ML20128N445

Auxiliary Feedwater System RISK-BASED Inspection Guide for the San Onofre Unit 2 Nuclear Power Plant

ML20128N445
Person / Time
Site:	San Onofre
Issue date:	02/28/1993
From:	Bumgardner J, Gore B, Moffitt N, Pugh R, Vo T Battelle Memorial Institute, PACIFIC NORTHWEST NATION
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-L-1310 NUREG-CR-5766, PNL-7609, NUDOCS 9302230239
Download: ML20128N445 (36)

Text

-

NUREG/CR-5766 PN L-7609 Auxiliary Feecwater Sys~:em Ris1-Basec Insaection Guic e

for de San Ono:?re Uni: 2 Nuclear Power Plant Pregued by it Pugh,11. F Gore. T. V. Vo. J. D. Ilumgardner, N. E. Moffitt Pacific Northwest Laboratory Operated by Battelle Memorial Institute Prepared for U.S. Nuclear Regulatory Commission p$k ko$!k O!O$ PDR61 0

l AVAILADILITY NOTICE Avadab.lity of Reference Matenal: Cited in NRC Pubhcations M+st documents cited in NRC publications witi be avaRabte from one of the fortowing sources;

1. The NRC Public Document Room. 2120 L Street. NW Lower Level. Washington. DC 20555

2. The Superintendent of Documents, U.S. Govemment Prnnting Office, P.O. Box 37082, Washington, DC 20013-7082

3. The National Technical Information Service. Spring' eld VA 22161 Although the ilsting that tollows represents the majoritr of documents cited in NRC pubhcations 6t is not intended to be exhausttve.

Referenced documents available for inspect!on and coppng for a fee ftom the NRC Public Document Room include NRC correspondence and internal NRC memoranda: NRC butletins. circulars, information notices, inspection .

• Investigation notices; licensee event reports; vendor reports and correspondence; Comer 9s.

sion papers; and applicant and hcer'seo documents and correspondence The fonow!ng documents in the NUREG senes are avai!abte for purchase from the GPO f a!es Program:

f ormal NRC staff and contractor reports. NRC-sponsored conference proceedings, international agreement reports grant pubucations, arid NRC cocktets and brocNres. Also available are regulatory guides. NRC regutatsons in the Code of f oderal Regulations. and NJciear Regulatory Commission Issuances.

Documents avadable from the National Technica! Informatson Servict include NUREG-senes reports and technical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commis-tion, forerunner agency to the Nuclear Regulatory Commission, Documents available from pubhc and specal 'echnical libraries lnclude di cpen literature items. such as books. journa! articles, and transactions. Federal Repster noticus. Federa? and State legsstation. and con.

gress'onal reports can usua!ly be obtained from these isbraries.

Documents such as theses. d:ssertations, foreign reports and trans ations, and non-NRC conference pro-ceedings are ava:!ab;e for purchase from the organdation sponsonng tne publication caed Singte copies of NRC craf t reports are avadabte free, to the extent of supply. upon wntten reauest to the Office of Admitystration. Dtstribut.on and Ma3 Services Section. U,S. Nuclear Regulatory Commission.

Washington DC 20555.

Copies of Industry codes and standards used in a substantive manner tn the NRC regulatory process are matntained at the NRC Library. 7920 Norfolk Avenue. Bethesda, Marytand, for use by the public. Codes and standards are usuait copyrignted and may be purchased from the originating organl2ation or, if they are Amencan National Standards, from the Amencan National Standards institute.1430 Broado y. New York.

NY 10018.

DISCLAIMER NOTICE Th s report was prepared as an ascount of work sponsorec' by an agency of the United States Government Nestner the United States Government nor any agency tnereof, or any of their employees, makes any warranty, expressed or imphed, or assumes any legaf hab.hty of responsibility for any third pany's use, or the results of such use, of any information, apparatus, product or process d:sclosed in ins report or represents that its use by $Uch third party would not inforK;e privateIy owned rights.

i

t i

NUREG/CR-5766  ;

PNL-7609 Auxiliary Feedwater System Risk-Based Inspection Guide for the San Onofre ~ Unit 2 Nuclear Power Plant idanuscript Completed: December 1992 Date Published; February 1993 Prepared by R. Pugh, B. F. Gore, T. V. Vo, J. D. Ilumgardner, N.13. Moffitt Pacific Northwest laboratory Richland, WA 99352 Prepared for Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation

- U.S. Nuclear Regulatory Commission Washington, DC 20555 NRC FIN L1310

f Abstract in a study sponsored by the U.S Nuclear Regulatory Commission (NRC), Pacific Northwest Laboratory has developed and applied a methodology for derising plant-specific risk-based inspection guidance for the auxiliary feedwater (AFW) system at pressurized water reactors that have not undergone probabilistic risk assessment (PRA), This methodology uses existing PRA results and plant operating experience information. Existing PRA-based inspection guidance information recently developed for the NRC for various plants was used to identify generic component -

failure modes. This information'was then combined with plant specific and industry-wide component information and failure data to identify failure modes and failure mechanisms for the AFW system at the selected plants. San Onofre-2

.was selected as one of a series of plants for study. The product of this effort is a prioritized listing of AFW failures which have occurred at the plant and at other PWRs. This listing is intended for use by NRC inspectors in the preparation ofinspection plans addressing AFW risk-important components at the San Onofre-2 plant.

e i

iii NU'R EG/CR-5766

+ w .-3s. n ..m.- . < . , , .

. ,,..,m..- .,~r,.... m. ..w.,_o-y,mc,, . . , , , . - , , ,_-.-s ,a- r+----- - -

h I

-4 Contents i

Abstract . . . . . . . . .. .. . . . . . .. . . . . . . . .. ............. . . ... . . . .. . ..... .. . . . ........ iii -

i Summary . . . . . . .. . .... . . . . . . . . . . . . . .. ..... . . . . .. . . . ... . . . . . . ........ vii g Acknowledgments ... . .. .. . .. . . .. . . . . . . . . . ... ............................... ........ 'ix 1 Introduction ..... ... . . . . .. . . ..... ..... . . . . .. . . .. . . . .. . . .. . . . . ........ - 1.1 2 San Onofre-2 ABY System . . . . , ., . . . . . . . . ... ...,,, . . . . . . . . . . . ... ... ,,, _ 2.1 '

2.1 System Description . . . , . . . . . . . . .. . . .. ... ........ . . . . . .. . . . . . . ... . . ........ 2.1.

2.2 Success Criterion ..... . . . . . . .. . . . . . . . . .. ... . . . . . . . . . .. . . . . . .. .. .. .. ' 2.2 -

2.3 Splem Dependencies .. . . . , , . . . . . . .. ............... . . . . . . .. . . . .. . . . ........ _ 2.2 2.4 Operational Constraints . . . . . .. . . . . . .. , .. . . . . . .. ... . . . . . . . ........ . 2.2 -

3 Inspection Guidance for the San Onofre.2 'ARV System . . . . . . , .. . . . .. .. .. .. .. . . 3,1 3.1 Risk Important ARY Components and Failure Modes . ... . . . .. . . .. . . . . . . . . . . ........ . 3.1

- 3.1.1 Multiple Pump Failures Due to Common Cause .. .. . .. . . .. .. . . .. . . . . . . . ...... 3.1 3.1.2 Turbine Driven l' ump P140 Fails to Start or Run . . _ , . . . . .. . . . . . . ... . . . ... ... 3.2

. 3.1.3 Motor Driver Pump P141 or P504 Fails to Start or Run . . . . . . . . . . . .. . , . . . . .. ........ ~ 3.4 3.1.4 Pump Unavailable Due to Maintenance or Surveillanec . . . . . . . . . . . . . . . . . . ....... 3.4 3,1.5 Electrohydraulie Controlled Valves ilV.4714,4731,4762, or 4763 Fail Closed . . . . . . . . . . .. .. .... .......... . . . . . . .. . . . .... .. . .. 3.4 3.1.6 Motor Operated Valves llV-4705, 4706, 4712, 4713, 4715, and 4730 . . . . . . . . . . . . . . . . . . . . . . 3.4 3.1.7 Manual Suction or Discharge Valves Fail Closed . . .. .. . . . . . . . . . . ' 3.5 3.1.8 Leakage of Hot Feedwater Through Check Valves . . . . . . . . . . . . .. . . . . . . . . ... .. 3.6

. 3.2 Risk Important ARV System Walkdown Table . . . . . . . . . . . . . . . . . . . .. . . . .- . . . ... ... 3.6 I.

4 . Generic Risk Insights from PRAs . . . .. . . . . ... .. . . . . . . . . . .. . . . . . . . . ..... 4.1

j. 4.1 Risk Important Accident Sequences invoking ABY Sptem Failure . . .. .. . . . . . . .... L4.1 '

l '4.2 Risk Important Component Failure Modes ... .. , . . . .. . . .. .. . .. ..... 4.1 :

l.

l- ~ 5 Failure Modes Determined from Operating Experience , .. . . . . . . . . . . . .. .

Sj

-5.1 San Onofre Experience . . . . . . . . . . . .. . . . . . . . . , , . . ... - 5.1 -

j 5.2 Industry Wide Experience . . . . . . . .. ..., ... . . . . . . , . . , . . 5.2 l

l 5.2.1 Common.Cause Failures . . . . . . . ... . . . . . . . . . . . ... .. L 5.2 5.2.2 Human Errors . . . . . . . . . . . . . .. . ... 5.4 5.2.3 Design /EngineeringProblems and Errors . . . . . , . ,, 5.4 5.2.4 Component Failures . . . . . . . . . _ . . ... .. 5.5 -

y NUREG/CR-5766 y

,y, . .-. , - , - , . - - -. , -.-.,,,y,_, , , . -yy ,, - , w ,-,,g.,r_..,-, ,.-.,,..,m- -.,--,4 .w v m . , - .

-v,

m Table

. .. . .. .. . .... . 3.7 3.1 Risk Important AITV System Walldown Table .. ... . .

Figure 2.3 2.1 San Onofre Unit 2 Auxiliary Feedwater System .. .. ... . . . .. . ... . ,.....

NUREG/CR-57Mi vi

. -. . . - - _ _ _ _ - -~ _ _ - _ _ _ _ _ _ _ _ - _ _ - - _ - - - - _ _ _ - - __- ____-_-

f E

i i

Summary This document presents a compilation of auxiliary feedwater (AIM) sptem failure inthrmation which has been ' "

screened for risk significance in terms of failure frequency and degrada%n of system performance. It is a risk-prioritized listing of failure events and their causes that are significant :nough to warrant consideration in inspection .

planning at the San Onofre-2 Nuclear Power Plant. This information is presented to provide inspectors increased  :

resources for inspection planning at San Onofre-2.

The risk importance of sarious component failures modes was identified ' malysis of the results of probabilistic risk assessments (PRAs) for many pressurized water reactors (PWRs). Ilow he component failure categories identi- _,

fied in PRAs are rather broad, because the failure data used in the PRAs is on aggregate of many individual fadures "

having a variety of root causes. In order to help inspectors focus on specific aspects of component operation, main.

3*

tenance, and design which might cause these failures, an extensive review cf component failure information was per-formed to identify the tank and root causes of these component failures; iloth San Onofre and industry-wide failure information was analy7ed. Failure causes were sorted on the basis of frequency of occurrence and seriousness of coa. .

sequence, and categorized as common cause failures, human errors, design problems, or component failures.

This information is presented in the body of this document. Section 3.0 provides brief descriptions of these risk-important failure causes, and Section 5.0 presents more extenshe discussions, with specific examples and references.

The entries in the two sections are cross-referenced. An abbreviated system wa!Ldown table is presented in Section 3.2 which includes only components identified as risk important. -This table lists the sptem lineup for normal, standby i system operation.

This information permits an inspector to concentrate on components important to the prevention of core damage. ,

Ilowever,it is important to note that inspections should not focus exclusively on these components. Other compon- '

ents which perform essential functions, but which are not included because of high reliability or redundancy, must also be addressed to ensure that degradation does not increase their failure probabilities, and hence their risk _importance.

t m

t i

a vii NUREG/CR-5766

l' -.

l 4

Acknowledgments - -

l We wish to thank .ae personnel at the San Onofre Nuclear Generating Station for their efforts in rendwing and -

- validating this report. A special noie of thanks is given to Greg Becker of the Operations group for his efforts in validating the walkdown table, i'

i D

9 1

l L

1 l-;

ix NUREG/CR-5766

1 Introduction .

This document is one of a series prosiding plant-specific he remainder of the document describes and discusses-inspection guidance for auxiliary feedwater (AFW) the information used in compiling this inspection guld-systems at pressurized wmter reactors (PWRs). This ance. Section 4.0 describes the risk importance informa--

guidance is based on information from probabilistic risk tion which has been derived from PRAs and its sourecs, assessments (PRAs) for similar PWRs, industry wide As review of that section will show, the failure cate-operating experience with ArW systems, plant-specific gories identified in PRAs are rather broad (e.g., pump AFW system descriptions, and plant. specific operating falls to start or run, valve fails closed). Section 5.0 experience. It is not a detailed inspection plan, but - addresses the specific failure causes which have been rather a compilation of AFW system failure information combined under these categories.

which has been screened for risk significance in terms of failure frequency and degradation of system perform. AFW system operating history was studied to identify -

ance. The result is a risk-prioritized listing of failure the various specific failures which have been aggregated events and their causes that are significant enough to into the PRA failure mode categories. Section 5.1 -

warrant consideration in inspection planning at San presents a summary of San Onofre failure information,-

Onofre-2, and Section 5.2 presents a review ofindustry wide -

failure information. De industry-wide information was .

This inspection guidance is presented in Section 3.0, compiled from a variety of NRC sources, including following a description of the San Onofre AFW system AEOD analyses and reports,information notices, in Section 2.0. Sectiori 3.0 identifies the risk important inspection and enforcement bulictins, and generic -

system components by San Onofic-2 identification - letters, and from a variety of INPO reports as well. Some .

number, followed by brief descriptions of each of the Licensee Event Reports and NPRDS event descriptions various failure causes of that component. Dese include were also reviewed. Finally, information was included specific human errors, design deficiencies, and hardware from reports of NRC-sponsored studies of the effects of failures. He discussions also identify where common plant aging, which include quantitative analyses of cause failures have affected multiple, redundant com, reported AFW system failures. This industry-wide ponents. These brief discussions identifyspecific information was then combined with the plant. specific aspects of system or component design, operation, failure information to identify the various root causes of maintenance, or testing for inspection by observation, the PRA failure categories, which are identified in records review, training observation, procedures review, Section 3.0.

or by observation of the implementation of procedures.

An AFW system walkdown table identifying risk impor-tant components and their lineup for normal, standby system operation is also provided.

1.1 NUREG/CR.5766

2 San Onofre 2 AFW Systent This section presents an overview description of the San pump arc indepcodent from one another. Steam for the Onofre-2 AFW system, including a simplified schematic turbine driven pump is supplied by each of the two main sptem diagram. In addition, the system success cri- ste n lines from a point between the containment pene-terion, sptem dependencies, and administrative oper- tration and the main steam isolation valves. Each of the ational constraints are also presented, steam supply lines to the turbine has a check valve and a pneumaticany-actuated steam supply isolation valve.

The steam from both supply lines combines and is then 2.1 System Description directed to the turbinevia a stop vahr and a governor _

vahe. Both pneumatiwny-actuated isolation valves, the The AFW system provides fecdwater to the steam stop valve, and the controls to the governor are supplied generators (SG) to allow secondary-side heat removal with power from an emergency DC power source Each from the primary system when main feedwater is un. AFW pump is equipped with a continuous reciretaation available. The sptem is capable of functioning for 0 w system,which prevents pump dcadheading. The extended periods, which allom time to restore main minimum flow lines from cach AFW pump are indepen-feedwater flow or to proceed with an orderly cooldown dent flow paths back to tank T121.

of the plant to where the shutdown cooling system (SCS) can remove decay heat. A simplified schematic Each auxiliary feedwater pump discharge is provided diagram of the AFW system is shown in Figure 2.1. with a check vahe and k)cally operated isolation valve.

The discharge lines from the motor-driven auxiliary

' Die AFW sptem is controlled automatically by an feedwater pumps are equipped with AC motor-operated Emergency Feedwater Actuation Signal (EFAS). Initi. c ntrolvalves and ACelectrohydraulic bypass control ation of an EFAS automaticaUy actuates the AFW valves. The dixharge lines from the turbine-driven sptem to provide an AFW supply to the steam gener- pump are equipped with DC motor-operated control alors on low steam generator water level. When an y lves. Each motor-driven pump normally supplies EFAS signal is generated, the turbine-driven pump feedwater to only one steam generator, but the headers (P-140) and the correspcmding motor-driven pump may be cross-connected. The turbine-driven pump nor-(P-141 or P-5N) dedicated to the steam generator that many supplies teth steam generators. *Bvo parallel -

is initiating the signal are automatically sthrted. Tb containment is(dation valves are provided in cach auxil-deliver flow to the affected steam generator, auxiliary iary feedwater line to cach steam generator immediately feedwater control valves and isolation valves are fully outside containment. One isolation valve to cach pair is opened. When the EFAS signal clears, the control AC clectrohydraulic powered; the other valve is DC valves and isolation wives arc driven closed. Initiation motor powered. This arrangement assures a now path of a Main Steam Isolation Signal (MSIS) automatically I at least one steam generator if a valve failure occurs shuts all remotely actuated auxiliary feedwater control concurrent with a loss of AC or DC power.

valves and isolation valves unless an EFAS signal is present. Actuation of both a MSIS and an EFAS auto. CST T-121 is the normal source of water for the AFW matically isolates auxiliary feedwater flow to the rup- System and is required to store sufficient demineralized tured sicam generator and ccmtrols flow to the intact water to maintain the reactor coolant sptem (RCS) at steam generator. hot standby conditions for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> followed by cooldown to shutdown cooling initiation, with steam discharge to The normal AFW pump suction is from a scismic cate- atmosphere. Makeup to CST T-121 is normally sup-gory I condensate storage tank T 121 (150,000 Gal.). plied fr m the demineralized water 'HillTanks".

Each pump craws from a separate header through two Alternate makeup to CST T-121 is available from the locked open isolation valves. Power, amtrol, and demineralization optem, c(mdensate tank T-120 or the instrumentation associated with each motor-driven fire protedion sptem in an emergency condition.

2.1 NUREG/CR-57t6

- AFW Spiem 2.2 Success Crlferion 2.4 Operational Constraints System success requires the operation of at least one When the reactor is critical the San Onofre-2 7bchnical pump supplying rated flow to at least one of the two Specifications require that all three AFW pumps and steam generators. - associated flow paths are operable with each motor-driven pump poured from a different vital bus. _If one AFW pump becomes inoperable,it must be restored to 2.3 System Dependencies operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the plant must shut down to hot standbywithin the next six hours. If two De AFW sptem depends on AC power for motor- AFW pumps are inoperable, the plant must be shut - l driven pumps and level controhalves, DC power for down to hot standby within six hours. With three AFW control power to pumps and vahes, and an automatic pumps inoperable, corrective action to restore at least  ;

actuation signal. In addition, the turbine-driven pump one pmup to operable status must bc initiated I also requires steam availability. immediately.

l The San Onofrc-2 Tbchnical Specifications require a 144,000 gallon supply of water to be stored in the CST -

T-121 and a 280,000 gallon supply of water stored in CST T-120.

i-l NUREG/CR-5766 2.2

AFW System f4 as

- eO c Z 1

s ,

!, e 3 .

a-e 'i_ w i.

i i w ,

e 5 m 2 ,

.', N

• ~- xs ~

0 3 28 E I ,qg E GI? $;a  ? IS: a E m

32 e 3 i -

C Mg O~ ,2,< h 2

. o E e

N m Xe  :

b,,

'A Z i.!

a N . r4 y E'f 57 57 <

=

' N

• i . w N

~ b. .

. 5. Ys .Z *a e E E EO M

3 - g C

C S O e C i c k ,

Z I $,

M

- e n b T g &

.c a e

~

e ll / se 2" {l

= XOv $

=

X3* e x

M8e s

5 r-

33 a

. 3en<,

a .

es W N T N r0 3" C' r F

• ", u 9

U 2.3 NUREG/CR-5766 ,

l l

3 Inspection Guidance for the San Onofre-2 AFW System in this section the risk important components of the San 3,1,1 Multiple Pump Failures due to Common Onofre-2 AFW system are identified, and the important Cause modes by which they are likely to fail are brictly des-cribed. These failure moder include specific human The following listing summarizes the most important errors, design problems, and types of hardware failures multiple-pump failure modes identified in Section 5.2.1, which have been observed to occur for these types of Common Cause Pailures, and cach item is keyed with a components, both at San Onofre and at PWRs through- 3-digit code to entrics in that section.

out the nuclear industry. De discussions also identify _

where common cause failures have affxted multiplc, .

Incorrect operator intervention into automatic redundant components. These brief discussions identify system functioning, including improper manual specific aspects of system or component design, opera- starting and securing of pumps, has caused fail-tion, maintenance, or testing for inspection activitics. ure of all pumps, including overspeed trip on These activitics include observation, records review, startup, and inability to restart prematurely training observation, procedures review or by obser- secured pumps. CCl.

vuion of the implementation of procedurcs.

Inspection Suggestion Observe Abnormaland Table 3.1 is an abbreviated AFW system walkdown table Emergency Operating Instruction (AOl/EOI) which identifies risk important components. This table s mulator training exercises to verify that the lists the system lineup for normal, standby system opera- operators comply with procedures during observed tion. Inspection of the components identified addresses evolutions. Observe surveillance testing on the essentially all of the risk associated with ARV system ARV system to verify it is in strict compliance with operation. the surveillance test procedure.

+

Valve mispositioning has caused failure of all 3,1 Risk Important AISV Components pun.ps. Pump suction, steam supply, and instru-and Failure Modes ment isolation valves have been incived. CC2.

He multipic ARV system flowpaths at San Common cause failures of multiple pumps are the most Onofrc-2 minimize the hazard associated with risk-important failure modes of ARV system compon_ vane nu,spmuonmg.

ents. These are followed in importance by single pump f ailures, level control valve failures, and individual check Inspection Suggestion - Verify that the system valve valve backleakage failures. alignment, air operated valve control and valve actuating air pressures are correct using 3.1 The rollowing sections address each of these failure Walkdown Table, the system operating proced ures, modes,in decreasing order of importance. They present nd operator rounds :ogsheet. Review surveillance the important root causes of these component failure procedures that alter the standby alignment of the modes which have been distilled f rom historical records. AFW system. Ensure that an adequate return to from San Onofre-2 and other plants. Each item is keyed normal section exists.

to discussions in Section 5.2 which present additional information on historical events.

Steam binding has caused failure of multiple pumps. This resulted from leakage of hot feed-water past check valves and a motor-operated valve into a common discharge header. CC7, Multiple-pump steam binding has also resulted from improper valve lineups, and from running 3.1 NU R EG/CR.5766 l

l

l Inspection Guidance l

a pump deadheaded. CC10. The multiple a Simultaneous startup of multiple pumps has~

isolation valves in each AITV flowpath caused oscillations of pump suction pressure which are normally closed minimim the harard causing multiple-pump trips on low suction associated with steam binding at San Onofre-2. pressure, despite the existence of adequate static net positive suction head (NPSH). CC11.

Inspection Suggestion Verify that the pump At H. B. Robinson, design reviews have identi-discharge piping temperature is ambient. Assure fled inadequately stzed suction piping which any instruments used to verify the temperature by could have yielded insufficient NPSH to support ,

tt.e utility are of an appropriate range and included operation of more than one pump. CC12. At in a calibration program. San Onofte-2 the pumps have multiple flow-paths, but a common suuion tource.

• Pump control circuit deficiencies or design modification crrors have caused failures of luspection Suggest on - Assure that plant condi-mniple pumps to auto start, spurious pump tions w hich could result in the bk)ckage or degra-trips during operation, and failures to restart dation of the suction flow path are addretal by after pump shutdown. C3. Incorrect setpoints system maintenance and test procedures. Examples and control circuit calibrations have also include,if the AITV system has an emeigency source prevetaed ptoper operation of multiple pumps. from a water system with the potential for bio-CC4. fouling, then the system should be periodically treated to present buildup and routinely tested to Inspedian Suggestion - Review design change assure an adequate fknv car. be achieved to support implementation documents for the post mainten- operation of all pumps, or inspected to assure that ance testing required prior to returning the equip- bio-fouling is not occurring. Design changes that ment to service, Assure the testing verifies that all affect the suction flow path should repeat testing potentially impacted ftmetions operate correctly, that verified an adequate suction source for simul-and incluJes repeating any plant start-up or hot taneous operation of all pumps, Verify; hat testing functioual testing that may be affected by the design has, at sometime, demonstrated simultaneous opc t-change. ation of all pumps. Verify that surveillances adequately test all aspects of the system design func-

- Loss of a vital power bus ha3 failed both the tions, for example, demonstrate that the AITV .

turbinc-driven and one motor-driven pump due pumps will tnp on low suction pressure.

to kiss of cont;ol power to steam admission valves or to turbine controls, and to motor 3.1.2 hrbine Driven Puntp P140 Fails to controh powered from the same bus. CCi The Start or Run pumps at San Onofre.2 are electrically indepen-dent,which minimizes the risk in this area. ,

Improperly adjusted and inadequately main-tained turbine governors have caused pump Inspection Suggestion - The material condition of failures. HE2. Problems include worn or the electrical equipment is an indicator of probable loosened nuts, set screws, linkages or cable reliability. Review the Preventative Maintenance connections, oil leaks and/or contamination, (PM) records to assure the equipment is maintained and electrical failores of resistors, transistors, on an appropriate frequency for the environment it diodes and circuit carrk, and erroneous grounds is in and that the PMs arc actually being performed and connections. CF5.

as required by the program. Review the outstanding Correctise Maintenance records to assure the defi' Inspection Supion - Review PM records to ciencies found on the equipment are promptly assure the governor oil is being replaced or sampled corrected. and analy7ed within the designated frequency.

During plant walkdowns carefully inspect the NUREG/CR.Wi6 3.2

. Inspection Guidance 4 1

governor and linkages for loose fasteners, leaks, and surveillancei If the steam trap discharge is visible, unsecured or degraded conduit. ' Review vendor- assure there is evidence of liquid discharge.

- manuals to ensure PM procedures are performed according to manufacturer's recomtnendations and ' *

• Rip and throttle valve (LIV.4716) problems - M good maintenance practices. which have failed the turbine driven pump .. ,

include phpically bumping it, failure to reset it '

'Ibrry turbines with Woodward Model EG gover- folk) wing testing, and failurcs to verify c4mtrol .

nors have been found to overspeed trip if full steam room indication of reset. HE2, Whether either = -

flow is allowed on startup. Sensitivity can be the overspeed trip or 'ITV trip can be reset; i reduced if a startup steam bypass valve is sequenced without resetting the other, and unambiguity of to open first. del. At San Onofre, DCP 6020.OSJ control room and local indication of TTV posi-installed an automatic opening sequence for tion and oserspeed trip linkage reset sta tus, all =

HV-4716, which limits steam flow to the turbine affect the likelihood of these errors. DE3. ' Die-upon an automatic start. Manualstarts require TTV at the San Onofre-2 plant _has a history of-careful operation of HV-8716 to avoid a turbine being found in a tripped condition, and is now  :

overspeed. Direction is given in operating tested for trip and reset monthly under instructions on specific operations required of Surveillance Instruction SO23-3-3.16. ,

HV-4716 duting a tnanual start.

Inspection Sugestion - Car' efully inspect the TTV inspection Sugestion - Observe the operation of overspeed trip linkage and assure it is reset and in the turbine driven Aux Feed pump during pump good physical condition. Assure that there is a good testing and assure that HV-4716 stops for 2.5 steam isolation to the turbinc, othenvisc continued seconds at a valve stroke of approximately 5/32" turbine high temperature can result in degradation --

during an automatic start sequence. Review IST of the oilin the turbine, interfering with proper -

records for the valve stroke time trend. overspeed trip operation. Review training proced-urcs to ensure operator training on resetting the

+ Condensate slugs in steam lines have caused TTV is current. Observe operators during the turbine overspeed trip on startup. "Ibsts monthly surveillance, and randomly select operators '

repeated right after such a trip may fail to and have them simulate a reset of the linkage, Indicate the problem due to warming and clear- Verify the placard with the reset instructions is ing of the steam lines. Surveillances should installed near the turbine.

exercise all steam supply connections. DE2, _ .

A design change is being planned for possible 3.L3 - Motor Driven Pump P141 or P504 Fnits --

implementation in 1993 at San Onofre-2 to to Start or Run g change the steam supply tap point on the main --

steam system to the top of the pipe, as well as .

Control circuits used for automatic and manual ~

changing the supply pipe configuration and -

pump starting are an important cause of motor replacing steam traps with orifices. Until the driven pump failures, as are circuit breaker ' .

time that this is accomplished,one of the steam failures. CF7. Control circuit prohlcms and a supply isolation valves (2HV82003201) must blown fuse due to overload have occurred at

, remain closed to minimlic co:2densate build.up San Onoftc/2. .

in the steam supply piping, inspection Sugestion - Review corrective main; Inspection Sugestion '- Verify that the steam traps icnance records and non conformance reports when +

l. are valved or bypassed on the steam supply linci control circuit problems occur to determine if a . '

!- Some of the traps are in areas that require an trend exists. Every time a breaker is racked in a

- oxygen monitor for ent.ry; recommend checking PMT should be performed to start the pump,:

these traps with operations during the monthly assuring no control circuit problems have occurred .

3.3 NU REG /CR-5766 :

Inspection Guidance :

- as a result of the manipulation of the breaker. '* EHCV performance has been poor at other facili-(Control circuit stabs have to make up upon racting tics, primarily due to hydraulic problems. CFL-the breaker, as well as cell switet damage can occur upon removal and reinstallation of the breaker.) Inspection Suggestion - Monitor hydropack cycle time. If the pump starts often it is an indicator of ,

Mispositioning of handswitches and procedural internal leakage in the hydraulic system. Hydropack - 1 deficiencies have prevented automatic pump fluid should be periodically sampled or changed out.

start. HE3. __ .

_i

• Leakage of hot feedwater through check valves has _ l Inspection Suggestion - Confirm switch position caused thermal binding of normally closed flow 1 using *Ihble 3.1. Resiew administrative procedures control MOVs. EHCVs may be similarly suscep-concerning documentation of procedural deficien- tible. CF2.-

cies. Ensure operator training on proceduul . _ j changes is current. Inspection Suggestion - Covered by 3.1.1 bullet 3. i l

3.1.4 Pump Unavailable Due to Maintenance 3.1.6 Motor Operated Valves IIV-4705,4706, or Surveillance 4712,4713,4715 and 4730

+ Both scheduled and unscheduled maintenance These MOVs stntrol or isolate flow of the service water -

remove pumps from operability. Surveillance to the AFW pumps. They fail as-is on loss of power.-

requires operation with an altered line-up, .

although a pump train may not be declared . Common cause failure of MOVs has resulted inoperable during testing. Prompt scheduling from failure to use c!cctrical signature tracing .

and performance of maintenance and surveil- equipment to determine proper settings of - '

lance minimize this unavailability. torque switch and torque switch bypass . _

switches. Failure to calibrate switch settings for Inspection Suggestion - Review the time the AFW high torques necessary under design basis acci-system and components are inoperable. Assure all dent conditions has also been involved. CC11J maintenance is being performed that can be per- Diaphragm failure, packing leakage; electrical formed during a single outage time frame, avoiding camponent failure ar d seat leakage have been raukiple equipment outages. The maintenance the main causes (.; valve faile7 ai San should be scheduled before the routine surveillance Onofre-2.

test, so credit can be taken for both post mainten- . _ _

ance testing e c i surveillance testing, avoiding . Inspection Suggestion - Review the MOV analytical -

excessive testing. Review surveillance schedule for test records to assure the testing and settings are -

frequency and adequacy to verify system operability based on dynamic sptem conditions. Overtorquing -

requirements per TechnicalSpecifications. Review of the valve operator can result in valve damage-quarterly risk graphs for the Auxiliary Feed system. such as cracking of the seat or_ disc. Review the '

program to assure overtorquing is identified and 3.1.5 Electrohydraulic Contmlied Valves corrective actions are taken to assure valve opera-IIV-4714,4731,4762, or 4763 Fail Closed bility following an overtorque ctmdition. Review the program to assure EQ seals are renewed as required during the restoration from testing to These EHCVs control or isolate flow from the AFW maintain the EQ rating of the MOV.

purrys to each of the steam generators. They fail as.is during motor failure and fail closed on loss of hydraulic - Wlve motors have been failul due to lack of, or pressure.

improper sizing or use of thern,al overload -

protective devices. Bypassing and oversizing NUREO/CR-5766 3.4

_. - . . , . - - - , . .~. .

3 Impcction Guidance should be based on proper engineering for pump suction and clusure of the recond valves would j design basis conditions. CF4. block pump discharge.

Inspection Suggestion y Review the administrative

• Wlve mispositioning has resulted in failures of .

controls for documenting and changing the settings multiple trains of AFW. CC2. It has also been - l of thermaloverload protective devices. Assure the the dominant cause of problems identified information is available to the maintenance during operational readiness inspections. HEl. - 3 plaracts. Events have occurred most often during main. - i tenance, calibration, or system modifications.

Grease trapped in the torque switch spsing pack Important causes of mispositioning include:

of Limitorque SMB motor operators has caused motor burnout or thermal overload trip by +

Rilure to provide complete, clear, and specific -

preventing torque switch actuation. CF8. procedures for tasks and system restoration Inspection Suggestion Review this only if the

• Failure to promptly revise and validate proced.

MOV testing program reveals deficiencies in this ures, training, and diagrams following system area, modifications -

• Manually reversing the dire tion of motion of +

Rilure to complete all steps in a procedure '

operating or coasting down MOVs has over-loaded the motor circuit. Operating procedures +

Failure to adequately review uncompleted prot ,

should preside cautions, and circuit designs may cedural steps after task completion -

prevent reversal before cach stroke is finished.

DE7. +

Failure to verify support functions after- ,

restoration Inspection Suggestion - Verify procedures and training addicss reversal of valve direction +

Rilure to adhere scrupul6usly to administratiw midstroke. procedures regarding tagging, control and track.

Ing of valve operations Space heaters designed for preoperation storage have been found wired in parallcl with valve +

Rilure to log the manipulation of scaled valves 4 motors which had not been emironmentally qualified with them present. DE8. +

Riture to followgood practices of written task --

assignment and feedback of task completica inspection Suggestion - Spot chec_k MOV's during information MOV testing to assure the space heaters are .

x physically removed or disconnected. +

Rilure to provide easily read system drawings, .

legible valve labels corresponding to drawings 3.1.7 Mnnunt Suction or Discharge Ynives Fail and procedures,and labeled indications of k> cal i Closed valve position f . .

L TD Pumn P140 Wives S21305MU168.S21305MU122 Inspection Suggestion - Resiew the administrathe MD Pump P141: %1ves S21305MU469. S21305MU127 e ntrols that relate to valve positioning and scaling.

MD Pump P5nt: %1ves S21305 MUM S21305MU533 system restoration following maintenance, valve labeling, system drawing upda:ing, and procedure These manual valves are all normally k)cked open. For . revisi n, for proper imp!cmentation.

cach train, closure of the first valve listed would bh>ck 3.5 NUREG/CR-5766

laspection Guidance l

3.1.8 leakage ofIlot FeedwaterThrotigh 3.2 RiskImportant AFW System Check Valves: Walkdown 1hble At MFW connections: %1ves S21305MU124- Table 3.1 presents an AFW sptem walkdown table S21305MU448 including only components identified as risk important.

Between Pump P140 and MFW: %1ves S21305MU547 he i neup indicated is for normal power operation.

Between Pumn P141 and MFW: %1ves S21305MU126 This information alk)ws inspectors to concentrate their Between Pump P504 and MFW: %1ves S21305MU532 efforts on components important to prevention of core damage. Ilowever,it is essential to note that insper-

• leakage of hot feedwater through several check tions should not focus exclusively on these comments.

valves in series has caused steam binding of Other components which perform essential functions, multiple pumps. CC10. but which are abscnt from this table because of high reliability or redundancy, must also be addressed to Inspection Suggestloa Covered by 3.1.1 bullet 3. ensure that their risk importance are not increased.

Examples include the (open) steam lead isolation valves

• Slow leakage past the final checkvalve of a upstream of HV-4716, an adequate water level in the series may not force the check valve closed- CST, and the (closed) valves cross connecting the Other check valves in series may leak similarly. discharges of the two motor.dt en AFW pumps.

Piping orientation and valve design are important factors in achicsing true series protection. CF1.

Inspection Suggestion - Covered by 3.1.1 bullet 3.

I NUREG/CR.57(4 3h l

. . - - . . . . -- . .n ~ .. . _ , -

e

' Inspection Guidance

'thble 3.1 Risk Important AIV System Walkdown 'lkble l

Requird Actual -

Component # Component Name Position ' Position  :

Eiccirical -

Train A Electrical Switchgear Room 2AN04 2P 141 Motor Breaker . Indiating Lights Lit  ;

1 2BY3911 2P-141 Motor Heater Switch On Light Lit -  ;

Traio 11 Electrical Switchgear Room 2A0603 2P-504 Motor Breaker Indicating Lights Lit -

2BZ39H 2P-5N Motor Heater - Switch On Light Lit .1 Ausillary Feed Pump Room P-140 Flowpath S21305MU468 2P-140 Suction %1ve locked Open S21305MU122 2P-140 Discharge Wlve Locked Open S21305MU123 2HV-4706 Inlet Wlve Imcked Open 2HV-4706 2P-140 Discharge to S/O E4189 Closed S21305MU125 2HV-4706 Outlet Wlve Locked Open -

S'21305MU136 2HV-4705 Inlet Wlve locked Open 2HV-4705 2P-140 Discharge to 2E-088 Closed S21305MU134 2HV-4705 Outlet Wlve locked Open P-141 Flowpath

- S21305MU127 2P-141 Discharge Valve locked Open .

( S21305MU131 2HV-4713 Inlet Wlve locked Open -

I 2HV-4713 2P-141 l' isch. Flow Control Valve Ckwed

< S21305MU133 2HV-4713 Outlet Valve Imcked Open S21305MU154 2HV-4763 Inlet Wlve Open 2HV-4763 2P-141 Disch. Bypass Flow Control Wlve Closed S21305MU153 2HV-4763 Outlet Wlve - Open 3.7 - NUREG/CR-5766 - ,

j

Inspection Guidance i

hble 3.1. (Continued)

Required Actual Component # Component Name Position Ihltion P-SM Flowpath S21305MU469 2P-141 Suction Wive locked Opcn S21305MU538 29-504 Suction Wlve Imcked Open S21305MU533 2P-5M Discharge Whc Locked Open S21305MU128 .2HV-4712 Inlet Valve I.ocked Open 2HV-4712 2P-504 Flow Control Wlve Closed S2130$MU130 21IV-4712 Outlet Whe locked Open S21305MU553 211V-4762 Inlet Wlve Open 2HV-4762 2P 5W Bypass Flow Control Whr Closed S21305MU152 2HV-4762 Outic*. W1ve Open ,_

Cross-Connect %tves S21305MU634 2P-SN and 2P-141 Disch. XIlle lacked Closed S21305MU635 2P-5N and 2P-141 Disch. X-Tie Locked Closed ___

Steam Supply Whr 2HV 4716 hrbine 2K-007 7tip Throttle Wlve Reset Outside Auxiliary I'eed Pump Room SA2301MU330 Fire Water Header Isolation Wlve Open _

SA2301MU362 Deluge Isolation Valve Open SA230lMU363 Deluge Isolation Wlve Open Steam Generator 1 Main Steam Safety Wlve Area 2HV8200 Main Steam to 7briy hrbine Open

• Steam Generator 2 Main Steam Safety Wlve Area 2HV8201 Main Steam to Tbtry hrbine Closed

• Condensate "it Entry into the condensate pit requires an oxygen monitor. It is recommended that these vahres be checked with the operator during the monthly valve lineup surveillance.

S21305MU471 CST T-121 Outlet to 2P-140 locked Open S21305MU473 CST T-121 Outlet to 2P-141 Imcked Open S21305MU542 CSTT-121 Outlet to 2P-504 locked Open NUREG/CR-5766 3.8 l

1 3

i Inspection Guidance -

Thble 3.1. (Continued) e___. _

Required . Actual Component #. Component Name Position' - Position Control!!oom 1%nel 52 Steam Generator isolation 2HV-4714 Aux. Feed Disch. to 2 EMS Oosed 2HV-4715 Aux. Feed Lisch. to 2E-089 Qosed 2HV-4730 Aux. Feed Disch. to 2E-088 Gosed 2HV-4731 Aux. Iked Disch. to 2EW9 Cosed.

' (One of the akwe 2 sicam isolation valves must remain closed until the modincation to trduce condensate intnmion to .

the steam lines is installed; after which toth valves wiu le oin) i 3.9 NUREG/CR.5766

4 Generic Risk insights from PRAs PRAs for 13 PWRs were analyzed to identify risk- Steam Generator %be Rupture j important accident sequences invoh'ing loss of AFW, _

and to identify and risk-prioritize the component failure

• 6 SOTR is followed by failure of AN, main _ .l modes involved. The results of this analysis are feedwater, and emergency condensate. Coolant is described in this section They are consistent with lost from the primary until the RWSTis depleted.

results reported by INEL and BNL (Gregg et al.1988, IIPI fails since recirculation cannot be established and 'llavis et al.1988). from the empty sump, and core damage results.

4J RiskInsportant Accident Sequences 4.2 Risk Important Component Failure Involving AFW System Failure Modes loss of Power System ne generic component failure modes identified fro n .

PRA analyses as important to AFW system failure are A loss of offsite riower is followed by failure of listed below in decreasing order of risk importance.

AF,W, resulting in core damage.

(1) Thrbine-Driven Pump Pallure to Start.

A station blackout fails all AC power except Vital AC from DC invertors, and all decay heat removal (2) Motor Driven Pump Pallure to Start or Run.

systems except the turbine-drhen AFW pump.

AFW subsequently fails due to battely depletion or (3) TDP or MDP Unavailable due to Tbst or hardware failures, resulting in core damage. Maintenance.

+

abc t'us fails. causing a trip and failure of the (4) 'Ibrbine Driven Pump Pails to Run.

power conversion sptem. AFW is subsequently lost completely due to other failures. Feed-and-bleed (5) AFW Steam Admission %1ve Failures cooling fails because PORV control is lost, resulting in core damage. - steam admission vahes Transient-Caased Reactor or hrbine Trip - trip and throttle vahc l A transient-caused trip is followed by a loss of PCS (6) AFW System Wlve Pailures .

(- and AFW.

- flow control valves less of Main Feedwater

- pump discharge valves

+

.A feedwater line break drains the common water starce for MFW and AFW, ne operators fail to - pump suction valves provide fecdwater from other sources, and fail to

-initiate feed-and-bleed cooling, r.:sulting in core - valves in testing or maintenance.

damage.

(5) Supply / Suction Sources A loss of main feedwater trips the plant and renders emergency condensate unusable, and AFW fails - condensate storage tank stop valves resulting in core damage.

4.I NUREO/CR-5766

Generic Risk insights

- suction valves, important due to the multiplicity of steam generators and connection paths. Iluman errors of greatest risk in addition to indisidual hardware, circuit or importance involve: failures to initiate or ccmtrol system instrument failures,each of these failure modes may operation when required; failure to restore proper result from common causes and human errors. system lineup after maintenance or testing; and failure Common cause failures of AFW pumps are particularly to switch to alternate sources when required, risk important. Valve failures are somes. hat less t

NUREG/CR-5766 4.2

5 Failure Modes Deterniined froni Operating Experience This section describes the primary root causes of Failure of AITY Pump Discharge Flow Control and -

mmponent failures of the AIAVsystem, as determined Hypass Whe to Steam Generators from a review of operating Alstories at San Onofre and at other PWRs throughout the nuclear industry. Sec- Nincteen failures of the AFW pump discharge flow con- ,

tien 5.1 describes experience at San Onofre. Section 5.2 trol and bypass valves were found in the events exam-  !

summarizes information mmpiled from a variety of ined. These resulted from failures of valve contial j NRC sources, including AEOD analyses and reports, circuits,vahr operators and vahe breakers. Rilures l

information notices, inspection and enforcement bulle- have resulted from DC control grounds, valve binding, i tins, and generic letters, and from a variety of INPO dirty or worn contacts, improper torque switch opera. I reports as well. Some Licensee Esent Reports (LERs) tion, electrial mmponent failure, frayed wiring, valve and NPRDS event descriptions were also reviewed. operator mechanical failure and low hydraulic flui,1 Finally, information was included from reports of NRC- l pressure. Rtilure causes are mechanical wear, contact  ;

sponsored studies of the effects of plant aging, which oxidation, inadequate maintenance or testing aethities l include quantitative analyses of AFW system failure and improper design and/or installation. These vahes repotts. His information was used to identify the have also experienced various packing leaks, as have various root causes expected for the broad PRA-based pump discharge check vahes, failure categories identified in Section 4.0, resulting in the inspection guidelines presented in Section 3.0. AITY Steam Generator Isolation Yahe Failures Eleven failures of the AFW steam generator isolation 5.1 San Onofre Experience valves were found in the events examined. These fail-ures resulted from valve binding, solenoid coil failure, Rete were 86 reports of AFW system equipment fail- f uled torque switch contacts, oil line Icaks, pressure ures at San Onofre between Novernber of 1983 and July switch settings, hydraulic relief salve failure, control of 1990. Dese include failures of the AFW pumps, power short circuits, and low hydraulic operating pres-pump di.scharge Dow control valves to steam generators, sure. Failure causes are mechanical wear, contact oxida-and pump suction and dischargevalves. Failure modes ti n,c mponent aging,and inadequate maintenance or include electrical, instrumentation, and hardware testing ac*!-cities.

t failures, and human errors.

l AITV'Ibrbine Stop Vahe AFW Pump Control logie, Instrumentation and Electrical Failures Fourteen failures of the AFW turbine stop valve were =

found in the events examined. These failures resulted Nineteen failures of the AFW pumps to start, run, trip from valve binding, condensation in the balancing -

when required or achieve rated speed were found in the chamber, seat leakage, control circuit grounds, actuator events examined. These occurrences resulted from fail- tor failure, torque switch misadjustment or failure, cres of the turbine governor, breakers, relays and improper trip plunger adjustment, bent or damaged contacts, turbine overspeed desice, faulty wiring and declutch shaft, and missing hardware. Pallure causes are power supplies. De failure causes are mechanical wear, mechanical wear, component aging, contact oxidation or corrosion, or improper design and installation. fouling, inadequate maintenance or testine, sethities and improper design.

5.1 NUREG/CR-5'766

Fhilure Modes lluman Erren (SFRQi) led to overspeed tripping of both turbine-driven AFW pumps, probably due to the introduction of Thn events relating directly to significant human errors condensate into the AFW turbines from the long, affecting the AFW system were found in the events unheated steam supply lines. (The system had never examined. Motor stator end coil insulation was appar. been tested with the abnormal, cross-connected steam ently damaged during repair or inspection. Extc rnal supply lineup which resulted.) In the 'Rojan event the motor components have been found broken off or operator incorrectly stopped both AFW pumps due to damaged. System leakage has resulted from improperly misinterpretation of MFW pump speed indication. The adjusted bolts. Foreign material has been found dicscl driven pump would not restart due to a protective between switch contacts. Components have failed due feature requiring complete shutdown, and the turbine-to missing parts or hardware. Both personnel ctror and driven pump tripped on overipeed, requiring local reset inadequate procedures have been involved. of the trip and throttle valve, in cm.cs where manual intenention is required during the early stages of a transient, training should emphasize that actions should

.c performco methodically and detiderately to guard 5.2 Industry Wide Experience against such errors.

Human errors, design / engineering problems and errors, CC2. Valve mispositioning has accounted for a signifi-and compor.:nt failurcs are the primary root causes of cant fraction of the human errors failing multiple trains AFW System failures identified in a review of industry f AFW. This indudes closure of normally open suction wide sptem operating history. Common cause failurts, valves or steam supply valves, and of isolation valves to w hich disable more than one train of this operationally sensors having control functions. Incorrect handswitch redundant system, are highly risk significant, and can p sitioning and inadequate temporary wiring changes result from all of these causes.

have also prevented automatic starts of multiplc pumps.

Pactors identified in studies of mispositioning errors This section identifies important common cause failure include failure to add r.:wly installed valves to valve modes, and then provides a broader discussion of the checklists, weak administrative control of tagging, single failure effects of human errors, design /

restoration, independent verification, and locked valve engineering problems and errors, and component fail-logging, and inadequate adherence to procedurcs. Ille-ures. Paragraphs presenti_ng details of these failure gibic or confusing local valve labeling, and insufficient modes are coded (e.g., CCl) and cross-referenced by - - -

training in the determination of valve position may inspection items in Section 3. cause or mask mispositioning, and surveillance which d C8 " 5 **'IS# ' *E l#I 'Y5* I""'ti "I"E " Y ""'

5.2.1 Common enuse Failures .

reveal misposttionmgs.

The dominant cause of AFW system multiple-train CC3. Design / engineering errors have accounted for a failures has been human error. Design / engineering g g gg errors and component failures have been less frequent, P dd %n Mf~cie but nevertheless sigmficant,causes of multiple train Fadey defeated AFW pump auto-start on k>ss of

"""* main feedwater. At Zion 2, restart of both motor driven E"*E

• Y '" r CCI. Human error in the form of incorrect operator e pump en tn.pped 4 an aummade start intervention into automatic AFW system functionme "" ""'^

during transients resulted in the temporary loss of alI E*#"

"" S" " ' '*" ""

safety-grade AFW pumps during events at Davis Besse have identified designs where failures of a single (NUREG-11541985) and Trojan ( AEOD/r4161983). mmp nent uld have failed all or multiple pumps in the Davis Besse event,imEreper manualinitiation of (IN 87-341987).

the steam and feedwater rupture control system NUREG/CR-5766 5.2

. . . ~ , - --- . - - ~ . . - - .- , - - .

' Pallure Modes __

CC4.: Incorrect setpoints and control circuit settings ' failures; numerous incidents cf single train failures have -

resulting from analysis errors and failures to update occurred, resulting in the designation of

• Steam Binding l

procedures have also prevented pump start and caused - of Ataillary Fredwater Pumps

• as Generic Issue 93E pumps to trip spuriously. Errors of this type may . This generic issue was resolved by Ocr.cric letter 88-03 remain undetected despite surveillance testing, unless (Miraglia 1988), which required licensees to monitor surveillance tests model all types of system initiation AFW piping temperatures each shift, and to inaintain 1 and operating conditions.- A greater fraction ofinstru- procedures for recognizing steam binding and for mentation and control circuit problems has been identi- restoring system operability, a fied during actual system operation (as opposed to ,

surveillance testing) than for other types of failures. CC8. Conimon cause failurcs have also failed motor 1 operated valves. During the total loss of feedwater esent - :J CC5. On two occasions at a foreign plant, failure of a at Davis Besse, the normally-open AFW isolation valves j balance-of-plant inverter caused failure of twoNM failed to open after they were inadvertently closed. The pumpsi in addition to loss of the motor driven pump failure was due to improper setting of the torque switch ,

whose 1.uxiliary start relay was powered by the invertor, bypass switch, which prevents motor trip on the high the turbine driven pump tripped on overspeed because torque required to unscat a closed valve. Previous prob-the governor valve opened, allowing full steam flow to lems with these valves had been addressed by increasing - ,

the turbine. This illustrates the importance of assessing the torque switch trip setpoint a a fix which failed during ,

the e.Tects of failures of balance of plant equipment the event due to the l'igher torque required due to high which supports the operation of critica! components. differential prer.sure across the valve. Similar common De instrument air system is another example of such a mode failures of MOVs have also occurred in other sys-sptem. tems, resulting in issuance of Generic les Mr 89-10, -

' Safety Related Motor-Operated Valve 'Ibsting and Sur.

CCE Asiatic clams caused failure of two AFW flow veillance (Partlow 1989)." This EenerP letter requires' control vahes at Catawba-2 when low suction pressure licensecs to develop and implement a program to pro--

caused by starting of a motor-driven pump caused suc- vide for the testing, inspection and maintenance of all tion source realignment to the Nuclear Service Water safety-related MOVs to provide assurance that they will :

system. Pipes had not been routinely treated to inhibit function when subjected to design basis conditions.

clam growth, not regularly monitored to detect their presence, and no strainers were installed The need for CC9. Other component failures have aho resulted in surveillance which exercises alternative system opera- AFW multi-train failures. These include out-of-tional modes, as well as complete system functioning is adjustment electrical flow controllers resulting in emphasized by this event Spurious suction switchover improper discharge valve operation, and a failure of oil has also occurred at Callaway and at McGuire, although cooler cooling water supply vahes to open due to silt -

no failurcs resulted. accumulation-CC7. Common cause failures have abo been caused by CC10. At ANO-2, both AFW pumps lost suction due to component failurcs (AEOD/C4Gt 1984). At Surry-2, stcam binding when they were lined up to both the CST both the turbine driven pump and one motor driven and the hot startup/blewdown demineralizer effluent :

pump were declared inoperable due to steam binding (AEOD/C4St 1984). At Zion-1 steam created by run-caused by back!cakage of hot water through multiple ning the turbine-driven pump deadheaded for onci check vahes. At Robinson-2 both motor driven pumps minute caused trip of a motor-driven pump sharing thc :

were found to be hot, and both motor and steam driven same inlet header, as well as damage to the turbine-pumps were found to be inoperable at different times. driven pump (Region 3 Morning Report,1/17M)). -130th 1 Back:cakage at Robins (m-2 passed through closed events were caused by procedural inadequacies.

motor-operated isolation valves in addition to multipic .

check valves. At Rirlcy, both motor and turbine driven CCI1. Multiple AFW pump trips have occurred at pump casings were found hot,although the pumps were Millstone-3, Cook-1,'Itojan and Zion 2 (IN 87-531987) not declared inoperable. In addition to multi. train caused by brief, h)w pressure oscillations of suction "

5.3 NUREG/CR-5766

Failure Modes pressure during pump startup. These oscillations to restore it to the correct position after testing, and occurred despite the availability of adequate static failures to verify control room indication of TTV posi.

NPSil. Corrective actions taken include: extending the tion following actuation.

time delay associated with the low pressure trip, removing the trip, and replacing the trip with an alarm IIE3. Motor driven pumps have been failed by human and operator action. errors in mispositioning handswitches, and by procedure deficiencies.

CCl2. Design errors discovered during AFSV sptem re-analpis at the Robinson plant (IN 89-301989) and at 5.2.3 Design / Engineering Problems and Millstone-1 resulted in the supply header from the CST Ermrs being too small to preside adequate NPSH to the pumps if more than one of the three pumps were oper. del. As noted above, the majority of AIAV subspter-ating at rated now conditions. This could lead to failurcs, and the greatest relative system degradation, multiple pump failure due to cavitation. Subsequent has been found to result from turbine-driven pump fail.

reviews at Robinson identified a loss of feedwater utes. Overspeed trips of Tbtry turbines controlled by transient in which inadequate NPSH and flows less than Woodward governors have been a significant source of design values had occurred, but which were not recog- these failures (AEOD/C602,1986). In many cases these nized at the time. Event analysis and equipment trend' overspeed trips have been caused by slow response of a t ', as well as surveillance testing w hich duplicates Woodward Model EG governor on startup, at plants service conditions as much as is practical, can help where full steam flow is allowed immediately. This over-identify such design errors. sensitivity has been removed by installing a startup steam bypass valve which opens first, allowing a con-5.2.2 Human Errors trolled tuibine acceleration and buildup of oil pressure to control the governor valve when full steam flow is HEl. The overwhelmingly dominant cause of problems admitted.

identified during a series of operational readiness evaluations of AISV systems was human performance. DE2. Overspeed trips of Tbrry turbines have been The majority of these human performance problems caused by condensate in the steam supply lines. Con-resulted from incomplete und incorrect procedures, par- densate slows down the turbine, causing the governor titularly with respect to valve linop irtformation. A valve to open farther, and overspeed results before the study of valve mispositioning events involving human governor valve can respond, after the water slug cicars.

error identified failures in administrative control of This was determined to be the cause of the loss of-all-tagging and logging, procedural compliance and comple- AITV event at Davis Besse (AEOD/6021986), with con-tion of steps, verification of support sptems, and densation enhanced due to tbe long length of the cross-inadequate procedures as important. Another study connected steam lines. Repeated tests following a cold-found that valve mispositioning events occurred most start trip may be successful due to system heat up.

often during maintenance, calibration, or modification activities. Insufficient training in determining valve DE3. Turbine trip and throttle valve ('l "V) problems position, and in administrative requirements for con- are a significant cause of turbine driven pump failures trolling valve positioning were important causes, as was (IN 84-66), in some c tses lack of TTV position indica-oral task assignment without task completion feedback. tion in the control room prevented recognition of a tripped TfV. In other cases it was possible to reset .

HE2. Thrbine driven pump failures have been caused by either the overspeed trip or the TrV without resettiag human errors in calibrating or adjusting governor speed the other. This problem is compounded by the fact that control, poor governor maintenance, incorrect adjust- the position of the overspeed trip linkage can be mis-ment of governor valve and overspeed trip linkages, and leading, and the mechanism may lack labels indicating errors associated with the trip and throttle valve. TIV- when it is in the tripped position (AEOD/C6021986).

associated errors include phpically bumping it, failure NUREG/CR-5766 5.4

a .. .

Pallure Modes DE4. Startup of turbines with Woodward Model PG. 5.2.4 Component Failures PL governors within 30 minutes of shutdown has resulted in overspeed trips w hen the speed setting knob Generic issue ll.E.6.1,"In Situ Wsting Of Wives" was was not exercised locally to drain oil from the speed divided into four sub-Issues (lleckjord 1989), three of setting cylinder. Speed control is based on startup with which relate directly to prevention of AFW syst:m an empty cylinder. Problems have involved turbine component failure. At the request of the NRC,in situ rotation due to both procedure siolations and leaking testing of check valves was addiessed by the nuclear steam. Trry has marketed two types of dump valves foi industry, resulting in the EPRI report," Application automatically draining the oil after shutdown Guidelines for Check Wives in Nuclear Power Plants (AEOD/C6021986). (Brooks 1988).' His extensive report provides information on check valve applications, limitations, At Calvert Cliffs, a 1987 loss-of-offsite-power event and inspection techniques, in situ testing ofIAOW was required a quick, cold startup that resulted in turbine addressed by Generic letter 89-10,

• Safety Related trip due to PG-PL governor stability problems. %c Motor-Operated %)ve lsting and Surveillanec*

short.tcrm corrective action was installation of stiffer (Partlow 1989) which requires 'icensecs to develop and buffer springs (IN 88-091988). Surveillance had alwap implement a program for testing, inspection and main.

been preceded by turbine warmup, w hich illustrates the tenance of all safety.related MOVs. " Thermal Overload importance of testing which duplicates senice condi- Protectica for Electric Maters on Safety.Related tions as much as is practical. Motor Opetated %1ves Generic Issue ll.E.6.1 (Rothberg 19S8)* concludes that valve motors should be DES. Reduced viscosity of gear box oil heated by prior thermally protected,yet in a way which emphasize:

operation caused failure of a motor driven pump to start system function over protection of the operator.

due to insufficient tube oil pressure, Lowering the pressure switch setpoint solved the problem,which had 21. The common cause steam binding effects of check not been detected during testing. valve leakage were identified in Section 5.2.1, entry CC10. Numerous single-train events provide additional DF6. Waterhammer at Palisades resulted in AFW ac insights into this problem. In some cases leakage of hot and hanger damage at both steam generators. He AFW MFW past multiple check valves in series has occurred spargers are located at the normal steam generator level, because adequate valve-seating pressure was limited to and are frequently covered and uncovered during level the valves ckrcst to the steam generators (AEOD/C4N fluctuations. Waterhammers in top-feed. ring steam 19M). At Robinson, the pump shutdown procedure was

. generators resulted in main feedline rupture at Maine changed to delay closing the MOVs entil after the check Wnkee and feedwater pipe cracking a' Indian Point.2 . vahes were scated. At Farley, ndditional weights were (IN M-321984). added to the back sides of the check valve disks to ensure proper seating. Check valve rework has been DE7 Manually teversing the direction of motion of an donc at a number of plants. Different vahe designs and operating valve has resulted in MOV failures where manufacturers are involved in this problem, and such loading was not considered in the design recurring leakage has been experienced, even after (AEOD/C6031986). C4mtrol circuit design may preven: repair and replacement.

this, requiring stroke completion before reversal.

C.E. At Robinson, heating of motor operated valves by DEX. At each of thc units of the South Exas Project, check valve leakage has caused thermal binding and space heaters provided by the vendor for use in pre- failure of AFW discharge valves to open on demand. At installation storage of MOW were found to be wired in Davis Besse, high differential pressure across AFW parallel to the Class IE 125 V DC motors for several injection vahrs resulting from check valve leakage has AFW valves (IR 50-489l89-11; 50-499D11 1989). The prevented MOV operation ( AEOD/Cm31986).

valves had been environmentally qualified, but not with the non. safety.related heaters energized.

5.5 NUREG/CR-5766

l'ailure Modes Cl2. Gross check valve leakage at McGuire and activitics. Gowrnor oil may not be shared with turbine Robinson caused overpressuritation of the AIAV suc. lubrication oil, resulting in the need for separate oil tion piping. At a foreign PWR it resulted in a severe changes. Electrict! compment failures included tran.

waterhammer event. At Palo Vuce2 the Mi%uction $1stor or resistor fa'!ures due to inoisture intrusion, piping was overpressurized by chetk valve leakage from erroneous pournis and connections, diode failures, and the AITV system (AEOD/C4N 1984). Gross check a faulty circuit card.

valve leakage through idle pumps represents a potential dhersion of AIAV pump flow, E(t Electrohydraulic-operated discharge vahts have performed very poorly,and three of the five units using E4. Roughly one third of Al%ystem failures have them have removed them due to recurrent failures.

been due to valve operator failures, with about equal Pallurcs included oil leaks, contaminated oil, and failures for MOVs and AOVs. Almost half of the MOV hydraulic pump failures, failures were due to motor or switch failures (Casada 1989; An extensive study of MOV cycnts (AEOD/CNB CF7. Control circuit failures were the dominatt.19tre 19%) indicates continuing inoperability problems of motor driven AISV pump failurcs (Cast.da 1989).

caused by: torque switch' limit switch settings, his includes the controls used for automatic and adjustments, or failures; motor burnout; improper siihg manual starting of the pumps, as opposed to the or osc of thermal overload devices; premature degrada- instrumentation inputs. Most of the remaining tion related to inadequate use of protecthe devices; problems were due to circuit breaker failures.

damage due to misuse (valve throttling, valve operator hammering); mechanical problems (loosened parts, G. ' Hydraulic kickup

• of Limitorque SMll spring improper assembly); or the torque switch bypass circuit packs has prevented proper spring compression to tmproperly irotalled or adjusted. De study concluded actuate the MOV torque switch, due to grease trapped that current methods and proadures at many plants arc in the spring pack. During a surveillance at Trojan, not adequate to assure that MOVs will operate when failure of the torque switch to trip the TTV motor needed under credible accident conditions. Specifically, resulted in tripping of the thermal overload device, a surveillance test which the valve passed might result in leaving the turbine driven pump inoperable for 40 days undetc<ted valve inoperability due to component failure until the next surveillance (AEOD/E7021987). Prob-(motor burnout, operator parts failure, stem dhe sepa- lems icsult itom grease changes to EXXON NE11ULA ration) or improper positioning of protective devices EP-0 grease, one of only two greases considered (thermal overload, torque switch, limit switch). Generic environmentally qualified by Limitorque. Due to lower letter 89-10 (Partlow 1989) has subsequently required viscosity,it slowly migrates from the gear case into the licensees to implement a program ensuring ths; MOV spring pack. Grease changcover at Vermont Yankee switch settings are maintained so that the valves will affected 40 of the older MOVs of v hich 32 were safety operate under design basis coaditions for the lii: of the related. Grease relief kits are needed for MOV oper.

plant. alors manufactured before 1975. At Limerick, addi-tional grease relief was required for MOVs manu-W. Component problems hase caused a significant f actured since 1975. MOV refurbishment programs may number o urbine driven pump trips (AEOD/CM yield ether changeovers to lip-0 greasc.

1986).> u group of events involved worn tappet nat faces, tan e cable connections, kiosened set screws, M. For AITV systems using alt operated valves, improperly latched TTVs, and improper assembly, almost half of the system degradation has resulted from Another invohed oilleaks due to compment or scid failures of the valve contraller circuit and its instrument failures, and oil contamination due to poor muntenance inputs (Casada 1989). Failures occurred predominantly at a few units using aummatic clectronic controllers for the now control vidves,with the majority of failures due to electrical hardware. At Turkey PointJaonttoller NUREG!CR4766 Sh

lillure Modes malfunction resulted from water in the Instrument Air 211. Rir sptems using AOW, operability requires the syMem due to maintenance inoperability of the air availability ofInstrument Alt, backup air,or backup dryers. nitrogen. Ilowever, NRC Maintenance " Ram inspeo tions have identified inadu[uate testing of check valves CF10. For systems using dicsci driven pumps, most f isolating the safety relatui portion of the IA system at the failures were due to start mntrol and governor s} :cd f.everal utilities (letter, Roc to Richardson). Generic control circuitry. Ilatt of these occurred on demand, as 1xtter M 14 (Miraglia 19M), requires licensecs to verify opposed to during testing (Casada 1989). by test that air-operated safety-related wmponents will perform as expected in acmrdance with all design basis events, including a loss of normal IA.

9 5.7 NUREG/CR-57(4

- .. _.-___ _ _ _ _ _ _ _ __ __-_-. _.- ...__. - _ - _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ _ - _ ._ _ __ - ____- w i

l 6 References lledjord,li S. June 30,1989. Closcout of GencricIssur AEOD Heports

- II.E.hl, *In Situ TestingofIhhrs'. L.ctser to V. Stello, Jr., U.S. Nuclear Regulatory Commission, Washington, AEODR4N. W. D. Lanning. July 19M. Sicam Binding D.C ofAutiliaryFerdwaterPumps. U.S.Nuclcar Regulatory Commission, W,tshington, D.C Btooks,11. P.1988. Application Guidclinesfor Check I hh cs in Nuc/ car Ibwer Plants, N P-5479. Electric Power AEOD/C602. C 1Isu. August 1986. Operational ,

Research Institute, Palo Atto, California. Erperience Involvng 71stbine Overspeed 7Hps. U.S.  ;

Nuclear Regulatory Commission, Wehington, D.C Casada, D. A. I989. AusiliaryFredwaterSystem Aging Stuh I o!ame 1. Operating Esperience and Current AEODX14)3. R.J,11rown. December 1986. A Rcricw A.'onitoring hactices. NUREG/CR-$4M, U.S. Nuclcar ofAiotor-Operated Ih!ve irrformance. U.S. Nuclcar Regulatory Commiulon, Washington, D C Regulatory Commission, Washington, D.C Gregg, R. E., and R. E. Wright.1988. Appendit Rcricw AEOD/E702. liJ.llrown March 19,1987. AfOl' for Dommant Generic Contributors,ilLB 31-M, Idaho Failure Due to flydraulic Lockup from Etccasive Grease i National Engineering laboratory,1daho lhlis, Idaho. in Spring Pack. U.S. Nuclear Regulatory Commission, Washington, D.C Miraglia, R J h bruary 17,1988. Resolution ofGeneric Safety Issue 93, 'Stram Binding ofAuriliary Fredwater AEODIT416. January 22,1983. Loss ofESFAurdiary Pumps'(Generic Letter M-03). U.S. Nucl car Regulatory Fredwater hamp Capabiliy at Trojan on January 22, a Commission, %hshington, D.C 1933. U.S. Nuclear Regulatory Commission, Washington, D.C Miraglia, R J. August 8,1988. Instrument Air suff4 Synem Problems Affecting Safety-Related Equipment lutonnation Notices (Gencric Lcrtcr 6814). U.S. Nuclear Regulatory Commission, \Wshington, D,C IN 82-01. January 22,1982. Auriliary Fcedwater Pump lockout Resultingfrom It'stinghouse e ll'2 Switch Circuit  !

Partiow, J. G. June 28,1989 Safcry Relaird Afotor. Afods/scation.- U.S. Nuclear Regulatory Commission, ,

Operated I alvc Testing and Surveillance (Gencric Letter Washington, D.C 89-10). U.S. Nuclear Regulatory Commission.

Washington, D.C IN M-32. E. L Jordan. April 18,19M. Aurillary Fredwater Sparger and Pipe Hangar Damage. U.S.~

Rothberg.O. June 1988. Thermaloivrload Protection Nuclear Regulatory Commission, Washington, D.C for Electric Alours on Safcy-Related Atotor-Operated t hh es Gcncric issue llE n i, NUREG-1296, U.S. IN MA August 11,19M. Undetected Unavailabihty of

' Nuclear F;gulatory Commission, Washington, D.C the Turbinc-Driven AurillaryFredwater 7)ain. U.S.

Nuclear Regulatory Commission, %$shington, D.C

'Havis, R., and J.'Thylor. 1989. Development of <

Guidancefor Gerwric, Functionally Oriented PRA Based iN 87 34. C E. Rossi. ]uly 24,1987. : ingle Failurcs in Team inspectionsfor BlVR Plants. identification ofRisk . Auxiliary Fcedwater Systerns. U.S. Nuclcar Regulatory important Systerru omponents andlluman Actio sn, ,

commission, Washington, D.C TLR-A-3874.T6A, Brookhaven National Laboratory,

. Upton. New York, 6.1 NUREG/CR $766 d*eyw'1rrww-- vm.- 1re urm-rv g_W--wy==$-7"iw'nunt + g -t 'M-vwg>-- - -net-tr ur i win M- -ahah+ =r+s:s--- +-www-r--- -- w=--mo % e-=--wa-*i---1 r- -re-e-- e e ' ' --- - ve--g*rt<-vwe uh -

-we- -+e*

l l

References IN 87 53. C E. Rossi. October 20,1987. Auriliary insintion Reimt Fredwater ihmp Tnys Resultingfrom Low Suction IYessure. U.S. Nuclear Regulatory Commission, IR 50-489M911; 50-499M911. May 26,1989. South

%%shington, D.C 7t.nas hoject inspectiva Retort. U.S. Nucleat Regulatory Commission, Washington, D.C IN 88 09. C. E. Rossi. March 18,1988. Reduced Reliabilay of Steam Driven Autiliary Tecdwater Pumps NURi:G Report caused by Instability of11iniward PG PL 7)pe Governors. U.S. Nuclear Regulatory Commission, NUREO.1154.1985. Loss ofMain andAuriliary

%%shington, D.C Predwater Event at the Davis Besse Plant on June 9,1985.

> U.S. Nuclear Regulatory Commiulon, Washington, IN 89 30. R. A. Arua. August 16,1989. Robinson Unit D.C.

2 Inadequate NPSilofAntiliary Fredwater1%mps. Also, Event Notification 16375, August 22,1989. U.S.

Nuclear Regulatory Commission, Washington, D.C N UREGICR-5766 6.2

NUREO/CR,5766 PNL+7W1 ~

/g, DISTRIHUTION No. of No. of fa' Pln DUP.lEl i

OFF31TE J.11. 'Ihylor lirookhaven National laboratory 19 II.S. Nudtsfileggiatory Commluion llullding 130 -  ;

Upton, NY 11973 l D. K. Orimes OWIH 9 A2 R.11 avis Brookhaven National Laboratory R Congcl Building 130 -i OWFN 10 E2 Upton, NY 11973 O. M. llolahan R. Of egg OWFN 8 E2 EO&O idaho, Inc.

P.O. Box 1625 W. T Russell Idaho Falls,ID 83415 OWFN 12 018 Dr. D. R. Edwards A. C. Thadani Prof. of Nuclear Engineering OWFN 8 E2 University of Missourl . Rolla Rolla, MO 65401 ,

K. Campe OWFN 10 E4 5 R, J. Lee Southern California Edison J. Chung (10) ' P.O. Box 123 ,

OWFN 10 E4 San Clemente, CA 92674-0128 T. R. Quay 5 O. E. liammond OWFN 13 E16 Southern California Edison - r P.O. Box 128 it Thomas (2) San Clemente, CA 92674 0128 l OWlH 121126 ONSITH l 3 It.S. NuclegnRegulatory Commlulon -

l Herion 5 ~22 Patine Northwest Imhorntory R. Zimmerman J. D. Bumgardner S. Richards L R. Dodd L Miller B. R Oore (10)

N. E. Maguire-Moffitt 4 San Onofre Resident Insnector Office B. D. Shipp E A. Simonen T.V.Vo Publishing Coordination 7tchnical Report File (5) ,

Distr.1

, s, -

a4 4 H:s

,  ; NR popu 335 U.S. NUCLE AR REGUL ATO9Y COMMISSION 4. R iN iA

~ "'

i nonce BIBLIOGRAPHIC DATA SHEET isn uur,s,cto,w s., mens NUREG/CR-5766

r. titts ANo susterte PNL N l Auxiliary Feedwater System Risk-Based Inspection Guide for the San Onofre Unit 2 Nuclear Power Plant  : DAtt afroaT evousMao u o.a.. ....  ;

l February 1993-

4. nw On on ant NuvBt R .

L1310 i 6.AW'M OPTS) 6. TYPE OF REPORT Technical R. Pugh,11. F. Gore, T. V. Vo, J. D. Ilumgardner, N. B. Mof fitt 7.eaaioocovtaeor, o,,,u 1/90 to 12/92  !

e et n, r Oauius

, g4Nizaisom - N Aue ANo Aoon a ss ,n =.e. ,, o. o, ., a vs , , ,, c . , , ,,,,..i ,,, ,,,, ,. ,,.v.,

Pacific Northwest laboratory Richland, W A 99352 2,, . .a *, ., e nw sw, em..w =ac o, . on c. w a., . ua *ww., a.,i,ew, cem SygRg G ANIZ A T4ON - N Au 6 ANO AooN E J to 4ac. ,w Division of Systems Safety and Analysis Omce of Nuclear Reactor llegulation U.S. Nuclear Regulaton Commiwinn Washington, DC 20555 10 SUPPLEMENTARY NOTE 5

11. A06 TRACT (100 e.no e, eus In a study sponsored by the U.S. Nuclear Regulatory Contnission (NRC), Pacific Northwest Laboratory has developed and applied a rnethodology for deriving plant-specific risk-based inspection guidance for the auxiliary feedwater (AFM) system at pressurized water

[

reactors that have not undergone probabilistic risk assessment (PRA). This itethodology i

uses exi' sting PRA results and plant operating experience information. Existing - PRA-base < l inspection guidance infounation recently developed for the NRC for various plants was used to identify generic component failure modes. This inforration was then cortbined with plant-specific and industry-wide cor:ponent information and failure data to identify failure modes and failure mechanisms for the AFW system at the selected plants. San Onofre-2 was selected as one of a series of plants for study. The product of this effor .

is a prioritized listing of AEM failures which have occurred at the plant and at other PWRs. This listing is intended for use by NRC inspectors in the preparation of inspection plans addressing AFM risk-important components at the San Onofre-2 plant.

12. n t Y woa os/oe sca :e roa 5 m.. ., ,., . . , . . , , ,,,,,a o .... ..s,i,.1. o ,,..a Unlimited Inspection, Risk, FRA, San Onofre-2, Auxiliary Feedwater (AFH) i. s co ,c..is...cor 0.,

or,.

Unelassified

<r..,,,

Unclassified-

16. NVW84 M OF P AGE s 16 Pf4 tC E

- 8eaC 80RM Ut (240

-- -m r , w , . . . , - . . , , . -s .o -, , , . . - m *- e ,ye4 g

Printed on recycled paper r eceral Recycing Program 1

,ll l! l iI 3

9 D

_ 9 I 1 A LP Y I AS 7

_ R 6 A MEE G U SFc.

R S DRO B A NNN L

E C A ul si

_ F T E v SG R RA E P

- nTS O

P E

D I

U GT NN OA I I TP -

CR 1 E

P E .

SW ~_ -

NO ( -

I P

DR EA - [ re SE e AL

• B C

• K U c

• SN I

R2 "

1 T I

1 f 5

EN e

74 TU SE ,

Y S R 5 C F r, v, - #

RO a;

• EN i gn - r T

A O . ., a r WN e-~ '. ,

D SA - ; g  ;'4+

1u E

EE g -

., 7 ,

FI I . eI * ,.

YT ,',I T  ;.

RR IAO L F I

X U

A N

O 1 I

S0 S0 0 I

0 0 M-5 3 M5 E S

EC0 O5 SS SU E

T Y 2 NE A

T R .

iT S A U

S O C. Bt V TD L R DA EL N, A P I

R 6 TU O I CO GF 6

7 NG T f OY 5 UER G T R

- N L A

RI H N C

/ A S E E F G LA E

R CW U

U N N