ML20141M365
| ML20141M365 | |
| Person / Time | |
|---|---|
| Site: | Beaver Valley |
| Issue date: | 08/05/1992 |
| From: | De Agazio A Office of Nuclear Reactor Regulation |
| To: | Sieber J DUQUESNE LIGHT CO. |
| References | |
| RTR-NUREG-CR-5835 BV-92-030, BV-92-30, NUDOCS 9208120075 | |
| Download: ML20141M365 (31) | |
Text
. _ _ _ _ _ _ _
August _5, 1992 Docket No. 50-334
)istribat<on:
Serial No. BV-92-030 g kcket-l1'er KCampe NRC-& Local PDRs JChung Mr. J. D. Sieber, Vice President PD I-4 Plant =
ACRS (10)
Nuclear Group SVarga ARBlough, RI Duquesne Light Company JCalvo Post Office Box 4 SNorris Shippingport, Pennsylvania 15077-0004 ADeAgazio
-0GC
Dear Mr. Sieber:
WBeckner
SUBJECT:
RISK-BASED INSPECTION GUIDE The Nuclear Regulatory Commission has been developing plant-specific inspection-guidance fer auxiliary.feedwater (AFW) systems at pressurized water reactors.
The inspection guidance.is based upon information from probabilistic risk assessments (PRAs),_ industry-wide and plant-specific o)erating experience with AFW systems, and plant-specific AFW system designs. Tie guidance:provides risk-prioritized failure events and causes that should be considered in NRC inspection planning. :The Risk-based Inspection Guides-(RBIGs) are being developed-with the assistance of certain national laboratories, and they will be published-as NUREG/CR documents.
We plan to visit the Beaver Valley Power Station, Unit 1 (BVPS-1) on August 13' and 14,1992, to conduct system walkdowns with the NRC resident staff and to -
verify the accuracy of the information used in the RBIG for BVPS. A contractor representative also will accompany the staff during the visit.
A copy of " Auxiliary Feedwater System Risk-Based Inspection Guide for the Beaver Valley Unit 1 Nuclear Power Plant" is enclosed forLyour information._
You are invited'to review this document and provide any comments you may have so that the final document as published will-reflect the facility accurately.
During the visit, the staff and contractor will ts available to meet with your staff to discuss the document and any comments.
However, I wish to emphasize that any Duquesne Light Company participation in:this project is totally voluntary.-
Sincerely,
/s/
Albert W. De Agazio, Sr. Project Manager:
Project Directorate 1 Division of Reactor Projects - I/II Office of Nuclear Reactor Regulation.
Enclosure:
As stated cc w/ enclosure:
See'next page OFFICE LA:PDI-4 PM:PDI-4[k Dk-4 SNr Y ADeAgazio:cn JStMz-WE mE F /5/92 P7f/92 K/6/92
-/ /-
/ /
OFFICIAL RECORD COPY
-(
$= i N :
Document Name:. RBIG IJ U0014 9208120075 9208051 r PDR ADOCK 05000334.
l P-
. post
Mr. J. D. Sieber Beaver Valley Power Stedon Duquesne Light Company Units 1 & 2 cc:
Jay E. Silberg, Esquire Bureau of Radiation Protection Shaw, Pittman, Potts & Trowbridge Pennsylvania Department of 2300 N Street, NW.
Environmental Resources Washington, DC 20037 ATTN:
R. Janati Post Office Box 2063 Nelson Tonet, Manager Harrisburg, Pennsylvania 17120 Nuclear Safety Duquesne Light Company Mayor of the Borrough of Post Office Box 4 Shippingport.
Shippingport, Pennsylvania 15077 Post Office Box 3 Shippingport, Pennsylvania 15077 Commissioner Roy M. Smith West Virginia Department of Labor Regional Administrator, Region I Building 3, Room 319 U.S. Nuclear Regulatory Commission Capitol Complex 475 Allendale Road Charleston, West Virginia 25305 King of Prussia, Pennsylvania 19406 John D. Borrows Resident inspector Director, Utilities Dennrtment U.S. Nuclear Regulatory Commission Public Utilities Commission Post Office Box 181 180 East Broad Street Shippingport, Pennsylvania 15077 Columbus, Ohio 43266-0573 Director, Pennsylvania Emergency Management Agency Post Office Box 3321 Harrisburg, Pennsylvania 17105-3321 1-I
i
~
NUREG/CR 5835 PNL 7925 l
AUXILIARY FEEDWATER SYSTEM RISK BASED INSPECTION GUIDE FOR 'fHE BEAVER VALLEY i
- UNIT 1 NUCLEAR POWER PLANT R.C.Lloyd N. E. Moffitt T.V.Vo B. E Gore April 1992 Prepared for Division of Radiation Protection and Emergency Preparedness l
Office of Nuclear Regulatory Regulation U.S. Nuclear Regulatory Commission Under Contract DE ACO6 76RLO 1830' NRC FIN L1330 Pacific Northwest Laboratory
- Richland, Washington 99352 l
Contents r
S u m m a ry...........,.............. ~... ~.. ~...... ~. o. ~.... ~ ~ ~..
lli
~ '. '. ~~
I 1 I n t r od u ct io n............................................................,..................
1.1 2 Bea ver W iley AFW Sys t e m................................................ o......... ~ ~...
2.1 I'
2.1 Sp t em Descri; on...........................................................
tion 2.1 2.2 Success Critett
...............u 2.1 2.3 Sys t em De pen d e n cies............................ n........................
2.2 2.4 Ope ra t io n a l Co ns t ra in ts................................................. o...
2.2 3 Inspection Ouldance for the Beaver Valley AFW System............................................
3.1 3.1 Risk Importar. AFW Components and Failure biodes...................... o...............
3.1 3.11 Multiple Pump Failures due to Common Ca use.......................................
3.1 3.1.2 *Ibrbine Driven Pump P.2 Fails to Start or Run.........................................
3.2 3.1.3 Motor Driven Pump 3A or 3B Falls to Start or Run......................................
3.2 3.1.4 Pump Unavailable Due to Maintenance or Surveillance..................................
3.2 3.1.5 Air Operated Flow Control %1ves Fall Closed.........................................
3.2 3.1.6 Motor Operated Isolation and Throttle Valves Fall Closed...............................
3.3 3.1.7 Manual
- clion or Discharte Valves Fall Closed 3.3 3.1.8 1.c.akage of Hot Feedwater Through Check Valves.................................... o.
3.4 3.2 Risk Important AFW System \\Wikdown 7hble....... o.......... o................
3.4 4 G ene ric Risk Insig h ts Fr om PRAs................................................,..........
4.1 4.1 Risk Important Accident Sequences invoh'ing AFW System Failure,.....,. 4,......
4.1 4.2 Risk important Component Failure Modes............................ c......
4.1 5 Failure Modes Determined From Operating Experience..........................................
5.1 5.1 Bea ver Valley Uni t 1 Experien ce...................................... m.............. o....
- 5.1 5.1.1 Motor Drive n Pu mp Fail u res.......................................................
5.1 5.1.2 Turbine Drive n P um p Fail u res......................................,..............
5.1 5.1.3 Flow Control and Isolation Valve Failures..... o.....
5.1 5.1.4 Turbine Driven Pump steam Supply. Admission.and Control Wlves ~ m........
5.1-
' 5.1.5 Ch eck W h'es........................... ~...................................., -
5.1 5.2 I nd us t ry Wide Expe rien ce... ~... o... m...................................
5.2 5.2.1 Common Ca use Failures..............................
5.2 5.2.2 H u m a n Err o rs................................ ~..
5.4 Y
NURFO!CR 5335 w
5.2.3 Design / Engineering Problems and Errors................................................
5.4 5.14 Com pon en t Fa il u r es..............................................................
5.5 l
6.0 R e fer e n ces..................................................................................
6.1 t
i i
i 8
1
.i t
i I
I i
i 1
'?
1 I
i I
l 6
}
6 N
i t.
i l-
.j
.t
?
j o
r 1
i e
a
- NUREG/CR 5835 3.;
?
r h
-?
L '-
~
Figure 2.1 Beaver Valley u nit I auxiliary feedwa ter system...................................................
2.3 Table 3.1 Risk important walkdown table for Beaver Valley AFW system components........................
3.5 vii NUREO!CR 5835 l-
Distribution No. of No. of Copies Copies OFFSITE 4 Beaver Vallev Resident Impector Office U.S. Nuclear Reculatory Commission J. H. Taylor Brookhaven National Laboratory B K.Orimes Bldg.130 O%TN 9 A2 Upton,NY 11973 E Congel R. 'havis OMTN 10 E4 Brookhave NationalLaboratory Bldg.130 A. El Bassioni Up on NY-11973 OwTN 10 A2 -
J. Bickel A. R. Johnson EG&G Idaho,Inc.
OWFN 14 D1 P.O. Box 1625 Idaho Falls,ID 83415 W.T R.assell OWFN 12 E23 Dr. D. R. Edwards Professor of Nuclear Engineering K. Campe
. University of Missouri. Rolla 0%TN 1 A2 Rolla,MO 65401 10 J.Chung ONSITE OWFN 10 A2 23 Pacific North' west Laboratory R. H. Wessman OWFN 14 D1 S. R. Doctor L R. Dodd 2
B. Thomas B. E Gore (10)
OWFN 12 H26 R. C. Lloyd N. E. Maguire Moffitt U.S. Nuclear Reculatorv Commission - Recion 1 B. D. Shipp
. E A.Simonen C. W. Hehles T.V.Vo M. W. Hodges Publishing Coordination W. E Kane :
Technical Report File (5) _
W. D. Lanning T. T. Martin G. W. Meyer i
)
- Distr.) -
NUREG!CR 5835 -
j
+.
Summary This document presents a compilation of auxiliary feedwater (AFW) system failure information which has been screened for risk significance in terms of failure frequency and degradation of system performance. It is a risk. prior.
itized listing of failure events and their causes Ihat are significant enough to warrant wnsideration in inspection plan.
ning at the Beaver %11ey plant. This information is presented to provide inspectors with inucased resources for inspection planning at Beaver %11cy.
The risk importance of various component fa'. lure modes was identified by analysis of the results of probabilistic risk assessments (PRAs) for many pressurized water reactors (PWRs). However, the component failure categories identi fled in PRAs are rather broad, because the failure data used in the PRAs is an syregate of many individual failures having a variety of root causes. In order to help inspectors focus on specific aspects of component operation, main.
tenance and design which might cause these failus es, an extensive review of component failure information was performed to identify and rant the root causes of these component failures. Both Beaver Valley and industry wide failure information was analyzed. Failure causes were torted on the basis of frequency of occurrence and r,criousness of consequence, and categorized as common cause failures, human errors, design problems, or component failures.
This information is presented in the body of this doct' ment. Section 3.0 provides brief descriptions of these risk-important failure causes, and Section 5.0 presents more extensive discussions, with specific examples and references.
ne entries in the two sections are cross-referenced.
4 An abbreviated system walkdown table is presented in Section 3.2 which includes only components identified as risk important. This table lists the system lineup for normal, standby system operation,
' Bis information permits an inspector to concentrate on components important to the prevention of core damage..
4 However,it is important to note that inspections should not focus exclusively on these components. Other compo-3 nents which perform essential functions, but which are not included because of high reliability or redundancy, must i
.}
also be addressed to ensure that degradation does not increase their failure probabilities, and hence their risk importance.
i I
i i
- r 6
I i
lii NUREOiCR 5835.
~_
1 Introduction his document is one of a series providing plant specific The remainder of the document describes and discusses inspection guidance for auxiliary feedwater (AFW) sys-the information used in compiling this inspection guid-tems at pressurized water reactors (PWRs). His guld.
ance. Section 4.0 describes the risk important informa-ance is based on information from probabilistic risk tion which has been derived from PRAs and its sources.
assessments (PRAs) for similar PWRs, industry-wide As review of that section will show, the failure events operating experience with AFW systems, plant specific identified in PRAs are rather broad (e.g., pump fails to AFW system descriptions, and plant specific operating start or run, valve fails closed). Section 5.0 addresses experience. It is not a detailed inspection plan, but the specliic failure causes which have been combined rathat h compilation of AFW system failure information under these broad events.
which has been screened for risk significance in terms of failure frequency and degradation system performance.
AFW system operating history was studied to identify The result is a risk prioritized listing of failure events the various specific failures which have been aggregated and the causes that are significant enough to warrant into the PRA failure events. Section 5.1 presents a sum-consider.aon in inspection planning at Beaver Valley.
mary of Beaver %11ey failure information, and Sec.
tion 5.2 presents a review ofindust7 wide failure his inspection guidance is presented in Section 3.0, fol-information. The industry-wide information was com-lowing a description of the Beaver Valley AFW system piled from a variety of NRC sources, including AEOD in Section 2.0. Section 3.0 identifies the risk important analyses and reports, information notices, inspection system components by Beaver Wiley identification and enforcement bulletim, and generic letters, and from number, followed by brief descriptions of each of the a variety of INPO report.s as well. Some Licensee Event vatious failure causes of that component. These include Repons and NPRDS event descriptions were also re-specific human errors, design deficiencies, and hardware viewed individually. Finally,information was included failures. ne discussions also identify where common from reports of NRC sponsored studies of the effects of cause failures have affected multiple, redundant compo-plant aging, which include quantitative analyses of re-nents. These brief discussions identify specific aspects ported AFW system failures. This industry-wide in-of system or component design, operation, maintenance, formation was toen combiH with the plant specific or testing for inspection by observation, records review, failure information to iden., the various root causes of training observation, procedures review, or by observa-the broad failure events used in PRAs, which are tion of theimplementation of procedures. An AFWsys-identified in Section 3.0.
tem walkdown table identifying risk important compo-nents and their lineup for normal, standby system operation is also provided.
1.1 NUREG/CR 5835 m
i 2 Beaver Valley AFW System j
His section presents an overview descrip.on of the Auxiliary fecdwater is supplied to each steam generator Westinghouse three loop Beaver Wiley Unit 1 AFW through two redundant supply headers, each containing system including a simplified schematic sptem diagram.
a motor operated throttle valve. The supply headers In addition, the sptem success criterion, system de-join downstream of the throtlie valves and flow through l
pendencies, and administrative operational constraints a flow measnring device, a check valve and a manual iso.
)
are also presented.
lation vah'e, before connection with the main feed line l
downstream of the main feed line containment isolation.
I
2.1 System Description
^ dedicated non safety grade /.FW pump (FW P-4) is also provided and is capable of providing demineralized The AFWsystem provides feedwater to the steam gen.
water to the three steam generators within ten minutes crators (50) to allow secondary-side heat removal from i llowing a loss of the main feedwater and the AFW the primary system when main fecdwater is unavailable, pumps (FW P 2.3A and 3B) due to loss of offsite power The system is capable of functioning for extended per-and an AFW area fire or loss of associated control or lods, which allows time to restore main feedwater flow p wer circuitry. The dedicated pump is powered from 1
or to proceed with an orderly cooldown of the plant to the 4160 V ERF Substations, Bus 1H. De AFW pump where the residual heat removal (RHR) system can re.
(FW P 4) takes suction from demineralized water stor.
move decay heat. A simplified schematic diagram of the age tank %TTK 11 or 26. Additional makeup water Beaver %11ey AFW system is show in Figure 2.1.
may be provided by water tanker trucks. The AFW pump (FW P-4) discharges into the main feed systern The sptem is designed to start up and establish flow downstream of the first point heaters and flow is manu-autornatically. Allpumps start on receipt of a steam ally controlled at the feedwater bypass manifolds.
generator low-low level signal. (The turbine-driven putnp starts on low level in one SG, whereas, two SG De Primary Plant Demineralized %bter (PPDW) stor-low icvel signals are required for a motor driven pumps age tank %TTK 10 (152,000 gallon capacity) is the to start.) ne single turbine-driven (TD) pump starts on normal source of water for the AFW System and is re-undervoltage on two of the three reactor coolant (RC) quired to store a minimum of 240,000 gallons of demin-pump buses and an ATWS Mitigation Actuation Signal cralized water to malmain the reactor coolant system (AMSAC). De motor driven (MD) pumps start on a (RCS) at hot standby conditions for 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> with steam trip of the electric main feedwater pumps (MFW), a discharge to atmosphere. All tank connections except safety injection signal, or an AMSAC signal, those required for instrumentation, auxiliary feedwater pump suction, chemical analysis, and tank drainage are Separate lines from the Primary Demineralized %bter
' located above this minimum level. AFW suction may.
Storage Thnk (WT-TK 10) supply each motor-driver, also be manually switched to the enginected safety pump and the turbine-driven pump. Isolation valves in feature River Water System.
these lines are locked open. Power, control, and instru-mentation associated with each motor-driven pump are independent from one another. Steam for the turbine-2.2 SUCCESS Criterl0n driven pump is supplied by steam generators A.B, and C, from a point upstream of the main steam isolation System success requires the operation of at least one valves, through vahe MS 105. Each AFW pump is pump supplying rated now to at least one of the three equipped with a recirculation Dow system, which pre-steam generators.
vents pump deadheading.
21 NUREG/CR 5S35 m
Beaver %Ilcy 2.3 System Dependencles associated flow paths are operable with each motor.
driven pump powered from a different vital bus. If one AFW pump becomes inoperable,it must be restored to The AFW systern depends on AC and DC power at var.
operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the plant must shut lous voltage levels for motor operation, valve control, down to hot standby within the next twelve hours.
monitor and alarm circuits, and valve / motor control cir-cults. Instrument Air is required for several pneumatic The Beaver %lley Technical Specifications require a control valves. Air operated vahes are designed to fall nine hour supply of water to be stored Iri the PPDW in the safe direction, therefore safety grade backup sys-storage tank. With the PPDW storage tank having less tems are not necessary. Steam availability is requireil than 140,000 gallons, restarc water volume or demon.
for the turbine-driven pump.
strate operability of the river water system and restore the PPDW storage tank water volume within seven days, or be in hot shutdown within the next twelve hours.
2.4 Operational Constrain 15 When the reactor is critical the Beaver %11ey Technical Specifications require that all three AFW pumps and t
e NUREGICR 5835 '
2.2. '
- j
3 C
8 I
tFMstESR
[
tFW*tb.B S W-t ESC k
7 MFM X* ~-' a X "-a X '~-'a =
TO M N LJNE DEBICgtEg UPSTREMM OF A
P W
E8 trW 42 (FW-43 17 M44 FW+P*4 IWtE.
j tvu-026 SFM-627 tru-C2 gygg.s2s tW-822 tm-e22 t N-15 tB SW-1513
- 4.
$NatstF M
N t W-15 t t tFu-tste SN*tstM
},.
a w
u
.u-l us t---
if,MK t, -t
,, i --
t.
IN*M d I g yy,,gg tFW-37
~
- -**7
"'***)
t,u.n g, k,tru...Z m-
==
u.rm Xn2=t L.
,,. t STM-P-2 STM P-33 Stu.V-Se
>o-t.
ar=2.
x x,t.t.
WT227 t.
- g
.t.1,
..: L
,,.24,.t.
.t.
I
+
4
+
fuc.7 sw sw su m8 in is tc a g "sEr$
~
Figure 2.1 Beaver Valley unit I ainxlliary feedwater system 23 NUREG/CR 5835
t 3 Inspection Guidance for the Beaver Valley AFW Systein 1
In this section the risk important components of the 3.1.1 Multiple Pump Failures due to Common Beaver Wiley AFW system are identified, and ti,e im-Cause portant failure modes for these components arc briefly j
described. Rese failure modes include specific human The following listing summarizes the most important
[
crrors, design deficiencies, and types of hardware fall
- multiple-pump failure modes identified in Section 5.2.1, ures which have been observed to occur for these Common Cause Failures, and each item is keyed to components, both at Ecwcr Wiley and at PWRs entries in that section, t
throughout the nucicar industry. The discussions also 1
identify where common cause failures have affected mul-Incorrect _ operator intervention into automatie sys.
tiple, redundant components. These brief discussions
. tem functioning, including improper manual start.
identify specific aspects of systern or componem design.
Ing and securing of pumps, has caused failure of all opcration, maintenance, or testing for inspect!on activ-pumps, including overspeed trip on startup, and in.
ities; These setiv, ;es include observation, recotds re-ability to restart prematurely secured pumps. CCl.
view, training obsi ration, procedurcs review, or by ob.
servation of theit -lementation of procedures.
- - %1ve mispositioning has caused failure of all pumps. Pump suction, steam supply, and instru.
Thble 3.11:, an abbreviated AFW system walkdown table.'
nient isolation valves have been involved. CC2.-
which identifles risk important components. This table lists the system lineup for normal (standby) system Steam binding has caused failure of multiple pumps.
operation. Inspec40n o'the components identified in This resulted from leakage of hot feedwater past the walidown table addresses essentially all of the risk check valves and motor operated valves into a com-associated with AFW system operation.
mon discharge header. CC10.- Multiple pump steam binding has also resulted from improper valve
[
lineups, and from running a pump deadheaded.
3.1 Risk Important AFW Components CC3.
and Failure Modes E
Pump control circuit deficiencies or design modif-i Common cause failun t of multiple pumps are the most ication errors have caused failures of multiple '
risk important failua Aes of AFW system compo-Pumps to auto stan, spurious pump trips during op.
nents. Dese are fonow 4 in importance by single pump eration, and failures to restart after pump shutdown.
failures, level control valve failures, and individual check CC4. Incorrect setpoints and control circuit cal.
valve backleakage failures,
. ibrations have also prevented proper operation of multiple pumps. CC5.
The following sections address each of these failure -
modes,in decreasing order of risk-importance. They.
Dss of a vital power _ bus has failed both the turbine.
.present the important root causes of these component -
. driven and one motor-driven pump due to loss of-failure modes which have been distilled from historical.
control power to steam admission valves or to ture records. Each item is keyed to discussions in Ser1 ion 5.2 bine controls, and to motor controls powered from where add!tional information on historical events is the same busc CC6.
presented.-
A I
3.1 NUREG/CR 5835 '
]
E.
/
1
Inspection Guidance Simultaneous startup of multiple pumps has cauuJ overspeed trip or TTV trip can be reset without oscillations of pump suction pressure causing mul-resetting the other, indication in the control room tiple pump trips on low suction pressure, despite of TTY position, and unambiguous local indication the existence of adequate static net positive suction of an overspeed trip affect the likelihood of these head (NPSH). CC7. Design reviews have identified errors. DE3. Foreign objects under the seat, seat inadequately sized suction piping which could have wear, and diaphragm failure in the steam supply yielded insufficient NPSH to support operation of valves have resulted in failure of the turbine driven more than one pump. CC8.
pump to perform propuly at Beaver Valley Unit 1.
3.11. 7brbine Driven Pump P.2 Falls to Start 3.1.3 Motor Driven Pump 3A or 3B Falls to or Run Start or Run Irmroptily adjusted and inadequately maintained Control circuits used for automatic and manual towine governors have caused pump tallures. HE2.
pump starting are an important cause of motor Problems include worn or loosened nuts, set screws, driven pump failures,as :nc circuit breaker failures.
linkager or cable connections, oil leaks and/or con.
CF7. Spurious false starts resulting from control tamination,and electrical failures of resistors, circuit failures have occurred at Bcaver Valley transistors, diodes and circuit cards, and erroncous Unit 1.
grounds and connections. CFS. Internal corrosion in the governor has resulted in speed control Mispositioning of handswiten s and procedural de-problems at Beaver Valley Unit 1.
ficiencies have prevented automatic pump start.
HE3. At Beaver Valley Unit 1, mispositioning of Terry turbines with Woodward Model EG pover.
control switches has caused inadvertent pump starts.
nors have been icund to overspeed trip if full steam flowis allowed on startup. Sensitivity can be re-1.nw lubrication oil pressure resulting from heatup duced if a startup steam bypass valve is sequenced to due to previous operation has prevented pump re-open first. del.
start due to failure to satisfy the protective inter.
lock. DES. Hot bearings have caused problems at Tbrbines with Woodward Model PG.PL governors Beaver Valley Unit 1.
have tripped on overspeed when restarted shortly alter shutdown, unless an sperator has locally exer-3.1.4 " a p Unavallable Due to Maintenance cised the speed setting knob to drain oil from the or Su, ance governor speed setting cylinder (per procedure).
Automatic oil dump valves are now available Both scheduled and unscheduled maintenance re-through Terry. DE4.
move pumps from operability. Surveillance requires Condensate slugs in steam lines have caused turbine operation with an altered line up, although a pump train may not be declared inoperable during testing.
overspeed trip on stattun. Tests repeaied right after Prompt scheduling and performance c' mainten-such a trip may fail:o in ate the problem due to warming and clean,ng of1. alcam lines. Survett.
ance and surveillance minimize this unavailability.
Ian should exercise all stea.n scpply connections.
3.1.5 Air Operated Flow Control Valves Fail Closed Trip and throttic valve (TTV) prcblems (MS 105A.-
-TD Pumn Traim,,_FW-102 105B) which have failed Ihe tterbine driven pump in.
clude physicauy bumpir'g it, failure to reset it fol -
MD Pump Traint FW.10'tA.B lowing testing, and failure to verify control room Dedicated AFW Pumtr FW-150 indication of reset. HE1 Vhether either the NUREG/CR 5835 3.2
Inspection Guidance hese normally open air operated valves (AOVs) con-
%lve motors have been failed due to lack of, or trol AFW pump recirculation flow to the primary plant improper sizing or use of therrnal overload protec.
- o demineralized water storage tank. They fail open on live devices. Bypassing and oversizing should be loss ofInstrument Air.
based on proper engineering for detien basis conditions. CF4.
Control circuit problems have been a primary cae of failures, both at Beaver Wiley Unit 1 and else.
Out of adjustment electrical flow contiollers have wb.ere. CF9. Whc failures have resulted fiorn caused improper discharge valve opera tion, affect-bbwn fuses, failure of control components isuch as ing multipic trains of ABY. CC12.
current / pneumatic convertors), broken or dirty con-tacts, misaligned or broken limit switches, control 0 case trapped in the torque switch spring pack of power loss, and cribration problems. Degraded op.
IJmitorque SMB motor operatois has caused motor cration has also resulico from improper air pres:ure burnout or thermal overload trip by p!eventing due to air regulatt,r failure or leaking air lines.
torque switch actuation. CFE Out of. adjustment electrical flow controllers have Manually reversing the direction of motion of op-caused improper valve operation, affecting multiple crating MOW has overloaded the motor circuit.
trains of AFW. CC12.
Operating procedures should provide cautions, and circuit designs may prevent reversal before cach Leakage of hot feedwater through check valves has stroke is finished. DE7.
caused thermal binding of ff v control MOW.
AOVs may be similarly susceptible. CF2.
Space heaters designed for preoperation storage have been found wired in parallel with valve motors Multiple flow control valves have been plugged by which had not been environmentally qualified with clams when suction switched automatically to an them present. DE8.
alternate, untreated source. CC9.
3.la Manual Suction or Discharge Valves Fall 3.1,6 Motor Operated Isolatinn und Throttle Closed Valves Fall Closed TD Purno'naim %tves MT 221.22' %39
- A' Manif,gid Throttle %1ves: RV 151 B.D.F MD 3A Pumn Train: %1ves %T223@6.37.40
'B' Manifold Throttle %1ven FW-151 A.C.E MD 3B PumnTrain: Wives MT222.227.3RAI Dedicated AFW Pumre MOV-FW 160 Dedicated ARV Pumrv Wives MT648.639.M3 S!G isolation Wives. RV 158A. LLC These normally open MOW throttle or isolate flow to the steam generators. They fail as-is on loss of power.
These man ual valves are normally locked open, except for %T-M3. For each train,except for the dedicated Common cause failure of MOW hs resulted from ARV pump, closure of the first and second valve listed failure to use electrical signature tracmg equipment would block suction from PPDW storage tank A
m determine proper settings of torque switch and MTTK 10.- Closure of the third and fourth valves for -
3rque switch bypass switches. Fellure to calibrate the TD and MD pump trains would block pump dis-.
switch settings for high toiques necessary under charge except recirculation to the PPDW storage tank.
desien basis accident conditions has also been in-The motor operator has been removed from valve RV volved. CC11. At Beaver %lley Unit ), most fail.
158 B and is currently operated manually. The motors ures have been due to normal wear of the valve have been removed from the operators on valves BV sats, however there have been failures due to 158 A and C.
improper torque switch adjustment.
3.3 NUREG/CR-5835
4 Inspection Guidance
+
I Wlve mispositioning has resulted in failures of mul-3.1.8 Ieakage erllot Feeciwater Through tiple trains of AFW, CC2. It has also been the Check Valves dominant cause of problems identified during op-erational readiness inspections. HEl. Events have At MFW Connectione f W 42E43 occurred most often during maintenance, calibra-Discharre oiPomris 3A3B: TD Pump %)ves FW tion, or system modifications. Important causes of 34,3333
=
mispositioning include:
.A'hiantfold: %Ives FW622.624.626
'B' Mantr ld: %1ves "V 623.625.627 o
Failure to provide complete, clear, and specific procedures for tasks and system restoration I.cakage of hot feedwater through several check Failure to promptly revise and validate proce.
valves in series has caused steam binding of multiple pumps.1 eakage through a closed level control dures, tiaining, end diagrams following system modifications ulve in series with check valves has also occurred, as would be required for Icakage to reach the motor driven pumps A and B. CC10.
l
" allure to complete all steps in a procedure Slow leakage past th'e final check valve of a serie-j Failure to adequately review uncompleted
+
may not force the check valve closed. Other check procedural steps after task completion valves in series may leak similarly. Piping orienta-Failure to verify support functions after tion and valve design are important factors it.
achieving true series protection. CFl.
restorauon Failure to adhere scrupulously to admini-strative procedures regarding tagging, g g gE g g, control and tracking of valve operations WalkdOWH Thble Failure to log the manipulation of scaled Table 3.1 presents an AFW system walkdown table in-valves cluding only components identified as risk important.
This information allows inspectors to concentrate their Failure to follow good practices of written efforts on components important to prevention of core task assignment and feedback of tuk com-damage. However,it is essential to tr :e that inspec-pletion information tions should not focus exclusively on these components.
Other components which perform essential functions, Failure to provide easily read system draw-but which are absent from this table because of high reli-ings, legible valve labels corresponding to ability or redundancy, must also be addressed to ensure drawings a procedures. and labeled in-that their risk importance are not increased. Example.,
7 dications oflocalvalve position include the (open) steam lead isolation valves upstream of MS-105, and an adequate water level in the PPDW storage tank.
t I
NUREG/CR-5835 3.4 4
4
-Y"a
Inspection Guidance a
D Table 3J 'tisk important walkdown table for lleaver Wiley ABY system components Component #
Component Name Required Position Actual Position Electrical 3A Motor Driven Pump Racked in/
Closed 3B Motor-Driven Pump Racked In/
Closed
%)ves FW 36 TDP 2 "A" Header Disch Locked Open FW 37 MDP 3A *A" Header Disch Locked Open FW38 MDP 3B *A' Header Disch Closed FW 39 TDP 2 *B" Header Disch Closed FW 40 MDP 3A *B* Header Disch Closed FW 41 MDP 3B *B" Header Disch lacked Open
%T 221 PPDW lsol to TDP 2 Locked Open WT 222 PPDW lsol to MDP 3B Locked Open
%T 223 PPDW lsol to MDP 3A Locked Open
% T 225 PPDW lsol to TDP 2 Locked Open WT 226 PPDW Isol to MDP 3A lacked Open WT 227 PPDW lsol to MDP 3B lacked Open FW 102 TDP 2 Recirculation Auto FW 103B MDP 3B Recirculation Auto -
FW 103A MDP 3A Recirculation Auto RW 206 River Mhter Suction 15o1 Locked Closed 3.5 NUREGICR 5835
['
l 7
Inspection' Guidance Thble 3.1 (Continued) -
Component #
Component Name Required Position Actual Position RW 207 River %bter Suction isol Closed RW 208 River %bter Suction 1s01 Closed RW 209 River %hter Suction 1s01 Closed RW 210 River %$ter Suction Isol Closed BV 158 A 1 A S/G ! solation Wlve 1.ocked Open FW 158 B 1B S/G 1 solation Wlve Ircked Open FW 158 C IC S/G isolation Valve =
Locked Open BV 151 A IC SG Throttle (B Hdr)
Open --
BV 151 B 1C SG Throttle (A Hdr)
Open FW 151 C 1B SG Throttle (B Hdr)
Open FW 151 D 1B SG Throttle (A Hdr)
Open FW 151 E 1A SG Throttle (B Hdr)
Open -
FW 151 F 1A SG Throttle (A Hdr)
Open -
MS 15 TDP Steam Supply from 1A Open MS 16 TDP Steaa supply from 1B
- Open MS 17 TDP Steam Supply from IC -
Open MS 105
-TDP Steam Admission Wlve '
- Open MS 105A TDP Drottle-Trip Wlve Closed MS 105B TDP Throttle-Trip W <t ~
Closed FW 42 Piping Upstream of Check Wlve.-
Cool FW 43 Piping Upstream of Check Valve Cool '
NUREG/CR-5835 3.0 l
-l i
Inspection Guidance -
. Table 3.1 (Continued)
Component #
Component Name Required Position Actual Position FW 44 Piping Upstream of Check Wlve Cool FW 622 Piping Upstream of Check Wlve Cool FW 623 Piping Upstream of Check Wlve Cool FW 624 Piping Upstream of Check Wlve Cool FW 625 Piping Upstream of Check Wlve Cool FW 626 Piping Upstream of Check Wlve Cool FW 627 Piping Upstream of Check Wlve Cool FW 33 Piping Upstream of Check %1ve Cool FW 34 Piping Upstream of Check Valve Cool FW 35 Piping Upstream of Check Valve Cool
-i 3.7
?
'RE' CR 5835
h..
e 4 Generic Risk Insights From PRAs -
PRAs for 13 PWRs were analyzed to identify risk
-l>>ss of Main Feedwater -
important accident sequences involving loss of AFW,.
A feedwater line break drains the common water and to identify and risk-prioritize the component failure modes involved. The results of this analysis are de..
source for MFW and AFW, Le operators fail to L
- scribed in this section. They are consistent v ith results -
provide feedwater from other sources, and fail to reported by INEL and BNL (Gregg et al.198S, and
. initiate feed and-bleed cooling, resulting in core Travis et al.1988).
~ damage.-
- A loss of main feedwater trips the plant,and AFW 4.1-Risk Important Accident Sequences fails due to operator error and hardware failures.-
Involving AFW System Failure m perat rs fan t inhiate feed and-bleed coonng, resultingin core camage.
loss of Power System
. Steam Generator Tube Rupture (SGTR):
. A loss ofoffskepowerisfallowed byfailure ofAFP,
,, A SGTR is followed by failute of AFW Coolant is -
Due to lack of actuating power, the power operated lost from the primary until the refueling water stor.
relief valves (DRVs) cannot be opened preventing age tank (RWST)is depletedJ Hich pressure injec-1 adequate feed and-bleed cooling, and resulting in tion (HPI) fails since recirculatfori cannot be estab-core damage-lished from the empty sump, and core damage results.'
A station blackout fails all AC power except Vital AC from DC inverters, and all decay heat removal systems except the turbine-driven AFW pump.
AFW subsequently fails due to battery depletion or C RiskImportant Component Failure
- hardware failures, resulting in core damage,.
M Odes
. LA DCbusfalls, causing a trip and failure of the.
The generic component failure modes identified from power conversion system. _One AFW motor-driven PRA analyses as important to AFW system failure are pump is failed by the bus loss, and the turbine.
listed below in decrmsing order of risk importance.
driven pump fails due to loss of turbine or valve control power. AFW is subsequently lost com-
- 1, : Turbine Driven Pump Failure to Start or Run, pletely due to other failures. Feed-and-bleed cool.
ing fails because PORV control is lost, resulting in '
2.1 Motor Driven Pump Failure to Start or Run.
core damage.
.i
- 3. L TDP or MDP Unavailable due to Test or~
Transient Caused Reactor or Turbine Trip ?
Maintenancei
-j g
A transient-caused trip is f.dlowed by a loss of the,
4c-1AFW System %1ve Failures -
' steam admission valves
. operator to initiate it, or due to hardware failures, resulting in core damage.
+ trip and throttlevc!vr
+ ' low control valves 4.1
.NUREO!CR;5835
._z
i0 4
Generic Risk
+ pump discharge valves in addition to individual hardware, circuit, or instru-ment failures, each of these failure modes may result pump suction valves from common causes and human irors. Common cause failures of AFW pumps are particularly risk im-
+ valves in testing or maintenance.
portant. Wlve failures are somewhat less important due to the multiplicity of steam generators and connection
- 5. Supply / Suction Sources paths. Human errors of greatest risk importance in-w>lve: failures to initiate or ci ntrol system operation
+ condensate storage tank stop valve when required; failure to restore proper system lineup after maintenance or testing; and failure to switch to al-
+ hotwellinventory ternate sources when required.
- suction valves.
9 NUREG/CR SS35 4.2
r 5 Failure Modes Determined From Operating Experience This section describes the primary root causes of AFW 5.1.2 hrbine Driven Pump Failures system component failures, as determined from a review of operating histories at Beaver Valley Unit I and at Eight events have occurred from 1980-1991 that have re-other PWRs throughout the nuclear industry, Sec-sulted in decreased operational readiness of the turbine tion 5.1 describes experience at Beaver Wiley Unit I driven pump. Failure modes involved failures in instru-from 19801991. Section 5.2 summarizes information mentation and control circuits, electrical faults, system compiled from a variety of NRC sources, including hardware failures, and human errors. The t_urbine AEOD analyses and reports,information notices,in.
driven pump has tripped or failed to teach proper speed spection and enforcement bulletins, and generic letters, as a result of internal rust and corrosion and corroded and from a variety of INPO reports as wc!!. Some Li.
contacts. Pump aging and wear has resulted in high censee Event Reports and NPRDS event descriptions-bearing temperature. Failure of valve diaphrams and -
were also reviewed. Finally,information was included loose parts in the steam supply have necessitated pump from reports of NRC-sponsored studies of the effects of shutdown and repair.
plant aging, which include quantitative analysis of AFW system failure reports. This information was used to
- 5.1.3 Flow Control and Isolation Valve identify the various root causes expected for the broad Failures PRA-based failure events identified in Section 4.0, re-sulting in the inspection guidelines presented in There have been five events from 1980-1991 that re-Section 3.0.
suited in impaired operational readiness of the air oper-ated recirculation flow control and motor operated.%-
lation valves. Principal failure causes were equipment 5.1 Beaver Valley Unit 1 Experience wear, instrumentation and control circuit fattures, valve hardware failures, and human errors. Valves have failed The AFW system at Beaver Valley has experienced fail-
- to operate properly due to failure of valve packing, mis-ures of the AFW pumps, pump discharge flow control aligned switches, and valve operator calibration prob.
i valves, the turbine steam admission and supply valves, lems. Human errors have resulted in improper control =
j turbine trip and throttle valve, pump discharge isolation circuit calibration and limit switch adjustment.
valves, river water backup supply valves, and several j.
such steam system check valves. Failure modes include
' 5.1.4 %rbine Driven Pump Steam Supply, electrical, instrumentation and control, hardware fail.
Admission, and Control Valves.
ures, and human errors.
More than fifteen events from 1980-1991 have resulted 5.1.1 Motor Driven Pump Failures in degraded operation of steam isolation and steam flow There have been five events from 1980-1991 which in-control valves. Failure types included failures due to aging. Flow control and isolation valve seats were found volved failure of the motor driven pumps during several to be steam cut, and isolation valves were found to leak modes of operation. Failure modes involved instrumen-
. through due to cut or worn seats or to obstruction under tation and control circuit failures, pump hardware fail-ures, and human failures during maintenance activities" the seats. Air leaks or misadjusted air pressure regula-Imotoper or inadequate maintenance has resulted in tors have prevented proper valve operation.
j high thrust bearing temperatures requiring pump shut- -
5.1.5 Check Valves :
i:
down and repair.
Three events of check valve failure have occurred in the.
main steam supply to the TDAFW pump from -
5.1 NUREG/CR.5835 l-(..
Failure Modes 1960-1991. Normalwear and aging was cited as the intervention is required during the early stages of a failure mode, restilting in leakage, transient, training should emphasize that actions should be performed methodically and deliberately to guard against such errors.
5.2 Industry Wide Experience CC2. Valve mispositioning has accounted for a signif.
Human errors, design / engineering problems and errors, icant fraction of the human errors failing multiple trains and cornponent failures are the primary root causes of of AFW. This includes closure of normally open suction AFW System failures identified in a review ofindustry valves or steam supply valves, and of isolation valves to wide system operating history. Common cause failures, sensors having control functions. Incorrect handswitch which disable more than one train cf this operationally Positioning and inadequate temporary wiring changes redundant system, are highly risk signifiant, and can re, have also prevented autor latic starts of multiple pumps.
sult from all of these causes.
Factors identified in studies of mispositioning crrors in-clude failure to add newly installed valves to valve Titis section identifies important common cause failure checklists, weak administrative control of tagging, res-modes,and then provides a broader discussion of the toration, independent verification, and locked valve single failure effects of human errors, design /
logging, and inadequate adherence to procedures, lileg-engineering problems and errors, and component fail-ible or confusing local valve labeling, and ins'.fficient ures. Paragraphs presenting details of these failure training in the determination of valve position may modes are coded (e.g., CC1) and cross-referenced by in, cause or mask mispositioning, and surveillance which spection items in Section 3.0, does not exercise complete system functioning may not revealmispositionings.
5.2.1 Comrnon Cause Failures CC3. At ANO-2, both AFW pumps lost suction due to The dominant cause of AFW system multiple-train fall-steam binding when they were lined up to both the CST ure: has been human error. Design / engineering errors and the hot startup/ blowdown demmeralizer effluent and component failures have been less frequent, but (AE@N, N). At Lond steam created by run-nevertheless significant, causes of multiple train failures, ning the turbine-driven pump deadheaded for one min-ute caused trip of a motor-driven pump sharing the CC1. Human error in the form ofincorrect operator in-same inlet header, as well as damage to the turbine-tervention into automatic AFW system functioning dur-driven pump (Region 3 Morning Report,1/1700). Both ing transients resulted in the temporary loss of all safety-events were caused by procedural inadequacies.
grade AFW pumps during events at Davis Besse (NUREG-1154,1985) and Trojan (AEOD/r416,1983)
CC4. Design / engineering errors have accounted for a In the Davis Besse event, improper manualinitiaticn of smaller, but significant fraction of common cause fail-the steam and feedwater rupture control sy, tem ures. Problems with control circutt design modifications (SFRCS) led to overspeed tripping of both turbine-at Parley defeated AFW pump auto. start on loss of.
main feedwater. At Zion.2, restart of both motor driven driven AFW pumps, probably due to the inu oduction of condensate into the AFW turbines from the long, un-pumps was blocked by circuit failure to deenergize when heated steam supply lines. (The system had never been the pumps had been tripped with an automatic start SiEnal resent (IN 82-01,1982).. In addition, AFW con-P tested with the abnormal, cross-connected steam supply lineup which resulted.) In the Trojan event the operator trol circuit design reviews at Salem and Indian Point incorrectly stopped both AFW pumps due to misinter-have identified designs where failures of a single compo-pretation of MFW pump speed indication. The diesel n c uld have failed all or multiple purnps (IN 87-34,.
driven pump would not restart due to a protective fea-ture requiring complete shutdown, and the turbine-driven pump tripped on overspeed requiring local reset CC5. Incorrect setpoints and control circuit settings re-of the trip and throttle valve. In cases where manual sulting from analysis errors and failures to update NUREG/CR-5835 52
Failute Modes procedures have also prevented pump start and caused caused by starting of a motor driven pump caused suc-pumps to trip spuriously. Errors of this type may re-tion source realignment to the Nuclear Service \\Wier main undetected despite surveillance testing, unless sur-system. Pipes had not been routinely treated to inhibit veillance tests model all types of system initiation and clam growth, nor regularly monitored to detect their operating conditions. A greater fraction ofinstrumenta-presence, and no strainers were installed. The need for tion and control circuit problems has been identified surveillance which exercises alternative system opera.
during actual system operation (as opposed to survell-tional modes, as well as complete system functioning, is lance testing) than for other types of failures, emphasized by this event. Spurious suction switchover has also occurred at Callaway and at McGuire, although CC6. On two occasions at a foreign plant, failure of a no failures resulted, balance-of-plant invertor caused failure of two AFW pumps. In addition to loss of the motor driven pump CC10. Common cause failures have also been caused by whose auxiliary start relay was powered by the im crtor, component failures (AEOD/C404,1984). At Surry-2, the turbine driven pump tripped on overspeed because both the turbine driven pump and one moto-driven the governor valve opened, allowing full steam flow to pump were declared inoperable due to steam binding -
the turbine. This illustrates the importance of assessing caused by leakage of hot water through multiple check the effects of failures of balance of plant equipment valves. At Robinson-2 both motor driven pumps were which supports the operation of critical components.
found to be hot, and both motor and steam driven The instrument air system is another example of such a pumps were found to be inoperable at different times system.
Leakage at Robinson-2 passed through closed motor-operated isolation valves in addition to multiple check CC7. Multiple AFW pump trips have occurred at valves. At Farley, both motor and turbir.e driven pump -
hiillstone-3, Cook 1, Trojan and 2. ion 2 (IN 87 53, casings were found hot, although the pumps were not 1987) caused by brief, low pressure oscillations of suc-declared inoperable. In addition to multi-train faibtes, tion pressure during pump startup. These oscillations numerous incidents of single train failures have oc-occurred despite the availability of adequate static curred, resulting in the designation of' Steam Binding of NPSH. Corrective actions taken include: extending the Auxiliary Feedwater Pumps" as Generic issue 93. This time delay associated with the low pressure trip, remov-generic issue was resolved by Generic l etter 88-03 ing the trip, and replacing the trip with an alarm and I (Miraglia,1988),which required licensees to monitor -
operator action.
AFW piping temperatures each shift,'and to maintain procedures for recognizing steam binding and for restor-CC8. Design errors discovered during AFW system re.
ing system operability.
analysis at the Robinson plant (IN 89 30,1989) and at Millstone-1 resulted in the supply header from the CST CC11. Common cause failures have also failed motor being too small to provide adequate NPSH to the operated valves. During the totallost of feedwater pumps if more than one of the three pumps were oper.
event at Davis Besse, the normally-open AFW isolation ating at rated flow conditions. This could lead to multi-valves failed to open after they were inadvertently pie pump failure due to cavitation. Subsequent reviews closed. The failure was due to improper setting of the at Robinson identified a loss of feedwater transient in torque switch bypass switch, which prevents motor trip which inadequate NPSH and flows h.ss than design on the high torque required to unseat a closed valve.
values had occurred, but which were not recognized at.
Previous problems with these valves had been addressed the time. Event analysis and equipment trending, as by increasing the torque switch trip setpoint - a fix which
-- well as surveillance testing which duplicates service con-failed during the event due to the higher torque required ditions as much as is practical, can help identify such due to high differential pressure across the valve. Sim-design errors.
ilar common mode failures of MOVs have also occurred in other systems, resulting in issuance of Generic Letter CC9 Asiatic clams caused failure of twa AFW flow.
89-10,
- Safety Related Motor-operated Valve Testmg control valves at Catawba-2 when low suction pressure and Surveillance (Partlow.1989)." This generic letter 5.3 NUREG/CR 5835 I
Failure Modes requires licensees to develop and implemeut a program 5.23 Design / Engineering Problems and to provide for the testing, inspection and maintenance Errors of all safety-related MOVs to provide assurance that they will function when subjteted to design basis del. As noted above, the majority of AFW subsystem conditions.
failures, and the greatest relative sptem degradation, has been found to result from turbine-driven pump fail-CC12. Other component failutes have also resulted in ures. Overspeed trips of Tbtry turbines controlled by AI V multi-train failures. These include out of*
Woodward governors have been a significant source of adjustment electrical flow controllers resulting in im-these failures (AEOD/C602,1986). In many cases these -
proper discharge vahr operation, and a failure of oil ovetspeed trips have been caused by slow response of a cooler cooling water supply valves to open due to silt Woodward Model EG gove nor on startup, at plants accumulation.
where full steam flow is allowed immediately. This over-sensitivity has been removed by installing a startup 5.2.2 Human Errors 4 -
steam bypass valve which opens first, allowing a :
controlled turbine acceleration and buildup of oil pres-HE1. The overwhelmingly dominant cause of problems sure to control the governor valve when full steam flow identified during a series of operational readiness eval-is admitted, uations of AFW systems was human performance. The majority of these human performance problems resulted DE2. Overspeed trips of Terry turbines have been from incomplete and incorrect procedures, particularly caused by condensate in the steam supply lines. Con-with respect to valve lineup information. A study of densate slows down the turbine, causing the governor valve nuspositioning events involving human error iden-valve to open farther, and overspeed results before the tihed failures in administrative control of tagging and governor valve can respond, after the water slug clears, logging, procedural compliance and completion of steps, This was determined to be the cause of the loss-of-all-verification of support systems, and inadequate proce-AFW event at Davis Besse (AEOD/602,1986), with dure, as important. Another study found that vane mis-condensation enhanced due to the long length of the positioning events occurred most ohen during mainten-
- cross-connected steam lines. Repeated tests following a ance,calibratiot.,or modification activities. Insufficient cold-start trip may be successful due to system heat up.
training in determining valve position, and in admini-ctrative requirements f" controlling valve positioning DE3. 'I\\ubine trip and throttle valve (TTV) problems -
were important causes,.
s oral task assignment with-are a significant cause of turbine driven pump failures out task completion fewack.
(IN 84-66). In some cases lack of'ITV position indica-tion in the control room preven'ed recognition of a HE2. Turbine driven pump failures have been caused by tripped TTV. In other cases it was possible to teset human errors in calibrating or adjusting governor speed either the overspeed trip or the 'ITV without resetting control, poor governor mamtenance, incorrect adjust-the other. This problem is compounded by the fact that ment of governoi valve at,d overspeed trip linkages, and
= the position of the overspeed trip linkage can be mis-errors associated with the trip and throttle valve. TTV-leading, and the mechanism may lack labels indicating associated errors include physically bumping it, failure when it is in the tripped position (AEOD/C602,1986).
- to restore it to the correct position after testing, and failures to verify control roorr. Indication of TTV posi-DE4. Startup of turbines with Woodward M_odel PG-PL tion following actuation-governors within 30 minutes of shutdown has resulted in overspeed tr4s when the speed setting knob was not ex-HE3. Motor driven pumps have been failed by humar, ercised locally to drain oil from the speed setting cy- -
- errors in mispositioning handswitches, and by procedure linder. Speed controlis based on startup with an empty deficiencies.
cylinder. Problems have involved turbine rotation due NUREG/CR-5S35 5.4 l
lj a
e Failute Modes to both procedure violations and leaking steam. Terry testing of check valves was addressed by the nuclear has marketed two types of dump valves for automatically industry, resulting in the EPRI report,
- Application draining the oil after shutdown (AEOD/C602,1986).
Guidelines for " heck Wlves in Nuclear Power Plants (Brooks,1988). This extensive report provides in.
At Calvert Cliffs, a 1987 loss-of-offsite-power event re-formation on check valve applications, limitations, and quired a quick, cold startup that resulted in turbine trip inspection techniques. In situ testing of MOVs was ad.
due to PG PL governor stability problems. The short-dressed by Generic Letter 89-10,' Safety Related Motor-term corrective action was installation of stiffer buffer Operated %)ve *Ibsting and Surveillance * (Partlow, springs (IN 88-091988). Surveillance had always been 1989) which requires licensees to develop and imple-preceded by turbine warmup, which illustrates the irn-ment a program for testing, inspection and maintenance portance of testing which dup'iicates service conditions of all safety related MOVs. " Thermal Overload Protec.
as much as is practical.
tion for Electric Motors on Safety-Related Motor.
Operated Valves Generic Issue II.E.6.1 (Rothberg, DES. Reduced viscosity of gear box oil heated by prior 1988)" concludes that valve motors should be thermally operation caused failure of a motor driven pump to start protected,yet in a way which emphasizes system func-due to insufficient lebe oil pressure. IAwering the pres-tion over protection of the operator.
sure switch setpoint solved the problem, which had not been detected during testing.
CFL The common cause steam binding effects of check valve leakage were identified in Section 5.2.1, entry DE6. \\Wterhammer at Palisades resulted in AFW line CC10. Numerous single-train events provide additional and hanger damage at both steam generators. The AFW insights into this problem. In some cases leakage of hot spargers are located at the norinal steam generator level, MFW past multiple check valves in series has occurred and are frequently covered and uncovered during level because adequate valve seating pressure was limited to fluctuations. Waterhammers in top-feed ring steam the valves closest to the steam generators (AEOD/C404, generators resulted in main feedline rupture at Maine 1984). At Robinson, the pump shutdown procedure was Yankee and feedwater pipe cracking at Indian Point-2 changed to delay closing the MOVs until after the check (IN 84-32,19M).
valves were seated. At Parley, check valves were l
changed from swing type to lift type. Check valve re-DE7. Manually reversing the direction of motion of an work has been done at a number of plants. Different operating valve has resulted in MOV failures where valve designs and manufacturers are involved in this such loadFag was not considered in the design (AEOD/
problem, and recurring leakage has been experienced, C603, Ifd6) Control circuit design may prevent this, re-even after repair and replacement.
quiring stroke completion before reversal.
l CF2.' At Rei-inson, heating of motor operated valves by l
DES. At each of the units of the South Texas Proj. c:,
check valve leakage has caused thermal binding and fail-space heaters provided by the vendor for usein pre-ure of AFW discharge valves to open on demand. At installation storage of MOVs were found to be wired in Davis Besse, high differential pressure anoss AFW in-parallel to the Class 1E 125 V DC motors for several jection valves resulting from check valve leakage has AFW valves (IR 50-489/89-11; 50-499/89-11,1989). The
_ prevented MOV operation (AEOD/C603,1986).
valves had been em'ironmentally qualified, but not with the non-safety-related heaters energized.
CF3. Gross check valve leakage at McGuire and Robinson caused overpressurization of the AFW suc-5.2.4 Component railures tion piping. At a foreign PWR it resulted in a severe
(
- waterhammer event. At Palo Verde 2 the MFW suction Generic Issue II.E.6.1, *In Situ Testing Of Valves" was piping us overpressurized by check valve leakage from divided into four sub-issues (Beckjord,1989). three of the AFW system (AEOD/C404,19M). Gress check which relate directly to prevention of AFW system valve leakage through idle pumps represents a potential component failure. ' At the request of the NRC,in-situ diversion of AFW pump flow.
5.5 NUREG/CR-5835
[
Failure Modes CF4. Roughly one third of AFW system failures have CF7. Control circuit failures were the dominant source been due to valve operator failures, with about equal of motor driven AFW pump failures (Casada,1989).
failures for MOVs and AOVs. Almost half of the MOV -
This includes the controls used for automatic and failures were due to motor or switch failures (Casada, manual starting of the pumps, as opposed to the instru-1989). An extensive study of MOV events (AEOD/
mentation inputs. Most of the remaining problems were C603,1986) indicates continuing inoperability problems due to circuit breaker failures.
caused by: torque switch / limit switch settings, adjust-ments, or failures; motor burnout; improper sizing or CF8. " Hydraulic lockup" of Limitorque SMB spring use of thermal overload devices; premature degradation packs has prevented proper spring compression to related to inadequate use of protective devices; damage -
actuate the MOV torque switch, due to grease trapped due to misuse (valve throttling, valve operator hammer.
_ in the spring pack. During a surveillance at Trojan, fail-ing); mechanical problems (loosened parts, improper ute of the torque switch to trip the TTV motor resulted assembly); or the torque switch bypass circuit improp.
In tripping of the thermal overload device, leaving the erly installed or adjusted. The study concluded that
- turbine driven pump inojkrable for 40 days until the current methods aad procedures at many plants are not next surveillance (AEOD/E702,1987). Problems result adequate to assure that MOVs will operate when from grease changes to EXXON NEBULA EP-0 grease, needed under credible accident conditions. Specifically, one of only two greases considered emironmentally a surveillance test which the valve passed might result in qualified by Limitorque. Due to lower viscosity,it undetected valve inoperability due to component failure slowly migrates from the gear case into the spring pack.
(motor burnout, operator parts failure, stem disc sep-Grease changeover at Vermont Yankee affected 40 of aration) or improper positioning of protective devices the older MOVs of which 32 were safety related. Grease.
(thermal overload, torque switch, limit switch). Generic relief kits are needed for MOV operators manufactured Letter 89-10 (Partlow,1989) has subsequently required before 1975. At Limerick, additional grease relief was licensees to implement a program ensuring that MOV required for MOVs manufactured since 1975. MOV re-swi'ch settings are maintained so that the valves will furbishment programs may yield other changeovers to operate under design basis conditions for the life of the EP-0 grease.
plant.
CF9. For AFW systems using air operated valves,.
CFS. Component problems have caused a significant almost half of the system degradation has resulted from number of turbine driven pump trips (AEOD/C602, failures of the valve controller circuit and its instrument 1986). One group of avents involved worn tappet nut inputs (Casada,1989). Failures occurred predominantly faces, loose cable connections, loosened set screws,im-at a few units using automatic electronic controllers for properly latched TTVs, and improper assembly.
the flow control vah es, with the majority of failures due Another involved oil leaks due to component or seal to electrical hardware; At Turkey Point-3, controller failures, and oil contamination due to poor maintenance malfunction resulted from water in the Instrument Air -
activities Governor oil tnay not be shared with turbine system due to maintenance inoperability of the air lubrication oil, resulting in the need for separate oil dryers.
changes. Electrical component failures included transis-tot or resistor failures due to moisture intrusion, er-CF10. For systems using diesel driven pumps, most of I
roneous grounds and connections, diode failures, and a
- the failures were due to start control and governor speed faulty circuit card.
= control circuitry. Half of these occurred on demand,as opposed to during testing (Casada,1939).-
CF5. Electrohydraulic-operated discharge valves have.
performed very poorly, and _three of the five units using CF11. For systems using AOVs, operability requires the them have removed them due to recurrent failures.
availability of Instrument Air (IA), backup air, or Failures included oil leaks, contaminated oil, and hy-backup nitrogen. However, NRC Maintenance "Ibam
- draulic pump failures.
- Inspections have identified inadequate testing of check -
valves isolating the safety related portion of the 1A NUREG/CR-5835 5.6
.v 1
i 1
Failure Modes system at several utilities (letter, Roe to Richardsor).
components will perform as expected in accordance with Generic letter 88-14 (Miraglia,1988), requires licen.
all design-basis events, including a loss of normal IA.
sces to verify by test that air operated safety related
)
4 4
1 5.7 httREG/CR-5835
t s
6 References Beckjord, E. S. June 30,1980 Closcout ofGeneric Issue AFOD Reports ll.E.61, *ln Situ Testing of Valves'. l.ct:er to V. Stello, Jr., U.S. Nuclear Regulatory Commission, %hshington, AEOD/C404. W. D. lanning. July 1984. Stea n Binding D C.
ofAuxiliaryFeedwater Pumps. U.S. Nuclcar Regulatory Commission, Washington, DC.
(
Brooks, B. P.1988. Application Guidelinesfor Check Valves in Nuclear Power Plants. NP-5479, Electric AEODIC602. C Hsu. August 1986. OperationalErper.
Power Research Institute, Palo Alto, California.
ience involving Turbine Overspsd Trips. U.S. Nuclear Regulatory Commission, Washington, DC Casada.D. A.1989. AuriliaryFeedwaterSystem Aging Study Volwne1. OperatingErperience and Current AEOD!C603. E.J. Brown. December 1986. A Review J
Afonitoring!>actices. NUREGICR-5404. U.S. Nuclear ofhiotor-Operated Valve Performance. U.S. Nuctcar.
Regulatory Commission, Washington, DC Regulatory Commission, Washington, DC Gregg, R. E. and R. E. Wright.1988. Appendit Review AEOD,E702. E.J. Brown. March 19,1987. AfO F Fail.
forDominant Generic Contributors. BLB-31-88,16aho ure Due to Hy.iraulic Lockup From Excessive Grease in National Engineering Laboracry, Idaho Falls, Idaho.
Spnng Pack. U.S. Nuclear Regulatory Commission, Washington, DC.
Miraglia, E J. February 17,19SS. Resolution of Generie Safetyissue 93, ' Steam Binding ofAuxilia y Fredwater AEODIT416. 3anuary 22,19M. Loss ofESFAuxiliary Pumps'(Generic Lett, 88-03). U.S. Nuclcar Regulatory Feedwater Pump Capability at Trojan on January 22, Commission, %hshington, DC 1983. U.S. Nuclear Re8ulatory Commission, Whshington, DC Miraglia, E J. August 8,1988, instrument Air Supply System Problems Affecting Safety-Related Equipment (Generic Letter 88-14). U.S. Nuclear Regulatory Com.
Information Notices mission, Washington, DC IN 82-01 January 22,1982. AuxiliaryFeedwaterPump Partlow,J. G. June 28,1989. Safety-Related blotor.Op.
Lockout Resultingfrom IVestinghouse IV-2 Switch Circuit erated Valve Testing and Surveillance (Generic Letter Modification. U.S. Nuclear Regulatory Commission, 8910). U.S. Nuclear Regulatory Commission,
' %bshington, DC Mhshington, DC IN 8&32. E. L Jordan. April 18,1984. Auxiliary Feed-Rothberg,0. kne 198S ThermalOverloadProtection water Sparger and Pipe Hangar Damage. U.S. Nuclear for Electric i,fotors on Safety-Related Motor-Operated Regulatory Commission, Washington, DC.
Vc!ves Generic usuell.E61. NLTutEG 1295 U.S.
Nuclear Regulatory Commission, Washington, DC IN 8&66. August 17,1984. Undetected Unarailability of the Turbine-Driven AuxiliaryFeedwater Train. U.S.
Travis, R. and J. Taylor.1989. Development of Guid-Nuclear Regulatory Commission, Washington, DC ancefor Generic, Functionally Oriented PRA. Based Team Inspectionsfor BWR Plants. Identification ofRisk-
- IN 87-34. C E. Rossi. July 24,1987...
Single Failuresin important Systems, Components and Human Actions.
Auxiliary Feedwater Systents. U.S. Nuclear Regulatory TLR-A-3874-TGA Brookhaven National Laboratory, Commission, Washington, DC.
Upton, New York.
6.1 NUREG!CR-5835 i
l
t Refetences IN 87-53. C. E. Rossi. October 20,1987, Aurilia7 Inspeulon Report Feedwater Pump Trips Resultingfrom Low Suction Pres-sure. U.S. Nuclear Regulatory Commission, IR 50-48029-11; 50-49%9-11. May 26,1989. South
%bshington, DC.
7cras Project /nspection Repon. U.S. Nuclear Reg-elatory Commission, Washington, DC.
IN SS-09. C. E. Rossi. March 18,1988. Reduced Reli-ability ofSteam Driven AuriliaryFeedwaterPumps Caused byinstabihtyoflibodwardPG-PL Type NUREG Report Governors. U.S. Nuclear Regulatory Commission, Washington, DC.
NUREG-1154.1985. Loss ofMain andAurihary Feed-watsr Event at the Davis Besse Plant on June 9,1985.
IN 89 30. R. A. Azus. August 16,1989. Robinson U.S. Nuclear Regulatory Commission, Mbshington, DC.
Unit 2 Inadequate NPSH olAuriliary Teedwater Pumps.
Also, Event Notification 16375, August 22,1989. U.S.
Nuclear Regulatory Commission, Washbe, ton, DC.
NUREG/CR-5835 6.2 h
1
_u
~'
v.s. =vCLtan asov6Alony couusssion
- i. g t y t*
c ro== 235
~~
~
EEE BIBLIOGR APHIC D ATA SHEET NUREG/CR-7925.
.i is,,,,==.a.,~~-."-
'PNL-5835 2.mus aosveTn6s Auxiliary Feedwater System Risk-Based Inspection Guide for 2
_ oaTt m:Pont evous-so the Beaver Valley Unit 1 Nuclear Power Plant n a.,
w, i -
April 1 1992 I
o m oacnautwvusem L1310 67"50'88'0"1
- 6. AumoRm R.C. Lloyd Technical i
N.E. Moffitt h Pt RIOD COVE A L D ##arauses, oeeess 7y g B.F. Gore 1980-1991 g,3nggucAnou-a us eo Acoatss,u.ac.-o-o,
.- u -.
e Pacific Northwest Laboratory P. O. Box 999 Rich 13nd, WA 99352'
- 3. SPONSORING ORG ANIZATION - N AME AND ADOR ESS ist wac, ever "seaw a eas.e";# ess=ursee, see ame mac D. e.sa F%er er aseen, u.1 sevassee acaesenr----,
a=W s=mhur assrumJ Division of Radietion Protection and Emergency Preparedness Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory l Commission Washincton, DC 20555
- 10. $UPFLEMENT ARY NOTES
- 11. ABSTRACT taco===ami er am" In a study sponsored by the.U.S. N'uclear Regulatdry Commission (NRC), Pacific Northwest Laboratory has developed and applied a methodology-for: deriving: plant-specific risk-based inspection guidance -for-the auxiliary feedwater ( AFW) system at.
pressurized water reactors that have not undergoneLprobabilistic risk assessment (PRA).-
l-This methodology uses e'xisting PRA results'and plant operating experience ;information.
Existing PRA-based inspection guidance 11nformation!recently_ developed for the NRC for various plants was used to -identify generic. component failure modes. This.information was then combined with plant-specific and industry-wide component'information and '
failure data to identify +ailure modes and failure-mechanisms; for' the AFW. system at the selectedj plants.. Beaver Valley was selected as one of. a series of plants 1for-study. The product of this effort is a prioritized listing of L AFW failures 1which have occurred _ at_ the plant and at other;PWRs.- This listing;is intended for us'e by L
NRC inspectors in' the preparation _of, inspection:= plans' addressing ' AFW risk-important _-
components at the Salem. plant.
- 12. er,Ey woRos/ des;A:PTORs (&me meses erpasases sest mest osant sesesseness as meansiv ene essere.s.
la avma6AsawTv 81 A16uth1 Inspection, Risk, PRA', Beaver Valley,' Auxiliary Feedwater (AFW)_
m, Unclassified-n.,
Unclassified lANUMBEROfPAOLI IL PRICE
,,,e 4
.n m,
,.,%.c~.,...+.
,-,-,.m...~,.....-.m.~,s,,,,
,m.-
... -,,, -., _