ML20235V297

Probabilistic Evaluation of Reduction in Turbine Valve Test Frequency

ML20235V297
Person / Time
Site:	Prairie Island
Issue date:	06/30/1987
From:	Brockhoff C, Sharp D, Matthew Smith WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:
Shared Package
ML20235V263	List: ML20235V262 ML20235V274 ML20235V285 ML20235V297
References
WCAP-11529, NUDOCS 8710150082
Download: ML20235V297 (154)

Text

{{#Wiki_filter:- _, / WESTINGHOUSE CLASS 3 WCAP-11529 PROBABILISTIC EVALUATION OF REDUCTION IN TURBINE VALVE TEST FREQUENCY ~ R. K. Rodibauch R. L. Jansen J. A. Martin F. D. Stevenson G. F. Wande11 Approved:

1. A. /H D. R. Sharp, Manager l

Product Risk Analysis l C. 5. Brockhoff, Jr. Manager M. F. Smith, Manager l Technical Specification Services Product Engineering l I 1 June, 1987 Work Performed Under Shop Order MUHU-7000 Westinghouse Electric Corporation Power Systems P.O. Box 355 Pittsburgh, Pennsylvania 15230-0355 8710150002 870928 PDR ADOCK 050002B2 P PDR 0298x:1o/090187

WCAP-11529 PROBABILISTIC EVALUATION OF REDUCTION IN TURBINE VALVE TEST FREQUENCY TABLE OF CONTENTS l l TITLE PAGE 1.0 EXECUTIVE

SUMMARY

1-1

2.0 INTRODUCTION

2-1 3.0 TURBINE VALVE TESTING AND IMPACT 31

4.0 DESCRIPTION

S OF TURBINE VALVES AND OVERSPEED CONTROLS 4-1 5.0 BASIS FOR ANALYSIS 5-1 6.0 FAULT TREE MODELS 61 ~ 7.0 FAILURE DATA AND ANALYSIS OF BASIC FAILURE PROBABILITY 7-1 8.0 RESULTS 8-1

9.0 REFERENCES

9-1 APPENDIX A CONTROL OIL DIAGRAMS A APPENDIX B FAULT TREES B 0298x:10/073087 ii

4 1.0 EXECUTIVE SU WARY Several owners of Westinghouse nuclear steam turbines have formed a group for I 'the purpose of obtaining a change in the requirements for turbine valve testing. This group, the Turbine Valve Test Frequency Evaluation Subgroup (TVTF Subgroup), has sponsored this study and an earlier feasibility study as .the first tasks in obtaining relaxation or reduction in the required frequency of turbine valve tests. The group members have technical specifications or other requirements that currently call for weekly or monthly turbine valve testing. .j The purpose of this report is to provide the detailed probabilistic basis for the revision and extension of turbine valve test intervals. The probability of turbine missile ejection has been calculated for each turbine owner using detailed turbine data. The effect of extending the time interval of turbine valve tests has been incorporated into the analysis. Testing of turbine valve's affects the probability that the valves will be incapable of closing given that the load on the turbine is lost. The failure or unavailability of j the turbine valve safety function affects or contributes to the pr'obe.bility that the turbine will overspeed and e' ject a missile. Previous Westinghouse studies and evaluations have indicated that turbine missiles can be ejected at overspeeds that are less than the destructive or runaway speed of the turbine. The current study has attempted to quantify the total risk of turbine missile ejection at destructive overspeed (Approximately 180 percent of rated turbine speed) and at lower overspeeds in the range of 120 to 136 percent of rated speed. The lower overspeeds were evaluated in two categories: design overspeed and intermediate overspeed. The total missile ejection risk is developed in this report as the sum of the missile ojection probabilities from each of the three overspeed categories. The analysis of turbine overspeed has included a thorough identification of all faults and contributors to overspeed. Specific plant data was collected from the turbine owners in this effort. In addition, other systems which interface with the turbine have been investigated to determine whether they ] have any impact on the probability of overspeed. Section 5.,0 of this report 0298x:10/073087 1-1

y ,F, 'l '\\ \\ rel' y l \\ ) ) 1 i discussesthe'briisfortheanalysis)ofturbineperspeed. Extensive fault -l trees have been hondtructed for thih pyrpose uid"kr[c[ included in Appendix D. 1 Comporhit failure probabilities have bee'n ;developechbased on actual j 2, J Westinghouse service experience for most of the components. These basic f j failure probabilities are described and quantified in Section 7.0 of this '/ ) f report. j 1 ,'D The analysis has ccn'siderwthe type of low pressure turbine rotors thetaare currently installed in the owner's p1Wy, SpecificlowpressurerotorNata has been utilized because obthe irpact,thAt the type of rotor can have on the total probability of missile)sjection. Significant changes have occurred ir[ the design' of low pressure S.ttors and rotor disd in recent years. The t general trend has been towerf designs that reduce or climinate the problem of .discstresscorrosiencrackidg. This, i,n_turrthas h nited in significant reduction's'intheprobshilibofmissileejec'tionatdesignoverspeedwhichis ofinterestipthecurrentskudy. Installation of tne new rotor types and refurbishinent'of eM[ rotors'is expected to continuMn,the future. This should htN thk effect of further reducing in the proba'kility 'of missile ^ ejection at design and intennediate overspeed, and thapoveripe:ed events will Q3 centribute even less to the total probability of turbine missile ejection., // h 9 t 'j Section 8.0 of this report contains the detailed results of:,heprobabildtic investigation. Figures 8.3-1through8.3-22showthetotaldrobabiljtyof N turbine missile' ejection as a function of the turbine valve test interval. ? ~ Test intervals of one month to twelve months, were considered in the ctudy. The'purposeofthedetailedresultsinSection8.01.ptoprovideenough information for each group,rmher to make a valid dedisq'on on an appropriate l turbine valve test intervah' This rapert does noti aivd a hconnended turbine valve test intet,al. Section2.0 recommends'thatbeturbinavalvetest interval be selected,in a:co-dance with specif's plant needs cnd in accordance with a proposed acceptance criteria.- This faccedance criteria s'ets 2 limit on of miqs9e ejectie' per year based on nig group's and the total probability n Westinghouse'sunderstardindofcurrentflRCcriteria. The acceptance criteria addresses the last year'of turbineloperaEcn before the scheduied irsrection of the low pressura US) rotoNs. i An'atAeptance test made on *he lak> year ,1 I \\ t 0298mlo/07308? l '; l-2 I ) p

is. , assures that all preceding years will be within, and in fact well below the' acceptance criteria. If the ac eptance criteria are aet for the selected l turbine valve test interval, it is believed that an adequate level of turbine s reliability and safety has boen demonstrated. 4 i-The results show that the acceptance criteria are met as the turbine valve test interval is extended. This applies to all turbines in the group that are now installed or, in the case of Turkey Point, to be installed. 4 i J 0298x;1D/073087 1-3 m.____.__._______.___.-.__

2.0 INTRODUCTION

Historically, Westinghouse has recommended that turbine valves be tested at periodic intervals. A weekly test recommendation was originated in the mid-1950's as a result of-service experience associated with fossil plants that used phosphate feedwater treatment and in recognition of the importance of reliable turbine generator operation, equipment protection, and personnel safety. This weekly test recommendation evolved into a license requirement for some nuclear power plants by virtue of its inclusion into plant technical specifications. Frequent valve testing has remained a requirement for most nuclear plants even though its necessity has not been established. To the contrary, past Westinghouse studies indicate that weekly or monthly testing of nuclear turbine valves is an unnecessarily short schedule that can be undesirable for reasons stated below. Current technical specification requirements for turbine valve testing appear to be arbitrarily applied. For some plants the technical specifications require weekly testing, for others monthly testing, and for other plants no technical specification requirement exists. Periodic valve testing requires a. temporary power reduction that results in lost electrical generation while adding to the number of thermal cycles on the piping, valves and the turbine itself. In addition, inadvertent reactor trip can become more likely during the transient power reduction and increase. In recognition of the effects of turbine valve testing on plant equipment and electrical power generation, Westinghouse was asked to evaluate the need for periodic valve testing and to establish appropriate test intervals. This report contains the results of that evaluation. The evaluation performed consisted of construction of fault trees with the top j 1 event giving the annual probability or frequency of overspeed. Failures of turbine valves and overspeed protection components were modeled in the fault trees as a function of the valve test interval. Plant data was used to quantify the fault trees. The probability of overspeed was calculated for various test intervals. The evaluation also determined the probability of missile generation at an overspeed condition. The probability of overspeed en

c: L t i and the probability of generating a missile were combined to arrive at the ~ s , total probability of missile generation considering various valve test intervals. The evaluation performed was authorized by the following utilities and is specific to the turbines at their respective nuclear plant sites as indicated: UTILITY PLANT Carolina Power & Light H.B. Robinson 2 Shearon Harris Consolidated Edison Co. of New York Indian Point 2 ~ Consumers Power Co. Palisades Florida Power & Light Turkey Point 3&4 St. Lucie 1&2 Maine Yankee Atomic Power Maine Yankee Northern States Pcwer Prairie Island 1&2 Pacific Gas & Electric Diablo Canyon 1&2 New York Power Authority Indian Point 3 Public Service Electric & Gas Salem 1&2 Wisconsin Electric Power Point Beach 1&2 Wisconsin Public Service Kewaunee 0298m:1o/073087 2-2

3.0 TURBINE VALVE TESTING AND IMPACT Testing is conducted to verify that equipment is capable of performing its intended function. The turbine valves function to control.and protect the ~' main turbine. They must be capable of moving freely in response to control and protection signals. Valve testing ideally tests these abilities or i detects non performance of these abilities. There are two degrees of performance or non performance that testing may potentially demonstrate: A. Equipment failure - the complete non performance of equipment function. B. Equipment failure precursors - identification of equipment conditions that will eventually lead to failure if not corrected. A test which only identifies equipment failure is useful in limiting the time . after failure that the faulty equipment may be relied.on. A test which identifies failure precursors can impact the time between and the number of failures if the precursors are acted on. This section of the report addresses turbine valve testing and its implications on valve failure rate. 3.1 Turbine Valve Testing Periodic testing of turbine valves consists of movement of each of the turbine valves through one cycle (from the valve position prior to testing, to full close, and returning to the original position). Typically, this test is conducted by the control room operator with an observer at the valve. Valve testing verifies freedom of movement of the valve stem and plug, the actuator rod and piston and verifies proper operation of either the servo valve,. servo i motor, or dump valve, depending on which valve is being tested, and the associated drain line (return line)'to the reservoir. Testing verifies closure of the turbine valves as testing is now constituted, i.e., nothing is inhibiting closure. This type of testing is beneficial for, (1) detecting non or sluggish operation of the valves, and (2) identification of gross outward appearance of valve condition. 0298x:1o/073087 3-1 .____._m.___.

L L l-In~ addition to periodic testing, valve inspections during a shutdown can l detect distress or conditions that would lead to future valve failure. In the current study, the valve inspection interval was not an input parameter. However, actual service experience has been used in the calculation of valve failure rates (Section 7.0). It is believed that these failure rates reflect the average practice of the nuclear and fossil industry with respect to inspection and maintenance of turbine valves. 3.2 Surrogate Valve Testing i Periodic valve testing primarily demonstrates the ability of the valve to respond to a signal and close upon demand'. Both planned and unplanned turbine trips can also demonstrate these abilities and can be considered surrogate valve tests for which a valve test " credit" can be taken. All turbine trips -result in the dumping of autostop oil and the operation of systems which dump high pressure oil or electrohydraulic fluid from the turbine valve actuators. For planned trips, Westinghouse has determined that stationing an observer at the valves to visually' check valve operation during the trip qualifies as a surrogate valve test provided there has been no evidence of malfunction of control or governor valves during normal operation. For unplanned trips, the only significant difference from a planned trip or a typical valve test is the absence of an observer at the valves. In this case, sufficient evidence of proper valve operation can be obtained if an operator looks at each turbine valve not too long after the trip and verifies that all valves are in the closed position and that conditions with respect to the valves appear normal. This' operator activity would then qualify as a surrogate valve test. 3.3 Valve Failure Modes and Impact of Testing l The dominant occurrence of valve failure modes, such as sticking and mechanical damage, can be attributed to the following: 1. Movement or loss of valve internal components

2.. Cracking or breaking of the muffler 0298x:1o/073087 3-2

q 1 l l 3. Piston seal ring - bonnet, bushing, or liner galling or distress 4. Misalignment of valve linkage ) l These conditions are primarily internal to the valves, and periodic testing would identify these conditions only to the extent that they are apparent to j an observer or that they prevent valve operation. Periodic testing most often identifies failures. Failure precursers that do not noticeably affect the rate of closure or final position of a valve are not easily detected in s testing. For example, a cracked muffler could potentially result in later f muffler. failure and subsequent internal valve binding; however, the j " precursor" could not be detected during testing, only the subsequent failure I of the valve could be detected. i Before the adoption of all-volatile feedwater treatment (AVT), deposit buildup i occurred in the clearance between valve stems and bushings which could inhibit valve operation. During this period valve testing. assisted in removing the i deposits and a' Iso prevented a buildup of the deposits. Since then, AVT water treatment has been adopted in most plants. All of the plants in the study ) group have AVT. The failure rate for turbine valve sticking (Section 7.0) is applicable to plants currently using AVT treatment, regardless of whether or i not they previously used the phosphate type of treatment which has been ] identified as the major cause of sticking. For the above reasons, periodic valve testing ches not have an impact on valve l failure rate for these types of valves in that it has not readily identified failure precursors, only failures. Therefore, increasing the periodic test ) interval will have no adverse impact on observed failure rates or valve lifetime. Testing that does not identify repairable defects cannot influence valve degradation and therefore valve failure rate. Westinghouse, after considering failure modes and testing methods in conjunction with the use of i AVT water treatment, concludes that less frequent testing will not adversely ? impact turbine valve reliability. l i l i k l 0480v:1o/0814a7 3-3 i

w m lq

4.0 DESCRIPTION

S OF TURBINE VALVES AND OVERSPEED CONTROLS The following sections' describe the'various turbine. valves and the overspeed controls. :The turbine valve arrangements for each plant, by variation number,- are shown in Section 5.0 Figures 5-1 through 5-7. 4.1 300~ PSI System The turbine valve arrangement for Turkey Point, Units 3 and 4 (variation 1) is shown in Figure 5-1. The turbine valve arrangement for Indian Point Units 2 and 3 (variation 2) is shown in Figure 5-2. These are the 300 PSI system plants. 4.1.1 Turbine Valves'(300 PSI) Stop valves and control valves are located in the steam supply lines to the high pressure turbine.- Interceptor and reheat stop valves are located in'the supply lines to the low pressure turbines, except for the Indian Point units which do not have reheat stop and interceptor valves. Instead, these units have low pressure steam dump systems connected to the inlet lines to the low pressure turbines. Stop valves close automatically in response to the dumping of autostop oil which will occur in an overspeed trip or a system separation. The controls and trips that dump autostop oil are discussed in Subsection 4.1.2. In normal operation, each stop valve is held open against a closing spring force by high pressure oil acting on the servomotor piston. A servomotor relay, held closed by the pressure'of autostop oil, opens if the autostop oil pressure is dumped. This-in turn routes the high pressure oil to drain; and the stop valves, equipped with large closing springs, close rapidly. Stop valves block 'the flow with a clapper that swings down from the horizontal (open) position similar to a swing check valve. Each stop valve has a bypass valve that is designed to automatically equalize the pressure on both sides of the stop valve before it opens. The valve is a 'normaliy-closed air-to-open type and is equipped with mechanical and hydraulic 0298x:1D/073087 4-1

. interlocks that permit it to open only when the stop valve is fully closed and the turbine is " latched." To restart the turbine following a turbine trip, the overspeed trip valve is latched or_ reset manually.so that the autostop oil pressure can begin to build up. This immediately causes an oil-operated air pilot valve to close and admit air to the bypass valve diaphragm.- The bypass valve then opens and equalizes the pressure across the \\ stop valve just before the stop valve opens. As a result of the interlock logic, the bypass valve remains closed during normal cperation and turbine trip, and it opens when a stop valve is closed for a stem freedom test. Control valves adjust the inflow of steam to the turbine in response to the speed or load demand placed on the turbine generator The control valve servomotor receives a control oil pressure signal generated by the control devices. This control oil signal operates on the pilot relay stage of the servomotor which controls the admission of high pressure oil to the main i servomotor piston.- The valve is positioned according to the magnitude of the control oil pressure and will move rapidly to the fully-closed position if the control oil is dumped. Various turbine controls and trips, explained in Subsection 4.1.2, are designed to dump the control oil on loss of load or overspeed. Interceptor and reheat stop valves are held open in normal operation by high pressure oil operating on the piston of the servomotor. Each interceptor valve has a servomotor relay which is connected to the common control oil header. The relays will open in response to a dump of the control oil and close the interceptor valves. Reheat stop valves have servomotor relays that are connected to the common autostop oil header. These valves close with a dump of the autostop oil in a similar manner as the stop valves. Reheat stop valves'and interceptor valves are of a butterfly or disc pivoting on a center shaft type design. The steam dump system employed in the Indian Point plants has six normally-closed air-operated valves of the air-to-close type. Air pressure to each valve is released by deenergizing either of two normally-energized solenoid valves (12 solenoid valves in total). One soleniod valve of each pair is deenergized by relay 63/AST which receives a signal from a trip of the autostop oil system. The other solenoid valve is deenergized by relays designated OCB which respond to a loss of load. Each of the six steam dump paths can be manually blocked by one of six motor-operated valves. 0298x:1o/073087 4-2 l

I f I I ~ 4.1.2 Turbine Control and Overspeed Protection (300 PSI) 1 Turbine control is accomplished with a mechanical-hydraulic system consisting ] of'a gcvernor impeller, governor, auxiliary governor and motor-operated speed changer. If the turbine accelerates from its normal speed, the auxiliary governor will rapidly reduce the control oil pressure in response to this turbine acceleration and excess speed. This causes the control valves to .close until the turbine returns to normal speed. In the event the governor and auxiliary governor fail to keep the turbine speed within the acceptable range, three additional protective devices are q available to prevent excessive overspeed. First, the overspeed protection controller will activate with loss of load and f automatically open scienoid valves that will drain the control oil and cause l the control valves and interceptor. valves to close. (Note, this feature is not incorporated in the Indian Point plants, Variation 2.) Second, a mechanical overspeed trip valve consisting of an eccentric weight, trigger, cup valve, and dump valve will activate at an overspeed setpoint that typically does not exceed 111 percent. This drains the autostop oil, thereby ~ causing the stop valves and reheat stop valves to close. The control valves and interceptor valves will also close since the control oil is also dumped via the governing emergency trip valve. Third, an electrical trip mechanism consisting of a solenoid and plunger valve (20-AST-1) will activate with system separation due to a generator trip signal and thereby anticipate the overspeed condition. The plunger valve drains the autostop oil which results in the closing of the turbine valves and in the case of the Indian Point units, the opening of the steam dump valves. 4.2 AEH-DEH System Analog Electrohydraulic (AEH) and Digital Electrohydraulic (DEH) are two variations of a turbine control system that is commonly called the electrohydraulic (EH) control system. Electrohydraulic control systems differ 0298x:1o/073087 4-3

s from 300-PSI systems in that an electronic controller is used f'or valve - i l positioning rather than a mechanical-hydraulic governor, and a separate electro-hydraulic fluid system is used for control rather than a combination control and lube oil system. The DEH control system evolved from the AEH with the major change being the redesign of the electronic controller as a s computer-based controller with greater flexibility of operation. AEH and DEH control systems have practically the same electro-hydraulic fluid system (except for a redesigned trip subsystem at Shearon Harris). Distinguishing between AEH and DEH was found to be unimportant in the study because the j probability of turbine overspeed was closely tied to the common design of the electro-hydraulic fluid system and not to the type of electronic controller. Plants having the AEH-DEH (or EH) control system are shown in Section 5.0, Figures 5-3 through 5-7. 4.2.1 Turbine Valves (AEH-DEH) Stop valves and control valves (or throttle valves and governor valves in the steam chest design shown in Figure 5-7) and interceptor and reheat stop valves i are located in the steam lines to the h'gh and low pressure turbines. The i Point Beach units do not have reheat stop and interceptor valves.

Instead, i

these units have low pressure steam dump systems connected to the inlet lines of the low pressure turbines. Stop (throttle) valves close automatically in response to the dumping of emergency trip fluid which will occur in an overspeed trip or a system separation. The controls and trips that dump emergency trip fluid are j discussed in Subsection 4.2.2. In normal operation, each stop (throttle) valve is held open against a closing spring force by high pressure fluid l acting on the servo-actuator piston. Each stop (throttle) valve has a dump l valve that opens if the emergency trip fluid pressure is dumped. This in 1 turn, routes the high pressure fluid to drain and the stop valve, equipped with large closing springs, closes rapidly. The stop valves used in the plants of variations 3,4 and 6 are of the " clapper" type while those of l variations 7 and 8 are of the " plug" type. The clapper-type has a stop valve 1 bypass valve, as described in Subsection 4.1.1. 0298rt o/073087 4-4 ______-__n_.

-r a Co.ntrol (governor) valves adjust the inflow of steam to'the turbine in L . response to the speed'or load demand placed on the turbine generator. Each ihas a servo valve'and a dump valve. The servo valve receives an' electrical input from the electronic controller and positionsLthe steam valve through tho' control of.high pressure fluid to the servo-actuator. The' electronic . controller is an analog or digital processor receiving turbine speed and first stage pressure inputs. The control (governor) valve will move rapidly to the fully-closed position if the dump valve is opened by a trip or protective device that' dumps the emergency trip fluid. Various controls and trips, discusscd in Subsection 4.2.2, are designed to dump the emergency trip fluid on loss of load or overspeed. Interceptor and reheat stop valves are held open by high pressure fluid -operating on the. pistons of the servo-actuators. Each interceptor valve has a dump valve that is connected to a common control emergency trip fluid header. (This header is called the 0.P.C. trip header in the Shearon Harris system.) I The dump valves will open in response to a dump of the emergency trip fluid and close the interceptor valves. Reheat stop valves have dump valves that 'are connected to'the common stop emergency trip fluid header. (This header is called.the auto stop emergency trip header in the Shearon Harris system.) Reheatnstop valves will close in response to a dump of the stop emergency trip i fluid.- Since the Point Beach units do not have reheat stop and interceptor valves, a steam dump system is employed which has four normally-closed air-operated valves of the air-to-close type. Their operation is similar to the steam dump system at-Indian Point. A description of this operation can be found in i Subsection 4.1.1. 'l 4.2.2-Turbine Control and Overspeed Protection (AEH-DEH) 1 l The AEH-DEH (or EH) control system controls the flow of steam to the turbine and permits the selection of the desired turbine speed and acceleration . rates. The primary speed channel and turbine impulse stage pressure are the primary inputs to the valve electronic controller which positions the control (governor) valves. If the turbine accelerates from its normal speed, the primary speed channel and servo valve on each control valve will rapidly 0298x:1o/073087 4-5

i reduce _the fluid pressure acting on the control valve servo-actuators.. This. causes the control valves to close until the turbine returns to normal speed. Three additional overspeed protection controls are available to prevent overspeed.- s First, the overspeed protection controller will activate with loss of load or at an overspeed setpoint of approximately 103 percent and automatically open solenoid valves that will drain the control emergency trip fluid and cause the control. valves and interceptor valves to close. Second, a mechanical overspeed trip valve, consisting of an eccentric weight, trigger, and cup valve, will activate at an overspeed setpoint that typically does not exceed 111 percent, and drain the autostop oil. This releases pressure on.the diaphragm of the interface valve which then opens and drains the emergency trip fluids. Third, an electrical overspeed trip mechanism consisting of a solenoid and plunger valve (20AST-1) will activate with system separation due to a ~ generator trip signal. The plunger valve drains the autostop which causes the ) interface valve to open and the turbine valves to close. On 8B-296 turbines, the solenoid valve is also activated by an overspeed signal of approximately 111 percent. Some plants include, in backup, an additional autostop oil solenoid dump valve (20AST-2) which is redundant to 20AST-1. Rather than the two-valve 20-AST system, Shearon Harris (Variation 8), has an electrical trip system made up of four 20/AST solenoid dump valves. The opening of two of the four solenoid valves results in draining of the emergency trip headers and i closure of the turbine valves. In the event of a turbine trip prior to a generator trip, the opening of generator output breakers is delayed for 30 seconds following the turbine trip. During this period, the turbine is allowed to motor; and turbine speed is governed by grid frequency. The delayed generator trip usually results in negligible overspeed. The interlock and delay is found on both the 300-PSI and AEH-DEH type turbines. 0298x:1o/073087 4-6

t 1 5.0. BASIS FOR. ANALYSIS I ' 5.1 Classification of Turbines for Overspeed Analysis This:sub'section discusses the method by which each participating plant was-placed into one of seven categories for the purpose of overspeed analysis. l i i The members of the Turbine Valve: Test Frequency Subgroup and Westinghouse I determined at the onset of this study that an analysis of a single " generic" turbine would be unsatisfactory. Significant differences were.found in the controls and in the arrangement and type of turbine valves. These differences ' had the potential for affecting the probability'of-' turbine overspeed, either due.to the. inherent. design of the valve and control system or due to the . failure rates of. individual' components. A generic' analysis would have neglected these and other differences and could n'ot have produced the type of results that would be required.for the eventue.1 relaxation of turbine valve

test _ frequencies.

It was found that the turbines could be-grouped.according to similar or 4 identical valving, controls, and protective subsystems such that a single overspeed analysis could be made that would be applicable to all of the turbines in a group. A checklist was developed _to classify the turbines. From an original listing of ten possiblel categories or variations of turbines, the turbines'of the subgroup of owners were placed'into sever categories or variations, as shown in Table 5.1. ThecategorizationwasmadeafterarevieY of Westinghouse and owner-supplied data such as the control oil drawings that are reproduced in Appendix A. Even after the turbines were classified, there were some plant specific ' differences that still had to be addressed. Overall, an attempt was made to account for these plant specific differences in a way that would result in a bounding or conservative evaluation of overspeed probability within each variation group. 0298x:1o/073087 5-1 I

3. f. \\ l The following plant specific differences were addressed in this study:

a. Combinations of reheat stop/ interceptor valves l

i

b. Full load' steam dumps y

c. Additional autostop oil' dump. valves.(20/AST-2) 1

d. Additional or redundant overspeed trip systems

, j \\ l l. . e. Reheat steam pressure control valves

f. Tu'bine extraction for feedwater heating r

9 Item a above' concerned the fact that some of the plants in Variation Number 3 had six combinations of reheat stop/ interceptor valves while others had four. ~' Six combinations were used in the analysis of overspeed in order to provide a j - bounding analysis of overspeed. Item b was considered a feature that could - not mitigate overspeed based on the opening time for the main steam dump valves being longer than the typical closing time for turbine valves. Item c was not included-in the analysis because all of the turbines within the category did not have them. Item d involved redundant overspeed protection systems, such as the Independent Emergency Overspeed Protection System (IEOPS), and the redundant overspeed protection system (ROST or SCOTS). These 4 were not included in the analysis because only eight of the nineteen . generating units in the study had one of these trip _ systems. Item e, reheat steam control valves, could have some mitigating effect on overspeed but was - not evaluated because not'all of the plants in the study had them. Item f j involved the effect on overspeed of a reverse flow of steam through the extraction lines to the turbine. Because this effect could contribute to rather than mitigate overspeed, an analysis of the probability of reverse flow was made. This analysis involved an extraction line system that was representative of the plants in the study group. The results of this analysis l are discussed in Section 8.0 of this report. 1 l 0298x:10/073087 5-2 l

The following is a description of the classification information in Table 5.1. The variation number assigned to each of the seven categories is given in Column 1. Column 2 identifies the basic turbine building block (BB) number. Column 3 describes the turbine valving on the steam inflow lines to the high pressure turbine. The basic coding for this column is: SV, stop valve; CV, control valve; TV, throttle valve; and GV, governor valve. Three arrangements of high pressure turbine valving are given: the one-on-two stop valve-control valve configuration, the one-on-one stop valve-control valve arrangement, and the steam chest. arrangement consisting of two throttle valves and two governor valves per chest. Figures 5-1 through 5-7 show the three arrangements of the H.P., turbine valving. l Column 4 of Table 5.1 describes the valving on the inflow lines to the low pressure turbine. There are two basic entries in this column; the 1-on-1 reheat stop (RS) interceptor valve (IV) arrangement, and steam dump system. Tha physical arrangement of the steam dump systems is shown in Figures 5-2 and 5-6. Both Diablo Canyon 1 & 2 and Salem 1 & 2 have six RS-IV inflow paths to the LP turbines (Figure 5-3). The remainder of the plants in the study have four RS-IV inflow paths to the low pressure turbines (Figures 5-1, 5-5, 5-4, and 5-7). Column 5 of Table 5.1 lists the two basic types of control systems: the 300 PSI control system and the EH (AEH or DEH) control system. These two basic control systems were described briefly in Section 4.0 of this report. Turkey Point 3 & 4 and Indian Point Units 2 and 3 have the 300 PSI system. The remainder of the plants in the study group have the AEH-DEH (or EH) system. Appendix A shows the applicable control oil drawing for each plant in the study group. Column 6 lists three basic types of trip systems. The various trip components were described in Section 4.0 of this report. System No. I has the mechanical overspeed trip valve and the 20-AST solenoid valve, either of which will dump the autostop oil in a trip. The system also includes an auxiliary governor which responds to overspeed or acceleration. System No. 2 has a mechanical overspeed trip valve and a 20-AST solenoid valve which dump the autostop oil 0298x:1o/073087 5-3

_ = _ _ _ _ _ _ _ _ _ _ _ _ _ - _ i i in a manner similar to system No. 1. ~The dump of'autostop oil causes an oil-operated. interface v'alve and a 20/ET solenoid valve to open,.either of .which dumps the emergency electro-hydraulic. trip (ETF) fluid; System No. 2 also includes two overspeed protection control solenoid dump valves (20-1 OPC and-20-2 OPC), either of which will dump the control electrohydraulic trip In some plants the OPC solen ~id valves'may be labelled 20-1 AG and . fluid. o 20-2 AG. System No. 3 has a fluid line called the mechanical overspeed trip header which is dumped by the mechanical overspeed trip valve. A dump of the l overspeed trip he'ader causes an oil-operated interface valve to open and dump the emergency trip fluid. System No. 3 also has four 20/AST solenoid valves which activate on overspeed and dump ETF fluid. 5.2 Identification of Overspeed Events Before discussing the type of overspeed events that are of. concern in this study, it should be pointed out that turbine overspeed is sometimes planned for the purpose of testing overspeed trip mechanisms. Usually, the test. conditions are controlled so that the turbine speed reaches, but does not greatly' exceed the overspeed trip setpoint of the turbine. This setpoint is typically in the range of 103 to 111 percent of rated speed. The risk of missile ejection at these low overspeeds is believed to be small and was not i evaluated in this study. The current study focuses on overspeed events that occur inadvertently following a system separation or loss of load. These events generally involve system failure sequences causing overspeeds that approach or exceed the design overspeed of the turbine. Table 5.2 was developed to identify the significant overspeed events and the , combinations of turbine valve failures that can cause overspeed. The " design Loverspeed" event for turbines with reheat stop and interceptor valves is one in which the~ maximum speed of.the turbine approaches but does not exceed an overspeed of 120 percent of rated speed. For turbines with reheat stop and ' interceptor valves, design overspeed will be approached if the initial overspeed protection (overspeed protection controller and auxiliary governor) or the control valves or interceptor valves fail to fuaction and the stop and 0298clo/073087 5-4

i I'l reheat stop valves'close after turbine speed reaches the overspeed trip .setpoint (Events 3 and 4 in Table 5-2). Turbines.without reheat stop and interceptor valves (Indian. Point and Point Beach) have a design overspeed of 132 percent. For turbines without reheat stop and interceptor valves, a loss of load followed by closure of the control valves or stop valves and e - activation of the low pressure steam dump will result in an overspeed which approaches design overspeed. Therefore, nova)ve'failuresareinvolvedand further fault tree analysis was not required. In establishing a basis for the analysis of design overspeed, it was conservatively assumed that the failure of one or more control valves or the failure of two or more interceptor valves to close would result in a design overspeed event. This is believed to be conservative based on the results of previous tests. In these tests, turbines operating at 80 percent or more of rated load have been separated from the system. The tests have shown that the turbine speed approaches but stays below design overspeed under these conditions. It is expected that the turbine response would be similar if only one control valve or only two interceptor valves stuck open, and the maximum turbine speed would be'no greater than the speeds determined from the_ tests. Therefore, a conservative basis was established for the analysis of design overspeed. The following is description of the basis for design overspeed for turbines with reheat stop and interceptor valves. 1. System separation occurs and a turbine trip does not occur at event onset. 2. One or more control (or governor) valves, or two or more interceptor valves, fail to close immediately following loss of load or onset of overspeed. l l 0298x:1o/073087 5-5 l

j 3. Successful overspeed trip: the stop (or throttle) valves and reheat: 1 stop valves'close.- ] 1 ' Intermediate overspeed has been estimated to be approximately.10 percent above design overspeed for. turbines with reheat stop and interceptor valves ]

(Reference 3). For the Indian Point and Point Beach units, intermediate 1

p overspeed is approximately 136 percent. The events'that result in ~ intermediate overspeed are Numbers 5 through 8 in Table 5-2. Generally,. i intermediate'overspeed-involves a failure to. block or reduce the pressure of the steam flow to tho' low pressure turbine. - For turbines with reheat stop and interceptor ' valves,- the. failure of the reheat stop.and interceptor valves to , close 'at the overspeed trip setpoint results in' a transfer of. energy to the low pressure turbine for a longer duration than what occurs in design -overspeed. For turbines without interceptor and reheat stop valves, intermediate overspeed was assumed to result from failure of one or more of the steam dump valves'for a'four-valve system or failure of twc or more dump valves in a-six-valv,' system. Events 6 and 7 identify another way in which_- intermediate overspeed can,be reached. If a control valve remains open and a stop valve bypass' valve'in the same steam path is also inadvertently open, the steam flow through the 4-inch diameter bypass valve can be sufficient to cause intermediate overspeed. The stop valve bypass valve is designed to remain ' closed during normal ~ operation and during turbine trip. Further details on the failure modes of the bypass valve can be found in Sections 4.0 and 7.0. l i .The following is a description of the basis' for intermediate overspeed for j turbines with reheat stop and interceptor valves: 1.- System separation occurs. i 1 2. One or more alignments of RS/IV remain open, or one or more stop valve bypass valves is inadvertently open and the downstream control i valve is open. ) 0298xd D/073087 5-6 .______-___a

.1 1 The'following is an abbreviated description of the basis for intermediate overspeed for turbines with steam dump systems:.

1..

System separation' occurs. { <2. One or more LP steam dump valves fail ~to open or one or more stop / valve bypass valves.is. inadvertently open and the downstream control-i valve is open. [ Events 9 and 10 in Table 5-2 identify the destructive overspeed event. This _{ event results-from failure of one or more stop (throttle) valves to close and failure of one or more control valves downstream of the failed stop valve (in the same* steam path).- Destructive overspeed is on the order of 170 percent to 185 percent of rated speed, depending on the L.P. rotor design. Failure of L.P. valving has no impact on this event. The following is an abbreviated { description of the basis for destructive overspeed: ~1. System separation occurs f 2. One or more control (governor) valves fail to close i 3. One or more stop (throttle) valves, in the same steam path as the failed control valve, fail to close ] 5.3 Basis for Calculation of Missile Ejection Probabilities Based on Westinghouse experience, the regular testing'of turbine valves and the regular inspection of the low pressure turbine rotors are two effective ways of controlling and' managing the risk of turbine missile ejection. The main goal of this study was to determine the probability of turbine missile ejection and the effect of the turbine valve test interval on this probability. Turbine valve testing affects only.the the probability of missile ejection resulting from overspeed of the turbine. Therefore, this study concentrated on missile ejection from overspeed. 0298x:1D/073087 5-7

s Before discussing the basis for ca.lculating the probability of missile I ejection due to overspeed, it should be mentioned that all of the plants in the subgroup have a program of low pressure rotor inspection. All but one of the subgroup plants uses a deterministic rotor inspection program in accordance with Reference 15. In the deterministic program, the LP rotors are 4 I inspected and the time that it takes for a hypothetical crack in the rotor to grow to critical size (the crack size that is just large enough to result in disk failure) is calculated. If the inspection indicates the presence of cracks, the inspection time is further reduced. Half of this time is used as a deterministic basis for' establishing the length of time before the next rotor inspection. This program effectively assures that the risk of missile ejection at running speed is very small because a very conservative criterion is used to establish the time interval to the next inspection. One plant in the study group (Indian Point 3), has a probabilistic rotor inspection program in accordance with Reference 5. This program differs from the deterministic in that probabilities of missile ejection at normal speed and at design overspeed are calculated for various running tir.e intervals. The risk of j turbine missile ejection can then be managed by selecting a running time that i results in a sufficiently low missile ejection probability. In the current study, the effect of. varying the turbine valve test interval was evaluated by calculating the total probability of turbine missile ejection, P(1), for the three identified overspeed events. The formula used to calculate P(1) is reproduced in Table 5-3 and is discussed in the following paragraphs. The probability of missile ejection due to design overspeed is the product of the probability of design overspeed, P(A), and the conditional probability of I missile ejection at design overspeed, P(M/A). In words, P(M/A) is the probability of ejecting a missile given that the turbine reaches design overspeed.. A product of P(8) and P(M/B) results in the probability of I missile ejection for the intermediate overspeed event. P(C) by itself denotes l the probability of missile ejection for the destructive overspeed event f because the conditional probability, P(M/C), is assumed to be one for all turbines in the study. ] 0298x:1o/073087 5-8

m. h l o P(M/A)~wasobtainedfrompreviousWestinghouseplant-specificprobabilistic' reports on missile ejection from low pressure turbine rotors. The method that l these reports use in calculating the probability of missile ejection.is l described in Reference 5. It involves a calculation of'the probability of f, . failure of.each turbine disc based on Westinghouse crack growth data, the l . stress' generated at design overspeed, and.the resultant critical crack size.. The~ probability of disc failure is broken into two parts: the probability that a crack initiates and the probability that the crack has grown beyond critical I, size after a certain interval of time. Each disc is evaluated separately, and the sum of the' individual probabilities yields the final missile ejection probability for the rotor. The current study has utilized.information from the Westinghouse probabilistic reports in determining values of P(M/A) and P(M/B) which can be evaluated as a functionof.P(M/A). The values of P(M/A).can vary significantly from one turbine.to another depending on the type of LP rotor design. Therefore, rotor-specific. values of P(M/A) have been used in the analysis. If this information was.not available, data judged to be representative of the specific rotor design have been used. Section 8.0'of this report gives the detailed results.of the evaluation of P(1) for the various turbine valve test ' intervals. In the case of Indian Point 3, P(1) was also evaluated using additional:information on the probability of missile ejection at running speed. l -5.4 ' Assumptions (Basis for Analysis) The assumptions.below pertain to the basis for analysis. Assumptions on the development of fault trees are listed in Subsection 6.2, and other assumptions are stated in the text of the various report sections as needed. o A failure sequence consisting of a failure of a control valve and reheat stop/ interceptor valve combination along with a failed-open stop valve bypass valve has not been analyzed because the probability of failure of four dissimilar valves is assumed to be very small. 2 l 1 1 0298x:10/073087 5-9 1

o The failure sequence consisting of failure of a control valve and failure of a stop valve bypass _ valve was assumed to result in an intermediate overspeed eventLfor all'of the subgroup turbines =that have the bypass valv<s. o For turbines with reheat stop and interceptor valves, the design overspeed events are assumed to result in 120 percent overspeed even though it is likely that. the actual overspeed would be less. This gives additional conservatism to the analysis. i 0298x:10/073087 5-10 _w

TABLE 5.1 CLASSIFICATI0N'0F TURBINES BY VARIATION NUMBER ~ 1~ 2 3-4 5 6 Variation Turbine' -Description of Description of Control Trip . Number.. Type H P Valving L P Valving System System 1 BB-95,96 1-on-2 SV-CV 1-on-1 RS-IV 300 PSI 11 2 88-95,96 1-on-1 SV-CV 6-DV 300 PSI 1 Steam Dump 3 88-95,96 1-on-1 SV-CV 1-on-1 RS-IV AEH-DEH 2 88-296 4 88-95,96 1-on-2 SV-CV 1-on-1 RS-IV AEH-DEH 2 l 6 BB-95,96' 1-on-2 SV-CV 4-DV AEH-DEH 2 Steam Dump t 7 88-296 2TV-2GV 1-on-1 RS-IV AEH-DEH 2 Steam Chest 8 BB-296 2TV-2GV 1-on-1 Rs-IV AEH-DEH 3 Steam C. hest CLASSIFICATION OF TURBINES: Variation Station Number Turkey Point 3 & 4 1-Indian Point 2 2 Indian Point 3 2 ] 1 Diablo Canyon 1 & 2 3 1 Salem 1 & 2 3 Maine Yankee 3 i Palisades 3 ) Prairie Island 1 & 2 4 Kewaunee 4 Robinson 2 4 I -Point Beach 1 & 2 6 St. Lucie 1 & 2 7 Shearon Harris 8 0298x:1o/073087 5-11

I TABLE 5.2 IDENTIFICATION OF OVERSPEED EVENTS Success or Failure ^ Mode of Turbine Valves Event Outcome Event H P Valves L P Valves (Maximum Turbine Number CV/GV SV/TV IV RSV DV SVBV Speed Category) 1 S1 NA S1 NA NONE NA Well Below Design Overspeed 2 NA S1 NONE NONE S2 51 Design Overspeed 3 F1 S1 51 NA NONE S1 Design Overspeed 4 S1 NA F1 S1 NONE NA Design Overspeed 5 S1 S1 F1 F1 NONE S1-Intermediate Overspeed 6 F1 S1 S1 S1 NONE F4 Intermediate Overspeed 7 F1 51 NONE NONE NA F4 Intermediate Overspeed 8 S1 S1 NONE NONE F3 NA Intermediate Overspeed 9 F1 F2 NA NA NONE NA Destructive Overspeed 10 F1 F2 NONE NONE NA NA Destructive Overspeed Key to Success and Failure Modes: S1 = Closes or remains closed S2 = Opens or remains open F1 = Fails to close at onset of overspeed and remains open F2 = Fails to close at tripping speed and remains open F3 = Fails to open F4 = Inadvertently open or fails open NA = Success or failure has no effect on the outcome 0298x:10/073087 5-12

TABLE'5-3 BASIS FOR CALCULATION OF P(1) (RESULTING FROM TURBINE OVERSPEED) P(1) = P(A)'X'P(M/A) + P(B) X P(M/B) + P(C) Whsre: P(1) = annual probability of turbine missile ejection. P(A) = annual probability of. design overspeed P(B) = annual probability of in'termediate overspeed P(C) = annual probability of destructive overspeed P(M/A) = conditional probability of missile ejection at design overspeed P(M/B) = conditional probability of missile ejection at intermediate overspeed i l' 0298x:1D/o73087 5-13 4

i i 2 1s page has been intentional 1Y left blank. / 4 I e J e / l I 5-14

FIGURE 5-1 GENERAL ARRANGEMENT OF TURBINE VALVES . FOR VARIATION 2 (TURKEY-POINT UNITS 3 L 4) 6 W a w g E W ^ 9: W bg>W S W , - - *m g.,s.*, _. ll s__ 3 gi_ a-m i U /i V ! = d a 65 l lgE n4 4 WE i i w I 1 a u F i_ i u > s v i I 't l l u----- 7..--, I l

p. @ k,l 2-g _,;" O -j

[- "j u-e,,l 7-e > .a._. 1. _1_,_t. / Q t I 5-15 I o

,,7 v v ,y. 7 9;. jQ,., 3 y (% 7 3 .,; J 3 ".; i y p. + 3 ,.r. ~ n a.. o ,s . ;t y,,. I' l'p ' -S' 1 'i l l< %' f \\ yy t ,i l$s/* FIGURF>5-2 ) i GENERAL ARRANGEMENT' UF TURBINE VALVES FOR -VARIATION 2 g1 3,, t 33' (INDIAN POINT 'UNETS 2 & 3) ,t y .gj O p,J ~bs s c g o g 7 (- '{,, shg M.y t' ,W W ,r ( i: x s i t s Y ,t rh / u- ,e 3 ' g w >;: (~ l'~~ K R s y e a 3 m g 9

l..,, f, >,' b.__*

,gq l fly >d w i g g 4 t It

h__-

/ 1 A fj {<.,p l s ? }._ _ 5..._ _ _ E __j a !c WE

i.. xm/$\\

x wlu,g i 3- '1 i ,y' I ki 'l g g>g I NJ 1 i s f '" > g / I 1 ' y, >u >w w> a> > g a I U g ge j.__ g x s g g i A E, N l ' a l i r g l 1 - s I l. r 3 1 1 1 y la -Ra y-t*- l* d ( h.@. a..d. a., __@ c g I 1 4 ..s_ . _.g_ j @I, r--@lL_______.2 ___ ____.! r l . I_ a...Igy.b[_.l L M_g__L. a. b" b" N" ~* J ~ ~~ s' ~ ~ ~ ~ ~ L_g.! j Lgj 'a c 4 t.

\\

f \\, ] 5 5-16 1' e ,/ l ( }' t s e f j. $ ' g o 1 's L.... ^ ____-_a

l i l l \\ l FIGURE 5-3 l GENERAL ARRANGEMENT OF TURBINE VALVES j FOR VARIATION 3 { (DIABLD CANYDN UNITS 1 & 2 l SALEM UNITS 1 & 2) 1 y b a a \\ Q l Uw g 4 b>$;{: / "!w $d i >m G. -_ g N gd g.r I > llN__I__ V J g a _,l j >d @I g s l V I g l$llI"g5 I

/

g ___VGr._:__s ll , _s n.- . _,l

iid-D G

g l /ts V l y 1 1 I i l l G i l _ __ G.,__ _N "ll < _ l_ g r.

g. -_, _ _l l

V /IN V l l l

L_____,

,_____J l F-bl rhi I..a.I._ g _h 2 _ @ __l.a. !_ I a. __g_ f _@__ _ a. L_gJ !.gj t t 5-17 i Q =

FIGURE 5-4 GENERAL ARRANGEMENT OF TURBINE VALVES FOR VARIATION 3 (MAIN YANKEE AND PALISADES) 6 W e W w g ekW g i I>dWE ds yhkg b O !N O,__y,_,! = g g A g _s n r_*__ l x__, g. > >e- __ V l V /t \\ g Es A n l ~ w 8 W-g i i i E l I a UM _S.,__,__l__,*__g.-_y_q g g m m. y L U /i x V l l l l 1 u _ _ _ _ _ _, ,______a F-bl L_____ _____j Thi i_ 1_ e _6 2 _ e _ i ,. i. _q__,_ .3 e_7 i' 5_e__7. L_gJ Lgj 5_18

I l FIGURE 5-5 I GENERAL ARRANGEMENT ~ OF. TURBINE VALVES ) FOR VARIATION 4 1 (PRAIRIE ISLAND UNITS 1 & 2, j

KEVAUNEE, l

AND RDBINSON UNIT 2) W 5 a w g 5 I WI W y >da a.

• N h

F* W-r-* l U /ns V i l@.g>gS! E t; b l -h _se i w uw, i a V,_ _ , _/ E x _h _ _ ,*_ U,_ - _ _i I g i. g r_, y_.. l l l 1 I u_____7 ,______a 1._____ _____a

== == J_ a 1_l ll 1 F_ m. _L-L_ g _ l _g_J l l 5-19 l

g I $ZmM>r !>zQx@ nZg <>F(My 5 maM ls:$z h H W S'2 c$w eg )N EPD Y LL A R M E R T O A N E (H E E R V L_wmita_ / L N A O R E VI S .;I T D A M V \\ L E R E A T A V VA P LA E R E 1W PE S D. i V V MP r, me

• j X L UO E t,_

s I L A D R F I D O V R U 1 W N N R MO T A E T PAT S M I G NDEO O F E O TTM M U F i W L C SS D c M VR A e: \\ T V VVOS 'l I !. r E ,lJ i-tz W CSDM M S 1 /_ wmir S R R S. i Ii_ ti M M \\ 7! j'lt a_q:A),hI r" (ihW4 ] 1 iJ i L 8 i__ W11i-f ll al1 irt l l k \\ iA),hIi JihWE iL f Ia l

4 . 4 L FIGURE 5-7 GENERAL. ARRANGEMENT OF TURBINE VALVES FOR VARIATIONS. 7 & 8 (VARIATION 7 - ST, LUCIE VARIATION 8 - SHEARON HARRIS) 5 Wi gy-WW>W$ g >gI>gl r O N /- O __ ll x _ W ,.q,-- g g r. StS i V /a V l. l@8-ll!? l 4 l l s $53 e-=$5 i N A O ll _- g. -- p l y _s g,_. l x 3 j V /1 N V i l I u_____q _____a l g.____ __Q_% ll d_Q__7_1 g. li! 1 a.____J__ g _ l _ g __u____.g. I l l I i 5-21 i.

l S.0 FAULT TREE MODELS 6.1 Structure and Logic of Fault Trees The fault trees are reproduced in Appendix B for each of the turbine variations listed in Table 5.1 of Section 5.0. Overspeed fault' trees have evolved in a series of investigations (References 1, 2, 3 and 4) published from June 1970 to July 1984. The trees developed for the current study, including the.modeling of valves and controls, draw on this previous work and follow the basis for analysis in Section 5.0 of this report. The logic of the fault trees is discussed in the following three subsections. 6.1.1 Top Logic The top logic of the design, intermediate and destructive overspeed fault trees, involves two fundamental events. First, a generator system separation from the turbine must occur which unloads the turbine while operating with sufficient steam to allow its acceleration to the overspeed condition under study. The generator system separation event, indicated by the coding F40 or l D40 in the fault trees, appears immediately below the top event in each fault tree. The mean frequency of generator system separation was determined to be 0.5 per year with a variance of 0.14 (1.20 separations per year at the 95% l percentile of the lognormal distribution). This mean and variance was j obtained from NUREG/CR-3862 (Reference 7) as a mean for all PWR's and was used in all fault tree analysis of overspeed. In order to check the applicability of these values, a mean frequency of system separation was also determined for a smaller population of nuclear power plants having Westinghouse steam turbine ) generators. After screening outliers, a mean frequency of 0.39 and a variance j of 0.084 were determined for the Westinghouse plants. The higher mean f frequency of 0.5 per year and variance of 0.14 was used in the analysis. 1 l Second, given the system separation, a failure or series of failures of the turbine controls or valves must occur which results in a delay in isolation or j in failure to isolate the steam flow to the turbine. The turbine control system portion of the fault tree models the failure logic and the specific component failures that are necessary for a design, intermediate or 0296x:1o/073087 6-1

if I . e it . destructive overspeed event to_ occur, given a' generator system separation. This branch of the fault tree begins immediately below the. top. undesired eventz in each fault tree adjacent to the generator' system separation event. ~ l Consistent with the basis'for analysis, redundant overspeed protection and 3 trip systems (IEOPS, SCOTS, ROST, etc.) have not'been modeled in the fault trees in. order to assure a' bounding analysis for all plants. Similarly, other-protective devices such as the 20/AST-2 autostop dump' valve which is a part of the protection system at'some plants (e.g. Kewaunee) has not been included in. the fault: trees. ~ 6.1.2 ' Modeling of Valves, Controls, Protection and Trip Systems in Fault Trees Table 6.1 shows, 'by. variation, the control's, trips and valves modeled in specific fault' trees., Basic' faults that appear in the fault trees are discussed in Section 6.1.3. 6.1.2.1 Valves 'The turbine valve' arrangements are shown in Figures 5-1 through 5-7 of Section 5.0 and 'are summarized in Table 6.1 of this section. The upper levels of the fault trees are structured according to these arrangements and according to the' criteria of the overspeed condition being analyzed. Each turbine valve i i generally has two branches: one branch represents failures of the valve itself, and the other branch models the controls that operate the valve and automatically close the valve in event of.overspeed or system separation, j 300 PSI System for the control valves, the applicable controls are the main and auxiliary governors. The protection and trip systems include mechanical overspeed trip i and electrical loss of load trip which dump autostop and control oil. In addition, overspeed protection control applies to Variation 1. i For the stop valves, the protection includes the mechanical and electrical 3. overspeed trips. 0298x:1D/o73087 6-2

+ l i i 1 4 -Interceptor valves'have the same protection and trips as do the control valves. 1 Reheat stop valves have the same protection and trips as do the stop valves. AEH-DEH System For the control (governor) valves, the controls include the main speed j detector and the' individual servo valves. The protection and trip systems I include overspeed protection control, mechanical overspeed trip, and electrical trip which dump the emergency trip fluid and autostop oil. I For the stop (throttle) valves, the protection includes the mechanical and electrical overspeed trips and the 20/ET solenoid dump valve. I l Interceptor valves have the same protection and trips as do the control valves. Reheat stop valves have the same protection and trips as do the stop valves. l !6.1.2.2 Controls, Protection and Trip Systems The controls, protection and trip systems are modeled in accordance with their functions and descriptions as described in.Section 4.0. The following are modeled: 300 PSI system main governor auxiliary governor overspeed protection control ] 20/AST solenoid trip mechanical overspeed trip governing emergency trip valve I AEH-DEH system [ main speed detector overspeed protection control 20/AST solenoid trip special 20/AST solenoid trip system i mechanical overspeed trip 20/ET solenoid valve interface valve 1 0298m:1o/073087 6-3 1 1

o 'The applicability of each of these systems to the turbine variation is given in Table 6.1 1 6.1.3 Basic Faults Each basic event in the fault tree has an identifier code with three to eight characters or digits. The first character is an "F" indicating a 300 PSI turbine control system or a "D" indicating a AEH-DEH turbine control system. Next are two numbers which refer to the numbered basic events included in the tables of Section 7.0. The remaining characters or digits identify the particular event. 6.1.3.1 Basic and Undeveloped Faults There are two types of basic events in the fault trees: basic faults denoted by a circle symbol and undeveloped faults denoted by a diamond symbol. Basic faults involve elemental components such as check valves and drains for which failure data is generally available or documented in plant records. Undeveloped faults could be modeled into more elemental components. However, good basic service experience data was obtained for the undeveloped faults, and the availability of data for such integrated components ~as logic cards made it unnecessary to develop these events further. 6.1.3.2 Common Cause Failures Common cause failure of two or more turbine valves has been modeled in the fault trees in explicitly identified common mode faults and in miscellaneous common cause failure. Typical common mode faults of the turbino valves include: stop valves-- clogged autostop oil line (Zone 1, 4 or 5 as shown on Figures A-1 and A-2 in Appendix A), clogged emergency trip fluid line, or failure of the overspeed trip dump valve control valves--clogged governor control oil line (Zone 2), clogged emergency trip fluid line, or clogging of the servo valve drain line that L common to all control or governor valves 0298mlo/073087 6-4

l c.. interceptorvalves--cloggedcontroloilline(Zone 7orZone2), clogged emergency trip fluid line, or blocked primary drain line reheat stop valves--clogged autostop oil line (Zone 6), clogged emergency trip fluid line, or blocked primary drain line Miscellaneous common cause failures of two or more identical redundant components were also modeled in the fault trees. The calculation of failure probabilities of these common cause events is discussed in Section 7.0 of this report. A miscellaneous common cause block was included in the appropriate fault trees for the following events: two of four (or six) interceptor valves, 20/0PC solenoid valves, two of three air-operated steam dump valves, dump valve solenoid-operated valves, 20/ASTsolenoidvalves(variation 8) check valves between the OPC trip header and the auto stop l emergency trip header (variation 8). 6.1.3.4 Human Error Although there is no need for operator action to prevent turbine overspeed, one possible instance of human error could result in one or more steam dump 1 motor-operated valves being inadvertently closed, possibly due to maintenance procedures not properly carried out. This potential failure has been included in the fault tree model, and the probabil.ity of this human error is discussed j in Section 7.0, 6.1.3.5 Unavailability Due to Maintenance i Based on the assumption that one steam dump valve in Variation 2 could be in ) maintenance during normal power generation, this one maintenance outage was modeled in the fault tree. No other maintenance outages were assumed to be acceptacle during normal operation. The failure rate due to maintenance of steam dump valves is discussed in Section 7.0. c298x:1D/073087 6-5

[: L

m..

6.2; Summary of Assumptions Modeling of turbine valve faults is based, in part, on the following-1 assumptions:. ~ Complete (100%)i system separation is assumed as a. prerequisite for design, intermediate and destructive overspeed.. Failure of the stop valve trip pilot valve has not been included in the . fault tree based on the assumption that its failure will not prevent closure of the stop valve but may contribute to wear or damage. Fault trees identify sticking as one of the mechanisms that can prevent valve closure'. It is assumed that it is possible for turbine valves to fail due to sticking of the valve or sticking of the servomotor piston. Clogging of the drain line from the top of a turbine. valve cylinder has been assumed to prevent valve closure even though it is expected that the clogging might only result in a longer valve closing time. Mechanical damage has been indicated for the clapper-type stop valves only. The fault tree has been structured in such a way that mechanical damage of any clapper-type stop valve results in its failure to close. Mechanical damage faults are also possible'for plug or butterfly valves. However, these faults have been included with the faults related to " sticking'" of plug-stop, control, governor, reheat stop, and interceptor valves, based on the assumption that mechanical damage would cause these valve to' stick open. The. steam chest provides a flow path from either of two thrcttle valves to either of two governor valves, as shown in the applicable figures of general arrangement of turbine valves. In order for interceptor valves in Variation 1 to close, it was assumed that the main control oil pressure would have to be dumped by the 0298m:10/073087 6-C'

~ i q p 2 i b auxiliary governor,'OPC' system, or governing emergenc'y trip' valve. Credit I was not taken for the action of the governor which' regulates the control-oil pressure in'a range above atmospheric.- 'It is assumed that failure to dump enough steam going to the L.P. turbine l 1 following system separation and overspeed trip can cause the turbine to q accelerate to intermediate overspeed. Two steam dump configurations have been modeled: a four dump valve four motor-operated valve system, and a j two train system, each train having three dump valves'and three l motor-operated valves (six dump valves and six motor operated valves total). Insufficient steam is dumped if one.of.four steam dump valves or-one of four motor-operated valves fail.. Insufficient steam is dumped if i two or more steam dump valves or two or more motor-operated valves in' either of the two trains'of three valves fail. Inspection and maintenance of turbine valves is assumed to not occur i i during normal power generation except as may be provided for in the plant -] tdchnical specifications. It is recognized that one of two redundant solenoid dump valves, such as the 20/0PC valves may occasionally be unavailable due to maintenance. I Test runs indicated that the probability of turbine overspeed was unaffected if.one valve was unavailable due to maintenance. Based on these test runs, the maintenance of one of two or one of four redundant I solenoid.. dump valves is assumed to have a negligible effect on the l probability of overspeed. 1 0298x:1o/073087 6-7

a I f i TABLE 6.1 s, 4 NUMBER OF TURBINE VALVES, AND CONTROL'AND TRIP DEVICES BY VARIATION' \\' QUANTITY'0F TURBINE VALVES BY l VARIATION NUMBER VARIATION NO.: 1 2 3 4 6 7 8 TURBINE VALVE: CONTROL / GOVERNOR VALVE 4 4 4 4 4 4 4 l STOP/ THROTTLE VALVE 2 4 4 2 2 4 4 STOP VALVE BYPASS VALVE' 2 4 4 2 2 INTERCEPTOR VALVE 4 6/4 4 4 4 REHEAT STOP VALVE 4 6/4 4 4 4 STEAM DUMP VALVE 6 4 CONTROL AND TRIP DEVICE: MAIN GOVERNOR CONTROL X X AUXILIARY GOVERNOR CONTROL X X MAIN SPEED DETECTOR CONTROL X X X X X OVERSPEED PROTECTION CONTROL TRIP X X X X X X 20/AST SOLENOID TRIP X X X X X X 20/AST SOLEN 0ID VALVE TRIP SYSTEM X MECHANICAL OVERSPEED TRIP X X X X X X X GOVERNING EMERGENCY TRIP VALVE X X 20/ET SOLEN 0ID VALVE TRIP X X X X INTERFACE VALVE X X X X X Note: An X in the table above indicates that the variation includes the protective control or trip device.. 0298x:10/073087 6-B

q l l ) 7;0 FAILURE DATA AND ANALYSIS OF BASIC FAILURE PRO 8 ABILITY ~ 7.I' Sources of Failure Data and Nethod of Analysis i The primary source of basic failure data in_this study was from the operating l L experience of Westinghouse steam-turbines. Westinghouse has maintained service and malfunction' records of the turbine components for many years. This basic. service experience was first used in the 1974 Westinghouse report on turbine missile generation (Reference 2). An updated file of basic event service experience was developed and used in two Westinghouse reports: a 1982 report on'the effects of turbine valve testing at the Farley plant (Reference 3), and a 1984 report on the probability of a Westinghouse turbine reaching destructive overspeed (Reference 4). J Overall,-the Westinghouse data base has been enhanced by the inclusion of a- -large number of service years from both nuclear and fossil units. The inclusion of fossil experience for the throttle and governor valve faults was found to be valid in the Farley study -(Reference 3). The data has also been enhanced by.two surveys of owners of Westinghouse nuclear turbines. The first study was conducted in 1982 and the most recent survey was completed in March of 1987. A total of 31 nuclear units replied in 1987 to the detailed-Westinghouse questionnaire which requested information on valve testing, surveillance, maintenance, and reported modes of failure. The results of this survey have been used in the updating of the service experience data for the ) current study. The-basic service experience data for the current study, number of component malfunctions and years of service, is given in Tables 7.1 and 7.2. The compilation of component malfunctions has generally been done in a conservative manner. For example, some reported valve malfunctions might not necessarily have prevented the valve from closing, but were added to one of the totals if any doubt existed. In addition, two sets of malfunction values 0298x:1o/073087 7-1

l l were listed for some components with a high value assigned as a maximum or 1i upper bound and a lower value assigned as a best estimate. These data ranges were then conservatively interpolated on the high side to r'esult in a single conservative value of the number of malfunctions. l ,i Generic failure data from the nuclear industry was used for a few of the basic -faults in Tables 7.1 and 7.2. The decision to use generic data involved a-consideration of the number of component years of service. In a-few cases j this service experience was judged to be too short or insufficient with respect to knowledge about the component malfunction during those years. Subsection 7.4 discusses component failure probabilities that were evaluated i using generic data. This subsection also includes discussion of the calculation of common cause failure, maintenance unavailability, and human error. Additional information on the basic fault tree representation of common cause, maintenance, and human error can be found in Subsection 6.1. Before converting the malfunction values to fault tree quantification data, it was necessary to determine which data would be treated as demand faults versus those to be treated as time-related faults. In general, the basic for this categorization was whether a particular component operated intermittently or continuously. The transformation of the basic service experience data into the failure rates and probabilities suitable for fault tree analysis involved the following steps: 1. Median failure rates or failure probabilities and 95% upper confidence bound failure probabilities were computed for each basic component using the tabulated basic service experience data or generic data. 1 2. The median and upper 95 percent failure rates or failure probabilities were converted to statistical means and variances based on a lognormal probability model for component failures. The means and variances were used in the fault tree analysis. 1 l 0298x to/073087 7-2 l

h f. l' 7.2 Treatment of Component Failures as Demand Faults I. Demand failures are generally associated with components that oper' ate intermittently or repetitively; typical examples are the overspeed trip valve l or the auxiliary governor. The probability of failure of a demand component is-simply the probability that the component fails to function as required given a demand. These failure probabilities were calculated from data on component years of service, the number of malfunctions or failures observed, I and the number of demands on the component per year. Demand failure probabilities were initially calculated for the median, or 50th percentile of the probability distribution, and for the 95th percontile.. The method followed was the same as in previous studies (References 2, 3, and 4). The formula for calculating demand failure probability arises from the.use'of the Poisson distribution as a probability model for the distribution of r. The following formulas were used to evaluate demand failure probabilities: 2 X (.5, D ) 1 P (.5)=

50th Percentile 2 MT 2X (.05, 0 )

1 P (.95) =

95th Percentile z MT Di=2r+2

Degrees of Freedom

'l Where P Demand failure probability = T Number of years of service = M Number of demands per year = Number of observed failures r = 2 X (C, D ) Chi-squared function = 1 The mean annual number of demands (M) was estimated for each demand component since it is difficult to obtain these numbers from actual plant records. Estimation was done in previous studies with reasonable accuracy. This estimation.was based on an understanding of the operation of the component and 1 l the number of times per year that it was tested. For a given number of actual 1 0298x:10/073087 7-3

malfunctionsLin the raw failure data, increasing the number of estimated demands willicause a ~ decrease in the magnitude of the failure probability per demand. With this in mind, the mean number of demands on several components - was-deliberately underestimated, resulting in additional conservatism. The calculated demand failure probabilities for the 300 psi and AEH-DEH . control systems are given in Tables 7.3 and 7.4, respectively. 7.3 Treatment of Component Failures as Time-related Faults ' Time-related failures'are generally associated with components that are in continuous operation or operate in a standby mode to provide a specific safety. response when challenged. The failure probability of a time related, or . failure-rate component, is the proportion of time that the component is in a failed state. This proportion of time is also called the " unavailability" i of a component'and is evaluated with the following formula: X = '.5 A. t Where K = Unavailability or probability of failure Failure rate in failures per hour A = Time interval.between tests in hours t = The occurrence of component failures in time is assumed to be random; therefore,.it is modeled by a uniform, or constant failure rate A. This assumption of a constant A is generally accepted for complex components that fail infrequently. Furthermore, periodic inspection, maintenance, and parts replacement tend to mitigate the effect of age on the failure rate of a component during its design or useful life. Since the occurrence of component failures is constant, the average or expected downtime of the component is-one-half of the time interval, thus the coefficient of 0.5 in the unavailability formula. 1 0298x:1o/073087 7-4

t. l f tFailure rates were' evaluated for each time-related component using the following formulas: 2X (.5, 0 ) 1 l' (.5) =

50th Percentile.

2T 2X(.05,'D) 1 X (.95) =

95th Percentile 2T

_ Where f = Failure rate [hr.1] r = Number of. observed failures T' = Number of hours of operation 2. X (C, D ) '=. Chi-squared function f 1 D'= Degrees of-freedom y i The number of operating hours of each component was calculated from the calendar years of service of each component type. Based on operating data for the plants in the subgroup, tho' average percent of actual. time that turbines operated was approximately 74 percent', resulting in 6487 operating hours per calendar year.: 1 Turbine valves and associated components comprise the set of time-related failures _whose average unavailability or failure probability was directly proportional to the mean time intervals of 1 month, 3 months, 6 months, and 1 year between tests. ) { ] Certain time-related failures were conservatively assumed to have a fixed j annual test interval or mission time. For additional conservatism, it was I assumed that there were no' outages during the year in the calculation of l . component unavailabilities. In many cases, the assumption of an annual test l . interval is very conservative since the successful function of many components is demonstrated or verifiable during normal operation. For example, ' degradation'of the governor speed changer can be detected by the occurrence of any unacceptable speed or frequency deviations. 3 l l 0298x:10/0730a7 7-5

l ~ i The following is a list of basic failures.whose unavailability was based on a-l one year time interval: i o Stop valve bypass valve fails open o-Stop valve mechanical damage inhibits closing i o ' Governor speed changer or check valve failure o Auxiliary governor failure o LP steam dump motor-operated shutoff valve fails closed o OCB signal to dump valve fails o Secondary drain line for OPC, autostop, and ETF fluid is blocked 'o 63/AST pressure switch (actuates 20/ET) fails i o-Autostop' oil line is clogged f Dump valve (control, interceptor, and reheat stop valves) faiis to open o o OPC speed detection (speed pick-up 2) fails j o Check valve on drain line from dump valve (stop, control, interceptor, I and reheat stop valves) fails.to open o. Failure of logic card o Emergency trip fluid line (SV/RS or CV/IV line) is clogged i The stop valve failures have been included in the list because a test might-not detect a failed condition. With regard to mechanical damage, clapper damage and failure of the valve to seal off the flow would not be detected because the associated control valve is closed during the stop valve test. With regard to the bypass valve, not all of the components of the subsystem are exercised during a'stop valve test. The steam-dump motor-operated valves l have been included in the list based on.the' assumption that they are not tested periodically during normal operation. I The successful function of some continuously-operating components is verified by normal turbine operation. For example, the operation of-governors and speed sensing devices would be verified by a normal turbine response to routine changes in load, and degradation of these components would likely result in a trip or in an off-normal condition that would receive attention frc.m the operators. In reality, these compononts would only need to operate successfully during the actual overspeed mission. However, in this study 0298x:1o/073087 7-6

l their unavailability was' based on a conservative time interval or mission time of two months. The following component failures used two months as the basis for their unavailability: o Governor impeller system fails o Blocked drain in control block o Governor control oil line blocked o Main speed detector (speed pick-up 1) failure o Primary drain line to EH reservoir is blocked a Servo valve drain line is clogged o Extension shaft failure The calculated failure rate and unavailabilities for the 300 psi and AEH-DEH control systems are given in Tables 7.5 and 7.6, respectively. 7.4 Determination of Failure Probabilities of Special Faults This section discusses special failures that were evaluated from generic data sources and/or according to accepted industry methods. These faults include a j few random failures, common cause, human error, and maintenance I unavailabilities. Tables 7.7 and 7.8 give the calculated failure probabilities. The probabilities of the primary drain and common servo valve drain line being blocked or clogged (EH system Faults 10 and 30, respectively) were evaluated using a range of probability values (3.0E-11 to 3.0E-08) obtained from l Reference 10. A 95% probability of 1.0E-09 and error factor (EF) of 4.32 l were determined to be representative of the fault. The mean failure rate and variance were calculated to be 3.44E-10 and 1.43E-19, respectively. In general, the clogging of a primary drain line for electro-hydraulic fluid is believed to be a very rare event. l l 0298m10/073087 7-7 ( __________________________u

The calculation of the probability of total blockage in the secondary drain line for the OPC, autostop,.and emergency trip fluid (EH system Fault 7) was also evaluated using information from Reference 10. A mean failure rate of 5.16E-09, and variance of 3.22E-17 was determined to be applicable to this fault based on the fact that the lack of any appreciable flow in the line ~ could result in a higher failure rate than for lines that have continuous flow. The median failure rate of the OCB' signal to the steam dump valve (Fault 39) was 0.1 failures in 1.0E+06 hours (Reference 9). Assuming an error factor of 2.5, the lognormal mean failure rate was calculated to be 1.17E-07 with a variance of 4.96E-15. The median probability of the motor-operated dump system shut-off valve failing closed (Fault 34) was estimated to be 3.0E-07 with an error factor of 3, based on information from Reference 10. The resultant hourly mean failure rate and variance were 3.75E-07 and 7.90E-14, respectively. The probability of the dump system shutoff valve being closed due to operator error (Fault 35) was modeled as failure to restore after inspection or maintenance. The following equation was used to calculate the median human error probability (HEP): HEP = 0, X Or Where: 0, = Action phase HEP (failure to restore the valve to the correct position) O = Recovery factor (failure to detect deviant condition during a r walk-around) For the failure probability of the action phase, an HEP of 1.0E-03 and an error factor of 3 (Reference 11) were determined to be applicable. A recovery factor of 0.2 was assumed. The resultant mean failure probability was determined to be 2.50E-04 with a variance of 8.78E-07. 0298x:lD/073087 7-8

The calculation for the probability of.the low pressure dump valve being ) unavailable due to maintenance (300 psi system Fault 42) was based on the assumption of 4 hours and 12 hours for the average and maximum amount of time' per year that a valve would be in maintenance. Using an average 6487 operating hours per. year, the resultant mean unavailability was determined to be 7.71E-04 with a variance of 3.40E-07. The probability of the stop valve bypass. valve being inadvertently open (300 PSI system Fault 21, AEH-DEH sv-dem Fault 33).was evaluated as the sum.of two basic failure modes: the air pilot valve fails to close (sticks open), and the stop valve bypass valve itself fails to close (sticks open), both of which could occur after the turbine is latched. Using,information from References 8 and 10, the resultant total meari failure rate for an inadvertently open bypass valve was determined to be 2.08E-07 with a variance of 1.57E-14. Miscellaneous common cause failures were included in the fault trees wherever the failure logic required the random failure of two or more identical components.. Common cause failure probabilities (Occ) were determined using the following Beta factor equation: O =OXSXN ce r Where: Total random failure probability of one component 0 = 7 Beta factor { B = Number of combinations of failures (e.g. N=6 for combinations of N = 2 out of four) i 0298x:1o/073087 7-9 ---__---__--_-j

l Additional information on the calculation of common cause failure probabilities is given in Table 7.8 for the following components: FAULT CONTROL NUMBER-SYSTEM DESCRIPTION OF COMMON CAUSE FAULT 43 AEH-DEH Two 20/AST solenoid valves fail to open '44 300 PSI Two OPC solenoid valves fail to open AEH-DEH 45 300 PSI, Two or more steam dump air-operated valves fail 1 to open I 46 300 PSI Two or more interceptor valves fail to open j 46 AEH-DEH Two OPC check valves fail to open l 48 AEH-DEH Two or more steam dump solenoid valves fail to open 49,50 AEH-DEH Two or more interceptor valves fail to close l l I o nw.io/osias7 7-10

c,a. SN FO OI T RC EN SUF Bl L NAM T - NFE S EOC E N V R OSI U PRR L MAE I OES A CY F D ill E ) T E1 A R( L U E LE 321lll 3 2 2 3 2l R IP DDDDTTTTTTD1DDTDDDD-T TD TiDD AY E FT M) m I Te t Mys AS d ) e 1 Dl d 2 s No e o 7 A r gd e n l Mt ge t e c E E n os n o p L Do e dl o s e N o s B .C t ecl l p d k A R a g c i o e eo c T OI rds dgs a e gt i FS eel eois f o s g t dd P psl gl k t ( os s ee E ooa gc) c nd ll kk C0 lf o 3i i es d cl e cc N0 oc l s t asl e a v oo E3 t e cies rol s sf ldll I( sv e n tl a o i aebb R S skl eser s) oe cf l e vg E T l carl run i2zv n c k v gss P L li vul ul e (l osl cl k oii X U at l ali p ) e a iki t oa .cl E A fsrifi ao 1 nevet co o l v ec)) ( ea af n on rai s n b h 45 E m e gf mf s e e zi p u u tll k cs C C svn e mk pn(lil t sai e l c iee I I il unt recnoo - ric na v oe r nn V S nali seti e zelt a a e gf l rh eeoo R A avpaygst ps( ni f .vi a t c gnzz E B h rsnysok ioy rl sn v n ni(( S cprt as cel croa or a1 i F eco rh nsin l no vVa s co h .ee C O mc necyoktil aenn Sr s n cnnn I dol at csl ongrod t a mr iii S N p piil d l si r g r eii n p oe dall A O iiot eeeit epti evt oin y rv er B I rrnaperpsvinsmocn o b fo edll T tt euap l ro egeeei g p ii P l tt srreat ce tl vt e e sroo I ddoc oovv vgyeol c v ny o R eesarrttl prl nrdsae l i r rt pp C ee ooooal ooaia vt a l a oooo S ppTT nnssvot nvniCC e v i nstt E ssSSrroo rsr rlPPkd nl ross D r r A A e e v v pt oepei00c .p ..ii.evoo ee//vvrront v o v x / / e C A. to A. A. a x A. o e u u vrtt vv00ooeet ouot ou00hP ru OO22GGSSSCAGSGA22CONSNNDANGSAA R TE N EW VU 123456789012345678901234567890 EN 111111111122222222223 ~ f YO

c, a S l e N a h FO n t. OI oa T i t RC t na n EN roh i U o t BMF pd d UL oet e NA rsc s N paa s bf u y c T l se s NFE tih i S EOC c t d E N V ey R OSI rt n s U PRR ii o a L NAE dl I OES id + sb e t A CY F ias l ba u D yob a E ) t r f T E1 i ps A R( l i s L U i e i E LE 212 2 33 bry h 3 2 R I P 0TTTDDDTDTT aut t 1 1 AY bli E FT oil. r N) r ai s o o o I m pf b h f N N Te at t ) e ,b n d t t ) Ds 2 ) r2oo e l l N y s 3) uTrm s u u t AS e l 4 l p u a a n t l e ir 2 f f o Dl o na t eg aoe s C No g N ef ot n fFry a s s ( A r n p N oi ur w a a Mt i nenop) Ns l e E n seee m2e n 1 .iv y e e 1 Do opspou eee Tsae r m m 7 C l o( o td e s e s s tf t a a R nc t( s t rs e s s s E OI e kdosmo (d l oe , c u L FS pscetl aNd e u Ft3 n d e e B P ot us i e ede a T o n h h A E it osat ek ep f e i t t T C0 o b sllf s e c k s .vrt N0 ti cl soc s sl os r e e E3 he aeo(l og u e aF a a b b I( snvmf vt bl n o rv e e R S lil e l s bi n u l o o .l E T i at eall s l a l e c t t P L a e v s v v a ii s b l inrt u X U f g yl na ia l ai a a n d d E A a p s a d gf ) s e fbe e e F emo vii 6)i c r yd e m m E vat p osp 7d s du e h u u C C ldsm pn me i et eg t s s I I a u m eh u n e, m t nn s s V S vl t d ul cd o n s anoe r a a R A aa dot zol r l e l o E B pcem si m( zi e eefl f s s S mih am wa ( a h drwoa a a F uneeamsee f t nt h a w w C O dart ee t ne o aeel c t I h stt e si n t m mb a a e e S N pcr ssr lif r ei ve d c c A O i eon yuo l a o dt erb n n B I rm i dsstl h f me e. e e T t r e s il s neitl r4 i i P eoet pel oi 4 ort nl u r r I dvt vamra on a ii l7 e e R el pl rupnp o 7 e n w i p p C eaeaed goli r3ae an x x S pvcvp Tit os n uTemt f o e e E s r.omSssrn o l , min i D rpe - aA ot e i i t e ct e e e o t O. i t 3 C u o x re/8t nt t a2 e n i c c c vt n c FThdo re i i OSINAS60 ACE e ,t ep es v v s = x m nb r r b 1 oi o eu e e - R u DTtf c GS S S TE S s NI e EM e t ) ) ) ) VU 12346789137 e o 1 2 3 4 EN 33333333444 S N ( ( ( ( gf RS 3" y,U l l

s c, S a N FO OIT RC EN SU F 2 L lMAM T NFE S EOC E N V R 0SI U

1. RR L

AE l I oES A CY ~ F li D E ) ~ 2 T E1 T 3 A R( T. L U E LE 3 2 23122l11111 2 1 22 R IP DDDDTDTDTTTTTiTTTTT DDTDDT - TTDT AY E) FT I m Te ) t 2 es n y e e lAS t n p o i do 2 Dl N a e No s d r go 7 A r ) l e e d-n gt Mt 2 l de gn e o E En a) es ge o p l s L Do e e f2s( op t o cl B C t t o l o l A R a o ) eld c r s sa T OH r d :: s N Tt ce s e e k if FE eel r E o k sk nd n r c n D psl o e /Nsc icen e u i seeo E - ooa l e 0 ko i pi p l t n n pl CH lf l s 2 e cl rt ol o i s ii oc NE oc a ( eib es y - na ll EA t e f sst d sc oof e o I( sv d e( sV n)k ti v nnti R - S skl e) e t T i ect t) l ii E T l car 1 nk ad)/ l pi c e sc2 ea aase P L ii vu e c e u e e V d y yt ern l e rv rrl n X U at l pportk vS 2 ct snue l t peu ddli E A f sriuol uccl nl p aeurl p a F eak bl a o a r gf g) oio fdk ui o eef E m e gf co i(l voooeeca cl at vv C C svn i t sa b l l p f s ediif s ll e* I I il unP ifh eVcppyo k nap a aavs V S nali( s csnG o(tt yc io(f et vvl r R A avpa l eetii/ st ri ll va a e' ett nnl e ppv E B h rrinvi bVi hvwuu S cprt oail werC rl sFf oiah mm F euo tfl asnu e gl T oiave uudv C O mc nc v it o n u e pl cr E t r r ddil doeen el t1 ovairo sctd I S N ppiit vidr n 1 r l ain nse ir r n r A O iiot el aiunoe hpcf cr oot noo ooe B I rrnaderosi( nit o( e l eon l T tt eu vdnsa il t eav e dier eeov P l td eerel oesevvo vn tl o vvsr d d o c e e yl rdv n/vil g I idaot ll l R eesaecrop l d pi e l sa/ a eusp aa2s C ee paas y a i oll avvl veet e vv-S ppTT sfd T rvut t v o rpcCc T E ssSS rnTS a l snt oor D r r A A n e o E A m pf o i pR v v t kusaP r okS o cl 0e. vcAm ee//it c//im t arorrn e i C C / t A. r e / vv00ane03 rut urht eeo h APP 0n eh0o OO22 MIS 26PDEADTSSSCCFOO2I NSC2C R TE NB EM VU 123456789012345678901234567890 EN 111111111122222222223 _ g33" y4w fV

c, S a l e tN a h F( n t .l l OI oa 1 T i t RC t na n "P. EI roh i N BI o t IF "V A pd d L oet e R A rsc I M 1 paa s bf u y c T l se s NFE tih i S EOC c t d E N V ey R OSI rt n s U WAE RR ii o a L dl I OES id A CY F sbe t i as l ba u b yob a d ) t r f E1 i ps d R( l i s U ie i LE l22 2 23 bry h 0 K IP DiTTDDDTDTT aut t 2 AY bli E) FT oil. r r ai s o o m pfbh f N I Te at t ) ) e ,b n d t Bs 2 3 r2oo e l ) y s u1 rm s u f t AS _- e l e l p u a n )t l t ir 2 f o Dl 2o na o aoe s C No N ef N 'g g fFry a s ( A r e p nn ur w a L t t enop) eii .l e 2 On oee m2 ess 1 i v y e Do Nspou son s Taae r m 7 C k ( otde(l e t mtf t a R ce t cs l a e s s s'.c u E OH uedosmos u L FE t setl aNk sd a Ft3n d e B D s( s l e ct e f To n h A E-osat eiie e i t T CH ndllf setbp s . vrt NE oscl ssis u sl es r e EA t s aeo( h o eafs a b I( ssef vt sng e rv s e R S ii s l srin n u i l o E T pct sall e i a l e. c t P L tvvaldel l i nrt u X U )t yl n a a gb l aiaa n d E A r o s a d gf eaa e fbe e vii hms c o n ;p d:ryd e m F E osp ai s e h u t C C aempn mFdd i et eJ t s n ~. u v u m eh uT m t s I I V S dtldul cdEl, anoe r a R A rca dot as r l e l o c nk aa simncl e eefl f s E B am waeil h drwoa a S e eamseena t nt h a w F C O cvst ee t waf o aeel c t I i rastt esth mmba a e S N gep ssr ect r ei ve d c A O osyn yuobef o dt erb n l(bidsst ma f me e B I e T e s e s neitl r4 i P f reet pel ve 4 ort nl u r oovvamral vn a ii l7 e I R tll rupnal o 7 e n w i p C eoaaed gvai r3ae an, m S rsvvp Ti vs n uTemt f o e E uo omSsk n o l ,miw l i . - aA cpe D l vp t et e i i r o D. i t 3 0 h tr e/8 e o t t a2e c c i aet F1hd s c re i ,t e es v s' b 1 FSSMAS60CSE e n nb r s = oi-eu e D1tf e GS S R u ' TK S s N e 'E E e t ) ) ) R V 12346789171 e o 1 2 3 R EI 33333333445 S N ( ( ( ,E gl* y.%

l v 1 .d. i ,{i. t f' ,j. 1 t ,( $ ' '.g i . j, TABLE '.3, i. s ib FAILURE PR08A81LITIt.5 W CEi4AND FAlitTS i w 1 300PSIControl0]a.'d. P (PERDENWS) 3 System sj'. ). G' j 4i ,. jivent { T,',. /Mf P (.5C)_ P (.95) P $4ead. 2e fVariince) '( ! T )' I D . A I. 3,.

!31 1

3 Len,e i 'h 2 a 4 / i-3 4 f/b. 4 11 f1 a 13 a '- .t 1 ,1 14 l !/ i i !.{ 16 e '/ / 1 3, 'i, i 17 T 6-18' t 19 /' s( 25 { t 3 3 29 ( 30 ) o a. 31 ,')- / 35 4 ") 36 y n/ 3 37 h'../ 4 38 .41 See Subsection 7.4 for failure probabilities of.other miscellaneous faults. >1 l + j J n J' 4 y r ossov:iotoross7 7-15 .t9,, y, :\\ ' ] I

p I.' ,. f ! Vf, .r I i 1 TA8LE 7.4 i FAILURE PROBABILITIES OF DEMAND FAULTS (PERDEMAND) AEH-DEH Control Oil Systes Event. 2 (Variance) No.,, P (.50) P (.95) P (Mean) c 1 ,, e 2 3 4 6 8 20 21 23 24 29 35 36 37 ) I 38 1 41 i See Subsection 7.4 for failure probabilities of other miscellaneous faults. l 1 3 0480v:10/070ss7 7-16 1

)\\I1 l!! c, a I e I c I n A a i d Y r e T a t I V o L n I B s A s ) L e 3 I l A n 7 V n u A a n N e n o U M o i i t t c a e r s e b p u ) o S e ( c s S n u s E a o h I i u t T r n n I m a i o L e V t m I t ( n B s o o A y 2 c w L S o t I f A l o f V i 5 A O o ) N s e 7 U l E r m o C u i E Mt N o t r A ) L h B A n I n n A o R a 6 o T S C A e 6 i E V N 7 s T I ( 8 s A S E1 ( i R P m A r E 0 a a R 0 ] e U 3 I y n L o I R e A H n d F [ o e ) s 1 5 r a 9 o b E f T ( s A s i R 1 i y E y t R t i U i l L l i I i b A b a F ) a l 0 l 5 .i i a a e v ( v s a a i n 1 n w u u re s e h i h t h T oT ) ) t 1 2 n. ( ( e o v N 0 2 5 1 4 7 8 2 3 4 9 3 7 e E 5 6 7 8 9 1 1 1 2 2 2 2 3 3 3 3 4 4 to N IE y

c, a I e I c I n Aa i d Yr e Ta t IV o L n I B s A s ) L e 3 I l A n 7 V n u Aa n Ne n o UM o i i t t c a e r s e b p u ) o S e ( c s S n u s E a o h I i u t T r n n m a I i o L e V t m I t ( n B s o o A y 2 c w L S a t I f A l o f V i o 6 A O ) N s e 7 U l E r m o C u i E D r N o t L N t A) h B A n I n n A o R a 0 o T S C A e 6 i E VM T H ( 6 s 8 s A E D ( i R D N1 m A r E H a a R E ] e U A I y n L o I R e A H n d F [ o e ) s 15 r a 9 o b E f T( s A s i R1 i y E y t R t i U i l L ~ l i I i b A b a F) a l 05 .i l i a aev ( vsa ain 1 nwu ures ehi hth T oT ) ) t 1 2 n. ( ( eo vN 01234567892567801234971 e E 57911111111112222233333345 to N 2 si 7i l

ECN 0 0 E 1, 1, R 0 0 0 9 0 1 E 1 1 1 1 1 8 8 F E R E 9 9 7 5 4 4 4 C 1 1 1 1 1 1 1 N 7 A E E E E E E E I 3 3 2 0 E 7 7 4 4 2 9 7 5 5 R S A E V 1 1 3 4 7 8 1 1 I T I d L n I a B r r m A h h r r r e r r B / / h h h d h h O 0 0 / / / / / / R N 1 1 9 7 7 4 7 7 P A E E E E E E E E E T M 4 4 6 7 5 0 8 8 N A 4 4 1 1 7 5 0 0 E T N A 3 3 5 1 3 2 2 2 O D P 7 M F O O L 7 C I) S OS E C E ( L I C LM H H H iH iH iH H i B S R OE E E E sE sE sE E s A A U RT D D D pD pD pD D p T B O TS S NY H H H 0H 0H 0H H 0 F OS E E E 0E 0E 0E E 0 O D C A A A 3A 3A 3A A 3 N S A I S d f Y e f L k o d A c y p t e N o l m u s A l e l u h o s s b n a d s l l l L i t c i i A y l o o m a a I l t t e e f f C l n t v E a i s l s l e e P t a i a y a v v S o r n s vr l l t d e g o a a N n i p f r v v O e e i s md f r I n v l ue oe s s T i l d ds t s s P l a n a o ur a a I v i o dl h o p p R n a l ec st y y C i o r t a b b S a v d f s as mr E r r ol rl ee e e D d e y i ei t p v v s r sa pa so l l y d ad sf of y a a r ne de o so v v a og nk l e re t m mg oc v ov p pn pn i mo co Bl tl me oe oe r ol el C a oa uu t p t p P C c Sb Ov Mv Dd S o So R TE LB UM AU 0 0 7 9 4 5 3 1 FN 1 3 3 3 3 3 2 9*

5. j y

IlL

) ) I 3 3 I 7 5 4 ( 544 7 5 ) 554 I 544 I 5 - - - 5-f c E E E - EEE E E ( EEE - EEE o c 5 4 0 E025 0 6 5153 E262 Q 7 8 8 6124 3 4 - 801 2523 e 7 3 3 3.512 0.925 E u 8 1 1392 l 1 2 3 av 1 s i ) ) h 3 3 T I 5 4 3 I 443 5 4 ) 443 ( 443 I 4 - - - 4 - - - I E E E - EEE E E I EEE - EEE R 5 7 3 E006 6 2 4342 E342 s 5 6 5 3483 6 9 - 254 1254 e 1.361 0.471 E r S 1 7 2 1 2 1471 u N 1 0 2 - l O i I 2 a T f AU e C d L o A I ) ) ) m C I 2 2 2 I 5 5 5 ( 5 5 ( ( n E E 0 0 0 3 0 0 2 2 o R 0 0 0 m U m L o. I ce A s F su s ua D e oc 8 N l e A I b nn 7 M I a ao E I 1 1 3 6 1 1 6 5 i l m E D N 1 r l m L a eo B E v cc A S s T U e if A s mo C e h dt N ) t nn O n ae M i ) f n S a e o t o O FT r v i p C ON T l n cm E a o i o F RN r V i l c O EO e t p BP P r p x s Y MM 2 2 4 2 e 4 6 i eu R UO 3 P r o A NC ( ( c ee M s vn 6 2 e aa U d hl S l a se ec r vs o li f am v 9 e L - H IH I I H H H H rh ON E SE S S E E E E 7 ot RE D PD P P D D D D t TT e pr NS H 0H 0 0 H H H H g eo OY E 0E 0 0 E E E E a cf CS A 3A 3 3 A A A A P r es e ti e n S I A 1 2 R TE S LB E UM 3 4 5 6 6 8 9 0 T AU 4 4 4 4 4 4 4 5 O FN N 3 E g=: M" [O

n. j il 8.0 RESULTS 1 .J ~ This section presents the results of the probabilistic analysis of turbine 'overspeed and missile ejection. The.end results of this study are j plant-specific curves.(Figures 8.3-1 through 8.3-22) that relate the probability of. turbine missile ejection to the test interval of turbine valves. 8.1 ' Probability of Turbine Overspeed and Dominant Faults -Probabilities of design, intermediate, and destructive overspeed are listed in Table'8.1-1 by turbine variation. The table gives mean or "best estimate" values as well as values at.the upper.95th percentile of the frequency curve. These probabilities are also plotted Figures 8.1-1 through 8.1-12 as a function of the turbine valve = test interval. The effect of varying the turbine valve test interval is shown by the upward slope of the curves. Design overspeed is least affected by an extension of the turbine valve test interval: the probability doubles (approximately) as the turbine valve test intervai is increased from 1 month to 12 months. The turbine valve test interval.has a'more pronounced effect of the probabilities of intermediate and destructive overspeed. These probabilities increase by approximately 10 to 20 times as-the turbine valve test interval is increased from 1 to 12 months. In general, the overspeed probabilities are similar to those reported in previous studies (References 3 and 4). In some cases the probabilities are lower than the previous studies due to the use of more realistic fault tree models, more accurate accounting of protective controls, and a more realistic , frequency.for the number of system separations per year. The calculated -8 probabilities of destructive overspeed'are on the order of 5 X 10 to 1 X 10.-6. The probabilities did not vary much with turbine variation or with 'the type of control system. This was expected because of the similarity of valves and trip systems, and it would appear that all turbines are adequately protected against destructive overspeed. -4 The probabilities of. design overspeed are on the order of 3 X 10 to 1 X '10-3 for plants with reheat,stop and interceptor valves. Design overspeed has a mean frequency of 0.5 for plants without reheat stop and interceptor 0298x:1o/o73087 8-1 .1 r.. l

1-

q ;

valves. ' Intermediate overspeed probabilities'have a large variation in range-

s..

/from approximately liX.10 to 3 X 10 Variations 2 and 6 have the d -7 ~3 highest probability of: intermediate ov'erspeed because'of;a large contribution- ~

to the. probability from failure of the steam dump' systems.

EH turbines with <

i reheat stop and interceptor valves are in the middle of the range'due'to the' s

1 'effect of secondary drain. failure.. Variation 1 has the lowest intermediate. overspeed probability.: Tables 8.1-2.through'8.1-4 show the dominant faults in each overspeed event. w q The probability of' design overspeed is. dominated by failures of.the control l valves, interceptor valves, and the emergency trip fluid line to the interceptor valves. Design overspeed can also be affected by failures of the extraction nonreturn valves. Since these valves were evaluated separately 1 from'the major turbine valve and control system fault trees, Table 8.1-2 does not have the nonreturn' valves ~ indicated. Their contribution to design -4 overspeed was determined to be approximately 2 X 10 per year, as discussed in Subsection 8.4. In intermediate overspeed (Table 8.1-3), the dominant failures are sticking of the reheat stop and interceptor valves, failure of the stop' valve bypass valves, blockage of the emergency trip fluid drain line, and failure of the steam dump valves. -In destructive overspeed (Table 8.1-4), . failures of the stop valves, control valves, stop valve emergency trip fluid line, and primary drain line dominate. 8.2 Conditional probabilities of Missile Ejection ThecalculationofP(1),describedinSubsection 5.3 of this report, required values for the conditional probabilities of missile. ejection at design and intermediate overspeed, P(M/A) and P(M/B) respectively. Specific values of P(M/A) were determined for each set of LP rotors. Westinghouse turbine missile reports, listed in Table 8.2-1, was the main source of information used to determine the values of P(M/A). Briefly, these reports give the probability of turbine missile ejection at design overspeed as a function of the interval of, running time between inspections of th'e low pressure rotors. Table 8.2-2 describes the rotors that were evaluated in this study. The table indicates four different rotor types that were included in the study. With 0298x:10/073ca7 8-2 l l

regard to the rotor type, the prob' ability of missile ejection at design overspeed can vary greatly depending on this' type. Therefore, rotor type was an important parameter in the evaluation of total missile ejection probability. N Based on LP rotor data, P(M/A) was evaluated for all sets of low pressure \\ rotors, including spares..These conditional probabilities are plotted in Figures 8.2-1 through 8.2-14 for all. plants except those that have fully i integral rotors..The probability of missile ejection from fully integral ( rotors at design overspeed is very small in comparison to the other rotor types. This probability has bec: determined by Westinghouse to be sufficiently low even after [ Ja.c of continuous running time without an inspection. For the current study, 10 years was used as the time interval for inspections of these rotors, and P(M/A) was assumed to be half of the conditional probability associated with a typical partially integral rotor. Conditional probabilities of missile ejection at intermediate oversneed, P(M/B),werealsoevaluated. These probabilities were found to be approximately five to fifteen times the conditional probabilities determined for the design overspeed event. c Table 8.2-3 gives two sets of conditional probabilities, labell.ed Case 1 and Case 2, that were used in the analysis. Each entry in the table has a reference number which is used in subsequent tables and figures. The following subsection describes the two missile ejection cases that were evaluated. 8.3 Annual Probability of Turbine Missile Ejection The calculation of the total probability of missile ejection due to overspeed was based on the formulation given in Table 5-3 of this report. The resultant Case 1 and Case 2 missile ejection probabilities are summarized in Table 8.3-1 and 8.3-2. The final plots of annual probability of missile ejection are given in Figures 8.3-1 through 8.3-22. As discussed in Subsection 5.3, one plant in the group had a rotor inspection interval based on probabilistic c2ssa o/ososs7 8-3

(rather than deterministic) methods. In this case, the probability of missile ejection at running speed was added to the final sumation and appears in the .,) plot in Figure 8.3-5. P(1) has been evaluated for two different cases. These cases can be described as follows: ^) Case 1: The value "P T.tal" is the mean probability of missile ejection (expressed on an. annual basis) during the first quarter of the last year of operation of the rotor before its scheduled inspection. t Case 2: The value "P Total" is the mean probability of missile ejection at the end of the last year of operation of the rotor before its scheduled inspection.- The last year of operation of the rotor prior to its scheduled inspection is the most important year because the probability of missile ejection is the highest. This is due to the effect of missile ejection from design overspeed which grows with the length of time that the rotor operates before it is inspected. Figures 8.2-1 through 8.2-14 illustrate how P(M/A) grows with time. Because of this, the current analysis concentrated on evaluating the probability of missile ejection at the beginning and at the end of the final year, as indicated in the cases above. The predetermined probability of missile ejection during the final year can be checked.against an acceptance criteria since, if the final year satisfies the criteria, there is assurance that the entire period of turbine operation between rotor inspections will ] satisfy the criteria. i Based on recent NRC communications regarding the reliability criteria for J turbine systems (References 6 8,14), the following acceptance criteria is suggested for determining a suitable turbine valve test interval for an unfavorably oriented turbine: a. The mean annual probability of missile ejection due to overspeed should be less than 5.0 X 10-6 during the first quarter of the last year of operation of the rotor (Case 1). If rotor inspections c2 sax:1o/c720s7 8-4' i

r ? + .are based on the probabilistic rather than.the deterministic method,.the probability of missile ejection at running' speed should be added to the total.:and the grand total mean annual probability should be less than 1. 0 X 10-5, \\ b. The mean annual probability of missile ejection due to overspeed should be less than 5.0 X 10-5'at the en'd of the last year of operation of-therotor(Case 2). Again, if the probabilistic method is used for 7 rotor inspection, the probability of missile ejection at running. speed j E . should be added to the total, and the resultant grand total should be less i ~4 than.1.0 X 10 Both of the criteria suggested above should'be satisfied in d'etermining1the turbine valve test' interval. In most cases the results indicate that the first criteria will set the turbine valve test interval. However, a check of -the missile ejection probability at the end of the year may be important in j determining that operation for a limited time beyond the nominal. inspection time is acceptable. As long as the suggested criteria are met, there is an adequate basis for stating that an acceptable level of turbine reliability and safety has been . achieved. 8.4 Evaluation of the Effects of Extraction Nonreturn Valves { l i ' Extraction nonreturn valves are air-operated swing check valves that close in the event'of a turbine trip. Closure isolates the extraction lines and feedwater heaters from the turbine and prevents reverse flow of steam through the lines which might otherwise cause the turbine to overspeed. The "close" signal is normally transmitted by the main turbine oil-operated air pilot i valve. This valve dumps the air pressure to the nonreturn valves in response to a dump of the autostop oil. Some nonreturn valves also have an electrical solenoid dump for the air pressure which is activated by a turbine trip. Nonreturn valves are also designed to close as a simple check valve in response to the force generated by reverse flow. The check valve has an 0298x:10/073087 8-5

1 ( p D externally-mounted lever arm and weight which is adjusted and balanced so that the valve will close with reverse flow. This means of closure is redundant to the air. operator. -A probabilistic analysis'of the nonreturn valves was conducted separate from

the main turbine overspeed fault trees..The reason for doing this was that the design of the extraction system was different for each plant and the effects of testing of these' valves was outside the scope of this study. Based on previous calculations'of the amount of overspeed that can be generated, more than one extraction line must remain open following a system separation and turbine trip in order to reach design overspeed. Furthermore, only certain extraction lines that connect to source of high energy fluid with

-sufficient turbine blading downstream of the extration zone can cause -appreciable overspending. The criteria adopted in the analysis was that given a system separation and turbine trip, the failure of two or more extraction nonreturn valves to close would result in design overspeed. It was assumed that four extraction lines could potentially contribute to the overspeed, and each extraction line was assumed to have a single nonreturn valve.- To evaluateLthe probability of the extraction system failure, a fault tree of a I representative extraction system was constructed and the probability of the top event was evaluated using industry failure data (References 8, 10, and 12) and Westinghouse service experience for mechanical damage associated with clapper-type valves. The fault tree is shown in Appendix B. i Assuming that the nonreturn valves are periodically tested or inspected, the ] mean annual probability of extraction system failure is calculated to be ) ~4 3.9 X 10 Since the frequency of system separation is 0.5, the probability of design overspeed due to extraction system failure is ~4 approximately 2.0 X 10 This probability was combined with the design ) overspeed probability determined for each main system fault tree. The total resultant design overspeed probability is given in fable 8.1-1 and is shown in the related probability plots. 0480v:1o/081387 6-6,

4 _e. t I S. a. n. s. t. a. a. s. t. a. a. s. t. a. s. s. s. u. a. s.

t. a. a. s. t. a. a. s.

~EE RENE BENE !EEE !EEE 5555 IENN 555E aaaa saaa aaaa aasa aaaa saa; aaa;

s. e. s. c. e. s. s. e. e. s. e. n. s. e. c. o. s. s. a. c. s. s. s. e. s. s. e. n.

<, j .NRER E525 IEEE E555 5555 E555 NEEE asas asas saas saas saas saa; saa; M 3 S.t.a.t. S. t. a. t. -s. t. a. t. a. t. t. a.

t. a. t. t. B. a. t. t. t.a.t.t.

Ej 5E55 5552 E5EE E5EE E5EE 5555 !!!! i a;aa asaa saaa Jaea Jaae Jaaa Jaaa

t. a. a. s. s. a. s. s. s. e. s. s. s. e. e. s. s. u. a. s. e. s. a. s. -s. s. e. s.

,.EE 5555 EEEE !!!E Ef52 EEEE E555 5555 ~ asa; ;;;; assa asaa aaaa asaa aaaa E / .wl J

s. =. =. =. m. a. t. a. e. s. s. e. e. s. s. e. - s. a. n. s. s. a. n. s. s. e. s. s.

j:j' sj !!55 EffE ENEW ENNE REEE-EEEE 8255 Jasa awaa aaas aaa; aaaa aaa; aaas at8

t. a. a. s. a. s. s. a. s. s. s. s. s. s. s. s. s. a. s. s. s. a. s. s. s. s. s. s.

gE,. -Ej IIII IIII ENNE EENI EEEE IEEE IE55 "g Jasa JJJJ ;;;a ;;;; aaaa ;;;; ;;;; 8899 IIII 9999 9999 IIII 9999 9999 ,,' E E EEEE NEEE IEEE IIII EEEE ada; ;;;; ;;;a ;;;; ;;;; IIII 555I Wl J 8833 5555 S. t. a. t. S. t. a. t. E. E. E. E. 8. t. t. e.

8. k. t. e.

3 j REEE 5555 NEEE 555N 5555 E!!N EEEE 5 aaaa ;;;; adaa asua ;;;; asua a;;a .3888 E. E. E. E. $. $. $. s. $. 3 8 8 E. E. E. E. 8333 3333 ~ aaaa aaaa asa; eaaa asaa eaaa asaa II IIII 44 --.II IIII II.II @@@@~ ---u -- a -- ~ ---~ --44 $444 3 3 a ---~ 5:e e ~ n e I> 8~7

c, a 8 RA V e h t 7 ) o t [ R A y E V l C p N p A a TR t O 4 o P n M I R s A e S T V o E L d E U R A t T F l 3 u T C a L I f U S R A A A e F L B V h A t D V E R r E E o P T S N 1 R I 2 E 4 V T R 1 O S A n E V a 8 N T h G t E I E L S V s B E L s A D A e T V l N I H s T i S N T O e L N c U - n A 6 a F tr T o N p A u N l I N e O T h D L t UA t F a h C t I S s A e B tac i d n n i o i h t s a a i d r a A v

e t

o 1 2 3 4 5 6 7 8 9 N l1 SS .E l

8 RAV 7 e h R t ] A 1 V o [ t E 6 y C l N p A R p T A a R V O t F o S 4 n I E I E s R T R e T L A o U V d T A L F t U 3 l A C u F I a S R f D A A E L B V e E A h P V t S R 2 R E r E T o V N R O I A 3 V E T 4 1 T S A E 1 n 8 I T a D h E E E R t L N V A B R L V s A E A s T T V e N l H I T s N N i I OM e S - c T 6 n L a U t A r F o T pm N i AN e I T h M L t O U D A t F a h C t I S s A e B tac i d nn i o i htsa ai dr a Av

e t

12345678901234 o 11111 N g$!30 o4 m

o, a 8 no i R t A a V i ra 7 v e R h ] A t % V [ o t E 6 C y N l A R T A p R V p O a P t M 4 o I n T R s L A e U V A o d S F E 3 t E C l R I u T S R A A a f T B V LU e A 2 h t F r D L R E A A o E V V P R S E 4 R T 1 E N na V I h 4 O R s t T A E S V 1 V E d d s 8 I T e e e T g g d l E C E d g d n g e L U V d e o e e o g s B R L e g l k pd l g i A T A g g c c d o e c o T S V d g o o e g l e E g e o l s l k o g s c c D H n g l c i b c t o i n T i g c o l s a N N s o s V s l s c r i t I O o l s i T i b l e r M l c i / s l s d e o S - c ) V p s l a i n v p T 6 n s ) 5 n S m i l f i s l d m L e s i 2 e u a e l l a e i U p t r p o s F f e v y l v s A o i ) e o o t T n l c a o e F T b 3 n H E mi a n f p l h L s i o 4 s eE e l v e V m c t T U k h e z k n r t o p C y u N A c n n ( e c i o o s n w o r d s t A F n i i o n i l t f y i r f t k a N e t z e o t s a e s o i V c h I C p s e ( n z s d n e r s k u T i t N I o g i ( i r n y d c p c / t O S ) a e l n u u i a V i o r V s s D A s V m n e o l t l l V C t t i S e B k C a i l n t f e e C s c e t c ( d l o i s r n r m m m v a i r l i p i n o e o e o l c t e l i t pi n a r o r v r v r a i s v a l n l r i r o f l f l f v d l c o o l r t a d t e a a n e a i c v v n l ~o o r o v e v e v e p i t y d y sl n n n m l a a r p a c r o a i e i o i u h a l h n o o u n y a v v l l l v l d s v o c g n t t e r d r t r a r e i r s c g a n e k n t n e n V d p t m s e o a r m o s c i n i s i T o n v t e i c e a r a a / A t o V V o u V m r e V h r h r V r V S C S S G A C E P S C C D T D C D S e t l 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 o 1 1 1 1 1 1 1 1 1 N 5:E ,y

i e TABLE 8.2-1 List of Probabilistic Turbine Missile Reports Used in the Analysis 8.1 Reference' deleted 8.2 CT-24826 Rev. O, Turkey Point Station Unit No. 4, Serial Numbers 13A3401-1, 13A3402-1, 13A3403-1, September 1980 (PROPRIETARY). 8.3 CT-25270 Rev. 1, Indian Point Station Unit No. 3, Refurbished Rotors - GNX 22635, June'1987 (PROPRIETARY). 8.4 CT-24086 Rev. O, Diablo Canyon Station Unit No. 1, Serial Numbers 13A3318-1, 13A3319-1, 13A3320-1, 13a3321-1, June 1980 (PROPRIETARY). CT-24866 Rev. 0,' Diab 1' Canyon Station Unit No. 2, Serial Numbers 8.5 o 13A3486-1, 23A3487-1, 23A3488-1, 23A3489-1, Nov. 1980 (PROPRIETARY). 8.6 CT-25205 Rev. O, Diablo Canyon Station Units No. 1 & 2, Serial Numbers NAE 99500, NAE 99501, NAE 99502, April 1984 (PROPRIETARY). 8.7 Reference deleted 8.8 Reference Deleted ' 8.9 CT-24110 Rev. O Maine Yankee Bailey Point Station Unit No. 1, Serial Numbers 13A3335-1, 13A3336-1, 13A3337-1, August, 1980 (PROPRIETARY). 8.10 Reference Deleted 8.11 CT-24098 Rev. O, Prairie Island Station Unit No. 1, Serial Numbers 13A3348-1, 13A3349-1, 13A3350-1, July 1980 (PROPRIETARY). j 8.12 CT-24828 Rev. O, Prairie Island Station Unit No. 2, Serial Numbers 13A3437-1, 13A3438-1, 13A3439-1, September 1980 (PROPRIETARY). 8.13 CT-24108 Rev. O, Kewaunee Station Unit No. 1. Serial Numbers 13A3339-1, 13A3340-1, 13A3341-1, updated May 1982 (PROPRIETARY). 8.14 Reference Deleted 8.15 Reference Deleted 8.16 Reference Deleted 8.17 Reference Deleted i 8.18 Reference Deleted 8.19 CT-24888 Rev. 1, Saint Lucie Station Unit No. 2, Serial Numbers 13A4481-1, 23A4482-1, 23A4483-1, December 1981 (PROPRIETARY). 0298x:10/090887 8-11 A

TABLE 8.2-1 (Continued) j 8.20 CT-25090 Rev. O, Saint-Lucie Station Unit No. 1, Serial Numbers l 13A3581-1, 23A3582-1, 23A3583-1, July 1983 (PROPRIETARY). 8.21 CT-25098 Rev.' 0, Harris Station Unit No.1, Serial Numbers 13A4681-1, i 23A4682-1, 23A4683-1, March 1984 (PROPRIETARY). 8.22 Reference deleted '8.23 CT-25241 Rev.0, Indian Point Station Unit No. 2 Serial Numbers NYE99300, NYE99301, NYE99302, August 1985 (PROPRIETARY]. 8.24 " Analysis-of the Probability of the Generation of Missiles from Fully Integral Nuclear Low Pressure Rotors," WSTG-4-P, Westinghouse Steam Turbine Generator Di' vision, October 1984 (PROPRIETARY). + h l 4 l l 0298x:1o/090887 8-12

. 3,. l I TABLE 8.2 LOW PRESSURE TURBINE AND ROTORS GENERAL DESIGN AND INSTALLATION STATUS LP NUMBER l REFERENCE. TURBINE OF ROTOR-NUMBER-LOCATION . TYPE ROTORS TYPE STATUS AND COMMENTS 1 Turkey Point 3 BB 81 2 FI Installed '2 Turkey Point 4 8B 81 2 LDK Installed, to be replaced l 2 FI To.be installed,-Fall 1988 l 3 Turkey Point 4 Indian Point 2 BB 81 3 FI Installed 5 Indian Point 3 BB 81 3 HDK Installed 6 Diablo Canyon 1. BB 81 3 HDK Installed 7 Diablo Canyon 2 BB 81 .3 LDK Installed Diablo Canyon 3 LDK ' Spares, to be refurbished 9 Salem 1 BB 81 3 HDK Installed 10 Salem 2 BB 81 3 HDK Installed 11 Maine Yankee BB 81 2 HDK Installed 12 Palisades BB 81 2 HDK Installed 13 Prairie Island 1 BB 80 2 LDK Installed 14 Prairie Island 2 BB 80 2 LDK Installed 1 15 Kewaunee BB 80 2 HDK Installed j 16 Robinson 2 BB 81 2 FI Installed 17 Point Beach 1 BB 80 2 HDK Installed 118 Point Beach 2 BB 80 2 HDK Installed l 19 St. Lucie 1 BB 281 2 HDK Installed 20 St. Lucie 2 BB 281 2 HDK Installed i 2 LDK Spares ] 21 St. Lucie 22 Shearon Harris BB281 2 PI Installed t KEY: LDK = Original light disc keyway type HDK = Heavy dise keyplate type (This applies to LP rotors ] with one or more discs of this type.) PI = Partially integral rotor type FI = Fully. integral rotor type 04eovno/ostas7 8-13

0, R ~ ) A/N ( P ro f s isa S N ) O B I / T N C ( E P N P 2 O S I N e T I s C a E t C ) J o A E T / O M E R ( L P E t R ss O i F M EB ) 3F S - O N /

2. S I

( O N 8E T P I A 1 ET R LI E e SL P s AI O a TB C ) A F A B O / O M R R ( P A P E L Y A N T O I S n 0 A rot T L oia ] 1 t t v s 0 0 3 555 I G ocr r 151 0 - 545 55 55 5 0 55 554 5 O I t ee a 15 55 0 D 4 5 55 5 1 55 553 5 N N pt e 050 4 5 C R P snY 1 1 03 555 55 1 U L nI ( 1 B I 12 12 344 23 dd s nnn nn 12 i t t t t t ooo e aal hh 12 rr nnn nn yyy e l t iiiooo ii aaa r e Iss 2 c c a nnn n oo s I aa eee N a PPP PP CCC a e n ee iii l 12 Y d ee e o tB c c c n P yyy nn ooo a irr t in t t LLL r eee aa s l m s uuu o kkk ii iil sn e i il w b iioo t t t h bbb ee n a nn a r rr dd l aa uuu nn laaai l l ia a rr e o l aa e TTT I I OpD ss M P PP r a PP Sss s e c nr ee rb 12I 45 678 90 1 2 34 5 6 78 901 2 em 1 1 1 1 1 1 1 1 1 1 22 2 f u eN R aaH* s l'

1 l TAaLE 8.3 1 IEAN AmmunL PecaASILITY or funstuE N!ss!LE EJECTIcel CASE 1 FIRST GUARTER (OF LAST TEAR SEPORE IllSPECTION) Valw Reference Test thauber Pleit Intervel P(A) a P(M/A) P(5) x P(M/5) P(C) P TOTAL )

=

1 Twkey P6fnt 3 1 Me 3 see E,C 1 6 me 12 Me 2 Turkey Point 4 1 me ) 3 Me 6 Me 12 Me 3 Twkey Point 4 1 Me 3 no 6 No 12 Me 4 Indian Point 2 1 Me 3 Me 6 me 12 Me S Indian Point 3 1 me 3 me 6-Ito 12 me 6 Diebte Canyon 1 1 me 3 see 6 no 12 me 7 Diebte Canyon 2 1 me 3 no 6 me 12 no 8 Olablo Cavyen 1 me 3 me 6 fee 12 Me 9 satse 1 1 me 3 me 6 No 12 No 10 tales 2 1 me 3 me 6 no 1 12 see 11 meine Yankee 1 me 3 me 6 no 12 Me 12 Pollsados 1 me 3 me e me 12 me 8-15 t.

s e TAeLE 4.3 1 1 MEAm AinadL PAORAstLITY CMr funelmE m!SSILE EJECTICII-CASE 1 : PIR$f EUARftE (OP LAST YEAR BEFORE IllePECf!OII) i Velve Referense feet Iludier Plent intervel P(A) a PWA) P(3) a P(m/W) P(C) P TOTAL 13 Prefrfe telend 1 1 me 3 me E,C 6 fee 12 me 14 Preirte Island 2 1 see 3 me 6 fle -l 12 lee 15 Keusunse 1 fee I 3 me I 6 me 12 les 16 Robinnen 2 1 fee 3 me 6-me 12*lte 17 Point Beach 1 1 me 3 ses 6 me 12 fee 14 Point leech 2 1 me 3 me 6 see i 12 me 19 St. Lwie 1 1 me 3 ste 6 see 12 les 1 20 St. Lucie 2 1 me 3 Ins i 6*fte I 12 me 21 st. Lucie 1 me 3 me 6 me \\ I 12 fee 22 Sheeren iterrfs 1 me 3 fee 4*me 12 me ) M MI l 6 8-16

TABLE 8.3 2 MEAN A8 MEW PROBA8tLITY OF TUR8!NE MIS 8!LE EJECTION CASE 2 : LAsf GUARTER (OF LAST YEAR SEFORE INSPECTION) i volve Reference foot h Plant Intervel P(A) E P(M/A) P(8) a P(M/5) P(C) P TOTAL ~ 1' Turkey Point 3 1 me ~ 3 Mo A,c 6 Me 12 mo 2 Turkey Point 4 1 me 3 me l 6-Me l 12 me 3 Turkey Poitit 6 1 No l 3 me 6 Mo 12 No 6 Indian Point 2 1 Mo 3 Mo 6 Me 12 mo 5 Indfan Point 3 1 me 3 Mo 6 No 12 Mo 6 Ofeblo Canyon 1 1 Mo 3 mo 6 No 12 Me 7 Diablo Canyon 2 1 Me 3 No 6 Mo 12 mo 8 Ofablo Canyon 1 Me 3 Mo 6 No 12 Me 9 selos 1 1 Me 3 Me 6 No 12 Mo 10 Salem 2 1 Me 3 Me 6 Mo 12 Me 11 Meine Yankee 1 me 3 Me 6 Mo 12 Mo 12 Polisadeo 1 Mo 3 No 6 Mo 12 Mo e 8-17

.4 e + fAaLa 8.3 2 NEAm AmmuAL PROSASILITY OF fttelut miss!LE EJECTION 4 CASE 2 : LAsf cunatta (0F LAST YEAR SEPost IntPECT!0m) Vetvo ~. Referense Test f W Plant Intervel P(A) a P(m/A) P(0) a P(8t/9) P(C) P TOTAL 13 Preirle tolerd 1 1 see 3 me a,C 6 ese 12 me 16 Prefrie tel m d 2 1 me 3 me 6 me 12 me 15 Kass6mee 1 me 3 me e ne 12 me 16 Robinnen 2 1 me 3 me 6=mo 12 see 17 Point Seash 1 1 me 3 me 6 me 12 me 18 Point Beech 2 1 me 3 me 6 me 12 me 19 st. Lucie 1 1 me 3 me 6 sto 12 me 20 st. Lucle 2 1 me 3 me 6 me 12 me k 21 st. Lucie 1 me b 3 me 6 me 12 me I 22 sheeren Harris 1 me i 3 me { 6 me 12 me i 8-18

1E,02 i i t i i e i i I i I l l --.l-l ! FIGURE 8.1-1 ANNUAL FREQUENCY OF DESIGN OVERSPEED l FOR VARIOUS VALVE TEST INTERVALS i (VARIATION NO. 1)

~

=

_2

c. :

_n

• .',p y[

.::.~;;.3 ..... y dirj:. ', g. } h:. : c i *_ . :... : '.1*., .)M ._. f.iI . f. __.7

• [
• -]"' _ '

^ ~**:' '^':..~. . =-.z-

• L :. I.' :.", :^ :'.. ~~~~':..

.::._~~~.~-'"-~ - - ~ _. G" -*.~"T^. ~ ". ". -. '.. - '

==

=

.=; x. =~:. _ : .-_: =. ~ _..: ~'. ~~ '= '. ~ _ ' ~ _

7

.:~ '~ 0__9 . _., i __tr - I 95 p. ' y., - 1E-03 i - T-i i i i i i i -l I l I _f i l l I I !_O ! i l Mg_- l l k l -l l _. -1 e / i = i ~8 t -- fj .l j .i l l ~- ___ y /. 6 3 i l .l- ~ - ~ ,0 l .e i l.- .[ Q. _ (- 2:.. [ l ~ 'H .I 1.... i l j g.. l. HH g i 4 i m o 1E-04 M. i p ,. m. v,. i i j F j I t (.. .a .= !. j g. l I

i. -

.- h_ ___%.. ...'..-i '.__. 3. l.. l t... '. _..w='_~_-i_.:i: h = .=..-..=E. =._ ~. L =._:' - f ,J r.._ r _ __ l I ~;*~..'.[.*... .i ".. ~ ~. ...-~_f1*'.._

f. -

. _ _.. %.;~l.' l. ~

• ~

. _l, .I _. _---tr:= cc-1.

c...

= = - r. -t.=:- _".__',--:._.. i.__.- .-}- l [ ._C[ .1. j g .:.. : 2. ..,i l l l-l: l j -E .I l l l

1. =T l

- - =- c .[. l f -. i l j TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHSL l l l p l _ j 1E-05 1 2 3 4 5 6 7 8 9 10 11 12 8-19 1

i 13601 I i i l s l ( - l FIGURE 8.1-2 ANNUAL TREQUENCY OF DESIGN OVERSPEED l FOR VARIOUS VALVE TEST INTERVALS <- ~ { I (VARIATION NO. 2 & 6) L :* : *.~~~ : p *._ *.

[_~~~ :,

._ :. Q~.. \\ . ~$-{'{:k& Q 5 '~ ~

':.:}.

.i **.. ]ii. U.. ._: :a. : = = =. _s. '._' ~. ~ _ ^ = _. =., _ _. I_-i i._:.i.-d. "~'~ - f. i. -. ; :::5~ %. ^ ~ z.i.-. : : y

.. : p~ ' ;;~, '-_

2. C'.

7. u ~.~ '

• '~.

"L.. 1."'.... '*l"~~'*." __.1.~ :.~0~ 12" I._. _~ :.'~.~_ ~ ~

• ~

. ~... ... " ~. _ _ _~ - ~ ~' ~ ~ ' - * * "~...-_.l. J.~"'.-~~~-*C ..;'".. J;!

• J."".~~'. ~.*"~~'.'2 ~ ~. ".. *.._

~ ~;. '~

• ,. ' ". ~ ~

95th PERCENTILE. 1E+00 i t i I I i i a .l I i ~l i l ~> l -l l- - .~ l l l a, i p. .l MEAN ~' ~ hcii~.f. c.: [ -l Ng i l. l .[ p. i 1 i$ i l L =? l '. " ' ".h.h f O pu, l. j. r }. i . : :: ?- o p. . _..._.._p y. I

g. _ _.. _. _._.

I. 5 o L cr W l 'g l { j k 1E-01, j 8 h .[ _e'.,.. g ~ l

4...

--i:-p =. - =i : w =.. ~_.g.= m:... .; g ) r . : 5_.

• • J..

.5_ J.._d_- ;) ~" h._ k.,.'_.~.".,.,~'.'.4 5 3 3._h..b5..3. bd.._ -- -. "._ [ E__ T 1 E. -[ b [ ..d hA. ~. .... _1.... _. 1 j ' ~ - - j = [.. w

. +::--

= --- p \\ 1 l _. _. [. i l l ._.}.. 1. _. j

4..

____4...... . j ~ ~ ~ I. TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS)., j _-i. i g 1E-02 1 2 3 4 5 6 7 8 9 10 11 12 8-20 1 \\ l l

'( t 0- [ 1E,01 <,j s s ~ l -l f i s-( l l -l- -~] l FIGURE 8.1-3 ANUUAL l'REQUENCY OF DESIGN OVERSPEED .l FOR VARICUS VALVE TEST INTERVALS (VARIATION NO. 3) 4 .r l ~

:M -

.1-NI.- - ~ _ ' 5 -~_-:.i.' E T T ~..

• % L*F. ~~.~:-~

'E- ')j,

be g.r.i=_ _

~ _ _,.. -+. t : : mi - t=;; _ _ - -. =... _ - -. "_ lr-Ei t

(

p: .r ....=:'.---. . ; }. : .u ...:. _--... _;_:._1 -..c!.,

. ;_ :.=;

. _ -2.,_ J. ..w _. o i 1E-02..-- i i ,,,e _.g l l l ( l } l i i i ' I i i g ly j .}. i. j.. ..j l i. M l,, l-1 i l. - _..l -:d .I a m i. t 4.... _.. _ l L., i c. t j \\ M -t-- -( p -I c;. : l j. ~] i. ";- 1O r 6. ~ - [l- - - - l '..~q _l.~.~ o _ _. ~. ,o 3, G-e ^ 9f& ., ;;l...... g .j. 9 ~~~ ~ , m3 i )

_ s i

C_. J i lmg p;,. _ .4 q l 4 1E-03 l' . n. _. d.. I .s:. u (.:. ?

• s..

l i pe qf..- a l i l l l ., :..hh'g'.., ~ i j s,,=="" .r _e_i

r..r.. g. -.;;.

F C ~ g /. ., {, . _. ' { ;.;.; . _ _z_:

• • 7*.*'.
• ~ *. ". ". *, '........... _. ". ' " ' _. "

1 ,,.sr A g

• 7..~.' l' ' ' l '

..!'."~.T.....7.I..'!.".'*.1'~_.L.._J.. ".,. ~. _ ' *. l."~.._.*._".'. ~ * * *'.~_.~."_7.~_I.._""_'.~,.'"' ) .m.s.'.__.y_ J g l - ;} d -4.;. . ; :_:- ). ... -.==.:a p 9,p., 1 l-

. [ qiir M---.- l : :.-- -

..._t~jg :_- l -Q ; e 3 l l.. __.......'t... [ l b, s ._-i l . _ [..... _. _. i i l... j . j ...j. 3. _ _ l TIM. E..I.N..TERV. AL. ETWEEN._TURBINEvb '5'E.S. TS._(MONTHS )... ~ l _..j 1 2 3 4 5 6 7 8 9 10 11 12 .1 i' l 8-21 1 j l o___---______.-_-- m

(y o ,.1 12,02 a p 6 6 i t i i. i e. i e I i l l t FIGURE 8.1-3An ANNUAL FREQUENCY OF DESIGN OVERSPEED i .A FOR VARICUS VALVE TEST INTERVAIA l t, (VARIA.TIoW No. 4r. 7 & 8..).., ..e .~. ... - -., m.. _......

• _..._.
• * * - = =

1 k' 4 ~ ~..

• • ]~5 i : 0.7

.~.~~T' ~ -r .. Z " ..i..~- (.. L.. ____ L T r .. ! -~ :......~ =. r ~. * . ~ ~ * * *." * * ~ ~.. ".. -. - -.

~~ ^

;',~2.

• '... ~ * *..

~

6. '..- Jf

.'_.;!..

~. ~...... ..... ~ _.. .i * ... :;y.. 3, 7,L_S _ [.,,.. _...a. .p 88,, f ... ~. g ,e".-..-. ...7-1E-03 g i I I M .ii g -l I s---' i t ,ii, i i 'r i l i p j p p. p I j l --t-O. r. p, .. 5.. 4

p..

l. '

..I. ft) I t .'I j y a; -;. s.a 6 F I;/ I l /t I ~.. o ,. m ~ ff s ( y+, - - ;p. l j r-l 2. L. L io i \\ 'i ' ~ T r l t I ( 'r s t n ig l -( yp i a u n gj m. gg 1E S' s s 6 i. r. J. --f r. l r-- j J :. {....._. - - U. t.a r. .. - =r r ,? l .... l...... ... [..:. :. f - p "-- = M_. ~ ~~ ~lE.:.-._....~.' k, W.w Y~ . ~ *.. $.T.. . 0_ a :, ~ ~ ~ _. ~. '..._~..... _ ..'*~.?'- 1 '.' ~_._L.- 'r ^ } = q.; } . l .\\ u l - l r o ,_ _n --(- -+= - t, t-I 'a /' c l i -l ~. N l [ " di j. l "pj. .T y. /. f . _ - ~. l i-- -l p_. l 1y ~~ ).... l j i TIME.[IMTE.RVAL BETWEEN TURBINE VALVE TEST .. l }. _ }... _ -~ __[ . l 1E-05 1 2 3 4 5 6 7 8 9 10 11 12 0-22 ,r 9

'.) ; i

l -

d I 1 1 .g 1E-04 i 3 I i I, ) n' I i I .I 1 l, li-1 1 I i l I (, (< L* FICORE 8.1"4 ANNUAL FREQUENCY OF INTERMEDIATE OVERSPEEDh 4 "i / i FOR VARIOUS VALVE TEST 7.NTERVALS ... ',..;,... _. (VARIATION rd). 1) g i-i, 9 . :.. =. .. :w. s '.: -_:. 2. ,t.,...':.- .1 ' _._//;. :, p '* j g. l r: .- :[r;.. ,q 9 a. m.. i.:

r. i=. E.a.

.s....._ 4:rE... :

+.: _:

i 2 : !. :li~ j i r ' f== ti.5;ff Eji .jbj-i@ 3' r.1

zin t

s y.,.. ) i' 1 i. . _..'I. j a#. 12-05 -- t - r4 y i.8 I { l !j i r, I 1 4 I I i, l P_ l >j I> l ii u 1 - L, r, .c. s + -:.c. - l $. I .] f, / l g L-.] .._ w ,,( [, $ i i l _

• / -

} i E 1 i,' i 0. u.. f j_. f[- l 3

p..

l l. 't i .o p i k-4 ~ / ~~-- 41.n ..f s l ,,,, H ~~~/ ) /. l e j ,.... g. I j / 1E-0 6,.. S ,f i 2. / I .a

r i

i r j/ I i i - '- I } / ( m.j (___ = - l ?~~2 R_2_. V-N.Y ll )Y _-].!'~"- -D_=\\=_b.. =~~\\

~~

- = =- n.:=.

=p.=-

.. j::=--- .... t..... ..:..:.t :.

/.

..:d r '

.n :..

1 ay l m .=. t ).4 / /- .1 .e i. .) j. {- ..i .p l . _r q _ = - / l [ j r_. 3 ,l .. f .-.h, l. I TIME, INTERVAL.BETWEEN TURB.I.N._E VALV.E. TESTS...(MONTHS) .{ l, 1 p l 1E-07 --- l 1 2 3 d 5 6 7 8 9 10 11 12 3-23

e e +

v i

lE-02 i l l l e i l t j .g i / ! FfdLxE 8.1-5 ANNUAL FREwuanCi OF IhrsanzuIATE Oysadirssu : FOR VARIOUS VALVE TEST INTERVALS .(VARIATION No. 2) ,:M . r. ut +: m i= I

• .s.Eri.:-

3 .'i i. -~i "{ Z.2.fp~.5. --'!-hi.,,, -_ ~.g. ' ' -.d = :::~. ' =.. z. 95th PERCENTILE ). - = j . _.. _...... l. _ L lE-03 ^ ea e s e f I I i i i i .-r- -) l >e-l ~* f -~ > w uru r .. _ r. l l.. .I w ( . ghe M i + i l i i s l [ .E lO ~ l l - i. f:ri- .F. l 1 - ,w . :. t l.O -l J. i I . f.M i ~~ 54 . (.. I H .[.... i

y i

g

- m -----

,4 , g I O We ~ ~ ~ - - ~.. ~ - ~ ~ - lE-04 [ l l 3 i f I l l ~ l l V l i.= l g g '".T E CT.-*~ !".. I ..[ f ...Z":.'... { -_'~ { {~. ~_ "{ __ G ~.' l l l' l 3

• I f

~.. ". '... I I ..l ^ . _l ... _. l j g l g l. l 1 l TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) l l lE-05 I 1 2 3 4 5 6 7 8 9 10 11 12 8-24 e, t I b

I L l l lE-03 9 t i i t i i i } l -l 7 FIGURE 8.1-6.. ANNUAL MLEQUENCY OF. uwamazDIATE OVERSPEED FOR VARIOUS VALVE TEST INTERVALS (VARIATION NO. 3 & 4) g._..... _p.___.. .k - ': _. J. .L._. ^ ~ - x :9-+ ;.as= . :. =; i k=.. - L-a -; t7 . + +.. . :.cs-;. ;. . = ...~ ._ %. C.=-. :_ . ::: :.[_&. l.::g;. .: l.E_. -E#=;'f ~~:.-H = y .-i :-E.

.ar_.

r_. :. . =_ _ :.;.. ... = _ _..; _ :. - - =. :. =..: _ = _. ~. _ ^

=-

q.__ r~" [-~.:. _ . :.. ~ - " .1~ -.T~ _J: r " - ~ J. ~ ~' ~ I~~ ' ~ ' ' t 1E-04 _a e4 t i 78 I i i i i I t l l t l- {. l p_.- I_~ -p-- ILE w 95th P, .. [ i -a i sd i as ,. tr - a-g.,,, I a, i i 'E ) i :1 l g _p - j - j j .i -i ._t: l -- I- ,n _j p -- l l." p l- ** *.. - -" l ~ l -- i O j f ~~'"~ E s i _.. -,,,- i i l j_ .._. l l }, H p g l p "" ~-. 'o M---- - m + 1E-05 L, "' gg. t i i p l ..l. _.:. j. .[i l .[ .c. i _. - j --- l

c: y.-

=.:a. { -; _ _ 2:__ p - . u=g : + : I. &. _:._.. {.__. ._5.".~.-TE._==. ..._..: : i l _.= _~.i_::L... lF_ _..__ 1- =_.=.. :. ;.'f. ~ -~~- ' ~ - .p - ~:.--' .._...r =. -

. _.. :.:.... : - :'. ~_"_~ '. _ : -- - :_ - _--...:=..._

} ~.. _ l __: l l =.. l r .n . =. - s--- . ;\\ g {;- - l :_ : 1 (- l ~ -.l - l

• "'""~g.

I l l . J~ pl....T._.. I ~ ._I.._. f ~ ~ ~ ~ ~ r'21 ~-- .i .e, .,_e j TIME INTERVAL BETWEEN TURBINE VALVE TESTS,,1 MONTHS). l l l l l. -. l. _ p_._ - lE-06 1 2 3 4 5 6 7 8 9 10 11 12 8-25

1 l l ' 12-01 i i i i i i I I I I .I i I FIGIRE 8.1-7 ANNUAL FREQUENCY OF INTERMEDIATE OVERSPEED FOR'VARIOUS' VALVE TEST INTERVALS (VARIATION No. 6) ~- p. E - I.9 Mt. - *'- i ~ N' E- -I*

• 3-f

. N k.- h. F.' f: -

i.

._. :. : :- C___ _

_ = _. ~^ .:. :........ _=i.i. i ..c.. J ...-J,.. ..... _... '. ~.

L..

i ' -.. ~ _ ~_... . 1. C-- --.; - . -.; ".; _ - - - ~ .7 ^ ~. _ - ~ - ' 1E-02 -= i 95th PERCENTILE i .ei E. L 4 - 4.- d.-.. L.- l -.-l 8!i - i i i F i i3 j ....t I I l 1 I, f .h l . M f' , ;.S. l '..

• l

_w t t 6 m l _.. _. 1 i i o. I' MEAN '.-~'.c l -- 1 i i i j . p.._.. -g p.. p= o i ._i i I .. o ..l - -- [ .-_.. I u e. l. l j,y m . ~.. ~. ~... _ ~. ~ O ,g 1E-0 3

n _;..p s.-

i i 1 --l l-l } l. l }. } b-lm l. ?J q q _J. g. :_;;__ - fid_;..._-Ei ~ JNN N ;5 " k~~~ ~.W.E h $$D. . _.dc l.. ~~ ~ '..!~. _: h 7-._ .C.. ~~ ~' b_ _*"_* ; i .J:.~ -- -~- . ;. J.! J l. ....._"C. .'_..n .L . a, ....4.._ Y. i ... N l I l I. -.l. .i - i D

• =

l l l _.,i i .= 3 L. L l j ) I -~ TIME INTERVAL BETWEEN TURBINE VALVE TESTS _(MONTHS) j._ j._. _ _.._] l 1E 1 2 3 4 5 6 7 8 9 10 11 12 8-26

---

______ _ _J

) l 1E-03 i i i l i ANNUAL FREQUENCY OF INTERMEDIATE OVERSPEED i FfGERE S.1-8 FOR VARIOUS VALVE TEST INTERVALS (VARIATION NO. 7 & 8) i g. r . F :; -:-i_.. v. N

:. -:_0.. II~~ -

Mi _.IN bMi l ~ ~.... r-i-- 5.{.__. p:; c_ 7 chp IlM. ) ~' E =.

==:- - l ^_ =: : _..p-.'~

• ^

.. ~ l- [.__ i 1E-04,-7 i I I f I f I i .N 1 I l I i i$! } h' I l l I i lc-i i '[ .j M, PERCENTILE I ~/ .m ~_s-i i$ _., _ a - i _y $~ l I i i _. I~ $ M l I-1 --o l g, l l- .E.-- t i I CO l [ l l i i . y i.__ p;i ,g y j_ I

j...

~ m )$AN ___-. - _. i o 1E-05

• i i

.r : L.- i i -l q; j l i "nri[..

F - [

1 {/. 7 t i

_..:. I.:-_ _~ :.-E_.. : L.:_. i- -..

-._=._ I. =_% ::. =...I. L.?..i.=._~ .. :.J _.l._ s_. ._...L.. l t. [ ~_'_i?if..ri 1._5_ l~;~:~2 T._ &-== =- ~~.I _. "?E' ~._: l =..: _t l.;_... ..l i -i2 l - l l.-*- r: : l -- l j--- I l l._ ~. _.l' l l l ~ g l-1 } l- -j i __ TIME INTERVAL BETWEEN. TURBINE VALVE TESTS _(MONTHS) l .. i 1E-06 1 2 3 4 5 6 7 ,8 9 10 11 12 8-27

1E-05, i i 1 I .. _1 l E FIGURE 8.1-9 ANNUAL FREQUENCY OF DESTRUCTIVE OVERSPEED ; FOR VARIOUS VALVE TEST INTERVALS (VARIATION NO. 1)

^

I.5 ?-? ~: 5- $Y* h h:* ':?* b ~ ~ .-Q f. - ~. Y5: _ 21-:. : .- ~.3=

i ^ __

._t = ..2

- :

"'* *. "T1 = _ - - - -~"*'- =.

.=._

~- '*~~1. '"~""! "~""-'!"t_ .. _' C_ " ". " * " * *.. *.... ~.~C.. '.*: - ~ ' ' '. _. " '. '"~'!~~ ~.:. '.. ^ L.*.~*. ~. ..~. T .::~ =. ' * ~ ~ ~ ~ ' _.. L,, ^ ~.~ ' ~~: , e... f _. ._ 7 7 g f[n. p' 1E-06, - ,1 a$ i l W. j 9g d' l I f I ~'~ i,,e. l-l f- :.. i i j e i l . l. M.f.: r. l % -[ .l t 4 i 'W. l @' ! - h. :. / l

f. f :;r l.. -

I [ / i =: _g i / i I a / ! f l , y h:: ~'~' O j yl l- {[ p I ~ -' o / [.... l .r .i / l / .l_. g .--._..e.... - g. i .s ... ~.

g y

r , CG 1 g j / .. i[. i -o i / ~ a: 1E-07h" f p.=. 4 / t . p. 6 i /-~ l ~,- ; ~ -i t - . al I :- ~ h l [ [' ... b..

2~:_2."..* !* 7 ~~. 21_L *.2 1.~~~'.'.:0

-.. ~. ~ ' ~.. .__~~.C.+~_~ t. u.- f.~ ' f F- .--i. -}.NN -Nbb h-N[ M' l /. .;O. 2 L ".- *,;.. ."P _!.'*2.~. _p ~ ~. ~ ". ' ~. ~...... _... ~. ~. ~. ~" " - C"~~. j....Z * ~ ' ~ ~ ~. ~ ~ ~. ~ ~. ' . C**~.~.~ ! l ,. 7- '.~.'.C"' 1.~ * ~ ~ ~ ~ ~ * ~ !_.~**,__ .....l___._. I l

==. 'l' =h

• -[3.'.:

= &-T fi..-- - :. :, 257[ Q. f-f F.- ~~ ..:.... :.:. : ' ~' .. [ ' ~~. '~ V -: t l. [

t. I

. _ _. l. _ ~ l g.....'.. i \\ l . }_ l._ ._.. } __ q j l TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS)_.__ [. l .. _ _l l__. 1E-08 1 2 3 4 5 ,6 7 8 9 10 11 12 8-28

1E,05; i i i i i l FIGURE 8.1-10 ANNUAL FREQUENCY OF DESTRUCTIVE OVERSPEED FOR VARIOUS VALVE TEST INTERVALS j (VARIATION NO. 2) l i

i

.fi-

- - :.; :. @.f.- 3 :. : ; v. -r : : ,..:.._=_. =. : =-. = _. -45 ; ~__.. I r: 5-I-5 i~_I- %I5il 7-C

r..... _.

.-. ;.:.

..;.f

• " ' ~ ~ ~ ~

. ;. ~; C '_^

• _..... _. '. I

.:._.T_~_. ... '.TJ ~. Z.~. ~ ~~i . _..,e 4_ .~.. l .._.,s_..... y ,e.. ..t._. 1E-06 e i si i e i a } j/' s @' @e. f I 8 } t ,f C!i t g l ,,M, / I I !-- [ b l [ I I I/ 'I ~ ~ f. I l I ~8 / h. I I .l l l t- /I / i, i j,' i ,/ i -l IO / - Y- [l ' b.l. l l l> r (=4 e .m *,. . l.:... l 1 l g 'n j 1 lg ~~ 'T i . l .o t .g 1E-07'

• i

/ i i j / ~ l i e .I / t-I l' i

1.

=. L -i l-1 i I

/

= [

.i. l _ -

. ) 3=.,.=q _:= g..:.=='-j

. =1 ::?. ____ mq l

._.c. ; r_. =;.

cc.-f._.

.. _. f. f . _.=gn ;-- .: r .1. _u. 4., i 4= l p.. l g l-I i l - i i i l l: i .i i i l l-l l ..' I... g.. l .. s i TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) I l j l 1E-08 l -- l F -- I l i 1 2 3 4 5 6 7 8 9 10 11 12 8-29

1 [. l-10-os j 1 (. l 6 i o 4 . FIGURE'8.1-11 ANNUAL FREQUENCY OF DESTRUCTIVE OVERSPEED -l FOR VARICUS VALVE TEST INTERVALS I S I (VARIATION NO. -... ', 4 & 6).. _ _..

e.

. * ~

• y

t.; ;..

L.. +, ) -;6 Q 4:.g. { - j [, c_; -. i M. - 27 =1 ' ;i .1 I i. .a . :.r=: r.: :.. ---.r---- .c =. \\ +

u.. _ _. - --

r

2..==:

i ..y. l .. _, y _. a .w. l v '1E-06 ^ .r t s s m 8 t i I i/ l i -.L' I i i ""i l i \\ ! >i I' l-I f I Ic- - ] 7

• /

^ S} u g-g [ [. iw- ._ i f i + ,~ l fi j l. l ,O l .l._.... , - l. : l i _O q g. i. H /.

64

,a F. g so, l3 ~. ,i.~_ ! O ~ ~ - - ~ - ~ ~ - of. 1E-07 " +.a..,. i i t 1 L (_;. l. - i - l

.2._....

c. .. l. _.-_ i - l-l ,_ y.. _.- [ l _.. l'.. __;... 7.._.. z. l ..__...:. 2 :::.-

.=_.=__-.. -. ~.. 2_ =: :

i } l _c- = i j -j } }. l-l l I l. l. i l j i l i +- - l I ---l-I .l TIME IN..T.E..RV.AL. B..ET.W..E. EN.. T.. UR. BI..N_E__V..ALVE TESTS (MONTHS) l 3 m I.. ) [ g I... j t 1E-08i 1 2 3 4 5 6 7 8 9 10 11 12 8-30

1 I 1E-05 i t i i 6 l-p I i i I l l l l _. l FIGURE 8.1-12 ANDUAL FREQUENCY OF DESTRUCTIVE OVERSPEED j FOR VARIOUS VALVE TEST INTERVALS I (VARIATION No. 7 & 8) r; .: 4 - _ _ - - - 2.: --- -q:. r 3:7 .M ~ - - - - ..a : _.2 _r ......-- -:-~ ~ :...... . - ~ ~ ~... - ~..} ~b. f. ~ ~ - ^ ,_.. l 1E-06,^ -. o,-- ,s l5 l - L" I i i I !d l i I I =.. >~ l--- I = -l l l s Ia r lW _:_. [ I._ l-l t t. t }g f i l + :- $f .U l .+ .I y' j.+._.. f. ig lw _/'h

;h

::.

- ~ - o i

c. - -

l I - t

e.

L... ..r... e t. ,s i .L g J ,grm . _. b. _.E... _ i If b

o a:

.g 1E-07."' i t. .. - - =. i ..(.. .}.. l _l- } l J. p. . :- E g.. .._ _ [ - Q- ._:...]*_ _ ~ ... 4?~; t .2 .h.d_ :. _- _;-_.E =i..l i..

?; l..; ~

l ~ = {:. :_. y:-....._ : {_=...: -f.-.. _ _.._. l -f.

.... :. =

l

}.

.( j

e..

j j ;_ -- F : -- j l l l l l l i l

_.. b t r-

'l f .g i __. i l l l l l l .l } TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS). i l I 1E-08 ~ l l l l__ [ __ I 1 2 3 4 5 6 7 8 9 10 11 12 8-31

f.,

b FIGURE 8.2-1 CONDITIONAL PROBABILITY OF MISSILE EJECTION .GIVEN THE OCCURRENCE OF DESIGN OVERSPEED , TURKEY POINT 4 (Reference 2) a,c 4 I = 2 ) L.P. ROTOR INSPECTION INTERVAL [ YEARS) 8-32

FIGURE 8.2-2 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE OCCURRENCE OF DESIGN OVERSPEED INDIAN POINT 3 (Reference 5) a,c 4 = 8 i L.P. ROTOR INSPECTION INTERVAL (YEARS) 8-33

i l FIGURE 8.2-3 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE OCCURRENCE OF DESIGN.OVERSPEED DIABID CANYON 1 (Reference 6) a,c I k i i r I 4 l i 1 5g M 4,a i j i l I l 1 1 L.P. ROTOR INSPICTION INTERVAL [ YEARS] 1 8-34 1 l l l I 1

l. l FIGURE 8.2-4 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE OCCURRENCE OF DESIGN _OVERSPEED DIABID CANYON 2 (Reference 7) a,c g l ? 2 E L.P. ROTOR INSPECTION INTERVAL (YEARS) 8-35

l ] l I FIGURE 8.2-5 CONDITIONAL PROBABILITY OF MISSILE EJECTION -s i GIVEN THE OCCURRENCE OF DESIGN OVERSPEED { DIABLO CANYON (Reference 8) a,c i 1 1 9 M W 2o i L.P. ROTOR INSPECTION INTERVAL (YEARS) l 8-36 1

FIGURE 8.2-6 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE OCCURRENCE OF DESIGN OVERSPEED SALEM.1 & 2.(Referencee 9_& 10) ,, e 8 i I i l O 3 E 2 E e L.P. ROTOR INSPECTION INTERVAL (YEARS) 8-37

[.- i 1 l, FIGURE 8.2-7 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE OCCURRENCE.OF DESIGN OVERSPEED MAINE YANKEE (Reference 11) a,c l i 1 i 1 I l I HA N i &<mO i k l L.P. ROTOR INSPECTION INTERVE {gy 8-38

l FIGURE 8.2-8 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE OCCURRENCE OF DESIGN OVERSPEED PALISADES (Reference 12) a,c O i = 2 I E L.P. ROTOR INSPECTION INTERVAL (YEARS) 8-39

l FIGURE 8.2-9 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE OCCURRENCE OF DESIGN OVERSPEED-PRAIRIE ISLAND 1 & 2 (Reference 13 & 14) a,c I l i J i NA h 1 L.P. ROTOR INSPECTION INTERVAL (YEARS) 8-40

s' e ps i FIGURE 8.2-10 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE OCCURRENCE OF DESIGN OVERSPEED KEWAUNEE (Reference 15) a,c i l 1 1 I i e l l 3 i L.P. BOTOR INSPECTION INTERVAL [ YEARS) I 8-41

FIGURE 8.2-11 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE OCCURRENCE OF DESIGN OVERSPEED POINT BEACH 1 & 2 (References 17 & 18) a,c e 4 a 8 L.P. ROTOR INSPECTION INTERVAL (YEARS) 8-42

FIGURE 8.2-12 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE OCCURRENCE OF DESIGN OVERSPEED ST. LUCIE 1 & 2 (Reference 19 & 20) a,c N 3 2 2 1 ) L.P. ROTOR INSPECTION INTERVAL [YEARSj 8-43

n i 4 4 \\ , FIGURE 8.2-13 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE' OCCURRENCE OF DESIGN OVERSPEED ST. LUCIE (Reference 21) a,c I i i E am L.P. ROTOR INSPECTION INTERVAL [ YEARS) 8-44

I 4 IIGURE 8.2-14 CONDITIONAL PROBABILITY OF MISSILE EJECTION GIVEN THE' OCCURRENCE OF DESIGN OVERSPEED SHEARON HARRIS (Reference 22) l u i0 1 i L.P. ROTOR INSPECTION INTERVAL [ YEARS) l 8-45

~ l o FIGURE 8.3-1 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE TO OVERSPEED l TURKEY POINT 3 (Reference 1) a,c L M I i e d-Sl' E TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-46

I FIGURE 8.3-2 TOTAL ANNUAL. PROBABILITY OF TURBINE MISSILE ~! EJECTION DUE TO OVERSPEED TURKEY POINT 4 (Reference 2) e,c i l i i l e M i 1 3 H GD I E T M INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-47

l FIGURE 8.3-3 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE l EJECTION DUE TO OVERSPEED 1 TURKEY POINT 4 (Reference 3) a,c ~ I e N 8I C 3 E 2 TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-48 e

6 6 , )' j ' , ' 'r / I, l ..(' FIGURE 8.3-4 TOTAL ANNUAL PROBABILITY OF TURBINE MID3ILT: EJECTION DUE TO OVERSPEED. t ' f

js -{$

._ INDIAN FOINT 2-(Reference 4) a,c 1 'jj_ e [ m M i %s k r d .i-m ./< 4 .!,'i R D l' \\ .i l e TIME INTERVAL BETWEEN TURBINE VALVE ESTS (MONTHS) 8-49 i

7 .r ( _ >fr ". B..yP{ b;. .jflf a /g FIGURE,C.,3-5 ' TOTAL ANNUAL PROEALILITY OF TURBINE MISSILE x j(L ' EJECTION DUE TO-OVERSPEED c. i, ~ ,. INDIAN POINT 3 (Refarence 5) a,c u l-1. w [ e l ./g { ,l ./ e '( ( O.

l U

.i. U 1r w M4 a ^ E ' (, ' f*;f .,e '), 7' TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-50

.a 1 .y, '/ .,\\. '/. 1 , i ~ gg s l,

+

.) FIGURE 8.3-6 ' T7 TALL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE'To OVERSPEED DIABLO CANYON 1 (Reference 6) a,e l l I )) 3 g l a 1-I

(

l c) ] l t '} t ) ) f. h .y I -) 9 k f . I Y T / 1. c, 2 l u i' R ./ I / 0 rt '6 1 ) s ,f .pt t ' \\. y .> 1 ,1 -,1 Y / t i t -l = amm, TIE INTERVAL BETWEEN TURBINE VALVE TE3T6',(MONTHS) ) l i s-s1 l s

i

FIGURE 8.3-7 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE TO OVERSPEED DIABIO CANYON 2 (Reference 7) a,c h' t 4 s i seet 8 x 3-i TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-52

FIGURE 8.3-8 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE To OVERSPEED' DIABLO CANYON (Reference 8) a,c l \\ O 9 I 9% l s i 1 3 I a 3 ) l TIME INTERVAL BENED TURBINE VALVE TESTS (MONTHS) I f s-53

\\ L FIGURE 8.3-9 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE TO OVERSPEED-SALEM 1 (Reference 9) e,c I s i. 4 6 M M ii U E 2 E l l TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-54 8

FIGURE 8.3-10 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE To OVERSPEED SALEM 2 (Reference 10) a,c e i M E 2 1 I TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-55

l FIGURE 8.3-11 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE i EJECTION DUE TO OVERSPEED MAINE YANKEE (Reference 11) a,c '+-m l 7 l M M i I. 5 i 2 2 I 1 ) l l l l TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-56 1

I i l l FIGURE 8.3-12 TOTAL ANNUAL PROBABILITY OF TURBINE MISSII2 L EJECTION DUE~To ~0VERSPEED l PALISADES (Reference 12) a,c 1 o 1 9 M N 4 I l-U M S3 I TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-57 i l

FIGURE 8.3-13 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE TO OVERSPEED l PRAIRIE ISLAND 1 (Reference 13) a,c l 8 M E 2 TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-58

I l . FIGURE 8.3-14 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE TO. OVERSPEED PRAIRIE ISLAND 2 (Reference 14) a,c l 9 l kI l M. A E l l I l I l TIME INTERVAL BETWEEN TURBINE VALVE TESTS (NONTHS) 8-59 i

I = f' , FIGURE 8.3-15 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE TO OVERSPEED KEWAUNEE (Reference'15) a,c f n Mi i 3 2 a E i i h l 1 l i TIE INmVAL BMEEN TURBINE VALVE TESTS (MONTHS) 8-60 b

.f-4 FIGURE 8.3-16 . TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION.DUE TO OVERSPEED ROBINSON 2 (Reference 16) ,, e 4 4W8% 3 2 8 E T M M ERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-61

FIGURE 8.3-17 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE TO OVERSPEED-POINT BEACH 1 (Reference 17) a,c t e. 8 O M MIi b Na E 2 TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-62 m________

. FIGURE 8.3-18 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE '~ EJECTION DUE TO OVERSPEED POINT BEACH 2 (Reference 18) a,c k n b .I i 5 .g. g. E l l TIME INTERVAL BETwEEN TURBINE VALVE TESTS (MONTHS) 8-63 ) )

FIGURE 8.3-19 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE To QVERSPEED -) ST. LUCIE 1- (Reference 19) a,c 4 S N na E 2 TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-64

y I, FIGURE 8.3-20 TOTAL ANNUAL PROBABILITY OF TURBINE MIS 5ILE EJECTION DUE TO OVERSPEED ST. LUCIE 2 (Referarica 20) a,c l l l l l l n 8 3 m l ll l fi i 1 TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) f 8-65 f

l 1 l FIGURE 8.3-21 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE To OVERSPEED ST. LUCIE (Reference 21) e,c l s 1 l l l I O N 8i l TIME INTERVAL BETWEEN TURBINE VALVE TESTS (MONTHS) 8-66 4 l

FIGURE 8.3-22 TOTAL ANNUAL PROBABILITY OF TURBINE MISSILE EJECTION DUE TO OVERSPEED SHEARON HARRIS (Reference 22) a,c i } i 4 i e e a m 3o k N INERVAL BENEEN TURBINE VALVE TESIS (MONTHS) 8-67

9.0 REFERENCES

1. " Likelihood and Consequences of Turbine Overspeed at the Point Beach Nuclear Plant", WCAP-7525, Westinghouse Nuclear Energy Systems, June, 1970. 2. " Analysis of the Probability of the Generation and Strike of Missiles from a Nuclear Turbine'" Westinghouse Steam Turbine Division, March, 1974 (RevisedJuly1,1987). 3. " Evaluation of Impact of Reduced Testing of Turbine Valves," WCAP-10161, Westinghouse Nuclear Energy Systems, September, 1982 (PROPRIETARY]. 4. " Analysis of the Probability of a Nuclear Turbine Reaching Destructive Overspeed," WSTG-3-P-A, Westinghouse Steam Turbine Generator Division, July, 1984 (Revised July 1, 1987) (PROPRIETARY). 5. " Procedures for Estimating the Probability of Steam Turbine Dise Rupture From Stress Corrosion Cracking," WSTG-1-PA, Westinghouse Steam Turbine Generator Division, May, 1981 (Revised July 1, 1987) (PROPRIETARY). 6. U.S. Nuclear Regulatory Commission Letter from C. E. Rossi to J. A. Martin of Westinghouse Electric Corp., dated February 2, 1987. j l i 7. " Development of Transient Initiating Event Frequencies for Use in j Probabilistic Risk Assessments," NUREG/CR-3862, U.S. Nuclear Regulatory l Commission, May, 1985. l 8. " Zion Probabilistic Safety Study," Commonwealth Edison Company, 1981. j 9. "IEEE Guide to the Collection and Presentation of Reliability Data for Nuclear Power Generating Stations," IEEE Std. 500-1984, IEEE Power Engineering Society.

10. McCormick, N. J : Reliability and Risk Analysis, Academic Press, New York, 1981.

I 0298x:lo/090887 9-1 i

'11.-Swain, A.D. 'and H. E. Guttman:' Handbook of Human Re' liability Analysis with Emphasis on Nuclear Power Plant Applications", NUREG/CR-1278, August, 1983.

12. " Classification and Analysis of Reactor Operating Experience Involving Dependent Events," EPRI NP-3967, Interim Report, June,1985.

13. " Analysis of the Probability of the Generation of Missiles from Fully Integral Nuclear Low Pressure Rotors," WSTG-4-P, Westinghouse Steam Turbine Generator Division, October, 1984 (PROPRIETARY).

14. U.S. Nuclear Regulatory Commission Letter from J. D. Neighbors to J. C.

Brons of Power Authority of.the State of New York, Docket No. 50-286, dated February 26, 1987.

15. " Criteria for Low Pressure Nuclear Turbine Disc Inspection," MSTG-1-P, Westinghouse Steam Turbine Generator Division, June, 1981 (PROPRIETARY).

0298x:1D/090887 9-2

4 WCAP-11529 PROBASILISTIC EVALUATION OF REDUCTION-IN TURBINE VALVE TEST FREQUENCY APPENDIX A INDEX TO CONTROL DIL DIAGRAMS

FIGURE TITLE PAGE

' NUMBER NUMBER A-1 TURKEY. POINT UNITS 3 & 4 A-1 A-2 INDIAN POINT UNITS 2 & 3 A-3 ~ A-3 DIABLO CANYON UNITS 1 & 2 A-5 A-4 SALEM UNITS 1 & 2 A-6 A-5 MAINE YANKEE A-7 A-6 PALISADES A-8 A-7 PRAIRIE ISLAND UNITS 1 & 2 A-9 A-8 KEWAUNEE A-10 A-9 ROBINSON UNIT 2 A-11 'A-10 POINT BEACH UNITS 1 & 2 A-12 A-11 ST. LUCIE UNITS 1 & 2 A-14 A SHEARON HARRIS UNITS 1 & 2 A-15 A-i 0298x:10/081787

cy. cc a t e '9 f f 0 <1 FIGURE A-1 SHEET 1 OF 2 CONTROL OIL DIAGRAM TURKEY POINT UNITS 3 & 4 PAGE A-1

1 S,C 5 / e FIGURE A-1 SHEET 2 OF CONTROL OIL DIAGRAM TURKEY POINT UNITS 3 &4 PAGE A-2

-T,,. 5 9 - ' R,' C ~ 4 4 e \\ FIGURE A-2 SHEET 1 OF 2 CONTROL OIL DIAGRAM INDIAN POINT UNITS 2 & '3 PAGE A-3

soc I 1 \\ { l e FIGURE A-2 SHEET 2 OF CONTROL OIL DIAGRAM INDIAN POINT UNITS 2 & 3 PAGE A-4

e

p r

O,C t 1 O e O

• r 1

t 9 l 6 i ) k I i FIGURE A-3 CONTROL OIL DIAGRAM DIABLO CANYON UNITS 1 & 2 PAGE A-5

_-_-______.___-_____.-___7-._.- h soc s FIGURE A-4 CONTROL OIL DIAGRAM SALEM UNITS 1 & 2 PAGE A-6

,-y- \\, A orc / l / ) / i Gb i ,ei .f h,, \\ .'/ f r .I / .,i i / / ,i s q i t l i g r 4J t \\ y 1 / / l 'b FIGURE A-5 l CONTROL OIL DIAGRAM l MAINE YANKEE g PAGE A-7 )

e i .c. j i a,c i s / 't jj, .,i+ I),. s 'j {p- ,/, I I e s ,/ ,r c' J' .(; -l \\ / s t i ,.i I .f g f i I FIG M A.S i CONTROL OIL DIAgggg s PALISADES PAGE A-g

.a + l Co c q t 39 i i ~ t l l s ) e s i ?"IGURE A-7 CONTROL OIL DIAGRAM PRAIRIE ISI.AND UNITS 1 & 2 R7CE A-9

I i I et J 6 l t

t. :.

I ! a-( FIGURE A-8 CONTROL OIL DIAGRAM KEWAUNEE PAGE A-10 ) l i m.___.____ l

p; > t,- p, c,e

r 4

l' i s I li j FIGURE A-9 CONTROL OIL DIAGRAM ROBINSON UNIT 2 PAGE A-11 l

7 j c,e 1 1

I

.) I 'I .q j 3 I l ? FIGURE A-10 SHEET 1 0-CONTROL OIL DIAGRAM POINT BEACH UNITS 1 & 2 PAGE A-12

I I-l.-p 'GrC (. 1 t, . 1, a e t 1 I l 1 ,1 FIGURE A-10 SHEET 2 OF 2 I CONTROL OIL DIAGRAM POINT BEACH UNITS 1 & 2 PAGE A-13

-p i i Or c l s FIGURE A-11 CONTROL OIL DIAGRAM ST. LUCIE UNITS 1 8: 2 PAGE A-14

-_-.------.,---..n-,- A 4..- 9 0,C I l l 4 FIGURE A-12 SHEET 1 OF 3 CONTROL OIL DIAGRAM SHEARON HARRIS UNITS 1 & 2 PAGE A-15

Or c s g, FIGURE A-12 SHEET 2 O' CONTROL OIL DIAGRAM SHEARON HARRIS UNITS 1 & 2 PAGE A-16

c k Orc l ,b7%; i e ik -f,?u 1 -- h l l I t i FIGURE A-12 SHEET 3 OF ~ CONTROL OIL DIAGRAM SHEARON HARRIS UNITS 1 & : PAGE A-17

a .( l WCAP-11529 PROBABILISTIC EVALUATION OF REDUCTION IN TURBINE VALVE TEST FREQUENCY ' 5 APPENDIX B INDEX TO FAULT TREE DIAGRAMS FIGURE VARIATION OVERSPEED PAGE NUMBER NUMBER CONDITION NUMBER B-1-1 1 DESIGN OVERSPEED B-1 B-1-2 INTERMEDIATE OVERSPEED B-2 B-1-3 DESTRUCTIVE OVERSPEED B-3 i B-2-1 2 (NOT REQUIRED) L B-2-2 INTERMEDIATE OVERSPEED B-4 B-2-3 DESTRUCTIVE OVERSPEED B-5 B-3-1 3 DESIGN OVERSPEED B-6 B-3-2 INTERMEDIATE OVERSPEED B-7 B-3-3 DESTRUCTIVE OVERSPEED B-8 B-4-1 4 DESIGN OVERSPEED B-9 B-4-2 INTERMEDIATE OVERSPEED B-10 B-4-3 DESTRUCTIVE OVERSPEED B-11 B-6-1 6 (NOT REQUIRED) B-6-2 INTERMEDIATE OVERSPEED B-12 B-6-3 DESTRUCTIVE OVERSPEED B-13 B-7-1 7 DESIGN OVERSPEED B-14 B-7-2 INTERMEDIATE OVERSPEED B-15 B-7-3 DESTRUCTIVE OVERSPEED B-16 ^2sacio/ost7a7 J

i t WCAP-11529 PROBABILISTIC EVALUATION OF-REDUCTION IN TURBINE VALVE TEST FREQUENCY APPENDIX B INDEX TO FAULT TREE DIAGRAMS (Continued) FIGURE VARIATION OVERSPEED PAGE NUMBER NUMBER-CONDITION NUMBER B-8-1 8 DESIGN OVERSPEED B-17' B-8-2. INTERMEDIATE OVERSPEED B-18 B-8-3 DESTRUCTIVE OVERSPEED B-19 FAILURE OF EXTRACTION B-20 B-9 NONRETURN VALVE SYSTEM NOTE: VARIATION 1 = TURKEY POINT L, HITS 3 & 4 VARIATION 2 = INDIAN POINT UNITS 2 & 3 VARIATION 3 = DIABLO CANYON UNITS 1 & 2 SALEM UNITS 1 & 2 MAINE YANKEE PALISADES VARIATION 4 = PRAIRIE ISLAND UNITS 1 & 2 KEWAUNEE ROBINSON UNIT 1 VARIATION 6 = POINT BEACH UNITS 1 & 2 VARIATION 7 = ST. LUCIE UNITS 1 & 2 VARIATION 8 = SHEARON HARRIS UNITS 1 & 2 l L B-ii l-0298x:10/081787 _______ -..__________ -}}