ML20116A137

Auxiliary Feedwater System RISK-BASED Inspection Guide for the Prairie Island Units 1 and 2 Nuclear Power Plants

ML20116A137
Person / Time
Site:	Prairie Island
Issue date:	10/31/1992
From:	Gore B, Moffitt N, Vo T Battelle Memorial Institute, PACIFIC NORTHWEST NATION
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-L-1310 NUREG-CR-5839, PNL-7605, NUDOCS 9210290208
Download: ML20116A137 (35)

Text

. . .

NUREG/CR-5839 PNL-7605 ,

i Auxiliary Feedwater System 1 Risk-Based Inspection Guide for 1

the Prairie Island Units 1 and 2

~

1 N.uc ear Power Plants 1 L -

Prepared by

' N. E. Moffitt, B. F. Gore, T. V. Vo -

i.

Pacific Northwest Laboratory (Operated by _

, Battelle MemorialInstitute  :

o g ff. Prepared for g U.S. Nuclear Regulatory Commission t

9210290208 921031 -

DR ADOCK 0500 2 .

~ , - , . . - , . - . - . . .

,r . ,

AVAILABILITY NOTICE Avanabiltty of Reference Materials Cned in NRC Publications -

Most documents cited h NRC pubacations will be available from one of the following sources:

~

1. The NRC Pubuc Document Room 2120 L Street, NW., Lower Level, Washington, DC 205$5

2. The Superhtendent of Documents. U.5, Government Printing Office, P.O. Box 37082, Washbgton.

DC 20013-7082

3. The National Technical Information Service, Spring 9 eld, VA 22161 Although the Esting that follows represents the majority of documents cited in NRC pub 0 cations, it is not htended to be exhaustive, Referenced documents avanable for inspection and copying for a fee from the NRC Public Document Room helude NRC correspondence and Intemal NRC memoranda: NRC buRetins, circulars, information notices, inspection and investigation notices: Rconsee event reports: vendor reports and correspotdence: Comm!s-slon papers; and applicant and licensee documents and correspondence, The following documents in the NUREG series are available for purchase from the GPO Sales Program; formal NRC staff and contractar reports, NRC-sponsored confereto ,. *ocecGngs, international agreement reports, grant publications, and NRC booklets and brochures. Also available are regulatory guides, NRC reNations in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical information Service include NUREG-series reports and.

technical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commis-sion, forerunner agency to the Nuclear Regulatory Commission.

Documents available from pubRc and special technical Ebraries include all open literature items, such as books. jouni articles, and transactions. Federal Register notices, Federal and State legislation, and con-

, grossional reports can usually be obtained from these libraries. .)

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference bro-ceedings are avaliable for purchase from the organ!Zation sponsoring the publication cited, Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Administration, Distribution and Mall Services Section, U.S Nuclear Regulatory Commission, Washington, DC 207.,55, Copies of industry codes and star 4rds used in a substantive manner in the NRC regulatory process are maintained at the NRC Library,7920 Norfolk Avenue, Bethesda, Maryland, for use by the pubHC. Codes and -

standards are usually copyrighted and may be purchased from the originating organization or, if they are  !

American National Standards, from the American National Standards institute,1430 Broadway, New York, NY 10018.

~!

• I DISCLAIMER NOTICE  !

i This report was orepare

! as an account of work sponsored by an agency of the United States Govemment.

Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights. i 1 '

1

NUREG/CR-5839 PNL-7605-Auxiliary Feedwater System Riss-Based Inspection Guide for the Prairie Island Units 1 and 2 Nuclear Power Plants Manuscript Cornpleted: September 1992 Date Published: October 1992 Prepared by N. E. Moffitt, II. F. Gore, T. V. Vo Pacific Northwest Iaboratory Richland, WA 99352 l

l l

Prepared for Division of Radiation Protection and Emergency Preparedness Office of Nuclear Reactor Regulation

- U.S. Nuclear Regulatory Commission Washington, DC 20555 NRC FIN L1310 I

l

. ~ . - . - . - - - . - . - . . . . . . . .- - .

- Abstract -

In a study sponsored by the U.S. Nuclear Regulatory Commission (NRC), Pacific Northwest laboratory he.3 dtveloped and applied a methodology for deriving plant specific risk-based guidance for the auxiliary feedwater (AIM') system at pressurized water reactors that have not undergone probabilistic risk assessment (PRA). This methodology uses existing PRA results and plant operating experience information. Existing PRA-based inspection guidance information recently developed for the NRC for various plants was used to identify generic component failure modes. j This information was then combined with plant-specific and industry-wide component information and failure data to

- identify failure modes and failure mechanisms for the AFWsystem at the selected plants. Prairie Island was selected as I the seventh plant for study. The pr(xtuct of this effort is a prioritized listing of AFW failures which have occurred at the plant and at other PWRs. This listing is intended for use by NRC inspectors in the preparation of inspection plans addressing AFW risk.important components at the Praitic Island plant.

l l-i l'

l l

l I-l l

l l

i iii NUREG/CR 5839

l i

Contents Abstract ... .. . ... . . .. . .. .... ... . . .............. til Summary . . . .... . . ... . . .. . .. .. vii 1 Introduction . . .. . . .. .. . .. .. .. . ..... . . .. .. 1.1 2 Prairic Island AFW System . . . . . . .. ........ ........ ... ... 2.1 2.1 System Dxtiption . . . .. . .. ... . .. . ... ... .. ... 2.1 2.2 Success Criterion . . . ... .. ..... . . . . . ... . . 2.2 2.3 System Dependencies. . . . . . .. . .. 2.2 2.4 Operational Constraints . .. .. . . .. . 2.2 2.5 Other Significant Information . .. . . . . 2.3 3 Inspection Guidance for the Prairie Island AFW System , . . . 3.1 3.1 Risx Important AFW Components and Failure Modes . .. . .. . 3.1 3.1.1 Multiple Pump Failures due to Common Cause . . .. . . .. , 3.1 3.1.2 'Ibrbine Driven Pump 11 or 22 Pails to Start or Run . 3.2 3.1.3 Motor DricEa Pump 12 or 21 Fails to Start or Run . 3.2 3.1.4 Pump 11,21, or 22 Unavailable Due to Maintenance .. 3.2 3.1.5 Motor Operated Wives Fail Closed .. 3.3 3.1.6 Manual Suction or Discharge Wives Fail Closed . 3.3 3.1.7 leakage of Hot Feedwater through Check Valves . 3.4 3.2 Risk Important AFW System Walkdown Thble . 3.4 4 Generic Risk Insights from PRAs . 4.1 4.1 Risk Important Accident Sequences involving AFW System Failure . 4.1 4.2 Risk Important Comp (ment Failure Modes . . 4.1 v NUREG/CR.5839

,y.,. ..

l Contents :-

4

- 5 Ihllure Modes Determined from Operating Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 ,

5.1 Prairie Isla nd Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  ; 5.1 5.1,1 M otor Driven Pump Pallu res . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 '

5.1.2 'Ibrbine Driven Pump Failures . . . . . . . . . . . . . . . . . . . . . . . .............................. - 5.1--

5.13 Flow Control and Isolation Valve Pailures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1~ ,

. 5.1.4 H u man E rro rs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . s . . . . . . . . . . - 5.1 -

5.2 Ind ustry. Wide Experience . . . . . . . . . . . . . . -. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . .. . . . . .. 5.1 5.2.1 Com mo n.Ca use Pall u res . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . . . . . . . . . . . . . . - 5.2 '

5.2.2 Human Errors . . . . . . . . . . . . ,, . . .. .... . ............ .. ..................- 5.3-5.23 Design /Enginecting Problems and Errors .. ... . .. . ... . . . . . . . . . . .. . . .. . . . 5,4 5.2.4 Component Pailures . . . . . . ... ..... ... . ... .... ..... . . . . . . .. . . . . .. . . .- 5.5

- 6 References .. . . . .. ... ........... .... ............. .... . . . . . . . .. . . . . . .. . 6.1 Figure

~

2.1 Prr.iric Island Auxiliary Feedwater System .. . . . . ... .. ... ........... . ... . . . . .. 2.4 f:

u L Table

- 3.1 Risk important AFW System Walkdown 'Ibble . .. . .. . .. .. . . . . . . . . . . ... . . . . 3.5 .-

i-N NUREG/CR.5839 - vi

, -._:- . & . . ~ . . . - ,_ . . _ _ , . . . . -. J . . r. . ..

Summary This document presents a compilation of auxiliary feedwater (AFW) system failure information which has been screened for risk significance in terms of failure frequency and degradation of system performance. It is a risk-prioritized listing of failure events and their causes that are significant enough to warrant consideration in inspection planning at the Prairic Island plant. This information is presented to provide inspectors with increased resources for inspection planning at Prairie Island.

The risk importance of various component failure modes are identified by analpis of the results of probabilistic risk assessments (PRAs) for many pressurized water reactors (PWRs). However, the component failure categories identified in PRAs are rather broad, because the failure data used in the PRAs is an aggregate of many individual failures having a variety of root causes. In order to help inspectors foc's on specific aspects of component operation, maintenance and design which might cause these failures, an extensive review of component failure information was performed to identify and rank the root causes of these component failures. Both Prairie Island and industry-wide failure information was analyzed. Failure causes were sorted on the basis of frequency of occurrence and seriousness of consequence, and categorized as common cause failures, human errors, design problems, or component failures.

This information is presented in the body of this document. Section 3.0 provides brief descriptions of these risk. ,

important failure causes, and Section 5.0 presents more extensive discussions, with specific examples and references.

The entries in the two sections are cross-referenced.

- An abbreviated system walkdown is presented in Section 3.2 which includes only components identified as risk l

important. 'Ihis table lists the system lineup for normal, standby system operation.

3 This information permits an inspector to concentrate on components important to the prcvention of core damage.

However,it is important to note that inspections should not focus exclusively on these components. Other compo-l nents which perform essential functions, but which are not included because of high reliability or redundancy, must also be addressed to ensure that degradation does not increase their failure probabilities, and hence their risk importances.

l~

vii NUREO/CR-5839 i

_.__m *----____m_m-__- ---__.----m-__m - _ ___-_-____m

L Introduction This document is one of a series providing plant-specific The remainder of the document describes and discusses inspection guidance for auxiliary feedwater (AIM) sys- the information used in compiling this inspection guid-tems at pressurized water reactors (PWRs)f nis guid- ance. Section 4.0 describes the risk importance informa- ,

ance is based on information from probabilistic risk as- tion which has been derived from PRAs and its sources. 1 sessments (PRAs) for similar PWRs, industry. wide As review of that section will show, the failure cate-operating experience with ARY systems, plant-specific gories identified in PRAs are rather broad (e.g., pump ARV system descriptions, and plant-specific operating fails to start or run, valve fails closed). Section 5.0 ad-experience. It is not a detailed inspection plan, but dresses the specific failure causes which have been com-rather a compilation of ARV system failure information bined under these categories.

which has been screened for risk significance in terms of failure frequencyand degradation of system perform- AITV systcm operating history was studied to identify -

ance. The result is a risk-prioritized listing of failure the various specific failures which have been aggregated events and their causes that are significant enough to into the PRA failure mode categories. Section 5.1 pres-warrant consideration in inspection planning at Prairie ents a summary of Prairie Island failure information.

Island. and Section 5.2 presents a review of industry-wide fail-ure information. The industry-wide information was This inspection guidance is presented in Section 3.0, foi- compiled from a vanety of NRC somces, including lowing a description of the Prairic bland AFW system AEOD analyses and reports,information notices,in-in Section 2.0. Section 3.0 identifies the risk important spection and enforcement bulletins, and generic letters, system components by Prairie Island identifi cation and from a variety of INPO reports as well. Some Li-number, followed by brief descriptions of each of the censce Event Reports and NPRDS event descriptions various failure causes of that component. Rese include were also reviewed. Finally,information was included specific human errors, design deficiencies, and hardware from reports of NRC-sponsored studies of the effects of failures. The discussions also identify where common plant aging, which inchsde quantitative analyses of re-cause failures have affected multiple, redundant compo- ported AFW system failures. This industry-wide in-nents. These brief discussions identify specific aspects formation was then combined with the plant-specific of system or component design, operation, maintenance, failure information to identify the various root causes of or testing for inspection by observation, records tesicw, the PRA failure categories, which are identified in Sec-training observation, procedures review, or by observa- tion 3.0.

Fon of the implementation of procedures. An AFW sys-tem walkdown. table identifying risk important compo-nents and their lineup for normal, standby system operation is also provided.

1.1 NUREG/CR-5839

- -+n-n. - , . - -. , .._

2 Prairie Island AFW System This section presents an overview of the Prairie Island switch on its discharge to protect against runout. If a AFW system, including a simplified schematic system low pressure setpoint is reached on either switch, it will diagram. In addition, the system success criterion, sis- trip the pump.

. tem dependencies, and administrative operational con.

straints are also presented. Electrical power for the two motor driven p, umps is sup-plied by independent safety features buses, with provi-sions for manual transfer if the corresponding diesel 2.1 System Description generator is unavailable. The turbine-driven pumps are supplied steam from both steam generators of their res.

The AFW system provides feedwater to the steam gen- pective units. Steam supply lines come from points up-erators (SG) to allow secondary-side heat removal from stream of the main steam isolation valves of each steam the primary system when main feedwater is unavailable, generator and pass through a normally open motor-The system is capable of functioning for extended per- operated-valve and a check valve before joining to pass fods, which allows time to restore main feedwater flow through the air-operated steam admission valve (31998) or to proceed with an orderly cooldown of the plant to for their respective unit. Failure of either DC power or where the residual heat removal (R1IR) system can re. the air supply to the steam admission valves will cause move decay heat. A simplified schematic diagram of the the valves to open, starting the associated turbine-driven AFW system is shown in Figure 2.1. pump. The turbine-driven pumps operate independent of the plant AC power sources. A cycle timer control The system c(msists of two steam turbine. driven pumps circuit automatically runs the auxiliary motor driven (200 gpm cach), one for each unit, and two motor-driven tube oil pump on each AFW pump for approximately pumps (200 gpm each), one for each unit. Both the 10 minutes twice cach week. If proper tube oil pressure turbine-driven and motor-driven pump for a unit are is not reached following this lube oil pump start, an capable of delivering feedwater to either or both steam alarm i: sounded in the control room. This ensures that generators of that unit Normallineup is for both sufficient oil film is maintained at all times in each pumps of a unit to feed both steam generators of that AFW pump to allow pump start without requiring start j unit. The discharge lines of the two motor-driven ofits associated auxiliary motor driven tube oil pump.

pumps may be interconnected through two normally Once the AFW pump starts, tube oil circulation is pro-closed motor operated valves. There is no provision for vided by a shaft-driven lube oil pump.

l I

interconnection of the discharge lines of the two l

~ turbine-driven pumps. The normal AFW pump suction is Crom a header sup-plied by three 150,000 gallon condensate storage tanks, The system is designed to start up and establish flow one associated with unit I and the other two associated within one minute of an automatic start signal. Both the with unit 2. A sufficient qcantity of water (100,000 gal.

motor-driven and turbine driven pump for a unit will lons) is required to be maintained in these tanks to sup-start on the following signals from that unit: both main port the reactor coolant system in Hot Standby condi-feedwater pumps tripped, low-low level in one steam tion for two hours followed by a cooldown to the point generator, safety injection actuation,and ATWS Mitiga. where the RHR system can be placed in senice. All tion Actuation Circuitry (AMSAC) signal. In addition, t nk connections except those required for instrumen-the turbine drisen pumps will receive a start sienal from tation, AFW pump suction, and tank drainage are 10-an undenoltage condition on both safeguard b'uses, cated above the lesel' required to maintain 100,000 gal.

l.

Each AFW pump has a ' pressure switch on its suction to lon capacities l

protect against insufficient NPSH and another pressure 2.1 N UREG/CR-5839

l I AFW System A normally open valve (C-41-2) can be used to isolate 2,3 Systegn Depengeg3cies the CSTsuction header between units. Suction from the

- header to each pump is through a check valve and a The .^.FW system depends on AC power for the motor-normally open motor-operated valve. In addition, each driven pumps and level matrol valves, DC power for pump is provided with a suction path to the Cooling control of the pumps, valves and automatic actuation Water System through a normally closed motor- signals, instrument air S AFW putnp lube oilcooler operated valve. Because the CSTk atc not sesmic control valves, and te h.nctionaliube oil system. Tira Class I structures, the plant's safety ana ysis relics on the turbine driven pump also requires steam availability.

scismic Class I Cooling Water System source. Use of the Cooling Water System source requires manual align' A three-way solenoid vakh hai been added to the air ment. The turbine driven pump for each unit takes suc- supply line of each turbine driven pump steam inlet tion from the side of the CST header or the Cooling supply valve to allow manual operation of the turbine.

Water System associated with that unit. However, the driven pumps. A procedule has been provided for man-motor-driven pump for each unit takes suction from the ual operation of the turbine-driven pumps by locally side of the CST header or the Cooling Water System venting air from the diaphragm of the stream admission associated with the opposite unit. Three additional valve.

back-up sources of water are available: 'he deminer-alizer, the condenser hotwell, and C CVCS monitor tanks.

2A Operational Constraints _r Each AFW pump discharges through a check valve and a normally open manual valve to its own header. From When both reactors are critical or their average coolant this point, a recirculation path provides continuous flow temperatures exceed 350 F, the Prairie Island Technical back to the CST to prevent pump deadheading and to Specifications require that all four AFW pumps and as.

provide for lebe oil cooling. The header for cach pump sociated ' low paths are operable. When only one reae-tor is critical or above 350 F,its turbine driven AFW feeds each steam generator ofits respective unit through another check valve and a normally open motor- train and one of the two motor-driven AFW trains inust operated valve to the point where the lines f rom the two be operable, inoperability of a single required AFW pumps combine. The AFW feed line for each steam train is permitted for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, after which the af-generator then passes throm'.h an additional normally fected unit must be brought to Hot Shutdown condi-l open niotor-opeiated valve, through the containment tions in the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and the average reactor coolant -

wall and through an addi;ional check valve before join- temperature reduced below 350"F within the following ing the main feedwater line to the steam generator. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

During Startup or Power Operation, a minimum of 2.2 Succesc C,riterion 100,000 gallons of water is required to be available in the condensate storage tanks, and the backup supply of river water must be available through the cooling water System success requires operation of at least one pump system. The CS'It may be inoperable for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, pro-supplying rated flow to at least one steam generator. yided the Cooling Water System is available as a backup Each pump is sized to provide sufficient flow against the water supply to the AFW pumps. The backup supply l steam generator safety valve set pressure (plus 3% ac~ from the Cooling Water System may be inoperable for cumulation) to prevent water relief from the pressurizer 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> provided a minimum of 100,000 gallons of during a station blackout transient (no reactor coolant water is available in the CS'It pump heat to the primary system).

NUREG/CR-5839 2.2

AFW System .

During operation, containment ihai;cs. valves GdV d. All drain valves from the AIM steam lines to the 32242, M V.3243, M V 32248 and MV-32249) are locked main condenser have been bk)cked open using safe-open with control power removed. Also, any manual guards hold cards, valves in the system flowpath that could reduce flow bciow the value assumed in the safety analysis are c. A procedure was written for bypassing the AFW" required to in locked in their proper positions for emer- pump suction and discharge pressure trips in the

. gency use and are under strict administrative controls. event of faults in the actuation circuits.

The condensate supply cross connect valves C-41-2 must be blocked and tagged open (Croswonnect valve f. Requirements were added for monitoring the tem-C-41-1 has been removed and replaced by a spool piccc.) peratures of the ARY discharge lines once cach shift. This was done to provide prompt detection of -

backicakage of hot feedwater through the check 2.5 Otlier Significant Information valves,which could lead to steam binding of the j ARV pumps. Tbmperature indicators on each 1 In its assessment of Generic Issue No.124," Auxiliary pump discharge line provide inputs to the Emer-Feedwater System Reliability", NRC analysis (reported gency Res[mc Computer Spicm (ERCS).

in NUREG 0611) dezermined that the Prairic Island ARV system was in the low reliability range. As a g. Both the high and low pressure leakoff for the result, Northern States Power Company performed a turbine-driven AFW pump trip /throttie valves has

- probabilistic risk assessment of the AFW and sup. been remumd io discharge into the turbine exhaust portine, systems (NSPNAD 8606P Rev,0, April 1986). lines. This was done to climinate the potential for -

Gener'ic Issue No.174 was closed out by an NRC Safety creating a steam environment in the AFW pump

, Evaluation Report transmitted on November 26,1986. room during operation of the turbine driven ARV As the result of these studies, the following list of pump.

l.

actions were ta.ken:

' h. Condensate header valve C-41 1 was replaced by a

a. The ARV system dependency on the cooling water sp ol piece.

system for tube oil cooling was removed by re-ri>uting the ARV recirculation flow through the i. Condensate storage tank isolation valves were ad.

coolers. A step was added to the monthly surveil. Ininistratively locked open to ensure ARV pump lances for the turbine-driven pumps to verify flow suction.

from the lube oil and c.overnor cooling water return i line. [ 3m step ladders (of different heights) were placed -

in the AFW pump mom to aid operators in manipu.

l b. Manual control of the turbine-driven AFW pumps I ting overhead valves during emergency situations.

l was added as described in Section 2.3, above.

k. Additional emergency lighting was installed in the

e. The auto open signal to MV-32041 " Condenser _ area of the turbine-driven AFW pumps.

Emergency Supply Valve" was removed for both units.

2.3 NUREG/CR 5839

- . . - . ..- . _ _ _ . . - - . - ~ . . . _ . . _

.z.._.. - _ __ . . . , . . _

. .I AFW System m .

l.

9-3' O

-p- >- .

E U

p@h'

'N l.

N 9 p a C y .~

f,4 * .

n , 2 38==

T- -m-1 AggC4 g. g

[- $ / $ ..

l -. N .'

c t t< n - g -s n e

\ c- 7 "

d- Eg hQ 8 n

gl , D l

7 n- e 2

r,

. n

-c h

~

d.

N 85t+ T c! 4 n

I

• 4% F4+ W s- !!Wo!

W I -

-W E O C cM T .I O 3 f 'pg V b ,k,, N $ =

e N Q E -.wM '

n n

+ -

2 Oce WE h

x {en 4-

-1 w

c -

ss p$

D

• T h - ' .

l

" vA S( e g

n rm nT i.,

a.

• R@2 $ b o

V '

O e.

Q.

g N .2  %

yW w g g -7

, ,c e- .. s--L a

g su a a

y 1a .

d k g, B C o .:2 -

y N ( 5 n

=

E N ..g_ '

n

_)

b ' "h '

h C v CY , /

N N

N n

rg,,, g

.*,.,y g g; q w-ca .e E'

2-6 o a h a c- n E

.8 o- g_mmCoj N.

n A

rN w

' s"o g -

@t ~; s_

~

</ :

.Q n n -? h N .E S

- A S

i

.co-$ tn -

N n m 1 g sr g -_

n

~

^

i ... .- yN

"" s EL.E. .!2Z23 = ,'- .,1 ' r , . .

O C *.* - n m N ~ r ,'

" " g g kg;5

j. M.--. ,/ - m Mg h-y A O  ; 9::

e M'+ - "

n' n i u .a E.

N we s

TX:g X. di-g z

0 a

N n

e e.

c.

e-e o " , Od:

E M (3 T--- w IO.

.e

-- ou

.N - 6---- 5

., a w D

NUREG/Ch-5839 2.4 2

3 Inspection Guidance for the Prairie Island AINY Systent in this section the risk important components of the 3.1.1 Multiple Pump Failures due to Common Prairie Island ARV system are identified, and the im- Cause portant modes by which they are likely to fail are bricDy described. These failure modes include specific humatt The following listing summarizes the most important errors, design problerns,and types of hardware failures multiple-pump failure modes identified in Section 5.2.1, which have been observed to occur for these types of Common-Cause Fali . , and each item is keyed to en-components, bo' at Prairie Island and at PWRs tr es in that section. I throughout the nuclear industry. The discussions also  !

identify where common-cause failures have affected ,

Incorrect operator intervention into automatic sys.

multiple, redundant components. These brief discus- tem functioning, including impreper manual start-sions identify specific aspects of system or component ing and securing of pumps, has caused failure of all design, operatiet., maintenance, or testing for observa^ pumps, including overspeed trip on startup,and in-tion, records review, training observation, procedures ability to restart prematurely secured pumps. CCl.

review or by observation of the implementation of procedures. . Valve mispositioning has caused failure of all pumps. Pump suction, steam supply,and instru.

Tabic 3.1 is an abbreviated AFW system walkdown table ment isolation valves have been involud.- CC2.

which identifies risk important comnonents. This table lists the system lineup for normal, standby system opera- ,

Steam binding has caused failure of multiple pumps.

tion. Inspection of the components identified addresses This resulted from leakage of hot feedwater past essentially allof the risk associated with ARV3ystem check valves into a common discharge header, with

! operation- several valves involved including a motor-operated

! discharge valve. (See item 7 below.) CC10. Multi.

( ple-pump steam binding has also resulted from im-3.1 Risk Iniportant AFW Components proper valve lineups,and from running a pump deadheaded. Cc3.

and Failure Modes

• Pump control circuit deficiencies or design modifi-Common-cause failures of multipic pumps are the most cation errors have caused failures of multiple pumps risk-important failure modes of ARV system compo-to auto start, spurious pump trips during operation, nents. These are followed in importance bv single pump and tailures to restart after pump shutdown. CC4.

failures, level control valve failures, and individual check Incorrect setpoints and control circuit calibrations valve Icakage failures.

have also prevented proper operation of multiple pumps. CC5 The following sections address each of these failure modes,in decreasing order of importance. They present

• Loss of a vnal power bus has failed both the turbme-the important root causes of these component f ailure driven und one motor-driven pump due to loss of modes which have been distilled from historical records.

conuol power to steam admission valves or to tur-Each item is keyed to discussions in Section 5.2 which bine controls, and to motor contrc s powered from present additionalinformation on historical events.

' ihe same bus. CC6.

3.1 NUREG/CR-58W

I.

l.

i l

i inspection Guidance 'I

-+

Simultaneous startup of multiple pumps has caused +

Trip and throttle valve problems which have failed oscillations of pump suction pressure causing multi. the turbine driven pump include physically bumping ~

ple-pump trips on low suction pressure, despite the it, failure to reset it following testing, and failures to _t existence of adeqmte static net positive suction verify control room indication of reset. }-IF2. '

head (NPSH). CQ. Design reviews have identified Whether either the overspeed trip or Tl y trip can inadequately sized suction piping which could have he reset without resetting the other, indication in yielded insufficient NPSH to support operation of the control room of TIV position, and unambigu.

more than one pump. CC8. ous localindication of an overspeed trip affect the likelihood of these errors.DE3. Prairie Island has - .

3.1.2 'Ibrbine Driven Pump 11 or 22 Fails it, had the turbine driven pump trip due to a workman =

Statt or Run bumping the governor.

• Impmperly adjusted and inadequately maintained 3.1.3 Motor Driven Pump 12 or 21 Falls to turbinn governors have caused pump failures, both Start or Run -

at Prairie Island and elsewhere. IIE2. Problems include worn or loosened nuts, set screws, linkages

• Control circuits used for automatic and manual or cable connections, oil leaks and/or contamina- pump starting are an important cause of motor tion, and electrical failures of resistors, transistors, driven pump failures, as are circui_t breaker failures, diodes and circuit cards, and erroncous grounds and CF7. Similar failures have occurred at Prairie c(mnections. CFS. Island.

~

1btry turbines with Woodward Model EG gover- +

Mispositioning of handswitches and procedural def.

nors have been found to overspeed trip if full steam iciencies have prevented automatic pump start.

flow is allowed on startup. Sensitivity can be re. HE3.

duced if a startup steam bypass valve is sequenced to open first. del. .

Low lubrication oil pressure resulting from heatup due to previous operation has prevented pump

+

1hrbines with Woodward Model PG-PL governors restart due to failure to satisfy the protective inter.

have tripped on overspeed when restarted shortly lock. DES. At Praitic Island, an improperly instal.

after shutdown, unless an operator has locally exer- led oil filter resulted in excessive differential pres.

cised the speed setting knob to drain oil from the sure which defeated the oil pressure permissive and -

governor speed setting cylinder (per procedure). prevented a pump start.

Automatic oil dump valves are now available through1brry. DE4. 3.1 A Pump ll,21,12 or 22 Unavailable Due to Maintenance or Surveillance

- Condensate slugs in steam lines have caused turbine l overspeed trip on startup. Tests repeated right after

• Both scheduled and unscheduled maintenance re. l 1 such a trip may fail to indicate the problem due to move pumps from operability, Surveillance requires -

l; warming and clearing of the steam lines, Steam operation with an altered line-up, although a pump traps for the steam supply lines should be properly train may not be declared inoperable during testing.

maintained and surveillance should exercise all Prompt scheduling and performance of mainten.

steam supply connections. DE2. ance and rurveillace trinimize this unavailability.

L s

NUREG!CR-5839 3.2

Inspection Guidance 3.1.5 Motor Operated Valves Fail Closed -

Manually reversing the direction of motion of oper-ating.MOVs has overloaded the motor circuit. Op-MD Pump S . tion Valves: MV32335. 323T6 erating procedures should provide cautions, and TD Pump Suction %1ves: MV32333. 32345 circuit designs may prevent reversal before each MD Pump Flow Control %1ves: MV32381. 32382. stroke is finished. DE7.

32383.32384 TD Pump Flow Control Valves: MV32238. 32239

• Space heaters designed for preoperation storage 32246.32247 have been found wired in parallel with valve motors Unit 1 SO Isolation %1ves: MV32242. 32243 which had not been environmentally qualified with Unit 2 SG Isolation Wives: MV32245t. 32249 them present. DE8.

Steam Supply TD Pump Unit 1: MV32016. 32017 Steam Supply TD Pump Unit 2: MV31019. 31020 3.1.6 Manual Suction or Discharge Valves Fall -

Closed Normally open MOVs are located at the suction and discharge of both the motor and turbine driven AFW TD Purnp Steam Supply %1ves: 31039,31060 pumps. Downstream of the discharge valves, each AFW TD Pump Discharce wives: AF-13-3.13-6.12-1.

header contains a motor operated flow control and a 12 4 containment isolation valve. Steam supply lines to the MD Pv in Discharee Valves: AF 13-4.13-5.12-2.

turbine driven AFW pumps also contain motor oper- 12-3 ated steam isolation valves. All these MOVs are norm-ally open and they fail as-is on loss of power. Manual valves that could reduce flow in any AFW train are normally locked in the proper position for emer-

. Common-cause failure of MOVs has resulted from gency use.

failure to use electrical signature tracing equipment to determine proper settings of torque switch and .

Wlve mispositioning has resulted in failures of mul-l torque switch bypass switches. Failure to calibrate tiple trains of AFW. CC2. It has also been the l_ switch settings for high torques necessary under de- dominant cause of problems identified during oper-sign basis accident conditions has also been in- ational readiness inspections. HEl. Events have volved. CC11. Similar failures have occurred at occurred most often during maintenance, calibra-Prairie Island tion,or system modifications Important causes of mispositioning include:

• Wlve motors have been failed due to lack of, or im-

_ proper sizing or use of thermal overload protective -

Pailure to provide complete, clear, and specific devices. Bypassing and oversizing should be based procedures for tasks and system restoration on proper engineering for design basis conditions.

CF4. -

Failure to promptly revise and validate procc-l_ dures, training, and diagrams following system l

. Out.of. adjustment electrical flow controllers have modifications caused improper discharge valve operation, affect-ing multiple trains of AFW. CCl2. . Rilure to complete all steps in a procedure Grease trapped in the torque switch spring pack of .

Failure to adequately review uncompleted pro-Limitorque SMB motor operators has caused motor cedural steps after task completion burnout or thermat overload trip by preventing torquisuitch actuation. CF8. -

Pailure to verify support functions after restoration 3.3 NUREG/CR-5839

Inspection Guidance

.- Failure to adhere scrupulously to administrative -

Slow leakage past the final check valve of a series procedures regarding tagging, control and track- may not force upstream check valves closed, allow-ing of valve operations ing leakage past each of them in turn, Piping .

orientation and valve design are important factors

- Failure to log the manipulation of scaled valves in achieving true series protection. CFl.

- Failure to follow good practices of written task assignment and feedback of task completion 3.2 RiskImportant AFW System information Walkdown 'Ihble'

- Failure to provide easily read system drawings,

'Ihble 3.1 presents an AIAV system walkdown table it-legible valve labels corresponding to drawings ciuding only components identified as risk important.

and procedures, and labeled indications of local This information allows inspectors to concentrate their valve position efforts on components important to prevention of core d m gc. However,it is essential to note that inspec-3.1.7 Leakage of Ilot Feedwater through tions should not focus exclusively on these components.

Check Valves Other components which perform essential functions,

- but which are absent from this table because of high reli-S1 Check Valves: AF 16-1.16-2.16-3,164 ability or redundancy, must also be addressed to ensure Flow Control Check Valves: AF 15-1.15-7.15-3. that their risk importances are not increased. Examples 154,15 5.15-6.15-7.15 8 nclude the (open) steam lead isolation valves upstream of CV31998, an adequate water level in the CST, and the a 1.cakage of hot leedwater through several check (closed) valves cross connecting the discharges of the

< valves in series has caused steam binding of multiple two motor-driven AISV pumps.

pumps. Leakage through a closed level control valve in series with check valves has also occurred.

CC10.

f s

NUREG/CR-5839 3.4

I i

1' i

Inspection Guidance

'lkble 3.1. Risk Important AnY System Walkdown Table (')

Component _ _

! Required Actual Number Component Name location Position Position Electrical Bus 16 12 Motor-Driven Pump Breaker Racked In/ Closed Bus 26 21 Motor-Driven Pump Breaker Racked In/ Closed Cell A2 MV 32025 MCC 1 A Bus ! Installed / Closed .

Cell A3 11 AFW pump aux lube oil pump MCC 1 A Bus .I Installed / Closed (Record minutes )

Cell A2 12 ARV pump aux lube oil pump MCC 1 A Bus 2 Installed / Closed (Record minutes )

Cell A4 MV 32027 MCC 1 A Bus 2 Installed / Closed Cell A4 21 AFW pump aux lut'e oil pump MCC 2A Bus 1 installed / Closed (Record minutes )_ _

Cell C2 MV 32026 MCC 2A Bus 1 installed! Closed Cell A3 MV 32030 MCC 2A Bus 2 installed' Closed Cell B3 22 AFW pump aux lube oil pump MCC 2A Bus 2 Installed / Closed (Record minutes -) .

Wlve MV32333 11 TDP Suction Valve Open i

l MV32025 11 TDP Cooling Water Suction Valve Closed C W 1-2 Cooling water Wive to 1 I TDP and Open 21 MDP l

[. MV32336 21 MDP Suction Valve Open I

ll M V32026 - 21 MDP Cooling "/ater Suction Valve Closed i

MV32335 12 MDP Suction Valve ' Open

(-

l (a) Outside and in AFWS pump room.

l-3.5 . N UR EG/CR.5839 l.

r=

Inspection Guidance w

Table 3.1. (Continued) 4 Component Required Actual Number Component Name location Position - Position --

MV32027 12 MDP Cooling \Wter Suction Valve Closed CW11 Cooling water Wlve to 12 TDP Open and 22 MDP MV32345 22 TDP Suction Valve Open MV32030 22 TDP Cooling Water Suction Valve Closed MV32239 11 TDP to SG 12 Row Control Valve Open MV32238 11 TDP to SG 11 Flow Control Valve Open MV32381 12 MDP to SG 12 Flow Control Valve Open MV32382 12 MDP to SG 11 Flow Control valve open MV32283 21 MDP to SG 21 Flow Control Valve Open MV32384 21 MDP to SG 22 Flow Control Valve Open MV32246 22 TDP to SG 21 Flow Control Valve Open MV32247 22 TDP to SG 22 Flow Control Wlve - Open _

MV32242 11 TDP to SG 11 Containment Open/

Isolation Wlve Breaker op;a MV32243 12 MDP to SG 12 Containment Open/ ,

Isolatico Wlve Breaker open MV32249 21 MDP to SG 22 Containment isolation Open/

Wlve Breaker open MV32248 ' 21 MDP to SG 21 Containment Isolation Open/

Wlve Breaker open 2AF-13 l- 21 MDP to Unit 1 Discharge Cross Closed Tie Wlve NUREG/CR 5839 3.6

inspection Ouidance Table 3.1. (Continued)

Component Required Actual l

Number Component Name Location Position Position l

l'- AF-13-1 12 MDP to Unit 2 Discharge closed l Cross Tie Valve 4

C-41-2 CST Cross Tie Valve Open AF 13-4 12 MDP Discharge Valve Open AF 17-2 12 MDP 2-in. Flow'Rst Line Closed AF 18-2 12 MDP Recire. Line Wlve Open AF 25-2 12 MDP 2-in. Flow'Rst Line Closed AF 33-2 12 MDP Recirculatiori Line Valve Open -

AF 17-3 21 MDP 2-in. Flow'Rst Line Closed AF 18-5 21 MDP Recirculation Line Wlve Open AF 253 21 MDP 2-in. Flow 'Rst Line Closed CV31153 11 TDP Recirculation Flow Valve Auto Open(*)

CV31154 12 MDP Recirculation Flow Wlve Auto Open(a) -

CV31418 21 MDP Recirculation Flow Wlve Auto Open(")

CV31419 22 TDP Recirculation Flow Valve Auto Openld)

MV32016 11 SG to TDP Main Supply Open Isolation Valve MV32017 12 SG to TDP Main Steam Supply Open isolation Wlve (a) Check central air pressures in regulator filter lii mid-rarge (30 it. 50 psig).

3.7 NUR EG/CR-5839 -

.__________E_

. __ a n m r

Inspection Guidance

'Ibble 3.1. (Continued)

Component itequired Actual -

Numler Coingwment Nanic incution Position l'o* ttion MV 31019 21 NO to TDP Main Steam Supply Open isolation Wlve MV 31020 22 SO to TDP Main Steam Supply Open isolation Wlve -

AF 33-1 21 MDP Recirculation Line Open AF 13-5 21 MDP Discharge Wlve Open ._

CVTit/18 Unil 1 Steam inlet Conttol Wlve Closed / locked Secutity Door CV31W1 Unit 2 Steam inlet C,ntrol Wlve Closed / locked Security Door CV31039 Unit 1 Trip & Throttle Wlve Open CV31060 Unit 2 Trip & Throttle Wlve Open AF 15 9 Piping Upsticam of Check Wlve Cool AF 1510 Piping Upstream of Check Wlve Cool AF 1511 Piping Upsticam of Check Wlve Coal AF 1512 Piping Upstream of Check Wlve Cool AF 13-3 11 TDP Discharge Whc Open AF 171 11 TDP 2 in. Flow Tess Wlve Closed AF 18-1 11 TDP Recirculation Line Wlve Open AF 331 11 TDP Recirculation Line %1ve Open AF 251 11 TDP 2-in. Flow Test Wlve Closed NUREG/CR-5839 = 38 I

. __ _. . _ _ . _m . . _ . _ _ _ . . _ . _ . _ . _ _ _ _ . _ _ _ . _ _ . _ _ _ _ _ _ _ _ . _ _ . . _ _ . _ _ _ ...

l I

Inspection Guidance

'luble 3.1 (Continued) i Corupment Required Actual )

Number Com;xment Name location Posi' ion Postilon i AF 13 6 22 TDP Discharge Valve Open AF 17-4 22 TDP 2-in. Flow 1bst valve clo3cd .

AF 25-4 22 TDP 2 in. I' low 'Rst Valve Closed AF 184, 22 TDP llecirculation Line Valve Open i

AF 33-2 22 TDP llecirculation Line Valve Open .

r MV 32242 Piping Upstream at 715 !i level (8) Cool ,

M V 32243 hping Upstream at 71511 lxvell ") Cool ,

MV 32248 Piping Upstream at 715-It level (*) Cool MV 32249 Piping Upstream at 715-ft Level! ") Cool (a) It h desirable to check for leaks at locations closer to containment. These motor. operated valves are approximately 30 ft upstream of AF 15 5, AF 15-6, AF 15 7,and AF 15.S, respectively.

l k

l 3.9 NURFG/CR 5839

= . - - - . - - , .

l l

4 Generic Hisk Insights froni PilAs PR As for 13 PWRs were analy/ed to identify risk, provide feedwater from other souncs, and fail to important accident sequences involving low of AITV, irutiate feed and bleed cooling, tesulting in core t ..d to identify and thk-pnoritize the coraponent failure da mage.

modes involved. The results of this analysis ate des-er bed in this section. They are consistent with se6ults

• A low of main feedwatq trips the plant, and AITV  ;

seported by INiland llNI.,(Gregg et al.1988: Travis falls due to operator error and hardware failures.

et al.19xx). The operators fall to inithite feed and bleed cooling, tesulting Iri core damage.

4,1 1(isk Iniportant Accitlent Setjuences siemn cennator M2tpumun IllVoiVlllg AFW Systein liniture .

An scrrR is followed by failure of Af4V. Coolant is lost from the primary until the RWSTis depleted.

IMAS!_l'!*frJntm! llp) fails since recirculation cannot be established ,

from the erupty sump, and core damage results.

Ajms o(offsite pyw.g is followed by failure of AITV. Due to lack of actuating power,the PORW cannot be npened, preventing adequate feed and-bleed cooling, and resulting in core damage.

4,2 l(isk inipurinnt Coniponent Fullure Mo(ies a

A station blackoul fails all AC powet except Vital AC f rom DC invertors, and all decay heat removal The generic cornponent failure modes identified from i systems except the turbine driven AFW pump. PR A analyses as important to AFW system f ailure are -

AFW subsequently fails due to battery depletion or !isted below in decrecoing ordJr of risk importance, hardware failures, resulting in core damage. *

1. 'lbibine-Driven Pump Failure to Start or Run.

• A DC bus fails, causing a trip and failure of the power cornetsion system. One ATSV motor-driven L Motor Driven Pump Failure to Start or Run.

pump is failed lly the bus loss, and the turbine-doven pump faih dt.c to loss of turbine or valve 3. TDP or MDP Unavailable due to Test or control power. AFW is subsequentlylost com- Maintenance.

pletely due to other failures. Feed and-bleed cool.

ing fails because PORV control is lost, resulting in 1. AFW System Valve Failures core damage.

• steam adtnission vabes

]nmsicot Causgl item tor or'Ibrhine Tiip a

trip and thiotlic valve

=

. t\ transient eaused trip is followed by a loss of PCS and AFW. Feed and bleed cooling fails either due + llow control valves to failun of the operator to initiate it,or due to hardware failures, resulting in core damage. +

purnp discharge valves I

leMLMn.inhnlynttr -

pump suction valves

. A feedwaierjine break drains the common water -

valves in testing or maintenance.

j source for MFW and Af3V. The operators fail to 1I NURFO/CR-5839

. . , - , -. . - - , _ _ = _ - - . ,

_ . _ .- , . ._m _

Generic Risk insights from PRAs i

l

5. Supply / Suction Sources from common causes and human errors. Common.

j cause failures of A13V pumps are particularly risk im. i

• convensate storage tank stop valve portant. Yalve failures are somewhat less important due l m the multiplicity of steam generators and connection - (

• hot wellinventory paths. Iluman errors of greatest risk importance in-volve: failures lo initiate or control system operation .

6 suction valves. when required; failure to restore proper system lineup  !

af ter maintenancc or testing; and failute to switch to  !

In addition to individual hardware, circuit, or instru- alternate sources when required.  !

ment failures, each of these fallute modes may result {

P l

1 l

c j

l .

- NUREG/CR 5839 .t.2.

I

,,..- v. .,-rwe . s, .-.,7- ,,,y-e,~

p -,, i,-,,, , , m,3 ,y_,,y s, .v,m,---,-, - , - . , , v,_ ,, _ ,,y ..---y-n ., .w.,-.--,,,w,,, .,-n,-..-i,w-,r--.---

5 Failure Modes Detentined frorn Operating Experience nis section describes the primary root causes of com- 5.l.2 lbrbine Driven Puinp Falliires ponent f ailures of the AIM systen, as determined irom a review of operating histories at Prairic Islai.d and at Dere have been fifteen events since 1977 that have re-other PWRs throughout the nuclear industr". Sec- sulted in failures of the turbine driven pumps. Failure tion 5.1 describes experience at Prairic Island. Sec- modes involved failures in instrumentation and control tion 5.2 summarizcs information cornpi!cd Nm a vari- circuits, electrical faults, system hardware failures, and ety of NRC sources, including AEOD analyso anj human errors. %c turbine driven pumps have tripped repor ts, information notices, inspection and enforec- or failed to reach proper speed as a result of suction ment bulletins, and generic letters, and from a vuricty of lines clogged with clams and sludge, dirty limit switch INPO reports as well. Some Licensee Event Reports contacts, bent governor valve stem, shorted relays in the (LERs) and NPRDS cvent descriptions were also re- speed control circuit, and dirty breaker contacts.

viewed individually. Finally,information was included from reports of NRC sponsored studies of the effects of 5.1.3 Flow Control and Isolntion Vnive plant aging,which include quantitative analyses of AFW Fnilures system failure reports. This information was used to >

identify the various root causes expected for the broad More .han ten events since 1977 have rmulted in fail.

PR A. based f ailure categories idcNihed in Secthm 10' urcs of the motor operated flow ctmtr , ad isolation resulting in the inspection guidelines presented in valves. Principal failure causes were equipment wear, Section 3.0. instrumentation, and control circuit f ailures, valve hard-ware failures,and human errors. Valves have (;iled to Some of the following experiences inay no longer be ap- operate properly due to blown fuscs, failure of control plicahic, due to subsequent modifications or changes, components (such as I/P corivertors), broken or dirty contacts, misaligned or broken limit switches, control

""*" '#" " "E#" '" " I' #*'

5.1 Prairie Island Experience 5.1.4 Iluinnn Errors

%c AFW systern at Prairic Island has experienced fail-urcs of the AFW pumps, pump discharge flow control .

nere have been approximaicly ten significant human valves, the turbine steam supply valves, pump suction criors affecting ihe AFW system since 1977. Peraonnel and recirculation vahes and system check vahes. Fail ~ have inadvertently actuated the AFW pumps during '

ute Inodes include electrical, instrumentation, hardware testing, failed to calibrate equipment or improperly in-failures,and human errors. stalled an oil filter. Both personnel error .nd inade.

5.1.1 Motor Driven Purnp Fnilures i

here have been two events since 1977 which involverl 5.2 IndiistryMide Experievice lailure of the motor driven pumps. Failure modes m.

volved instrument and control clicuit failure, and lluman errors, design / engineering problems and errors, human error during maintenance activitics. Improper and component failures are the primary root causes of installation of the self cleaning oil filter resulted in ex' AFW System failures identified in a review ofindustry.

cessive differential pressure which defeated the oil w de system operating history. Common cause failures, pressure pctmissive and prevented starting of the pump. g gg g gg gg

,The other esent im r tved a failed rehg in the steam g g g generator low low level start citcuitry. g g7 g l

l 5.1 NUREO/CR 5839

Failure Modes This $cction identifics important common-cause failure checklists, weak administrative umtrol of tagging, re-l modes, and then provides a broader discussion of the storation, independent verification, and locked valve l single failure effects of human errors, design / ?ogging, and inadequate adherence to procedurcs,11-engineering problems and errors, and component fail- legible or confusing local valve labeling, and insufficient utes. Paragrephs presenting details of these failure training in the determination of valve positiott may modes are coded (e.g., CCl) and cross referenced by in- cause or mask mispositioning, and surveillance which spection items in Section 3. does not exercise complete system functioning may not reveal mispositionings.

6.11 Cornmon Cause Entlures CC3 At ANO-2,both AFW pumpslost suction due to The dominant cause of AIAV system multiple-train fail. steam binding when they were lined up to both the CST utes has been human error. Design /enginecting ctrots and the hot startup/ blowdown demineralizer effluent -

and component failures have been less frequent, but ( AEOD/C4041984). At Zion 1 steam created by run-nevertheless significant, causes of multiple train failures. ning the turbine-driven pump deadheaded for one min-ute caused trip of a rnotor-driven pump sharing the  ;

CCl. Ilurnan error in the form ofincorrect operator in. same inlet header, as well as damage to the turbine-tervention into automatic AITV system functioning dur- driven pump (Region 3 Morning Report,1/17M)). Iloth ing transients resulted in the temporary loss of all safety. events were caw ed by procedural inadequacies, grade Af4V pumps during events at Davis llesse  !

(NUREG 11541985) and 'Dojan (AEOD/T4161983). CC4 Design /cngineering crrors have accounted for a in the Davis liesse event, improper manualinitiation of smaller, but significant Iraction of common-cause fall-the steam and feedwater rupture control system utes. Problems with control circuit design modifications (SFRCS) led to overspeed tripping of both turbine. at Faricy defeated AINV pump auto start on loss of driven AIAV pumps, probably due to the introduction of main feedwater. At Zion 2, restart of both motor driven condensate into the Af4V turbines from the long, un- pumps was bk)cked by circuit failure to decnergire when heated steam supply lines. (The system had never been the pumps had been tripped with an automatic start sig-tested with the abnormal, cross-connected steam supply nal present (IN 82 011982). In addition, AFW control lineup which resulted.) in the"nojan event the operator circuit design reviews at Salem and Indian Point have I

incorractly stopped both AFW pumps due to misinter. identified designs where failures of a sine le component pretation of MFW pumpi peed indication. The diesel could have failed all or multiple pumps (IN 87-341987).  ;

driven pump would not restart due to a protective fea.

ture requiring complete shutdown, and the turbine, CC5. Incorrect setpoints and control circuit settings re-driven pump tripped on overspeed, requiring h> cal reset sulting from analysis errors and failures to update proco  !

of the tiip and throttle vahe. In cases where n.anualin. dures have also prevented pump start and caused pumps l tervention is required during the early stages of a to trip spuriously. Errors of this type may remain unde-  :

transient, training should emphasize that actions should tected despite surveillance testing, unless surveillance be per formed methodicauy and deliberately to guard tests model all types of system initiation and operating l ag inst such errors, conditions. A gicater fraction of instrumentation and control circuit problems has been identified during act. I CB. Wlve mispositioning has accounted for a signifi. ual system operation (as opposed to r.urveillance test-  !

cant fraction of the human ertors failing multiple trains ing) than for other types of failures. '

of AFW. This includes closure of normallyopen suction  ;

valves or steam supply valves, and of isolation valves to CC6. On two occasions at a foreign plant, failure of a sensors having control functions. Incorrect handswitch balance-of. plant inverter caused failure of two AFW

. positioning and inadequate temporary wiring changes pumps. In addition to loss of the motor driven pump have also prevented automatic starts of mul'itple pumps. whose auxiliary start relay was powered by the invertor, ,

Factors identified in studies of mispositiomng errors in. the turbine driven pump tripped on overspeed because ciude failure to add newly installed valves to valve the governor valve opened, allowing full steam flow to

1. i 1 +

NUREG/CR-5839 . 5.2 ,

-i i

-,,-wew- ..w--g w. y,,-w.,m y. .-, r.~, og e.- -,e o,-,, , , , , , - , ~wn,-,,m- - , , , -,-,ww.w,-m-w,.,,-x-n- .-

liilure Modes the t_urbine. This illustrates the importance of assessing check valves. At Robinson 2 both motor driven pumps

- the effects of failures of balance of plant equipment were found to be hot, and both motor and steam driven which supports the operation of c!itical components, pumps were found to be inoperable at different times.

The im trument air system is another example of such a 11ackleakage at Robinson 2 passed through closed r,pt em. motor-operated isolation valves in addition to rnuhlple chet k valves. At Parley, both motor and turbine driven CC7 Multiple AFW pump trips have occurred at pump casings were found hot, although the pumps were Milhtone-3, Cooh 1, Trojan and Zion-2 (IN 87-531987) not declared inoperabic. In addition to multi train fall- j caused by brief, low pressure oscillations of suction utes, riumerous ine: dents of single train failures have oc.

pressure during pump startup. These oscillations oc- eutscd, resulting in the designation of

• Steam liinding of I i

, curred despite the availsbility of adequate static NPSIL Auxiliary Feedwater Pumps

• as Generic issue 93. This Corrective actions taken include: extending the time generic issue was resolved by Generic Letter 88-03 delay awociated with the low pressure trip, removing the (Miraglia 1988), which required licensees to monitor trip, and replacing the trip with an alaim and operator AFW piping temperatures each shift, and to maintain

]

action _ procedures for recognizing steam binding and for restor. I I

ing system operability, ffR Desigr, ettars discovered during AIM system re-analysis at the Robinson plant (IN 89-301989) and at CCI1. Common cause failures have also failed motor Millstor,c.1 resulted in the supply header from the CST operated valves. During the totalloss of feedwater being too small to ptovide adequate NPSH to the event at Davis liesse, the normally open AFW isolation pump 3 ilinore than one of the three pumps were oper- valves failed to open af ter they were inadvertently ating at rated flow conditions.1his could lead to multi- closed. The failute was due to improper setting of the ple purnp failure due to cavitation. Subsequent reviews torque switch bypass switch, which prevents motor trip at Robinson identified a loss of feedwater transient in on the high torque required to unscat a closed valve, which inadequate NPSil and flows less than design Previous problems with these valves had been addressed values had occursed, but which were not recognized at by increasing the torque switch trip setpoint-a fix which the time. Event analysis and equipment trending, t.s failed during the event due to the higher torque required well as surveillance testing w hich duplicates service con- due to high differential pressure across the valve. Sim-ditions as rnuch as is practical, can help identify such ilar wmmon mode failures of MOVs have also occurrea ,

design errors. in other systems, sesulting in hsuance of Generic letter -

8%10,

• Safety Related Motor-Operated Valvelbsting C.(3 Asiaticclams caused failure of two AFW flow and Surveillance (Partlow 1989)? This generic letter re.

control vahes at Catawba 2 when low suction pressure quhes licensees to develop and implement a program to

- caused by starting of a motor driven pump caused suc- provide for the testing, inspection and maintenance of tion source realignment to the Nuclear service Water all safety related MOVs to provide assurance that they system. Pipes had not been routinely treated to inhib will f unction when subjected to design basis conditions.

cla u growth, nor regularly monitored to detect their presence, and no strainers v.cre installed. The need for [CJ1 Other coruponent failures have also resulted in surveillance w hich exercises alternative spiem opera AFW multi-train failures. These include out-of- i tional modes, as well as complete system iunctioning, is adjustment electrical flow controllers resulting in im-emphasized by this event. Spurious suetion switchover proper discharge valve operation, and a failure of oil has also occurred at Callaway and at McGuire,although cooler cooling water supply valves to open due to silt no failures resulted. accumulation.

CCIO, Common-eause failures have also been caused by 5.2.2 litettinn Errors component failures ( AEOD/C4041484). At Surry-2, both the turbine driven pump and one inotor driven 111% The overwhelmmgly dominant cause of ptoblems pump were dedated inoperable due to steam binding identified during a series of operational readiness caused by backleakage of hot water through multiple i 5.3 NUREG/CR 5839 '

n n, ., - , , - . - - - . . . - _ . - - , - - ~ _ . - _ - - . . - . - . - . - __ --. - - -- - - -- - - - - - - - - - - - -

l Failure Modes i

evaluations of AIM systems was human performance. DE2. Overspeed trips of1brry turbines have been The majority of these human performance problems re- caused by condensate in the steam supply lines. C(m.

suited from incomplete and incerte:t procedures, par- densate slows down the turbine, causing the governor ticularly with respect to valve lineup information. A valve to open farther, and overspeed results before the study of valve mispositioning events involving human cr- governor valve can respond, after the water slug cleats.

rot identified failures in administrative control of tag. This was determined to be the cause of the loss-of all-ging and logging, procedural compliance and comple- AIM event at Davis Besse (AEOD/6021986), with con-tion of steps, verification of support systems, and densation enhanced due to the long length of the cross-inadequate procedures as importarit. Another study connected steam lines. Repeated tests following a cold.

found that velve mispositioning events occurred most start trip may be successful due to system heat up. ,

often during maintenance, calibration, or modification activities. Insufficient trairing in determining valve DE3. Tbtbine trip and throttle valve (TIV) problems i

position, and in adrninistrative requircruents for con- are a significant cause of turbine driven purnp failures trolling valve positioning were important causes, as was (IN 84-66). In some cases lack of TIV position indica.

oral task assignment without task completion feedback. tion in the control room prevented recognition of a tripped TlY. In other cases it was possibic to reset

))E2. Tbrbine driven pump failures have been caused by either the overspeed trip or the 1TV without reseting human errors in calibrating or adjusting governor speed the other. 'lhis problem is compounded by the fact that control, poor governor maintenance,inconcet adjust- the position of the overspecd trip linkage can be mis-ment of governor valve and overspeed trip linkages, and leading, and the mechanism may lack labels indicating errors associated wijh_ the trip and throttic valve. TTV- when it is in the tripped position (AEOD/C6021986).

associated errors include physically bumping it, failure to testore it to the correct position after testing,and DE4. Startup of turbines with Woodward Model PO.

failures to verify control room indication of TrV posi- PL governors within 30 minutes of shutdown has re-tion following actuation. sulted in overspeed trips when the speed setting knob was not exercised locally to drain oil from the speed 11E3. Motor-driven pumps have been failed by human setting cylinder. Speed control is based on startup with errors in mispositioning handswitches, and by procedure an empty cylinder. Problems have involved turbine tota-deficiencies. tion due to both procedure violations and Icating stearn.

'Ittry has marketed two types of dump valves for auto-rnatically draining the oil after shutdown (AEOD/C602 5,2.3 Design / Engineering Problems and

Errors 1986).

1 del. As noted above, the majority of AIN subsystem At Calven Cliffs, a 1987 loss-of offsite-power event re- .

failures, and the greatest relative system degradation, quired a quick, cold startup that result:d in tutbine trip -

has been lound to result from turbine driven pump fail, due to pO PL governor stQility problems. The short-ures. Overspeed trips of1btry turbines controlled by term corrective action was installation af stiffer buffer Woodward governors have been a significant source of springs (IN 88-091988). Surveillance had always been these failures (AEOD/C6021986). In many cases these preceded by turbine warmup, which illustr'ates the im- ,

overspeed trips have been caused by slow resp (mse of a portance of testing which duplicates service conditions Woodward Model EO governor on startup, at plants as much as is practical.

w here full steam flow is allowed immediately. This over-sensitisity has been removed by installing a startup DE-5 Reduced viscosity of gear box oil heated by prior i

steam bypass valve which opens first, allowing a con. operation raused failure of a motor driven pump to start trolled turbine acceleration and buildup of oil pressure due to insufficient tube oil pressure. Loweriry the pres- 4 to control the governor valve when full steam flow is sure switch setpoint solved the problem, which had not beert detected during testing.

admitted.

NUREO/CR 58N 54

_ . _ _ . _ __ _._ __ _ _ _ . ___.._ _ __..-._m -_ u_., 4

Failure Modes pl3 Watethammer at Palisades resulted in AIAV:ine CC10. Numerous single train events provide additional and hanger damage at both steam generators. The AIAV insights into this probiern. In some cases leakage of hot spargers are located at the normal steam generator level, MIAV past multiple check valves in series has occurred and are frequently covered and uncovered during level because adequate valve seating pressure was limited to fluctuationt Waterhammers in tap fec41 tingsteam the valves closest to the steam generators ( AEOD/C404 generators resulted in main feedline rupture at Maine 1984). At ilobinson, the pump shutdown procedure was Yankee and Icedwater pipe cracking at Indian Point 2 changed to delay closing the MOVs until after the check (IN 84 321984). valves were seated. At Parley, check valves were changed from swing type to lift type. Check valve tc.

DE"1. Manually reversing the dhection of motion of an work has been donc at a number of plants. Different operating valve has resulted in MOV failures where valve designs and rnanufacturers are involved in this such loading was not considered in the design (AEOD/- problem, and recurring leakage has been experienced, C6031986). Control circuit design may prevent this, even after repair and replacement.

requiring stroke completion before reversal.

CF2. At Robinson, heating of motor operated valves by DE8. At cach of the units of the South Thas Project, check valve leakage has caused thermal binding and fail.

space heaters provMed by the vendor for use in pre- ute of AITV discharge valves to open on demand. At installstion storage of MOVs were found to be wired in Davis llesse, high differential pressure across AISV in-parallel to the Class lE 125 V DC motors for several jection valves resulting from check valve leskage has AIAV valves (IR $0-489/89-11; 50 499/89-11 1989). The prevented MOV operation (AEOD/C6031986). <

valves had been environmentally qualified, but not with ,

the non safety related heaters energized. CF3. Gross check valve leakage at McGuire and Robinson caused overpressurization of the AIAV suc-5.2.4 Component Fullures tion piping. At a foreign PWR lt resulted in a severe waterhammer event. At Palo Verde-2 the MISV suction Generic issue ll.E.6.1,"In Situ TPsting Of Valves"was piping was oserpressurited by check valve leakage from divided into four sub. issues (13cckjord 1989), three of the AIAV system (AEOD/C4041984). Gross check which relate directly to ptevention of AITV system com. valve leakage through idle pumps represents a potential ponent failure. At the request of the NRC,in situ test. diversion of AINV pump flow, ing of check valves was addressed by the neclear indus-try, resulting in the EPRI report," Application CE4. Roughly one third of AIAV system failurcs have Guidelines for Check Valves in Nuclear Power Plants been due to valve operator failures, with about equal (Brooks 1988)" This extensive report provides informa- failures for MOVs and AOVs. Almost half of the MOV tion on check valve applications, limitations, and inspec. failures were due to motor on tiwitch tailures (Casada lion techniques. In situ testing of MOVs was addressed 1989). An extensive study of MOV events (AEOD/C603 by Generic Letter 8910," Safety Related Motor. 1986) indicates continuing inoperability problems Operated Valve Testing and Surveillanec* (Partlow caused by: torque switch / limit switch settings, adjust-1989) which requires licensees to develop and imple. ments, or failures; motor burnout; improper siting or ment a program for testing, inspection and maintenance use of thermal overload devices; premature degradation of allsafety related MOW. "ThermalOverload Protec. related to inadequate use of protective devices; daman;c tion for Electric Motors on Safety Related Motor. due to misuse (valve throttling, valve operator hammer-Operated Valves Generic issue ll.E.6.1 (Rothberg ing); mechanical problems (loosened parts, improper as-1988)" concludes that valve motors should be thermally sembly); or the torque switch bypass circuit improperly protected, yet in a way which emphasizes system fune. Installed or adjusted. The study ccmcluded that current tion over protection of the operator, methods and procedures at many plants are not ade.

quate to assure that MOW will operate when needed CE). The common-cause steam binding ef fects of check under credible accident conditions, Specifically, a sur- ,

valve leakage were identified in Section 5.2.1, entry scillance test which the valve passed might result in 5.5 NUREO/CR 5839

, , - - - - ~ - - . -- .- ---- - - _ --.__.- - - .

__ _..~_ _ _ __._._ _ _ _ _. - _ _ __._.__--______-_

Failure Modes undeteettd valve inoperability due to componcat failure tripping of the thermal overload device, leaving the (motor burnout, operator parts failure, stem disc sepa- turbine driven pump inoperable for 40 days until the ration) or improper positioning of protective devices next surveillance (AEOD/E7021987). Problems result (thermaluserload, torque switch, limit switch). Generic flom grease changes to EXXON NEBULA EP.0 grease, letter 89-10 (Partlow 1989) has subsequently required one of only two greases considered environmentally licensees to implement a program ensuring that MOV qualihed by 1.imitorque. Due to lower viscosity,it i switch settings are maintained so that the valses will slowly migrates from the geat case into the spring pack.  !

operate under design basis conditions for the life of the Grease changeover at Vermont Yankee affected 400f plant. the older MOVs of which 32 were safety related. Orcase relief kits ate needed for MOV operators manufactured l GL Comp (ment problems have caused a significant before 1971 At Limerick,additioral grease relief was number of turbine driven pump trips (AEOD/C602 required for MOVs manufactured since 1975, MOV re-1986). One group of events involved worn tappet nut furbishment programs rnay yield other changeovers to f aces, loose cable connections, loosened set sciews, im. EP 0 grease.

properly latched TTVs, and improper assembly. An-other imolved oil leaks due 10 comtonent or seal f ail- @ For AFW systems using air operated valves, al-utes, and oil contamination duc to poor maintenance most half of the system degradation has resulted Irom activitics Governor oil may not be shared with turbine failures of the valve omtroller circuit and its instr ument lubrication oil, resulting n the need for separate oil - inputs (Casada 1989). Failures occurred predominantly changes. Electrical component failures included uansis- at a few units using automatic electronic controllers for tot or resistor f ailures due to moisture intrusion, erron. the Dow control valves,with the majority of failures due cous grounds and connections, diode failures, and a to electrical hardware. At 'Ibrkey Point.3, controller faulty circuit card. malfunction resulted from water in the Instrument Air sptem due to maintenance inoperability of the air

@ Electrohydraulic. operated discharge valves haw d ryers, performed very poorly, and three of the five units using them have removed them due to recurrent failures. .CF10. For systems using dicsci driven pumps, most of Failures included oil leaks, contaminated oil, and the fail"*cs were due to start control and governor speed hydraulic pump failures. control ci e ! tty. Ilalf of these occurred on demand, as opposed to during testing (Casada 1989).

Cl]. C ,rol circuit failutes were the dominant source of motor driven AFW pump failures (Casada 1989). Ell. For systems using AOVs, operability requires the This includes the controls used for automatic and availability of Instrument Air, backup air,0: backup ni.

manual starting of the pumps, as opposed to the instru- trogen. Ilowever, NRC Maintenance "Ibam inspections mentation inputs. Most of the remaining problems were have identified inadequate testing of check valves isolat-I due to circuit breaker failures. ing the safetygelated portion of the lA system at several utilities (Letter, Roc to Richardson). Generic letter R$. *llydraulic lockup

• of Limitorque SMB spring 8814 (Miraglia 1988), requires licensees to verify by test packs has prevented proper spring compression to arte, that air operated safety-telated components will per-ate the MOV torque switch, due to grease trapped in the form as expected in accordance wnh all design. basis spring pack. During a survedlance at 'ltojan, failure of events including a lost of normal IA.

the torque switch to trip the'lTV motor resulted in NUREG/CR 5839 56 l

i A,,-,. , -n. .- v - 2, . , , , . . - . - - ,n-,,,,,,n.,. i' ,,-,---.a .v-,,-. - . . . _ - . - - . - , , , . - , . - - - - , . . . ' - - . . _ . - - , . _+ ,

6 Referenices l

lletk}ord,IL S. Junc 30,1989. Clascout of Gcncric issur AEOD Rtports llE61, *1n Situ 1csting ofiidres'. Lettet to V Stello, Jr., U.S. Nuclear Regulatory Onnminion, Whshington, AEODIC404. W. D. Lanning. July 1984. Srcam Binding

'DC ofAuxdiary Fecdwater numps. U.S. Nucleat Regulatory Commiwlon, Washington, DC 13tooks U. P. I988. Application Guidelinesfor Check l'alrcs in Nuclear Power Plants. NP.5479, Elecitic AEODlC602. C1isu. August 19S6. OperationalEsper.

Power Research Institute, Palo Alto, California. icnce /nvolving 7hrbine overspeed 7Fips. U.S. Nuclear Regulatory Commission, Washington, DC Casada, D. A.1989. Alttiliary Fredwater System Aging Study. i blume 1. Operating Expcrience and Cunent Afon. AEODICbO3. E.J. Utown. December 1986:A Review itoring Practices. NUREGICR.5404. U.S. Nuticar Reg. of Alotor-operated ibire Perfonnance. U.S. Nuclear ulatory Cornmission, Washington. DC Regulatory Conunission, Washington, DC Gregg, R. E., and R. E. Wright.1988. Appendit Review AEOD/E702. E.J. Brown. March 19,1987. Afol'Aril-

. for Denninant Gencric Contributors._ ULU-31,88. Idahn ure Due to Hydraulic LocVup From Etcessive Grcase m National Engineering l2boratory, Idaho Falir 'daho. Spnng Pack. U.S. Nuclear Regulatory Commiuton, Washington, DC Miraglia, H J. February 17,1988. Rc3alution of Genenc Safety issue 93,

• Steam Binding ofAuriliary Tecdwater AEODfl'416. January 22,1983. Loss of ESFAuriliary i hunps* (Generic Letter 38 03). U.S. Nudear Regulatoty Fredwater Pump Capability at 7h>Jan on January 22, Commission, Whshington, DC - 1983. U.S. Nuclear Regulatory Commission,

%hshington, DC Miraglia, E J. August 8,1988. Instrument Atr Suppiv System l>oblerns Affcctmg Safc.yRelated Equipment Injurmation Notices (Generic Leucr SS.14). U.S. Nu&ar Regulatory Com.

minion. Whshington, DC IN 82-01.~ January 22,1982. Attriliary Fcedwater 1%mp Lockout Resultingfrom liestingho tse I(*-2 Switch Circuit Partlow,J. O. June 28,1989. Safety.Related Alotor. Afochfication. U.S. Nuclear Regulatory Commission,

- Operated I hire 7bsting and Surveillance (Generic Letter whshington, DC 39.lt/J. U.S Nuclear Regulatory Commission, Washington, DC IN 84 32. E. L Jordan. April 18,1984. Autiliary Tecd-water Sparger and Ppc Ilangas Damage. U.S. Nuclear Rothberg,0. June 1988. Thermat orcr/oad Protectmn Regulatory Commission, %hshington, DC for Electric Atotors on Safety Related Afofor Operated -

IDIves Generic Issuc IlE.n1. NUREG-129h U.S. No. IN 84 66. August 17,1984. Undriccred Unaradahdity of .

clear Regulatory Comm;ssion, Washington, DC the 7krbinc-Dnven Auxiliary Fredwater 7 tam. U.S.

Nuclear Regulatory Commiulon, Washington, DC l 'Itavis, R., a nd J. Tay lor. 1989. Derclopment of Gurd.

!- ancefor Generic, functionally Oriented PRA. Based leam 1N 87-34, C B. Rossi. July 24,1987. Single Failures in l Inspectionsfor Bll'R Plants-idenu)1 cation of Ruk- Autthary Feedwater Systems. U.S. Nuticar Regulatory important Systems, Components andlluman Actions. - Commwion, ubshington, DC TLR-A.3874?l'6A Dioc4 haven National Laboratory, ,

Upton, New Yort I

tt 1 NUREGICR-5839 r

l l

% . .a _. .. .- -.,..._.;___._ _ _ _ _ _ . _ _ _ _ _ _ _ . _ _ _ _ _ _ , _ , _ _ _ _ _ _ _ _ _ _ , _ _

_ - . . .. _ _ . .-_ __. ____.m...._. _._. . _ _ _ _..._ . _. -._

References IN 87 53. C E. Rossi. October 20,1987. Autiliary inspwtion Rqwrt Tecdwater Pump 7 tips Resultingfrom Low Suction l>cs-sure. U.S. Nuclear Regulatory Commission, IR 50-489/8911; 50-499/8911. May 26,1989 South Whington, DC Texas Project inspection Report. U,S. Nuc1 car Regula.

tory Commission, Whington, DC  ;

IN 884N. C E. Rossi. March 18,1988. Reduced Reli. i abihty of Steam-Driven Auritiary Feedwater 1%mps NUREG Rqvrt .

Caused by Instahdity oflibodward PG.PL hpe Gover.

nors. U.S. Nut.lcat Regulatory Commission, NUREG-115L 1985. Loss ofMain andAuxiliaryFeed. I i Whington, DC water Event at the Davis Besse Plant on June 9,1985. ]'

U.S. Nuclear Regulatory Commission, Washington, DC IN 89-30. R. A. Azua. August 16,1989. Robinson Unit 2 inndequate NPSil of Auniliary Feedwater Pumps. Also, 1 Event Notification 16375, August 22,1989. U.S. i Nuclear Regulatory Commission, Whington, DC.

F t

-t

-d e

I 1

- NUREG/CR 5S39 6.2 w gr

• w-

  SE, $300 t

2 l'

I 'P 5 S S I 3 e g, 3 e 'k'S IV "lP FogC g- O . dt *; I IANIog

[

• S ~ P D P *g;c,E GUPLTCa77 ya .

-213 svc5 VRSHINGTom DC

?'555

. - . - _ . - - - . -. . - = . ~ . , . . - . , - . .