ML003683085

Evaluation of Air-Operated Valves at U.S. Light-Water Reactors

ML003683085
Person / Time
Issue date:	02/11/2000
From:	Rossi C NRC/RES/DSARE
To:	Beasley K, Chexal V, Coleman M, Cortis K, Liberatori L, Lochbaum D, Modeen D, Phelps R, Pieknik P, Jeffrey Riley, Subalusky W, Swanger F, Torok R, Vine G, Warren W ABB-CE Owners Group, B & W Owners Group, BWR Owners Group, Combustion Engineering Owners Group, Consolidated Edison Co of New York, Electric Power Research Institute, Institute of Nuclear Power Operations (INPO), Nuclear Energy Institute, Union of Concerned Scientists, Westinghouse Owners Group
Ornstein H
References
GL-89-010
Download: ML003683085 (33)

Text

February 11, 2000

Dear Colleague:

The final report, Evaluation of Air-Operated Valves at U.S. Light-Water Reactors, is enclosed for your information. The study was initiated to collect information to form the basis for determining if additional regulatory attention is needed to address air-operated valves (AOVs).

Plant visits were conducted to obtain information about AOV operating experience and AOV maintenance and support activities. Discussions of operating experience focused on the root causes of AOV failures and corrective actions. Features of the AOV programs that were discussed included identification of risk-important AOVs, design margins, design verification, diagnostic testing, maintenance practices, ageing, participation in industry AOV activities, and parallelisms between AOV and motor-operated valve experience and activities.

The major safety concern of this study from a risk perspective is the simultaneous common-cause failure of AOVs, which disable redundant trains of a safety system. The scenario of most concern is that during an accident or transient, AOVs in redundant trains of a safety system fail when subjected to pressure, temperature, and flow conditions different from those seen during normal operation or testing. Similar to the situation with motor-operated valves which led to issuance of Generic Letter 89-10, Safety-Related Motor-Operated Valve Testing and Surveillance - 10 CFR 50.54(f), June 28, 1989, errors in design parameters, such as valve factors, and other design, manufacturing, or maintenance errors could result in lower than expected AOV valve operator force or greater than expected valve friction. Normal testing or routine operation of these valves, if performed under pressure, temperature, flow conditions different from those expected during an accident or transient, may not reflect the actual capability of the valve to perform during an accident or transient.

A draft of this report was provided to cognizant individuals within the NRC and to industry for peer review in June, 1999. All of the peer review comments received were considered in the finalization of the report.

The implementation of effective AOV programs incorporating the use of analysis, diagnostic testing, and lessons learned from operating experience, as outlined in the study, can minimize the likelihood of common-cause AOV failures resulting in risk significant events.

Sincerely,

/RA/

Charles E. Rossi, Director Division of Systems Analysis and Regulatory Effectiveness Office of Nuclear Regulatory Research

Enclosure:

As stated

February 11, 2000

Dear Colleague:

The final report, Evaluation of Air-Operated Valves at U.S. Light-Water Reactors, is enclosed for your information. The study was initiated to collect information to form the basis for determining if additional regulatory attention is needed to address air-operated valves (AOVs).

Plant visits were conducted to obtain information about AOV operating experience and AOV maintenance and support activities. Discussions of operating experience focused on the root causes of AOV failures and corrective actions. Features of the AOV programs that were discussed included identification of risk-important AOVs, design margins, design verification, diagnostic testing, maintenance practices, ageing, participation in industry AOV activities, and parallelisms between AOV and motor-operated valve experience and activities.

The major safety concern of this study from a risk perspective is the simultaneous common-cause failure of AOVs, which disable redundant trains of a safety system. The scenario of most concern is that during an accident or transient, AOVs in redundant trains of a safety system fail when subjected to pressure, temperature, and flow conditions different from those seen during normal operation or testing. Similar to the situation with motor-operated valves which led to issuance of Generic Letter 89-10, Safety-Related Motor-Operated Valve Testing and Surveillance - 10 CFR 50.54(f), June 28, 1989, errors in design parameters, such as valve factors, and other design, manufacturing, or maintenance errors could result in lower than expected AOV valve operator force or greater than expected valve friction. Normal testing or routine operation of these valves, if performed under pressure, temperature, flow conditions different from those expected during an accident or transient, may not reflect the actual capability of the valve to perform during an accident or transient.

A draft of this report was provided to cognizant individuals within the NRC and to industry for peer review in June, 1999. All of the peer review comments received were considered in the finalization of the report.

The implementation of effective AOV programs incorporating the use of analysis, diagnostic testing, and lessons learned from operating experience, as outlined in the study, can minimize the likelihood of common-cause AOV failures resulting in risk significant events.

Sincerely,

/RA/

Charles E. Rossi, Director Division of Systems Analysis and Regulatory Effectiveness Office of Nuclear Regulatory Research

Enclosure:

As stated Identical letters sent to: See attached list Distribution w/encl.: See attached list C:\1externalcover.wpd

• See previous concurrence:

To receive a copy of this document, indicate in the box: "C" = Copy without attachment/enclosure "E" = Copy with attachment/enclosure "N" = No copy OFFICE REAHFB C REAHFB C C:REAHFB C D:DSARE C NAME HOrnstein:mmk GLanik JRosenthal CRossi DATE 01/20/00* 01/20/00* 01/20/00* 02/11/00*

OFFICIAL RECORD COPY Template= RES-005 Accession Number RES File Code RES-7B-1

2 Letter dated: February 11, 2000 Identical letters sent to:

Mr. David Modeen Mr. Raymond C. Torok, Project Manager Director of Engineering Nuclear Power Group Nuclear Energy Institute Electric Power Research Institute 1776 I Street NW, Suite 400 P.O. Box 10412 Washington, DC 20006-37008 Palo Alto, CA 94303 Mr. Jim Riley Mr. Gary L. Vine AOV Project Manager Senior Washington Representative Nuclear Energy Institute Electric Power Research Institute 1776 I Street NW, Suite 400 2000 L Street NW, Suite 805 Washington, DC 20006-3708 Washington, DC 20036 Mr. Mark Coleman, Chairman Mr. Louis Liberatori, Chairman BWR Owners Group, Westinghouse Owners Group Joint Owners Group 6 Air-Operated Valves Consolidated Edison Co. of New York, Inc.

Hope Creek and Salem Plants Indian Point Nuclear Station P.O. Box 236, Mail Code X07 Broadway and Bleakley Avenues Hancocks Bridge, NJ 08038 Buchanan, NY 10511-1099 Mr. Phillip Pieknik, Chairman Mr. Ralph Phelps, Chairman Westinghouse Owners Group ABB-CE Owners Group Joint Owners Group 6 Air-Operated Valves Omaha Public Power District STP Nuclear Operating Company Ft. Calhoun Nuclear Station South Texas Project P.O. Box 399 P.O. Box 289 Ft. Calhoun, NE 68023-0399 Wadsworth, TX 77483 Mr. Kevin Cortis, Chairman Mr. W. Glenn Warren, Chairman Combustion Engineering Owners Group BWR Owners Group Joint Owners Group 6 Air-Operated Valves Southern Nuclear Operating Company Northeast Utilities Mail Code B052 Millstone Station 40 Iverness Center Parkway Rope Ferry Road Birmingham, AL 35201 Route 156 Waterford, CT 06385 Mr. Frank L. Swanger, Chairman B&W Owners Group Mr. Ken Beasley, Chairman Toledo Edison Company B&W Owners Group Davis Besse Nuclear Power Station Joint Owners Group 6 Air-Operated Valves Mail Stop 3105 Duke Power Company 5501 North State Route #2 526 South Church Street Oak Harbor, OH 43449 Charlotte, NC 28202 Mr. William T. Subalusky Mr. David A. Lochbaum Institute of Nuclear Power Operations Union of Concerned Scientists 700 Galleria Parkway 1616 P Street, NW, suite 310 Atlanta, GA 30339-5957 Washington, DC 20036-1495 Mr. V.K. Chexal, Director cc w/attachment:

Nuclear Safety Analysis Center Pat Lewis, INPO Electric Power Research Institute Debbie Queener, NOAC P.O. Box 10412 Palo Alto, CA 94303

3 Letter dated: February 11, 2000 Distribution w/att.:

Public File Center Distribution w/o att.:

REAHFB R/F DSARE R/F CPaperiello, DEDMRS FMiraglia, DEDR MTschiltz, OEDO WOtt, OEDO RSavio, ACRS SCollins, NRR BSheron, NRR RWessman, NRR AThadani, RES MFederline, RES REmrit, RES SRubin, RES PNorian, RES

TO BE PUBLISHED AS NUREG-1275, VOLUME 13 EVALUATION OF AIR-OPERATED VALVES AT U.S. LIGHT-WATER REACTORS February 2000 Prepared by:

Dr. Harold L. Ornstein Regulatory Effectiveness Assessment and Human Factors Branch Division of Systems Analysis and Regulatory Effectiveness Office of Nuclear Regulatory Research

CONTENTS ABBREVIATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v EXECUTIVE

SUMMARY

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii 1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2 USE AND APPLICATION OF AIR-OPERATED VALVES . . . . . . . . . . . . . . . . . . . . . . . 1 3 AIR-OPERATED VALVE ISSUES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3.1 Design Capability Versus Operability and Operational Readiness . . . . . . . . . . . 4 3.2 Instrument Air Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4 SITE VISITS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 5 OPERATING EXPERIENCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 5.1 Selected Common-Cause Air-Operated Valve Events . . . . . . . . . . . . . . . . . . . . 8 5.2 Air-Operated Valve Events at Sites Visited . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 5.2.1 Air-Operated Valve Event Attributed To Poor Air System Quality . . . . . 13 5.2.2 Air-Operated Valve Failures At Sites Visited Not Attributed to Poor Air System Quality . . . . . . . . . . . . . . . . . . . . . . . . . . 13 5.2.3 Design Errors Having Potential for AOV Common-Cause Failures At Sites Visited . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 6 INDUSTRY INITIATIVES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 7 AIR-OPERATED VALVE FAILURES AND RISK . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 7.1 Simultaneous Failure of Air-Operated Valves Which Disable Safety Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 7.2 Sensitivity of Core Damage Frequency to Air-Operated Valve Failures . . . . . . 18 7.3 Important or Risk Significant AOVs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 7.4 Accident Sequence Precursors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 8 FINDINGS AND CONCLUSIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 8.1 AOV Program Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 8.2 Air-Operated Valve Performance Under Accident or Transient Conditions . . . 20 8.3 Air-Operated Valve Common-Cause Failure Experience . . . . . . . . . . . . . . . . . 20 8.4 Air-Operated Valve Risk Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 9 RECOMMENDATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 10 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 iii

CONTENTS (cont.)

TABLES 1 Populations of Air-Operated Valves in Plants Visited . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2 Plants Visited . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3 Status of Air-Operated Valve Programs at Time of Site Visits . . . . . . . . . . . . . . . . . . . 6 4 Risk Important Air-Operated Valves at the Monticello Plant . . . . . . . . . . . . . . . . . . . . . 16 5 Systems, Functions or Components Having Risk-Significant Air-Operated Valves at Plants Visited . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 iv

ABBREVIATIONS ADV atmospheric dump valve AOV air-operated valve ASME American Society of Mechanical Engineers ASP accident sequence precursor AUG Air-Operated Valve Users Group BWR boiling-water reactor CCDP conditional core damage probability CCF common-cause failure CDF core damage frequency EPRI Electric Power Research Institute (Nuclear Maintenance Applications Center)

GL Generic Letter HOV hydraulic-operated valve IN Information Notice INEEL Idaho National Engineering and Environmental Laboratory IPE individual plant evaluation IPEEE individual plant evaluation of external events ISA Instrument Society of America JOG-AOV Joint Owners Group on Air-Operated Valves LER licensee event report LWR light-water reactor MOV motor-operated valve MUG Motor-Operated Valve Users Group NEI Nuclear Energy Institute PORV power-operated relief valve PSA probabilistic safety assessment PWR pressurized-water reactor RES Nuclear Regulatory Research, Office of (NRC)

RHR residual heat removal SOV solenoid-operated valve TEP top event prevention v

EXECUTIVE

SUMMARY

This study was conducted by the Nuclear Regulatory Commissions Office of Nuclear Regulatory Research to collect information to form the basis for determining if additional regulatory attention is needed to address air-operated valves (AOVs). This report and its companion document, Idaho National Engineering and Environmental Laboratory report NUREG/CR-6654, A Study of Air-Operated Valves in U.S. Nuclear Power Plants, present the results of a comprehensive review of AOV operating experience and visits to 7 U.S. light water reactor sites at which there are 11 operating reactors.

Plant visits were conducted to obtain information about AOV operating experience and AOV maintenance and support activities. Discussions of operating experience focused on the root causes of AOV failures and corrective actions. Features of the AOV programs that were discussed included identification of risk-important AOVs, design margins, design verification, diagnostic testing, maintenance practices, ageing, participation in industry AOV activities, and parallelisms between AOV and motor-operated valve experience and activities.

Each plant visited had an AOV program. The licensees AOV programs identified, categorized, and prioritized the plants AOV populations in order to determine the level of effort that needed to be focused on AOV analysis, testing, and maintenance activities. Recognizing the application of the single failure criterion and defense in depth, failure of a single AOV would generally not be a cause of concern. However, all licensees identified important AOVs based on a variety of methods including plant specific probabilistic risk assessments, individual plant examinations, or maintenance rule expert panel reviews. Many licensees identified individual AOVs whose failure would result in increased risk as indicated by high risk achievement worth or high Fussell Vesely risk rankings.

The major safety concern of this study from a risk perspective is the simultaneous common-cause failure of AOVs, which disable redundant trains of a safety system. The scenario of most concern is that during an accident or transient, AOVs in redundant trains of a safety system fail when subjected to pressure, temperature, and flow conditions different from those seen during normal operation or testing. Similar to the situation with MOVs which led to issuance of Generic Letter 89-10, errors in design parameters, such as valve factors, and other design, manufacturing, or maintenance errors could result in lower than expected AOV valve operator force or greater than expected valve friction. Normal testing or routine operation of these valves, if performed under pressure, temperature, flow conditions different from those expected during an accident or transient, may not reflect the actual capability of the valve to perform during an accident or transient.

Several instances from operating experience are noted in this study where AOVs were shown to be unable to operate under the conditions expected during an accident or transient. These were usually found through diagnostic testing methods similar to those utilized to verify MOV operability in response to Generic Letter 89-10 and its supplements. Some failed to operate in real events. Current inservice testing and technical specification operability tests may not assure AOV capability for pressure and flow conditions during an accident or transient.

Another concern is the potential for simultaneous common-cause failure of two or more AOVs in important safety systems due to contamination from the pneumatic system or from fabrication vii

and maintenance activities. Rust, dirt, or water in the air system can affect many valves.

Fabrication and maintenance activities can introduce excessive thread locker or other contaminants which cause sticking or binding. Degradation of elastomers have resulted in common-cause failures. AOV failures from these conditions are expected to be more random than the design errors and fabrication errors described above, but could still have the impact of disabling multiple trains of safety systems.

As discussed in the study, some licensees found that certain AOVs had high risk achievement worth and/or Fussell Vesely risk rankings. Table 6 of NUREG/CR-6654 includes the risk achievement worth values for AOVs that were calculated by licensees at three plants. These calculations showed that, in some cases, the risk achievement worth could increase by one or two orders of magnitude as a result of CCFs. Risk achievement worth for common-cause AOV failures at those three plants ranged from slightly over 1 to 202.

The implementation of an effective AOV program, incorporating the use of analysis, diagnostic testing, and lessons learned from operating experience, can minimize the likelihood of AOV failures resulting in risk significant events. Such a program would:

• Identify safety related AOVs which are normally in a non-safety position and are expected to move to their safety position during accidents or transients. (These will subsequently be referred to as safety related active AOVs.)

• Identify safety related active AOVs which contribute the most to risk should they fail to operate, using plant-specific application of appropriate risk-ranking methodologies. For those valves with unconfirmed design margin or diagnostic testing, risk calculations which appropriately consider failures of redundant valves in both trains of a system may be appropriate.

• Establish confidence that risk significant safety related active AOVs will operate as required, subject to the actual pressures, temperatures, and flows during transient and accident conditions, by application of accepted and verified analysis or diagnostic testing methods. Assure continued operability of these valves through periodic testing.

• Establish operations and maintenance practices which prevent introduction of contaminants to the pneumatic system or to the valves and their sub-components and replace aging elastomers as appropriate.

Cooperation between the NRC and industry to develop the guidance for AOV programs would facilitate and optimize the implementation of these programs.

viii

1 INTRODUCTION To assess the status of air-operated valves (AOVs) at U.S. light-water reactors (LWRs), Office of Nuclear Reactor Research (RES) and the Idaho National Engineering and Environmental Laboratory (INEEL) engineers visited 7 reactor sites which house 11 operating U.S. LWRs representing about 10 percent of the currently operating U.S. LWRs. The site visits provided an important sampling of the AOV activities and programs at U.S. LWR plants. In addition, RES staff had discussions with engineers at many other U.S. LWR facilities and with members of nuclear industry groups such as the Air-Operated Valve Users Group (AUG), Motor-Operated Valve Users Group (MUG), Joint Owners Group on Air-Operated Valves (JOG-AOV), Nuclear Energy Institute (NEI), American Society of Mechanical Engineers (ASME) Operating and Maintenance Working Groups on AOVs and hydraulic-operated valves (HOVs) [ASME O&M 19], and motor-operated valves (MOVs) [ASME O&M 8].

The information gathered from those visits and discussions is an important part of this study.

The focus of this study is on AOVs which could affect plant safety systems and as such are within the purview of NRCs regulations.

2 USE AND APPLICATION OF AIR-OPERATED VALVES AOVs are used in all U.S. LWRs. They are used in a wide variety of applications. Some AOVs perform important functions in safety and nonsafety-related systems which could affect initiating event frequencies, accident mitigation, and radiological releases.

An AOV is a complex system comprised of three major components: the actuator, the valve body, and the controller. Each of the major components includes numerous piece-parts such as diaphragms, springs, limit switches, solenoid operators, positioners, current/pressure (i/p) converters, voltage/pressure (e/p) converters, accumulators, o-rings, lubricants, filters, regulators, yokes, bonnets, and seals. Electricity is required for control and air systems are required to provide motive power.

Table 1 contains a listing of the AOV populations at the 7 sites (11 plants) visited during this study. The licensees visited stated that their plants had between 418 and 2800 AOVs. Each of the plants visited categorized between 42 and 410 AOVs as safety-related, high safety-significance, important-to-safety, or a combination thereof. The category designations in the table vary from plant-to-plant. The use of the categories for each plant is explained with the entry. The remaining AOVs (the majority of AOVs at each plant) were determined to have little or no safety-significance.

Some AOV applications appear to be common to many plants. For example, all U.S. LWRs use AOVs for containment isolation functions and for main steam systems. U.S. boiling-water reactors (BWRs) use AOVs in their scram systems. U.S. pressurized-water reactors (PWRs) use AOVs for controlling auxiliary and main feedwater and for condensate systems. The majority of AOVs at U.S. LWRs are nonsafety-related and are generally associated with the non-nuclear balance of plant. Nonetheless, two of the plants visited identified a number of important or risk important AOVs which had been classified as nonsafety-related.

1

Table 1 Populations of Air-Operated Valves in Plants Visited Plant Safety-Related Category 1 Category 2 Category 3 GL 89-10 Name AOVs AOVs AOVs AOVs MOVs Palo Verde 41 + 131 = 172 AOVs 41 AOVs per plant 131 AOVs per plant are Approximately 2628 There are 831 1-2-3 per plant are classified are classified by the classified by the licensee AOVs per plant are MOVs on site by the licensee as licensee as as Category 2. The classified by the (3 plants) of safety-related. See Category 1. The licensee refers to licensee as Category 3. which 336 are in Category 1 and 2. licensee refers to nonactive safety-related The licensee refers to the GL 89-10 active safety-related AOVs as Category 2. nonsafety-related AOVs program.

AOVs as Category 1. as Category 3.

Fermi 2 29 AOVs in Category 1 410 AOVs are 84 AOVs are classified Category 3 AOVs are 147 MOVs are in and 34 AOVs in classified by the by the licensee as those having little or no the GL 89-10 Category 2 (63 total) licensee as Category 2 including safety-significance or program.

are safety-related Category 1. The 34 safety-related AOVs. economic according to the licensee refers to The licensee designates consequences.

program plan draft. AOVs having high as Category 2 those less (Note: The original safety-significance safety-significant AOVs 1995 rough outline for In addition, 370 AOVs as Category 1. that support safety- development of the for scram inlet and Included are 370 related functions or have Fermi 2 AOV program outlet valves. SCRAM inlet and relatively high economic lists a total of 2058 outlet valves, consequences if they AOVs of which 598 (There are also 2482 29 safety-related should fail. were considered safety-solenoid-operated valves, and 11 AOVs related valves or valves (SOVs) of which that perform a dampers, and 1460 1442 are classified by nonsafety-related risk were considered the licensee as QA1.) significant function. nonsafety-related valves or dampers.)

Palisades 191 AOVs 111 AOVs. Valves in 42 AOVs are classified Approximately 561 There are 54 this category are by the licensee as AOVs which are not MOVs in the safety-related with Category 2. These AOVs Category 1 or 2 are plant of which 30 active safety are safety-related but of classified by the are covered by functions, important- low risk-significance or licensee as Category 3 GL 89-10.

to-safety based on nonsafety-related but AOVs.

their probabilistic used in critical safety assessment applications (PSA), risk significance, or included based on Expert Panel determinations.

LaSalle 1-2 84 for both units. AOVs having high AOVs having low safety AOVs having high There are 200 safety significance. significance. Number not economic significance. MOVs in the In addition, 370 control Number not provided. Number not provided. GL 89-10 rod drive hydraulic provided. (LaSalle categorizes program for both valves in each unit are AOVs with no or limited units.

classified by the safety/ economic licensee as safety- significance as related. Category 4.) (There are 1575 nonsafety-related AOVs for both units.)

Three Mile 98 AOVs are classified 98 AOVs are 328 AOVs are 484 AOVs are There are 81 Island 1 as safety-related categorized as Class categorized as Class 2 categorized as Class 3 MOVs in the (designated Q-class 1 by the licensee. by the licensee. These by the licensee. These GL 89-10 or Class 1") by the These are AOVs with are AOVs with an EOP are AOVs not program for this licensee. an active safety function or operational categorized 1 or 2. plant.

function. economic significance. There are a total of 910 AOVs at Three Mile Island 1.

2

Plant Safety-Related Category 1 Category 2 Category 3 GL 89-10 Name AOVs AOVs AOVs AOVs MOVs Indian 263 AOVs are The licensee did not The licensee did not The licensee did not 89 MOVs are Point 3 classified as safety- classify AOVs as classify AOVs as classify AOVs as within the scope related by the licensee. Category 1, 2, or 3. Category 1, 2, or 3. Category 1, 2, or 3. of GL 89-10.

[215 AOVs were There are 578 AOVs in classified by the the plant, therefore:

licensee as being 578-263 = 315 AOVs within the scope of are nonsafety-related.

the Maintenance Rule, 10 CFR 50.65 (Ref. 1)]

Turkey The licensee classified 174 AOVs (98 active, 53 (34 active, 19 passive, There are 836 AOVs in 111 MOVs (total Point 3-4 191 AOVs (total for 76 passive, total for total for both units) are both units. It is not for both units) both units) as safety- both units) are classified by the licensee known if the licensee are within the related. classified by the as Category 2. specifically designated scope of licensee as some AOVs as GL 89-10.

Category 1. Category 3.

• Generic Letter (GL) 89-10, Safety-Related Motor-Operated Valve Testing and Surveillance 6 10 CFR 50.54(f), June 28, 1989 (Ref. 2).

This column is included for comparison purposes.

3 AIR-OPERATED VALVE ISSUES The primary issues of concern with AOVs are those design deficiencies, maintenance deficiencies, and pneumatic system deficiencies which may result in simultaneous common-cause failures (CCF) of more than one valve. For example, similar to the situation with MOVs which prompted issuance of GL 89-10, high differential pressure across the valve disk, seen during accident or transient conditions, may cause friction forces beyond the capacity of the valve operator. Since it is expected that the valves in both trains of a safety system would be subject to the same conditions, both trains of a safety system could fail at the same time.

Situations where the initial design resulted in valve operator output insufficient to overcome friction forces on the valve which are generated during an accident or transient are often referred to as design basis failures. These issues are sometimes described as mechanistic capability to perform in contrast to probabilistic reliability.

Inappropriate fabrication or maintenance practices can also introduce conditions which reduce valve operator forces or increase valve friction forces so as to render the valve incapable of performing its required function. The impact on the redundant valves in separate trains would be similar.

3.1 Design Capability Versus Operability and Operational Readiness As noted in recent NRC and industry communications and as observed during our plant visits, licensees have found several instances of AOVs which were capable of performing satisfactorily during normal plant operations but were not capable of performing satisfactorily during design-basis accident or transient conditions. In some cases, the AOVs successfully passed inservice or surveillance testing to be declared operable, but further analysis or diagnostic testing indicated that the AOVs did not have adequate margins to operate 3

successfully during the more severe design-basis conditions. There have been several cases where the AOV design specifications did not account for the more severe accident or transient conditions and where the AOV manufacturers design assumptions or analyses were found to be incorrect. As a result of these types of design deficiencies, some AOVs have been found to have little or no operating margins. In addition, as explained below, there have been cases where inservice or surveillance testing did not reveal the AOVs small or nonexistent margin for performing their design-basis functions. Inservice or surveillance testing does not necessarily replicate the more harsh accident or transient conditions. Successful completion of inservice or surveillance testing is generally viewed as having demonstrated operability. However, because of differences between the test and design basis conditions, inservice or surveillance testing of AOVs may not verify that the AOVs have the design capability to assure that they would function satisfactorily during design basis events. Table 7 of the INEEL report, A Study of Air-Operated Valves at U.S. Nuclear Power Plants, NUREG/CR-6654, February 2000 (Ref. 3), lists about 30 events and conditions during the last 5 years where the design basis for AOVs or their components was not met or not known.

3.2 Instrument Air Systems AOVs are finely tuned systems which are susceptible to failure from contaminants such as moisture, dirt particles, and oil which may be introduced through the pneumatic supply system.

Water in contact with carbon steels can lead to the formation of rust particles. Excessive use of threadlockers can lead to the formation of foreign unidentified sticky substances when they come in contact with lubricants, elastomers, or other chemicals in the AOVs piece-parts (SOVs), thereby preventing the AOVs from functioning properly. Dirt particles and rust particles can block the small passageways within the AOVs piece-parts and prevent them from functioning properly SOVs, converters, and regulators are especially prone to this phenomena. Oil contamination can result in the formation of varnish-like deposits on the heated surfaces of SOVs, thereby preventing them from changing position. Operating experience confirms that intrusion of moisture, oils, and other particles via the pneumatic system has been a source of AOV failures. Because many AOV piece-parts have tight clearances and tolerances, they are vulnerable to CCFs from contaminants introduced by the pneumatic system.

Another CCF vulnerability of concern is that of excessive pneumatic system pressure due to pressure regulator failure. Pressures in excess of the SOVs maximum operating pressure differential may prevent the SOVs from functioning properly and thereby cause failure of their associated AOVs.

Recognizing the importance of detecting and eliminating moisture contamination from pneumatic systems, current industry standards and guides for pneumatic equipment and systems recommend continuous or frequent (once per shift or once per day) dewpoint monitoring [Instrument Society of America, (ISA)-S7.0.01-1996, Quality Standard for Instrument Air (Ref. 4), ASME OMa-S/G-1998 Guide Part 17, Performance Testing of Instrument Air Systems in Light-Water Reactor Power Plants (Ref. 5), and Electric Power Research Institute (Nuclear Maintenance Applications Center) (EPRI/NMAC), NP-7079, Instrument Air Systems - A Guide for Power Plant Maintenance Personnel (Ref. 6)].

4

4 SITE VISITS Seven site visits were conducted between October 1997 and March 1998. Each visit lasted 2 days. Table 2 lists the plant name, the dates of the visit, the reactor manufacturer, the architect engineer, and the year the plant began commercial operation.

Table 2 Plants Visited Plant Name Dates Plant Description/ Year Commercial of Visits Architect Engineer Operation Began Palo Verde 10/28629/97 Combustion Engineering, two loop, 1-2-3 System 80 (no power-operated relief 1986 valves [PORVs]) PWR/Bechtel Fermi 2 11/03604/97 General Electric BWR 4/Detroit Edison 1988 Palisades 11/18619/97 Combustion Engineering, two loop 1971 PWR/Bechtel LaSalle1-2 12/17618/97 General Electric BWR 5/Sargent & Lundy 1984 Three Mile 02/12613/98 Babcock and Wilcox, lowered loop 1974 Island 1 PWR/Gilbert Associates Indian Point 3 03/10611/98 Westinghouse, four loop PWR/United 1976 Engineers and Constructors Turkey Point 03/24625/98 Westinghouse, three loop PWR/Bechtel 1972 3-4 The site visit team included one or two engineers from RES, two engineers from INEEL, and at times an engineer from the Office of Nuclear Reactor Regulation. During most of the visits, the NRC resident inspectors attended the entrance and/or exit interviews that were held on site.

The visits usually included plant walk-throughs, discussions with plant management, plant licensing personnel and engineers, plant operators and plant maintenance personnel affiliated with AOV activities. Discussions were held regarding plant AOV operating experience and plant programs associated with AOVs. In addition comprehensive discussions were held with personnel associated with plant PSAs (individual plant evaluations [IPEs] and individual plant evaluation of external events [IPEEEs]) and maintenance rule (10 CFR 50.65 [Ref. 1])

activities. Detailed trip reports from the site visits appear in Appendix C of NUREG/CR-6654.

The plants visited were chosen in a manner to get a representative cross-section of the U.S. LWR population in accordance with the following criteria:

1. plant and NRC project schedule availability

2. plant participation in the EPRI AOV activities

3. plant participation in AOV users group activities

4. plant type and age.

5

Participation by the licensees was voluntary and participants were assured that the visits were independent fact finding activities, not inspection or regulatory compliance activities.

AOV Programs at Sites Visited All of the plants visited had AOV programs in place. All of the programs were aimed at improving AOV performance. However, there were many differences in the status and the depth of the programs at each station (see Table 3). NUREG/CR-6654 provides details of the programs at the stations visited.

Table 3 Status of Air-Operated Valve Programs at Time of Site Visits Categorization Diagnostic Testing*

Plant Status Being Done Findings Palo Verde Complete Static and Dynamic Low margins 6 replaced or modified AOVs Fermi Nearing Completion To be determined Calculations planned Palisades Complete Static and Dynamic Low margins 6 replaced or modified AOVs LaSalle Complete Static Low margins 6 replaced or modified AOVs. Found generic effective diaphragm area problem described in Information Notice (IN) 96-68.

Three Mile Complete Static planned. Low margins 6 modified AOVs Island 1 Indian Point 3 Complete Static Low margins 6 replaced or modified AOVs Turkey Point Complete Static Focus on maintenance and operations. Limited testing of problem AOVs.

• Dynamic testing: testing conducted with system pressure or flow.

Static testing: testing conducted at ambient conditions without system pressure or flow.

The AOV programs at all of the stations visited had been or were in the process of surveying, categorizing, and ranking their AOV populations. Table 1 contains a summary of the categorizations and ranking efforts at each of the seven stations visited. The methodologies used to categorize and rank the AOVs at the plants visited included: review of plant operating experience, consideration of the results of plant PSAs, the use of expert panels, consideration of plant responses to transients and design basis events, and review of emergency procedures.

Frequently these activities were part of licensee implementation of the maintenance rule. Many 6

licensees evaluations utilized IPE and IPEEE methodologies and results. Many licensees categorizations considered risk achievement worth1, Fussell Vesely, or other risk importance measures.

Licensees at most of the plants visited and licensees that were contacted at industry meetings have indicated that they are not including air-operated dampers in their AOV programs.

However, the LaSalle plant identified the air-operated containment purge valves to have a high risk importance. Table 3 in NUREG/CR-6654 provides descriptions of other air-operated damper events.

The Palisades and Fermi plants are lead plants in a program funded by EPRI to develop and confirm analytical techniques for predicting AOV performance and design margins. At the time of our visits to those plants, both plants had categorized and prioritized or ranked their AOVs.

A contractor had performed analyses on the Palisades plants AOVs. The Palisades plant staff had performed static and dynamic testing of their AOVs. In contrast, the Fermi plant had hired a contractor to conduct analyses of the most important (Category 1) AOVs, but had not established specific plans for diagnostic testing of AOVs.

Palo Verdes AOV program was initiated many years ago. Having experienced common-cause AOV failures as early as 1989, the Palo Verde plant initiated an aggressive program to prevent CCFs. The Palo Verde staff performed static and dynamic testing of AOVs which appeared to have low operating margins. As a result of analyses which indicated less than desired design margins, coupled with the results of static and in some cases, dynamic testing, Palo Verde made modifications to certain AOVs to assure satisfactory operation during design basis events.

In order to analyze their AOVs, several utilities have purchased design information and analyses from the AOV manufacturers since that information was not provided with the valves.

The original AOV design information may have been provided to the architect-engineers but the utilities did not collect and retain the details of the AOVs design analyses or available margins.

Recently, several utilities evaluated their AOVs and found errors in the AOV manufacturers design calculations as well as errors in the valve designs (e.g., Crane-Aloyco, Fisher, Anchor-Darling/ACF/WKM/ BS&B [described in Section 5 of this report and NUREG/CR-6654]). In addition, some AOV manufacturers have not provided sufficient guidance or instructions for AOV maintenance or replacement. Similarly, regarding SOVs which are important piece-parts of AOVs, NUREG-1275, Vol. 6, Operating Experience Feedback Report6Solenoid-Operated Valve Problems, U.S. Nuclear Regulatory Commission Office for Analysis and Evaluation of Operational Data, February 1991, noted instances where SOV manufacturers did not provide utilities with sufficient guidance for maintenance and replacement of SOVs.

The licensees visited either were using or were planning to use AOV diagnostic testing equipment. Information shared at industry meetings indicates that plants have had favorable results using AOV diagnostic testing equipment to diagnose and fix specific AOV problems. As a result of using diagnostic testing equipment, several plants have made modifications to AOVs 1

Risk achievement worth is the ratio of the plants CDF calculated when the component of interest has a failure rate of one divided by the plants base case overall CDF.

7

to improve their operation. Some plants indicated that they use AOV diagnostic testing equipment routinely to confirm that AOVs have been set up correctly.

Some plants have performed AOV diagnostic testing under conditions which mimic dynamic design loading conditions; however, most plants have not. In some cases, successful static diagnostic testing does not provide the assurance that an AOV will be able to perform its safety function under design loading conditions.

5 OPERATING EXPERIENCE 5.1 Selected Common-Cause Air-Operated Valve Events Listed below are summaries of a representative sample of recent common-cause AOV events.

The reader is referred to INEEL report, NUREG/CR-6654, which has a more extensive list of recent AOV events (Tables 2, 3, and 4). In addition, NUREG/CR-6654 contains a table (Table

7) of recent events (within the last 5 years) or conditions involving AOVs or air-operated components where the design basis was not met or was not known.

Millstone 3 (Inspection Reports 423/98-206 and 423/96-09)

The reports describe events in 1996 in which multiple AOVs were unable to perform their intended safety functions or could have adversely affected the operation of other safety-related equipment. The plant was shut down in order to correct design errors, many of which affected AOV operability and capability. Some of the AOV deficiencies which were identified in 1996 are noted below and in Section 9.7 of NUREG/CR-6654.

Forty-eight SOVs were identified which could be subjected to an air pressure greater than their design. As a result, 41 safety-related and 7 nonsafety-related AOVs and level control valves may not have functioned as designed during postulated accidents or transients.

Twenty-one safety-related AOVs affecting the high-pressure and low-pressure safety injection systems were identified with power and control circuits not qualified for harsh environmental conditions.

Loss of instrument air could have resulted in repositioning of residual heat removal (RHR) heat exchanger AOVs such that the component cooling water system would have exceeded its design limit.

Clinton (Operability Determination and Condition Reports #1-99-09-062, September and October 1999)

On 1 day in 1999, two AOVs failed surveillance testing. During a 1-month period, August to September 1999, there were five more similar AOV failures. Six of the AOVs were categorized by the licensee to have high safety significance. The AOV failures were attributed to SOVs 8

(normally energized ASCO 206-832 series), which were stuck due to lubricant and thread locker.

Clinton station has 52 safety-related continuously energized ASCO 206-832 Series SOVs, 41 of which have been determined to have high safety significance and 11 of which have been determined to have low safety significance.

ASCO Series NP 206, 208, 210, 8314 and NS 8300, 8314 Solenoid-Operated Valves (Engineering Report 320, Justification for the Change to an O-Ring Seal for Threaded Seat Nuclear Valves)

In December 1996, ASCO completed an engineering evaluation supporting replacement of methacrylate ester thread locker sealant with an O-ring to seal internal screw-in parts of the SOVs. The evaluation acknowledged that the use of the thread locker sealant could cause the SOVs to stick. Subsequent laboratory analysis of ASCO 206 Series SOVs that had failed (stuck) at Peach Bottom, Clinton, and Waterford confirmed that methacrylate ester thread locker sealant interacting with the silicone oil used during manufacture was the root cause of the failures. The Clinton plants examination of a 9-year old 206 Series ASCO SOV found that it still had uncured thread locker inside. To date, ASCO has not notified purchasers of valves which were manufactured prior to the change that those SOVs may be vulnerable to CCF because methacrylate ester had been used in the assembly process.

ITT Industries (50.72 Report #35512 [10 CFR Part 21])

Waterford Davis-Besse Duane Arnold Diablo Canyon Indian Point 2 Surry Turkey Point St. Lucie Oconee Westinghouse Electric - multiple locations In December 1999, as a result of an inquiry from Indian Point 2, the manufacturer analyzed and tested the operating capability of 3" air-operated diaphragm valves under design basis conditions. The manufacturer found that due to tolerance variations in replacement parts (elastomers, springs), the refurbished AOVs may not function in accordance with their design requirements.

Most of the valves were manufactured in the 1960s and 1970s; however, the refurbishment was recommended every 5 years. Post-maintenance testing of the refurbished valves was not specifically recommended by the manufacturer.

Vermont Yankee (Licensee Event Report [LER] 271/98-025, EN 35150)

In December 1998, three of four air-operated scram discharge volume drain valves failed inservice testing. The licensee found that the valve actuators used on all four scram discharge 9

volume drain valves were of insufficient size to operate the valves within the required times.

Subsequently, larger actuators were installed.

Millstone 2 (LER 336/97-011, EN 32070)

In April 1997, 19 of 23 AOVs serving in containment isolation functions failed to isolate under full system pressure. The failures were attributed to improper set up. Full pressure testing had never been done. Given a design basis accident, failure of the three AOVs which isolate letdown would result in offsite radiation doses higher than stated in the plants final safety analysis report. Two of three AOVs in the letdown line had malfunctioned 4 years earlier but the problem was not corrected 6 see LER 336/93-023 below.

Millstone 2 (LER 336/93-023)

In August 1993, while at full reactor coolant system pressure with valve position indicators showing them to be closed, two AOVs in the letdown line were leaking between 20 and 40 gpm.

The licensee attributed the leakage to improper bench setting of the AOVs. The licensee also noted that failure to test the AOVs at full reactor coolant system pressure was a contributing cause. The licensee acknowledged the need to verify isolation of those valves against full reactor coolant system pressure however verification was not done until 4 years later (see LER 336/97-011 above).

Dresden and Quad Cities Stations (LER 237/98-003 and NRC Morning Report 1H-98-0045)

In January 1998, Dresden 2 experienced the failure of a high-pressure coolant injection steam supply drain valve (Copes-Vulcan D-100 AOV) due to design or manufacturing errors.

Dresden 3 had a similar failure in March 1995. It was also reported that Quad Cities station had experienced three similar failures. The failures were attributed to premature wear-out of diaphragms in the AOVs operators. The elastomeric coatings on the diaphragms fabric fibers were too thin. During the AOVs operation, the elastomeric coatings wore off and the diaphragms fabric fibers abraded and failed. Subsequently, the manufacturer changed the design; however, the utilities were not informed of the design deficiency. Our check of the Nuclear Plant Reliability Data System database found over 1800 Copes-Vulcan D-100 AOVs in service at U.S. LWRs.

San Onofre 2 and 3 (LER 361/96-011)

In December 1996, while pursuing an AOV testing program similar to their MOV program, the licensee found several containment isolation valves [AOVs] which would not have been capable of closing under design-basis conditions. The licensee attributed the deficiencies to errors in the manufacturers analysis and setup errors that emanated from using the manufacturers outdated and incorrect setup instructions.

Haddam Neck (LER 213/94-005), NRC IN 95-34 (Ref. 7)

In February 1994, both of the pressurizer PORVs [AOVs] failed to open on demand during a test while the plant was in cold shutdown. The failures were attributed to air leaks caused by improper AOV diaphragm installation by the licensee. Improper use of lubricant on the diaphragms caused them to extrude enabling the air leakage.

10

Hope Creek (LERs 354/94-017 and 354/93-006)

In September 1993 and November 1994, repetitive AOV failures occurred, including two sets of concurrent failures of AOVs in the Safety Auxiliary Cooling System. A licensee initiated design change (modification of valve packing without taking into account the effect of the new lower friction) compromised room cooling for all plant emergency diesel generators (8 AOVs) and all emergency core cooling systems (24 AOVs).

Multiple Plants Waterford (LER 382/98-010)

D.C. Cook (LERs 315/97-026-01 and 315/98-052/01)

Cooper (Inspection Report 50-298/97-201)

Millstone 3 (LER 423/96-031)

Indian Point 3 (LER 286/93-050)

Clinton (LER 461/90-004)

In May 1988, NRC IN 88-24 (Ref. 8) notified all U.S. LWR licensees of conditions at Kewaunee and Calvert Cliffs where common-cause AOV failures did or could result from overpressurizing SOVs (which are piece-parts of AOVs). The IN indicated that failures of nonsafety-related pressure regulators could result in failure of safety-related AOVs. Subsequent to the issuance of the IN, several licensees found similar situations at their plants. However, in recent years licensees at Clinton, Indian Point 3, Millstone 3, Cooper, D.C. Cook, and Waterford found similar vulnerabilities that their original review of IN 88-24 did not find.

Relevant Non U.S. Events Darlington Unit 2 [Canada] (Event Notification Report D-1998-01497 and Detailed Event Report D-1998-01497)

In September 1998, while restoring the instrument air system during an outage, 18 of 120 pressure regulator valves failed, exposing downstream AOVs to full-system pressure.

The pressure regulator valve failures were attributed to embrittled diaphragms coupled with the large load that was placed on the pressure regulator valve diaphragms when the air system pressure was being restored. The licensee noted that the occurrence of such an event could cause safety-related AOVs to be forced to a position opposite from their loss of air position, and that they could be damaged and remain in that non-safe position. An analogous situation could occur at a U.S. plant during a recovery from a loss of offsite power or a loss of instrument air.

Pickering Unit 2 [Canada] (SEA A-94-94 6 Pickering A Unit 2 Small LOCA, Final Root Cause Failure Report)

On December 10, 1994, a thermally aged diaphragm in a pressure relief valve [AOV] in the primary heat transport system cracked, thereby initiating a small break loss-of-coolant accident.

The event resulted in a loss of about 30,000 gallons of heavy water. As a result of that event, 11

Canadian plants have implemented programs for ensuring appropriate diaphragm replacement frequencies in safety-related systems.

5.2 Air-Operated Valve Events at Sites Visited All seven plants visited had experienced noteworthy failures or malfunctions of AOVs. Many of the earlier events were caused by deficiencies in the air systems. Subsequent to those events, six of the seven stations visited made effective improvements to the design and operation of their air systems and they did observe corresponding decreases in the incidence of AOV malfunctions. The events demonstrated the AOVs susceptibility to CCFs from moisture in the supporting air system.

During our visit to the Palisades plant, we discussed recent Palisades plant events which involved degradations and malfunctions of AOVs and their piece-parts. As noted in Palisades Nuclear Plant Condition Report, C-PAL-97-0404, March 18, 1997 (Ref. 9), NRC Inspection Report 255/97-05 (Ref. 10), and NRC Inspection Report 255/97-18 (Ref. 11), the apparent cause of the degradations and malfunctions was rust and moisture contamination which resulted from air system deficiencies such as poor dryer performance, incorrectly located filters, and absence of low point drains. (See the NUREG/CR-6654, Section 8.3.1 and Appendix C-Trip 3.)

During the visits, we noted the variations in plant air system design, maintenance, and operating practices. The critical issue of dew point measurements, monitoring, and alarming were discussed. The plants measurement and monitoring of dew point data varied as follows:

1. Plants that measured dew point and particulates rarely (Palisades; Fermi 2).

2. Plants that measured dew point and particulates annually (Palo Verde 1, 2, 3).

3. Plants that monitored dew point each shift (Indian Point 3).

4. Plants that monitored dew point locally on-line (Turkey Point 3, 4).

5. Plants that monitored dew point locally on-line with control room alarm (LaSalle 1, 2; Three Mile Island 1).

ANSI and industry standards and guidelines (ISA Standard S7.0.01-1996, ASME OM-17, NMAC NP-7079 [Refs. 4, 5, and 6] recommend continuous or frequent monitoring of dew point.

12

5.2.1 Air-Operated Valve Event Attributed to Poor Air System Quality All of the plants that were visited had experienced significant AOV, SOV, or pneumatic system failures which were attributed to contaminated air systems. A recent noteworthy event is described below.

In March 1997 at Palisades (Ref. 9), 9 of 22 pressure regulators which affect the operation of AOVs in the high pressure air system malfunctioned or were found degraded. This air system provides motive and control power for many of the Palisades plants ECCS equipment. The pressure regulators were blocked by rust and corrosion products that had formed within the air system because of the high moisture content attributed to malfunctioning refrigeration-type air dryers. The problem was discovered during a post maintenance test of an AOV which was supplied by air fed through one of the degraded pressure regulators. The licensee noted that filters in the air system were mounted downstream of the pressure regulators. As a result, the filters were unable to protect the pressure regulators from failing.

Subsequent to our visit to the plant, the licensee committed to place filters upstream of the affected pressure regulators, replace the refrigeration-type air dryers with desiccant-type air dryers, and to install a second dryer in the instrument air system.

5.2.2 Air-Operated Valve Failures At Sites Visited Not Attributed to Poor Air System Quality

1. In April 1989, at Palo Verde 3, all four of the plants air-operated atmospheric dump valves (ADVs) failed to open on demand (LER 528/89-005 and IN 89-38, Atmospheric Dump Valve Failures at Palo Verde Units 1, 2, and 3, April 5, 1989 (Ref. 12). The licensee attributed the failures to a combination of: inadequate design, misadjustment, wear, aging, inadequate maintenance practices, and poor air quality. Subsequent to this event, Palo Verde management initiated an AOV program. (See NUREG/CR-6654, Section 8.1.1 for further details.)

2. In May 1995, at Palo Verde 1, excessive leakage occurred in three letdown containment isolation valves. Diagnostic testing found that if the AOV vendors recommended setup values were used, the actuators could not provide adequate force to achieve the required seating forces (LER 528/95-007). The licensees diagnostic testing found that the manufacturer had not accounted for the actuators high frictional loads. (See NUREG/CR-6654, Section 8.1.2 for further details.)

3. In November 1995, at Palo Verde 1, three of four downcomer feedwater isolation valves failed to open on demand due to inadequate valve design (LER 528/95-012). The licensee attributed the failure of three AOVs to the manufacturers use of a nonconservative valve factor and thermal binding. Static and dynamic diagnostic testing was required to fully determine the root causes of the failures. (See NUREG/CR-6654, Section 8.13 for further details.)

4. In August 1997, the Fermi 2 plant recognized the CCF of 18 SOVs controlling safety-related AOVs that failed during an 18-month period (Fermi Plant, Deviation Event Report Number 97-1200, August 4, 1997; Fermi Plant, Deviation Event Report Number 97-1202, August 5, 1997). The licensees root cause analysis found that most of those failures were the result of excessive Loctite PST-580 methacrylate ester thread-locking compound on the threaded joints in the pneumatic system. Migration of vapors from the 13

thread-locking compound followed by subsequent deposition and interaction within the SOVs caused sticking of the SOVs and subsequent failure of the AOVs to shift position on demand. A population of 66 safety-related AOVs with constantly energized SOVs were subject to the same failure mechanism. (See NUREG/CR-6654, Section 8.2.2 for further details.)

5. In April 1996, Turkey Point 3 and 4 experienced common-cause AOV failures due to design and maintenance issues. The failures were due to o-ring distortion and build-up or caking of grease. In addition to replacing the o-rings and removing the caked grease, the licensee modified the valve springs and increased the valve exercise frequency (Ref.

13). (See NUREG/CR-6654, Section 8.7.2 for further details.)

5.2.3 Design Errors Having Potential for AOV Common-Cause Failures At Sites Visited

1. In September 1996, LaSalle County Stations review of AOV diagnostic test data and load calculations revealed errors in the AOV manufacturers design data. The manufacturer (Anchor Darling and its predecessor organizations, WKM, BSB, AMF) had provided erroneous effective diaphragm areas which could result in incorrect AOV set-up values and consequently result in AOVs not performing correctly during design basis events (LER 373/96-011). The manufacturer acknowledged the error and issued a 10 CFR Part 21 Report. Due to a previous change in corporate ownership, it was not possible to notify all the potentially affected licensees. Subsequently NRC issued IN 96-68, Incorrect Effective Diaphragm Area Values in Vendor Manual Result in Potential Failure of Pneumatic Diaphragm Actuators, December 19, 1996. (See NUREG/CR-6654, Section 8.4.1 for further details.)

2. In February 1993, engineers at Three Mile Island Unit 1 found insufficient design margins in several Aloyco AOVs. The AOVs had inadequate closing forces which were attributed to inadequacies in the manufacturers design calculations. The design calculation errors associated with these valves are discussed in Appendix C - Trip 5 of the INEEL AOV study (NUREG/CR-6654). The engineers at Three Mile Island 1 indicated that Crystal River 3 had identical problems with similar Aloyco valves at their facility and that Three Mile Island 1 engineers had received advice from Crystal River 3 engineers on how to correct the problems with the Aloyco valves at their plant. Three Mile Island 1 and Crystal River 3 are Babcock and Wilcox plants designed by Gilbert Associates who specified the Aloyco valves for similar service at both plants.

3. In February 1996, Indian Point Unit 3 found that two in-series containment isolation valves (3" air-operated diaphragm valves manufactured by ITT-Grinnell) were unable to close when the differential pressure across them was less than a prescribed minimum differential pressure. The valves failed during post maintenance testing (LER 286/96-004). The vendor informed the licensee that sizing a diaphragm valve actuator must consider whether it closes with a 100 percent differential pressure across the valve, a 0 percent differential pressure across the valve, or both. The two valves that had failed the post maintenance tests were designed to provide a positive seat against a maximum differential pressure of 200 psi but would not close when there was no differential pressure across them. The original design specification for the AOVs listed a maximum differential pressure, but did not include a minimum differential pressure requirement.

14

6 INDUSTRY INITIATIVES Operating experience has shown that many of the problems associated with MOVs such as valve sizing, packing, friction or actuator sizing, verification of valve capability, design loading, lack of vendor information, nonprototypic surveillance testing, verification of design and operating capability also exist with AOVs. Industry organizations have encouraged licensees to take the initiative to translate the lessons learned from the MOV operating experience and the diagnostic testing associated with MOVs to AOVs. As noted in Section 4 of this report, licensees at the seven sites visited have initiated AOV programs to address those and other similar problems. Those AOV programs vary in age, resources, and effectiveness and they are voluntary. They use risk-informed techniques drawing from operating experience, the maintenance rule, plant IPE and IPEEEs, plant operating and emergency procedures, plant technical specifications, etc., to identify important AOVs, the design capability of which need to be verified. Some licensees have performed analyses and diagnostic tests to verify the capability of certain AOVs. Some utilities use diagnostic testing equipment to improve the set-up and maintenance of their AOVs. However, some licensees are not addressing the AOV design capability issues and these programs are voluntary.

In 1997, EPRI implemented AOV pilot programs at the Palisades and Fermi 2 plants and recently implemented pilot programs at the Duane Arnold and Comanche Peak plants. EPRIs program supports identification of important AOVs, development of AOV calculational techniques, and verification of the design capabilities.

In 1997, U.S. LWR licensees formed the JOG-AOV. JOG-AOVs stated mission is to develop a common and cost-effective U.S. nuclear utility AOV program which defines the minimum elements necessary to enhance safe and reliable AOV performance and allow timely address of industry and regulatory AOV issues (Ref. 14). The JOG-AOV initiatives are voluntary.

On June 3, 1999, a public meeting was held at NRC headquarters to discuss industry activities regarding AOVs. NRC staff met with representatives from NEI, JOG-AOV, Institute of Nuclear Power Operations, AUG, and EPRI to discuss AOV issues, including the JOG-AOV Program and JOG-AOV Program document. The meeting discussions about the JOG-AOV program and program document were limited because the NRC had not received copies prior to the meeting.

NRC attendees noted that the industry programs appeared to be positive voluntary initiatives.

However, the JOG-AOV program did not address several items which the NRC staff thought were important. The following list is a representative tally of those items not fully addressed:

1. Air system quality.

2. Risk significant nonsafety-related AOVs.

3. Quarter-turn AOVs (dampers).

4. Licensee commitments and schedules for implementation.

On July 19, 1999, NEI transmitted the JOG-AOV Program document to the NRC (Ref. 15). In the transmittal letter, NEI stated that the NRC was not requested to review or endorse JOG AOVs program document and that industry does not want credit for such industry activities in the context of SECY-99-063, The Use by Industry of Voluntary Initiatives in the Regulatory Process. On October 8, 1999 (Ref. 16), NRC responded to NEIs July 19, 1999 letter, providing comments on the JOG-AOV program document.

15

Top Event Prevention Analysis The technical paper, Use of Top Event Prevention Analysis to Select a Safety-Significant Subset of Air-Operated Valves for Testing (Ref. 17), describes some aspects of the Monticello plants AOV program. Discussion with the Monticello plant staff and their contractor found that the Monticello plants AOV program is under development and will be similar to the AOV programs of other plants noted in this report. One difference is that Monticello plants AOV program will use the Top Event Prevention (TEP) methodology to identify safety-significant AOVs for design basis review and periodic testing. The paper describes the results of some of the work that the Monticello plant and its contractors have done to select safety-significant AOVs using the TEP methodology.

The TEP methodology is commonly referred to as a minimum path set methodology. It utilizes PSA techniques to determine which equipment must work in order to prevent the undesired event (top fault tree event) from occurring. The Monticello plants TEP analysis identified 24 important AOVs. The paper reported that when the Monticello plant IPEs AOV failure rates were used for those 24 AOVs and a failure rate of one (1.0) was assigned to all other active AOVs, there was a small (8 percent) increase in the plants base case core damage frequency (CDF). In contrast, failures of any two of the 24 important AOVs would result in significant increases in CDF above the base case.

The technical paper also reported that when using the Fussell Vesely Importance and risk achievement worth threshold or screening values of 0.5 percent and 2.0 respectively (per the recommendations of NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, May 1993), the Monticello plant has no potentially risk significant AOVs. In contrast, the paper stated that while no AOVs exceed thresholds for risk significance, in combination with one another, they can have a significant effect if allowed to degrade in reliability. TEP analysis identifies the combinations of AOVs which are important to safety. Table 4 below lists the AOVs that the Monticello plant found were risk important using the TEP analysis.

Table 4 Risk Important Air-Operated Valves at the Monticello Plant (Ref. 17)

Valve Location or Function Valve Designation Hotwell makeup from CSTs AV 1094A, AV 1094B Feedwater bypass AV 3489, AV 3490 Condensate demineralizer bypass AV 1740 RHRSW to RHR heat exchanger AV 1728, AV 1729 Hard piped vent AV 4539, AV 4540 Instrument air dryer bypass AV 1473 16

7 AIR-OPERATED VALVE FAILURES AND RISK Recognizing the application of the single failure criterion and defense in depth, failure of a single AOV would generally not be a cause of concern. However, all licensees visited identified important AOVs based on a variety of methods including plant specific probabilistic risk assessments, individual plant examinations, or maintenance rule expert panel reviews. Many licensees identified individual AOVs whose failure would result in increased risk as indicated by high risk achievement worth or high Fussell Vesely risk rankings.

Licensees for three nuclear stations performed calculations of the risk achievement worth assuming CCF of redundant AOVs in certain safety systems. These are tabulated in Table 6 of NUREG/CR-6654 which shows risk achievement worths which range from slightly over 1 up to 202.

7.1 Simultaneous Failure of Air-Operated Valves Which Disable Safety Systems.

The major safety concern of this study from a risk perspective is the simultaneous CCF of AOVs, which disable redundant trains of a safety system. The scenario of most concern is that during an accident or transient, AOVs in redundant trains of a safety system fail when subjected to pressure, temperature, and flow conditions different from those seen during normal operation or testing. Similar to the situation with MOVs which led to issuance of GL 89-10, errors in design parameters, such as valve factors, and other design, manufacturing, or maintenance errors could result in lower than expected AOV valve operator force or greater than expected valve friction. Normal testing or routine operation of these valves, if performed under pressure, temperature, flow conditions different from those expected during an accident or transient, may not reflect the actual capability of the valve to perform during an accident or transient.

Several instances from operating experience are noted in this study where AOVs were shown to be unable to operate under the conditions expected during an accident or transient. These were usually found through diagnostic testing methods similar to those utilized to verify MOV operability in response to GL 89-10 and its supplements. Current inservice testing and technical specification operability tests may not assure AOV capability for pressure and flow conditions during an accident or transient.

Another safety concern is the potential simultaneous failure of two or more AOVs in important safety systems due to contamination from the pneumatic system or from fabrication and maintenance activities. Rust, dirt, or water in the air system can affect many valves.

Fabrication and maintenance activities can introduce excessive thread locker or other contaminants which cause sticking or binding. Elastomers deteriorate with age. AOV failures from these conditions are expected to be more random than the design errors and fabrication errors described above, but could still have the impact of disabling multiple trains of a safety system.

The study and its companion report describe over 100 AOV events. Many of the events are CCFs which resulted in degradation of important safety systems. If the plant had experienced an accident or transient while these failures existed, plant safety may have been challenged.

17

Risk calculations are generally done based on the assumption that components perform in a probabilistic sense under accident conditions. For those situations where AOVs in redundant trains of a safety system are not capable of operating due to pressure, temperature, or flow conditions expected during an accident or transient, those assumptions are negated. A truer risk analysis would account for this type of failure mechanism by assigning a failure probability of 1.0 for those valves for the particular accident or transient in which the valves are incapable of performing as needed.

7.2 Sensitivity of Core Damage Frequency to Air-Operated Valve Failures A recently completed sensitivity study, INEEL report, Generic Issue 158: Performance of Safety-Related Power-Operated Valves Under Operating Conditions, NUREG/CR-6644, September 1999, (Ref. 18), provides insights into the sensitivities of seven different U.S.

nuclear reactors to the performance of their power-operated valves, (i.e., AOVs, SOVs, and HOVs). The study was performed for NRC to address Generic Safety Issue 158, Performance of Safety Related Power-operated Valves Under Design Basis Conditions. The results show wide variations in the plants sensitivities to valve failures. At some plants, common-cause AOV failures can have a significant effect on the risk as measured by CDF. Furthermore, CDF sensitivity is dominated by the likelihood for CCF (quantified by the beta factor).

7.3 Important or Risk Significant AOVs At each of the plants visited utility personnel provided lists of AOVs that were considered to be important at their plants. At many plants the selections were based on the AOVs effect on CDF, as determined from the plants PRAs, (i.e., the AOVs risk achievement worth). Another subset of risk information that licensees at many of the plants visited deemed to be important was the AOVs effect on large early release frequency. In addition, the licensees determination of the risk importance of AOVs considered the specific functions that the AOVs were required to perform as outlined in the plants emergency, off-normal, abnormal recovery procedures, etc.

Table 5 below lists the systems, functions, or components that were determined by the licensees to have risk important AOVs at the plants visited and the number of risk significant AOVs at each station. In addition, the reader is directed to Table 6 in the INEEL AOV study NUREG/CR-6654 which lists the 182 AOVs that were determined by the licensees to be risk significant at the 7 sites visited. Two of the licensees found nonsafety-related AOVs that were risk significant. The Fermi plant found 11 nonsafety-related AOVs that perform a risk significant function and Indian Point Unit 3 found 4 nonsafety-related AOVs that were risk significant.

7.4 Accident Sequence Precursors A review of NRCs Accident Sequence Precursor (ASP) program results found that during the years 1984 to 1995, there were 288 events that were classified as precursors (conditional core damage probability [CCDP] greater or equal to 1E-06). Twenty-six of those events were AOV related (i.e., AOV malfunctions were involved as either initiators or contributors to the events).

Twelve of those AOV related precursor events had CCDP of 1E-04 or greater. The highest CCDP was the 1985 loss of all auxiliary feedwater at Turkey Point in which water contamination of the instrument air system resulted in common-cause AOV failures. The CCDP for that event was about 9E-04 which had the fourth highest CCDP of the 40 events that were found to be precursors that year. No AOV events after January 1, 1995, were classified as precursors by 18

NRCs ASP program. Appendix B of the INEEL AOV study (Ref. 3) has an extensive discussion of ASP events involving AOVs. Most ASP events involving AOVs are not the design basis challenges which are the major risk concern described in this study. That is because the conditions of pressure, temperature, and flow which challenge AOV capability mostly occur during accidents or unusual transients; and those events are rare.

Table 5 Systems, Functions or Components Having Risk-Significant Air-Operated Valves at Plants Visited Plants Systems, Functions, or Components Having Risk Significant Air-Operated Number of Risk Visited Valves Significant Air-Operated Valves Palo Verde Charging system, ADVs, feedwater isolation, steam generator isolation Units 1-2-3 51 Fermi Unit 2 Main Steam (MSIVs), scram discharge volume vent and drain, drywell floor drain, condensate polishing demineralizer, condensate emergency supply, reactor feed pump, general service water, emergency equipment cooling water, emergency equipment service water, standby gas treatment, reactor building HVAC, standby gas treatment to torus air purge valve, torus vent 29 Palisades SDC heat exchanger, condensate inlet containment isolation, steam generator, SDC to LPSI, containment sump isolation to engineered safeguards room, steam generator steam dump 11 LaSalle Units Containment vent valves, ADS, RHR room coolers, SW pump coolers, feedwater 1-2 regulator valve, drywell venting 14 Three Mile ADVs, Containment isolation (coolant return lines)

Island Unit 1 4 Indian Point AFW, Main steam to auxiliary boiler, condensate storage tank to condenser, Unit 3 condensate polisher inlet stop valve, heater drain tank to condenser bypass, ADVs, pressurizer PORVs 40 Turkey Point Steam generator blowdown control, auxiliary feedwater, CCW to emergency Units 3-4 containment coolers, Instrument air combined header crosstie, charging pump suction. 33 TOTAL 182 8 FINDINGS AND CONCLUSIONS 8.1 AOV Program Practices

• Licensees visited have implemented AOV programs.

• Licensee maintenance rule scope generally includes AOVs, both safety-related and nonsafety-related.

• Licensees have identified risk significant and important AOVs, both safety-related and nonsafety-related.

• Significant variations exist in the scope and focus of current licensee AOV programs.

19

• Air-operated dampers are excluded from most current and proposed AOV programs.

• The proposed JOG-AOV program is voluntary.

8.2 Air-Operated Valve Performance Under Accident or Transient Conditions

• Current testing methods may not assess AOV performance under certain accident or transient conditions, similar to the earlier situation with MOVs.

• Several licensees that have begun using diagnostic equipment similar to that used for MOVs have found AOVs which would not perform as expected under certain accident or transient conditions.

• Several licensees that have reanalyzed AOVs capability using updated design and valve factor information have found AOVs which would not perform under certain accident or transient conditions.

8.3 Air-Operated Valve Common-Cause Failure Experience

• Design and manufacturing errors.

• Aged and degraded elastomers and other piece parts.

• Contamination from the pneumatic system and fabrication materials.

8.4 Air-Operated Valve Risk Considerations

• Licensees have identified AOVs which they consider to have risk significance based on high risk achievement worth and other risk analysis methods. These usually address the risk of a single valve failure.

• The primary risk concern regarding AOVs found in this study is the potential for simultaneous CCF of both trains of a safety system during an accident or transient due to design, manufacturing, maintenance, and testing deficiencies which do not properly account for pressure, temperature, and flow conditions expected to occur during accidents or transients.

• Another concern is the potential for simultaneous CCF mechanisms introduced by air system contamination, other contaminants, or ageing of elastomeric parts.

9 RECOMMENDATIONS The implementation of an effective AOV program, incorporating the use of analysis, diagnostic testing, and lessons learned from operating experience, can minimize the likelihood of AOV failures resulting in risk significant events. Such a program would:

20

• Identify safety related AOVs which are normally in a non-safety position and are expected to move to their safety position during accidents or transients. (These will subsequently be referred to as safety related active AOVs.)

• Identify safety related active AOVs which contribute the most to risk should they fail to operate, using plant-specific application of appropriate risk-ranking methodologies. For those valves with unconfirmed design margin and unrepresentative diagnostic testing, risk calculations which consider failures of redundant valves in both trains of a system may be appropriate.

• Establish confidence that risk significant safety related active AOVs will operate as required, subject to the actual pressures, temperatures, and flows during transient and accident conditions, by application of accepted and verified analysis or diagnostic testing methods. Assure continued operability of these valves through periodic testing.

• Establish operations and maintenance practices which prevent introduction of contaminants to the pneumatic system or to the valves and their sub-components and replace aging elastomers as appropriate.

• Identify nonsafety-related valves which have high risk significance and apply similar analysis or diagnostic techniques.

Cooperation between the NRC and industry to develop the guidance for AOV programs would facilitate and optimize the implementation of these programs.

10 REFERENCES 21

1. U.S. Nuclear Regulatory Commission, 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants.

2. U.S. Nuclear Regulatory Commission, Generic Letter 89-10, Safety Related Motor-Operated Valve Testing and Surveillance 6 10 CFR 50.54(f), June 28, 1989.

3. Idaho National Engineering and Environmental Laboratory Report, A Study of Air-Operated Valves at U.S. Nuclear Power Plants, NUREG/CR-6654, February 2000.

4. Instrument Society of America ISA-S7.0.01-1996, Quality Standard for Instrument Air, November 1996.

5. American Society of Mechanical Engineers, ASME OMa-S/G-1998 Guide Part 17, Performance Testing of Instrument Air Systems, 1998.

6. Electric Power Research Institute (Nuclear Maintenance Applications Center) NP-7079, Instrument Air Systems - A Guide for Power Plant Maintenance Personnel, December 1990.

7. U.S. Nuclear Regulatory Commission, Information Notice 95-34, Air Actuator and Supply Air Regulator Problems in Copes-Vulcan Pressurizer Power-Operated Relief Valves, August 25, 1995.

8. U.S. Nuclear Regulatory Commission, Information Notice 88-24, Failures of Air-Operated Valves Affecting Safety-Related Systems, May 13, 1988.

9. Palisades Nuclear Plant Condition Report, C-PAL-97-0404, March 18, 1997.

10. U.S. Nuclear Regulatory Commission, Inspection Report 255/97-05, June 17, 1997.

11. U.S. Nuclear Regulatory Commission, Inspection Report 255/97-18, February 26, 1998.

12. U.S. Nuclear Regulatory Commission, Information Notice 89-38, Atmospheric Dump Valve Failures at Palo Verde Units 1, 2, and 3, April 5, 1989.

13. Turkey Point Station Condition Report 96-0535, April 29, 1996; Supplement 1, May 16, 1996; Supplement 2, September 16, 1996; Supplement 3, February 7, 1997.

14. Coleman, M., JOG-AOV Program, presented at 2nd Joint Meeting of the Air-Operated Valve and Motor Operated Valve Users Group Meeting (AUG Meeting Number 16),

December 1998.

15. Modeen, D., Nuclear Energy Institute, letter to E. Imbro, U.S. Nuclear Regulatory Commission, Joint Owners Group Air-Operated Valve Program Document, July 19, 1999.

16. Imbro, E., U.S. Nuclear Regulatory Commission, letter to D.J. Modeen, Nuclear Energy Institute, Comments on Joint Owners Group Air-Operated Valve Program Document, 22

October 8, 1999.

17. Proceedings of the 4th International Conference on Probabilistic Safety Assessment and Management. Nierode, C.F., Wellumson, T.P., Worrell, R.B., Blanchard, D.P., Use of Top Event Prevention Analysis to Select a Safety-Significant Subset of Air-Operated Valves for Testing, September 1998.

18. Idaho National Engineering and Environmental Laboratory Report, Generic Issue 158:

Performance of Safety-Related Power-Operated Valves Under Operating Conditions, NUREG/CR-6644, September 1999.

23