ML20127D645
| ML20127D645 | |
| Person / Time | |
|---|---|
| Issue date: | 04/12/1985 |
| From: | Heltemes C NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | Harold Denton Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML20127B981 | List: |
| References | |
| NUDOCS 8504290003 | |
| Download: ML20127D645 (1) | |
Text
_ _ _ _ _ _ _ _ _ _ . . _ _ _ - _ _ _ . _ _ _ _ _ _ _ _ _ __. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ___________ _ _ _ _ - _ _ ._
o r' j
, UNITED STATES -
'[,
8 g NUCLEAR REGULATORY COMMISSION b y WASHINGTON, D. C. 20555 s y a c', . - _
- " g-APR 12 25 .
MEMORANDUM FOR: Harold R. Denton, Director f
Office of Nuclear Reactor ReSulation FROM: C. J. Heltemes, Jr. , Director Office for Analysis and Evaluation of Operational Data
SUBJECT:
GENERIC ISSUE N0. 55
" FAILURES OF CLASS lE SAFETY-RELATED SWITCHGEAR
_ CIRCUIT BREAKERS TO CLOSE ON DEMAND"
REFERENCE:
Memorandum for R. M. Bernero from H. R. Denton dated March 27,1985 " Schedule for Resolving and Completing Generic Issue No. 55'-
In reviewing the attachment to the referenced memorandum which dealt with the prioritization evaluation of Generic Issue No. 55, we note that the evaluation of the issue by PNL was based on the assumption that AE00 Recommendations 2 and 3 (of Case Study C301) were implemented. Howeve r, as noted in the memorandum for D. Eisenhut from R. Spessard dated June 1, 1984 (Reference 664~of PNL report) licensees, with few exceptions, were not providing additional surveillance or monitoring of electrical equipment to verify operability or to detect unmonitored failures. Thus, the assumption does not seem to be correct and, consequently, the conclusion of the report may be invalid.
Because of the potential safety concerns raised by this issue, we believe that.it is important.to verify whether AE0D Recommendations 2 and 3 of Case Study C301 are being fully implemented.. In this regard, please see if the recommendations made in the memorandum from R. Spessard to D. Eisenhut dated June 1,1984 could be utilized to achieve this. If these recommendations are 'not being fully implemented, further_ action appears necessary to expedi-tiously.and properly resolve this generic issue.
i C. e temes Jr., Director l Of for Analysis and Evaluation
$$Mggg of Operational Data
Enclosure:
Prioritization Evaluation of ;
Generic Issue No. 55 l J
.Unmonitored Failures of Class 1E Safety-Related Switchgear cc w/ enclosures: l D.-Eisenhut, NRR R. Spessard, R III E. . Jordan, IE R. Walker, R II R. Bernero, NRR D. Hunter, R IV L. Riani, NRR i i
, ,,[e avuq'o,,
,, UNITED STATES g- , g NUCLEAR REGULATORY COMMISSION .
r, g, WASHINGTON,0. C. 20555 h..CM g/g MAR 2 71983 f1EMORANDt'M FOR: Robert M. Bernero, Director Division of Systems Integration FFOM: Harold R. Den'on, Director Office of Nut. ear Reactor Regulation
SUBJECT:
SCHEDULE FOR' RESOLVING AND COMPLETING GENERIC ISSUE .
NC. 55 - FAILURE OF CLASS IE SAFETY-RELATED SWITCHGEAR
CIRCUIT BREAKERS TO CLOSE ON DEMAND This memorandum approves of a priority ranking of " DROP" for Generic Issue No. 55, " Failure of Class IE Safety-Related Switchgear Circuit Breakers to Close on Demand." The evaluation of the subject issue is provided in the enclosure.
In accordance with NRR Office Letter No. 40, " Management of Proposed Generic Issues," there is no separate resolution to this issue to be monitored by the
.. Generic Issue ifanagement Control System (GIMCS). However,. the attached evaluation will be incorporated into NUREG-0933, "A Prioritization of Generic ;
~
Safety Issues," and is being sent to other NRC offices, the ACRS, and PDR for comments on the accuracy and completeness of the evaluation. Any changes as -
l
, a result of coments will be coordinated with you. -
Should you hav.e any questions pertaining to the contents of this memorandum, please contact' Louis Riani (24563).
/[ . I l
~
Harold R. Denton, Director Office of Nuclear Reactor Regulation
Enclosure:
l
'Prioritization Euluation -
cc: See next page .
lO o c ~ 1i7 0 2 7 4_
6 1
L'.Ar, % 7 555
- 2-cc: V. Stello
.J..Funches '
R. liinogue, RES '
J. Taylor, IE .
C. Heltemes; Jr., AE00 J. Davis F. Rowsome W. Minners ACP.S PDR '
R. Capra .
R. Emrit L. Riani -
e e
( ,
W
\
S
- e
.g i
1 ENCLOSURE
- PRIORITIZATION EVALUATION GENERIC ISSUE NO. 55
" FAILURE OF CLASS IE SAFETY-RELATED SWITCHGEAR CIRCUIT BREAKERS.TO CLOSE ON DEMAND" O I 6
e O
\
O .
O D
g 9 e
- I' i
g
- 4 e
O
- -- *w- - - -- s - - - _ _ _ _ _ _ - _ _ _ _ _ _ _ . _ _ _ _ . _ _ _ _ _ _ . , _ _ _ ._ , , . _ . , _ _ _ _ , . ,
.2 .:
e ISSUE 55:
" FAILURE OF CLASS 1E SAFETY-RELATED SWITCHGEAR CIRCUIT BREAKERS CLO5E ON DEMAND ,
DESCRIPTION -
4 Historical Backcround -
i I
In August 1982, AEOD reviewed a number of LERs related to Class.1E safety-related switchgear circuit breakers and found a high incidence of their failure to close on demand. A preliminary report was written and transmitted to NRR with recommendations for improvements.2si NRR reviewed the AE00 report and did
-not agree with the AEOD conclusion.as The preliminary AEOD report was later '
finalized, issued as a reactor case study (AEOD/C301), and transmitted to .
NRR.ssi A further NRR review of AEOD/C301 showed that NRR agreed with only one of the four AEOD recommendations. However, because of the AE00 concerns, NRR agreed to prioritize the issue.ssa l As a result of the AEOD concerns, IE Information Notice No. 83-50ssa was issued toljpenseesinAugust1983. Comments on AE00/C301 were also provided by Regich III.ss4 .
Safety Significance
'. The. majority of safety systems contain large electrical components such as motor's for pumps. Electr'ical circuit breakers must be closed to feed the power to these components. In addition, for cases of loss of Offsite power, the diesel generators must be connected (via breaker) to power all the plant elec-l trical equipment. All of these breakers are normally closed by remote automatic electrical signals; however, they can be closed manually by an operator at the switchgear; provided the circuit breaker closing circuit, control power, and breaker operating mechanism are free of defects. Failure to close the required breakers coulti lead to core-melt. This issue applies to the design and opera-tion of all nuclear power plants.
l Possible Solutions The possible solutions to this issue are considered to be the four recommenda-2
,. tions :1 made by AE00 and subsequently reviewed 2sz by NRR:
(1) Provide for monitoring the status of the closing circuit of Class IE L
, safety related switchgear circuit breakers and, for appropriately .-
selected breakers such as diesel generator output breakers, make the status indication available to the control room operator.
Further,-
other selected breakers which are normally open and through which emergency equipment is powered should be reviewed to determine if such monitoring may also be warranted.
(2) In the short-term, licensees of operating reactors should establish
- regular local surveillance of Class 1E switchgear circuit breakers to monitor the readiness statu's of the spring-charging motor of each unit.
U - -, _ ___.__ __. _ -- _ - . _ _ _ , . . _ _ .. . _ , . - - _ . _ _ _ _ . .. .__
(3) In addition to the above, measures that tend to preclude dirty or corroded contacts, poor electrical connections, b. lown control circuit fuses, and improper return of breakers to operable status should be incorporated into the maintenan'ce procedures and used in actual main-tena.%e practice.
(4) Shift operating personnel should receive periodic training in the logic and operation of circuit breakers equipped with anti pumping controls.
PRIORITY DETERMINATION -
Assumptions -
In an evaluation of the issue by PNL,s4 isolementation of AEOD Recommendations 2 and 3 was assumed. Only the diesel generator brea.kers were considered in the analysis pecause it was felt that they wars the most significant contributors, based on their ability to simultaneously affect a large number of safety systems. The analysis was performed using ANO-1 as the repres'entative plant.
Frequency Estimate For AN0-1, only one dominant accident sequence corresponds to loss of emergency
, power--T(LOP)LD 7 YC.ssa of its minimal cut sets (dominant), only the following involve'diesbl generator-related failures: .
T(LOP) LF-AC-DG1 LF-AC-DG2 LF-EFS-Ell - [0.36]
. T(LOP) LF-AC-DG1 LF-AC-DG2 LF-EFC D1D2CM - [0.'05],
~
where the numbers in brackets [ ] represent the probabilities of nonrecovery i within the est'imated one-hour 6 ration prior to onset of a core-melt.
The terms related to diesel generatar failure (LF-AC-6G1 and LF-AC-DG2) are redefined as follows to include a circuit breaker failure CBF:
~
~
LF-AC-DG1 = (LF AC DG1). + CBF1
.LF-AC-DG2 = (LF-AC-DG2). + CBF2, where the terms with the subscripts "*" represent the original terms and the designators "1" and "2" un CBF correspond to diesel generators "1" and "2",
. respecti vely. These term redefinitions result in the generation of two "new" '
.- minimal cut sets, representing the affected minimal cut sets for this issue:
~
, 'T(LOP) CBF1 CBF2 LF-EFS-Ell - [0.36]
T(LOP) CBF1 CBF2 LF-EFC-DID2CM .[0.05] ,
The terms CBF1 and CBF2 were then calculated using the following approach. A fault tree for failure to energize Class IE safety related electrical loads was constructed. This is caused by either diesel generatar failure or failur.e~of e
9
~ a -m. , -
- - .. - - __ = .
3- i the circuit breaker in its open position. The circuit breaker is failed open .
as a result of a failure in the breaker closing circuit and, failure of the operator to order that the breaker be activated locally. .
The latter is dominated by human error events.
Failure to close the circuit' breaker normally results from either an incorrect operator response or failure of the operator to respond to breaker position indicator lights. An incorrect operator response may occur if the operator responds to the wrong indicator light or his order to manually operate the breake" is misunderstood by another workman and the wrong breaker is closed. Failure of the operator to respond could be caused by improper indication of the breaker position or the operator failing to respond to correct light indications. Table 3.55-1 below lists the probabilities per demand for the basic events of this fault tree. - - 1 TABLE 3.55-1 1
Event Probability Information Source (1) Operator responds to wrong light P(1) = 5 x 10 s NUREG/CR-1278sas (2) Workman throws wrong breaker P(2) = 5 x 10 8 NUREG/CR-1278sas (3) Improper light indication P(3) = negligible ) WASH-1400ts
,, (4) Operator fails to respond P(4) = 2.5 x 10 1I )
. ' (a) Improper light indication requires 'two simultaneous demand-type failures of indicator. lights i.e. , green-light. failure due to burn out and red-light indication due to spurious current. Prob-abilities for such failures are on the order of 1 x 10 s and
. negligible compared to those for human error.
(b) Froe data for failure to respond to one of M lights on panel; valu,e used corresponds to M > 40.
i Failure of the operator on demand to effect on demand a manual bypass of the failed closing circuit is then equivalent to an unavailability given by:
ABF = P(1) + P(2) + P(3) + P(4) = 2.6 x 10-1 The unavailability of the diesel generator breaker closing circuit 'was estimated from the incidents reported in the AEOD preliminary report: 2st Number of failure to close events = 94 Number of reactors affected = 42 Period considered = 5.25 years 1
Analysis of these data shows that the numbei of incidents varied fres O to 3 per reactor year and 1 to 8 per 5.25-year period for individual reac10rs. As ;
these data were derived from required LERs, it is assumed that no such failures :
of the Class 1E circuit breakers were recorted from any other operating reactor.
r .
. 4-Assuming periodic inspection every W weeks and a 1-day repair time if a breaker closing circuit is found defective, Average down-time (T) = (W/2.+ 1/7). weeks.
N '
Failure. frequency (A)=(341)f52)perweek
- where N p = number of failures 341 = the sum of reactor-years in reporting period 52 = the number of weeks / year 1
Unavailability.of breaker closing circuit (KBCC) is given by: -
XBCC = A T Unavailability.of breaker to close on demand (ICBF) is given by:
CBF " BCC
- kF
. = 0.26 KBCC The.un. availability of the breakers to close on demand is critical in the case
- - t. hat transfer of safety-related electrical loads.to diesel generator power is required. The AEOD report noted that approximately 25% of the incidents reported in'volved a diesel generator output breaker. The failure frequency. .
calculation therefore assumed Np = (94)(0.25) = 23.5. Therefore, A = (3 ) 52) = 1.33 x 10-8/ week The following table summarizes I and K for three inspection frequencies:
BCC CBF Breaker Unavailability as a ' Function of Inspection Frequency
' ~ X A CBF_
Inspection BCC Frequency (W) .
[(A)(T)] M0.26) (ABCC)3
. 4 weeks 2.9 x 10-8 -
8.0 x 10-4 '
. - 2 weeks 1.5 x 10-8 4.0 x 10-4 '
1 week 8.6 x 10-4 -
2.3 x 10-4 NRC has no regulatory requirement for monthly inspections. However, assuming licensees' current inspection procedures require monthly inspections of the circuit breakers, the base case frequencies of the affected cut sets become 3 x 10-20/RY and 4.8 x 10-22/RY, respectively. Original values frem the ANO-1 study are used for'all terms,except CBF1 and CBF2 (which are taken as 8.0 x 10-4 as shown before). Thus, the base case affected core-melt frequency is 3.5 x 10-10/RY for PWRs. Scaling this value for BWRs resulted in a basi case affected core-melt frequency of 2.6 x 10-10/RY.
Increasing the inspection frequency to once per week results in an adjusted case core-melt frequency of 2.8 x 10-12/RY (based on an adjusted case value of 2.3 x 10-4 for CBF1 and CBF2). Therefore, the reduction in core-melt frequency .
for PWRs and.BWRs is 3.2 x 10-10/RY and 2.4 x 10-10/RY, respectively. ,.
Consequence Estimate -
There are 90 PWRs and 44 BWRs with average remaining lives of 28.8 years.and 27.4 years, respectively. Based on the reductions in core-melt frequency cal-culated above, PNL determined that the total public risk reduction associated with this issue is 2 man-rem.-
Cost Estimate -
Industry Cost:
The costs to implement the recommendations were estimated by PNL.** Assuming 5.5 man-weeks / plant would be required to implement the recom-mandations in the plant procedures for operating plants, the total implementa-tion cost was estimated to be $1.17M. Future plants are not affected since the above plans can be incorporated in their initial procedures.
Based on an increase in labor of 2.5 man-weeks / plant yr for weekly inspections and/or maintenance of Class IE diesel generator circuit breakers, the total
! operation and maintenance cost is $21.5M. This estimate includes training time.
,, Thus. the total. industry cost is approximately $23M. . .
NRC Cost: The cost for development of the solution was calculated to be
$120,000, based on an estimate of 1.2 man yrs. It was assumed that NRC review and approval of industry plans for implementing the solution would involve .
1 man-week / plant for a total cost of $160,000 for all plants . NRC labor to check utility compliance N with the solution through inspection / verification was assumed to be 1 man-hr/ plant yr. Thus, total operation and maintenance costs were estimated to be $215,000. Therefore, the total NRC cost associated with the solution to this issue is approximately $0.5M.
Value/ Impact Assessment
. . Based on an estimated public risk reduction of 2 man rem, the value/ impact score is given by:
3 -
2 man-rem
$23.5M l .
= 9 x 10-2 man-rem /$M l
Other Considerations (1) The low cost recommendations i.e. , revising procedures, could be cost-beneficial on those plants that have experienced a relatively larger number of failures. -
d s
-s m- ~e-e~ -, - , - - , - - ~ , _,n- - . . , , - - . - , _ . _ . _ _ _ _ _ _ _ _ _ _ -_ _ __ _ _ _ . , _ _ _ _
^~ '
(2) The area of diesel generator output breakers has also received attention during the staff's investigation of USI A-44, " Station Blackout." In NUREG/
CR-2989,ses it was concluded that the output breakers #(in combination with load sequencers) were responsible for about 10% of all emergency AC power system ~ failures. The Regulatory Guide which is to be issued along with the resolution of USI A-44 will address the area of diesel generator output.
breakers as part of reliability improvements of onsite sources. .
(3) The NRR responsessa to AEOD concluded that the overall issue could be effectively addressed by improvements in caintenance procedures and periodic testing. IE Information Notice No. 83-50ssa was later issued by OIE.
(4) Implementation of the solution will not increase occupational dose thecause
- it involves the specification and authorization of inspection procedures.
' However, occupational dose from operation and maintenance of the solution was estimated to increase by 750 man-rem.
CONCLUSION
- l. In AEOD/C301, a number of failures of circuit breakers were tabulated and then evaluated to determine recommendations to remedy the problems found. This report.did not provide any evaluation of the potential safety significance j '
of the, failures and did not address the following question: Are such failures an indication of an unacceptable failure rate? Based on t'he above risk analy-6 sis, we have concluded that the potential safety significance does not appear to indicate a need for issuing generic requirements. Furthermore, the issue -
was adequately addressed by IE Information Notice No. 83.50.ssa Based on the value/ impact score calculated above, this issue should be DROPPED from further consideration.
\
REFERENCES
- 16. WASH-1400 (NUREG-75/014), " Reactor Safety Study, An Assessment of Accident
( Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Commission, October 1975. -
- 64. NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Prioritiza-tion -Information Development," U.S. Nuclear Regulatory Commission.
- 281. Memorandum for H. Denton, et al., from C. Michelson, a " Case Study Report ,
! . . - Failure of Class 1E Safety-Related Switchgear Circuit Breakers to Close on Demand," August 4, 1982. '
282. Memorandum for C. Michelson from H. Denton, "AEOD Preliminary Report on Failures of Class IE Safety-Related Switchgear Circuit Breakers to Close l on Demand, September 23, 1982.
l 339.NUREG/CR-1278,"HandbookofHumanR$liabilityAnalysiswithEmphasison Nuclear Pow *er Plant Applications," U.S. Nuclear Regulatory Commission ,
February 1983. '
W pre-+---.. , a. ,_.a ___ _ _ . . . - . _ - , . . _ . - , . . , . . . . _ - , . . _ - . ,_r m_. _ _ _ _ _ . , _ , _ . _ , , , - ___.,...,.._g, ,,
7-366. NUREG/CR-2787, " Interim Reliability Evaluation Program: Analysis of the Arkansas Nuclear One - Unit One Nuclear Power Plant," U.S. Nuclear Regulatory Commission, June 1982. t 661. ' Memorandum .for H. Denton from C. Heftemes, " Failures of Class IE Safety
- Related Switchgear Circuit Breakers to Close on Demand," April 29, 1983.
662. Memorandum for C. Heltames from H. Denton, "AEOD April 1983 Report on Failures of Class 1E Safety-Related Switch Gear Circuit Breakers to Close on Demand," June 17, 1983.
663. IE Information Notice No. 83-50, " Failures of Class IE Safety-Related ~
Switchgear Circuit Breakers to Close on Demand," August 1, 1983. , , . .
664. Memorandum for D. Eisenhut from R. Spessard, "Unmonitored Failures of Class 1E Safety-Related Switchgear Circuit Breakers and Power Supplies (AITS-F03052383)," June 1, 1984.
i 665. NUREG/CR-2989, " Reliability of Emergency AC Power System at Nuclear Power Plants," U.S. Nuclear Regulatory Commission, July 1983. ,
- - ^
5
\
S
. e i
4 9
5 e
, _ _ , _ . ,-n. - . - - - - - - - - - ~ ~ ~ - ' ' '