ML20116J685
| ML20116J685 | |
| Person / Time | |
|---|---|
| Site: | Pilgrim |
| Issue date: | 10/31/1992 |
| From: | Gunther W, Shier W BROOKHAVEN NATIONAL LABORATORY |
| To: | Office of Nuclear Reactor Regulation |
| References | |
| CON-FIN-A-3875 BNL-NUREG-52339, NUREG-CR-5924, NUDOCS 9211160298 | |
| Download: ML20116J685 (54) | |
Text
.____ - -- -_
NU REG /CR-5924 BNL-NU R EG-52339
- = - - - - +
4%wsz.ew e 4=ww.%i.
+we 11ig a Pressure Coolant Infec: ion (HPCI) System Ris<-Basec Insaec': ion Guic e 1)ilgrim Nuclear Power Station 42m,. _..., -
z.
l*t epared by W. Shier, W. Gunther llrookhaven National Laboratory Prepared for U.S. Nuclear Regulatory Commission 9211160298 921031 I
PDR ADOCK 05000293 I
G PDR
-..._.~.- _.
m -_. _ _ _ _ _
m _
m..
e d
AVA11 ABILITY NOTICE -
Availab*ty of Reference Materlats Cited in NRC Pubucations Most documents cited in NRC publi:ations will be avaltable from one of the following sources:
1.
The NRC Pubbe Document Hoom, 2120 L Street, NW., Lower Levet, Washington, DC 20555 1
2.
The Superintendent of Documents, U.S. Government Printing Office, P,0, Box 37082, Washington.
DC 20013-7082 3.
The National Technicalinformation Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intendvd to be exhaustive.
Referenced documents ava!!able for inspection and copying for a fue from the NRC Pubhc Document Room include NRC correspondence and internal NRC memoranda: NRC bulletins, circulars, Inform tlon notices, inspection and investigation notices; licensee event reports; vendor reports and correspondence; Commis.
slon papers; and applicant and licensee documents and correspondence.
The following documents in the NUREG series are avaliable for purchase from the GPO Sales Program; formal NRC staff and contractor reports, NRC-sponsored conference proceedings, international agreement reports, grant publications, and NRC booklets and brochures, Also available are regulatory guides, NRC.
regulations in the Code of Federal ffegulations, and Nuclear Regulatory Commission issuances.
Documents available from the National Technical information Service include NUREG-series reports and technical reports prepared by other Federal agencies and reports prepared by the Atomio Energy Commis.
tion, forerunner agency to the Nuclear Regulatory Commission.
l Documents available from pJblic and special technical librarles include all open literature items, such as books, journal articles, en1 transactions, Federat Register notices, r d wat and State legislation, and con-e grossional reports can usually bo obtained from these libraries.
Documents such as theses, disseitations, foreign reports and translations, and non-NRC conference pro-ceedings are available for purchase from th( organization sponsoring the pubhcation cited.
Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Administration, Distribu* ion and Mail _ Services Section, U.S. Nuclear Regulatory Cornmission.
Washington, DC 20555.
Copies of incustry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Llorary,7920 Norfolk Avenue, Bethesda, Maryland, fu use by the public Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards Institute,1430 Broadway, New York, i
NY 10018.
DISCLAIMER NOTICE (his report was prt. pared as an account of work sponsored by an agency of the United States Government.
NCither the United States Govemment nor any agencythereof, or any of their employees, makes any warran%
expressed or implied, o assumes any legal liability of responsibility for any third party's use or the results of -
such use, of any information, apparatus, product or process disclosed in tnis report, or represents tnat its use by such third _ party would not infnnge prwately owned rights.
l l
.m.
i
.NUREG/CR-5924 BNI.-NUREG-52339 High Pressure Coolant Injection (HPCI) System i
Risk-Based Insaection Guide L. _
i' Pilgrim Nuclear Power Station
- ).
Manuscript Completed: September 1992 Date Published: October 1992 2i. ;
.A.g
[d$
l'repared by W. Shier, W. Gunther y jg
- a e
J. Chung, NRC Project Manager llrookhaven National laboratory Upton, NY 119. 3 7
I Prepared for j;
Division of Radiation Protection and Emergency Preparedness Office of Nuclear Reactor Regulation U.S. Nuclear Hegulatory Commission i
Washington, DC 20555
,i' NRC FIN A3875~
4 i
4
).
~
~.
i
-q 1
ABSTRACT
~
A-review of the operating experience for 'the fligh Pressure Coolant Injection (HPCI).
system at the Pilgrim Nuclear Power Station is described in this report. The information for this review was obtained from Pilgrim Licensee Event Reports (LERs) that were generated between -
1980 and 1989. These LERs have been categorized into 23 milure modes that have been prioritized based on probabilistic risk nssessment considerations. =In addition, the results of the Pilgrim operating experience review have been compared with the results of a similar, industry wide -
- operating experience review. This comparison provides an indication of areas in the Pilgrim HPCI system that should be given increased attention in the prioritization ofinspection resources.
r 4
9 III l
l 1
- 1
.m..
.e,
+-.--,-,....m.
. _ -.. ~,. ~ - ~.. - -,,
- - ~
CONTENTS f!!EE '
iii A BSTR A CT...................................
ix S U M M AR Y.......................................
xi ACKNOWLEDGEMENTS........
1-1 1
I NTR O D U CTI ON...............................
1-1 1.1 P u rpose...................,
1-1 1.2 Application to inspections..
2-1 2
IIPCI SYSTEM DESCRIPTION........................
-3 ACCIDENT SEQUENCE DISCUSSION..............
3-1 3.1 Irss of liigh Pressure Injection and 3.l' Failure to Depressurize............
3.2 Station Blackout (SBO) With Intermediate 3-1 T.:rm Failure of liigh F. essure Injection 3.3 Station Blackout with Short Term Failure 32 of Ifigh Pressure Injection..........,
3.4 ATWS With Failure of RPV Water Level 32 Control at High Pressure............
3.5 Unisolated LOCA Outside Containment........,......
33 3.6 Overall Assessment of HPCI Importance in the Prevention of Core Damage......
3-4 41 4
PRA-BASED IIPCI FAILURE MODES 5.
HPCI SYSTEM WALKDOWN CIIECKLIST BY RISK 5-1 IMPORTANCE..
6 OPERATING EXPERIENCE REVIEW...
6-1 6.1 ilPCI Fai!ure No.1 - Pump or Turbine Fails to' Start or Run.......
6-1 6.2 HPCI Failure No. 2 - System Unavailable-Due to Test or Maintenance Activities..
6-5 6.3
'IIPCI Failure No. 3 - False fligh Steant Line.
Differential Pressure Isclation Signal..
.6-6 6.4 HPCI Failure No. 4 - Turbine Steam Inlet Velve MO-2301-3 (F001) Fails to Open..
6-6.
6.5 HPCI Failure No. 5.. Pump Discharge Valve -
MO;2301-8 (F006) Fails to Open.....
'6-6.
6.6 HPCI Failure No. 6 - Suppression Pool Suetion --
. Line Valves MO.2301-36 (F042) and MO-2301-35 67-Fails to Open 6.7' ilPCI Failure No. 7 - Minimum Flow Valve 6-7 MO-230114 (F012) Falls to Open.
y s
>v44r x
r-,,
r,-r<-er-r-.
v
.sy
-y e
,e m
.-y-5 a.r-==
6-
-,e f
- --.r---e-esn-
- w '+** w v---.
f
..~
3
+
CONTENTS (Cont'd) faae.
6.8 11PCI Failure No. 8 - System Actuatio:.
l.ogie Fa il s....................,.....
6-8 6.9 liPCI Failure No. 9 - False liigh Area Temperature Isolation Signal................
6-8 6.10 11PCI Failure No.10 False low Suetion l
Pressu re Trips...............
6-8 6.11 IIPCI Failure No.11 - False liigh Turbine Exhaust Pressure Signal.....................
6-8 i
6.12 IIPCI Failure No.12 - Normally Open Turbine Exhaust Valve Fails Closed...................
6-8 r
6.13 - IIPCI Failure No.13 Condensate Storage Tank /
Suppression Pool Switchover logie Fails 6-9 6.14 IIPCI Failure No.14 Minimum Flow Valve MO-2301 ;
(F012) Fails to Open 6-9 6.15 Other Failures 6-9 6.16 Human Errors 6-10 6.17 Additional System Considerations...,..........
6 10 i
8 P.EFERENCES....
8-1 APPENDICES A1
SUMMARY
- OF INDUSTRY SURVEY OF llPCI OPERATINO -
EXPERIENCE IIPCI PUMP OR TURBINE FAILS TO 4
START OR RUN...
A-1 l
A.2 SELECTED EXAMPLES OF ADDITIONAL liPCI FAILURE MODES
_ IDENTIFIED DURING INDUSTRY SURVEY,...
A-8 i,
a i
i-d 4
)
t 5
e,.
,, ~
,,--,,,..,,,..nn
.w-+-..,m,.,,.,,
n..,,,.,-,,_,
y n
t FIGURES Ficote No.
- Pace 2-2 21 Simplified ilPCI Flow Diagram.,....................
TABLES j
i l
Table No.
Lige.
4-2--
c 4-1 liPCI PRA-Based Failure Summary....
4-2 Pilgrim IIPCI System LER Survey Compared with-l Industry Survey 3 5-1 -I : grim IIPCI System Walkdown Checklist..
- 52 A-1 IIPCI Pump or Turbine Fails to Sta-t -
. A.2
]
Industry Survey Reruits.........
~ A-2 Summary of Illustrative Examples of Additional A-9 llPCI Failure Modes 4
4 d
e d
E
?
T 1
d vii f
r'T*
w
-W*v br Wr-"
y 1't t*p3 & ^im ww,-w wgN r
ur
'-M-*
yy itCi-rWM-7
-t'-'trui-'F t-*e-'
y WW r'r*fe'
-49'
. ^
h'
l StiMMARY This System Risk-based Inspection Guide (RIG) has been developed as an aid to llPCI system inspeaions at Pilgrim. The document presents a risk-based discussion of the HPCI role in accideni mitigation and provides PRA-based llPCI failure modes (Sections 3 and 4). Most PRA oriented inspection plans end here and require the inspector to icly on his experience and knowledge of plant specine and BWR operating history.
Ilowever, the system RIG uses industry operating experience, including illustrative examples, to augment the basic PRA failure modes. The risk-based input and the operating experience have been combined to develop a composite BWR HPCI failure ranking. This information can be used to optirnize NRC resources by allocating proactive inspection effort based on risk and industry experience. In conjunction, the more important or unusual component faults are reDeeted in the walkdown checklist contained in Section 5. This, along with an assessment of the operating experience found in Section 6, provides potential areaa of NRC oversig'at both for routine inspections and the " post mortems" conducted after significant failures. The two tables contained in the Appendix to this report contain detmled information on selected failures which have been experienced. This should be used by the inspector to gain additional insights into a particular failure mode.
A comparison of the Pilgrim and the industry-wide BWR, IIPCI failure distributions is p;esented in Tabic 4 2. Although the plant speciGe data are limited, certain Pilgrim components exhibit a proportionally higher than expceted contribution to total HPCI failures. The following components are candidates for greater inspection activity, and the generie prioritization should be adjusted accordingly:
turbine speed control; turbine stop valve; turbine control valve; turbine steam inlet valve; containment isolation valve.
As the plant matures, operational experience is assimilated by the utility's staff and reflected in the plant procedures. For example, the incidence of inadvertent HPCI isolations due to surveillance and calibration activities is expected to decrease. Conveisely,in time, aging related faults are expected to become a contributor to Pilgrim HPCI failure distribution. 'lhe operating experience section has identified several aging related failures at Arnold, Hatch, Cooper and
. Brunswick, generally in the pump and turbine electronics.
This report includes all HPCI LERs up to mid 1989. Subsequent LERs can be correlated with the PRA failure categotics, used to update the plant specine HPCI failure contribution and compared with the more static HPCI BWR failure distribution. The industry operating experience is developed from a variety of BWR plants and is expected to t.hibit less variance with time than a single plant. This informadon can be trended to predict where additional inspection oversight is warranted as the plant matures.
Recommendations are made throughout this document regarding the inspection activities for the HPCI System at Pilgrim. Some are of a generic nature, but some relate to specific maintenance, testing or operational activities at Pilgrim.
ix
~. -
l-B I
1.
The plant actions to monitor and control the temperature in the'llPCI toom should
- be reviewed, and the effect of the loss of room cooling on continued HPCI operation should be evaluated.
2/
\\Vithin the context of the tr;c of HPCI in an 'ATWS event, the capability of th'e.
licensee to perform the necessary bypaxies of the system logie should be evaluated periodically.
3.
The turbine exhaust rupture disks should be installed with a structural backing to prevent cyclic fatigue failures.
-I 4.
-The' inspector should confirm that the licensee acknowledges the complexity of the turbine speed control by having a trained staff to test and repair it.
?
5.
l..icensee response to NRC Bulletin 88 04 should be reviewed to determine if the design of the minimum flow bypass line is adequate.
h l'
i.-
_ _ _ - = _
l-i l
c'
.~a..-_,
.c-,-,-.--_-,--a,_,.--.-...--,
--._.ma_-.,--..c.-.._._--.-
. ~
. 2. - -
- ACKNOWLEDG EMENTS The authors wish to express their appreciatio_n to Dr. J.W. Chung, the NRC Program Manager for this project, for his technical direction, and to John hiacDonald, the Senior Resident Inspector at Pilgrim, and to Mr. Anton Cerne and Ms. Allison Keller, the NRC inspectors at Pilgrim, for their support during a visit to the site to validate the contents of this document.
We express our gratitude to the Boston Edison Company for their cooperation in exchanging information on this system, especially Messrs. R. Mattos, G. McCarthy, and T.
McElhinney, who provided us with detailed information on HPCI system moditications, operating procedures, and design data.
Finally, we wish to thank the members of the Engineering Technology Division of BNL for their review of this report, and to Mrs. Ann Fort and the Word Processing Department for preparing the manuscript.
N h
4 -
l l-xi I'
g ees
,. y y--
y-
-~.e-e
-h,, er w --
3.
,- ' wer 4
e w. -, -,~,
,v-,
-,.n,-
ww
-w,-
4.~
%-,r%
m-=-
t l.
INTRODUCTION 1.1 Purrese This IIPCI System Risk-Based Inspection Guide (S-RIG) has been developed as an aid to ARC inspection activities at the Pilgiim Nuclear Power Station. The iligh Pressure Coolant Injection (llPCI) system has been examined from a risk perspective. Common BWR accident sequences that involve HPCI are described in f etion 3 both to review the system's accident mitigation function and to identify system unavailability combinations that can gicatly inercase risk exposure. Section 4 describes and prioritizes the PRA-based ilPCI failure modes for inspection purposes. A review of UWR operating experience review is presented in Sections 4 and 6 to illustrate these failure modes. This inspection guide also provides additionalinformation in related areas such as llPCI support systems, human errors, and system interactions (Section 6). A summary and list of references are provided.
1.2 Application to inspections This inspection guide can be used as a reference for routine inspections and for identifying the significance of component failures that occur at Pilgrim. The information presentcd in Sections 4 and 5 can be used to prioritize day-to-day inspection activities. This S-RIG is also useful for NRC inspection activities in a response to system failures. The accident sequence descriptions of Section 3 in conjunction with the discussion of multiple system unavailability (Section 6), provide some insight into the combinations of system outages that can greatly increase risk. The operatim; experience review provides some of the more important failure mechanisms (including corrective actions) that are useful for the review of licensee response to a system failure. This system RlG can also be used for trending purposes. Table 4-2 provides a summary of the industry wide distribution of IIPCI failure contributions, and presents a comparison of the Pilgrim IIPCI failure distribution with industry experience. Certain HPCI failure modes (i.e., turbine steam inlet valve failing to open, turbine stop valve and control valve failures, and tutbine speed control faults) appear to account for a disproportionate fraction of the Pilgrim IIPCI system fa3ures and are candidates for increased inspection activity. The:m areas shonhl be reviewed periodically as additional plant operating experience is compiled.
11
2, llPCI SYSTEM DESCRIPTION The Pilgrim liigh Pressure Coolant injection (llPCI) system is a single train system consisting of steam turbine-driven injection and booster pumps, a barometric condenser, piping, valves, controls, and instrumentation. A simphned How diagram is shown in Figure 2-1. The system is designed to pump a minimum of 4250 gpm into the reactoi vessel over a range of reactor pressures from 150 to 1000 psig when automatically activawd on a reactor water levellow-low ( inches) or drywell high pressure (2.5 psig) signal, or manually initiated from the control room.
Each automatic initiation signal is "one-out-of-two-twice" logic. Two sources of cooling water are available. Initially, *he HPCI pump takes suction from one of the two condensate storage tanks (CST) T-105A or T-105B through a normal;y opta motor-operated valve MO-23016 (F004)'. The pump suction automatically transfers to the suppression pool on low CST level c. nigh snnpression poollevel. This transfer is accomplished by a signal that opens the suppression pool suuon valves MO 2301-36 (F042) and MO 2301-35. Once these valves are fully open, valve-position-limit switch contacts automatically close the CST suction valve. Events that raise the suppression pool temperature above the HPCI system design limit for suction source temperature may require a manual suction transfer back to the CST.
Upon llPCI initiation, the normally closed injection valve MO-2301-8 (F006), automatically opens, allowing water to be pumped into the reae:or vessel through the main feedwater header. A minimum-flow bypass is prov;ded for pump protection. When the bypass valve MO-2301-14 (F012) is open. How is directed to the suppression pool. A full-Dow test line is also provided to recirculate water back to the CST. The two isolation valves, MO-2301-10 (F008;.nd MO-2301-15 (F011), are equipped with interlocks to automatically close the test line (if open) upon generation of an HPCI j
initiation signal.
The llPCI turbine is driven by reactor steam. The inboard and outboard HPCI isolation valves in the steam line to the HPCI turbine (MO-2301-4 [F002] and MO-2301-5 [F003}) are normally open to keep the piping to the turbine at an elevated temperature permitting rapid st:.rtup. Upon receiving a signal from the llPCI isolation logie, these valves will close and cannot be reopenT until the isolation signal is cleared and the logic is reset. Isolation valve MO-2301-4 (1002) is pm red from 480V AC MCC B-17A and controlled by isolation logie system A; isolation valve MO-230i-5 (F003) is powered from bov DC im D 9 and centrolled by icolation logie system B.
Steam is admitted to the HPCI turhine through supply valve MO-2301-3 (F001), a turbine stop vah 9-2301-1, and a turbine control valve, all of which are normally closed and are opened by an l'
. initiation signal. Exhaust steam from the turbine is discharged to the suppress;on pool, wane condensed steam from the steam lines and leakage from the turbine gland seals are routed to a barometric condenser E 202 (E-036).
' Standard GE valve designations are given in parentheses in this system description.
I 2-1
4-Main Reactor Steam A
Corxlensate 2
I St age Feedwater MO-23015 MD-13017
, (F003) h-(F005)
From RHR
^&-
u CK-230174 MD-2301-4$
Suppression (F066)
()Sl9) yo.23018 i-Pool 3
(F006)
L.O.
, M0-23016
, Stm. Suppiy (F001)
, MO-23013
&O (F001)
MO-230139
\\' F019 (Fat 5) ll Turb. Stop
-x MO 230136 M0-230135 VGt2)
BWer M3'"
l Turb. Cntri.
Pump N
E
-s ---C 1;irbine 7 Total Leakoff To Stand-by (F059)ll PVC 0
ir System
_el
@7r C--r......
1 i, __ x RO.
Vanum (two; h
Lube
, MO-2301-14 i
og (1012)
R0 t'S?) @
Croler Q
' Min. tiow tme
R0
.hFE System Test Line MO-23019 i (F007) f l
-<---M M ::
+
i MO 2301 15 MO-2301 10 Fr m RCIC (F011)
(F008) l l
l Figure 21 Simplified IIPCI Flow Diagram 22 l
i i
w v
+
3.
ACCIDENT SEQUENCE DISCUSSION The role of the HPCI system in the prevention of scactor core damage is valuable-information that can be applied in the normal day-to-day inspection activities.' If a plant has its own Probabilistic Risk Assessment (PRA), this information is usually available. However, not all plants have PRAs. Thus, eight representative BWR accident sequences based on a review of the available PRAs have been developed based on design and operational similarities that can be applied to other BWRs for risk based inspections'. These eight representative sequence account for an average of 87% of the core damage frequency for seven BWR plants. Since the HPCI contributes to five of the eight representative sequences, this information can be used to allocate inspection resources commensurate with risk importance and allow the inspector to focus on the important systems / components, f
3.1 loss of Hich Pressure Iniection and Failure to Depressurize i
This sequence is initiated by a general transient (such as MSIV closure, loss of feedwater, or loss of DC power), a loss of offsite powu, or a small break LOCA. The reactor successfully scrams. The power conversion system, including the main condens: r, is unavailable either as a direct result of the initiator os due to subsequent MSIV elosure. The high pressure injection systems (HPCl/RCIC) fail to inject 'into the vessel.
The major sources of HPCI/RCIC unavailability include one system disabled due to test or maintenance and system failures such as turbine / pump faults, pump discharge valve or steam turbine inlet valve failure to open. The CRD hdnmlic system can also be used as a source of high pressure injection (HPI), but the failure of 4
- e second CRD pump or unsuccessful flow control station valving prevents sufficient reactor pressure vessel (RPV) injection. The operator attempts to manually depressurize the RPV, but a common cause failuie of the safety relief valves (SRVs) defeats both manual and automatic depressurization of the reactor vessel. The failure to depressurize the vessel after HPI failure results in core damage due to a lack of vessel makeup.
3.2 Station Blackout (SBO) with hitermediate Term Failure of Hich Pressure inicetion This sequence is initiated by a loss of offsite power (LOOP). The emergency diesel generators (EDGs) are unavailable, primarily due to hardware faults. Maintenance unavailability is a secondary contributor. Support system malfunctions inclut EDG room or battery /switchgear room HVAC failures, service water pump, or EDG jacket co - a hardware failures. HPCI and RCIC are initially wailable and provide vessel makeup.
The high pressure injection systems can provide makeup untih the station batteries are depleted, or the system fails due to environmental conditions, i.e., high lube oil temperatures or
+
high turbine exhaust pressure due to the high suppression pool temperature and pressure, or the RPV is depressurized and can no longer support HPCI or RCIC operation.
+
31
the llPCI high area teinperature logic isolates the system or long term exposure to:
high temperatures disables the turbine driven pump..
Plant procedures should address means to maintain DC power for as long as pcssible;to assure a continued source of water to the llPCI or_ RCIC. These procedures should also provide contingency measures (such as supplying fire water via RliR system) if_ the SBO progresses until reactor pressure (decay heat) can no longer support ilPCI or RCIC. The plant procedures should also be consistent with the BWR Owner's Group Emergency Procedure Guidelines.
".he reactor building environmental conditions can also impact loi g term IIPCI system operation. The reactor building HVAC and IIPCI_ room cooling are dependent on AC power.
There is the possibility of spurious activation of the steam line break detection logic, and although the high. area temperature isolation logic may be-inactive-during SBolonditions, there are potential environmental qualitication concerns at elevated temperatures. 'Ilhe plant actions to monitor and control high area temperature, during an SDO, should be reviewed including any calculations necessary to establish a time frame for the implementation of these actions.
3.3 Station Blackout with Short Term Failure of liigh Pressure _ injection This SBO sequence is similar to the previous sequence engt the high ' pressure injection systems fail early. The sources of emergency AC power,- i.e., the imergency dicsci generators (EDGs) fail primarily due to hardware failures. Secondary contribators are: - output breaker -
failures and EDG unavailability due to test or maintenance c.cd<ities.
Support - system maitunctions, such as service water failures in the - EDG. jgeket ' cooling water--- train.-
battery /switchgear room IIVAC failures, or test and maintenance unavaliability are significant contributors to the loss of emergency on-site AC power.
f L
Station battery failures (including common mode) are an important contributor to this sequence, because HPI systems and 'he EDGs are DC power dependent. In the SBO sequence, IIPCI unavailability is dominated by turbine / pump failures and maintenance unavailability. Core damage occurs shortly after the failure of allinjection systems.
3.4 ATWS with Failure of RPV Water Level Control at liigh Presnu i
This: sequence is initiated by an anticipated transient:with initial or subseqaent MSIV; closure and a failure of the reactor protection system to scram. Attempts to manually scram are not successful; however the Standby Liquid Control System (SLCS) is initiated. The condenser and the feedwater system are unavailable. The BWR Owner's Group Emergency Procedure Guidelines (EPGs) recommend RPV-water levt reductions for control of reactor power below 59F and the BWR representative sequence was based on that philosophy.
This sequence postulates a failure to ensure sufficient RPV makeup at high pressure to pre.
l vent core damage. There are two failure modes:
3-2 YI em m g - w< r g ne - "
r
- ~-n
& v "m w
-'m n
4 N w v~
~'
v' e -W MM*w v&+
-^*
W'w*~+*~*~*'*-k"*
p 4
.e r y -.
- wor, weecW "mo.?
uwe g
-~
r 5
- 1.
The operator fails to control water level at high RPV pressu e. This result's in high core power levels, continuous SRV discharges and suppression poel heatup. After l
the suppression pool reaches saturation, containment pressurization begins. liigh
- i
[
pressure. injection fails. due to.high suppression pool temperature pnor. to I
/
containment failure.
i 2.
The high pressure injection (llPCI) system fails, primarily'due to pump failure to-start or testing and' maintenance (T&M) unavailability.1njection or inflow valves,
^
suction switchover, or loss of DC power are other potential system failures. IIPCI J
I pump failure to start or run, pump unavailability due to testing and maintenance activities, and Service Water EDG jacket cooler inlet or return valve failures are the major system failures.
The inability to maintain RPV water level above the top of the active fuel (TAF) requiri.,-
manual emergency depressurization tha_t is expected to result in core damage before the low pres-i sure ECCS can inject.-
The continued operability of lipCI during aa ATWS event is critical. Within the context of this accident sequence (i.e., time available for success) the licensee capability to perform thc logic bypasses should be evaluated periodically. With regard to HPCI system availability, the remaining sections will discuss system failures and availability evaluation.
3.5 Unisolated 1.OCA Outside Containment The initiator is a large pressure boundary failure outside' containment with a failure to isolate the rupture. (This sequence is also termed interfacing systems LOCA.) The pipiug failure is postulated in the following systems: main steam (50'?c), feedwater (10%), high pressure injection (33'7c), and interfacing LOCA (7%). The percentages indicate the estimated ielative core damage contribution of each system?.
. An interfacing LOCA initiator is defined as the initial pressurization of a low pressure line which results in a pressure boundary failure, compounded by the failure to isolate the failed line.
The failure is typically postulated in a low pressure portion of the core spray (CS) system, the LPCI, shutdown cooling and (to a lesser extent), the HPCI or RCIC pump suction.
The unisolated LOCA outside _ containment results in a rapid loss of the reactor coolant system (RCS) inventory, eliminating the suppression pool as a'long term source.of RPV injection.
These piping failures in the reactor building can 'also result -in unfavorable environmental-conditions for the ECCS.' Unless the unaffected ECCS systems or the' condensate system are available, long term RPV injection is suspect and core damage is likely.
. There have been several HPCI pump suction _overpressunzation events, primarily during_
surveillance testing oc the normally closed pump discharge motor-operated valve MO-2301 :This is of particular concern for the' discharge configuration with a testable air-operated check i
valve in addition to the normally closed MOV because of the valve's history of back leakage. The.
Pilgrim Station, however, does not use an air-operated check valve in their HPCI system.
3-3
~
~ -.
- The liPCI interfacing LOCA initiator seems to be less of a problem with the configuration of a normally closed h10-23018, primarily because another normally open hiO-2301-9 is closed prior to the MO-23018 surveillance. Ilowever, the concerns of the previous configuration are also valid here. There must be reasonable assurance that the normally closed MO-2301-8 valve is leak tight during plant operation and, prior to stroke testing, confirmation is necessary to assure MO.
2301-9 is fully closed and will provide the necessary protection for the upstream piping.
1 3.6 Overall Assessment of IIPCI Imnortance in the Prevention of Core Damace As previously stated, the high pressure injection function (HPC1/RCIC/CRD) contributes to five of the eight representative BWR accident sequences. The system failures for all eight BWR se iuences were prioritized b their contribution to core damage (using a normalized Fussell Vesely
/
importance measure). The I-IPI function in agregate was in the high importance category. Other high risk important.cystems are Emergency AC Pow.;r and the Reactor Protection System. The 11PCI system itselfis of medium risk importance, because of the multiple systems (e.g., RCIC and s
CRD) that can successfully provide vessei makeup at high pressure. Far comparison, other systems with a medium risk importance are; Standby Liquid Control, Automatic / Manual Depressurintion, J
Service Water, and DC Power.
3 i
t f
i' i
s l
l l'
l-l 34 l-l y
,.m w
{
g--
yWg-t w,
y 4D w
etw vn-ty-t'r y
4-y+rw-u--
o eg-e-
-N Y
-M"
M R-1-'
4
'"T-N'-
-wMT-
+
m T
5'-*
- --*'t18' d
t
4.-
PRA. BASED IIPCI FAILURE MODES PRA models are often used for inspection purposes to prioritize systems, components and human actions from a risk perspective. This enables the inspection cffort to be apportioned based on a core damage prevention measure called risk importance. The IIPCI failure modes for this system Risk-Based Inspection Guide (System RIG) were developed from a review of BWR plant specific RIGS", and the PRA Based Team Inspection Methodologf. The component failure modes are presented in Table 41, grouped by risk significance. There are four failure modes of high risk importance, four of medium risk impoum.cc and 15 oflower risk importance for a total of 23 failure modes. -The Fussul-Vesely importaaec Measure has been used to determine these rankings.
This importance measure comb'acs the risk signi6cance of a failure - mode or unavailability with the likelihood that the failure mode / unavailability will occur.
PRAs are lest helpfulin the determination of speci6e failure modes or root causes and do
-1 not generally provide detailed Inspection guidance. This makes it necessary for an inspector to draw on his experience, plant opereng history, Licensee Event Reports (LERs), NRC Bulletins, Information Notices and Genene Letters, INPO documents, vendor information and similar sourecs to conduct an inspection of the PRA-priorhized items.
Information useful_ for prioritization of inspection resources has been obta;aed by performing an operating experience.
review inJustry experience related to PRA derived failure modes for the HPCI system. Licensee Event Reports (LERs) generated between 1985 and mid 1989 were surveyed for HPCI related fr.ilures and approximately 200 were identified. Sixty-two LERs did not have a PRA-based failure-mode; these LERs generally documented systemL challenges, administrative deviations, and seismic / equipment quali6 cation concerns. The remaining 140 LERs documented 159 HPCI faults or degradations. As presented in Table 4 2, these failure modes have been categorized by.PRA failure mode to provide a relative indication of the contribution to all HPCI faults.
The failure rankings shown in Table,4-2 were estimated based on PRA-based rid importances, operational input, and current accident rmnagemeni philosophy, lhe failure mode identified as HPCI pump or turb:ne fails to start or run was ranked as "high risk importance" (Table 4-1) and also accounted for the largest number of LERs related to the HPCI system identified in the industry survey. Thus, as shown in Table 4-2, th_is failure mode was analyzed in greater detail to identify the various causes listed in Table 4-2.
A' summary of the signi6 cant causes of this failure mode are provided in Appendix A-L In addition, selected examples of all other PRA-based llPCI failure modes are provided in Appendix A 2.
A more extensive LER analysis has been completed for ine Pilgrim Plant. For Pilgrim,'all LERs documented between 1980 and 1989 were reviewed to identify failures applicable to HPCI The results of this review, tabulated in Table 4-2, indicate that several failure modes show a higher percentage of occurrence than the industry survey results. These failure modes ate.
- HPCI Pump er Turbine Fails to Start or Run due to:
L turbine speed control faults
- 2. turbine stop valve failur_c
- 3. turbine centrol valve faults
- 41
.~
- Turbine Steam inlet Valve Fails to Open
- Containment isolation Valve Fails Closed The entire survey of Pilgrim operating experience is discussed in Section 6.
Table 4-1 IIPCI PRA.:'ased Failure Summary Ilich Risk Imrottance 4
Pump or Turr 'ne Fails to Start or Run' System Unavailable Due to Test or Maintenance Activities
- Turbine Steam inlet Valve MO-2301-3 (F001) Fails to Open*
Pump Discharge Valve MO-2301-8 (R)06) Fails to Open*
2 Medium Risk Importanel CST / Suppression Pool Switchover Logie Fails' Suppression Pool Suetion Valves MO-230136 (R)42) or MO-2301-35 Fail to Open*
Normally Open Pump Discharge Valve MO-2301-9 (F007) Fails Closed or is Plugged l
Minimum Flow Valve MO-2301-14 (F012) Fails to Open, Given Delayed Activation of Pump Discharge Valve, MO 2301-8 (F006).*
Irwer Risk Imnortance CST Suetion Line Check Valvt (F019) Fails to Open l
CST Suetion Line Manual Valve 2301-22 (F010) Plugged Normally Open CST Pump Suetion Valve MO-23016 (F004) i Fails Closed or is Plugged Pump Discharge Check Valve 2301-7 (F005) Fails to Open (Flow Back) or Fails to Close (Interfacing LOCA)
Suppression Pool Suetion Line Check Valve 2301-39 (F045) Fails to Open Normally Open Steam Line Containment isolation Valve MO-2301-4 or -2301-5 (F002 or l
F003) Fail Closed Steam Line Drain Pot Malfunctions 1
Turbine Exhaust Line Faults, including:
- Normally Open Turbine Exhaust Valve 230174 (F066) is Plugged
- Turbine Exhaust Check Valve (F049) Fails to Open i
Turbine Exhaust Line Vacuum Breaker (F076,077) Fails to Operate False High Steam Line Differential Pressure Signal
- False liigh Area Temperature Isolation Signal
- False low Suetion Pressure Trip
- False High Turbine Exhaust Pressure Signal
- i.
System Actuation Logie Fails' Suetion Strainer Fails to Pass Flow
' Indicates a failure mode found in the Pilgrim operating experience review discussed in Section 6.
i-42
(*
l!
l
]l l
s s
4 4
4 moC
)
"(<
n o
i tu bir 3
0 0
o 3
5 0
3 0
0 4
1 2
1 J
tnoC er y
u es li m
a ru F
i S
r y
lg tr iP su
's d
e n
ru I
l h
ia s.
F 0
f 3
0 0
0 3
1 0
3 0
0 1
d o
e r
r e
a b
p m
n n
u oC N
yesru 2
S g
n R
ik I
n I
a 1
m R
e er ts u
y l
S ia I
F T
I I
I
)
m i
"v e
(
lg e 'n i
r o l'
i i I
0 e
2 l
tu I
i 7
5 4
3 3
3 2
1 1
6 ab 4
Fi r s
e t
R n
l M
C b
o a
T I
llA f
{
reru l
i 8
7 5
5 5
3 2
2 6
a 6
4 1
F 1
1 fo s
g e
d e
n i
o t
a e
u s
in n
l s
i b n tr l
n s
r e
l w
n o
u r
l l
o lo o
a u
r u a
d e
u ia s
t R
uR m
f t
f e
r b
l f
p T
c e
o a
s a l
l h
i t i ir s
uf o
g r,
r y
r p
r e p
p ak f
tr i
ih in A
g oI m
r o d
lp s
s fe o
cs o
e t
p trT o
h s o
m x
d ss e
e el ir t
ed pa a p
u D
s b s i r
s lu l
t SIaU i <
mt r
l u o s
s t
s t
e l
s.
g t
n a
e uS e
i e
r r s e s e er o
e r
p e e n e n
f u
P o i t
o i t
tr i u i
t i
t s
s r sS r
u c
n n
n ol s
o
.n s
r U
t t
l I
bl e
b e e
p w
hl ci u
b i
Cl r u b
r s s
l bli ur u o
i u s
a s
i u a u a o
r uu l
F Pi t f l
t r
i f t f t
r f
t f l
nd i
u a u
u e n a l
a a
II F F
Y*
llI Il'>Il tflllI
!Ilf1(
f',
,I l
lf
,!,!Il!i ll ii
- i'
.,3
^
m
^-
s tn w
m 9
7, 7
7, 9
e 7,
4 N
t I
5 5
5 5
5 m
oC
~
no i
tub ir N
t 5
5 5
5 0
0 0
0 0
0 5
i I
m C
eru m
i l
i Fa r
lg i
l'
's eru i
l a
F f
1 1
4 I
1 0
0 0
0 0
0 1
o re b
m u
N
'g t
n ik na R
2 3
4 5
6 7
N 9
0 1
2 3
1 1
1 1
e ru l
i a
F
)
4'(
'n o
i 7
1 l
1
. 4 6
5 5
2 3
2 1
t 2
u b
S ir R
tn W
o B
C L_
lA s
eru ila 3
0 N
N 3
4 3
2 1
I i
6 f
4 1
fo eu e
e ic e
I.
l n
n i
s n
d n
s g
o J e o
l n
s o
i e
o a e n
~
b
%i n
t t
s a
i e
I r
e r
l F
l t
s V p o
l o
i T
a' ni l
.e t
ms i
eo it d
ip 5t s
u lnl a
n n
ul 1
i i
p
)
f e
m a o i
b F'
. oi bl O a i s
I r
a c
't c
li i
a e g o a'
i r
c t
s eI t
rl n
g mF e
s
'r r
ta p
u a e
e' is e s
s i St I a
)
h l e
t r
I e o s
n t
s u
Ae u ir g
el nl a
o k
Tn ps s
t s
r S
C nA h l t O ci tnI t
h u T
hi Oal
. r r a c e I s
I oal a
c V
pe s a I
(
e U
igi S b i F sT A'
igt me igS ly isVi r
t eI D
a p>
e I
n t
r 2
u s nF el u
l t
l t
'4 l
m%
i el in(
)
ml m:
r s
s u n e
l l
I I
f u
a ud r o)
S/d pi2 r a e n pm eI ic li
.l e&
e e ia e pa e s e a n a i
e b
t lsf n b
s
. s m
.Tl mn l
s l
h r h o i
t 4 tsT s
s s
h e ic F
t l
s uW pc r
si g
e uuW ai ig p
f a r a x o xl S u u a a
S t
FDS TVO l'
(
SF S l'a
'l TS F
' SS(
y a y
a ei o
I T
pu
- i..
J J
~
i
,ji h:
- }i'jj
x i
}fii4 Ijl[
f;'-
,i
L ts ne 0
m 1,
m 6
oC
+
no i
tu b
ir tno 0
C eru l
ia im F %
rg N
I
'se ru l
ia F
f 0
o
.r e
b
.m uN 8 g-n ik naR 4
1 eru l
ia F
)
9
'no i
t 3
u eb S
r ir R
lut W
ina o l
FC I
l lA seru l
ia 5
F fo no e n i
he t
)
ip a p VO r
d c
mto s
't e
n D
Wls oC e
i mFa r
(
u l
u 2
i m2
)
4 a
i l F
le in)
T b
MI
(
aT u
, ~
, i:,
4 q
4 4
!ik I
4
- I jI
}
- 4
!2 4
4; i i 1
4
_._ _.. _ ~ - -.. _.. _.
. Table 4d Notes 1.
Failure contribution is expressed as a percentage of all signilicant ilPCI failures as developed by the Operating Experience Review.
l 2.
. Failure ranking is a subjective prioritization based on PR A and operational input, recovery l
potential, current accident management philosophy and conditional failures, as applicable.
3.
Pilgrim significant ilPCI failures are based on a review of all available LERs (1980 to 1
1989).
1 4.
Although some caution is warranted due to the limited plant specific data, this failure mode j
seems to comprise a disproportionate fraction of the Pilgrim IIPCI unavailability. This j
area is a candidate for enhanced inspection attention.
5.
Failure importance was upgraded from the PRA-based ranking of Table 41.
6.
Failure importance was downgraded from the PRA-based ranking of Table 4-1.
7.
IIPCI isolation and trip logies are significant contributors to unavailability. The systeni can be isolated by a single malfunction, yet instrument surveillance intervals can be greater than the more reliable actuation logie.
I 8.
- Unlike the system trip and isolation logie, the actuation logie arrangement (one out-of two.
i twice) diminishes the importance of a single instrument to reliable system operation. At' le,.st two low RPV level or two high dryv. ell pressure sensors must fail.
4 4-9.
The latest BWROG Emergency Procedure Guidelines deemphasize the suppression pool as an injection source, 10.
Conditional on the delayed opening of the pump discharge line valve, F006.
11; UnN thi rest of the failure modes listed herein," Systems Interactions"is not PRA-based.
It wa. identified as n significant failure mechanism during the operating experience. review--
i and is discussed in Section 6.
l' e
I a
4
+
N
_ 6 4
L r
a v.~m,','---,,r,
-v.,n,-
~
,,-4 r
v-%, e -er-n ae-x, e-
.mor -m e - N. --ren a -,-
'e u, n
- m. wn,
l-, w, N -+
,-r,-.,-e-y,-w,~
w-,
w - se m 60-
.r
+ ~
w",,v~
5.
IIPCI SYSTEM WAl.KDOWN CllECKl.lST IW lt!SK IMPol(TANCE l
Table 5.1 presents the llPCI system walkdown checklis; for use by the inspector. 'rhis' information permits inspectors to focus their efforts on components important to system availability and operability, Equipment heations and power sources are provided to assist in the review of this SyStent.
j..
4 3
4 f
i
+
h k
1 f
i i
i e
i 4
5 4
5-1 i
. -.. ~,
.,. ~,
~. - -.
m i
l' t
1 r
t i
Table 5-1 Pilgim HPC' System Walkdown Checklist i
l 1
-~
(
D senption ID NO.
Location Poner Source.tnd Locati<.m.
, Standby Actual i
Ibsition Positim i
. A.~ Cwoonents ofIfigh Risk Significance Note: All circuit breakers should be c!med (G@
TurNne Steam holatic vahv MO-2391 ~
IIPCI Rae - East Panet D9 Rx' Iddg. 23*. N. 72-944 Gosed h
i SJe d TurNnc
. i 4
MP ' ' '-4
.Drywell-En. 40' NW Panet B"7 Rt B!Jg. 2T. Ukr.1764 Open f
i Inboard Steam Lo!ation Valve t
]
Outboard Steam Ise!ation Vahr -
MO-2301-5
'Ir Rl!R Vahe Raw Pane: D9 - RX BIJg. 27. W. 72-Open I
l
- Rx. Bkit. Il 23' 951 l
L Trp Rae Panet D9 + Rx Hldg. 23*. W. 72-95e-Ckned i
{
3!
Itmp Inboard D:srha ge Vahe-M O J 'i-8
!!PCI Inverter Control Room Panel D5 N.13 4kV SWGR Ram, On
,? :
Il 37 l
4
^'
f B. Canponents of Medium Risk Significance a
2-CST Suction Isolati<w Vah e MO-2301-6 Aux Pay. Il T North.
Panel D8. Rx Bkig. 2T. Bkr. 72414 Open i
4 B B:v t
~
N. Pump Outboard Discharge Valve MO-2301-9 IIPCI Room - South Panet D9. Rx B!dg. 2T. Ukr. 72-964 Open l
l WaII i
P2mp Mini:num ITow Vahr.
MO-2301-
!!PCI Rmm - Fast Panel DM. Rx Bidg. 27. Bkr. 72-821 Ckwd i
4 14 Wall l -
r 4
j '
INrry Suctkm fiom Suppression Poc4 MO-2W1-IIPCI Room - East Panel D8. Rx Bldg. 2T. Ukr. 72424 Cawed (2 Valves) 35.36 Side 72431 i
Fut...w Test Valve to CST MO-236i-IIPCI.he Entrance Panci D9. Rx BIdg. 27. Ukr. 72-971 Ckned e
10 t
L
. I I
l NOTE: Maintenznce er testing of the :bove components i-important ta c=crall IIPCI avai! ability and operaN1ity. The inspector simuld va5date maintenance and i
- testing ae.tnities on these cunponents as time permits. Omtral > rom annunciators and panel status lights shouk! aho be checked peridica iy for a quick l
appraisal of IIPCI system status.
l
,9 I
. I l
br
6.
OPERATING EXPERIENCE REVIEW An operating experience review was conducted to integrate the recent industry experience of all operating BWRs with PRA derived failure modes for the llPCI system. The period 1985 to mid 1989 was scaiched for llPCI LERs and approximately 200 were identified. Sixty-two LERs did not have a cor.xponding laibue rnde. 3ese LERs generally documented successful system challenges, administrative deviations, or seismic / equipment qualitication conectns. The remaining 140 LERs documented 159 llPCI faults or degradations. As presented in Tables A.1 and A.2, these failures have been categorized by PRA failure mode to provide a relative indication of their contribution to ailllPCI fau". Twenty.three PRA failure modes had corresponding failures in the data examined. Each of these PRA-based failure modes is discussed below, in addition to the industry operating experience tr, ew, the failure experience of the Pilgrim Plant was surveyed over the period 1980 to 1989. This information is integrated into the discussion of each IIPCI failure node provided in the following paragraphs, s
6.1 llPCI Failure No. ) - Pump or TurbineJ2jb to Stat or Run The major contributor to itPCI system unavailability, both from a risk and operational viewpoint,is the failure of the turbine driven pump to start or continue running. This failure mode includes many interactive subsystems and components that can make root Jause analysis and component repair a complex task. For the purposes of this study, this failure has been defined us.
those components or functions that directly support the operation of the pump or turbine. Tbc
- llPCI Pump or Turbine Fails to Start or Run" basic event accounted for 64 failures or 40% of the llPCI faults in the industry operating experience review.
Thus, this failure mode has been broken down in the subcategories summarized in Table 4 2. Representative LERs for each of these subcategories are summarized in Appendix A 1 along with the most likely root cause, the corrective action taken in each case, and any applicable comments. This information should provide the inspector with additiorial insight into the particulars of each subcategory.
6.1.1 Turbine Speed Control Faults
& turbine speed is controlled automatically by a control system consisting of a flow controller and an cicetro hydraulie turbine governor. The turbine governor system receives the flow controller signal Nput and converts it into hydra;. lie-mechanical motion to position the governor (contml) valve. The system has a " ramp" generator which upon turbine start, will control the acceleration rate up to a speed relative to the tiow controller output signal. The " ramp" rate is periodically calibrated by instrumentation and controls technicians. A sununary of the turbine speed control failures identified in the industry LER surveris provided in Appendix A.1.
61
.l
4
+
i 1
1 j
De following events related to turbine $need control faults were identified in the expanded l'
LER search for Pilgrim:
-i l.
s L
Failure was attributed to the ramp gen:rator and signal converter. His ever.' (LER 89 i
j 028) occurred during a surveillance test when a mechanical overspeed trip was generated i
i by the failure of the ramp generator signal converter module. Discussion with the licensec l
j system engineering during a recent visit to the site. revealed that subsequent analysis j
indicated that the root cause of the overspeed problem was a sluggish mechanical system.
4 J
A new pilot relay spring was installed under PDC 90 65 which more effenively regulates the control valve position.
i
-c
{
2.
Two failures affecting the Pilgrim imbine speed control system were identified. LER 80 085 describes a turbine overspeed event that was caused by a failure in the turbine i
r governor and a faulty resistor in the turbine speed mntrol circuitry.
Ikith failed I
components were replaced and operational testing was c3mpleted successfully, in the i
second event (LER 85 012) a faulty cor nector in the iubine control system caused a turbine overspeed condition and n turbine trip. The failed connector, considered an j
isolated car.e. was replaced and the system testing was completed.
l j~
6.1.2 1 ube Oil Sunnly F.;ults i
There were no failures of the lube oil rupply system identified for Pilgrim in the expanded i-LER search back to 1980, i
j 6.1.3 IJubine Oversoced and Auto R(met Probinns l
De mechanical overspeed trip function is set at US percent of the _ rated turbine speed. At j
most facilities, the displacernent of the emergency governor weight lifts a ball tappet that displaces l
a piston, allowing oil to be dumped through a port from the oil operated turbine stop valve. His action allows the spring force acting on the piston inside the stop valve oil cylinder to close the stop valve. The overspeed hydraulic device is capable of automatic reset after a preset tim _e delay.
E At Pilgrim, a redesigned tappet assembly has been installed which replaces the original bast tappet.
3 as per G.E. 516392 Revision 1.
f 4
The expanded LER search for. Pilgrim did not identify any additional events in this e
j category.
4 p
l 6.1.4 JJPCI inverter Trios or Faihnes e
The IIPCI invertu s powered from a 125V DC bus and' ultimately' powers the turbine speed contro' circuit. The results of the industry survey ofinverter failures is provided in Appendix :
A.1. One 11! Cl inverter tiip was identified during the review of Pilgrim LERs back through 1980.
This trip was attributed to fluctuations in the input DC voltage and not considered an inverter failure.- This vent is discussed in Section 6.16.2c A n'cw inverter was installed at Pilgrim in 1991 under PDC 91-63. This inverter, located
- under th" liPCI controls in the control room, has on automatic reset feature following' an abnormal input voltage condition.
6-2 w
,,,m,i,,w-,,v.a ww~w rv
-+ + e < w - ar w e, u =-r
_ _ - - - ~ _
j I
1 I
l 6.1.5 Turbine Stoo Valve Failures The turbine stop valve !!V 23011 is located in the steam supply line close to the inlet j
i l
connection of the turbine. The primary function of the valve is to close quickly and stop the flow j
of steam to the turbine when so signaled. A secondary function of this hydraulicallyoperated valve is to open slowly to provide a controlled rate of admission of steam to the turbine and its
[
governing valve.
The following three reportable events involving liPCI turbine stop valve failures took place at Pilgrim since 1980:
1)
LER 82 006 describes the failure of three out of four cap screws that attach the i
main disk flange to the main disk of the turbine stop valve. Separation of the flange from the disk would cause the main disk to remain closed and prevent initiation of the llPCI, The cap screw failures were attributed to overload conditions caused by the steam balance chamber being out of adjustment resulting in caratie valve operation. The licensee developed a procedure for adjusting the steam balance chamber based on GE SIL No. 352.
2)
LER 83 039 reports the failure of the turbine stop valve to open in the required time during startup surveillance tests. The cause of this event was attributed to a deteriorated orifice plate gasket in the hydraulic control system a the stop valve.
The stop valve operated satisfactorily following replacement of the gasket.
3)
LER 83 048 reports the failure of a turbine stop valve to operate during the investigation of an overpressure condition in the llPCI system. _The valve failure was caused by a failed coil in the stop valvo control unit; the system was returned to service following replacement of the coil.
6.1.6 Turbine Exhaust Runture Di:,k Failures i
The llPCI turbine has a set of two mechanical rupture diaphragms in series which protect the exhaust piping and tune easing from overpressure conditions. When the inner disk ruptures, pressure switches cause turbine trip and IIPCI isolation signals. Low pressure steam flows past the ruptured diaphragm through a restriction orifice directly into the torus compartment. Rupture of the second disk would vent the turbine exhaust into the torus compartr.1cnt without flow restriction.
The nominal rupture pressure is approximately 175 psig.
Two other failures, including one that occurred at Pilgrim, (LER 85 008) were attributed to water hammer due to carryover from the exhaust line drain pot.- ~ Design changes were implemented at Pilgrim to alleviate the potential for turbine;overspeed and subsequent water hamma whi.:h included the-installation of vacuum breaker valves 2301-33 and 34 in series with check ' valves 23.CK 232 and 233, in thefturbine exhaust to _the torus.. AEOD; Report E402"-
providu, additional, earlier examples of turbine exhaust rupture disk failures, 6.
4
--..,-.,...-.w.~..._._..
6.1.7 Flow Controller Failures The flow controller in conjunction with the electiohydraulie turbine go.ernor controls turbine speed and pump 110w.The flow controller senses pump discharge flow and outputs a 10 to 50 milliamp signal to the turbine governor to maintain a constant pump discharge flow rate over the pressure range of operation.
Pilgrim did not report any incidents involving flow controller failures.
6.1.8 Turbine Control W!ve Faults Pilgthn reported two events (LERs80-060 and 85-023) involving the tuihine control valve.
Ikith events involved steam throttle valve oscillatioris; however, further system testing and calib. tion of the contro' instrumentation did not identify a system falh re. The control valve oscillationswere subsequently attributed to dirt in the hydraulic oil, and a sluggish pilot relay valve.
6.1.9 Inss of I ube Oil Cooling
. The loss of lube oil cooling can be caused by faults in the cooling water lines to and from the cooler, cooler leakage, or tiow bicekage. A prolonged loss of lube oil cooling can lead to turbinc bearing failure. The lube oil temperature is monitored by a temperature indicating switch with cor' trol room annunciation. A summary of the industry survey of luhe oil cooling failures is provided in Appendix A 1.
6.1.10 Miscellaneous Another potential spaw failure involves the practice of running the auxiliary oil pump to lubricate the turbine bearings or to clear a system ground. Monticello used this practiec to attempt t
j to clear a ground in the electro hydraulie governor. When the fau!t did not clear, a system test was initiated to confirm 11PCI operability. When the operator opened the turbine control valve to simulate a cold quick start, the system isolated on high steam 110w. The operation of the auxiliary oil pump caused the hydraulically operated turbine stop valve to move from its full closed to its full '
open pasition. When the stop t alve leaves the fully closed position it initiates a ramp generator that provides the tiow control signal to the turbine control valve, allowing it to move to the open position. Since the auxiliary oil pump had been running for some time the ramp generator had l
timed out and a maximum steam flow demand sienal v as sent to the contral valve. This prevented j.
the turbine steam admission valve from restricting steam Ibw as it normally would during a turbine start resulting in high steam flow and a valid system isolation.
L Plant procedures address running the auxiliary pump periodically to keep the turbine bearings lubricated. When the auxiliary oil pump is running, the high pressure coolant injection -
i l
system willisolate if an automatic initiation signalis received at any time after the ramp generator has. timed out, which occurs after approximately 10 to_15 seconds. The plant has taken the i-following corrective actions to address the problem:
A modification has been approved that will eliminate ramp generator initiation while the auxiliary oil pump is running unless a valid initiation signal occuis.
6-4
The high pressure coolant injection system operating procedures have been revised a
to include cautions addressing system inoperability v< hen the auxiliary oil pump is running.
The operating procedures that verify system operability have been resised to include
+
precautions about system status before and during the test, ne control system ramp generator function during the opening of the control valve is described in these procedures.
i l
In summary, this is a significant concern because a common plant practice has the potential to disable the 11PCI syr. tem. Pilgrim operating procedure 2.2.21.5 contains a precautica relative to the operation of the Auxiliary Oil Pump. It should be reviewed periodically to assure that this potential problem continues to be addressed.
6.2 IIPCI Failure No. 2 - System Unavailable Due to Test or Maintenance Activities A probabilistic rim assessment develops estimates of system unavailability generally using a fault tree. The fault tree is a diagrammatic representation of the known contributors to system l
unavailability. In addition to component failures, the systcm may not be functional due to testing or maintenance (T&M) activities. In a single train system, like llPCI, test and maintenance activities on one ' 3mponent usually disable the entire system. It is important to keep the llPCI T&M contribution as low as possible because it is so important to system unavailability.
l The ront sources of excessive hPCI unavailability due to T&M induced tailures were examined as part of this operating experience review. Forty-thne examples of test or maintenanec errors (277c of all11PCI failures) were divided into three categories. Inadequate maintenance or inadequate post maintenance testing accounted for 22 IIPCI failures.
At Pilgrim, a wiring error in the alternate shutdown panel caused interference with normal llPCI operation. This event is reported in LER 80 019.
P A second T&M category, consisting of 4 events, is attributable to human error that inadvertently or incorrectly disables the !!PCI system. Pertinent examples include the disabling of the wrong IIPCI system at a two unit site, mistakenly disabling the auxiliary oil pump due to a 3
smoke odor in the llPCI room, and valving errors which later caused a low pump suction trip or inadequate lube oil pressure.
The final categosy, " system inadvertently disabled during testing 1 consists of thirteen personnel errors that temporarily disabled the 11PCI systeme These incidents include steam line containment isolation valve closure du'e to testing errors during. isolation logie testing, one valve motor failure due to overheat ng caused by execssive stroking during a surveillance test, and an.
i inverter trip caused by personnel error which resulted in a high voltage condition affecting both Channel C battery chargers. Unlike the first two categories, the majority of these failures have a-high probability of recovery.
6-5
- ,.4.w,
..+.y.r,w--,n+,r.,e
.,,e-E
~m
--,m%-,
.=
-cis.#
-e,o, e
v.,w,,_.v.
- m. s-c.
+v,-
w-..r,.y
-,,,,-y
,--,,ey, 4-,+~m%---
~.,,y,e#->
--.__._..____.m 1
In summary, the T&M com;vnent of system unavailability must be continuously monitored by the inspector to assure it is as low ai possible. The licensee should be administratively limiting the time that the llPCI system is in test or maintenance duiing operailon. System resto ation i
should be vigorously pursued; ilPCI should not be down for days, ifit can reasonably be repaired in hours. If feasible, portions of the system should be tested during outages. In addition, llPCI unavailability can also be minimized by adequate root cause ar:alysis and effective corrective action l
to avoid multiple system outages to address the same failure. Other, less frequent, contributors include inadvertent or unnecessary removal from service and system isciations during calibration i
or surveillances.
6.3 11PCI Failur= No. 3 - False liigh Steantiltle Differential Preuure Isolat_ ion Signal The llPCI system is constantly monitored for leakage by sensing steam flow rate, steam pressure, area temperatmes adjacent to llPCI steam lines and equipment, and high IIPCI turbine exhaust pressure. If a leak is detected. the system responA with an alarm and an nu'omatic ilPCI isolation. The steam flow rate is monitored by two differential pressure switches located across an elbow in the steam piping inside the primary containment. The flow measurement is derived by measuring differential pressure across the inside and outside radius of the elbow. If a leak is j
detected, the system isolates the llPCI steam line and actuates a control room annunciator.
A summary of failures identified during the industry survey for this mode is provided in Appendix A.2. There were no applicable failures reported for Pilgrim over the period 1980 - 1989, 6.4 HPCI Failure No. Turbine Steam inlet Wlve MO-23013 (1001) Fails to Oper)
Mo:or operated valve MO-23013 (F001) is a normally closed, L)C powered gate valve.
7 This valve opens on automatie or manualinitiation signal.
At Pilgrim, three failures related to the turbine steam inlet valve have been reported ov(r the period of 1980 to 1989:
1)
LER 82 046 reported that electrical faults caused the llPCI system to be declared inoperable This same event was also reported in LER 82 053. The root cause for l
both problems was identitled as valve stem packing leakage due to a scored stem; l
the valve stem was repaired during a scheduled preventwe maintenance outage.
L
- 2) _
LER 83 052 describes the failure of the turbine steam inlet valve to open during a l-monthly surveillance. The cause of this failure on demand was determined tobe a grounded armature in the motor of the valve operator. The motor and associated circuit breaker were replaced and the system was successfully tested.-
3)
- LER 89.025 provides a description of a steam turbine supply valve failing to open during an operability surveillance test. -The cause of this failure was attributed to two loose torque switch setting adjusting screws. These screws affected the torque l_
setting and consequently, used damage to the valve _ operator internals and the
- motor windings. Tie valve operator was repaired and the motor was replaced.
Subsequent testing was completed with acceptable results.
6-6.
b i
y t W - w, m-,* s
,-y,www,,-
,y-w,+<,~- awre
,www ' r o wt-w www-ewi=== e-w sy,w ys, w w w.-eerr==r-o+imm + ww-ee w w w -
- +-+,*eww+-r+>+v&mmeWa-*,*'+s=sw**u-di*r-
-s***
- a. wo r-+
i i
4 6.5
]_lPCI Faihtre No. 5 -fpmp Disbarce Valve MO. pol-M ((UO6) Fajjuo Onen -
j Motor operated valve MO.23018 (1000) is a normally closed. DC powered gate valve that i
is automatically opened uten system.nitiation, The failure of this valve to open disables llPCI i
injection into the reactor vessel. There have been 8 pump discharge failures documented in the operating experience review, accounting for 5% of all system failures.
At Pilgrim, the expanded LER search identi0ed one failere of the llPCI pump discharge valve. LER 82 008 describes the failure of MO 23014 to fully open during a surveillance test. An investigation ident10cd a missing wire juruper that was intended to bypass'the motor operator i
torque switch. The valve was successfully tested after installation of the jumper.
6.6 HPCI Failure No. 6. Systems Interadinrn Systems interactions refer.to umelated system failures that can disable IIPCI. _ Althou;;h there is no associated PRA category, the operating experience review identified the following system interactions that disabled the llPCI system:
1.
During a fire protection system surveillance test, approximately one gallon of water j
drained onto a battery motor control center (MCC) causing a circuit breaker
- l overload trip and valve inoperability.
2.
A cracked flow control valve test coupling sprayed water on a battery MCC and disabled a nmin steam line drain loss of power monitor. IIPCI was disabled when the MCC was deenergized to inspect and dry the components.
3.
Activation of the tire protection deluge system in the control room ilVAC system 1
caused the llPCI trip solenoid to energize and disable the system. Other systems were disabled as an analoB trip system panel was effected by the moisture.
4.
An automatic sprir.kler system in the llPCI toom activated after a system test. The probable cause was vapor buildup from the leukoff drain system that activated on ionization detector, i
5.
Setpoint drift in a Penwal temprature switch caused activation of a deluge system during a IIPCI turbine overspeed test.
I Notet During the site visit, no fire protection sprinklers were observed in the 11PCI toom at Pilgrim. At this time, therefore, this sytem interaction should not he a primary area for concern by the inspectors at Pilgrim;
- )
6.7 LIPCI Failure No. 7 - System Actuation 1.ocie Fails
)
Startup and operation of the llPCI system is a'utomatically initiated upon detection of either low. low reactor vessel water level (-49 inches decreasing) in the reactor vessel or high r
drywell pressure (2.5 psig, increasing). It can be manually initiated by following a sequence of L
operations provided on Pilgrim's main control board.
l 6-7
No failures in the system actuation logic at Pilgrim were idenified through 1980.
6.8 ilPCI Faihve No. 8 Falsn.Lijgh Area Tempt _rature Isolation Sigel The flPCI system is constantly anonitoied for leakage by sensing steam How rate, steam pressure, and area temperatures adjacent to the steam line and equipment. If a leak is detected, the systern is automatically isolated and alarmed in the control room. This category accounted for three llPCI failures (2% of all failures).
No failures in this category were repc.sted at Pilgrim from 1980 to the present.
6.9
}RCJ Failure No. 9 False I ow Suetion Pressure T.rjp3
%e purpose of the low pump suction piessure trip is to prevent damage to the llPCI pumps due to loss of suction. Pressure switch PS-2360 actuates to cause the turbine stop valve to close. There have been two turbine trips attributed to false low suction pressure signals identified in the industry survey, llowever. Pilgrim has not reported any llPCI system isolations due to false low suction pressure trips since 1980.
6.10 liPCI Failure No.10 Fake liigh TurEr.tr Exhaust Pressure Signal The high turbine exhaust pressuie signal is one of several protective turbine trip circuits that close the turbine stop valve and isolate the llPCI system. The high turbine exhaust pressure f
signal is generated by picsrure switches PS.2368A and B, and is indicative of a turbine or a control system malfunction. The operating experience review found only one LER. No LERs noted involving false high turbine exhaust pressure signals at Pilgrhu since 1980.
6.11 IIPCI Failure No 11 - Normally Open Turbine lhhaust Valve Fails Closed De failure of any of the turbine exhaust valves to open results in a turbine trip due to a valid high turbine exhaust signal.
Pilgrim did not report any 1.ERs involving failure of normally open turbine exhaust valves to close back through 1980.
6.12 liPCLEajiure No.12 - Condensate Storage Tank /Sm2pressipn Pool Switchover inic Fails in the standby mode, the llPCI pump suction is normally aligned to the condensate storage tank (CST). Upon a low CST level signal via level switch IS2390A and D, or a high suppression pool level signal via level switch IS2351 A or B, the suppression pool suction valves MO-230136 (FO-12) and MO-230135 automatically open with subsequent closure of the CST suction valve MO-23016 (F004). System operation continues with the_ llPCI booster pump suction from the suppression pool.
'This PRA based HPCI failure mode has become less imixrtant due to changes in the BWR Emergcucy Procedure 'which generally' advocate the continued: use of water sources' that are external to the containment. This avoids potential ECCS degradation due to high suppression pool temperature (llPCI high lube oil temperature) while simultaneously increasing suppression pool mass. The end result is that an llPCI pump suction transfer to the suppression pool is no longer that desirable and the operator, especially in decay heat accident sequences, is likely to bypass the -
6-8 i
?
switchover logic to maintidn the CST suction source, or to nalign if a switchover to the pool has occurred. Therclore, the inspection focus should be on the continued viability of the CST as an injection source during an accident sequence.
'There wre ao failures in this category repor ;d at Pilgrim.
6,13 11PCI Failure No.13 Sun.pression Pool Suction Iine Valves h10 230136 (1T142) and MO-M013.8 Fails to Onen At Pil ; rim, there are two 250 VDC powered suppression pool llPCI pump suction valves, l
hiO 230136 (FD42) and htO 230135, ir, series with a check valve instead of thc h10V and check valve arrangement often foand at BWRs. The llPCI system is initially aligned to the condensate storage tank. The suppression pool suction valves are opened and the CST suction valve is closed on a CST low water level or a high suppression pool level signal The importance of this failure l
mode has been diminished by the current emergency procedure guidelines v.bleh emphasize the continued use of outside injection sources. Thin requires operator action to bypass the llPCI suppression pool switchover logic to prevent the opening of the suppression pool suction valees MO 2301-35 and MO 230135. This is esg cially true for the cecay heat removal (non ATWS) sequence wheie it is likely that the CST makeup can be maintained, At Pilgrim, LER 82 042 reported the failure of a torus suction valve to operate during a surveillance. An open field v inding on the valve operator motor was identified as the cause. The motor was rewound, successfully tested, and returned to service.
1 6.14 IIPCI Failure No.14 - Minimum Flow Valve h10-2301-14 (f4)12) Fails to Onen The minimum flow bypass line is provided for pump protection. The bypas valvc, MO-230114 (F012), automatically opers on a low flow signal of 400 gpm and closes when the flow reaches 800 gpm. When the bypass is open,.tlow is directed to she suppression pool. During an actual system demand, the failure of the minimum flow valve to open it important only if the opening of the pump discharge valve (F006) is significantly delayed. In general, this combination minimum flow mode. the licensee response to Bulletin 88 04"ystem operation of ever.ts is not probabilistically significant. With regard to s should be reviewed to determine if the design of the minimum Dow bypass line is adequate, Unless there is a design concern or a w:urring problem with either component, inspection effort should be minimized in this area.
No failures of the minimum How bypass valve were reported at Pilgrim since 1980.
6.15 Othu Faihires The Operating Expeisenec Review did not identify any llPCI failures for the following ten PRA. based failure modes:
Normally Open Pump Discharge Valve MO 23019 (F007) Fails Closed or is Plugged Pump Discharge Check Valve CK 2301-7.(F005) Fails to Open
+
CST Suetion Line Check Valve (F019) Falls to Open CST Suction Line Manual Valve 9010) Plugged Normally open CST Pump Suetion Valve MO 2301-6 (F004) fails closed or is plugged.
6-9 s,,-,--
Suppression Pool Suetion Line Check Valve 230139 (IU45) 17 ails to Open
+
Normally Open Steam Line Containment isolation Valve MO 2301-4 or 23015 (RK12 or 003) 1: ails Closed Steam IJnc Drain Pot hialfunctions
?
Turbine Exhaust Line Vacuum lireaker (R176,077) Fails to Operate Suetion strainer plugged The PRA-based prioritization of IIPCI failures correlates well with the actual industry failure experience. With the exception of the first failure mode listed above for h10 23019 (R)07),-
all of the faults listed above have been dnir,vted as '10w importance"in the PRA based ranking of Section 1.
The expanded LER search for Pilgrim (1980-1989) did identify two failures associated with the steamline containment isolation valves. LER 81009 describes the failure of the spring in the limitosque operator o h10 23015 (inboard isolation valve). The second failure is described in r
LLR 81009 and was attributed to an incerrect minimum toique switch setting and thermal binding of the valve.
6.16 Humt'n Drots An additional category of IIPCI failure modes that was not specifically identified in the prioritiration of failures involved human errors.Two specific examples can occur during normal operation:
hiiscalibration of IIPCI sensors that can disable system actuation or result in false
+
system isolation signals; Pailure to reset the llPCI system for operation after testing or :naintenance.
These two human errors can occur during normal operation and thus, are inspectable through the review of surveillance, calibration and maintenance practices and procedures.
6.17 Additional System Considerations ne industry LER survey has identitled several other llPCI system considerations that could impact the overall risk of a plant. These considerations are discussed in the following sub-sections w;th any applicable Pilgrim experience.
6.17.1 LOCAs outside Contair: ment Unlike the llPCI component failure modes discussed pwviously, that involve the unavailability of the system, the ilPCL system can be involved in potential LOCAs outside containment (Section 3.5). The industry survey identitled degradations of the steamline isolrition function and pump suetion line overpressurizations as potential causes. Identified isolation system problems include:
)
6-10 1
__.______-_i__---
l a steamline differential pressure transmitter with a non conservative setting; and -
an inboard containment isolation valve that failed to close.
a I
lixamples of pump suction overpressurizations include:
a slow closing pump discharge check valve that caused a pressure surge after a turbine '
+
I trip; and water hammer caused by void collapse following system initiation after feedwater back.
+
leakage elevated the temperature in the pump dissharge line.
Pilgrim had a llPCI overpiessurization event during a system logic surveillance. Two pump discharge MOVs were partially left open due to personnel error; in addition, an upstream check valve (F003) was not properly seated. De pump suction line was overprersurized by the feedwater header and failed the turbine gland seal condenser seals.
In general, the llPCI LOCA oatside containment event is a small contributor to the total core damage potential. The examples presented above indica +e possible areas for inspection to asscre that this core damage pctential remains low.
6.17.2 IIPCI Support Systems The high pressme coolant injection system is dependent on the following systems for successful o;>cration:
DC Power For system contro (125 V DC) and valve movement (250 V DC).
Room Cooling For llPCI pump room cooling to support long term operations. This function requires service water (for cooling) and AC power for the fan motor.
IIPCI Actuation RPVleveland primary containment pressure instrumentation for system initiation and shutdown.
During the llPCI operational experience review the influence of support systems on IIPCI availability was apparent. He loss or degradation of the DC battery or bus that powers IIPCI has a straightforward effect. Besides the battery charger problems or fuse openings, the more unusual ITC system proble..s included a battery degradation due to corrosion of the plates. The suspected cause was a galvanic reaction due to plate weld metal impurities. Another concern is insufficient voltage at the load during transients which could trip the station inverters or fail MOVs. _ This would be of particular concern duiing a loss of offsite power or a station blackout event.
An incident involving the DC power supply was reported at Pilgrim in LER 85 029. The investigation of this event attributed the trip of a breaker feeding the llPCI and ATWS inverters to fluctuations in the input DC voltage.
1 6-11
The room cooling system is typically required to support long term.llPCI operation.
Besides the random failures that can occur at any time, there is one sequence specilie effect that should be examined. During station blackout, the AC. powered room ecoling is lost when 6
continued ilPCI operation is critical. The licensee should have pump room and steam line
\\
temperature calculations or have other procedure provisions (bypass high temperature isolation or portable DC-powered fans) to assure ioug team IIPCI operability.
Tne RPV level or high drywell pressure instrumentation is required for multiple ECCS systems including HPCI. 'Ite operating experienet review did not have any pertinent examples of failures.
6.17.3 Simultaneous Unavailability of Multiple Systems Multiple system unavailability of certain functionally related systems is of concern because of the increased risk associated with continued operation. Although Technical Specification 3.0.3 tends to limit the risk exposure somewhat, the licensee should, to the extent possible, avoid planned multiple system outages.
Within tlie context of the accident sequences discussed previously (Section 3), certain_
combinations of system unavailability result in a relatively large risk of core damage. For example, the HPCI operating experience review had nine LERs that documented simultaneous IIPCI and RCIC unavailability. During this period, the probability of core damage is greatly inercased for accident sequences tnat require HPCI and RCIC for mitigation. This would include all the sequences described in the Accident Sequence Description except "Unisolated LOCA Outside Containment." The unavailability of IIPCI and an emergency diesel generator would have t impact on plant risk.
At Pilgrim, one LER reported the occurrence of multiple system unavailability. LER 82 043 describes the loss of position indication for the RCJC torus suction MOV while the HPCI system was unavailable. This event required a plant shutdown. The RCIC MOV failure was attributed to sticky contacts in a motor controller relay. The system was tested satisfactorily after the relay was cleaned, and the system was returned to service.
i 6 12
_ ~. _ _. _ _.
7.
SUMMARY
This System Risk Based Inspection Guide (Systen. RIG) has been developed as an aid to llPCI system inspections at Pilgrim. The document presents a risk based discussion of the llPCI role in accident mitigation and provides PRA. based llPCI failure modes. in addition, the System RIG uses industry operating experience, including illustrative examples, to augment the basic PRA failure modes. The risk-based input and the operating experience hase been combined in Table 4-2 to develop a composite BWR 11PCI failure ransing. This information can be used to optimize NRC resources by allocating proactive inspection effort based on risk and industry experience. In addition, component faults are suinmarized in Section 6, and provide potential insights both for i
routine inspections and the ' post mortems" conducted after significant failures.
The flgrim operating experience review has identitled the following component failure modes that have shown a higher percentage of occurrence:
turbine speed control faults turbine stop valve failure e
turbine control valve faults a
turbine steam inlet valve fails to open a
Containment isolation valve fails closed These comp (ments should be given additional attention during future routine and specialized inspection activities.
s l
7-1 l
8.
IIE! ERENCES 1.
Brookhaven National 1;iboratory (BNL) Technical Letter Report. TLR-A-3874 T6a,
identiGeation of Risk Important Systems Components and lluman Actions for BWRs" August 1989 2.
Shoreham Nucica: Power Station Probabilistic Risk Assessment, Docket No. 50-322, long Island Lighting Co., June,1983.
3.
NRC Case Study Report, AEOD/C502,'Overpressurization of Emergency Core Cooling Systems in Ibiling Water Reactors," Peter Lam Septemr er,1985.
4.
Brookhaven National Laboratory (BNL) Technical Report A 3453 87 5
- Grand Gulf Nuclear Station Unit 1 PRA-Based System inspection Plans," J. Usher, et al., September, 1987.
5.
BNL Technical Report A-3453 87 2, " Limerick Generating Station Unit 1, PRA-Based System inspection Plans," A. Fresco, et al., May,1987.
6.
EAL Technical Report A-3453 87-3,"Shoicham Nuclear Power Station, PR A 11ased System inspection Plans " A. Fresco, et al., May,1987.
7.
BNL Technical Report A-3864-2, " Peach Bottom Atomic Power Station, Unit 2 PRA-Based System inspection Plan," J. Usher, et al., April,1988.
8 BNL Technical Report A-3872-T4, "Ilrunswick Steam Electric Plant, Unit 2, Risk-Based Inspection Guide," A. Fresco, et al., November,1989 9.
NUREG/CR 5051," Detecting and Mitigating Battery Charger and Inverter Aging" W.E.
Gunther, et al., August,1988.
10.
NRC Circular 80-07, " Problems with IIPCI Turbine Oil System," April 3,1980.
11.
NRC AEOD Report E402 " Water llammer in BWR liigh Pressure Coolant Injection Systems,' January,1984.
12.
NRC AEOD Technical Review Report T906 " Broken Limiting Beam Bolts in HPCI Terry Turbine," April 18,1989, 13.
NRC Bulletin 8S-04, ' Potential Safety Relatu! pump Loss " May 5,1988.
14 NRC Information Notice 82-26,"RCIC and ilPCI Turbine Exhaust Check Valve Failures,"
July 22,1982.
81
APPENpfx 4,)
SUMMARY
Or INDUSTRY SURVEY OF 11PCI OPERATING EXPERIENCE
!!PCI PUMP OR TURBINE FA!LS TO START OR RUN
- 4 l
1 l
i
'?
t A1 I
e wa be-r-
,av-wg
~,=wm-gv+
- e=
4+w -y a
s a avrace ' r e
e+
p e+**
vdwm
-w*--*-r a
+
a w tre y-
, er w r + ev
- w,=
- e-r ye*-+---se-*-
'
- y e m m s
-e V er - W W
eeee t c-r4
1 I
)
r t
1 i
Table A-1 HPCI Pump er Turbine Fails. to Statt - Industry Survey Results t
t i
Failure Dese. -
Ront Cauw Carectne Measures Comments
'nspectum Gek!ance f
y
)
E i '
TUP.RINE SPfTD -
i CONTROL FAUT.15 -
?
EGM amtrot bou malfunction Two similar failures attributed to aging
- 'GM printed circuit boards will be Eacle of these EGT.I amtrol bm I
cliccts due to long eni cargization and replaced at eight year entervals.
fadares omurred at older plants
{
pmsibly cleve*cd ambient tempesstures.
Additkmal llPCI pump ronni omimg and appear to be aging related.
An EGM printed ' circuit board failec and added.
I caused a false high steam ikm **.gnal. Tir
[
second failure involved the elecirt,sdcs in j
,[
the amtrc4 bou chassis.
[
f EGM controi tot had a ground.
Two prmied circuit boards replaced.
)
l:
Miscabbrasm of nul! vr4 tare setting Recahbratkm of voltace settmp i
i i"
I ailed transistor in the FGM cietrol bot.
Ikn replaced. Surwinance i
f prowdures bemg espaejed to verify
[
j prope. functioning of the output j
y speed circuit.
Motor speed IIPCI failed auto initiatkm servemance E ror was sww detected during a changerfG-R..
because the electrical emncetkms between previous test at 160 psig. P macin.
i; actuator malfunctionsi pmenor comrcJ and governor valve revrsed to functionathr test the i
i c1ccarohydraulic servo were in error.
pwerrww control system d:rring the i
j km pressure surveillance testing
[
T i
},
Capacitor failure in motor gear emt.
Replaced capacitor Failure may have been caused by AmNent temperatures in
}
escessive IIPCI toom equip nent areas should be i
l.
temperature.
wrified within j
specifkaika i
Improper Faping and foreign accumulatina Compmer:t reph.:ed nr servimd.
4.
on contacts.
EG-R actuator erounded at pin connection Corrosion prode ts rennwed.
due to the accaanutation of corrosion i
ji products. Dere were three occurrences of
.this event that hase been attributed to a.
design change in the actuator pin p
j -
conne ctions. --
4 s
P 4
6 1
I I
e I
4 t
?
1 e
.?
r, m
---r.-
I
...~~.n-.n._
.~.._ - -.
.-- _. - ~ ~ - - - - - - - - - - -. -... - - - -
- -.~~
f f r
[
- i'.
-I Table A-1 (Cont d) i b
t Failure Dese.
Root Came Corrective Measures Comments Inspection Guidanec
)
Dropping resi tor--
Restor bom design deficiency-spedal test Resistor tu nx.Jified to ensure assemNy proHems stmed output voltage insufficient whea '
EGM amtrol tu mill receive input voltage at desigr. minimum required voltage under worst case a
j conditions.
1-Resistor failure Pesistor o.wponent seplaced
~
Ramp gereeratorrignal Skww IIPCI response time attribed Gain and trce settirgs rewt.
.iettings had not beca numfified t
t creerter box.
incorrect turbine kiop gain and ramp time based on power ascenseon test settings.
program
- t Matnetic speed Cable damaged during IIPCI maintenance Cahic refeired-a pulup cable.
preventing speed feedback to the speed l
I cretrntler.
1 I
Speed control inne conerni room panel terminations.
Repaired panci terminations v pr ten eneter.
r f
I,Ulst! Oil SUPPL.Y y.y FAUI.TS i
l pressure switch faJs.
~
Micrmwitch replaced.
2 additional failure %eto Auxiiiary oit :wmp -
Mio= witch within pressure switch faik miscalibration, and,
attributed to a piem of teflim i
tape that blocked seming orifice of raitcit
[
I s
Compment adjusted.
)
Imse hydraufs control system pressure stitch contacting arm.
+
i Audiary cd pump 1%mp bearing failure degraded pump Pump replaced.
Similar eveni-pomp motor 1
fadure.
performanceAnes.Mascharge pressere, bearing failure was posubly due t
bearmg had been untly replaced-to daily use to supply oid to f
j-.
pAential human errev.
turNne stop valve.
l 7
Addition 2 km '
llaman error. A!! am rol vahes.
Valves wrrectly psitioned. handles Two similar events have occurred j
hearing oil pressce.
mispeitbied_
renewed. Sureciliana revised to at other plants.
s occ3rrences.
check od pressure Avring turbine L
f j
test.
e r
i f
l l.
f L
+,
x -.-.....
..m.
..e
l i
r i
Table A t (Get*u)'
i Failuri Asc.
Root Cause Corrective hicasures Gmunents inspecten Gen.tance
(
l
'the process of cerumficapy 1mbe oil Paraffin in lube oil coated piston caused Fiston cleaned.
contamination, binding of bydraulic trip relay.
=ampling luhe mi shrwiki bc l
verified.
l
.I 1URIllNE OVI:R5TTI'D AND AITIU RINT PROHIFMS f
Electrical termination '
Inne electikal terminatxm on solenoid Wiring to the solemmh wdl be the corrective actre for a failures valve coildisabled the rew Me rewt restrarned to mince strain on the sinnlar earlier event apparently j
funcskm. Failure attributed ta normat terminations, dat am address the root cause of IIPCI vhation.
the failure.
D I
i' Over> peed trip device Overspeed trip device tappet assemb!y -
Tappet remachmed.
Semilar exerre~e at nrsxher tappet bindmg.
head was binding in vahe tw4 plant..
~[
Iblyurethane tappet, prevkmsty mauined
[
'y
[
g.
per GE guktance. had experienwd additional growth.
(
L e.-
Repared amtactor arm.
None.
1me hydraulic control systes a pressure -
[
switch umtactor arm.
Erratic stv wlve operaikw Blocked drain Drain port cleared.
Additimal infamarna on t
Drain port blocked.
port in merspeed trip and auto reset..
turbme merspeed trips is
(
piston assemby caused trip mechanism n.
prmided in NRC Ir fc* mation i;
cycle betmeen tripped and norm:.l.
Notice A6-14 and.6-14, $upp.1.
l l
pnsitions.
[
INSTR 1TR 'IRIPS..
t OR FAlIURl!S
'[
f
[.
Inverter tripped and amid not be reset Replaced inverter.
[
due so a failed dx=h."
See R f. 9 for effects of inverter j
aging and prewntative measures.
f i
~
Inverter failed due to the failure of an Replaced Swerter.
A suni!ar event inwiving a
{
internal capacitor.
ruptured capacitor onarred at i
another plant.
4 I
i
[
I-l 6
,m i
Table A-1 (Gmt'd)
Comments inspection Gedimx Failure Desc.
Root Cause Owrective Measures Internal electronic Inverter mvrt e atmg due to a failed Repared (v replaced ctw*ng fan.
faults integral ccding Len.
Inverter failure d ee ta bkun fuse.
Replaced fme.
Inverter trip dx to high veitsge wipwnt Equahre wtage was reduced drift.
alkming inwrter to reset
'fUHitlNE STOP VAI.VII Fall URI:S Ccmtrat oil teats.
Od leak dewkped at pdot vahr llange bolts torqued-Smilar event at arnwher plant.
aswmNy hydraulic glinder f!ange balts were bm.
Pdot oil trip solcruiJ Valve ste(L epen due to drsintegration of Vaks czpendaMe parts now vake.
diaphragm that caused salve plunger to scheduled fw repkxment at every third refueling outage.
stkk ahme the seat,
.h Vahe would mm open due to eneune Piston rints were fat ricated from Further drwwnm in IE Grc Aar leakare of piston rmgs in hydrauhc resin impregnated feather. Ve mior f60?'
recommended replacement every the niinder actuator.
years. Potental acine cnenern.
Mechanical valve Vahr and actuator stems separated at spht liaiance chamber adjustment was Smdar bihrre nrurred irm4ving Uverstress and ultimate failures.
coupling Hafance chamber adjustment perfarned en 1995 per GE SIL 32 a kwv.c sane pe=stam senew frarture sill usually (cur drift beheved to have cauwd mcreased Adpr.tceent will be checked quarMriv bracket that caught on acteater at :he undertut on the rnomentum wJ dnL rwertravel for a minimur.i of 3 quarters.
housmg when the vahe opened.
coupImg threads dae to lhe vahr failed in the open reducmg crm wttm WN Inopwm stem fadure may be endicated t-v circumferentbl cracks m threaded s*em area.
I l
El
,e Table' A-1 (Cret*d)
Failure Desc..
Root Cause Corrective Measures Cawnmcors inspectirm Guidance TURIIINE ILXIIAUNT RUI"fURI? DISK Cyche fatigue.
Inner rupture disk faikd due to csche floth doks replaced with an Improved design appears to ALOD Report ESt2{t1]
fatigue (ahernating pressure and vacuum imprwed design that has a structural climinate the esche fatigue prwides atkhtumal within the exhaust hne). Vacuum occurs barkeng to prevent flesing during failure nule.
exampks d turtnne during cord quick starts with cold piping-exhaust hne vacuum conditkms.
exhaust rupture disk failures. ~
i Water hammer Eshaust diaphragm ruptured by mater Ilktked line cleared. rupture disk A similar event has murred at induced dak rupture.
carryrwer from exhaust hne dram p* due.
replaced.
another plant. Duratsm and to a bktked drain line.
frequency dexhaust line bk=d.mn increased flow CON TR Of.ITR b
i All URES Failures appear to be aging Ambient corntitwms in I ailu e to control in
. Defective arnphGer card and solder jomt Repairs performed.
retae.ed.yet it appears sanne areas containing thrs ficeveces do nm intend to equipment sfumid be automatic.
attributed to aging.
periodically replace sensitin wrified against equipmen or oiberwise address specificatums.
the roo...use of these failures..
Dropping resistor fai ed in the instrument Reststors R26.R24.and rener dvwfe t
amptrfier arcuitry due to awmat heat of C24 a!! appeared to be affected by operation.
ambient temperatures am! were replaced.
Internuttent operation ofinternal switch a lhe sligM oxidized contacts were crmtacts dal not alkwe the controller to ckaned am! lubricated. In the kwg read the Ikw setroint m auto.
term. permanent jumptes wiII be in%2tled to bypass the smitches.
Gear train failure.
1sume fastener caused intermediate gear to Irocedures will be revised to require unmesh which prewnted adjustment of the a perustec check of the gear tram controller setting.
and fastence.
(
I--
3m T able A-1 (Ce:t'd) l'ailure Desc.
Root Cause Gerective Measurn Corn nents Irmwrt,m Guidarar r
M scabbration flom entretier indscatcd a i'km r4
- dt Contr:41er recabbrated 1*Igr:m sptem engi>wers n.ve that arr in the mstrument knea gpm when sptem rwd en o;vravirm l'aiLre has aim cauwd thn type of attrrbuted io m wabbratum.
pn Nem.
11 'R HINi CON IROI, VAf VII
_I At'IJIS i
Control c4 kal (M supply line nipple kaking because
%pple repaired. p'an; pemenet mformtd of failure cam plant personnel stepped on ime to gam access to contred rahe.
11tottic vahr bftinz
$st of the cigi.t Lfting beam hohs f iled j
Ixenwe to shange thread Wicant.
Per AI Olt Report l'A-[12].
be am inttmg 'ailure.
due to v. tress c.rr<we.m cradmg of ntm metal bearrer petroleum ylly bproper beat treatment ar.d the reo wimw nded.
ww of a cepper bawd ants s
nnproperty heat treated $4ts. The seizure twmpend mere mapw remammg two f=4:s were crxLed-contribunws to this fadurr.
f f Oss Of I UHf Of f.
PCV,1035 had in mcorrect diaphragm I-ormatn i of a procurement AddJrmal i1 R reported a coni ING instatied due to nTadequate crmter* to engmeering group.
diaphrag, faiA-e respitmg in a 5 gpm feal No cause stated-.
4 update pint infortatkm with industry
)
pC'/.IM5 failuret experience.
MlWi~II ANT OUS Used aunliary 61 pump to flush oil A nuddicat nn mas prywed to lhe pers=he ene of he auxdtary Opceanne prmedures t
thro"Th the governor to dor a grmario.
ebmmate ramp generater moatim d' pomp k a ownrn m pracrkr sh 'uld he revw c' in l
Subsequent!v. spiem tsotated on startup on aut hary od p,mr stren:p. anicss t!.at care drsable the IIIU ensive that cau i.x*$
r because the rst pomp ouses the stop an.d a uhd inasutam sgnal is prewnt.
sprem.
eJc.4dy IfrC1 eynem mepesabery aben the omtrol vahen to go full open auxiLary ed pump is sunning.
i l
i a
1 I
t l'
i APPENDIX A 2 4
i l
SELECI'ED EXAMPLES OF ADDITIONAL llPCI FAILURE 4
MODES IDENTIFIED CURING INDUSTRY SURVEY i
e t
4 9
a A
1 i
f 1
)
e 4
k t
k i
E-I i
4 4 '
4 1
J 4
1 I
i.
d
. [
-A8-4 fl
..y.y.
. y 3 w.y..
_~,.7,
,,.~%...Ly.,.,,n.,.,,,,..
,w..,,,.,_m,
.mm_,,,_w.
,,,r.m
,,m,..r,r,-.
...,,,.y.._,_,
,-.y_,,,,.
///'///'
-- /
s s
N
/-
l
/e g
/,
/1 s,
%g fWxf;;;;s o'i s g g'g
% h.
- p. V
\\
'% g f'
W's y
yn g[4o.
v',s%.,
g,'
'R s:q%
^
,y,
s
\\
- Nxx, x T][(N g g*
qs, s
p, N y'}sQQig. +' q
~
- c. s q
x\\% s
.;;pg
$;;g 3
e s
g p,
s s
,?
5 s
o
%,g Ng Apd. *{^ %o, s
s.,
Ys 9,
%gl - %'
g
\\,
q$,$
s:s s g'sx g l
s
,o g(k 4
s p gs v
s x
k
/,.
fspn./'.
e f3
- $f%
\\
so(
g
>fhs 6Ug
. r'p g
,+
vh -dh5N'.
+
y
%yca, a
x
g sV
]
O r
d e k]h M
e in e
r e
t c
m ec d
n l
te ei d d
re t
aN e
ta n
r a
d r e
be h U h
d o is ec ta t
r t
m h
yf w wi ta nN et Mkm r
e c r
a e
r e e Mm l bf o
b f
f o
5 'm s i 2
a y
a t
a 5
e l
at m
e a s e
k m
o e e l
ml f
e u
r t
s tad r w
Ff w
2 t
a r y r
mr u
w a
u q e R
a r
eb t
o m a s
w m c.
t s e r
o S n n r.
Rr d n
e r e
sd OI ga e e et 5
I po Efo d.
h tu dt, as a
e e sg h
c tc O
od C 2 m S n e
r n
r n
i e OwP n a
P 7
I e c f
n a
e n r
N RL d O
h a I
a 4 v c t
e c
+
Ck a a
m d
g N5 u
P w d ef ia I
8 r N R n e.
s u c p No n
en o 'u i
u n u gi e
r r
I g
h a s su s
n nA 4 e ql t
e
-I Drf ei e
1 a
i d
{
estm h uh o
bte r
d i
e jc r
e l
d a wi ls e
tc r
wd t
a e
d d
w r
s v
r e
ae s
e a
t f
t n n v tr ef s e
a o f
oy tel p
c d o r
et a
u a
r e
e b
a v
e o f
t u s w
n y
o wt uqw o
a ts <
t r
r s or s
t r
n n s c
o e r
a eb e
n gt r V
dh e
i w us mu Ja m w
O e a m
s n
d s
d u o
re intt wt M
tu eV a
v n r~
s r
e d s f le e = n b
N f
e ssk e C
oO tr a~
fMd.
d d n
d.
i o k
e r
'l.
e e n w
tout tm De ttr pM r
e e eo n
a lt h nr r
s.
gr e
a w tab edk l C lol o
p ri t
u o q m
t a
s (
e s g r a a
e eu iD y
h e n G
Muui t
v d a r r
c h l uk n t
v p i.
t a
t d a n
r p
b s
wr ea Oe e e h u e
i a e n a e te toh ss e
g r r
l' b m t
kr e
]
P o i s r er mp g oi How l a v e a
s Dfode h
y tcl t
wi c n
e s
e l
s r r
e s v
o b e e
t s
u a wly e
q d
is g
s e
r e
a a r
r r
r n a
v o e u
d a r
u ~~
t.
s t
g a e c
. e w
lp in r
d h u e
u n s e
tr s q r
d a
r s
aw a
s r r h i e
d r a
ta e
s e
o c
m b
1oo.
V d
s M
i s re c w
t p
e e to r
+
d tn pnt te ta r
is r
a v
e h
. d wi n
r e
t x
v n
r e
s s
o r
e e
- d d
e r md me d
c n n c
gi r
s u w
e x
id r u a d.
it d
d et e e
d n
e m
e e
t r
r a r d m
-e h
i ac r
h u g r
o a j t
c.
a r e er a
a C V d w h
m
!p h
id c ta r
d p
lp e
a e
t e e e
s at e
b e
e e
V w
c pmd be h
c r
s R
e a
2 b
e h
{
R V
t pm e on c
p v
e S c a R p R
R V
i r
e e
l tc a
m w
j[1 a
te e
g
}
S u
m y
l e q a
s t
v x t
m l
r r
v ta c
la b e
t e
r t
s t
m h
n n
o t
e in a
w ao a
v cr.
h i s r ic mn m
t df ta to t
n i
t f tc a
k a i.
o o
h e t
t n
d r
e u t
p a
k e
n n n m o
d o lu e g
r e
d t
r a ime ima tm is e
imi c e e o g
d a
u o
v nt m
r te ft s
r yl u
m a
o d u lia v u
g o j
t o
e x o e
te q in s d
o d.
e r
e r
a f
r e.
d d
i r r
d h of e
h e
te tc f
e o 4
d r
s a
w u
u v
p d b a
wt Win ig f
n d
t xi u
lu v
ie a y d
e r
w s
r f
n u
a d s m s e o i
y e n e.
to o
H a
t u
a ai n
e o e e e
r r
n r
r i e e c L
f i
t v
o vi a
p e
h f
f r
u ic e
N e r
r
?a c n o
o e
it b t
r n
f u d i
h s
a m
m e
u d
w m
e o
N v ic r
o d
e a d s
tc s
e n
t s
i e
f a r
rh R
M l
b a
g p
e s in f
e w
ts v
a a
u r
is r
i e
v n
d e
V u
i im M im l
e r w
s s
V i a o
r r
it r
~i d q
t l
c r
q r
t l h M
e o
m h
c i
e a
h r
U V a
a d~
r L
V t
)
s d
o 4
t n
k o
c.
e i
r e
s e a c
s r
5 v
e e
g r I i h a
6 na l
(
D d
e a
hl iV 2
a r
V e
r) u c%
e f 7
A r
H C 'd s
r e n w
a I
t fDe lV
- i h Up u F e o
I l
mne e o n u
e d
n r l N
a P o I
- a T
P m v e ir O p e 3 F w i d
p a
I c
C l
u a Cp a ta a mO l
(
e, I
r l
i u I P Vc P ptcil Ci ls 4
o I
mt I
u u I S S 'a I
P m i I
a M F I
I l
y3C
I i..
i
. Table A-2 Sufamary of Illustrative Examples of Additional Industry IIPCI Failure Modes i
i,.
1 C
i
{'
l l
Failure Dese.
Roos Cause Gwrective hicasures Comments Inspectim Guidance j.
Differeraial pressure transmitter failed due Amplifier card civmection was Rmemont Transmitter NRC Informatim Notice IIPCI Failure 3 -
Falsc Iti,th SteamNne toinadequate connectkm of ampbfier secured.
82-16 provides addrivmal r
~
ii Differential Pressure condition card was eithen incorrectly information on steamline Isolation Signal seated during installatkm or worked kwwe.
- wessure measurement.
1 t
Afr. calibration and a stuck pressure Wrong conversion value caused Rosemont Transminer i
l' indicator disabled txith divisions of high miscalbratim and aas corrected.
AP transmitters.
l t
g Transmitter operating outside tolerances Recalibrated transmitter Conservatkely narrow instrument f' '
j due toinovrect setpoint adjustment
. tolerances mere used during the setpint adpntment. De
.istrument was a Rosenmunt l,
Transmitter.
Setgw.n drift cause spurious system Setpoint was adjested-Barton transmitter increawd catrbration isolations frequency may tw y-g necrssary.
+
frtgxsnt draft caused by moisture intrusion Unknown'.
Barton trammitter.
~
y through the dial rod shaft seal.
7 IIPCI l'ailure 4 -
MechanicatAhermai binding of disk due to Interiti werective acti<m was drilhnst Dis failure was attributed to j.
Turbine Steam Inlet inadequaic clearances.
a hoke in the valve disk. Double procedural and training '
Valve (IV01) fails to dasLS vere to be installed dunny a inadequacies.
upen failure refueling outage as a kmg l
term sduskm.
Hermal Finding of disk Reptaced nWor gears and instatted ne the sal Nnding can occur A four hour sprem I
larger pmer supply cable ta noter.
for ~2 hours after rysicm is warmup may be required
{
returned in service folkming a by procedures to cooldown.
circumvent this problem.
i Motor failure Singe protecten added to shunt coil Motcr failure caused by 16gh of DC noter centrol circuitry.
voltsge transient in shant coil f-that occurred when supply breater opened.
l
'}
t 1
d i
-i
.f e
i
i l
i Table A-2 (Cont *d) l 1
Failure Dese.
Root Cause' Correctree Measures Gwpments Inspection Guidance liPCI Failure 4 -
Motor failure.
Vahe repaired and torque switch Motor wmdmp fa; led when Other safety related MOVs j
^ '
(cont *d) adjustment screws were correctly torque setting out of adjustment mere also allected torqued due to kme torque switch Prxedures were reywed i
i adjustment screws.
aa! torque switch limiter j
plates were imtalled 1
Valve motor failure due to incorrect sicam Vahr motor was replaced lubrication -
l licensee review determined that vahr Rsmoved step startine resistors.
Other DC MOVs were also INPO SER.5M and might not open due toimufrecient torque, evaluated.
NRC Inkwmation Notix M 72 prmide further
[
guidance.
[
a I
IIPCI Failurc 5I Mispositioned auxiliary contets in starting Replaced contacts.
Pump Discharge time delay relay for valve motor.
Valve [IW6) FWis to i
Open Vahr motor failure WNu motor replaced Failure attr>uted to heat related
[
breakdown of valve motor 7
y i
internatt f
O.
Potential problem may affect INFO KR SM and l
3 tacensee review determined that rake may Step starteng remt<ws had not been have insufficient torque to open.
considered in the torque analvses other DC MOVs NRC Informaeion Notice
{
and were remorei provide additional guilance.
IIPCI Failure 6-
' Morer failure. Winding imulation Reptaced motor. Voltage sege Iligh voltage transients occurred Suppression Pool degraded due to high voltage transientt protection added to circutrv.
as supply breater was opened.
f Suction line Vah< P l
i Fail to open Torque smitch out of adjustment.
keealiarated
. limit switch failure Replaced limit switdt..
L Va!ve stem separated front disk Vahr repaired There tudts failed due to tenne lhese vahes were ovettrxed Other similar valves manufactured by were impected Associated Control t
s Equ,pment. Inc.
IIPCI Failure 7-Vafve inoperable due to damaged motor Switch replaced.
Damage resulted from overtravel Design changes may be Minimum Flow Vahr starter discrmnect s#ch; of operating handle due to poor required as a resuP of this t
t Fails to Open design.
failure.
I I
e
^
n Table A-2 (Omtif)
F ailure Desc.
Root Cause Cerrective Measures Ovaments Impecthm Gua.fance IIPCI I~ailure 5 -
l'ese failure due to electrical groundmg l'use replaced and ground corrected.
$siem Actuarkm logic I ads
$ stem failed to actuate due to inadequate Design m<whfied.
I urther discusse in AI:OD RepetI40'[ ]
seal in time.
IIPCI l'adure 9 -
I aded peer supply resistor Resister repixed.
t ake iligh Area Failed temperat ne monitermg niodu!c.
Malule rept.ced.
New mndet reptsement Temperature Isolation considered 3,gn3 Design error Mm. mum intake seipknt temperature was increawd.
IIPCI Failure 10-Pressure switch isolatum vahe N,ne.
Imlated pressure switch c.ctuated due to(banging emironrnental False ter Suction inadvertently chwed.
condiikms.
Pressure Trip IIPCI I ailure 11 -
Gwr wi<m of pressure switch scaA Pressure switch replaced real trwrosum alkued moesture into casing and shorted un' g.
m
~
laise Ifigh TurNne shaust Pressure kaat itPCI i adure 12 -
Ishaust line swmg check salve fadure Chcrt rahr replurd I ailure of check valve was References [11) nd ]!4l attributed to ewerstressed evctmg prtwide funher Normal!y Open
%xicd MOV due to high exhaust pressure.
informarkm.
Turbine 13haust Valve I ads Owed IIPCI I'adure 13 -
Irrel switches out of cabbraism Switches replaced.
Accumulati m of foreign material on Ikut caused fadure.
f CNi/ Suppression Pool togic I ads
DIST ?.lBUTION No. of Copies No. of Copies OFFSITE U.S. Nucleai Regulatory 2
B. Gore Commission Pacific Northwest Lab.
Rich;and, WA 99352 A. El Bassoni OWFN 10 E4 QNSITE W. D. Beekncr 26 Bmokhaven National Lab.
OWFN 10 E4 W. Gunther (10)
K. Cam r.c R. Itall OWIN 10 E4 J. Iliggins W. Sluer (5) 10 J.Chung J. Taylor OWFN 10 E4 R. Travis M. Villaran s
F. Congei Technical Publis' ing (5)
OWIN 10 E4 Nuclear Safety Library (2)
B K. Grimes 3
H. Vern Oheim OWFN 9 A2 Regulatory Affairs Pilgrim Nucicar Stati,n J. N. Hannon RFD #1 OWFN 13 E21 Rocky liill Road
- Plymouth, 360 E. V. Imbro OWFN 9 Al 2
H. E. Polk d
OWFN 12 H26 4
. ilgrim Resident inspectors Offic.
4 U.S. Nuclear Regulatory Commission - Region 1 2
J. Bick; F'
EG&G Idaho, Inc.
P.O. Box 1625 Idaho Falls,ID 83415 l
I l
1 NRC sonu 335 U S NUCLE AR REGUL ATORY CoMMI55loN 1 REPoR1 NUMBE R 0Mc$ m2 em ea
)m. =
B18UOGRAPHIC DATA SHEET NUREC/CR-5924 is,merucre m ones,,,,e'"'
BN l.,-NU REG-52 339
- 7. IliLE AND SUBilTLE High Pressure Coolant Injection (llPCI) System 6t ud inspection Guide 3
oAvt REPORT eustisHto 4
MON 1H v6am Pilgrim Nuclear Power Station October 1992
- 4. FIN oR GRANT NUMBE R A3875 5 AUT HORIS 6 TYPE oF REPoR1 W. Shier W. Gunther Technical s
- 1. Pn RIQO COVE R E O nacievre be '
8 PEM opMiNG ORGAN 17 ATION - N AME AND ADORE f,S fu 4Rc mean p=.aa. Ott,c, a-moyen. u.8 Nwhar.e.1n wory cone w e# mes ar serress Jf toastwree, pm am swee end me. hay saarnJ Brookhaven National Laboratory Upton, NY l1973
~
a massa me, n nc demma, ofrece er movea u s. haber Aeruktory cwamw.
- 9. SPONSORING ORGANIZATION - NAME AND ADDRESS tre 4 tc, er,=
~ m sm, ~>
Division of Radiation Protection and Emetgtncy l'reparadness Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555
- 10. RIPPLEMENTARY rooTES
- 11. A25TR ACT /M orin se mus A review of the operating experience for the High Pressure Coolant Injection (HPCI) system at the Pilgrim Nuclear Power Station is described in this report. The information for this review was obtaind frot Pilgrim Licensee Event Reports (LERs) that were generated between 1980 and 1989. These LERs have been categorized into 23 f ailure modes that have been prioritized based on probabilistic ri@. assessment considerations. In addition, the results of the Pilgrim ooerating_ experience review have been compared with the results of a similar, industry wide operating experience review. ~his comparison provides an indication of areas in the Pilgrim HPCI system that should be g!ven increased attention in the prioritization of inspection resources.
'n 4. K E Y WORDS/DE SCR:PioRS (( ses e.onds er phrases thes O asset re=*erners m docersas the spet. A IJ A'*8t*848iysiATtMkNf Risk-Based Inspection Unlimited High Pressure Coolant Inject:on Systems is. ucuao v ctassmcam~
Licensee Event Reports t ra. ew PRA Based Failure Modes Unclarsified c rsa nanen Unclassified ib. NUMBER of PAGE:.
- 16. PRICE hMC FORM 315 (24W
i i
e I
}
l 1
h i
i l
1 4
i i
e i
Printed on recycled
!l Federal Recycling Program k
. _ _.... _. _. -.. ~... - _. _,. _.. _ _ _.. -.. _... _
Z En E
E no a
>m 7
d t4 OqC 4 9 5
bh agm r, e :
3 O4 i
9
,, 4 E 3 i b-O, O M e
u, 3 3
8 35 i
SW 9
O v.
2 ez Y=
00 2
9.
8 4
t be i
N
.- i.
y 1
?3 m.
3v.
=
[,
I s
f
=0 0
E
=.
r 3,
e b
C p$
Fj 6
$ E >5 $
0 0
~
5 55 M
o:2 x
c, G3
~-
r., s' 8
e b
4
'i4 4
- l w
s 1Ii
),
l t
I*
i ' ;. ';i a i.k.l!d.a
'k:
i i, ';yl;{iii
{j )]
4!iI 4i
+
N U
R N
E U
G
'W C.
/C
- AL.
R E
S E P
N H A 5
A.
I R
9 L -
N 2
T R
4 yO G EU f
T GN F R O
I O C UT R1
,N A
LE P
AD L
NB
.DT R
O C O S A S T
T r
_. R E N _
- Y A E
2 T
U S 0CE I
S S
,E 5OS l
l 5 M G
5 I
3
- M I
0 0I P
0 0S.
R 0S E
1 I
S O
S N
U R
E C
OO I
A
'. y,
i,,
[
N
+,.
T
- l
,c I
c
.N l
Er 1 EC T
I 4
O N
^.
(
I I
P
't C
I
' r
)
SYS r
T E
~
M
,r-R I
S K
+
,s I
.e
'c I
t A
S E
e D
I N
S PECT I
O N
G U
I D
E P
O P. STR E
AR R - G S O
T C
M E
I u
TsA C T
L O
J n )f A F
.O a D S B
cF S E
G.
E l
E M t
6 SA 1
7 I
9 PL '
9 A
D,
~ 2 I
l 8
> ~
1 l:
i L
l*
> s;k,!
E r!:'!
t fii {!t t } i,t3
!f li!!il!.iI