ML003683085

Evaluation of Air-Operated Valves at U.S. Light-Water Reactors

ML003683085
Person / Time
Issue date:	02/11/2000
From:	Rossi C E NRC/RES/DSARE
To:	Beasley K, Chexal V K, Coleman M, Cortis K, Liberatori L F, Lochbaum D A, Modeen D J, Phelps R L, Pieknik P, Riley J H, Subalusky W T, Swanger F L, Torok R C, Vine G L, Warren W G ABB-CE Owners Group, B & W Owners Group, BWR Owners Group, Combustion Engineering Owners Group, Consolidated Edison Co of New York, Electric Power Research Institute, Institute of Nuclear Power Operations (INPO), Nuclear Energy Institute, Union of Concerned Scientists, Westinghouse Owners Group
Ornstein H L
References
GL-89-010
Download: ML003683085 (33)

Text

February 11, 2000

Dear Colleague:

The final report, "Evaluation of Air-Operated Valves at U.S. Light-Water Reactors," is enclosedfor your information. The study was initiated to collect information to form the basis for determining if additional regulatory attention is needed to address air-operated valves (AOVs).Plant visits were conducted to obtain information about AOV operating experience and AOVmaintenance and support activities. Discussions of operating experience focused on the root causes of AOV failures and corrective actions. Features of the AOV programs that were discussed included identification of risk-important AOVs, design margins, design verification, diagnostic testing, maintenance practices, ageing, participation in industry AOV activities, and parallelisms between AOV and motor-operated valve experience and activities.The major safety concern of this study from a risk perspective is the simultaneous common-cause failure of AOVs, which disable redundant trains of a safety system. The scenario of most concern is that during an accident or transient, AOVs in redundant trains of a safety system fail when subjected to pressure, temperature, and flow conditions different from those seen during normal operation or testing. Similar to the situation with motor-operated valves which led to issuance of Generic Letter 89-10, "Safety-Related Motor-Operated Valve Testing and Surveillance - 10 CFR 50.54(f)," June 28, 1989, errors in design parameters, such as valve factors, and other design, manufacturing, or maintenance errors could result in lower than expected AOV valve operator force or greater than expected valve friction. Normal testing or routine operation of these valves, if performed under pressure, temperature, flow conditions different from those expected during an accident or transient, may not reflect the actual capability of the valve to perform during an accident or transient. A draft of this report was provided to cognizant individuals within the NRC and to industry forpeer review in June, 1999. All of the peer review comments received were considered in the finalization of the report.The implementation of effective AOV programs incorporating the use of analysis, diagnostictesting, and lessons learned from operating experience, as outlined in the study, can minimize the likelihood of common-cause AOV failures resulting in risk significant events.Sincerely,/RA/Charles E. Rossi, DirectorDivision of Systems Analysis and Regulatory Effectiveness Office of Nuclear Regulatory Research

Enclosure:

As stated February 11, 2000

Dear Colleague:

The final report, "Evaluation of Air-Operated Valves at U.S. Light-Water Reactors," is enclosedfor your information. The study was initiated to collect information to form the basis for determining if additional regulatory attention is needed to address air-operated valves (AOVs).Plant visits were conducted to obtain information about AOV operating experience and AOVmaintenance and support activities. Discussions of operating experience focused on the root causes of AOV failures and corrective actions. Features of the AOV programs that were discussed included identification of risk-important AOVs, design margins, design verification, diagnostic testing, maintenance practices, ageing, participation in industry AOV activities, and parallelisms between AOV and motor-operated valve experience and activities.The major safety concern of this study from a risk perspective is the simultaneous common-cause failure of AOVs, which disable redundant trains of a safety system. The scenario of most concern is that during an accident or transient, AOVs in redundant trains of a safety system fail when subjected to pressure, temperature, and flow conditions different from those seen during normal operation or testing. Similar to the situation with motor-operated valves which led to issuance of Generic Letter 89-10, "Safety-Related Motor-Operated Valve Testing and Surveillance - 10 CFR 50.54(f)," June 28, 1989, errors in design parameters, such as valve factors, and other design, manufacturing, or maintenance errors could result in lower than expected AOV valve operator force or greater than expected valve friction. Normal testing or routine operation of these valves, if performed under pressure, temperature, flow conditions different from those expected during an accident or transient, may not reflect the actual capability of the valve to perform during an accident or transient. A draft of this report was provided to cognizant individuals within the NRC and to industry forpeer review in June, 1999. All of the peer review comments received were considered in the finalization of the report.The implementation of effective AOV programs incorporating the use of analysis, diagnostictesting, and lessons learned from operating experience, as outlined in the study, can minimize the likelihood of common-cause AOV failures resulting in risk significant events.Sincerely,/RA/Charles E. Rossi, DirectorDivision of Systems Analysis and Regulatory Effectiveness Office of Nuclear Regulatory Research

Enclosure:

As statedIdentical letters sent to: See attached listDistribution w/encl.: See attached listC:\1externalcover.wpd*See previous concurrence:To receive a copy of this document, indicate in the box:

" C" = Copy without attachment/enclosure " E" = Copy with attachment/enclosure

" N" = No copyOFFICEREAHFBCREAHFBCC:REAHFBCD:DSARECNAMEHOrnstein:mmkGLanikJRosenthalCRossiDATE01/20/00*01/20/00*01/20/00*02/11/00*OFFICIAL RECORD COPY Template=RES-005 Accession Number RES File Code RES-7B-1 2Letter dated: February 11, 2000Identical letters sent to:Mr. David ModeenDirector of Engineering Nuclear Energy Institute 1776 I Street NW, Suite 400 Washington, DC 20006-37008Mr. Jim RileyAOV Project Manager Nuclear Energy Institute 1776 I Street NW, Suite 400 Washington, DC 20006-3708Mr. Mark Coleman, ChairmanBWR Owners Group, Joint Owners Group 6 Air-Operated ValvesHope Creek and Salem Plants P.O. Box 236, Mail Code X07 Hancocks Bridge, NJ 08038Mr. Phillip Pieknik, ChairmanWestinghouse Owners Group Joint Owners Group 6 Air-Operated ValvesSTP Nuclear Operating Company South Texas Project P.O. Box 289 Wadsworth, TX 77483Mr. Kevin Cortis, ChairmanCombustion Engineering Owners Group Joint Owners Group 6 Air-Operated ValvesNortheast Utilities Millstone Station Rope Ferry Road Route 156 Waterford, CT 06385Mr. Ken Beasley, ChairmanB&W Owners Group Joint Owners Group 6 Air-Operated ValvesDuke Power Company 526 South Church Street Charlotte, NC 28202Mr. William T. SubaluskyInstitute of Nuclear Power Operations 700 Galleria Parkway Atlanta, GA 30339-5957Mr. V.K. Chexal, DirectorNuclear Safety Analysis Center Electric Power Research Institute P.O. Box 10412 Palo Alto, CA 94303Mr. Raymond C. Torok, Project ManagerNuclear Power Group Electric Power Research Institute P.O. Box 10412 Palo Alto, CA 94303Mr. Gary L. VineSenior Washington Representative Electric Power Research Institute 2000 L Street NW, Suite 805 Washington, DC 20036Mr. Louis Liberatori, ChairmanWestinghouse Owners Group Consolidated Edison Co. of New York, Inc.

Indian Point Nuclear Station Broadway and Bleakley Avenues Buchanan, NY 10511-1099Mr. Ralph Phelps, ChairmanABB-CE Owners Group Omaha Public Power District Ft. Calhoun Nuclear Station P.O. Box 399 Ft. Calhoun, NE 68023-0399Mr. W. Glenn Warren, ChairmanBWR Owners Group Southern Nuclear Operating Company Mail Code B052 40 Iverness Center Parkway Birmingham, AL 35201Mr. Frank L. Swanger, ChairmanB&W Owners Group Toledo Edison Company Davis Besse Nuclear Power Station Mail Stop 3105 5501 North State Route #2 Oak Harbor, OH 43449Mr. David A. LochbaumUnion of Concerned Scientists 1616 P Street, NW, suite 310 Washington, DC 20036-1495cc w/attachment:Pat Lewis, INPO Debbie Queener, NOAC 3Letter dated: February 11, 2000 Distribution w/att.

Public File CenterDistribution w/o att.

REAHFB R/F DSARE R/F CPaperiello, DEDMRS FMiraglia, DEDR MTschiltz, OEDO WOtt, OEDO RSavio, ACRS SCollins, NRR BSheron, NRR RWessman, NRR AThadani, RES MFederline, RES REmrit, RES SRubin, RES PNorian, RES TO BE PUBLISHED ASNUREG-1275, VOLUME 13EVALUATION OF AIR-OPERATED VALVESAT U.S. LIGHT-WATER REACTORSFebruary 2000Prepared by:Dr. Harold L. OrnsteinRegulatory Effectiveness Assessmentand Human Factors BranchDivision of Systems Analysis andRegulatory EffectivenessOffice of Nuclear Regulatory Research iiiCONTENTSABBREVIATIONS...........................................................vEXECUTIVE

SUMMARY

....................................................vii1INTRODUCTION......................................................12USE AND APPLICATION OF AIR-OPERATED VALVES.......................13AIR-OPERATED VALVE ISSUES.........................................33.1Design Capability Versus Operability and Operational Readiness...........43.2Instrument Air Systems...........................................44SITE VISITS.........................................................55OPERATING EXPERIENCE.............................................85.1Selected Common-Cause Air-Operated Valve Events....................85.2Air-Operated Valve Events at Sites Visited...........................125.2.1Air-Operated Valve Event Attributed To Poor Air System Quality.....13 5.2.2Air-Operated Valve Failures At Sites Visited Not Attributed to Poor Air System Quality..........................135.2.3Design Errors Having Potential for AOV Common-CauseFailures At Sites Visited....................................146INDUSTRY INITIATIVES...............................................157AIR-OPERATED VALVE FAILURES AND RISK............................177.1Simultaneous Failure of Air-Operated Valves Which Disable Safety Systems. .........................................177.2Sensitivity of Core Damage Frequency to Air-Operated Valve Failures......187.3Important or Risk Significant AOVs.................................18 7.4Accident Sequence Precursors....................................188FINDINGS AND CONCLUSIONS........................................198.1AOV Program Practices..........................................198.2Air-Operated Valve Performance Under Accident or Transient Conditions...20 8.3Air-Operated Valve Common-Cause Failure Experience.................20 8.4Air-Operated Valve Risk Considerations.............................209RECOMMENDATIONS................................................2010REFERENCES......................................................21 ivCONTENTS (cont.)TABLES1Populations of Air-Operated Valves in Plants Visited...........................22Plants Visited ........................................................5 3Status of Air-Operated Valve Programs at Time of Site Visits ...................6 4 Risk Important Air-Operated Valves at the Monticello Plant.....................16 5Systems, Functions or Components Having Risk-Significant Air-Operated Valves at Plants Visited .....................................19 vABBREVIATIONSADVatmospheric dump valveAOVair-operated valve ASMEAmerican Society of Mechanical Engineers ASPaccident sequence precursor AUGAir-Operated Valve Users GroupBWRboiling-water reactor CCDPconditional core damage probabilityCCFcommon-cause failure CDFcore damage frequencyEPRIElectric Power Research Institute (Nuclear Maintenance Applications Center)

GLGeneric Letter HOVhydraulic-operated valve INInformation NoticeINEELIdaho National Engineering and Environmental Laboratory IPEindividual plant evaluation IPEEEindividual plant evaluation of external events ISAInstrument Society of AmericaJOG-AOVJoint Owner's Group on Air-Operated ValvesLERlicensee event reportLWRlight-water reactorMOVmotor-operated valveMUGMotor-Operated Valve Users GroupNEINuclear Energy Institute PORVpower-operated relief valvePSAprobabilistic safety assessment PWRpressurized-water reactorRESNuclear Regulatory Research, Office of (NRC)RHRresidual heat removalSOVsolenoid-operated valve TEPtop event prevention viiEXECUTIVE

SUMMARY

This study was conducted by the Nuclear Regulatory Commission's Office of NuclearRegulatory Research to collect information to form the basis for determining if additional regulatory attention is needed to address air-operated valves (AOVs). This report and its companion document, Idaho National Engineering and Environmental Laboratory report NUREG/CR-6654, "A Study of Air-Operated Valves in U.S. Nuclear Power Plants," present the results of a comprehensive review of AOV operating experience and visits to 7 U.S. light water reactor sites at which there are 11 operating reactors. Plant visits were conducted to obtain information about AOV operating experience and AOVmaintenance and support activities. Discussions of operating experience focused on the root causes of AOV failures and corrective actions. Features of the AOV programs that were discussed included identification of risk-important AOVs, design margins, design verification, diagnostic testing, maintenance practices, ageing, participation in industry AOV activities, and parallelisms between AOV and motor-operated valve experience and activities.Each plant visited had an AOV program. The licensees' AOV programs identified, categorized,and prioritized the plants' AOV populations in order to determine the level of effort that needed to be focused on AOV analysis, testing, and maintenance activities. Recognizing the application of the single failure criterion and defense in depth, failure of a single AOV would generally not be a cause of concern. However, all licensees identified "important" AOVs based on a variety of methods including plant specific probabilistic risk assessments, individual plant examinations, or maintenance rule expert panel reviews. Many licensees identified individual AOVs whose failure would result in increased risk as indicated by high risk achievement worth or high Fussell Vesely risk rankings.The major safety concern of this study from a risk perspective is the simultaneous common-cause failure of AOVs, which disable redundant trains of a safety system. The scenario of most concern is that during an accident or transient, AOVs in redundant trains of a safety system fail when subjected to pressure, temperature, and flow conditions different from those seen during normal operation or testing. Similar to the situation with MOVs which led to issuance of Generic Letter 89-10, errors in design parameters, such as valve factors, and other design, manufacturing, or maintenance errors could result in lower than expected AOV valve operator force or greater than expected valve friction. Normal testing or routine operation of these valves, if performed under pressure, temperature, flow conditions different from those expected during an accident or transient, may not reflect the actual capability of the valve to perform during an accident or transient. Several instances from operating experience are noted in this study where AOVs were shownto be unable to operate under the conditions expected during an accident or transient. These were usually found through diagnostic testing methods similar to those utilized to verify MOV operability in response to Generic Letter 89-10 and its supplements. Some failed to operate in real events. Current inservice testing and technical specification operability tests may not assure AOV capability for pressure and flow conditions during an accident or transient. Another concern is the potential for simultaneous common-cause failure of two or more AOVsin important safety systems due to contamination from the pneumatic system or from fabrication viiiand maintenance activities. Rust, dirt, or water in the air system can affect many valves. Fabrication and maintenance activities can introduce excessive thread locker or other contaminants which cause sticking or binding. Degradation of elastomers have resulted in common-cause failures. AOV failures from these conditions are expected to be more random than the design errors and fabrication errors described above, but could still have the impact of disabling multiple trains of safety systems. As discussed in the study, some licensees found that certain AOVs had high risk achievementworth and/or Fussell Vesely risk rankings. Table 6 of NUREG/CR-6654 includes the risk achievement worth values for AOVs that were calculated by licensees at three plants. These calculations showed that, in some cases, the risk achievement worth could increase by one or two orders of magnitude as a result of CCFs. Risk achievement worth for common-cause AOV failures at those three plants ranged from slightly over 1 to 202. The implementation of an effective AOV program, incorporating the use of analysis, diagnostictesting, and lessons learned from operating experience, can minimize the likelihood of AOV failures resulting in risk significant events. Such a program would:*Identify safety related AOVs which are normally in a non-safety position and areexpected to move to their safety position during accidents or transients. (These will subsequently be referred to as safety related active AOVs.)*Identify safety related active AOVs which contribute the most to risk should they fail tooperate, using plant-specific application of appropriate risk-ranking methodologies. For those valves with unconfirmed design margin or diagnostic testing, risk calculations which appropriately consider failures of redundant valves in both trains of a system may be appropriate. *Establish confidence that risk significant safety related active AOVs will operate asrequired, subject to the actual pressures, temperatures, and flows during transient and accident conditions, by application of accepted and verified analysis or diagnostic testing methods. Assure continued operability of these valves through periodic testing. *Establish operations and maintenance practices which prevent introduction ofcontaminants to the pneumatic system or to the valves and their sub-components and replace aging elastomers as appropriate. Cooperation between the NRC and industry to develop the guidance for AOV programs wouldfacilitate and optimize the implementation of these programs.

11INTRODUCTIONTo assess the status of air-operated valves (AOVs) at U.S. light-water reactors (LWRs), Officeof Nuclear Reactor Research (RES) and the Idaho National Engineering and Environmental Laboratory (INEEL) engineers visited 7 reactor sites which house 11 operating U.S. LWRs representing about 10 percent of the currently operating U.S. LWRs. The site visits provided an important sampling of the AOV activities and programs at U.S. LWR plants. In addition, RES staff had discussions with engineers at many other U.S. LWR facilities and with members of nuclear industry groups such as the Air-Operated Valve Users Group (AUG), Motor-Operated Valve Users Group (MUG), Joint Owners Group on Air-Operated Valves (JOG-AOV), Nuclear Energy Institute (NEI), American Society of Mechanical Engineers (ASME) Operating and Maintenance Working Groups on AOVs and hydraulic-operated valves (HOVs) [ASME O&M 19], and motor-operated valves (MOVs) [ASME O&M 8].The information gathered from those visits and discussions is an important part of this study. The focus of this study is on AOVs which could affect plant safety systems and as such are within the purview of NRC's regulations.2USE AND APPLICATION OF AIR-OPERATED VALVESAOVs are used in all U.S. LWRs. They are used in a wide variety of applications. Some AOVsperform important functions in safety and nonsafety-related systems which could affect initiating event frequencies, accident mitigation, and radiological releases.An AOV is a complex system comprised of three major components: the actuator, the valvebody, and the controller. Each of the major components includes numerous "piece-parts" such as diaphragms, springs, limit switches, solenoid operators, positioners, current/pressure (i/p) converters, voltage/pressure (e/p) converters, accumulators, o-rings, lubricants, filters, regulators, yokes, bonnets, and seals. Electricity is required for control and air systems are required to provide motive power.Table 1 contains a listing of the AOV populations at the 7 sites (11 plants) visited during thisstudy. The licensees visited stated that their plants had between 418 and 2800 AOVs. Each of the plants visited categorized between 42 and 410 AOVs as "safety-related," "high safety-significance," "important-to-safety," or a combination thereof. The category designations in the table vary from plant-to-plant. The use of the categories for each plant is explained with the entry. The remaining AOVs (the majority of AOVs at each plant) were determined to have little or no safety-significance. Some AOV applications appear to be common to many plants. For example, all U.S. LWRsuse AOVs for containment isolation functions and for main steam systems. U.S. boiling-water reactors (BWRs) use AOVs in their scram systems. U.S. pressurized-water reactors (PWRs) use AOVs for controlling auxiliary and main feedwater and for condensate systems. The majority of AOVs at U.S. LWRs are nonsafety-related and are generally associated with the non-nuclear balance of plant. Nonetheless, two of the plants visited identified a number of "important" or "risk important" AOVs which had been classified as nonsafety-related.

2Table 1 Populations of Air-Operated Valves in Plants Visited Plant NameSafety-RelatedAOVsCategory 1 AOVsCategory 2 AOVsCategory 3 AOVsGL 89-10MOVsPalo Verde 1-2-341 + 131 = 172 AOVsper plant are classified by the licensee as safety-related. See Category 1 and 2.41 AOVs per plantare classified by the licensee as Category 1. The licensee refers to active safety-related AOVs as Category 1.131 AOVs per plant areclassified by the licensee as Category 2. The licensee refers to nonactive safety-related AOVs as Category 2.Approximately 2628AOVs per plant are classified by the licensee as Category 3.

The licensee refers to nonsafety-related AOVs as Category 3.

There are 831MOVs on site (3 plants) of which 336 are in the GL 89-10 program.Fermi 229 AOVs in Category 1and 34 AOVs in Category 2 (63 total) are safety-related according to the program plan draft.In addition, 370 AOVsfor scram inlet and outlet valves.(There are also 2482solenoid-operated valves (SOVs) of which 1442 are classified by the licensee as QA1.)410 AOVs areclassified by the licensee as Category 1. The licensee refers to AOVs having "high safety-significance" as Category 1.

Included are 370 SCRAM inlet and outlet valves, 29 safety-related valves, and 11 AOVs that perform a nonsafety-related risk significant function.84 AOVs are classifiedby the licensee as Category 2 including 34 safety-related AOVs.

The licensee designates as Category 2 those less safety-significant AOVs that support safety-related functions or have relatively high economic consequences if they should fail.Category 3 AOVs arethose "having little or no safety-significance or economic consequences."

(Note: The original 1995 rough outline for development of the Fermi 2 AOV program lists a total of 2058 AOVs of which 598 were considered safety-related valves or dampers, and 1460 were considered nonsafety-related valves or dampers.)147 MOVs are inthe GL 89-10 program.Palisades191 AOVs111 AOVs. Valves inthis category are safety-related with active safety functions, important-to-safety based on their probabilistic safety assessment (PSA), risk significance, or included based on Expert Panel determinations.42 AOVs are classifiedby the licensee as Category 2. These AOVs are safety-related but of low risk-significance or nonsafety-related but used in "critical" applicationsApproximately 561AOVs which are not Category 1 or 2 are classified by the licensee as Category 3 AOVs.There are 54MOVs in the plant of which 30 are covered by GL 89-10.LaSalle 1-284 for both units.In addition, 370 controlrod drive hydraulic valves in each unit are classified by the licensee as safety-related.AOVs having highsafety significance.

Number not provided.AOVs having low safetysignificance. Number not provided.AOVs having higheconomic significance.

Number not provided.

(LaSalle categorizes AOVs with no or limited safety/ economic significance as Category 4.) (There are 1575 nonsafety-related AOVs for both units.)

There are 200MOVs in the GL 89-10 program for both units.Three MileIsland 198 AOVs are classifiedas safety-related (designated "Q-class" or Class 1") by the licensee.98 AOVs arecategorized as Class 1 by the licensee.

These are AOVs with an active safety function.328 AOVs arecategorized as Class 2 by the licensee. These are AOVs with an EOP function or operational economic significance.484 AOVs arecategorized as Class 3 by the licensee. These are AOVs not categorized 1 or 2.

There are a total of 910 AOVs at Three Mile Island 1.There are 81MOVs in the GL 89-10 program for this plant.

Plant NameSafety-RelatedAOVsCategory 1 AOVsCategory 2 AOVsCategory 3 AOVsGL 89-10MOVs 3IndianPoint 3263 AOVs areclassified as safety-related by the licensee.The licensee did notclassify AOVs as Category 1, 2, or 3.

[215 AOVs were classified by the licensee as being within the scope of the Maintenance Rule, 10 CFR 50.65 (Ref. 1)]The licensee did notclassify AOVs as Category 1, 2, or 3.The licensee did notclassify AOVs as Category 1, 2, or 3.

There are 578 AOVs in the plant, therefore:

578-263 = 315 AOVs are nonsafety-related.89 MOVs arewithin the scope of GL 89-10.TurkeyPoint 3-4The licensee classified191 AOVs (total for both units) as safety-related.174 AOVs (98 active,76 passive, total for both units) are classified by the licensee as Category 1.53 (34 active, 19 passive,total for both units) are classified by the licensee as Category 2.There are 836 AOVs inboth units. It is not known if the licensee specifically designated some AOVs as Category 3.111 MOVs (totalfor both units) are within the scope of GL 89-10.*Generic Letter (GL) 89-10, "Safety-Related Motor-Operated Valve Testing and Surveillance 6 10 CFR 50.54(f)," June 28, 1989 (Ref. 2). This column is included for comparison purposes.3AIR-OPERATED VALVE ISSUESThe primary issues of concern with AOVs are those design deficiencies, maintenancedeficiencies, and pneumatic system deficiencies which may result in simultaneous common-cause failures (CCF) of more than one valve. For example, similar to the situation with MOVs which prompted issuance of GL 89-10, high differential pressure across the valve disk, seen during accident or transient conditions, may cause friction forces beyond the capacity of the valve operator. Since it is expected that the valves in both trains of a safety system would be subject to the same conditions, both trains of a safety system could fail at the same time.

Situations where the initial design resulted in valve operator output insufficient to overcome friction forces on the valve which are generated during an accident or transient are often referred to as "design basis" failures. These issues are sometimes described as mechanistic "capability" to perform in contrast to probabilistic "reliability." Inappropriate fabrication or maintenance practices can also introduce conditions which reducevalve operator forces or increase valve friction forces so as to render the valve incapable of performing its required function. The impact on the redundant valves in separate trains would be similar.3.1Design Capability Versus Operability and Operational ReadinessAs noted in recent NRC and industry communications and as observed during our plant visits,licensees have found several instances of AOVs which were capable of performing satisfactorily during normal plant operations but were not capable of performing satisfactorily during design-basis accident or transient conditions. In some cases, the AOVs successfully passed inservice or surveillance testing to be declared operable, but further analysis or diagnostic testing indicated that the AOVs did not have adequate margins to operate 4successfully during the more severe design-basis conditions. There have been several caseswhere the AOV design specifications did not account for the more severe accident or transient conditions and where the AOV manufacturers' design assumptions or analyses were found to be incorrect. As a result of these types of design deficiencies, some AOVs have been found to have little or no operating margins. In addition, as explained below, there have been cases where inservice or surveillance testing did not reveal the AOVs' small or nonexistent margin for performing their design-basis functions. Inservice or surveillance testing does not necessarily replicate the more harsh accident or transient conditions. Successful completion of inservice or surveillance testing is generally viewed as having demonstrated "operability." However, because of differences between the "test" and "design basis" conditions, inservice or surveillance testing of AOVs may not verify that the AOVs have the "design capability" to assure that they would function satisfactorily during design basis events. Table 7 of the INEEL report, "A Study of Air-Operated Valves at U.S. Nuclear Power Plants," NUREG/CR-6654, February 2000 (Ref. 3), lists about 30 events and conditions during the last 5 years where the design basis for AOVs or their components was not met or not known. 3.2Instrument Air Systems AOVs are finely tuned systems which are susceptible to failure from contaminants such asmoisture, dirt particles, and oil which may be introduced through the pneumatic supply system.

Water in contact with carbon steels can lead to the formation of rust particles. Excessive use of threadlockers can lead to the formation of "foreign unidentified sticky substances" when they come in contact with lubricants, elastomers, or other chemicals in the AOVs' piece-parts (SOVs), thereby preventing the AOVs from functioning properly. Dirt particles and rust particles can block the small passageways within the AOVs' piece-parts and prevent them from functioning properly - SOVs, converters, and regulators are especially prone to this phenomena. Oil contamination can result in the formation of varnish-like deposits on the heated surfaces of SOVs, thereby preventing them from changing position. Operating experience confirms that intrusion of moisture, oils, and other particles via the pneumatic system has been a source of AOV failures. Because many AOV piece-parts have tight clearances and tolerances, they are vulnerable to CCFs from contaminants introduced by the pneumatic system. Another CCF vulnerability of concern is that of excessive pneumatic system pressure due topressure regulator failure. Pressures in excess of the SOVs' maximum operating pressure differential may prevent the SOVs from functioning properly and thereby cause failure of their associated AOVs. Recognizing the importance of detecting and eliminating moisture contamination frompneumatic systems, current industry standards and guides for pneumatic equipment and systems recommend continuous or frequent (once per shift or once per day) dewpoint monitoring [Instrument Society of America, (ISA)-S7.0.01-1996, "Quality Standard for Instrument Air" (Ref. 4), ASME OMa-S/G-1998 Guide Part 17, "Performance Testing of Instrument Air Systems in Light-Water Reactor Power Plants" (Ref. 5), and Electric Power Research Institute (Nuclear Maintenance Applications Center) (EPRI/NMAC), NP-7079, "Instrument Air Systems - A Guide for Power Plant Maintenance Personnel" (Ref. 6)].

54SITE VISITSSeven site visits were conducted between October 1997 and March 1998. Each visit lasted2 days. Table 2 lists the plant name, the dates of the visit, the reactor manufacturer, the architect engineer, and the year the plant began commercial operation. Table 2 Plants VisitedPlant NameDatesof VisitsPlant Description/Architect EngineerYear CommercialOperation Began Palo Verde 1-2-310/28 629/97Combustion Engineering, two loop,System 80 (no power-operated relief valves [PORVs]) PWR/Bechtel 1986Fermi 211/03 604/97General Electric BWR 4/Detroit Edison1988Palisades11/18 619/97Combustion Engineering, two loopPWR/Bechtel 1971LaSalle1-212/17 618/97General Electric BWR 5/Sargent & Lundy1984Three MileIsland 102/12 613/98Babcock and Wilcox, lowered loopPWR/Gilbert Associates 1974Indian Point 303/10 611/98Westinghouse, four loop PWR/UnitedEngineers and Constructors 1976Turkey Point 3-4 03/24 625/98Westinghouse, three loop PWR/Bechtel1972The site visit team included one or two engineers from RES, two engineers from INEEL, and attimes an engineer from the Office of Nuclear Reactor Regulation. During most of the visits, the NRC resident inspectors attended the entrance and/or exit interviews that were held on site.The visits usually included plant walk-throughs, discussions with plant management, plantlicensing personnel and engineers, plant operators and plant maintenance personnel affiliated with AOV activities. Discussions were held regarding plant AOV operating experience and plant programs associated with AOVs. In addition comprehensive discussions were held with personnel associated with plant PSAs (individual plant evaluations [IPE's] and individual plant evaluation of external events [IPEEEs]) and "maintenance rule" (10 CFR 50.65 [Ref. 1])

activities. Detailed trip reports from the site visits appear in Appendix C of NUREG/CR-6654.The plants visited were chosen in a manner to get a representative cross-section of theU.S. LWR population in accordance with the following criteria:1.plant and NRC project schedule availability2.plant participation in the EPRI AOV activities 3.plant participation in AOV users group activities 4.plant type and age.

6Participation by the licensees was voluntary and participants were assured that the visits wereindependent fact finding activities, not inspection or regulatory compliance activities. AOV Programs at Sites VisitedAll of the plants visited had AOV programs in place. All of the programs were aimed atimproving AOV performance. However, there were many differences in the status and the depth of the programs at each station (see Table 3). NUREG/CR-6654 provides details of the programs at the stations visited.Table 3 Status of Air-Operated ValvePrograms at Time of Site VisitsPlantCategorizationStatusDiagnostic Testing

• Being DoneFindingsPalo VerdeCompleteStatic and DynamicLow margins 6 replaced ormodified AOVsFermiNearing CompletionTo be determinedCalculations planned PalisadesCompleteStatic and DynamicLow margins 6 replaced ormodified AOVsLaSalleCompleteStaticLow margins 6 replaced ormodified AOVs. Found generic effective diaphragm area problem described in Information Notice (IN) 96-68.Three MileIsland 1CompleteStatic planned.Low margins 6 modified AOVsIndian Point 3CompleteStaticLow margins 6 replaced ormodified AOVsTurkey PointCompleteStaticFocus on maintenance andoperations. Limited testing of problem AOVs.

• Dynamic testing: testing conducted with system pressure or flow.Static testing: testing conducted at ambient conditions without system pressure or flow.The AOV programs at all of the stations visited had been or were in the process of surveying,categorizing, and ranking their AOV populations. Table 1 contains a summary of the categorizations and ranking efforts at each of the seven stations visited. The methodologies used to categorize and rank the AOVs at the plants visited included: review of plant operating experience, consideration of the results of plant PSAs, the use of expert panels, consideration of plant responses to transients and design basis events, and review of emergency procedures.

Frequently these activities were part of licensee implementation of the maintenance rule. Many 1Risk achievement worth is the ratio of the plant's CDF calculated when the component ofinterest has a failure rate of one divided by the plant's base case overall CDF.

7licensees' evaluations utilized IPE and IPEEE methodologies and results. Many licensees'categorizations considered risk achievement worth 1, Fussell Vesely, or other risk importancemeasures. Licensees at most of the plants visited and licensees that were contacted at industry meetingshave indicated that they are not including air-operated dampers in their AOV programs.

However, the LaSalle plant identified the air-operated containment purge valves to have a high risk importance. Table 3 in NUREG/CR-6654 provides descriptions of other air-operated damper events.The Palisades and Fermi plants are lead plants in a program funded by EPRI to develop andconfirm analytical techniques for predicting AOV performance and design margins. At the time of our visits to those plants, both plants had categorized and prioritized or ranked their AOVs.

A contractor had performed analyses on the Palisades plant's AOVs. The Palisades plant staff had performed static and dynamic testing of their AOVs. In contrast, the Fermi plant had hired a contractor to conduct analyses of the most important (Category 1) AOVs, but had not established specific plans for diagnostic testing of AOVs.Palo Verde's AOV program was initiated many years ago. Having experienced common-causeAOV failures as early as 1989, the Palo Verde plant initiated an aggressive program to prevent CCFs. The Palo Verde staff performed static and dynamic testing of AOVs which appeared to have low operating margins. As a result of analyses which indicated less than desired design margins, coupled with the results of static and in some cases, dynamic testing, Palo Verde made modifications to certain AOVs to assure satisfactory operation during design basis events.In order to analyze their AOVs, several utilities have purchased design information andanalyses from the AOV manufacturers since that information was not provided with the valves.

The original AOV design information may have been provided to the architect-engineers but the utilities did not collect and retain the details of the AOVs' design analyses or available margins.

Recently, several utilities evaluated their AOVs and found errors in the AOV manufacturers' design calculations as well as errors in the valve designs (e.g., Crane-Aloyco, Fisher, Anchor-Darling/ACF/WKM/ BS&B [described in Section 5 of this report and NUREG/CR-6654]). In addition, some AOV manufacturers have not provided sufficient guidance or instructions for AOV maintenance or replacement. Similarly, regarding SOVs which are important piece-parts of AOVs, NUREG-1275, Vol. 6, "Operating Experience Feedback Report 6Solenoid-OperatedValve Problems," U.S. Nuclear Regulatory Commission Office for Analysis and Evaluation of Operational Data, February 1991, noted instances where SOV manufacturers did not provide utilities with sufficient guidance for maintenance and replacement of SOVs. The licensees visited either were using or were planning to use AOV diagnostic testingequipment. Information shared at industry meetings indicates that plants have had favorable results using AOV diagnostic testing equipment to diagnose and fix specific AOV problems. As a result of using diagnostic testing equipment, several plants have made modifications to AOVs 8to improve their operation. Some plants indicated that they use AOV diagnostic testingequipment routinely to confirm that AOVs have been set up correctly.Some plants have performed AOV diagnostic testing under conditions which mimic dynamicdesign loading conditions; however, most plants have not. In some cases, successful static diagnostic testing does not provide the assurance that an AOV will be able to perform its safety function under design loading conditions. 5OPERATING EXPERIENCE5.1Selected Common-Cause Air-Operated Valve EventsListed below are summaries of a representative sample of recent common-cause AOV events. The reader is referred to INEEL report, NUREG/CR-6654, which has a more extensive list of recent AOV events (Tables 2, 3, and 4). In addition, NUREG/CR-6654 contains a table (Table

7) of recent events (within the last 5 years) or conditions involving AOVs or air-operated components where the design basis was not met or was not known. Millstone 3 (Inspection Reports 423/98-206 and 423/96-09)The reports describe events in 1996 in which multiple AOVs were unable to perform theirintended safety functions or could have adversely affected the operation of other safety-related equipment. The plant was shut down in order to correct design errors, many of which affected AOV operability and capability. Some of the AOV deficiencies which were identified in 1996 are noted below and in Section 9.7 of NUREG/CR-6654.Forty-eight SOVs were identified which could be subjected to an air pressure greater than theirdesign. As a result, 41 safety-related and 7 nonsafety-related AOVs and level control valves may not have functioned as designed during postulated accidents or transients.Twenty-one safety-related AOVs affecting the high-pressure and low-pressure safety injectionsystems were identified with power and control circuits not qualified for harsh environmental conditions.Loss of instrument air could have resulted in repositioning of residual heat removal (RHR) heatexchanger AOVs such that the component cooling water system would have exceeded its design limit.

Clinton (Operability Determination and Condition Reports #1-99-09-062, September andOctober 1999)On 1 day in 1999, two AOVs failed surveillance testing. During a 1-month period, August toSeptember 1999, there were five more similar AOV failures. Six of the AOVs were categorized by the licensee to have high safety significance. The AOV failures were attributed to SOVs 9(normally energized ASCO 206-832 series), which were stuck due to lubricant and threadlocker.Clinton station has 52 safety-related continuously energized ASCO 206-832 Series SOVs, 41 ofwhich have been determined to have high safety significance and 11 of which have been determined to have low safety significance.ASCO Series NP 206, 208, 210, 8314 and NS 8300, 8314 Solenoid-Operated Valves(Engineering Report 320, "Justification for the Change to an O-Ring Seal for Threaded SeatNuclear Valves")In December 1996, ASCO completed an engineering evaluation supporting replacement ofmethacrylate ester thread locker sealant with an O-ring to seal internal screw-in parts of the SOVs. The evaluation acknowledged that the use of the thread locker sealant could cause the SOVs to stick. Subsequent laboratory analysis of ASCO 206 Series SOVs that had failed (stuck) at Peach Bottom, Clinton, and Waterford confirmed that methacrylate ester thread locker sealant interacting with the silicone oil used during manufacture was the root cause of the failures. The Clinton plant's examination of a 9-year old 206 Series ASCO SOV found that it still had uncured thread locker inside. To date, ASCO has not notified purchasers of valves which were manufactured prior to the change that those SOVs may be vulnerable to CCF because methacrylate ester had been used in the assembly process. ITT Industries (50.72 Report #35512 [10 CFR Part 21])WaterfordDavis-Besse Duane Arnold Diablo Canyon Indian Point 2 Surry Turkey Point St. Lucie Oconee Westinghouse Electric - multiple locationsIn December 1999, as a result of an inquiry from Indian Point 2, the manufacturer analyzed andtested the operating capability of 3" air-operated diaphragm valves under design basis conditions. The manufacturer found that due to tolerance variations in replacement parts (elastomers, springs), the refurbished AOVs may not function in accordance with their design requirements.Most of the valves were manufactured in the 1960s and 1970s; however, the refurbishment wasrecommended every 5 years. Post-maintenance testing of the refurbished valves was not specifically recommended by the manufacturer.Vermont Yankee (Licensee Event Report [LER] 271/98-025, EN 35150)In December 1998, three of four air-operated scram discharge volume drain valves failedinservice testing. The licensee found that the valve actuators used on all four scram discharge 10volume drain valves were of insufficient size to operate the valves within the required times. Subsequently, larger actuators were installed. Millstone 2 (LER 336/97-011, EN 32070)In April 1997, 19 of 23 AOVs serving in containment isolation functions failed to isolate underfull system pressure. The failures were attributed to improper set up. Full pressure testing had never been done. Given a design basis accident, failure of the three AOVs which isolate letdown would result in offsite radiation doses higher than stated in the plant's final safety analysis report. Two of three AOVs in the letdown line had malfunctioned 4 years earlier but the problem was not corrected 6 see LER 336/93-023 below. Millstone 2 (LER 336/93-023)In August 1993, while at full reactor coolant system pressure with valve position indicatorsshowing them to be closed, two AOVs in the letdown line were leaking between 20 and 40 gpm.

The licensee attributed the leakage to improper bench setting of the AOVs. The licensee also noted that failure to test the AOVs at full reactor coolant system pressure was a contributing cause. The licensee acknowledged the need to verify isolation of those valves against full reactor coolant system pressure however verification was not done until 4 years later (see LER 336/97-011 above).Dresden and Quad Cities Stations (LER 237/98-003 and NRC Morning Report 1H-98-0045)In January 1998, Dresden 2 experienced the failure of a high-pressure coolant injection steamsupply drain valve (Copes-Vulcan D-100 AOV) due to design or manufacturing errors.

Dresden 3 had a similar failure in March 1995. It was also reported that Quad Cities station had experienced three similar failures. The failures were attributed to premature wear-out of diaphragms in the AOVs' operators. The elastomeric coatings on the diaphragms' fabric fibers were too thin. During the AOVs' operation, the elastomeric coatings wore off and the diaphragms' fabric fibers abraded and failed. Subsequently, the manufacturer changed the design; however, the utilities were not informed of the design deficiency. Our check of the Nuclear Plant Reliability Data System database found over 1800 Copes-Vulcan D-100 AOVs in service at U.S. LWRs.San Onofre 2 and 3 (LER 361/96-011)In December 1996, while pursuing an AOV testing program similar to their MOV program, thelicensee found several containment isolation valves [AOVs] which would not have been capable of closing under design-basis conditions. The licensee attributed the deficiencies to errors in the manufacturer's analysis and setup errors that emanated from using the manufacturer's outdated and incorrect setup instructions.Haddam Neck (LER 213/94-005), NRC IN 95-34 (Ref. 7)In February 1994, both of the pressurizer PORVs [AOVs] failed to open on demand during atest while the plant was in cold shutdown. The failures were attributed to air leaks caused by improper AOV diaphragm installation by the licensee. Improper use of lubricant on the diaphragms caused them to extrude enabling the air leakage.

11Hope Creek (LERs 354/94-017 and 354/93-006)In September 1993 and November 1994, repetitive AOV failures occurred, including two sets ofconcurrent failures of AOVs in the Safety Auxiliary Cooling System. A licensee initiated design change (modification of valve packing without taking into account the effect of the new lower friction) compromised room cooling for all plant emergency diesel generators (8 AOVs) and all emergency core cooling systems (24 AOVs). Multiple PlantsWaterford (LER 382/98-010)D.C. Cook (LERs 315/97-026-01 and 315/98-052/01)

Cooper (Inspection Report 50-298/97-201)

Millstone 3 (LER 423/96-031)

Indian Point 3 (LER 286/93-050)

Clinton (LER 461/90-004)In May 1988, NRC IN 88-24 (Ref. 8) notified all U.S. LWR licensees of conditions at Kewauneeand Calvert Cliffs where common-cause AOV failures did or could result from overpressurizing SOVs (which are piece-parts of AOVs). The IN indicated that failures of nonsafety-related pressure regulators could result in failure of safety-related AOVs. Subsequent to the issuance of the IN, several licensees found similar situations at their plants. However, in recent years licensees at Clinton, Indian Point 3, Millstone 3, Cooper, D.C. Cook, and Waterford found similar vulnerabilities that their original review of IN 88-24 did not find. Relevant Non U.S. EventsDarlington Unit 2 [Canada] (Event Notification Report D-1998-01497 and Detailed Event ReportD-1998-01497)In September 1998, while restoring the instrument air system during an outage, 18 of120 "pressure regulator valves" failed, exposing downstream AOVs to full-system pressure.

The pressure regulator valve failures were attributed to embrittled diaphragms coupled with the large load that was placed on the pressure regulator valve diaphragms when the air system pressure was being restored. The licensee noted that the occurrence of such an event could cause safety-related AOVs to be forced to a position opposite from their "loss of air position,"

and that they could be damaged and remain in that "non-safe position." An analogous situation could occur at a U.S. plant during a recovery from a loss of offsite power or a loss of instrument air.Pickering Unit 2 [Canada] (SEA A-94-94 6 "Pickering A Unit 2 Small LOCA, Final Root CauseFailure Report")On December 10, 1994, a "thermally aged" diaphragm in a pressure relief valve [AOV] in theprimary heat transport system cracked, thereby initiating a small break loss-of-coolant accident.

The event resulted in a loss of about 30,000 gallons of heavy water. As a result of that event, 12Canadian plants have implemented programs for ensuring appropriate diaphragm replacementfrequencies in safety-related systems. 5.2Air-Operated Valve Events at Sites Visited All seven plants visited had experienced noteworthy failures or malfunctions of AOVs. Many ofthe earlier events were caused by deficiencies in the air systems. Subsequent to those events, six of the seven stations visited made effective improvements to the design and operation of their air systems and they did observe corresponding decreases in the incidence of AOV malfunctions. The events demonstrated the AOVs' susceptibility to CCFs from moisture in the supporting air system.During our visit to the Palisades plant, we discussed recent Palisades plant events whichinvolved degradations and malfunctions of AOVs and their piece-parts. As noted in Palisades Nuclear Plant Condition Report, C-PAL-97-0404, March 18, 1997 (Ref. 9), NRC Inspection Report 255/97-05 (Ref. 10), and NRC Inspection Report 255/97-18 (Ref. 11), the apparent cause of the degradations and malfunctions was rust and moisture contamination which resulted from air system deficiencies such as poor dryer performance, incorrectly located filters, and absence of low point drains. (See the NUREG/CR-6654, Section 8.3.1 and Appendix C-Trip 3.)During the visits, we noted the variations in plant air system design, maintenance, andoperating practices. The critical issue of dew point measurements, monitoring, and alarming were discussed. The plants' measurement and monitoring of dew point data varied as follows:1.Plants that measured dew point and particulates rarely (Palisades; Fermi 2).2.Plants that measured dew point and particulates annually (Palo Verde 1, 2, 3).

3.Plants that monitored dew point each shift (Indian Point 3).

4.Plants that monitored dew point locally on-line (Turkey Point 3, 4).

5.Plants that monitored dew point locally on-line with control room alarm (LaSalle 1, 2;Three Mile Island 1).

ANSI and industry standards and guidelines (ISA Standard S7.0.01-1996, ASME OM-17, NMAC NP-7079 [Refs. 4, 5, and 6] recommend continuous or frequent monitoring of dew point.

135.2.1Air-Operated Valve Event Attributed to Poor Air System QualityAll of the plants that were visited had experienced significant AOV, SOV, or pneumatic systemfailures which were attributed to contaminated air systems. A recent noteworthy event is described below.In March 1997 at Palisades (Ref. 9), 9 of 22 pressure regulators which affect the operation ofAOVs in the high pressure air system malfunctioned or were found degraded. This air system provides motive and control power for many of the Palisades plant's ECCS equipment. The pressure regulators were blocked by rust and corrosion products that had formed within the air system because of the high moisture content attributed to malfunctioning refrigeration-type air dryers. The problem was discovered during a post maintenance test of an AOV which was supplied by air fed through one of the degraded pressure regulators. The licensee noted that filters in the air system were mounted downstream of the pressure regulators. As a result, the filters were unable to protect the pressure regulators from failing. Subsequent to our visit to the plant, the licensee committed to place filters upstream of theaffected pressure regulators, replace the refrigeration-type air dryers with desiccant-type air dryers, and to install a second dryer in the instrument air system.5.2.2Air-Operated Valve Failures At Sites Visited Not Attributed to Poor Air System Quality 1.In April 1989, at Palo Verde 3, all four of the plant's air-operated atmospheric dumpvalves (ADVs) failed to open on demand (LER 528/89-005 and IN 89-38, "Atmospheric Dump Valve Failures at Palo Verde Units 1, 2, and 3," April 5, 1989 (Ref. 12). The licensee attributed the failures to a combination of: inadequate design, misadjustment, wear, aging, inadequate maintenance practices, and poor air quality. Subsequent to this event, Palo Verde management initiated an AOV program. (See NUREG/CR-6654, Section 8.1.1 for further details.)2.In May 1995, at Palo Verde 1, excessive leakage occurred in three letdown containmentisolation valves. Diagnostic testing found that if the AOV vendor's recommended setup values were used, the actuators could not provide adequate force to achieve the required seating forces (LER 528/95-007). The licensee's diagnostic testing found that the manufacturer had not accounted for the actuators' high frictional loads. (See NUREG/CR-6654, Section 8.1.2 for further details.)3.In November 1995, at Palo Verde 1, three of four downcomer feedwater isolation valvesfailed to open on demand due to inadequate valve design (LER 528/95-012). The licensee attributed the failure of three AOVs to the manufacturer's use of a nonconservative valve factor and thermal binding. Static and dynamic diagnostic testing was required to fully determine the root causes of the failures. (See NUREG/CR-6654, Section 8.13 for further details.)4.In August 1997, the Fermi 2 plant recognized the CCF of 18 SOVs controlling safety-related AOVs that failed during an 18-month period (Fermi Plant, Deviation Event Report Number 97-1200, August 4, 1997; Fermi Plant, Deviation Event Report Number 97-1202, August 5, 1997). The licensee's root cause analysis found that most of those failures were the result of excessive Loctite PST-580 methacrylate ester thread-locking compound on the threaded joints in the pneumatic system. Migration of vapors from the 14thread-locking compound followed by subsequent deposition and interaction within theSOVs caused sticking of the SOVs and subsequent failure of the AOVs to shift position on demand. A population of 66 safety-related AOVs with constantly energized SOVs were subject to the same failure mechanism. (See NUREG/CR-6654, Section 8.2.2 for further details.)5.In April 1996, Turkey Point 3 and 4 experienced common-cause AOV failures due todesign and maintenance issues. The failures were due to o-ring distortion and build-up or caking of grease. In addition to replacing the o-rings and removing the caked grease, the licensee modified the valve springs and increased the valve exercise frequency (Ref.

13). (See NUREG/CR-6654, Section 8.7.2 for further details.)5.2.3Design Errors Having Potential for AOV Common-Cause Failures At Sites Visited

1.In September 1996, LaSalle County Station's review of AOV diagnostic test data andload calculations revealed errors in the AOV manufacturers' design data. The manufacturer (Anchor Darling and its predecessor organizations, WKM, BSB, AMF) had provided erroneous effective diaphragm areas which could result in incorrect AOV set-up values and consequently result in AOVs not performing correctly during design basis events (LER 373/96-011). The manufacturer acknowledged the error and issued a 10 CFR Part 21 Report. Due to a previous change in corporate ownership, it was not possible to notify all the potentially affected licensees. Subsequently NRC issued IN 96-68, "Incorrect Effective Diaphragm Area Values in Vendor Manual Result in Potential Failure of Pneumatic Diaphragm Actuators," December 19, 1996. (See NUREG/CR-6654, Section 8.4.1 for further details.)2.In February 1993, engineers at Three Mile Island Unit 1 found insufficient designmargins in several Aloyco AOVs. The AOVs had inadequate closing forces which were attributed to inadequacies in the manufacturer's design calculations. The design calculation errors associated with these valves are discussed in Appendix C - Trip 5 of the INEEL AOV study (NUREG/CR-6654). The engineers at Three Mile Island 1 indicated that Crystal River 3 had identical problems with similar Aloyco valves at their facility and that Three Mile Island 1 engineers had received advice from Crystal River 3 engineers on how to correct the problems with the Aloyco valves at their plant. Three Mile Island 1 and Crystal River 3 are Babcock and Wilcox plants designed by Gilbert Associates who specified the Aloyco valves for similar service at both plants. 3.In February 1996, Indian Point Unit 3 found that two in-series containment isolationvalves (3" air-operated diaphragm valves manufactured by ITT-Grinnell) were unable to close when the differential pressure across them was less than a prescribed minimum differential pressure. The valves failed during post maintenance testing (LER 286/96-004). The vendor informed the licensee that sizing a diaphragm valve actuator must consider whether it closes with a 100 percent differential pressure across the valve, a 0 percent differential pressure across the valve, or both. The two valves that had failed the post maintenance tests were designed to provide a positive seat against a maximum differential pressure of 200 psi but would not close when there was no differential pressure across them. The original design specification for the AOVs listed a maximum differential pressure, but did not include a minimum differential pressure requirement.

156INDUSTRY INITIATIVESOperating experience has shown that many of the problems associated with MOVs such asvalve sizing, packing, friction or actuator sizing, verification of valve capability, design loading, lack of vendor information, nonprototypic surveillance testing, verification of design and operating capability also exist with AOVs. Industry organizations have encouraged licensees to take the initiative to translate the lessons learned from the MOV operating experience and the diagnostic testing associated with MOVs to AOVs. As noted in Section 4 of this report, licensees at the seven sites visited have initiated AOV programs to address those and other similar problems. Those AOV programs vary in age, resources, and effectiveness and they are voluntary. They use risk-informed techniques drawing from operating experience, the maintenance rule, plant IPE and IPEEEs, plant operating and emergency procedures, plant technical specifications, etc., to identify important AOVs, the design capability of which need to be verified. Some licensees have performed analyses and diagnostic tests to verify the capability of certain AOVs. Some utilities use diagnostic testing equipment to improve the set-up and maintenance of their AOVs. However, some licensees are not addressing the AOV design capability issues and these programs are voluntary.In 1997, EPRI implemented AOV pilot programs at the Palisades and Fermi 2 plants andrecently implemented pilot programs at the Duane Arnold and Comanche Peak plants. EPRI's program supports identification of important AOVs, development of AOV calculational techniques, and verification of the design capabilities.In 1997, U.S. LWR licensees formed the JOG-AOV. JOG-AOV's stated mission is "to developa common and cost-effective U.S. nuclear utility AOV program which defines the minimum elements necessary to enhance safe and reliable AOV performance and allow timely address of industry and regulatory AOV issues" (Ref. 14). The JOG-AOV initiatives are voluntary. On June 3, 1999, a public meeting was held at NRC headquarters to discuss industry activitiesregarding AOVs. NRC staff met with representatives from NEI, JOG-AOV, Institute of Nuclear Power Operations, AUG, and EPRI to discuss AOV issues, including the JOG-AOV Program and JOG-AOV Program document. The meeting discussions about the JOG-AOV program and program document were limited because the NRC had not received copies prior to the meeting.

NRC attendees noted that the industry programs appeared to be positive voluntary initiatives.

However, the JOG-AOV program did not address several items which the NRC staff thought were important. The following list is a representative tally of those items not fully addressed: 1.Air system quality.2.Risk significant nonsafety-related AOVs.

3.Quarter-turn AOVs (dampers).

4.Licensee commitments and schedules for implementation.On July 19, 1999, NEI transmitted the JOG-AOV Program document to the NRC (Ref. 15). Inthe transmittal letter, NEI stated that the NRC was not requested to review or endorse JOG AOV's program document and that industry does not want credit for such industry activities in the context of SECY-99-063, "The Use by Industry of Voluntary Initiatives in the Regulatory Process." On October 8, 1999 (Ref. 16), NRC responded to NEI's July 19, 1999 letter, providing comments on the JOG-AOV program document.

16Top Event Prevention AnalysisThe technical paper, "Use of Top Event Prevention Analysis to Select a Safety-SignificantSubset of Air-Operated Valves for Testing" (Ref. 17), describes some aspects of the Monticello plant's AOV program. Discussion with the Monticello plant staff and their contractor found that the Monticello plant's AOV program is under development and will be similar to the AOV programs of other plants noted in this report. One difference is that Monticello plant's AOV program will use the "Top Event Prevention" (TEP) methodology to identify "safety-significant" AOVs for design basis review and periodic testing. The paper describes the results of some of the work that the Monticello plant and its contractors have done to select safety-significant AOVs using the TEP methodology.The TEP methodology is commonly referred to as a "minimum path set methodology." Itutilizes PSA techniques to determine which equipment must work in order to prevent the undesired event (top fault tree event) from occurring. The Monticello plant's TEP analysis identified 24 "important" AOVs. The paper reported that when the Monticello plant IPE's AOV failure rates were used for those 24 AOVs and a failure rate of one (1.0) was assigned to all other active AOVs, there was a small (8 percent) increase in the plant's base case core damage frequency (CDF). In contrast, failures of any two of the 24 "important" AOVs would result in significant increases in CDF above the base case.The technical paper also reported that when using the Fussell Vesely Importance and riskachievement worth threshold or screening values of 0.5 percent and 2.0 respectively (per the recommendations of NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," May 1993), the Monticello plant has no "potentially risk significant AOVs." In contrast, the paper stated that "while no AOVs exceed thresholds for risk significance, in combination with one another, they can have a significant effect if allowed to degrade in reliability." TEP analysis identifies the combinations of AOVs which are important to safety." Table 4 below lists the AOVs that the Monticello plant found were risk important using the TEP analysis. Table 4 Risk Important Air-Operated Valves at the Monticello Plant (Ref. 17)Valve Location or FunctionValve DesignationHotwell makeup from CSTsAV 1094A, AV 1094B Feedwater bypassAV 3489, AV 3490 Condensate demineralizer bypassAV 1740 RHRSW to RHR heat exchangerAV 1728, AV 1729 Hard piped ventAV 4539, AV 4540 Instrument air dryer bypassAV 1473 177AIR-OPERATED VALVE FAILURES AND RISKRecognizing the application of the single failure criterion and defense in depth, failure of asingle AOV would generally not be a cause of concern. However, all licensees visited identified "important" AOVs based on a variety of methods including plant specific probabilistic risk assessments, individual plant examinations, or maintenance rule expert panel reviews. Many licensees identified individual AOVs whose failure would result in increased risk as indicated by high risk achievement worth or high Fussell Vesely risk rankings.Licensees for three nuclear stations performed calculations of the risk achievement worthassuming CCF of redundant AOVs in certain safety systems. These are tabulated in Table 6 of NUREG/CR-6654 which shows risk achievement worths which range from slightly over 1 up to 202. 7.1Simultaneous Failure of Air-Operated Valves Which Disable Safety Systems.

The major safety concern of this study from a risk perspective is the simultaneous CCF ofAOVs, which disable redundant trains of a safety system. The scenario of most concern is that during an accident or transient, AOVs in redundant trains of a safety system fail when subjected to pressure, temperature, and flow conditions different from those seen during normal operation or testing. Similar to the situation with MOVs which led to issuance of GL 89-10, errors in design parameters, such as valve factors, and other design, manufacturing, or maintenance errors could result in lower than expected AOV valve operator force or greater than expected valve friction. Normal testing or routine operation of these valves, if performed under pressure, temperature, flow conditions different from those expected during an accident or transient, may not reflect the actual capability of the valve to perform during an accident or transient. Several instances from operating experience are noted in this study where AOVs were shownto be unable to operate under the conditions expected during an accident or transient. These were usually found through diagnostic testing methods similar to those utilized to verify MOV operability in response to GL 89-10 and its supplements. Current inservice testing and technical specification operability tests may not assure AOV capability for pressure and flow conditions during an accident or transient. Another safety concern is the potential simultaneous failure of two or more AOVs in importantsafety systems due to contamination from the pneumatic system or from fabrication and maintenance activities. Rust, dirt, or water in the air system can affect many valves.

Fabrication and maintenance activities can introduce excessive thread locker or other contaminants which cause sticking or binding. Elastomers deteriorate with age. AOV failures from these conditions are expected to be more random than the design errors and fabrication errors described above, but could still have the impact of disabling multiple trains of a safety system. The study and its companion report describe over 100 AOV events. Many of the events areCCFs which resulted in degradation of important safety systems. If the plant had experienced an accident or transient while these failures existed, plant safety may have been challenged.

18Risk calculations are generally done based on the assumption that components perform in aprobabilistic sense under accident conditions. For those situations where AOVs in redundant trains of a safety system are not capable of operating due to pressure, temperature, or flow conditions expected during an accident or transient, those assumptions are negated. A truer risk analysis would account for this type of failure mechanism by assigning a failure probability of 1.0 for those valves for the particular accident or transient in which the valves are incapable of performing as needed.7.2Sensitivity of Core Damage Frequency to Air-Operated Valve Failures A recently completed sensitivity study, INEEL report, "Generic Issue 158: Performance ofSafety-Related Power-Operated Valves Under Operating Conditions," NUREG/CR-6644, September 1999, (Ref. 18), provides insights into the sensitivities of seven different U.S.

nuclear reactors to the performance of their power-operated valves, (i.e., AOVs, SOVs, and HOVs). The study was performed for NRC to address Generic Safety Issue 158, "Performance of Safety Related Power-operated Valves Under Design Basis Conditions." The results show wide variations in the plants' sensitivities to valve failures. At some plants, common-cause AOV failures can have a significant effect on the risk as measured by CDF. Furthermore, CDF sensitivity is dominated by the likelihood for CCF (quantified by the beta factor).7.3Important or Risk Significant AOVs At each of the plants visited utility personnel provided lists of AOVs that were considered to beimportant at their plants. At many plants the selections were based on the AOVs' effect on CDF, as determined from the plants' PRAs, (i.e., the AOVs' risk achievement worth). Another subset of risk information that licensees at many of the plants visited deemed to be important was the AOVs' effect on large early release frequency. In addition, the licensees determination of the risk importance of AOVs considered the specific functions that the AOVs were required to perform as outlined in the plants' emergency, off-normal, abnormal recovery procedures, etc.

Table 5 below lists the systems, functions, or components that were determined by the licensees to have risk important AOVs at the plants visited and the number of risk significant AOVs at each station. In addition, the reader is directed to Table 6 in the INEEL AOV study NUREG/CR-6654 which lists the 182 AOVs that were determined by the licensees to be risk significant at the 7 sites visited. Two of the licensees found nonsafety-related AOVs that were risk significant. The Fermi plant found 11 "nonsafety-related AOVs that perform a risk significant function" and Indian Point Unit 3 found 4 nonsafety-related AOVs that were risk significant. 7.4Accident Sequence Precursors A review of NRC's Accident Sequence Precursor (ASP) program results found that during theyears 1984 to 1995, there were 288 events that were classified as precursors (conditional core damage probability [CCDP] greater or equal to 1E-06). Twenty-six of those events were AOV related (i.e., AOV malfunctions were involved as either initiators or contributors to the events).

Twelve of those AOV related precursor events had CCDP of 1E-04 or greater. The highest CCDP was the 1985 loss of all auxiliary feedwater at Turkey Point in which water contamination of the instrument air system resulted in common-cause AOV failures. The CCDP for that event was about 9E-04 which had the fourth highest CCDP of the 40 events that were found to be precursors that year. No AOV events after January 1, 1995, were classified as precursors by 19NRC's ASP program. Appendix B of the INEEL AOV study (Ref. 3) has an extensivediscussion of ASP events involving AOVs. Most ASP events involving AOVs are not the design basis challenges which are the major risk concern described in this study. That is because the conditions of pressure, temperature, and flow which challenge AOV capability mostly occur during accidents or unusual transients; and those events are rare.Table 5 Systems, Functions or Components Having Risk-Significant Air-Operated Valves at Plants Visited PlantsVisitedSystems, Functions, or Components Having Risk Significant Air-OperatedValvesNumber of RiskSignificant Air-Operated ValvesPalo VerdeUnits 1-2-3Charging system, ADVs, feedwater isolation, steam generator isolation 51Fermi Unit 2Main Steam (MSIVs), scram discharge volume vent and drain, drywell floor drain,condensate polishing demineralizer, condensate emergency supply, reactor feed pump, general service water, emergency equipment cooling water, emergency equipment service water, standby gas treatment, reactor building HVAC, standby gas treatment to torus air purge valve, torus vent 29PalisadesSDC heat exchanger, condensate inlet containment isolation, steam generator,SDC to LPSI, containment sump isolation to engineered safeguards room, steam generator steam dump 11LaSalle Units 1-2Containment vent valves, ADS, RHR room coolers, SW pump coolers, feedwaterregulator valve, drywell venting14Three MileIsland Unit 1ADVs, Containment isolation (coolant return lines) 4Indian PointUnit 3AFW, Main steam to auxiliary boiler, condensate storage tank to condenser,condensate polisher inlet stop valve, heater drain tank to condenser bypass, ADVs, pressurizer PORVs40Turkey PointUnits 3-4Steam generator blowdown control, auxiliary feedwater, CCW to emergencycontainment coolers, Instrument air combined header crosstie, charging pump suction.33TOTAL 1828FINDINGS AND CONCLUSIONS8.1AOV Program Practices*Licensees visited have implemented AOV programs.

• Licensee maintenance rule scope generally includes AOVs, both "safety-related" and"nonsafety-related."*Licensees have identified risk significant and "important" AOVs, both "safety-related"and "nonsafety-related."*Significant variations exist in the scope and focus of current licensee AOV programs.

20*Air-operated dampers are excluded from most current and proposed AOV programs.*The proposed JOG-AOV program is voluntary.

8.2Air-Operated Valve Performance Under Accident or Transient Conditions

• Current testing methods may not assess AOV performance under certain accident ortransient conditions, similar to the earlier situation with MOVs. *Several licensees that have begun using diagnostic equipment similar to that used forMOVs have found AOVs which would not perform as expected under certain accident or transient conditions.*Several licensees that have reanalyzed AOVs' capability using updated design andvalve factor information have found AOVs which would not perform under certain accident or transient conditions. 8.3Air-Operated Valve Common-Cause Failure Experience

• Design and manufacturing errors.

• Aged and degraded elastomers and other piece parts.

• Contamination from the pneumatic system and fabrication materials.

8.4Air-Operated Valve Risk Considerations

• Licensees have identified AOVs which they consider to have risk significance based onhigh risk achievement worth and other risk analysis methods. These usually address the risk of a single valve failure. *The primary risk concern regarding AOVs found in this study is the potential forsimultaneous CCF of both trains of a safety system during an accident or transient due to design, manufacturing, maintenance, and testing deficiencies which do not properly account for pressure, temperature, and flow conditions expected to occur during accidents or transients. *Another concern is the potential for simultaneous CCF mechanisms introduced by airsystem contamination, other contaminants, or ageing of elastomeric parts. 9RECOMMENDATIONSThe implementation of an effective AOV program, incorporating the use of analysis, diagnostictesting, and lessons learned from operating experience, can minimize the likelihood of AOV failures resulting in risk significant events. Such a program would:

21*Identify safety related AOVs which are normally in a non-safety position and areexpected to move to their safety position during accidents or transients. (These will subsequently be referred to as safety related active AOVs.)*Identify safety related active AOVs which contribute the most to risk should they fail tooperate, using plant-specific application of appropriate risk-ranking methodologies. For those valves with unconfirmed design margin and unrepresentative diagnostic testing, risk calculations which consider failures of redundant valves in both trains of a system may be appropriate. *Establish confidence that risk significant safety related active AOVs will operate asrequired, subject to the actual pressures, temperatures, and flows during transient and accident conditions, by application of accepted and verified analysis or diagnostic testing methods. Assure continued operability of these valves through periodic testing. *Establish operations and maintenance practices which prevent introduction ofcontaminants to the pneumatic system or to the valves and their sub-components and replace aging elastomers as appropriate. *Identify nonsafety-related valves which have high risk significance and apply similaranalysis or diagnostic techniques.Cooperation between the NRC and industry to develop the guidance for AOV programs wouldfacilitate and optimize the implementation of these programs. 10REFERENCES 22 1.U.S. Nuclear Regulatory Commission, 10 CFR 50.65, "Requirements for Monitoring theEffectiveness of Maintenance at Nuclear Power Plants."2.U.S. Nuclear Regulatory Commission, Generic Letter 89-10, "Safety Related Motor-Operated Valve Testing and Surveillance 6 10 CFR 50.54(f)," June 28, 1989.3.Idaho National Engineering and Environmental Laboratory Report, "A Study ofAir-Operated Valves at U.S. Nuclear Power Plants," NUREG/CR-6654, February 2000.4.Instrument Society of America ISA-S7.0.01-1996, "Quality Standard for Instrument Air,"November 1996.5.American Society of Mechanical Engineers, ASME OMa-S/G-1998 Guide Part 17,"Performance Testing of Instrument Air Systems," 1998. 6.Electric Power Research Institute (Nuclear Maintenance Applications Center) NP-7079,"Instrument Air Systems - A Guide for Power Plant Maintenance Personnel,"

December 1990.7.U.S. Nuclear Regulatory Commission, Information Notice 95-34, "Air Actuator andSupply Air Regulator Problems in Copes-Vulcan Pressurizer Power-Operated Relief Valves," August 25, 1995.8.U.S. Nuclear Regulatory Commission, Information Notice 88-24, "Failures of Air-Operated Valves Affecting Safety-Related Systems," May 13, 1988.9.Palisades Nuclear Plant Condition Report, C-PAL-97-0404, March 18, 1997.

10.U.S. Nuclear Regulatory Commission, Inspection Report 255/97-05, June 17, 1997.

11.U.S. Nuclear Regulatory Commission, Inspection Report 255/97-18, February 26, 1998.

12.U.S. Nuclear Regulatory Commission, Information Notice 89-38, "Atmospheric DumpValve Failures at Palo Verde Units 1, 2, and 3," April 5, 1989.13.Turkey Point Station Condition Report 96-0535, April 29, 1996; Supplement 1, May 16,1996; Supplement 2, September 16, 1996; Supplement 3, February 7, 1997.14.Coleman, M., "JOG-AOV Program," presented at 2nd Joint Meeting of the Air-OperatedValve and Motor Operated Valve User's Group Meeting (AUG Meeting Number 16),

December 1998.15.Modeen, D., Nuclear Energy Institute, letter to E. Imbro, U.S. Nuclear RegulatoryCommission, "Joint Owners Group Air-Operated Valve Program Document," July 19, 1999. 16.Imbro, E., U.S. Nuclear Regulatory Commission, letter to D.J. Modeen, Nuclear EnergyInstitute, "Comments on Joint Owners' Group Air-Operated Valve Program Document,"

23October 8, 1999.17.Proceedings of the 4th International Conference on Probabilistic Safety Assessment andManagement. Nierode, C.F., Wellumson, T.P., Worrell, R.B., Blanchard, D.P., "Use of Top Event Prevention Analysis to Select a Safety-Significant Subset of Air-Operated Valves for Testing," September 1998. 18.Idaho National Engineering and Environmental Laboratory Report, "Generic Issue 158: Performance of Safety-Related Power-Operated Valves Under Operating Conditions,"

NUREG/CR-6644, September 1999.