 1 GE GE GE SUSOUEHANNA UNIT 2 GE 'GE GE THREE MILE ISLAND UNIT 1 B&W GE GE l TROJAN H GE GE TURKEY POINT UNIT 2 H H H TURKEY POINT UNIT 3 E E E VERMONT YANKEE GE GE GE VOGTLE UNIT 1 E GE GE VOGTLE UNIT 2 H GE GE WATERFORD UNIT 3 C-E E E WNP UNIT 2 GE E E WOLF CREEK H GE GE YANKEE ROWE E E E NUREG-1275, Vol.11 A-4

~ 1 J .i i REACTOR TURBINE GENERATOR - PLANT SUPPLIER SUPPLIER SUPPLIER . ZION UNIT 1 E W/with BB W I low pressure turbme stages ZION UNIT 2 H W/with BB E low pressure turbine stages A-S Allis-Chalmers/Siemens ) BB Brown Boveri B&W Babcock & Wilcox C-E Combustion Engineering GE General Electric GEC English Electric - E Westinghouse 1 i A-5 NUREG-1275, Vol.11

f P APPENDIX B

SUMMARY

OF SERT REPORT RECOMMENDATIONS .e l

1 i i

SUMMARY

OF SERT REPORT RECOMMENDATIONS

• 1.

Plant Design dure (s). Address identified short-comings associated with failure to a. Evaluate the turbine protection implement the 1990 LER commit-systems for design enhancements. ment to change out the Unit 2 solenoid valves (e.g., require docu-b. Complete detailed root-cause mentation of commitment assessment of solenoid failures and modifications). implement corrective actions to prevent recurrence. d. Implement independent full func-tional, hydraulic operational c. Determine source of orifice foreign periodic testing of the four turbine material and implement appropri-protection solenoid valves. ate corrective actions. e. Review present priority of plans for d. Evaluate the need for design RCM to address the Salem main changes,to the front standard to turbine and support systems in address identified human factors light of this event, and make deficiencies, and initiate as changes as necessary. required. f. Evaluate the need for a License e. Finalize engineering analysis t Change Request to clarify 'Ibchnical determme all ongms of steam flow Specification 3/4.3.4 "'Ibrbine energy which resulted in the turbme Overspeed Protection." overspeed event, and place final report of this analysis in the SERT g. Review technical specification sur-file for this event, veillance testing methodologies to f. Evaluate the AST pressure switch ensure no other inst,ances of failure to test components independently settings for adequacy for protection which could involve 'Ibchmcal exist.,fication violations or reduc-as well as control functions. Speci ti nS in Protective functions 2. Programs redundancy. a. Perform a matrix review of turbine h. Review the process of Tbchnical multi trip and other secondary plant components to assure ade. specification license change quate testmg. requests to determine why LCO 3/4.3.4 was not clarified when it was b. Establish and complete routine last amended. Identify actions to calibration cycles for AST pressure Prevent recurrence. switches. i. Re-evaluate the basis for 30 day c. Review Administrative Controls for front standard testing as specified commitment tracking and revise by vendor; implement less frequent applicable administrative proce-testing if justifiable. t l j. Work with Operations and Com- }

• Direct qwtations from Public service Electric and Gas Com-puter Engineering to implement a E'd'91Dsn'leYt/mNdr'$rkne nUnNrbine/

Program to save an optimal set of l l Generator Failure of November 9,1991," December 20,1991. SPDS and P-250 data for future l B-1 NUREG-1275, Vol.11 a

^

j q

1 use during event evaluation, sep-J trip industry eventr, and other arate from the AD-16 program.- lessons learned, to the nuclear - industry via INPO. 4 k. Revise the turbine front standard [ test procedure (OP 111-1.3.7), prior u. Evaluate 10 CFR Part 21 c . to the next test performance for notification for solenoid valve either Unit. Review for inclusion failures. Human Factors Report comments. v. Continue implementation of l. Incorporate discussion of operation Nuclear Department programs of Steam Dumps, MS10s and EHC including: during Unit 'Ihp Events into opera-tor training. Reaching Our Vision ~! m. Re-emphasize to all Emergency coordinators that EP procedures Commitment Management and Attachments are not stand Reliability Centered alone documents. Maintenance ] n. Assess AOP-Fire-1 guidance con-cerning operation of equipment Salem Revitalization involved m or contributing to a fire, and revise as needed. Work Standards Practices t o. Enhance training on de-escalating

3.. Personnel I

events and use of procedure EPIP 405-a.< Plant Management is to assure behaviors / actions during the i p. Revise ECG Attachments 1,2 10/20/91 startup are understood and 3 with recommended and appropriate corrective actions enhancements. taken. q. Revise AOP-Fire-1, FRS-1-001,- EPIP 202 and EGG Attachment 8 b. Reinforce and clarify Standm.g to better address offsite assistance Night Order Book Pohcies with all [ SROs on shift. requests. y r. Revise the Initial Contact Message c. Review the decision-making i Form Attachments 2 and 3 to associated with the deferral of the enhance guidance in terminating Unit 1 LER commitment to replace events. Unit 2 solenoid valves "during the next outage of sufficient duration,"- l s. Provide refresher training on pager and take, corrective actions as activation to primary and appropriate. j secondary communicators. l-d. D.:velop and present a communi-t. Communicate the inadequate cations gogram on this event, L prioritization of turbine failure to emphasizmg lessons learned. I L 1 NUREG-1275 Vol.11 B-2 I L

APPENDIX C CUSTOMER ADVISORY LETTER 92-02, " OPERATION, MAINTENANCE, TESTING OF, AND SYSTEM EHNANCEMENTS TO TURBINE OVERSPEED PROTECTION SYSTEM"* i

• Reprinted with permission of Westinghouse Electric Corporation.

e

) DISCLANGER OF WARRANTIES AND UMITATION OF UASILITY THERE ARE NO UNDERSTANDINGS, AGREEMENTS, REPRESENTATIONS, OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF l MERCHANTASluTY OR F6TNESS POR A PARTICULAR PURPOSE, OTHER THAN i THOSE SPECIFICALLY SET OUT IN ANY EXISTING CONTRACT SETWEEN THE PARTIES REGARDING TH18 EQUIPMlINY. ANY SUCH CONTRACT STATES THE l ENTIRE OSUGATION OF SELLER. THE CONTENTS OF THIS DOCUMENT SHALL NOT L SECOME PART OF OR MODIFY ANY PRIOR OR EXISTING AGREEMENT, l COMMITMENT, OR RELATIONSHIP. The information recommendations and descriptions in this document are bened on Westinghouse's experience and judgment with respect to this equipment's operation and maintenance. THIS INFORMATION SHOULD NOT SE CONSIDERED AS ALL INCLUSIVE OR COVERING ALL ColmNGENCIES. N further information is required, Westinghouse Electric Corporation should be coneutted. NO WARRANTIES, EXPRESS OR IMPUED, INCLUDING WARRANTIES OF FITNESS POR A PARTICULAR PURPOSE OR MERCHANTASluTY, OR WARftAlmES ARISStG FROM THE COURSE OF DEAUNG OR USAGE OF TRADE, ARE MADE REGARDING THE INFORMATION, RECOMMENDATIONS, OR DESCRIPTIONS CONTAllED HEREIN. In no event will Westinghouse be responsilde to the user in contract, in tort (including negligence), strict liability or otherwise for any special, Indirect, incidental, or conesquential damage or loss whatsoever, including but not limited to damage to or loss of use of equipment, plant, or power system; cost or capital; loss of profits or revenues; cost of replacement power; additional expenses in the use of existing power facilities; or cisims agelnet the user by its customers, resulting from use of Sw

..;e--- "., recommendations, or descriptions contained herein.

j C-iii NUREG-1275, Vol.11

CAL 9003 Page1of7 CUSTOMER ADVISORY LETTER 92 1 REASON FOR ADVISORY Recently a smdaar unit esperienced an ea.1, d incident. hweetigation N=I that the lacklant may have been partially due to malfunctioning EH dump solenoid valves. Subsequent to this incident, other reports of incklante of sticking EH dump solenoid valves have been received. The solenoid valves involved were Parker HannaAn Manatrol solenold valves $WOPC 1 and 30/OPC-2 (overspeed protection controller) and 30/ET (Emergency Trip solenoid valves) used with 8"=e-;( * (EN) control systems. 'the above three solenoid valves are loested on a taaeadaad block on the right side of the pedestal -In another arrangement there are Four 20/AST (Auto Stop Trip) solenoid valves and.wo 2bOpC solenoid valves on a machined block on the right side of the pedestal Refer to Figures 1 and 2. 3 ADVISORY DWORMATION To reduce the potential for a unit overspeed incident, this Advtsory provides operation, maintenance and testing recosamendations for all control system solenoid valves, as well as avallable enhancements to the control system. WARNING TURRINE OVERSFEED OPERATION CAN RESULT IN DAMAGE 'IO OR DESTRUCTION OF EQUIPMENT AND PROPERTY AND/OR PERSONAL INJURY OR DEATE. PERFORM PERIODIC MAINTENANCE AND TESTING OF OVERSPEED PROTECTION SYSTEMS AND ADBERE TO EECOMMENDED FRACTICES TO REDUCE FOTElfrIAL FOR ' IBIS OCCURRENCE. 3.1 Operation, Maintemance and Testing Recomumendations 2.1.1 Remove, 'splace or rebuild and then test each solenoid valve et each medor unit outage or in accordaxe wtth valve -Aan=er's recosasaendations. Valves should be rebuilt enk by valve rieufeturer approved vendor. Spare valves la stock should be reteuilt in accordance with valve reanutecturer's recomunendenons to sudemin adequate oosnbined operation and shelflife. 2.1.2 Verify that aR pressure switches used to indicate a turtdne arty condition (=~ap oil pressure) are est at the same pressure level per Instruction Book information. This pennits reestting the turtdne control system to a tripped condition ohnultaneously with notlacedon of a turbine trip to the steem supply system. 2.13 Maintain EH fluid temperature and cleanliness within recoerunended speciScations. Refer to OMM 120 and Instruction Book. Vertly that EH ihdd Ribing is not buried in insulation or esposed to hot tautdne pans (Refer to AIB $108). '!his wm reduce varnish depostas on close clearance parts such as solenoid valves, Moog valves and relief valves and clogging of drain lines. 'the recommended operating temperanse for the EH thdd is 100Tto 180T. 2.1.4 Wesendouse recommends the use of autostop oil pressure level to indicate the latched or trtyped condition of the turbine. k is recordeed that some usare saar use valve limit I ewaches for this purpose. If so, en lient sweches et the closed and of the valm should besset L C-1 NUREG-1275, Vol.11

i ' CAL 0303 Paesset1 2.L5 Test tHp weight by shnulation (oil test) monthly per instructions in the unit Instruction Book. ( 2.1.s Test 30/ET solenoid valve tHp on each startup to vertly this valve is opening and closing. If any of the 20cPC,20/ET or sWAST solenoid valves does not operate due to sticidng, aR solenoid valves are te be amoved, replaced or abuilt and then retested. 2.1.7 Test each 20/OPC solenoid valve (or AGG on some units)ladividually on each startup to verify valve is opening and closing. This may sospdre installation of a test switch. If any of the 200PC,2 WET or 20/AST solenoki valves does not operate due to sticking, all solenoid valves am to be removed, replaced or rebuut and then retested. 2.1.8 Use reverse power relays in the circuit for opening the main generator circuit breaker as recommended in OMM002. This allows turbine driving steam to be dieelpeted prior to opening the breaker. 2.1.9 Follow testing and maintenance practices for steam non-return valves per ANSI /ASME Standards TDP 1 and TDP4

• Recommended Practices ihr the Prevention of Water Damage to Steam Turbines Used for Electric Power Generatkm? This wGl mduce the poestbility for uncontrolled flashing steam driving the unit to overspeed.

2.1.10 When conducting periodic trip seats at the kant pedestal, the hont pedestal operator must be in constant contact wth the cormot room to permit sceipt of any tHpping instructions. The mont pedestal openter is to have visual access to indications of unM speed and =iewT oE pressure via tachometer pressee gauge or other turbine trip status. 1he tant pedestal operator is to misase the test vahe if turbine tdp occme or if indicadons of a unit ovesspeed are received. 2.1.11 To reduce the potential for a mosnentary drop in autostop oil pressure during trip testing, the clamanness of the==* war tube ou abound be analntained to reduce possibility of odt!ce clogging. (Refer to OMM 072 and OMM 106). 2.1.12 Report fouures of any of the above solenoid valves to Westinghouse. The recommendations contained in Section 2.1 of this Advisory are to be implemented at your earliest opportunity and thereaAer at the recommended intervals. 2.2 Systess Enhancessents The following control system enhancements are provided for your consideration for reducing the potential for a unit overspeed incident. 2.2.1 Install cou monitors to check for circuit continuity of tripping solenoids. 2.2.2 Modify trip system to energise all avauable valve test solenoids simultaneously with trip solenokis. This would provide an alternate path for getting valves closed. 2.2.3 On units with EH controDers, the esdsting 110% rated speed contact can be used to initiate an overspeed trip. CAUTION. ON AN AEE UNIT. A SINGLE SFEED CHANNEL IS USED TO ENERGIZE THIS COffrACT. TERREFORE, A SINGLE BIGH FAILURE COULD CAUSE ATRIF. 2.2.4 Install a latch-in circuit to energine 20/ET solenoid valves. Some plants have a separate electric trip to energine 2 WET other than that used for 2WAlft'. If the signal is removed kont NUREG-1275, Vol.11 C-2 i ____....m

~ pp t CAL 9340t ' Page 3 of 7 the 20Er solenoid valve, the 2WElT wSt allow reestablishing the high pressure ihdd.' If the po sDel path which energises the 20/AST did not function, the steam valves could reopen creadng a potential for overspeed. To maintain the unit in a tripped condition from en extemal signal to the 20Tr. a lascida relay is recommended. i 2.2.5 - On units with snechanical trip systems, one 20rAST is standard. During trip tesdag at the front pedestal, this solenoid is made ineffective. A second SWAST (style 387A996002) can be instaDed on the HP oil supply skle of the test handle to aDow electrical trips to be effeedve even when the test handle is held. Refer to P1gure 3. l 2.2.6 Install a pressure switch (style 800C416015) in the main (shaft) ou pump discharge to detect an overspeed condition. This feature would be most beno6cial for customers who destro an alternate electrical overspeed protection channel This pressure switch could be set at a level equ.Nalent to 112% rated speed to initiate a turbine trip. _ To avoid an j inadvertent trip, a 2 out of 3 scheme should be used. 2.2.7 On 150# and 300# systems, add a load drop anticipator system to immediately close the l governor and interceptor valves on breaker opening. The valves would stay closed until the steam Sow drops to a relatively low level i 2.2.8 To reduce the possibility of tripping the unit during testing of the trips at the front pedestal, install a pressure gauge on the trip block skle (rnochanical tdp system) of the l test handle. See Figures 3 and 4. The operator should verify that autostop pressure has ~ been re established before releasing the test handle.. 1he recommendations contained in Section 2.2 can be implemented at the next opportunity to complete the scope. The recommendations contained la sections 2.2.1,2.2.2,2.2.6 and 2.2.8 apply to all units. The recomroandarians in 2.2.3 and 2.2.4 apply to EH systems. The recommendation contained in 2.2.5 applies to 300# EH systems with MH trip supplied prior to 1962. If additional informadon relative to or clarification of these recommendations is required, contact your local Technical Service Manager or Generation Specialist. 1 C-3 NUREG-1275, Vol.11

I CAL 9302 f Page 4 of 7 i l EMERGENCYANDOVERSPEED PROTECTION CONTROLLER SYSi t-M I (EXISTING) 63 a, P TURBINE AST TRIP BLOCK INTERFACE VALVE I P ~ i G y TRIP EADER TRIP S 2 0,, ~ ~ HP OIL TEST SUPPLY y HANDLE y (FROM yy LUBE OIL W SYS q S N EED -- PROTECTION y CounutER s g2 a E c,cg, V FIGURE 1 l l l l NUREG-1275, Vol.11 C-4

cm. Page5of7 EMERGENCYANDOVERSPEED PROTECTION CONTROLLER SYSit:M ( STING) m 1lf G EMERGENCYTRIPHEADER TRIP INTERFACE VALVE ] ~- h TEST HP O!L SUPPLY '1'HANDW (FROM 3 C LUBE OIL ,o., SYSTEM) M ~ n -m u 21:,$ 20 3 3 C '9' S (NERSPEED PROTECTION 2 S OPCN Sh V liGURE 2. C-5 NUREG-1275, Vol.11 1

r CAL 9242 Page 6 of 7 ~ i EMERGENCY AND OVERSPEED l PROTECTION CONTROLLER SYSI t-M (PROPOSED) Proposed Chang p., 6 3 TURBINE -- 1 AST TRIP BLOCK P INTERFACE VALVE L P { ~ N y TRIP l-20 TRIP HEADER S ET r HP OIL TEST SUPPLY HANDLE ~~ ~ y (FROM p i 20-2 LUBEOIL S AST SYSTEM) S E92.1. E i y OVERSPEED --1 l Propose PRO M ' y [ Change _2 2 3 LOGIC y FIGURE 3. NUREG-1275. Vol.11 C-6 l

1 CAL 9202 Page 7of 7 EMERGENCYANDOVERSPEED PROTECTION CONTROLLER SYSit-M (PROPOSED) "E Proposed llf Chang: P I G EMERGENCYTRIPHEADER TRIP INTERFACE VALVE HP Olt TEST S ~ ~ SUPPLY T-HANDLE ~ ~ l (FROM l LUBEOIL 3 C 2 o.2 n., SYSTEM) WT 1 Nb dN w 20 3 AsT J C g 20 1 GC V cuenseEso _1 W i L____p enamencu ____7 2p ,,cgg,,,,

9a y

FIGURE 4. C-7 NUREG-1275. Vol.11

i i APPENDIX D AVAILABILITY IMPROVEMENT BULLETIN 9301, i " SYSTEM TURBINE OVERSPEED PROTECTION SYSTEM"* ' Reprinted with pennission of Westinghouse Electric Corpora'Jon.

DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITY THERE ARE NO UNDERSTANDINGS, AGREEMENTS, REPRESENTATIONS, OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, OTHER THAN THOSE SPECIFICALLY SET OUT IN ANY EXISTING CONTRACT BETWEEN THE l PARTIES REGARDING THIS EQUIPMENT. ANY SUCH' CONTRACT STATES THE ENTIRE OBLIGATION OF SELLER. THE CONTENTS OF THIS DOCUMENT SHALL NOT BECOME PART OF OR MODIFY ANY PRIOR OR EXISTING AGREEMENT, COMMITMENT, OR RELATIONSHIP. The information recommendations and descriptions in this document are based on Westinghouse's experience and judgment with respect to this equipment's operation and maintenance. THIS INFORMATION SHOULD NOT BE CONSIDERED AS ALL INCLUSIVE OR COVERING ALL CONTINGENCIES. If further Information is required, Westinghouse Electric Corporation should be consulted. NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE OR MERCHANTABILITY, OR WARRANTIES ARISING FROM THE COURSE OF DEALING OR USAGE OF TRADE, ARE MADE REGARDING THE INFORMATION, RECOMMENDATIONS, OR DESCRIPTIONS CONTAINED HEREIN. In no event will Westinghouse be responsible to the user in contract, in tort (including negligence), strict liability or otherwise for any special, Indirect, incidental, or consequential damage or loss whatsoever, including but not limited to damage to or loss of use of equipment, plant, or power system; cost or capital; loss of profits or revenues; cost of replacement power; additional expenses in the use of existing power facilities; or claims against the user by its customers, resulting from use of the information, recommendations, or descriptions contained herein. D-iii NUREG-1275, Vol.11

y~ ~ r -=--

7-

~ ~~ 97sif( + 3 r i m

j

? ~ { a u Lt j AIS 9001e d Page 1 of 16 i 4 h y . AVAILABILITYIMPROVEMENT BULLETIN i 9301 = 1L REASON FOR BULLETIN l In February 1902, Customer Advisory Imtier 9242 was issued as a result of an overspeed incident on a nuclear unit. De overspeed incident was partially due to rnalfunctioning EH dump solenoid valves.1 . The solenoid valves involved were Parker-Hannifin Manatrol solenoid valves 20/OPC-1 and 20/OPC-2 . (overspeed protmetion contreuer) and 2WI'(Ea.ay Trip solenoid valves) used with Eiectro Hydraulic . (Ell) control systerns. De above three solenoid valves are located on a machined block on the right side of i . the pedestal In another arrangement there are four 20/AST (Auto Stop Trip) solenoid valves and two l 200PC solenoid valves on a machined block on the right side of the pedestal Refer to Figures 1 and 2. i Two configurations of valvo have been used. The Parker-Hannifin valves use a spool type solenoid j operated pGot valve. De other ein...lon uses e poppet type solenoid operated pilot valve. Of about 1000 solenoid valvse in use for the above functions,40% use the spool type phot valve. During the past : ] year, several incidents of spool valve attdring have been reported. No incidents of sticking have been - reported for the poppet type valves. On investigation it became apparent that the key to reliable operation i of either solenoid valve e,0.w. son, but especially of the spool type design, is periodse testing. On units ' with the three solenoid valve arrangement, this can only be done when the unit is off-line. On units with four 20/AST and two 200PC valves, only the 2 WAST valves can be tested on-line. None of the molenoid l valves can be replaced on4ine Concunent with the investigation of the aforementaoned incident, a number of complementary actions ' ~ were taken that included but ase not limited to the following: t

• Survey of users soliciting valve and system performance feedback

.i A thorough enginaaring reappraisal of overspeed protection systems. J e

• In depth discussions with various valve manufacturers to obtain their inputs.

.j

• An investigation of dump valve orifice sizing, related to slow (greater than 0.5 seconds) reheat j

s;op/ interceptor valve closure during offline tests. L AVAILABIIJTY IlgPROVEMENT INFOR8gATION Beceous of the serious nature of excessive overspeed, Westinghouse recommends system redundancies and on41ne testing capabilities. Several of the following configuration specific recommendations are J reiterations of those contained in CAL 9242. ' A. UNI 11 WITH ER CONTROL SYSTEMS 1. As a minimum, modify units with two 200PC (AGG) and one 20/ET solenoid valves to pennit on-line testing. This could also aDow on line replacement. a. One method of accomplishing on-line testing is to instaH a test block between the present solenoid valves and the large machined block. (Refer to Figures 8 and 4). - This test block can be used to individually test the solenoid valves on-line and could also aBow on-hne snaintenance. For units with spool type puot valves, this block can be sandwk:hed in with little effort.' For units with solenoid valves that screw into the main block, a new block would be required. This method mmimizes i the modifications needed but requires local testing Other methods could be used 1 which range from coming off-line to test to remote testing capability involving blocking solenoid valves and pressure transducers. - b. Instan a push button panel a4acent to the solenoid valves to permit on-line testing j of each salenoid valve when done locany. Additional instrumentation will be i needed t dos.e remotely, c. Test tt e valves monthly using appropriate Instruction leaflet requirements. 1 D-1. NUREG-1275, Vol.11 i

.- ~ 4 )

?,

i W t j Q 'i . gg : Paige 2 of 16 i 2.- J As a minimum, modify unks with'an electrical trip system and having two 200PC and four 20/Af evaenoLi valves to allow for on4ine testing of 200PC valves. His could also allow i on-lin a replacement of valves. l a. One method of ace <==paulaf on ilne testing is to install a test block between the present 200PC solenoid valves and the large spachiand block. (Beger to Figures 3 .c and 4 ). His test block can be used to L r.." "; test the solenoid valves on4lne and could also aBow on.hne sumintenance. For units with spool type puot valves, this block can be sandwiched in wMk little eRort. For unks wth solenoid vakes that screw into the snain block, a new block would be required. This unethod I minimises the modifications needed but requires local testing. Other methods i could be used which range 8mm coming off-line to test to remote testing capaldlity i involving blocking solenoid valves and pressure transducers. Test the valves i monthly using appropriate Instruction laaflet requirements. b.- Install a push button panel a4acent to the 'malanald vehes to permit testing each 'l solenoid valve when done locally Mdielanal instrumentation win be needed if done remotely. l r

c. '

he four NAST solenoid valves can presently be tested in pairs, not individually. l Install a push button panel agacent to the solenoid valves to aDow individual r testing of these valves. It is suggested that a test block be instaued for each aolenoid valve to allow on-line maintenance of these valves. Test the valves t monthly using araa'imaa Instruction Leaflet., l 3. Remove, replace or rebuild and then test each OPC, ET and AST solenoid valve in the EH 'i lines at each major unit outage in acconience with valve raanutseturer's recoenmendattaa= Spare valves in stock for five years or more should be rebuut prior to being placed in operation. valves should be rebuut antz by valve manufacturer appn=d vendor. 4. Verify that au pressure switches used to indleste a tambine trip condition (autostop ou _ pressure) are set at the same pressure level per Instruction Book information. This l permits resetting the turbine control system to a tripped condition simultaneously with i naalficatian of a turbine trip to the steam supply system. 5. Maintain EH fluid temperature and clan =Imess within recommended specifications (Refer f to OMM 120 and Instruction Book). Verify that EH fluid tubing is not buried in inantarian i or exposed to hot turbine parts (Refer to AIB 8102). dis wul reduce varnish depoelts on I close clearance parts such as =at== aid valves, Moog valves and roues valves and clogging i of drain lines. De recommended operating ternparature for the EH fhdd is 100'F to 130*F. l Refer to I.I. 1250-4290

• Care, Handling & Application of Control System Fluid
• for i

appropriate safety premiana 6s Instar a latch 4n (seal-in) circuit to energise 20/ET solenoid valves. (Refer to Figure 5). '{ Some plants have a separate electric trip to energine 20/ET other than that used for 20/AST. If the signalis amoved Dem the 20/ET solenoid vahe, the 20/ET wlO aBow r===*=Ning the high pressure fluid. If the pararsel pash which energlses the 20/AST did not function, the steam valves could reopen creating a prwi=1 for -. _, f A latch 4n circuit wiu ~ maintain the unit in a tripped condition when the 20/g"t solenoid receiu an external signal .I 7. Test each 200PC (or AGG) and each 20/AST or 20/ET solenoid valve individually on each startup. If any vaive does not operate due to rticking, all solenoid valves should be. -{ resnoved, replaced or rebuilt and then retested. j 8. For au valve actualors eqinpped wkh a three inch dump valve, inspect the orifice which

~

limits the Dow of Auld from the high pressure header to the emergency trip heeder to verify l that the diameter is 0.031 inches or less. Other valve actuators, equipped with the 7/8 inch dump valve, do not require this inspection as they do not have this orifice. Mgure 6 shows NUREG-1275, Vol.11 D-2 L_

Als 9301 - Page 3 of 16 i a ihnd diagram for actuators equipped with both types of dump halves. Figures 7 and 8 . show an exploded outline of typical valve actuators equipped with the 7/8 and 3 inch dump I nives(respectiveh). The oriSce to be inspected (on valve aredans equipped with the three inch dump valve)ls located most commonly in the orince plate that is sandwiched between the seachined I block and the test solenoid valve, as shown in Figure 8.'. If the onnee diameter is greater than 0.031 tnehes, it is recommended that it be replaced with another having the 0.0311nch diameter. Some valve actuators equipped with the three inch dump valve do not have an orifice plate and ir*=d the oriSce was drilled into the machined block underneath the test solenoid valve; for this configtuation, if the orince diameter is greater than 0.031 laches, it is reccamended that an orince plate be added having an oriSce diameter of 0.031 inches, as shown in Figure 8 (the drilled orloce in the macWnad block should be left as is). 9. Inspect and verify that the vented drain line(s), which return fhdd to the EH Reservoir from the emergency trip header interface diaphragm valve and emergency trip control block connections Oocated at the governor pedestal), are of the proper slee; 1.00 inch OD by 0.120inchwallthickness tubing. Also verify that the vented drain !!ne(s) are located and adequately protected against a possible mishap which could cause a reduction in the flow capacity of these line(s). It should be noted that current Westinghouse practice calls for two independent, full capacity vented drain lines to be run to the ER Reservoir in parallel in order to help minindse this risk. Additionally, a crose.tle between the two vented drain lines near their

=+I+ns to the interface d.phr. gin valve and emergency trip control block is also

'] secommended. j 10. Poppet type solenoid valves will be furnished when replacementAspare solenoid valves are ordered. They are a direct replacement for the spool type valves with regards to form, fit and function and will mount directly in place of spool type valves. (Refer to Figme 4). Westinghouse Style #822A848001 is replaced by 807J040002. B. UNITS WrtB MECHANICALTRIP SYSTEMS 1.- On units with mechanical trip systems, one 20/AST is standard. During trip testing at the front pedestal, this solermid is made ineffective. A ascond 2 WAST abould be instaBed on the HP ou suppW side of the test handle to allow electrical trips to be effective even when the test handle is held. (Refer to figure G). 2. In addition to testing the low bearing oil, low vacuum and high thrust trips devlees on a monthy basis, the trip solenoid 2 WAST in the mechanical trip device assembh should be tested monthly using appropriate Instruction ImaGet requireenants. Caution should be, exercised when making this wat to assure that other plant tripping circuits are not involved. 3. At each mWor outago, visually inspect and manually manipulate the trip assembly mechanism to detect any worn parts, loose pens, ruptured beDows ormir*tng mechanissa. Repairas needed. 3 C. UNITS WITH MECHANICAL HYDRAULIC CONTROL SYSTEId8 itis recommended that these uruts have as a minimunc j 1. An auxinary govemor which will take action to arrest turbine speed to a value below the trip met point. This function may be caned a pre emergene governor. D-3 NUREG-1275, Vol.11 ~..

I i i ? . Agg ggpp Psee 4 of '16 ' 2. A load drop andelpator to assist in preventing reackas the overspeed trip point on a [ sudden lose ofload. On 800 pois control systems, a solenoid valve would divert control oil j Dom governor and interceptor valve servomoeors to drain. On 150psig control spe== a i solenoid valve would admit high pressure.ou to the governor and interceptor valve control f oil header. Either configuration will cause the governor and interceptor valves to close. De essence of this featune is shown la Figure 10. .~ D. ALL UNITS 1. Use severse power relays in'the ekcult fbr opening the main generator circuit breaker as recommended in OMM002. This anows turbine driving steam to be dissipated prior to opening the breaker. 4 2. Westinghouse recommends the use of autostop ou pressure level to indicane the l= ace =t or tripped condition of the turbine. It is recognised that sosse users snar use valve Esnit ( switches for this purpose. If so, the Emit switches at the closed and of the valve should be [; L uned. 3. Test the trip weight by simut=eW (ou test) snontt# per instructions in the unit Instruction l Book. l 4; . Follow testing and maintenance practices for steam noaweturn valves per ANSI /ASME . Standards TDP 1 and TDP-2

• Recommended Praedcas for the T.u..th of Water Damage

. to Steam hrbines Used for Electric Power Generadost" his will reduce the passtility j for uncontroHed flashing steam driving the unit to overspeed. i 16.' When conducting periodic trip tests at the host pedestal, the kont pedestal operator asast i be in constant contact with the control room to pennit receipt of any tripping instructioms. -[ 6 6.. De front pedestal operator is to have visual access to indications of unit speed and 't autostop oil pressure via tachometer, pressure gauge or other turbine trip status. i 7. The front pedestal operator is to release the test valve if a turbine trip occurs or it j indications of a unit overspeed are received. f 8. To reduce the potential for a mosnentary drop in autostop 00 pressure during trip testing, the cleanuness of the autostop lobe oE should be maintained to reduce the possReulty of } onfice clogging. (Refer to OMM M2 and OMM 106). f 9. It is recommended that aR units have at least two independent aseens of tripping the unit on overspeed. His should consist of the overspeed trip weight channel plus one or amore e of the fonowing: a.' . One electrical speed esasing channel b. Pressure switches sensing shaft driven ou pung output pressure (l'1g.11) c. Two out of three electdcal speed sensing channels (Fig.12) ' A means of functional testing on-line le to be incorporated reganDees of the methods [ choosn. 10. To reduce the possibility of tripping the unit during testing of the trips at the front pedestal, install a pressure psage on the t:1p block side (mechanical trip system) of the test L hanage. Refer to Figsree I and t. De operator should vertfy that autostop pressure has ~ been se=N befbre releasing the test handle. NUREG-1275, Vol.11 D-4 o I 1

AIB 9301 Page 5 of16 EMERGENCYANDOVERSPEED i PROTECTION CONTROLLER-SYSit-M i 4 4 1 i 4 63 i. A P TURBINE AST TRIP INTERFACEVALVE I P i 5 y TRIP HEADER TRIP Lg 22 l h HP OIL TEST SUPPLY I THANDLE y ~" ~ j (ROA Q L s g b j m _. 1 PROTECDON V 2 2 S 1 CONm0U.ER -------- 90 OPCN ""o i V FIGURE 1 D-5 NUREG-1275, Vol.11

~. = AIS 9301 - Page 6 of 16 EMERGENCYANDOVERSPEED PROTECTION CONTROLLER: SYSTEM "=a 1lI i G EMERGENCYTRIPHEADER TRIP HP OIL TEST Y ~ ~ SUPPLY HN DLE ~ ~ (FROM 3 C LUBEOIL SYSTEM) Kit p A N& SN ua Asi W 3 C V _E s Y WERSPEED eRouns 8 20 2 CONm0LLER = - - ~~ Looc g CPCIEADER FIGURE 2 NUREG-1275, Vol.11 D-6

l t AIS 9301 Page 7 of16 SoLEWOID VALVE ADAPTER [ I l l SPRING RETURN LOCAL E MANUAL VALVE TEST n INN T ( EXISTINC ORIFICE 5 c1RCUIT 20/0PC ORIT f OPC OR ET ] g VALVE U DRAIN L lhis arrangement does not apply to: Manifold blocks with cartridge valves r=m'M directly in the block. For these a. units, a new manifold block and solenoid valves are required. b. The solenoid valves designated 20/AST on manifold blocks with 6 valves. Presently,201/AST thorough 20-4/AST valves can be tested online but not replaced online. New solenoid valves and an theradon to the manifold would be required in order to permit on line replacement. II. For vernote testing, a variation of the above arrangement could be made by: a. Replacing the manual valve with a normally open solenoid valve. b. Addmg a pressum transmitter and receiver to read the gauge pressure. c. Adding a solenoid valve test panel in the control room. FIGURE 3 l D-7 NUREG-1275, Vol.11 =..

i 4 i Als 9301 Page 8 of 16 l SOLENOID VALVE ADAPTER ) PARKER-RANNIFIN SOLEN 0ID VALVE REMOVE EXISTING PLUG REPLACE NITE ROOT VALVE AND OAUGE /- J PoPPn m l [ 0.[j SOLENOID BIACK / / l L _ _ _ _ _ _ _ _ oa l I i I i /' / i SPRING RETURN y / NORMALLY OPEN / BALL VALVE / 1 / I i f a : [h 8' DRAIN l RIGE PRESSURE EXISTING MANIFOLD BLOCK j FIGURE 4 l NUREG-1275, Vol.11 D-8 . l

.u If h A48 9301 Page 9 of16 1ATCR IN OP 20/ET + ~E CUST0tER 63/AST =g

1

"" TRIP CONTACT ~ y uSET 4 20/ET [A 63/AST - CLOSES ON 1485 0F AUTOSTOP OIL PRESSRE 20/ET - OPENS TO DUMP HIGH PHSSUM EMERGENCY TRIP LIE The original intent of the 63/AST-20/ET circuit was to pmvide a mhmdant path to the diaphragm valve. Practice has indicated that many utilities energize 20/ET directly u a redundant path to 2 WAST. As presently configured, there is no latch in circuit to keep 20/ET s..' ed. The chcuit above is recommended to keep 20/lft energized until an operator s purposely resets the circuit. l FIGURE 5 D-9 NUREG-1275, Vol.11

i...

l-As sem Page 10 of18 VALVE ACTUATOR WITH 7/8" DUMP VALVE (not affected; for reference only) gg'or A ST.r. [A ^4 mq e,., g r ston .s E ou w m vr h l m .I . gue gm (L YM sotsmos alp t VALVE ACTUATOR WITH 3* DUMP VALVE

e3 N, l

9uLLTvet l p', cruncta a l C -a sr 2 u N h m.e rtue g g =r w j settactPfoe MW affected orifice tw nesmer snam var tes FIGURE 8 NUREG-1275 Vol.11 D-10

AIB 9301 Page 11 of16 VALVE ACTUATOR WITH 7/8" DUMP VALVE (not affected; for reference only) l l MACHINED BLOCK /% b tvor D.e 8 a.,o vatvt s o ,/ < 1 4 vatvs Cw(Cg VALVE / (,' h A g, g / k, / /, t e ,\\ / E*LN k' v cEEd" T88 """8 l v MGURE 7 D-11 NUREG-1275, Vol.11 l

Als9001 Page 12 of16 VALVE ACTUATOR WITH 3" DUMP VALVE k i h o C o o / i

1. Nsp%

I Ti&Ys. x'- s s W l %~ f'4> /o$$A* ( h

• ete N

Oglg E-N s,bg s q</ N. f*/f %. unse c k i,i M affected orifice (d.o.ose meal FIGURE 8 NUREG-1275, Vol.11 D-12 t

m e soo1 Page 13 of16 MECHANICAL TRIP SYSTEM TURBINE TRIP @ VALVE CLOSURE SYSTEN BLOCK I P i CS TRIP ] k TEST ~ HP OIL 'g*HMOUE SUPPLY l FROM I 20 2 LUBE OIL S Sh SYSTEM) Propos Change FIGURE 9 D-13 NUREG-1275, Vol.11

i i AIS 9301 Page 14 of16 3 1.0AD DROP ANTICIPATOR 1 i k i MAIN a" BREAKER ,, g g LDA PRESSURE = SWITCH CONTROL 01L i h h SOLENOID i RELAY vat.VE 11 i t h i l 1. Install a pressure switch to use as a measure of steam flow. A convenient location is in the I crossover pipe. Calibrate the pressure switch to close at a pressure equivalent to 30% or greater of rated flow. j 2. Install a solenoid valve in the control fluid line. Operation 1. Unit operating above 30% load with drop anticipator (LDA) pressure switch closed and the main breaker contact open. I 2. Main breaker opens closing contract B. LDA contact remains closed. I 3. Relay R1 picks up and energizes control oil solenoid valve. 'Ihis in turn closes govemor l andinterceptor valves. j i 4. Steam flow reduces and LDA pressure switch opens. i 5. Control oil pressure restored and normal governing function controls speed. i FIGURE 10 NUREG-1275, Vol.11 D-14 i

F g ^ . g AIB 9301 Page 15 of 16 ~ l l 011. FRESSURE SWITCH AR.RANGDtENT PS rs PS la . 2a 2a { 3a : la -{ lb "2b.,g,3b,,, s ~ J~ 2 3 L 7 '8 - $~ 3a B1DCK & STEED TRIP $0 TEN 01D t i i SHAFT DRIVEN OIL Ptur OUTLET - One relatively easy way to add a backup overspeed protection circuit is to take advantage of the shaft driven oil pump pressure variation with shaft speed. Using 2 out of 3 logic reduces the chance of tripping due to a single switch failure. Due to variations from unit to unit, the output pressure needs to be checked for each unit at the overspeed triplevel. A normally closed contact from each pressure switch can be set to open above 95% speed and used to indicate a switch failure in the closed direction. 1 The pressure switches can be isolated and removed for calibration checking while online. Calibration should be done a minimum of once a year using a dead weight tester. 3 i FIGURE 11 i D-15 NUREG-1275, Vol.11 m m i

i Als 9301 Page 16 of 16 i TWO OUT OF THREE ELECTRICAL SPEED SENSING CHANNELS CHANNEL NO.1 CHANNEL NO.2 CHANNEL NO.3 OlG!TAL SPEED DIGITAL SPEED DIGITAL SPEED TACH / RELAY TACH / RELAY TACHAELAY NO.1 NO. 2 NO. 3 i P I t 1P lf 1 F 9P i P9P 1Pif9P1P 2/3 OVERS' EED M N ED P LOSS OF SPEED LOGC (NORMA 4 SENSING LOGIC l FIGURE 12 i NUREG-1275, Vol.11 D-16

} ) APPENDIX E HAMMER VALVE I l l i

I h HAMMER VALVE i 1 As noted in Section 43., the author of this Control for Compact Drives for 'Ihrbine study examined an SOV which is used in _ Valves," by E. Kloster, explain in detail how European fossil-unit TOPS systems. The valve the valve works. In response to the author's undergoes long periods of inactivity but must inquiries about the hammer valve's reliabihty, function properly when called upon to dump the enclosed June 10,1993, letter from EHC system hydraulic fluid. The enclosed N. Schauki of Siemens Nuclear Power technical articles; "Herion Directional Control Services, Inc., notes that the hammer valve has - Valve 'Iype 5203468 for Hydraulic Safety functioned on demand with 100-percent Control Systems Inoperative for Long Periods success. However, some minor flange leakages j Under Pressure," by A. Hoeger, and " Trip had been recorded. i i l l E-1 NUREG-1275, Vol.11

i l HERION directional control valve type 5203468 l for hydraulic safety control systems inoperative j forlong periods underpressure

• uomo.ge, Spool or seat-type directional control 31s *hanxner action" frees the con-function of the armature in solenoid trol phton, the return sp(ring can move (b) b to discharge the breakaway in>

valves subjected to hydraulic pressere for lengthy periods tend to suffer from the piston to position b). He sole

pact, piston sticking. His means that it is no longer possible to change the state of the valve, because the switching I

forces are not sufficient to free the jammed piston. His is particularly criticalif switchint s performed by a i spring or hydraulic pressure, as these I are agents which exert a static force on the piston. Tests and case histories have shown that a blow with a ham-oner on the casing of a valve with a jammed piston is enough to free the piston, a feat which static force alone could not accomplish. In safety control systems, the safety directional control valve must bc i switched by the return sprieg if power fails.nere must be noquestionof the piston jamming. ,5 neIIERION type $20M68 valvewas developed for reliable switching even when the pistonisjammedafteralong period ofInoperation. A device designed to jerk the sticking piston free is mounted on the elec-tromagnetically actuated spool vstve with return spnng. His device consists of a rnagnetic coil, a solenoid armature and a compres-sion spring. De armature is of a de. s sign which recirculates the oil when ~ the valve is switched. 1f theknpacteolenold(s)lsenergized, a b V [h - Lg the piston snoves against the force of Q ___ _ _ _'_ - g g- - the return spdng to position (a). gized, the return spn(a) is do<ner. When the solenoid 1 ag pushes the g piston back to position ).Ratis the % // gg--- py- - - - method of operation w en the piston gM 3 g M /4 l does not suck in the

• solenoid (a) energized
• poshion.

lll Solenoid (a) and soldpoid (b) are both 7APB energized at the same thne.%e arma-g ture of solenoid (b) pretensions the e spring la solenoid (b). When solenoid M (a) h de-energized, solenoid (b) is P 'T also hnergized. In this way,the ar. ( mature is pushed toward position (a) by the spring in solenoid (b). As k moves, the arrnature travels through the spau A and strikes the control piston itit has stuck. HERIONvalve *vpe$203468 ' Reprinted with permission of Herion-Werke KO. NUREG-1275, Vol.11 E-2 i

Trip control for compact drives for turbine valves

• m,m,o,. _ o.nm la the speed or output control system In order to control the steam forces by He control speeds required for not.

of a steam turbine, irregularities are means of the valves, high control mat closed 4oop or open-loop opern-compensated via the turbine control forces must be made available with tions of the control drives are insuffi. system by adjusting the steam inlet short control times. Dis, coupled cient for extreme turtsne failure valve.His enables the flow of steam with the requirement for high posh modes, such as a full-load shut-down to be matched to output require-tioningaccuracyof thecontrolvalves, or an overspeed trip. A considerably ments. In order to provide protection can be achieved only by mean,of hy-shorter control time is :-ary in against impermissible operating states draulic drives. Instead of the other-these cases in order to prevent imper-of the turbine-generator set, such as wise customary central control-Duid missible overspeeding of the turbine-overspeed resulting from the failure supply system to the valves via pipes, generator set.Hecompact drives for of control valves to close, the s: ics-a separate oil supply (pump, fatct and control and trip valves are therefore connected trip valves are provided accumulator) is incorporated in each provided with a fast speed which ena-with a control system which closes the drive. %csc are designed for a high bles a control time in the closing dirco. valves when triggered.The protective operating pressure and are of compacs tion of 150 ms to be achieved. signal also acts on the control valve, dimensions (Figt rc I). Electrical sig. One precondition for such short clos-thus incorporating redundancy into mal and supply lines are fed to the ing times is that the actuating fonic in the safety system. compact drive. To act as a drive for the closing direction be applied by a i the control valves, this is actuated by pre-loaded spring. in this case a spring ne new turbine control system has an electrohydraulic servovalve via an disk. In other words, closure ruust be been designed to use electricity for electrical position control loop. He effected without any suxiliary energy. I signal processing, signal transmission switching drive to control the trip De valve is opened by the actuating and as an auxiliary power source.De valve as an open/ closed valve is, on the piston which the ou pressure movesin advantages are high processing and other hand, driven by a solenoid ao-only one direction. Again, this princi-transmission speeds and short delay tuated control valve via the control pie n!!ows the stipulated short delay times. system. times to be realized (Figure 2). i i l i I 1 il i Tigue ! Compactdrive ' Reprinted with permission of Herion-Werke KG. E-3 NUREG-1275. Vol.11

Emergy storage by springs is also re-the tuttine, the disation of failure eqle if the oE s9 y falls (W f quired for another reason: to protect must always be toward "close" for energtze to trip"prinople) i ~ Mgure2 Hydrauliceystemof act drive Conuotvaeve rapid-dosing control -schematk riew ihoctionatownruvanve T

• • ia**ct.**mW Po

/ ppetssive L I_J rromp om# system j l coumatoww. l g mammmun j _t lDa*' , - = g,,ig=- h so*o Actuatinovisim Directionarcontma r seid*v so*x*: a., impactsame \\- N ji 'I l'.. 4 %' Q@f _ m f(TI--- iir-- ~-- w F .r \\'] r Ifag:A u emire oms.ur.wn.n N wh rappetverve T% 'a*a*=ad - D'Sa W li Figure.1 Poppet vare and directional contevi vdve A wkh impactsolenoid y FromemtrolcAnder i l NUREG-1275, Vol.11 E-.4 .a

l To initiate the trip procedure, prps-present, a second solenoid valve is Gt-Like all the parts in the control system sure beneath the piston must be re-ted to the opposite side; when tripped of the compact drive, the solenoid val-duced and the volume of oilddven by by spring force, the armature of this ves are also subject to particularly spring force into thc oi! reservoir.%is solenoid strikes against the control high cicantiness requirements, is attained by the rapid opening of an slide (" impact solenoid"). Dis impact integrated control system (Figure 3). produces an additional breakaway When these valves open for a trip, they pulse (Hgure 3). He trip procedure is executed at in-ternis M app ox.14 days la the connect the cylinder with the reservoir Even with high ambient tern peratures o utse M the testing d the turbin,c parallel to the electrohydraulic servo-and wide voltage tolerances, diree-Protection system by an automatic valve (control drive) or electro-tional control valves with im act sol. magnetic control valve (open/ closed enoids (*'kmm nives" have test system. d'I'*)* adequately large reserves of actuating Figure 4 shows graphs for a trip proce-As shown above, a failure,whichis to force in the closing direction, short dure, measured with an experimental say, the non<losure of a control valve, closing times with small tolerances drive. ncse show trip signals, control I leads to overspeed. Redundancy is and low leakage-oil rates. his is at-pressure downstream of the impact i therefore required, i.e. trip and tained by precise balancing of the solenoid, control Duid pressure, the control valves are connected in pairs in close-tolerance springs with the sol-pressure below the control piston, and series in a valve combination. Further enoids and similarly close tolerances the control piston travel as a function j redundancy is achieved by the parallel in clearance. oftime. I connection of two integrated control systems (Hgure 2). Tdp i Each of these is able to handle the g closing operation by virtue of the fact - 25v j Quick-close signal i that, with over-dimensioned valves O' and large duet cross-sections, the sernes-connected orifice is dimen-sioned for ahe short closing time. %c hydraulic Guid reaches each pop-ttv pet valve separately via a directional control valve actuated electrically by contros pressare the control system (Figure 2). De behindimpact poppet valves are standard.installa. awwalve tion elements with piston guide, l known as two-way poppet valves or i cartridge valves. With the control or ( j open/ closed drive open and cylinder pressure applied beneath the valve cone, they are held dosed by the con-Controlfluid pressure trol pressure which the solenoid valve Approx. mbar builds up above the cone. He sol. enoids are energized in operation, de-i energized for a trip, the control pres-sure is dissipated, the poppet valves are opened by cylinder pressure.De de-energire to close principle applies Pressurebeneath to the solenoid valves as well. in other actuatingpiston words,if the electricalsupply fails the gw turbine valves close, 3 r %e solenoid valves selected are of y slide design.in order to ensure that no sealing problems are encountered g during long periods in service. Slide i Actuating valves are subjected to frictional N Pistantravel forces and also adhesive forces if they remain for considerable periods in -~ L x one position.De IIERION solenoid s T 0% valves have been developed to ensure W"" ' \\ that they can be tripped reliably by Totat b ' - iso ms Cushioning spring force, even after a long delaytime standstill period. To increase the re-liability of the closing action even when unezpected adbesive iorces are Agure 4 Graphr ofa quick eIossue E-5 NUREG-1275, Vol.11 l

SIEMENS i June 10,1993 National Regulatory Commission Mali Stop 9715 Washington, DC 20555 l Attention: Dr. Ornstein

Dear Dr. Ornstein:

1

Subject:

Exoerlence with " Hammer Solenoids Valves" from Herion According to the information we received from Mr. Gebauer at Siemens - KWU in MGlhelm, there were no functional problems encountered with the " Hammer So!enoid Valves" from Herion. In some cases minor flange leakages were observed. The leakage was overcome by replacing the gaskets at scheduled maintenance. The functionability of the " Hammer Solenoid Valves" has been 100% ensured to date (April 93). Attached to this letter please find a fax to S-KWU with the above statement and a reference list showing the power plants which have the " Hammer Solenoid Valves", the start-up date and the number of installed " Hammer Solenoids." As far as I was informed, some information about the valves has already been sent to you last year. If you have any questions, please call me at 615/499-1718. Best regards, l ') Dr. Nabil Schauki Manager, F g and Valve Services i NS: 0177.Sg Attachments Siemens Nuclear Power Services, Inc. 5959 Shanowtord Road. Sude 531 Chattanooga, TN 37421 TEk (615) 4990961 FAX. (615) 894 2456 NUREG-1275, Vol.11 E-6

I TELEFAX / TELECOPY !O:'T,,,,, An/To Wn /Fenst l?."Lk OSG4- //- 7/I.f L**'fA., rozow4ss.2/(2 ~ L"#,.. .h.,~ as, ruu t'. xwu t".:T,.*a %*.L TDAR Gr.b.ar u M. 2. a ~~ W,% EM. -s,- O lf E o m o m a'* = u a

• 1:w",':u..

m -suo 1;,,,,,.*., tozon<u 287,1 mmi=x.~ 8e%hsaJ.L.-.,a, +.s%, Jnble< s kPA Ml:r Bung / Notics: sck Ukwe s. d as. birder w_ Ie7een Marm'[ der, I *etc ~ JL . a.1 rpa% a:.ad's I, ??la, L.JL V N M \\J eleko w em 1 Ei sdhh mA<klen leda.m s-h T L.s.l, y v .r;-,1 A.sde,,4. ul D;~.211..C9 - L Lu,~t.h~.b LJ A G oL. & d L b d.,A m m. A. D:e rak. hL:JJ de Min ~.Lkle :d LaL, >w joos a a L % IJ-U Nl Ldllcl.s-SW c> r $5? &W N* OE. 0't. 33 U 7-E-7 NUREG-1275, Vol.11

r. I REFERENCE LIST for Hedon - 4/2 " Hammer Solenoid Valves" i Selonald Tyne E1146 M: NG6 l 4 Power Plant Commercial Number of Number of Operation Actuators " Hammer Sotenoids" Start KW Heyden 4 04.87 24 48 Kendal1 04.88 24 48 Kendal2 10.89 24 48 Kendal3 10.90 24 48 Kendal4 09.91 24 48 Kendal5 Under 24 48 Kendal 6 24 48 KW Walsum Bl.9 05.88 14 28 Megalopolis 4 09.91 14 28 i Steas KW Home 4 07.89 12 24 i t SWM KW Nord 81.2 08.91 12 24 HKW Moabit Block A 11.89 12 24 Fynsvaerket Block 7 04.91 8 18 Haapavest 08.89 8 16 Simmering 3 04.92 8 16 Total: 232 464 + 1 F l NUREG-1275, Vol.11 E-8

..\\, a. APPENDIX F OPERATION & MAINTENANCE MEMO 108, i " MAINTENANCE OF MAIN STOP VALVES & REHEAT STOP VALVES"* i I I i ' Reprinted with permission of Westinghouse Electric Corporation.

DISCLAIMER OF WARRANTIES AND UMITA110N OF UABILITY THERE ARE NO UNDERSTANDINGS, AGREEMENTS, REPRESENTATIONS, OR WARRANTIES, EXPRESS OR IMPUED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. OTHER THAN THOSE SPECIFICALLY SET OUT IN ANY EXISTING CONTRACT SETWEEN THE PARTIES REGARDING THIS EttUIPMENT. ANY SUCH CONTRACT WFATES THE ENTIRE OSUGATION OF SELLER. THE CONTENTS OF THIS DOCUMENT SHALL NOT BECOME PART OF OR MODIFY ANY PRIOR OR EXISTING AGREEMENT COMMITMENT. OR RELATIONSHIP. The laderenseles reeemmendatleas and deseriptions la this deemment are based en Westinghouse's esportenee sad judgment with respeet to this egulpment's operaties and malatenasse. THIS INFORMATION SHOULD NOT BE CONSIDERED AS ALL INCLUSIVE OR COVERING ALL CONTINGENCIES. If further lateranaties is required, Westlagheese Elastrie C-.- '- should be senaulted. NO WARRANTIES, EXPRESS OR IMPUED, INCLUDING WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE OR MERCHANTARIUTY, OR WARRANTIES ARISING FROM THE COURSE OF DEAUNG OR USAGE OF TRADE. ARE MADE REGARDING THE INFORMA'GON, RECOMMENDATIONS, OR DESCRIPTIONS CONTAINED HEREIN. Is no event will Westlaghousi be reopenelble to the user la oestreet la tort (ineludlag magilgeneel, earlet llahulty er otherwise for any speelal,ladtreet,laeldenial. er eensequential damage er less whatsoever,lastedlag het not limited tr, damage la er less of use of equipment, plant, or power ersteams cost er. espleals less of pronts er revenuses eest of replacement powers addideaal esponses la the mee of esteting power feelMeleet or elalaes agalast the user by las sustomere, resultlag Arem use of the laferunatten, recesueendadene, er descriptions sentalaed herela. i i F-iii NUREG-1275, Vol.11 i - -.. ~..

i ' Page 1 of 4 OPERATION & MAINTENANCE MEMO 108 1 REASON FOR MEMO Incidents of clappers of main steam stop valves having come loose and separating from > the clapper arm have been reported. This occurrence completely disarms the safety backup feature of the stop valve. High levels of vibration of the clapper valve resulting from improper back ses,t of the clapper to the intemal stop, combined with inadequate staking (poening) of the retaining pms, can provide the conditions which may result in the pins coming out and eventual clapper coparation. Engineerino evaluation of the few incidents compared to the j thousands of years of successful operating history of this of valve and evaluation of the assembly requirements confirms that proper asse and maintenance of these j valves is essential to the performance of their function as a safety backup valve in the inlet features. 2 OPERATION AND MAINTENANCE INFORMATION i implementation of the following recommendations, consisting of verifying the conditon of the stop valve and, where required, institutmg corrective action, should minimize the potential for separation of the clapper from the clapper arm due to loose and vibrating parts. These recommendations should be implemented in compliance with the stop valve assembly procedures. 2.1 Verification of Stake, Nut to Retaining Pins ) Remove the stop valve cover and inspect the stake (poening) ins and location and of the clapper valve nut over the retaining pins. Requirements for posihon of p amount of staking are shown on Figure 1. If necessary, hot (500*F min - 1000*F take corrective action to establish proper staking. Staking (poening) is to be done max) with a poening tool having a 0.12 inch spherical radius tip. Contact your Westmghouse Representative for further details of the inspection procedures, of the peening requirements / acceptance criteria and, if restaking is necessary, of the staking procedures. 2.2 Verification of Back Seat Verify that the clapper valve stem properly back saata against the.intamal stop when the servo motor (or actuator) is in the prescribed wide-open, full-stroke posstion. Refer to Figure 2. Verification of proper back seat should be established Dy the " blue" method. If required, corrective action should be instituted per Reheat Stop Valve Assembly Procedures Drawing to establish proper valve stem back seat and recheck by the blue" method. 2.3 Verify Belleville Washer Setting Proper setting of the Belleville washer is critical to the proper operation of the valve. Following the field setting instructions provided in Fiqure 2 reset the Belleville washers to the required position while the valve is hot. F-1 NUREG-1275, Vol.11 . ~.

i i - 00804 100-PeGe 2 of 4 1 I 2.4 Document the results of the verification checks and actions taken per Paragraphs 2.1,2.2, and 2.3. ] ' Contact your local Technical Services Manager if additional information relative to or clarification of the recommendations in this Memo is required. i l t i l i f NUREG-1275, Vol.11 F-2

y $TAKE P!HS I HOLES FOR.500 P!NS l r'1.252 T A [, % \\ c - '". { i.n p set v!EW Ya / N [ -+ l ~ l r %. f ) 4*ALL AAOLNIO CLEAR \\ / STAKE NUT OVER MAX PIN 4 PLAct3. Elt> AGED VIEW "X"

• - NOTE: P!N MAST BE SEATED TO SUFFIC!rNT DEPTH BELOW NUT TO A55Wtt ADEQUATE 4

STAKE. END OF PIN WITH TAPPED Nott. s tNLARGtD VIEW 'Y" 1 PtB ACCEPTANCE CRITERIA WIACCEPTABLE ACCEPTABLE j INSUFFICIENTLY OtPOWED METAL OtPOWED WAL MIST TOUCH .12TTP d CHAlttR I ) ~ '0) m LIQ'J!D PENETRANT ) INSPECT DEFORMED METAL. g

f. BBL 1 F-3 NUREG-1275, Vol.11 r

s i oasM ios l Page 4 of 4 l 1 h 51 -- h.3 i s2 - 'f BELLVILLE WASHERS. /,, PEEN TO AETAIN 53 54 a ss RELLEVILLE FIELD SETTING INSTRUCTIONS WITH STOP VALVE HOT ANO WIDE OPEN. CODPRESS. ' BELLEVILLE WASHERS (IT. 54) BY USE OF ADJUSTING SCREW (IT. 51) UNTIL STOP VALVE JUST STARTS 70 t MOVE IN THE CLOSED 0! RECT 10N. TNU BACK OFF ADJUSTING SCRG 60* LOCK WITH NUT (IT. 52) i O2. AT AssDeLY CHECK THAT CLAPPR VALVE !$ SACK-SEATED AGAINST STOP WEN IN OPS PO$1710N AM THAT SHVO STR0KE IS MAINTAINED. l BACK SEAT \\ CLAPPER VALVE AB0VE .j N STEAM FLOW W EN RACK-!iEATED. M l l / **

-m f

[ / I i SEE VIEW *1* FIGURE 1 l / / l 1 RETAINER NUT FIGURE 2 NUREG-1275, %1.11 F-4

IWIC FORM 336 U.S. NUCLEAR REGULATORY COMMISSION

1. REPORT NUMBEQ CM 1102, Rev

'Num-3:o1, saae BIBLIOGRAPHIC DATA SHEET h* " *ar- ) (See instructions on the re w) NUREG-1275. Vol.11

2. mLe AND sueTiTot

3. DATE REPORT PUBUSHED

. Operating Experience Feedback Report *Ibibm.e-Generator Overspeed Protection Systems MONTH YEAR April 1995 Commercial Power Reactors

4. FIN OR GRANT NUMBER t

5 AUTHOR (5)

8. rYPE OF REPORT H. L Ornstein Technical l

7. PERIOD COVERED (inclusive Dates) 1950-1994

8. PERFORMING ORGANIZATION - NAME AND ADDRESS (if NRC. prov60e Division, Offsos or Region. U.S. Nuclear Reguistory Commission, and malling address; if contractor, provide name and malling address.)

Safety Programs Division Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission i Washington, DC 20555-0001

9. SPONSORING ORGANIZATION - NAME AND ADDRESS (if NRC, type 'Same as above"; if contractor, provide NRC Division. Office or Region, U.S. Nuclear Regulatory Commission, and malling address.)

Same as 8 above.

10. SUPPLE.MENTARY NOTES

11. ABSTRACT (200 woros or less)

The report p(resents the results of the U.S. Nuclear Regulatory Commission's Office for Analysis a tional Data AEOD) review of operating experience of main turbine-generator overspeed and overspeed protection sys-tems. AEOD's study provides insight into the shortcomings in the design, operation, maintenance, testing, and human fac-tors associated with turbine overspeed protection systems. It includes an indepth examination of the turbine overspeed event that occurred on November 9,1991, at the Salem Unit 2 Nuclear Power Plant. It also provides information concerning ac-tions taken by other utilities and the turbine manufacturers as a result of the Salem overspeed event. AEOD's study re-viewed operating procedures and plant practices. It noted differences between turbine manufacturer designs and recom-mendations for operations, maintenance, and testing, and also identified significant variations in the manner that individual l plants maintain and test their turbine overspeed protection systems. j i l 1 4

13. AVAILABluTY STATEMENT

12. KEY WORDS/DESCRIPTORS (List words or phrases that will assist researchers in locating the report.)

Unlimited 'Ihrbine, overspeed (OPC), electrohydraulic system, EHC, missile, control system, . SECURITY CLASSIFICATION Regulatory Guide 1.115, RG 1.115, General Desir Criterion 4, GDC 4, turbine-(This Page) generator, Salem-2, solenoid valve, solenoid opera'ed valve, SOV, common mode failure, admission valve, bypass valve, OPC, ET, gove.rnor, hammer, AST, SERT, Unclassified front standard, hand trip, precursor, TIL, fire, flood, vibration, AIT, CAL, AIB (ms meport) Unclassified

16. NUMBER OF PAGES

16. PRICE NRe FORM 335 (2-89)

i t 1 I l l i Printed

• on recycled paper Federal Recycling Program

NUREG-1275, Vol.11 OPERATING EXPERIENCE FEEDBACK REPORT-TURBINE-GENERATOR APIUL 1995 OVERSPEED PROTECTION SYSTEMS l I I ? 0 55 513 95 3 ^1 fy {jA{M IANIC21rg;y37 p TP s -pD P,, * "UPL ? r A 77 n.,c UNITED STATES 2WFN g 7UEEG SVCS speciAL r unrw ctass nare NUCLEAR REGULATORY COMMISSION N A S H I N G T q ag WASHINGTON, D.C. 20555-0001 DC ?0555 usunc PERMIT NO. G 67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE,4300 l}}