ML20116A484

Auxiliary Feedwater System RISK-BASED Inspection Guide for the Virgil C. Summer Nuclear Power Plant

ML20116A484
Person / Time
Site:	Summer
Issue date:	09/30/1992
From:	Bumgardner J, Gore B, Lloyd R, Moffitt N, Vo T Battelle Memorial Institute, PACIFIC NORTHWEST NATION
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-L-1310 NUREG-CR-5838, PNL-7924, NUDOCS 9210290412
Download: ML20116A484 (35)

Text

.- . - - - ..

NUREG/CR-5838 PNL-7924 a

l i

Auxiliary Feedwater System l Risk-Based Inspection Guide-for the Virgil C. Summer  ;

Nuclear Power Plant .;

i Prepared ty R. C. IJoyd, N. E. Moffitt,11. F. Gore, l T. V. Vo, J. D. Ilumgardner '

P:cific Northwest Laboratory Operated by - 1

Battelle Memorial Institute

' Prep red for ,

.U.S. Nuclear Regulatory Commission 1

E

1. 8A"Esa!M8E8,i a O PDR-

. . ~ , . . . . . . - . . , -

1. O i

-l l

AVAILABILITY NOTICE -

i AvallabAtry of Reference Matt #lais Cited h NRC Putkallons i

Most documents cited b NRC puMcations wR be available from one of the fonowhg sources:

1. The NRC Pubho Document Room,2t20 L Street, NW., Lower Level Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Prhting Office, P.O. Box 37082, Washington, DC 20013 7082

3. The National Technical laformation Service, Spthgfield, VA 22t61 Although the toting that follows represents the majority of documents cited in NRC pubhcations, it is not intended to be exhaustive.

Referenced documents avalable for inspection and copybg for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda: NRC bulletins, circ.utars, hformation notices, inspection and investigation notices; licenses event rsports; vendor reports and correspondence: Commis-slon paperet and appacant and licensee documents and correspondence.

The followhg documents in the NUREG series are avan.able for purchase frorn the GPO Sales Program:

formal NRC staff and contractor reports, NRC-sponsored conference proceedings, international agreement reports, grant pubHeations, and NRC booklets and prochures. Also available are reculatory guides, NRC regulations in the Code of Federal Regulations, and Nuclear "egulatory Commission issuances.

Documents available from the National Technical information Service hclude NUREG-series reports and I technicai reports prepared by other Federal agencies and reports prepared by the Atomic Er. orgy Cimmis-sion, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical Abraries include all open hierature items, such as books, journal articles, and transactions, FederalItegister notices Federal and State legislation, and con- q grossional reports can usually be obtained from these librarles, Documents sur,h as theses, dissertations, foreign reports and tr?nslations, and non-NRC conference pro-caedings are avaHable for purchase from the organtration sponsort g the publication cited.

Single copies of NRC draft reports are available free, to the extent cf supply, upon written request to the Office of Administratlon, Distribution and Mall Services Section, U.S. Nuclear Regulatory Comrnission, Washington, DC 205G5.

Coples of Industry t' odes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library,7920 Norfolk Avenue, Bethesda, Maryland, for use by the pLblic. Codes and standarde are usually copyrighted and may be purchased frem the originating organizatlon or, if they are Ar.wrlean National Standardi, from the American National Standards institute,1430 Broadway, New York, NY 10018.

DISCLAIMER NOTICE This report vias prepared as an account of work sponsored by an agency of the United States Govemment.

Neither the United States Govemment nor any agency tnoreof, or any of their employees, makes any werranty, expressed or irrplied, or assumes any legal liability of responsibility for any th;rd party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would rot infringe privately owned rights. -

a t'

W ew w -

e r .? +# -

N UREG/CR-5838 PNL-7924 Auxiliary Feedwater System Risk-Based Inspection Guide for the Virgil C. Summer Nuclear Power Plant hianusenpt Completed: August 1992 I) ate l'ubhshed: Sepittnher 1992 Prepared by it. C. I loyJ. N. ii. hioffitt,11.1. Gorc.

T. V. Vo 1. It llumgardner Pacific Northwest I ahoratory 11ichland, WA 99352 l'reparnt for Division of Radiation l'rotection and Emergency l'reparedness Omce of Nuclear lleactor llegulation U.S. Nuclear llegulatory Commission Washington, DC ?.0555 NitC FIN L1310

_-- . . - . . - .. . . . - . . - . - - _ = - . _ _ _ _ . _ _ . - - _

l Abstract l

In a study sponsored trj the U.S. Nuclear Regulatory Commission (NRC), Pacific Northwcst laboratory has 3 developed and applied a methodology for derMag plant-specific risk based ict}ution guidance for the emergencj/ ,

auxiliary feedwater (EFW/AFW) system at presuriud water reactors that have not undergone probabilistic risk assesstre.nt (PRA). This methodology usca existing PRA results and plant operating experience information. Existing PRA-based inspection guidance information recently developed for the NRC for various plants was used to identify generic component failure modes. This information was then combined with plant-specific and industry-wide com.

ponent information and failure data to identify failure modes and failure mechanisms for the AFW system at the selected plants. Virgil C Summer plant was selected as one in a series of plants for study. Tne product of this effort is a prioritized listing of AFW failures which have occurred at the plant and at other PWRs. Thh listing is intended for use by NRC inspectors in the preparation of inspection plans addressing AFW risk.important components at Virgil C Summer plant.

iii NUREG/CR-5838

. .. - - - - - - - . . . - _ . - . _ ~ . . . ~ - - . - . ... - . .

Contents Abs t ract . . . . . . . . . . . . . . . . . . . . . . . . . ............................................................ 111 Summary....................................................................................... is 1 i n t rod u ct io n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1 2 Virgil C. Su m me r AFW Svs tem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . - 2.1 l

2.1 Sptem Descri pt ion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1 2.2 Success Criterion . . . . . . . ................................................................ 2.1 - l 2.3 Sp tem De pend cacies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 1 2.4 Opera tio nal Co ns train ts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 I i

3 Inspection G uidance for the Virgil C. Summer AIM Sptem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 3.1 Risk important AFW Compcments anal Pallure Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 3.1.1 Multiple Pump Pallurcs due to Comraon Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 3.1.2 'Ihrbine Driven Pump Palls to Start or Run . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 3.1.3 Motor Driven Pump A or il Pails to Start or Run . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 3.1.4 Pump Unavailable Due to Maintenanu or Surveillance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 3.1.5 Air Operated Isolation and Flow Control %1ve Pailure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 3.1.6 Motor Operated %1ve Pailu re . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4  :

3.1.7 Manual Suction or Discharp Wlves Fall closed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 3.1.8 Ir.akage of Hot Fea1 water through Check %1ves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6 3.1.9 Risk Important AIM Sptem Walkdown 'Pable ........... ..... ....................... 3.6 T

4 Oc t eric Ris k insigh ts from PR As . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 4.1 Risk Important Accident Sequences involvinE AFW Sptem Pailure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 4.2 Risk Important Component Pailure Modes . .......... ................................. .... 4.1 5 Pailure Modes Determined From Operating Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .... 5.1 5.1 Virgil C. Su mmer Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 -

5.1.1 Motor Driven Pu mp Pa u ures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 -

5.1.2 'Ibtbine Driven Pump Pallures . . . . . . . . . . . . . . .. .. ..... .......................... 5.1 5.1.3 Flow Control and Isolat;on hlve Pallures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 S. I .4 Check Wives . . . . . . . . . . . . . . . . . . . . . . . . . . . , .................... ........... ...... 5.1 v NUREG/CR.5838 i

,- -.-m . _ - _ _ , . , . , , , , . . . . , _ _ , . - . . . , . . . . . . . . . - , _ - - _ _ . . . - . . . . - . . . - - _---._--m..._-~~r

.m.__... . . . . . . . . _ _ _ . ~ . _ . - _ _ . . _ . . _ . _ _ _ _ _ _ _ . _ _ . - . . . _ _ _ _ . . .

~

t l'

i Contents t i

e L

5.2 Ind ustry Wide Experie nce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 r

5.2.1 Com mon Ca use R it ures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 i 5.2.2 l i u ma n Er r o r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3 e 5.2.3 Dcsign/ Engineering Probtene and Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 . . 5.4 4 1

5.2.4 Com pon en t Wil u res . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.5 t

6 References................................................................................... 6.1 i

.i t

i l

l 4

?

I l '!

l NUREG/CR-5838 gi

.--_u-_._ - _ , , . . , , ~, ,.,:- ,. ._...__.__-m.-

Contents Figures 2.1 ..... ......................... ............................................................. 2.2 l

'Ihbles ,

3.1 Risk Impet tant Walkdown 'Ihble for Virgil C Summer AFW System Cornponents . . . . . . . . . . . . . . . . . . . . 3.7 f

t f

P vil NUREG/CR 5838

- --- e -.--. - + - . . ,

- . ,.... - . - .~. - - - - - .. . ._ - -_-. - - . - - . - - - - - - - _ .~

Summary This document presents a mmpilation of auxiliary /cmcigency fec4 water (AFW/EFW) system failure information which has been screened for risk significance in terms of failure frequency and degradation of system performance. It is a risk-prioritized listing of failure events and their causes that are significant enough to warrant mnsideration in inspection planning at the Virgil C Summer plant. Db information is presented to provide inspectors with increased resources for inspection planning at Virgil C Summer.

The risk importance of various component failure modes was identified by analysis of the results of probabilistic risk assessments (PRAs) for many pressurized water reactors (PWits) liowever, the component failure categories identi-ficd in PRAs are ratur broad, because the failure data used in the PRAs is an aggregate of many individual failures having a variety of root causes. In order to help inspectors focus on specific aspects of componcut operation, mainte-nance and design which might cause these failurca, an extensive review of component failure information was per-formed to identify and rank the root causes of these component failures. Both Virgil C Suremer and industry wide failure information was analyzed. Pallure causes were sorted on the basis of frequency of occurrence and seriousness of consequence, and categorized as common cause failures, human errors, design problems, or component failures.

His information is presented in the body of this document. Section 3.0 provide brictdescriptions of these risk.

important failure causes, and Section 5.0 presents more extensive discussions,whh specific examples and references.

De entrics in the two sections are : ross referenced.

An abbresiated system walkdown table is presented in Section 3.2 which includes only comp <ments identified as risk important, his table lists the system lineup for normal, standby sptem operation.

I Bis information permits an inspector to conantrate on components important to the prevention of cute damage.

ikrwever,it is important to note that inspections should not focus exclusively on these components. Other compo-nents which perform essential functions, but which are not included because of high reliability or redundancy, must also be addressed to ensure that degradation does no: incicase their failure probabilities, and hence their risk importance. ,

.i e

n r

lx NUREG/CR 5838.

, . . ._ ..~ . _ . _ _._._. -, . - _ . . . _ _ . _ _ . . _ . _ _ _ - .

1 Introduction This document is one of a series providing plant.specinc procedures. An AFWsystem walkdown tableidentify-inspection guidance for auxiliary /cmergency feedwater ing risk important mmponents and their lineup for (AFW/EFW) systems at pressurized water reactors riorinal, standby system ope.adon is also provided.

(PWRs). Tb be consistent with other inspection guides, the VC Summer EFW system will be referred to as ne remainder of the document describes and discusses AIM remgnizing that the plant specinc designation is the information used in mmpihng this inspection guld.

technically the EIM system. This guidance is based on ance. Sectio 14.0 describes the risk Important informa-Information from probabill.,dc risk assessments (PRAs) tion which has been derived from PRAs and its souras. j fot almilar PWRs,;ndustry-wide operating experience As review of that section will show, the failure events with AIM systems, plant specific AFW system descrip- identified in PRAs are rather broad (e.g., pump fails to -

tions, and plant specific operating experience. It is not a start or run, valve fails closed). Section 5.0 addresses detailed inspcction plan, but rather a compilation of the specific failure causes which have been combined Alv system failure information which has been under these broad events, screened for risk signifiamce in terms of failure frequency and degradation of system performance. The AFW system operating history was studied to identify result is a risk prioritized listing of failure events and the various specific failures which have been aggregated the causes that are significant enough to warrant consid- into the PRA failure events. Section 5.1 presents a cration in inspection planning at Virgil C Summer, summary of Virgil C Summer failure information, and Section 5.2 presents a review ofindustry-wide failure This inspection guidance is presented in Section 3S, information. The industry-wide information was com-following a description of the Virgil C Summer AFW piled from a variety of NRC sources, including AEOD

, system P Ocetion 2.0. Section 3.0 identifies the rish analyses and reports,information notices, inspection  ;

important sptem components by Virgil C Summei and enfor:cment bulletins, and generic letters, and from '

identt0 cation number, followed by brief descriptions of a variety of INPO reports as well. Some IJcensee Event each of the various failure causes of that component. Reports and NPRDS event descriptions were also re-These include specific human errors, design deficiencies, viewed. Finally,information was included from reports and hardware failures. The discussions also identify of NRC-sponsored studies of the effects of plant aging, where common cause failures have affected multiple, which include quantitative analyses of reported AIM redundant components. These brief discussions identify system failures, his industry-wide information was specific aspects of system or component design, opera- then combined with the plant specific failure informa-tion, maintenance, or testing for inspection by observa- tion to identify the various root causes of the broad tion, records review, training olisetvation, procedures failure events used in PRAs, which are identified in review, or by observation of the implementation of Section 3A 1.1 NUREG/CR-5838

2 Virgil C. Summer AIM' System This section presents an oveniew description of the ftom a point t,pstream of the main steam isolation Virgil C. Summer AFW system (Westinghouse 3 kiop valves, through valve 2MS. Each AIM pump is equip-plant), including a simplified schematic sptem diagram. ped with a continuous recirculation flow system, which in addition, the system success criterion, sptem depen- prevents pump deadheading.

dencies, and administrative operational constraints are also presented. The discharges of the motor driven pumps are cross connected and each pump can feed all three steam generators. The turbine-driven pump also feeds all 2,1 System Description thrceteam generators through separate lines. Each of these six lines contains an air operated discharge now The AFW system provides feedwater to the steam gen. control vah c. Motor driven and turbine driven pump  ;

erators (50) to allow r,emndary-side heat removal from flow mntrol valves are 3531,3541,3551, and 3536,3546, the primary sptem when main feedwater is unavailable. 3556, respectively. Safety class air accumulatois for each The sptem is capable of functioning for extended flow control valve provide sufficient air capacity to perkxis, which allows time to restore main feedwater permit remote valve closure for isolation of a semndary flow or to proceed with an orderly cooldown of the plant sptem break. Each of the lines from the motor driven to where the residual heat removal (RHR) system can pumps also contains a manually opciated disclwge iso < ,

remove decay heat. A simplified schematicdiagram of lation vahc,1017 A,B,C. Discharge isolation valves in -

the Virgil C. Summer AFW sptem is shown in the lines from the turbine-driven pump are manually Figure 2.1. operated valves,1018 A,B,C. AFW umtsinment isola, tion valves are provided by air assist <pring operated

'the AFW system consists of two motor-driven (MD) chetk vahrs 1009 A, B, C. Each AFW line also contains pumps and one steam- driven ('11)) pump aiong with the several check valves to prevent leakage from the fced associated piping, vahes and instrumentation normally water lines.

mnrected to the Cor,densate Storage 'Umk (CST).1: is designed to start up and establish flow automatically. The mudensate storage tank (CST) is the normal source +

All pumps start on receipt of a steem generator low-low of water tot the AFW Sptem and is required to store level signal. (The motor-driven pumps start on low level sufficient demheralized water to maintain the reactor in one SG, whereas, two low level signals are required molant sptem (RCS) at hot standby conditions for for the steam. driven pump to start.) Also, the motor- 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> (172,700 gallcas). All tank connections execpt driven pumps start on a trip of main feedwater pumps those required for instrumentation, auxiliary feedwater (MFW) pumps, a safety injection signal, undenultage pump suction, chemical analysis, and tank drainage are on either ESF Bus DA or DB, or on ATWS Mitigation k)cated above this minimum level, Backup AFW supply -

Sys em Circuit Activation (AMSAC).The single is automatically provided by the senice water system.

turl ine.drh'en (TD) pump also starts on undcrvoltage On a kiw suction pressure condition of 11.9 psig for on he ESF busse' DA and DB, and on an AMSAC 5 seconds, senice water valves,1001 A & B and 1037 A SK NAl. & B will open automatically to supply loop A and B.

A suction line from the CST provides a common header that suppl!cs water to tne it,rbine-driven pump and to 2,2 Success Criterion both motor-driven pumps. Isolation valves in these lines are kAked open. Ibwer, control, and instrumenta. System success requires the operation of at least one tion associated with each motor-driven pump are inde. pump supplying rated flow to at least one of the.three pendent from one another, Steam for the turbine- steam generators.

• driven pump is supplied by steam generators B and C, 2.1 NUREG/CR-5838

-- . . , . .. . . . _ - . - - = . . . _ . - . _ - - - . - . - . _ ..

1 l

Virgil C. Summer AFW Sptem i

! 2.3 System Dependencles if one Alw pump becomes inoperable,it must be re-l stored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the plant must shut down to hot standby within the next six hours  ;

He AFW system depends on AC and DC power at vari-ous voltage levels for motor operation, valve control, and in liot Standby within the followiug sit hours. If two monitor and alarm circuits, and valve / motor control AIN "lv P re inoperable, be in hot standby within six l circuits. Steam availability is required for the turbine- hours and in not shutdown within the following six  !

driven pump. hours. if three AIM pumps are (noperab!c,immediately initiate corrective action to restore one pump tu operable status as soon as possible, 2.4 Operational Constraints De Virgu c Summer 1bchnical Specifications require ,

a minimum supply of 172,700 gallons of water to be '

The Virgil C Summer 1bchnical Specifications require stored in the CST to maintain the RCS at hot standby that all three AFW pumps and associated flow paths are condition for 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> with steam tilscharge to atmos-operable with each motor-driven pump powered irom a phere concurrent with totalloss of offsite p(rwer.

different vital bus and one turbine driven pump ca[uble ,

of being powered from an operable steam supply sptem.

I 6

I

\

1 i

l NUREO/CR 5838 2.2 l--

Virgii C. Summer AFW Systear

< m o -

be%

o. $# _

W _ /_ _

'f B wwwwwwwmmewwwwwww.wwm g_'jjjgg g

g.

< M w M o < <

$ , E!

a n 8 a-e 8

a af, e

=a "

a a,

e a

e s, sn s, a 4JC "

g a g

. .- eg.

A -

j

< m t' E

E

- p"

.- - R a e v kr EN l D

'm \

5 J' U i O< O- 09< _

,9 9 [ . .

[ ..

m;n [

I 3j3 h - h f M 9M[i [i

$ ?n 2.3 NUREO/CR-5838

3 Inspection Guidance for the Virgil C, Sunimer AFW System la this section the risk important components of the 3.1,1 Multiple Putup Failures due to Common Virgil C. Summer AFW system are identified, and the Cause important failure modes for these components are brief.

ly described.Dese failure modes include specific human ne following listing summarizes the most impor-  ;

crrors, design deficiencies, and types of hardwa' re fail- tant multiple-pump failure modes identified in Sec-urcs which have been observed to occur for these mm* tion 5.2.1, Common Cause F ilures, and each item is  !

ponents, both at Virgil C. Summer and at PWRs keyed with a 3 digit code to entries in that section.

throughout the nuclear industry.De discunions also identify where common cause failures have affected . Incorrect operator intervention into automatic sys-multiple, redundant components. These briel discus' tern functioning, including improper manual start.

sions identify specific aspects of system or component ing and securing of pumps, has caused failure of all design, operation, maintenance.or testing for inspection pumps, including overspeed trip on startup, and in.

activities. These aethities include; observation, records ability to restart prematurely secured pumps. CC1.

review, training observation, proccdures review, or by obscavation of the implementation of procedures. Inspection Suggestion - Observe Abnormal and Emergency Operating Procedure (AOP/EOP) simu-Table 3.1 is an abbreviated AFW system walkdc wn table lator training exercises to verify that the operators which identifies risk 4mportant mmponents. This table comply with procedures during observed evolutions.

lists the system lineup for normal (standby) system Observe surveillance testing on the AFW system to operation. Inspection of the mmponents identified in verify it is in strict compliance with the surveillance the AFW walkdown table addresses essentially all of th' test procedure.

risk associated with AFW system operation.

• Valve mispositioning has caused failure of all pumps. Pump suction, steam supply, and instru-3.1 RiskImportant AFW Componen(S ment isolation valves have been involved. CC2.

and Failure Modes inspection Suggestion - Verify that the system valve Common cause fallu es of multiple pumps are the most alignment, air operated valve mntrol and valve risk important failure modes of AFW system compo- actuating air pressures are correct using 3.1 Walk-down *Ihble, the system operating procedures, and nents. These are followed in importatac by single putap failures, level control valve failures, and indhidual check operator rounds logsheet. Review surveillance pro-cedures that alter the standby alignment of the valve leakage failures.

AFW system. Ensure that an adequate return to normal section exists.

The following sections address each of these failure modes,in decreasing order of risk-importance. They

• Steam binding has caused failure of multiple pumps.

present the important root causes of these component failure modes which hase been distilled from historical This resulted from leakage of hot feedwater past records. Each item is keyed with a three digit code to check vahts and a motor-operated vah e into a com-discussions in Section 5.2 where additional information mon discharge header CC10. Multiple pump on historical ever.ts is presented, steam binding has also resulted from improper valve lineups, and from running a pump deadheaded.

CC3.

3.1 NUREG/CR-5838

Inspection Guidance Inspectio.1 Sugestion - Verify that the pump dis- suction head (NPSil). CC7. At li.B. Robinson, charge temperature is within the limits specified on design revicws have idemified inadequately sized the operator rounds logsbert (<24(f'F). Assure any suction piping which could have yielded insufficient instruments used to verify the ternperature by the NPSH to support operation of more than one utility are of an appropriate range and included in a pump. CC8.

calibration program. Verify affected pumps have been vented every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to ensure steam binding Inspection Sugestion - Assure that plant condi-has not occurred. Verify that a maintenance work tions which conid result in the blockage or degrada-request has t cen written to repair leaking check tion of the suctic.i uow path are addressed by syn valves. tem reaintenance and test procedurc<. Examples in-clude, if the AITV system has an emergency source Pump control circuit deficiencies or design modifi- from a water systern with the potential for bio-cation errors have caused failures of multiple pumps fouling, then the system should be periodically to auto start, spurious pump trips during operation, trcated to prevent buildup and routinely tested to and failures to restart after pump shutdown. CC4. asst're an adequate Dow can be achieved to support Incorrect setpoints and control circuit calibrations operation of all pumps, or inspected to assure that have also prevented proper operation of multiple bio-foulingis nat occurring Design changes that pumps. CC5. affect the suctiori flow path should repeat testing that verified an adequate suction source for simul-Imration Sugestion - Review design change im- taneous operation of all pumps. Verify that testing plementation documents for the post maintenance has, at sometime, demonstrated sLuultaneous oper-testing required prior to returning the equipment to ation of all pumps. Verify that surveillances ade-sersicc. Assure the testing verifics that all poten. quately test all aspects of the system design func-tially impacted functions operate correctly, and in- tions, for example, demonstrate that the AFW cludes repeating any plant start.up or hot functional pumps will trip on .'ow suction pressure.

testing that may be affected by the design change.

3.1.2 hrbine Driven Purnp Falls to Start or loss of a vital power bua has failed both the turbine- Run driven and one motor-driven pump due to loss of control power to steam admission valves or to tur-

• Improperly adjusted and inadequately maintained bine controls, and to motor controls powered from tuibine governors have caused pump failures. HE2.

the same bus. CC6. Problems include worn or kiosened nuts, set screws, linkages or cable connections, oil leaks and/or con-Impectio; Sugestion The tuaterial condition of tamination, and electrical failures of resistors, the ekttrical equipment is an indicator of probable transistors, diodes and circuit cards, and erroneous reliability. Review the Preventative Maintenance grounds and connections. CF5. Governor problems.

(PM) records to assure the equipment is inaintained bearing wear, low oil, and human error in making on an appropriate frequency for the environment it proper settings have caused failure of the turbine is in anc that the PM's are actually being pe formed driven pump at Virgil C. Summer.

as required by the program. Review the outstandii.g Correctise Maintenance records to assure the Impection Sugestion - Review PM records to deficiencia found on the equipment are promptly assure the governor oil is being replaced within the corrected-designated inquency. During plant walkdowns carefully inspect the governor and linkages for loose

• Simultaneous startup of multiple pumps has caused fasteners, leaks, and unsecured or tegraded conduit.

oscillations of pump suction pressure causing Review vendor manuals to ensure PM procedures multipic pump trips on low suction pressure, are performed according to manufacturer's recom-despite the existence of adequate static net positise mendations and good maintenance practices.

NUREO/CR-5838 12 l

l

Inspection Guidance

• 'Ihrbines with Woodward Model PG-PL governors luspection Sugestion . Carefully inspect the TIV have tripped on overspeed when restarted shortly overspeed trip linkage and assure it is reset and in after shutdown, unicss an operator has locally exer- good physical condition. Assure that there is a good cised the speed setting knob to drain oil from the steam isolation to the t.arbine, otherwise continued governor speed setting cylinder (per procedure). turbine high temperature can result in degradation Automatic oil dump valves are now available of the oilin tM turbine, interfering with proper through 'Ibrrv. DE4. ovecpeed trip operation. Review training pro-cedures to ensure operator training on resetting the Inspection Sugestion . Observe the operation of TIV is current.

r the turbine driven Aux Feed pump and assure that the governor is reset as directed in SOP-211 stcp

• Low lubrication oil pressure resulting from 1.catup 2.11 by rotating the speed control knob fully in the due to previous operation has prevented pump counterclockwise direction, then fully in the clock- restart due to failure to satisfy the protective wise direction. Assure the turbine is not masting interlock. DES.

over, whir's can result in refill of the speed setting cylinder. Inspection Suggestkm - ww oil pressure is a trip that is in service at all times for the turbine driven Ccndensate slugs in steam lines have cau;ed turbine AIM pump. Normally the low oil pressure occurs overspeed trip on startup. 'Ibsts repeated right after at approximately 1400 rpm and serves to protect the such a trip may fall to indicate the problem due to pump from low RPM operation, however low oil warming and clearing of the steam lines. Surveit- pressure due to a plugged filter will also cause a trip.

lances should exercisc all steam supply connections. Review PM remrds to assure the filter is replaced DE2. on the designated frequency.

Inspectica Sugestion Verify that the steam traps 3.1.3 Motor Driven Purnp A or B Falls to Start are valved in on the steam supply line. For steam or Run traps that arc on a pressurized portion of the steam line, check the steam trap temperature (if unlagged) .

Control circuits used for automatic and manual ,

to assure it is warmer than ambient (otherwise it pump starting are an important cause of motor -

may be stuck or have a plugged line). If the steam driven pump failures, as are circuit breaker failu es.

trap discharge is visibic, assure there is evidence of CF7. Control circuit problems and a blown fusc due liquid discharge.

to overload have occurred at Virgil C. Summer.

' nip and throttle valve (TIV) problems which have Inspection Suggestion - Review corrective mainte-failed the turbine driven pump incl"dc physically n2nce records when control circuit problems occur bumping it, failure to reset it folk wing testing. and to determine if a trend crists. Evety time a breaker failures to verify control room indication of reset.

is racked in a PMT should be performed to start the HE2. Whether either the overspeed trip or TIV pump, assuring no control circuit problems have trip can be reset without resetting the other, and occu red as a result of the manipulation of the unambiguity of control room ated k) cal indication of breaker. (Control circuit stabs have to make up TIV position and overspeed trip linkage reset upon racking the breaker, as well as cell switch dam-status, all affect the likelihood of these errors. DE3.

age can occur upo's removal and reinstallation of The TIV at the Virgil C. Summer plant has f fled to the breaker.)

reset due to misalignment of pins which prevented reengagement of the trip !cver. .

Mispositioning of handswitches and procedutal de-ficiencies have prevented automatic pump start.

HE3.

33 NUREG/CR-5838

- , x _ _ _- . , -

l l Inspection Omdance inspection Suggestion Ccmfirm switch position switche.;, control power kiss, and calibration prob-i using Thble 3.1. Review administrative procedures lems. Degraded operation has also resulted from concerning documentation of procrdural eficien. improper air pressure due to air regulator failure or cies. Ensure operator training on procedural leeking air lines.

changes is current.

Inspection Suggestion Check for control air system 3.1.4 Pump Unavailable Due to Maintenance alignment and air leaks during plant walkdowns.

or Surteillance (Regulators may have a small amount of external bleed to maintain downstream pressure.) Check for i

• Iloth scheduled nnd unscheduled maintenance re, cleanliness and physical mndition of sisibic circuit l elements. Review vah'c stroke time surycillance for move pumps from operability. Surveillance ruluires _

operation with an altered line-up, although a pump adverse trend%cspecially those valves on reduced j train may not be declared inoperable during testing. testing frequency. Review air systern surycillances I moisture content of air is within established limits, Prompt scheduling and performance of mrAc, nance and surveillance minirnbc this unavdlability.

• Out-of-adjustment electrical flow controllers have insgation Suggestion - Review the time the AIN/ caused improper valve operation, affecting multiple system and mmponent* are inoperable. Assure all trains of AFW. CCl2 maintenance is being performed that can be per-formed during a single outage time frame, avoiding Inspection Suggestion - Review PM frequency and multiple equipment outages. The maintenance remrds, only upon a trend of failure of the should be scheduled before the routine surveillance mnt.011ers.

ter.so credit can be taken for both post mainte-nance testing and surveillance testing, avoiding

. leakage of hot feedwater through check valves has excest've testing. Review surveillance schedule for caused thermal binding of flow control MOVs.

frequency a :d adequacy to verify system operabilf t'; AOVs may Fe similarly suswptible. CF2-requirements per 'Ibchnical Specifications.

3.1.5 Air Operated Isolation and Flow Control . Multiple flow mntrol valves have been plugged by Yahe Failure clams when suction switched automatically to an TD Purep Vain: 3536.3546.3556.1009A.B.C. 2030 MD Pump Trains,A:B: 3531.3541.3551.W9 A.B.C Inspection Suggestion - Qwcred by 3.1.1 bullet 6. ,

Hes normally open air operated valves (AOVs)isolat

.$.1.6 Motor Operated Valve Failure and ctmtrol flow to the steam generators. They fail open on loss of instrument air' Inon A Backup Suction Sources: 1037A.

. Control circuit problems have been a primary cause

^'

"# "

• I#

l of failures, beth at Virgil C. Summer and elsewhere.

CPA %1ve failures have resulted from blown fuses, h}"g '[""

l-failure of amtrol components (such as current!

These MOVs control or isolate flow of the service water pneumatic convertors), diaphram failures, broken to the AFW pumps, They fail as is on loss of power.

and dirty contacts, misaligned or broken limit NUREG/CR.5838 3.4

. .~ _

Inspection Guidance

• Commoa cause failure of MOVs has resulted from Operating procedures should provide cautions, and

' circuit designs may prevent reversal befora cach failure to use electrical vgnature tracing equipment to determine proper settings of torque switch and stroke is finished. DE7.

torque switch bypass switches. Pallure to calibrate switch settings for high torques neu:ssary under Inspection suggestion None. Circuit design pre-design basis accident conditions has also been vents this problem at V. C. Summer.

involved. CCll. Diaphragm failure, packingleak-age, electrical mmponent failure and seat leakage

• Space heaters designed for preoperation storage have been the main causes of valve fallute at Virgil have been found wired in parallel with vah ' motors C. Summer. which had not been emironmcetally qualified with them present. DE8.

Inspection Suggestion - Re iew tbe MOV test records to assure the testing and settings are based inspection Suggestion Spot check MOV's during on dynarnic system conditions. Overtorquing of the MOV testing to assure the space heaters are physi.

valve operator can result in valve damage such as cally removed or disconnected.

cracking of the seat or disc. Review the program to assure overtorquing is identified and wrrective 3.1.7 Manual Suction or Dischary Vahes Fall actions are taken to assure valve operability follow- Closed ing an overtorque condition. Roiew the program to assure EQ seals are renewed as required during CST Suction and Recirculation wives:

the restoration from icsting to maintain the EQ im7.1010.1025A.B.1026 rating of the MOV. TD Pump Train: 1012.10% 1018A.B.C hic Pump Train A: 1011 A.1021 A.1017A.B.C

+ Wlve motors have been failed due to lack of, or M D Pump 7tain B: 10118.1021 B.1017A.B.C improg,cr sir.ing or use of thermal overload protec-tive devices. Bypassing and oversl7ing should bc Dict.c manual valves are all normally kicked open. For based on proper enginecting for design basis cach train, closure of the first valve listed woutd block conditions. CF4. pump suction and closure of the second vahes would E "

Inspection Surgestion - Review the administrative controls for documenting and changing the settings . Valve mispositioning has resulted in failures of of thermal overload protective desices. Assure the multiple trains of AFW. CC2. It has also been the informathn is available to the maintenance dominant cause of problems identified during planners. operational readiness inspections. HE1. Events base occurred most often during maintenance, call.

• Grease trapped in the torque switch spring pack of bration,or system modifications. Important causes Limitorque SMB motor operators has caused motor of mispositioninginclude:

burnout or thermal overload trip by preventing torque switch actuation. CF8. - Pa lute to provide complete, clear, and specific inspecti >n Su go ~n - Resiew this only if the MOV testing program reveals deficiencies in this . Failure to promptly revise and validate pro-area. cedures, training, and diagrams following system modifications

- Manually reversing the direction of motion of operating MOVs has overloaded the motor circuit. - Pa lute to complete all steps in a procedure 3.5 NUREG/CR-5838

l inspection Guidance

- Pallure to adequately review uncompleted pre-

• 1eakage of hot feedwater through several check cedural steps after task completion valves in series has cause<1 steam binding of multiple pumps. leakage through a closed level control

- Failure to verify support functions after valve in series with cbeck valves has also occurred at restoration Virgil C. Summer, as would be required for leakage to reach the motor driven pumps A and II. CC10.

- Ihllure to adhere scrupulously to edtninistrative procedures regarding tagging, mntrol and track- Inspection Sugestion Covered by 3.1.1 bullet 3.

ing of valve operations

• Slow leakage past the final check valve of a series

- Pallure to log the manipulation of scaled valves may not force the check valve closed. Otner check valves in series may leak similarly. Piping

- Pallure to follow good practices of written task orientation and valve design are irnportant factors assignment and feedback of task completion in achieving true series protection. CFl.

information Inspection Sugestion - Covered by 3.1.1 bullet 3.

i -

Ihllure to provide casily read sptem drawings,

cgible valve labels corresponding to drawings 3.1.9 Risk Important AFW System Walkdown and procedures, and labeled indications of local 'lhble valve position

'Ihble 3.1 presents an AFW system walkdown table in.

Inspection Sugestion - Review the administrative ciuding only components identified as risk important.

mntrols that relate to valve positioning and scaling, This information allows inspectors to mocentrate their system restoration following maintenane ralve efforts on components important to prevention of core labeling, system drawing updating, and procedure damage. However,it is essential to note that inspec-resision, for proper implementation. tions should not focus exclusively on these components.

Other components which perform essen'lal functions, 3.1.8 leakage of Hot Feedwater thrungh but which are absent from this table because of high tell-Check Valves: ability or redundancy, must also be addresse4 to ensure that their risk importance are not increased. An example MD Pump A: 1019M1,G would include ensuring an adequate water level in inc hiD Purno II: 1019AAC CST exists.

TD Pump: 1020AAC Containment isolation Stop Check Valves; 1009AAC NUREG/CR-5838 3.6 )

Inspection Ouldance

%ble 3.1 Risk important Walkdown Thble for Virgil C. Summer AFW System Components Required - Actual Component # Component Name Position Position Electrical i

A Motor Driven Pump .Rachs In/

Qosed B Motor Driven Pump Racked In/

Closed

%)ve 1010 CST Outlet Valve locked Open 1007 CST Outlet Bypass Valve Incked Open 1009A Containment isolaticn to S/G A Chief./ Norm 1009B Containment Isolation to S/G B Closed / Norm 1009C Containment Isolation to S/G C Closed / Norm 1012 TDP Suction Valve Locked Open 1036 TD FWP Discharge Wlve locked Open 1018A TD PNP Supply to S/G A locked Open 1018B TD FWP Supply to S/G B locked Open 1018C TD FWP Supply to S/G C locked Open 1026 TDP RecircIsolation Iocked Open 3536 TDP Flow Control to S/G A Opent*)

3546 TDP Flow Control to S/G B Open(*)

1 3556 TDP Flow Control to S/G C Open(*) - ,_

1011A MDP "A" Svetion Locked Open

-1011B MDP 'B' Suction locked Open 3.7 NUREG/CR 5338

- . - . . . . _ _ . ~ -- - - - - - - - -

. - . _ . _ _ . . _ - . _ . - _ . _ . _ . . _ _ _ - . _ ...- . _ - - . _.._________.m-.. . _ _ . _

Inspection Guidance l bble 3.1 (Continued)

Requim! Actual l- Co:nponent # Component Name 1%Illon Position if . A MDP 'A' Recirculation locked Open 1025B MDP 'B' Recirculation Locked O p n 1021A MDP A Discharge Locked Open l l

1021B MDP D Discharge ln ked Open 1017A MDP Supply to S/G A l.orked Open 1017B MDP Supply to S/G B locked Open 1017C MDP Supply to S/O C locked Open 3531 MDP How Control to S/G A Open ,

3541 MDP Mow Control to S/O B Open 3551 MDP Flow Control to S/O C Open ,

2802A MS Supply to TDP Opcn/ Auto 2802B MS Supply to TDP Open/ Auto 2030 Steam Isolation Wlve Closed / Auto l

TDP Governor %1ve Speed Set Hagan Controller Fast i 2865 Steam Supply Wrottie Wlve Open 1037A SWloop A Supply Wlve Closed / Auto 1037B SW l.nop B Supply % Ivc Closed / Auto 1001A SW loop A to MDP A Closed / Auto 1001B SW trop B to MDP B Closed / Auto 1008 SW loop A to TDP Closed / Auto l

l NUREO/CR-5838 3.8 l

. . .m. L . . , . . . . . ~ . . . . .. . ,, ,e...,_ _._.. . . _ , , - . . . _ _ , _ _ .~-

Inspection Guidance hble 3.1 (Continued)

Required Actual Component # Component Name Nition Position 1002 SW Imp B to TDP Closed / Auto 1019A MDP Supply Stop Ck to S/O A lecked/Open 1019B MDP Supply Stop Ck to S/O B locked /Open 1919C MDP Supply Stop Ck to S/O C locked,Open 1020A TDP Supply Stop Ck to S/O A Locked /Open L 1029B TDP Supply Stop Ck to S/O B Locked /Open 1020C TDP Supply Stop Ck to S/O C lacked /Open Piping at Pump Discharge Ambient Tbmperaturc@)

Piping at Pump Discharge Ambient ltmperature@)

Piping at Pump Discharge Ambient Tbmperaturc@)

(a) Handwhccilocked in Mid Position (Neutral) locally.

(b) Ambient 1bmperatute is approximately 110 degrees E e

3.9 - NUREO/CR 5838

--. ,- --ww w -

4 Generic Risk Insights from PRAs PRAs for 13 PWRs were analyzed to identify risk- provide feedvater from other souras, and fail to important accident sequences involving loss of AFW, initiate feed and-bleed cooling, s esulting Lt core and to identify and risk-prioritize the component failure damage, modes involved. De results of this analysis are de-scribed in this section. They are consistent with results +

A 10% of rf,ain feedwater trips the plant,and AFW reported by INEL and BNL (Gregg et al 1988, and falls due to operator error and hardware failures.

Davis t al,1988). He opertitors fall to initiate feed-and-bleed coolina,,

roultinf,in core damage.

4.1 RiskImportant Accident Sequences steam oermrator Ibbe Runture fsoTTu involving AFW System Failure + A soIgis followed by failure of AFW, Coolant is k>st f mm the primary until tL: refueling water stor.

1.oss of Power System age Iank (RWST) is depleted. High pressure injec-tion (HPI) fails since recirculation cannot bc

+

A loss of effsitu nower is followed by failure of established from the empty sump, and core damage AFW and failure of feed and bleed, resulting in core roults.

g damage.

+

A statinD blackoul fails all AC power except Vital AC trom DC invertors, and all decay heat removal 4.2 Risk ImI>ortant C 1ent Failure systetus except the turbine-driven AFW pump. Modes AFW system operation is subsequently impacted by loss of instrumentation or hardware failures, The generic component failure modes irlentified from resul;ing in wre damage. PRA analyses as impo. tant to AFW system failure are listed below in decreasi'ig order of risk importance.

+

@C bus faBs, causing a trip and failure of the power conversion system. One AFW nc ,+ driven 1. Thrbine-Driven Pump Pailure to Start or Run.

ptimp is failed by the bu: loss, AFW is subsequently tost completely due to other failures. Feed-and- 2. Motor-Driven Pump Pallure to Start or Run.

w t ad cooling fails, resulting in core damage.

3. TDP or MDP Unavahable due to %st or

, Wansient-Caused Reactor or1hrbinc tip Maintenance.

• A_t.pnsient caused trip is followcd by a 10 s of 4. AFW System W've Failures MIM and AW Feed-and bleed cooling fails Mther due to Eiure of the operator to initiate it, or + steam admission valves i

due .o hardware failures, resulting in core dainage.

+

trip and throttle valve boss of Main Fec41 water

+ ilow control valves j

+

A,_frutwater line break diains the common water autret. for M"W and AFW. De opentors fail to +

pump discharge valves 4.1 NUREG/CR-5838 u - - - - - - - - _ - _ - _ - _ - -_

Y ,

,;Q l mig ric Risk insights from PRAs

• ~ pump suction valves in addition to individual hardware, circuit, or lastru-ment failures, each of these f.Jiure modes may result

• valvesin testing or maintenance. from common causes and human errors. Common cause failures cf AFW pump 3 are particularly risk '

5. Supply / Suction Sources important. W1ve failures are somewhat less imporu .t due to the multiplicity of steam generators and connec-

• condensate storage tank stop valves tion paths. Human error of greatest risk importance q involve: failures to initiate or control system operation l hot wellinventory when required; failure to restore proper system ilneup l afier mMntenance 5 ting; and failure to switch to

+ suction valves, alternate sourca wtn quired.

• Service Water System i

d .

i 4

- NUREG/CR.5838 4.2

5 Failure Modes Determined Fiom Operating Experience This section describes the primary root causes of AIN were attributed to governor trip valve problems, bearing system component failures, as determined from a resiew failure, low lube oil pusure, and operator error and of operating histories at Virgil C Summer and at other procedural deficiencies in setting speed control. (LER PWRs throughout the nuclear industry. Section 5.1 de- 83-45) scribes experience at Virgil C. Summer, from 1983 to 1991. Some Licensee Event Report (LER) references 5.1.3 Flow Control and Isolation Valve are also listed to proside a basis for potential inspectic- Failures aethities. Section 5.2 summarizes information complied from a variety of NRC sources, including AEOD analy-More than sixteen events have resulted in impaired ses and reports,information notices, inspection and operational readiness of the air operated how control enforcement bulletins, and generic letters, and from a and motor operated isolation valves. Principal failure variety of INPO reports as well. Some LERs and causes were equipment wear, instrumentation and con-NPRDS event descriptions were also reviewed. Fiaally, trol circuit failures, valve hardware failures, and human information was included from reports of NRC-spon^ errors. Wives have failed to operate properly due to sored studies of the effects of plant aging, which include failure of ccmtrol components, dirty seat, overload and quantitative analysis of AIN system failure reports. air leaks. Humaa errors have resulted in valve binding his information was used to identify the various root and packing problems. (LERs 83-37,83-75,83-86,84-causes expected for the broad PRA-based failure events 28,85-26) identified in Section 4.0, resulting in the inspection guidelines presented in Section 3.0~

5.l A Check Valves Five events of check s ahc failure have occurred. Normal 5.1 Virgil C. Summer Experience wear and aging, inadequate valve manufactursng, lack or proper maintenance and human error were cited as the ne AFW systern at Virgil C. Summer has expenenced failure causes, resulting in leakage. (LER 86-01) failures of the AFW pumps, pump discharge flow con-trol valves, the turbine steam admission and supply valves, turbine trip and throttle valve, pump discharge isolation vakes, service water backup supply valves, and 5.2 Industry Wide Experience numerous system check valves. Etiture modes include g  ;  ; g electrical, instrumentation and control, hardware fail-g g; g s g7 ures, and human errors.

AIN System failures identified in a resiew of industry wide system operating history. Common cause failures, 5.1.1 Motor Driven Pump Failuras Aich disable more than one train of this operational,y s

redurant system, are highly risk significant, and can Bere have been three ewnts w hich involved failure of rc:, ult frw all of these causes.

the motor driven pumps during several modes of opera-tion. Pailure modes involved instrumentation and ccm- His uction identifies important common cause failure trol circuit failures, blown fuse, and human failures modes, and then provides a broader discussion of the during maintenance activities.

single failure effects of human errors, design!

enginecting problems and errors, and component fail-5.1.2 %rbine Driven Pump Fnitures utes. Pa%raphs presenting details of these failure modes are coded (e.g., CCl) and cror.:st eferenced by Eight events have resulted in decreased operational inspection items in Section 3.0.

readiness of the turbine drisen pump. Failure causes l

5.1 NUREG/CR-5838 ,

1

i l

Pallure Modes 5.2.1 Common Cause Failurts CC3. At ANO 2,both AFW pumps lost suction de to steam binding when they were lined up to both the CST The dominant cause of AFW system multiple-train fail, and the hot startuphlow' wvn dcmineralizer effluent urcs has been human error. Design / engineering errors (AEOD/C404,1984). At Zion-1 steam croated by run-and component failures have been less freqaent, but ning the tarbine-driven pump deadheaded for one min-nevertheless significant,causes of multiple train iailures. ute caused trip of a motor-driven pump sharing the same inlet header, as well as damage to the turbine-CCl. Iluman error in the form of incorrect operator driven pump (Region 3 Morning Report,1/17/90). Both intervention into automatic AFW system iunctioning events were caused by pro:cduralinadequacies.

during transients resulted in *c temporary loss of all safety-grade AFW pumps during events at Davis Besse CC4. Design / engineering errors have accounted for a (NUREG-1154,1985) and hojan (AEODfr416,1983). smaller, but significant frution of common cause fall-In the Davis Besse event, improper manual initiation of ures. Problems with mntral circuit design modifict tions the steam and feedwater rupture control sptem at Parley defeated AFW pump auto-start on loss of (SFRCS) led to o erspeed tripping of both turbine- main feedwater. At Zion-2, restart of both motor driven e driven AFW pumps, probably due to the introduction of pumps was blocked by circuit failure to de-energize mndensate into the AFW turbines from the long, when the pumps had been tripped with an automatic unheated steam supply lines. (The system had never start signal present (IN 82-01,1982). In addition, AFW been tested with the abnormal, cross-connected stcan, control circuit design reviews at Salem and Indian Point

,upply lineup which resulted.) In the Trojan event the have identified designs where failures of a single compo-operator incorrectly stopped tmth AFW pumps due to nent muld have failed all or muuple pumps misinterpretation of MFW pump speed indication. The (IN 87-34,1987).

diesel driven pump would not restart due to a protective feature requiring complete shutdown, and the turbine. CC5. Incorrect setpoints and control circuit settings driven pump tripped on overspeed, requiring local reset resulting from analysis crrors and failures to update pro-of the trip and throttle valvc. In cases where manual cedures have also prevented pump Fart and caused intervention is required during the early stages of a pumps to trip spuriously. Errors of this type may re-transient, training should emphasize that actions should main undetected despite surveillance testing, unless sur-be performed methodicaPy and deliberately to guard veillance tests model all types of system initiation and against such errors. operating conditions. A greater fraction ofinstrumenta-tion and control circuit problems has been identifie41 CC2. Valve mispositioning has accounted for a signifi. during actual system operation (as opposed to survell-cant tractio' of the human errors failing multiple trains lance testing) than for other types of failures.

of AFW. Td. includes closure of normally open suction vJves or steam supply valves, and of isolation valves to CC6. On two occasions at a foreign plant, failure of a sensors having control functions. Incorrect handswitch balance-of-plant inverter caused failure of tv o AFW positioning and inadequate temporary wiring changes pumps. In addition to kiss of the motor driven pump have also prevented automatic starts of multiple pumps. whose auxiliary start relay was powered by the invertor, Pactors identified in studies of mispositioning errors the turbine driven pump tripped on overspeed because include failure to add newly installed valves to valve the governor valve opened, allowing full steam flow to checklists, weak administrative control of tagging, resto- the turbine. This illustrates the importance of assessini; ration, independent verification, and h>cked valve log. the effects of failures of balance of plant equipment ging, and inadequate adherence to procedutes. lilegible which supports the operation of critical components.

or confusing local valve labeling, and insufficient The instrument air sptem is another example of such a training in the determination cf valve position may system.

cause or *nask mispositioning, and surveillance which does not exercise complete sptem functioning may not CO. Multiple AFW pump trips have occurred at reveal mispositionings. Millstone-3, Cook-1,Rojan and Zion-2 (IN 87-53, s

1987) caused by brief, k)w pressure oscillations of b

< NUREG/CR 5838 5.2 i 1

Pallure Modes suction pressure during pump startup. These occurred, resulting in the designation of ' Steam Binding oscillations oxurred despite the availability of adequate of Auxiliary Feedwater Puntps' as Generic Issue 93.

static NPSH. Corrective actions taken include: This generic issue was resolved by Ocuetie Letter 88-03 extending the time delay associated with the low (Miraglia,1988), which required licensees to monitor pressure trip, removing the trip, and replacing the trip AFW piping temperatures each shift, and to maintain with an alarm and operator action. procedures for remgnizing steam binding and for restor-

, ing systern operability,

_CC8. Design c.rors discovered during AFW system re-analysis at the Robinson plant (IN 89-30,1989) and at CCI1. Common cause failures have also failed motor Millstone-1 tesulted in the supply header from the CST operated valves. During the total loss of feedwater event being too small to pro 5ide adequate NPSH to the at Davis Besse, the normally-open AFW isolation valves 'l pumps if more than one of the three pumps were oper- failed to open after they were inadvertently closed. The  !

ating at rated flow mnditions. This could lead to multi- failure was due to improper setting of the torque switch ple pump failure due to cavitation. Subsequent reviews bypass switch, which prevents motor trip on the high _

at Robinson identified a loss of feedwater transient in torque required to unseat a closed valve, Previous prob-.

which inadequate NPSH and flows less than design lems with these valves had been addressed by increasmg values had occurred, but which were not recogn8 zed at the torque switch trip setpoint - a fix which failed du ng the time. Event analysis and equipment trending, as the event due to the higher torque required due to high well as surveillance testing walch duplicates service con- differential oressure across the valve. Similar common ditions as much as is practical, can help identify such mode failures of MOVs have also occurred 5 other sys-design errors. tems, resulting in issuance of Generic Ixtter 89-10,

" Safety Related Motor-Operated Wlve 'Ibsting and Sur-CC9. Asiatic clams caused failure of two AFW flow veillance (Partlow,1979).* This generic letter requires control valves at Catawba-2 when low suction pressure licensees to develop and implement a program to pro-caused by starting of a motor-driven pump caused suc~ vide for the testing, inspection and maintenance of all tion source realignment to the Nuclear Service Mter safety-related MOVs to provide assurance that they wil:

system. Pipes had 1.ot been routinely treated to inhibit function when subjected to design basis conditions.

clam growth, nor regularly monitored to detect their presence, and no 1 trainers were installed. The need for CCl2. Other component failures have also rewlted in surveillance which exercises alternative sy: tem opera- AFW multi-train failures. 'Ibese include out-of-tional modes, as well as complete system functioning, is adjustment electrical flow controllers resulting in im-emphasized by this emnt. Spurious suction switchever proper discharge valve operation, and a failure of oil has also cautred at Callaway and at McG utre, altbough cooler cooling water supply valves to open due to silt no failures resulted. accumulation. 1 CC10. Common cause failures have also been caused by 5 2.2 Humar Errors component failures (AEOD/C4N,1984). At Surry-2, both the turbine driven pump and one motor driven HEl. The overwhelmingly dominant cause of problems pump were declared inoperable due to steam binding identified during a series of operational readiness eval-caused by leakage of hot water through multiple check untions of AFW systems was human performance. The valves. At Robinson 2 both motor driven pumps were majotity of these human performance problems resulted found to be hot, and both motor and steam driven from incomplete ant incorrect procedures, particularly pumps were found to be inoperable at different times. with respect to valve lineup information. A study of Backleakage at Robinson 2 passed through closed valve mispositioning events invoking human error iden-motor. operated isolation valves in addition to multiple tified failures in administrative control of tagging and check valves. At Parley, both motor and turbine driven logging, procedural compliance and completion of steps, pump casings were found hot, although the pumps were verification of support systems, and inadequate proce-

- not declared inoperable. In addition to multi-train fail-dures as importar Another study found that valve ures, numerous incidents of single train failures have -

5.3 NUP.EG/CR-5838

Pailure Modes mispositioning events occurred most often during main- cross. connected steam lines. Repeated tests following a tenance, calibration, or moddication activities. Insuffi- cold. start trip may be successful due to system heat up.

ciert training 'n deterniining valve position, and in administrative requirements for controlling valve posi. DE3. Tbrbine trip and throttle valve (TIV) problems tioning were important causes, as was oral task assign- are a significant cause of turbine driven pump failures ment without task completion feedback. (IN 8445). In some cases lack of TIV position indica-tion in the control room prevented recognition of a trip.

HE2. Thrbine driven pump failures have been caused by ped TIV in other cases it was possible to reset either human errors in calibrating or adjusting governor speed the overspeed tiip or the TIV without resetting the control, poor governor maintenance, incorrect adjust. other. Tnis problem is compounded by the fact that the ment of governor valve and overspeed trip linkages, and position of the overspeed trip linkage can be misleading, errors associated with the trip and throttle valve. TIV- and the rnechanism may lack labels indicating when it is assoc.ated errors include physically bemping it, failure in the tripped position (AEOD/C602,1986).

to restore it to the correct position after testing, and failures to verify control room indication of TIV posi- DE4. Startup of turbines with Woodward Model PG-tion following actuation. PL gove*ncts within 30 minutes of shutdo vn has result.

ed in overspeed trips when the speed setting knob was HE3. Motor driven pumps have been failed by human not exercised locally to drain oil fr om the speed setting errors in mispositioning handswitches, and by procedure cylinder. Speed control is based on startup with an deficienews. empty cylinder. Problems have involved turbinc rota-tion dt.c to both procedure violations a id leaking team.

5.2.3 Design /Engineccing Problems and 'Ibtry has marketed two types of dump valves for auto.

Emirs matically draining the oil after shutdown (AEOD/CIC2, 1986).

del. As noted above,the majorityof AFW subsptem failures, and the greatest relative sptem degradation, At Calvert Cliffs, a 1987 loss-of-offsite-power event has been found to result from turbine-driven pump fail _ required a quick. cold startup that resulted in turbine ures. Overspeed trips oflbrry turbines conttolled by trip due to PG-PL governor stability problems. The Woodward governors have been a significant source of short term corrective action was installation of stiffer these failures (MOD /C602,1986). In many cases these buffer springs (IN 88-09,1988). Surveillance had alwap overspeed trips have been caused by sk w iesponse of a been preceded by turbine warmup, which illustrates the Woodward model EO governcr on startup, at plants importance of testing which duplicates service condi-where full steam Dow is allowed immediately. This over. tions as much as is practical, sensitivity has been removed by installing a statnip steam bypass valve which opens first, allowing a contral. DES. Reduced viscosity of gear box oil heated by prior led turbine acceleration ar d buildup of oil pressure to operation caused failure of a motor driven pump to start control the governor valve when full steam flow is due to insufficient tube oil pressure. Lowering the pres-admitted. sure switch setpoint solved che problem, which had not becn detected during testing.

DE2. Overspeed tnps of Tbtry turbines have been DE6. Waterhammer at Palisades resulted in W line caused by condensate in the steam supply lines. Con.

densate slows down the turbine, causing the governor and hanger damage at both steam generators. The AFW valve to open farther, and overspeed results before the spargers are k)cated at the normal steam generator level, governor valve can respond, if;ci the water slug clears. and are frequently covered and uncovered during level This was determined to bc the cause of the loss-of-rill- fluctuations. Waterhammera in top-feed-ring steam AFW event at Davis Besse (AEOD/602,1986), with generators resulted in main feedline rupture at Maine condensation enhanced due to the longlength of the Yankee and feedwater pipe cracking at Indian Point 2 (IN 84-32,19M).

NUREG/CR-5838 5.4

liillure Modes DE7.- Manually reversinE the direction of ruotion of an rework has been done at a number of plants. Different operating valve has resulted in MOV failures where valve designs and manufacturers are involved in this such loading was not considered in the design (AEOD/ problem, and recurring leakage has been experienced, C603,1986). Control circuit design may prevent this, re- even after repair and reptwement.

quiring stroke completion before reversal.

CF2. At Robinsou, heating of motor operated valves by DE& At each of the units of the South Tbxas Project, check valve leakage has caused thermal binding and fall.

space heatus provided by the vendor for use in pre- ure of AFW discharge vahrs to open on demand. At .;

installation storage of MOVs were found to be wired in Davis Besse, high differential pressure across AFW parallel to the Class 1E 125 V DC motors for several injection valves resulting from chect valve leakage has AFW valves (IR 50-489/8%11; 50-499/89-11,1989). The prevented MOV operation (AEOD/C603,1986). ,

valves had bcen environmentally qualified, but not with . l the non-safety-related heaters energized. CF3. Gross check va!ve leakapo at McGuire and Robin-son caused overpressurintica of the AFW suction pi;r 5.2.4 Onnponent Failures ing. At a foreign PWR lt resulted in a severe water-hammer event. At Palo Verde-2 the MFW suction Generic Issue ll.E.6.1,"In Situ 'Ibsting Of Valves" was piping was overpressurized by check valve leakage from divided into four sub-issues (Beckjord,1989), three of the AFW system (AEOD/C4M,1984). Oross check which relate directly to prevention of AFW sptem cum. vb ce leakage thro'agh idle pumps represents a potential ponent failure. At thc request of the NRC,in-situ test. diversion of AFW pump flow, ing of check valves was addressed by the nuclear indus-try, resulting in the EPRI report,"Applic1on CF4. Roughly one third of AFW system failures have Guidelines for Check Valves in Nuclear Pwer Plants been due to valve operator failures,with about equal (Brooks,1988)." This extensive report provides infor- failures for MOVs and AOVs. Almost half of the MGV mation on check valve applications, limitations, and failurcs were due to motor or switch failures (Casada, inspection techniques. In-situ testing of MOVs was 1989). An extensive study of MOV events (AEOD/

addressed by Generic Letter 89-10," Safety Related C603,1986) indicates continuing inoperability problems Motor-Operated Wlve"Ibsting and Surveillance" caused by torque switch / limit switch settings, adjust.

(Partlow,1989) which requires licensees to develop and ments, or failures; motor burnout; improper sizing or implement a program for testing. inspection and main. use of thermal overload devices; premature degradation tenance of all safety.rclated MOVs. " Thermal overkiad retated to inadequate use of protective devices; damage Protection for Electric Motors on Safety-Related due to misuse (valve throttling, valve operator hammer-Motor Operated %Ives - Generic Issue ll.E.6.1 ing); mechanical proMems (loosened parts, improper (Rothberg,1988)" concludes that valve motors should assembly); or the torque switch bypass circuit improp-be thermally protected, yet in a way which emphasizes erly installed or adjusted. The study cor.cluded that cut-system function over protection of the operator, rent methocis and procedures at many plants are r ot adequate to assure that MOVs will operate when CFl. The common cause steam binding effects of check needed undcr credible acrident conditions. SpeciDeally, valve leakage were identified m Section 5.2.1, entry a surveillance test which the valve passed might result in CClo. Numerous single-train events provide additional undetected valve inoperability due to component failure insights into this proMem, in sore cases leakage of hot (motor burnout, operator parts failure, stem disc sepa-MFW past multiple check valves in series has occurred ration) or improper positioning of protective devices because adequate valve-seating pressure was limited to (thermal overload, torque switch, limit switch). Generic the valves closest to the steam generators (AEOD/C404, letter 89-10 (Partlow,1989) has subsequently required 1984). At Robinson, the pump shutdown procedure was licensees to implement a program ensuring that MOV changed to delay closing the MOVs until after the check switch settings are maintained so that the valves will valves were scred. At Rtricy, check vahes were operate under design basis conditions for the life of the changed from swing type to lift type. Check nive plant.

5.5 NUREG/CR-5838

Failure Modes CF5. Component proble.as have caused a significant qualified by Limitorque. Due to lower viscosity,it number of turbine driven pump trips (AEOD/C602, slowly migrates from the gear case into the spring pack.

1986). One group of events involved worn tappet nut Grease changenver at Vermont Yankee affected 40 of faces, loose cable connections, loosened set screws, the older MOVs of which 32 were safety related. Grease improperly latched TTVs, and improper assembly. An- relief kits are needed for MOV operators manufactured other imt .ved oil leaks due to compotient or scal fail- before 1975. At Limerick, additional grease relief was ures, and oil contaminstion due tv (oor maintenance required for MOVs manufactured since 1975. MOV activities. Governor oil may not be shared with turbine refurbishment programs may yield other changeovers to lubrication oil, resulting in the need for .,cparate oil EP-0 grease.

changes. Electrical component failures included transis-tor or resistor failures due to moisture intrusion, erron- CF9. For AFW systems using air operated va'ves, cous grounds and connections, diode failures, and a almost half of the system degradation has resulted from faulty circuit card. failures of the valve controller circuit and its instrument inputs (Casada,1989). Failures occurred predominantly C_F6. Electrohydraulic-operated discharge valves have at a few units using automatic electrorJe controllers for performed very poorly, and three of the five units using the flow control valves, with the majority of failures due them have removed them due to recurrent failures. to electrical hardware. At 'Ibrkey Point-3, controller Failures included oil leaks, contaminated oil, and hy- malfunction resulted from water in the Instrument Air draulic pump failuris. sptera due to maintenance inoperability of the air dry.

ers.

CF7. Control circuit failures were the dominant source of motor driven AFW pump failures (Casada,1989). CF10. For sptems using diesel driven pumps, most of This includes the controls used for automatic and manu- the failures were due to start control and governor sp ed al starting of the pumps, as opposed to the instrumenta- control circuitry. Half of these occurred on demand, as tion inputs. Most of the remaining problems were due opposed to during testing (Casada,1989).

to circuit breaker failures.

CFl1. For sptems using AOVs, operability requires the CFR

• Hydraulic lockup" of Limitorque SMB spring availability of Instrument Air (IA), backup air, or back-packs has prevented proper spring compression to up nitrogen. However, NRC Maintenance 'Ibam In-actuate the MOV torque switch, due to grease trapped spections have identified inadequate testing of check in the spring pack. During a surveillance at 'Itojan, fail. valves isolating the safety-related portion of the 1A sys-ute of the torque switch to trip the TTV motor resulted tem at several utilities (letter, Roc to Richardson),

in tripping of the th:rmal overload device, leaving the Generic Letter 88-14 (Miraglia,1988), requires licen-turbine driven pump inoperable for 40 dap until the sees to verify by test that air-operated safety-related next surveillance (/.M/E702,1987). Problems result components will perform as expected in accordance with from grease changes to EXXON NEBULA EP-0 grease, all design-basis events, including a loss of nortnal IA.

one of only two greases considered environmentally NUREG/CR-$h38 5.6 l

m .

6 References Beckjord, E. 5. Junc 30,1989. Closcout ofGenaric AEOD Reports issue ll.E.6.1, *In Situ Testing of Valves

• l.etter to V. Stello, Jr., U.S. Nuclear Regulatory Commission, AEOD/C4N. W. D. Lanning. July 1984. Steam Binding Washington, D.C ofAuxiliary Feedwater Pumps. U.S. Nuclear Regulatory Commission, Washington, D.C Brooks, B. P.1988. Applicatism Guidelinesfor Check Valves in Nuclear Ibwer Plantr. NP-5479, Electric AEOD/C602. C Hsu. August 1986. Operational Power Research Institute, Palo Alto, California. Erperienceinvolang 7hrbine Overspeed Pips. U.S.

Nuc1 car Regulatory Commission, Washington, D.C Casada,D. A.1989. AuxiliaryFeedwaterSystem Aging Study Volume 1. Operating Experience and Current AEOD/C603. E.J. Brown. December 1986. A Review Afonitann; Practices. NUREO/CR-5404. U.S. Nuclear of Afotor-Operated Valveltrformance. U.S. Nuclear Regulatoty Commission, Washington, D.C Regulatory Commission, Washington, D.C Gregg, R. E. and R. E. Wright.1988. Appendir Review AEOD/E702. E.J. Brown. March 19,1987. Af0VFail-ure Due to flydraulic Lockup From Excessive Grease in for Dominant Generic Contributors. BLB-31-88. Idaho Na ional Engineering Laboratory, Idaho Falls, Idaho. Spring Pack. I G. Nucleat Regulatory Commission, Wasnington, D.C Miraglia,E J. February 17,1988. Resolution ofGeneric Safety issue 93, ' Steam Binding ofAutiliary Feedwater AEODfr416. January 22,1983. Loss ofESFAuriliary Pumps' (Generic Letter 88-03). U.S. Nuclear Regulatory Feedwater Pump Capability at hojan on January 22, Commission, %hshington, D.C 1983. U.S. Nuc! car Regulatory Commission, Washington, D.C Mirag,lia, E J. August 8,1988. Instrument Air Supply System Problems Affecting Safety.Related Equipment (Generic Letter 38-14). U.S. Nuclear Regulstory Information Notices g Commission, %bshington, D.C IN 82-01. January 22,1982. Antiliary Feedwaterihmp Partlow, J. G. June 28,1989. Safety-Related Afotor- Lockout Resultingfrom Westinghouse W2 Switch Circuit Operated Valve Testing and Surveillance (Generic Letter Afodification. U.S. Nuclear Regulato y Commission, 89-10). U.S. Nuclear Regulatory Commission, Washington, D.C Whshington, D.C IN 84-32. E. L Jordan. April 18,1984. Auriliary Rothbcrg,0. Junc 1988. Therma? Overk>ad Protection Feedwater Sparger and Pipe Ilangar Damage. U.S.

for Electric Afotors on Safety-Related Afotor-Operated Nuclear Regulatory Commission, Washington, D.C Valves - Generic issue II.FAl. NUREG 1296. U.S.

Nuclear Regulatory Commission, Washington, D.C 1N 84-66. August 17,1984. Undetected Unavailability of the 7hrbine Driven Auriliary Feedwater Dain. U.S.

'havis, R. and J. Taylor. 1989. Development of Nuclear Regulatory Commiss:on, Washi.aton, D.C Guidancefor Generic, Funcdonally Oriented PRA. Based Team inspectionsfor DWR Plants-Identification ofRisk- IN 87-34. C E. Rossi. July 24,1987 single Failures in important Systems, Cornponents and lluman Actiota. Antiliary Feedwater Systems. U.S. Nuctcar Regulatory TLR-A-3874-TGA Brookhaven National Laboratory, Commission, Washington, D.C Upton, New Yerk.

6.1 NUREG/CR-5838

References IN 87-53. C E. Rossi. October 20,1987. Auxiliary Inspection Report Feedwater1%mp hips Resultingfrom Low Suction . ..

Itessure. U.G. Nuclear Regulatory Commission, IR 5J-489/89-11; 50499/89-11. May 26,1989. South Washington, D.C Taas Project frupection Report. U.S. Nuclear Regulatory Commission, Washington, D.C IN 88-09. C E. Rossi. March 18,1988. Reduced Reliability ofSteam. Driven Auxiliary Feedwater Pumps Caused by Instability of Woodward PG.PL Type NUREG Repuet Governors U.S. Nuclear Regulatory Commission, Washington, D.C NUREG 1154.1985. Loss ofMain andAuxiliary Feedwater Event at the Davis Besse Plant on June 9,1985. ._

IN 89-30. R. A. Azua. August 16,1989. Robtruon Unis U.S. Nuclear Regulatory Commission, Washington, 2 Inadequate NPSH ofAuriliar, Feedwater Pumps. .adso, D.C Event Notification 16375, August 22,1989. U.S.

Nuclear Regulatory Commission, Washington, D.C i

=

h NUREG/CR-5838 6.2 l 1

Distribution No. of No. of Copics Copies OFFSITE R. 'Itavis Brookhaven National 12boratory 18 U.S. Nuclear Regulatory Commission Building 130 Upton, NY 11973 B. K. Grimes OWFN 9 A2 R. Gregg EG&O Idaho, Inc.

E Congel P.O. Box 1625 OWFN 10 E4 Idaho Palls, ID 83415 R. Barrett Dr. D. R. Edwards OWFN 10 A2 Professor of Nuclear Engineering University of Missouri - Rolla A. El Ibssioai Rolla, MO 65401 OWFN 10 A2 T. D. Gatlin S. M. Long V. C. Summer Nuclear Station OWFN 10 A2 P.O. Box 88 Jenkinsville, SC 29065 K. Campe OWFN 1 A2 ONSITE 10 J.Chung 28 Pecific Northwest laboratory OWFN 10 A2 J. D. Bumgardner 2 B. Thomas S. R. Doctor OWFN 12 H26 L R. Dodd B. E Gore (10) 3 U.S. Nuclear Regulatory Commission - R. C. Lloyd (5)

Region 2 N E. Moffitt B. D. Shipp E Jape E A. Simonen A. Herdt T.V.Vo T. Peebles Publishing Coordination

'Itchnical Report File (5) 4 Vircil C. Summer Resider.t inspector Office R. C. Haag J. H. Taylor Brookhaven National Laboratory Building 130 Upton, NY 11973 Distr.1

I u:: so:= us us. nucle Aa a s cut AToa v coumissioN i RtroaTNe'

',',& , n.

1"?"" Weta ,. .' 0@^

noi. no BIBLIOGRAPHIC DATA SHEET rse .amun.,,m en r,, ,..orm NUREG/CR-5838 PNL-7924

2. TOLE ANo svein LE Auxiliary Feedvater System Risk-Pased Inspection Guide for the 3 oATE aEPonT ausussEo Virgil C. Suritner Euclear Power Plant o r ,, ,,8,.

September l 199?

4 fin OR GRANT NUMBE R L1330

6. TYvE OF REPORT 6.AUTMOmto R. C. Lloyd, N. E. Tiof fitt, B. F. Gore, i T. V. Vo, J . D. Bumgardner ,,,,,,ggggy,,,,,,,,,,,,,,,,,,,

12/91 to 8/92

~

--. #8 seawerser. **o**es

s. PE p o Rumc a c ANiz AT ION . N AM E AND ADDR ESS (# mac. peen.or Demon. Ortare er messoa. u& muca.sr .4eevaseerr Comvac ea, eae s'ia#*as a r1rsue esed 8hssesnf 8ee'v84J Pacific Northwest Laboratory Richlard, WA 99352 e

i 9.eSP,ONSO

~4 , e -JRING ORGANIZA TION - N AM E AND ADDR E55 tit 44c, eran w m eso.e'. # esw.eroemr, seoeme N#C Deema. Ort.ce se Ae, va, u.1 Division of Radiation Protection and Emergency Preparedness Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Cot:Inission Washington D.C. 20555

10. SUPPLEMENTARY NOTES 11, ASST R ACT (200 esaer er arms In a study sponsored by the U.S. Nuclear Regulatory Commission (NBC), Pacific Northwest taboratory has developed and applied a methodology for deriving plant-specific risk-basec inspection guidance for the emergency / auxiliary feedwater (EFW/AFW) system at pressurize (

water reactors that have not undergone probabilistic risk assessment (PRA). This methodology uses existing PRA results and plant operating experience infortnation. Exist-ing PRA-based inspection guidance information recently developed for the NRC for various '

J plants was used to identify generic component failure moC This informacion was then combined with plant-specific and industry-wida component information and failure data to identify failure modes 7d failure mechanisms for the Ani system at the selected plants. Virgil C. Summer plant was selected as one in a se-les of plants for study.

The product of this effort is a prioritized listing of AFW failures which have occurred at the plant and at other PWRs. This listing is intended for use by NRC inspectors in the preparation of inspection plans addressing AFW risk-important components at Virgil C. Summer plant.

14. * * ^'6^ss uI y sT A r gme % t I2, KE Y WORQL'DESC R:P ! OR 5 itsu aseres er pareses ener min esses, re arraere .* #euestav rae russest.#

Unlimited Inspection, Risk, PRA, Virgil C. Summer, Auxiliary Feedwater (AB4) e scua*rvc'a w e ca era w, Ur. classified 7 e. .ee r.,

Jnclassified

16. NUMSEH OF PAGES lik PRICE eric eoew Sn a ns

l Printed

on recycled l paper j

Federa Recycling Program

SEPTEMBER 1992 NUREG/CR-5838 '- AUXILIARY FEEDWATER SYSTEM RISK-BASED INSPECITON GUIDE FOR THE VIRGIL C. SUMMER NUCLEAR POWFJ1 PLAST UNITED STATES FIRST CLASS Matt POSTAGE ANC FEES PAID PsUOLEAR REGULATORY COMMISSION USNRC WASHINGTON, D.C. 20555-0001 PERMIT NO. G-67 OFFICIAL BUSINESS ,

PENALTY FOR PRIV/ '.E USE, 8700

'l 170555139531 1 1ANice US N o c - D A D ' ,

OIV FOIa c. m. 9L I C A TI N'S St S j Tos 000 ';UprG D.O11 W a E OI G T m; rc ? ' 5 5 "-

I

- " ' " " - - ' ' ' - ' ' " ' ~ - ' ' '

. _ . _ _ - .s..m- -

.