ML20044C200
| ML20044C200 | |
| Person / Time | |
|---|---|
| Site: | Fermi  |
| Issue date: | 01/31/1993 |
| From: | Gunther W, Travis R, Villaran M BROOKHAVEN NATIONAL LABORATORY |
| To: | Office of Nuclear Reactor Regulation |
| References | |
| CON-FIN-A-3875 BNL-NUREG-52352, NUREG-CR-5959, NUDOCS 9303190116 | |
| Download: ML20044C200 (55) | |
Text
{{#Wiki_filter:- NUREG/CR-5959 BNL-NUREG-52352 High Pressure Coolant Injection (HPCI) System Risk-Based Inspection Guide for Enrico Fermi Atomic Power Plant, Unit 2
- 1. hi'l , R. Travis, W.' Gunther Brookhaven National Laboratory Prepared for U.S. Nuclear Regulatory Commission 188 '!Baan Zi8aasu PDR G
d' f AVAILABILIT1f NOTICE Availability of Reference Materials Citriin NRC Pubhcatons
.i Most documents cited in NRC pubucations w!D be available from rane of the following sources:
- 1. The NRC Pubuc Document Room, 2120 L Street, NW., Lower Level, Washington, DC 20555 ;
- 2. The Superintendent of Documents, U.S. Government Printing Of6ce. P.0, Box 37082. Washington, DC 20013-7082 ,
- 3. The National Technical information Service Springfield, VA 22161 Although the hsting that foBows represents the majority of documents cited in NRC pubDeations, it is not htended to be exhaustive. ,
Referenced documents available for inspecthn and copying for a fee from the NRC Pubic Document Room helude NRC correspondence and internal NRC memoranda; NRC bulletins, circulars, info mation notices. Inspection and investigation notices; licensee event reports; vendor reports and correspondence; Commis-slon papers; and apphcant and licenses documents and correspondence, ; The following documents h the NUREG series are available for purchase from the GPO Sales Frogram: formal NRC staff and contractor reports, NRC-sponsored conference proceechngs, intemational agreement I reports, grant publications, and NRC booklets and brochures. Also available are regutatory guides NRC ! regulatons hn the Code of Federal Regulations, and Nuclear Regulatory Commission issuances. l Documents available from the National Technical information Service hclude NUREG-series reports and i technical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commis. ! sion, forerunner agency to the Nuclear Regulatory Commission. ; Documents aval!able from pubhc and special technical libraries include au open hterature items, such as books, journal articles, and transactions. Federal Register notices Feceral and State legislation, and con- . gressional reports can usually be obtained from these libraries. l Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference pro ~ I ceedings are aval!able for purchase from the organization sponsoring the publication cited. Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Administration, Distribution and Mall Services Section, U.S. Nuclear Regulatory Commission. Washington, DC 20555, [ Copies of industry codes and standards used h a substantive manner in the NRC regulatory process are maintained at the NRC Library. 7920 Norfolk Avenue, Bathesda, Maryland, for use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are , American National Standards, from the American National Standards institute,1430 Broadway. New York, NY 10018. i i 3 DISCLAIMER NOTICE i This report was prepared as an account of worft sponsored by an agency of the United States Govemrnent. [ Neitherthe United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any infermation, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights. i I r
?
'. ,1 l ': .{
l ' NUREG/CR-5959 ' 1 l
'BNL-NUREG-52352 i
a f High Pressure Coolant ' Injection (HPCI) System Risk-Based Inspection Guide . for Enrico Fermi 1 Atomic Power Plant, Unit 2 ' a t Manuscript Completed: November 1992 , Date Published: January 1993 - . Prepared by M. Villaran, R. Travis, W. Gunther - - J. Chung, NRC Project Manager , 1 Brookhaven National laboratory , Upton, m' 11973 l
't Prepared for l Division of Systems Safety and Analysis
' Office of Nuclear Reactor Regulation U.S. Nucicar Regulatory Commission 7 Washington, DC 20555 - l NRC FIN A3875 't i
f i j
. -l
r ABS'IRACT The High Pressure Coolant Injection-(HPCI) system has been examined from a risk V perspective.' A System Risk-Based Inspection Guide (S-RIG) has been developed as an aid to-HPCI system inspections at the Enrico Fermi Unit 2 Nuclear Power Plant. Included in this S-RIG is a discussion of the role of HPCI in mitigating accidents and a presentation of a PRA-based ' failure modes which could prevent proper operation of the system. The S-RIG uses industry operating experience, including plant-specific illustrative examples to augment the basic PRA failure modes. It is designed to be used as a reference for both routine inspections and the evaluation of the significance of component failures. o
+
J iii 1 6
, , , . .. ~ ,
r- r
' CONTENTS 4
g
? ABSTRACT . ; . . . . . . . . . . . . . . . . . . . . ......., ................... ~ iii '
SUMMARY
. . . . .. . . . . . . . . . . . . . . .......... ..... ..... ....... vii ACKNOWLEDG EM ENT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix f
1 INTRODUCT. ION . . . . . . . . . . . .............s.. ............ 11-1 Purpose. . . . . . . . . . . . . . . .............................. 1-1 1.1l 1.2 Application to Inspections . . . . . . . . . . . , .................. 1-l ' 2 H PCI SYSTEM DESCRIPTION . . .. . . . . -. . . . . . . . . . . . . . . . . . . . . . . .21 . 3 ACCIDENT SEQUENCE DISCUSSION . . . . . . . . . . . . . . . . .. . . . . . . . . 31 3.1 Loss of High Pressure Injection and- - Failure to Depressurize ~ . .............................. .3-1 3' 3.2 Station Blackout (SBO) With Intermediate . Term Failure of High Pressure Injeetion . . . . . . . . . . . . . . . . . . . 3-1 3.3 Station Blackout with Short Term Failure of High Pressure Injection . . . ... .................... 3-2' 3.4 ATWS With Failure of RPV Water Level , Control at High Pressure .. .. .....................,.. 3-3
. 3.5 Unisolated LOCA Outside Containment . . .. .... .......... 3-3 '
3.6 Overall Assessment of HPCI Importance in . the Prevention of Core Damage . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 4 PRA-BASED HPCI FAILURE MODES . . . . . . . . . . . . . . . . . . . . . . . . . . 41'
- 5. . HPCI SYSTEM WALKDOWN CHECKLIST BY. RISK IMPORTANCE ~., . ~ 5 3 6 OPERATING EXPERIENCE REVIEW . . . . . . . . . . . . . . . . . . . n . . . . . 6 1' ' .
6.1 HPCI System Failure Modes . . . . . . . . . . . . . . . . . . . . . . . . . s . . . 61. . 6.2 Contribution of Human Error - . -. . . . . . . . ; . . . . . . . . . . . . . . . . 6 14 : 6.3 Support Systems Required for HPCI Operation . . . . . . . . . . . . . . . ' 6-15 L 6.4 H PCI System Inteiractions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-16 -- 6.5 Simultaneous Unavailability of Multiple. Systems . . .......v.... 6 16 :; 6.6 - LOCA' Outside Containment . . . . . . . . . . . . ; . . . . . . . . . . . . . . . . 6 17
- 7.
SUMMARY
. . . . . . . . . . . . . . . ............... .... ......... [7 :
8 ' REFERENCES. . . . . . . . . . . . . ............. ........ ........ 8 ; A-1 Summary of Industry Survey of HPCI Operating Experience HPCI Pump or Turbine Fails to Start or Run ...... ............... .A . A-2 Selected Examples of Additional HPCI Failure Modes " Identified During Industry Survey . . . . . . . . . . . . . . . . . . . . ............ A 8-- v t
=m 1
T L'
- LIST OF FIGURES ;' hge 2-1 Simplified HPCI Flow Diagram . . . . . . . , . . . . . . . . . . . . . . . . . . . . . . ~2 2 LIST OF TABLES -
4.1 HPCI PRA-based Failure Summary . . . . . . . . . . . . . . .. . . . . . . . . . . . . 4-2
. 4-2 Fermi 2 HPCI System RIG Summary . . . . . . . . . . . . . . .. . . . . . . . . . . . 43-5-1 ~ Fermi Unit 2 HPCI System Checklist
-52 6 - HPCI Failure Summary . . . . . . ..........., . ................ ~6-3: ,
6-2 HPCI Pump Turbine Fails to Start or Run { HPCI Failure No.1 Subcategories . .. ............ ............ 16-4. A-1 HPCI Pump or Turbine Fails to Start Industry Survey Results . . . ................................. . A.2 - - A-2 Summary ofIllustrative Examples of Additional '. HPCI Failure Modes ...... .... .......................... A.9 :,
.e 4
s-L T t t t t f , , .. ? t
.. [
,L
. VI .
B
a kg 0
SUMMARY
his' System' Risk-Based Inspection Guide has been developed as an aid to HPCI system inspections at Fermi Unit 2. The document presents a risk-based discussion of the role of HPCI . in accident mitigation and provides PRA-based HPCI failure modes (Sections 3 and 4). Most PRA ' oriented inspection plans end' here and require th'e inspector to rely on his experience and ? knowledge of plant specific and BWR operating history. However, the system RIG uses industry operating experience,includingillustrative examples, to augment the basic PRA failure modes. He risk-based input and the operating experience have been combined in Table 4-2 to develop a composite BWR HPCI failure ranking. This information can be used to optimize NRC resources by allocating proactive inspection effort based on risk and industry experience. In conjunction, the more important or unusual component faults are reflected in the walkdown checklist in Section 5. This, along with an assessment of the operating experience . found in Section 6, provides potential areas of NRC oversight both for routine inspections n'nd the .
post mortems" conducted after significant failures.
A comparison of the Fermi Unit 2 and the industry-wide BWR, HPCI failure distributions is presented in Table 4-2. Although the plant specific data are limited, certain Fermi Unit' 2 . components exhibit a proportionally higher than expected contribution to total HPCI failures. Rese components are candidates for greater inspection activity.and the generic prioritization j should be adjusted accordingly. l As the plant matures, operational experience is assimilated by the utility's staff and reflected - in the plant procedures. For example, the incidence of inadvertent HPCI isolations due to surveillance and calibration activities is expected to decrease. Conversely,.in time, aging related faults are expected to become a contributor to the Fermi Unit 2 HPCI failure distribution. He ' operating experience section, identifies several aging related failures which occurred at Duane' , l Arnold, Hatch, Cooper and Brunswick, generally in the pump and turbine electronics. 4
~
This report includes all_ HPCI LERs up to mid-1989. During a site visit in November 1992,- three additional LERs related to HPCI at Fermi were evaluated, and are discussed in this report. n Subsequent LERs can be correlated with the PRA failure categories, used to' update the plant ; , specific HPCI failure contribution, and compared with the more static, industry-wide,' HPCI BWRi " failure distribution. The industry operating experience is developed from a variety of BWR plants and is expected to exhibit less fluctuation with time than a single plant. This information can be trended to predict where additional inspection oversight is warranted as the plant matures. vii wx- : '
l ACKNOWLEDGEMENT f 2
. The authors wish to express their appreciation to the NRC Program Manager for this project,--
Dr. Jin W. Chung, for his technical direction, and to the NRC's resident' inspector at Fermi Unit ' 2, Mr. Kenneth Riemer, for his constructive comments and insights during a site visit. We express our gratitude to members of the Engineering Technology Division of BNL, Mr. J. Higgins, Mr. J. Taylor, and Mr. R. Hall, for their review of this report. Finally, we wish to thank Ms. Ann Fort for her help in the preparation of this manuscript. 1 L L t I ix i l l
i t
- 1. INTRODUCTION !
I i 1.1 Purpose ; l This HPCI System Risk-Based Inspection Guide (S-RIG) has been developed as an aid to l NRC inspection activities at the Enrico Fermi Nuclear Power Plant -_ Unit 2. De High Pressure
- Coolant Injection (HPCI) system has been examined from a risk perspective. Common BWR I accident sequences that involve HPCI are described in Section 3 both to review the system's !
accident mitigation function and to identify system unavailability combinations that can greatly increase risk exposure. Section 4 describes and prioritizes the PRA-based HPCI failure modes for ., inspection purposes. The results of a BWR operating experience review are presented in Section. l 6 to illustrate these failure modes. Section 6 also provides additional information in related areas ; such as HPCI support systems, human errors, and system interactions. A list of risk significant ; components is contained in Section 5, and references are provided in Section 8. ! i 1.2 Annlication to Inspections l t i This inspection guide can be used as a reference for both routine inspections and for ! identifying the significance of component failures. The information presented can be used to ; prioritize day-to-day inspection activities, and the illustrative HPCI failures can suggest multiple inspection perspectives. The S-RIG is also useful for NRC inspection activities in response to ! system failures. The accident sequence descriptions of Section 3 in conjunction with, the discussion' -j of multiple system unavailability (Section 6), provide some insight into combinations of system j outages that can greatly increase risk. The discussion of the operating experience review provides 1 information on the various failure mechanisms, and the corrective actions taken. This could be .: useful to the inspector when reviewing a licensee's response to a HPCI system failure. The system RIG can also be used for trending purposes. Tables A-1 and A-2 provide a summary of the nuclear industry's HPCI operating experience. Table 4-2 presents a comparison , of the Fermi 2 HPCI failure distribution with industry experience. Certain HPCI failure modes -l appear to account for a disproportionate fraction of the Fermi 2 HPCI system failures and are ; candidates for increased inspection activity. Since the plant specific failure distribution is expected 1 to vary over time, Table 4 2 should be updated periodically to trend the Fermi 2 HPCI experience, i in comparison to the more static industry experience. ;
.I y
i q
)
i 1-1 3 o
l
?
I
- 2. HPCI SYSTEM DESCRIPTION j The Fermi 2 High Pressure Coolant Injection (HPCI) system is a single train system consisting - l of turbine-driven injection and booster pumps, a barometric condenser, piping, valves, controls, and !
instrumentation. A simplified flow diagram is shown in Figure 2-1.' The system is designed to j pump a minimum of 5200 gpm of water into the reactor vessel over a range of reactor pressures from 150 to 1020 psig when automatically activated on a reactor vessel low water level, low level 2 (110.8 inches) or drywell high pressure (1.68 psig) condition, or when manually initiated from the - control room. Two sources of cooling water are available. Initially, the HPCI pump takes suction from the condensate storage tank (CST) through a normally open motor-operated valve E41-F004. . The pump suction automatically transfers to the suppression pool on low CST level or high. l suppression pool level. This transfer is accomplished by a signal that opens the suppression pool l suction inboard and outboard isolation valves E41-F042 and E41-F041. Once these valves are fully .!' open, valve-position-limit switch contacts automatically close the CST suction valve E41-F004. Events that raise the suppression pool temperature above the HPCI system design limit foi suction source temperature may require a manual suction transfer back to the CST. l Upon HPCI initiation, the normally closed pump discharge inboard isolation valve E41-F006, ; automatically opens, allowing water to be pumped into the reactor vessel through the main ! feedwater header A. A minimum-flow bypass is provided for pump protection. When the pump. '} minimum flow bypass valve E41-F012 is open, flow is directed to the suppression pool. A full-flow j test line is also provided to recirculate water back to the CST. The two motor-operated test line .; isolation valves, E41-F008 and E41-F011, are equipped with interlocks to automatically close the- ( test line (if open) upon generation of an HPCI initiation signal. -l The HPCI turbine is driven by reactor steam. The inboard HPCI steam supply isolation valve ; E41-F002 and the bypass valve E41-F600 around the outboard isolation valve in the steam line to l the HPCI turbine are normally open to keep the piping to the turbine at an elevated temperature, i thus permitting rapid startup, and reducing thermal transients on the piping. Upon receiving a j signal from the HPCI isolation logic, these valves, as well as the outboard isolation valve E41 F003, , will close and cannot be reopened until the isolation signal is cleared and the logie is reset. The j steam supply inboard isolation valve E41-F002 is powered from Division I 480V AC MCC 72C-3A and controlled by isolation logic system A; the steam supply outboard isolation valve E41-F003 is ! powered from Division 11260V DC MCC 2PB-1 and controlled by isolation logic ~ system B. The. ] HPCI system is a Division 11 system with the exception of the HPCI turbine steam supplyinboard j isolation valve E41-F002. i l Steam is admitted to the HPCI turbine through the turbine steam inlet valve E41-F001, a" !' turbine stop valve E41-F067. and a turbine control valve E41-F068 all of which are normally closed and are opened by an HPCI initiation signal. Exhaust steam from the turbine is discharged to the ; suppression pool, while condensed steam from the steam lines and leakage from the turbine gland ; seals are routed to a barometric condenser E41-B001. j
-l i
i 1 l 2-1 i I
A 850 k Man Bham ,5 C Law A n' i*
,,,, ,ma, ,, r. ..-ma.
Fl?B I178 - Senam Supph . Outmare amanon 4 8$# Bypass Vale gg % $010 CR0 fun. f t* Samon from Canoerman FDDI X r f600 r Strape las Mam Sleam horawm vale fD19 - tschman
~
I, I 7002 g
' /f003
$$eam 5uppW Dumoud holanun vain
-{F067 v. e
---- B<g ,,, ,,,,
! 7 h ses I-t V 4 Swam $uppW 8 Inbord mosaban 8 '
Man Vate preury 1 o
"" . Contamnent i Tm F045 ,g'. fM ""
Boosw Pump Sucson l * [f012 - ffom 8vppassum Peal vate 8 eurro _ N een, unumum rim, vain lo Suppressum Poul g terment 8 A
! _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _'"_ _ _ J ** '" %
"J"
e"&'fs'Ma =-
=
M, ,x. , 8 ,.,-1,- [ ESMC22 from RCIC FuB fknrlast(Jns Figure 2-1 Simplified HPCI Flow Diagram 2-2 1 L
t t
- 3. ACCIDENT SEQUENCE DISCUSSION
_. The role of the HPCI system in the prevention of reactor core damage is valuable information that can be applied in the normal day-to-day inspection activities. If a plant has its own - Probabilistic_ Risk Assessment (PRA), this information is readily available. Not only are plant specific design and operating nuances considered, but the accident sequences, systems and ! component risk impoitances are generally quantified and prioritized. q Since most plants do not currently have PRAs, the application of risk insights is less straight 2 ; forward. An ongoing PRA-based Team Inspection Methodology for the Risk Applications Branch ; of NRR has developed eight representative BWR accident sequences based on a review of the , available PRAs'. Because of design and operational similarities, these representative accidents can , be applied to other BWRs for risk based inspections. This information can be used to allocate ' inspection resources commensurate with risk importance. In addition,if single or multiple systems are degraded or unavailable, this methodology can be used to designate those accident sequences that have become more critical due to the unavailability of a key system (s). His can allow the inspector to focus on the remaining systems / components within a sequence to assure continued + availability and minimize plant risk. ' Five of the eight sequences include the HPCI system, for _ mitigation or as a potential initiator and are discussed below. . 3.1 less of Hich Pressure Iniection and Failure to Depressurize This sequence is initiated by a general transient (such as MSIV closure, loss of feedwater, or loss of DC power), a loss of offsite power, or a small break LOCA. The reactor successfully j scrams. The power conversion system, including the main condenser, is unavailable either as a i direct result of the initiator or due to subsequent MSIV closure. The high pressure injection systems (HPCI/RCIC) fail to inject into the vessel.The major causes of HPC1/RCIC unavailability include one system disabled due to test or maintenance and system failures such as turbine / pump 3 faults, pump discharge or steam turbine inlet valve failure to open. The CRD hydraulic (CRDH) - system can also be used as a source of high pressure injection (HPI), but the failure of the_second , CRD pump or unsuccessful flow control station valving prevents sufficient RPV injection. The . ' operator attempts to manually depressurize the reactor pressure vessel (RPV), but a common' cause failure of the safety relief valves (SRVs) defeats both manual and automatic depressurization of the reactor vessel. The failure to depressurize the vessel after HPI failure results in core damage due to a lack of vessel makeup. 3.2 Station Blackout (SBO) with Intermediate Term Failure of Hich Pressure Iniection This sequence is initiated by a loss of offsite power (LOOP). The etnergency diesel generators (EDGs) are unavailable, primarily due to hardware faults. Maintenance unavailability is a secondary contributor. Support system malfunctions include EDG room or battery /switchgear room HVAC failures, service water pump, or EDG jacket cooler hardware failures.' ' ! HPCI and RCIC are initially available and provide vessel makeup.
+
3-1 1 r
? ,
The high pressure injection systems can provide makeup until:
- the station batteries are depleted, or the system fails due to environmental ~ conditions i.e., high lube oil .
temperatures or high turbine exhaust pressure due to the high suppression pool temperature and pressure, or
- the RPV is depressurized and can - no longer support HPCI or 'RCIC operation.
- the HPCI high area temperature logic isolates the system or long term exposure to high temperatures disables the turbine driven pump. -
Plant procedures should address means to maintain DC power for as long as possible, to assure a continued source of water to the HPCI or RCIC, to ensure adequate lube oil cooling, and to provide contingency measures (such as supplying fire water via RHR system) if the SBO progresses until reactor pressure (decay heat) can no longer support HPCI or'RCIC. The plant , procedures should be consistent with the BWR Owner's Group Emergency Procedure. Guidelines.- The reactor building environmental conditions can also impact long term HPCI system opera. -! tion. The reactor building HVAC and HPCI room cooling are dependent on AC power. There is_- i the possibility of spurious activation of the steam line break detection logic, and although the high - , area temperature isolation logic may be inactive during SBO ~ conditions, there are potential " environmental qualification concerns at elevated temperatures. The plant actions to monitor and control high area temperature should be reviewed including any calculations necessary to establish - a time frame for the implementation of these actions. 3.3 -Station Blackout with Short Term Failure of Hich Pressure Iniection t i This SBO sequence is similar to the previous sequence except the high pressure injection. : systems fail early. The sources of emergency AC power i.e., the emergency diesel generators . (EDGs), fait primarily due to hardware failures. Secondary contributors are: output breaker i failures and EDG unavailability due to test or maintenance _ activities. Support system - malfunctions, such as service water failures in the EDG jacket cooling water ' train, - battery /switchgear room HVAC failures, or test a..d maintenance unavailability are significant contributors to the loss of all AC power. ; Station battery failures are an important contributor to this sequence, because HPI systems , and the EDGs are DC dependent. As discussed in the ~ previous SBO . sequence, HPCI: ; unavailability is dominated by turbine / pump failures and maintenance unavailability. Core damage , occurs shortly after the failure of allinjection systems. 32 Y
1
- 3A ATWS with Failure of RPV Water Level Control at Hich Pressure ,
This sequence is initiated by a transient with initial or subsequent MSIV closure and 'a failurc - ,
- of the reactor protection system. Attempts to manually scram are not successful, however the i' Standby Liquid Control System (SLCS) is initiated. By definition, the condenser and the feedwater - "
system are unavailable. The BWR Owner's Group Emergency Procedure Guidelines (EPGs) recommend RPV water level reductions to control reactor power below 5% and the BWR representative sequence was based on that philosophy. This sequence postulates a failure to ensure sufficient RPV makeup at high pressure to pre-vent core damage. There are two failure modes:
- 1. The operator fails to control water level at high RPV pressure. This results in high core power levels, continuous SRV discharges and suppression pool heat'up. After the suppression pool reaches saturation, containment pressurization.begins. However, - 3 high pressure injection fails due to high suppression pool temperature prior. to:
containment failure.
- 2. The high pressure injection (HPCI) system fails, primarily due to pump failure ta start -
or testing and maintenance (T&M) unavailability. Injection or mintlow valves, suction 1 switchover, or loss of DC power are other system failures. HPCI pump failure to start or run, pump unavailability due to testing and maintenance activities, and Service Water EDG jacket cooler inlet or return valve failures are the major system failures. The inability to maintain RPV water level above the top of the active fuel (TAF) requires manual emergency depressurization, which is expceted to result in core damage before the low
~'
pressure ECCS can inject.
~
.The continued operability of HPCI during an ATWS event is critical.'Within th'e context of' this accident sequence, (i.e., time available for success) the capability of the licensee to perform the logic bypasses should be evaluated periodically.
3.5 Unisolated LOCA Outside Containment , The initiator is a large pressure botmdary failure outside containment with a failure to isolate the rupture. The piping failure is postulated in the following systems: main steam (60%), feedwater
- (12%), high pressure injection (20%), and interfacing LOCA (8%). The percentages indicate the -
r estimated relative core damage contribution of each system . Aa interfacing LOCA initiator is defined as the initial pressurization of a low pressure line which results in a pressure boundary failure, compounded by the failure to isolate the failed line. The failure is typically postulated in a low pressure portion of the core spray (CS) system, the j LPCI, shutdown cooling and (to a lesser extent), the HPCI or RCIC pump suction or the head - spray line of RHR system. , 1-l l t- , l 1
.3-3 .;
I
'l l
l
i I The unisolated LOCA outside containment results in a rapid loss of the reactor coolant . system (RCS) inventory, eliminating the suppression pool as a long term source of RPV injection.
- Piping failures in the reactor building can also result in unfavorable environmental conditions for g the ECCS. Unless the unaffected ECCS systems or the condensate system are available,long term j RPV injection is suspect and core damage is likely. i l
There have been several HPCI pump suction overpressurization events, primarily during - [ surveillance testing of the normally closed pump discharge motor-operated valve E41-F006' This is of particular concern for the discharge configuration with a testable air-operated check valve + (General Electric HPCI valve No. F005) in addition to the normally closed MOV because of the . valve's history of back leakage. 1
- L The HPCI interfacing LOCA initiator seems to be less of a problem with the configurction !
of a normally closed E41-F006, primarily because another normally open E41-F007 is closed pdor I to the E41-F006 surveillance. However, the concerns of the previous configuration are also vahd here. There must be reasonable assurance that the normally closed E41-F006 valve is leak tight - during plant operation and, prior to stroke testing, confirmation is necessary to assure that E41- ! F007 is fully closed and will provide the necessary protection for the upstream' piping. Potential interfacing system LOCA precursors and steam line isolation logic failures are presented in Section ; 6.3 Support Systems. ! i 3.6 Overall Assessment of HPCI Imoortance in the Prevention of Core Damace l l As~previously stated, the high pressure injection function (HPC1/RCIC/CRDH) contributes
- to five of the eight representative BWR accident sequences. The system failures for all.eight 'j sequences were prioritized by their contribution to core damage (using a normalized Fussell-Vesely l importance measure). The HPl function in aggregate was in the high importance category. Other _ ;
high risk important systems are Emergency AC Power and.RPS. The HPCI system itself is of medium risk importance, because of the multiple systems that. can succes's fully provide vessel - makeup at high pressure. For comparison, other systems with a medium risk importance.are: < Standby Liquid Control, Automatic / Manual Depressurization, Service Water, and DC Power. '[ e t I r s k b t 3-4 f
4.- PRA-BASED IIPCI FAILURE MODES -+ PRA models are often used for inspection purposes to prioritize systems, components and hu-man actions from a risk perspective. This enables the inspection effort to be apportioned based ; on a core damage prevention measure called risk ~importance. The'.HPCI failure modes for this
. system Risk-Based Inspection Guide (System RIG) were developed from a review of BWR plant _. ;
specific RIGS" and the PRA-Based Team Inspection Methodology'. . The component failure j modes are presented in Table 4-1, grouped by risk significance. Table 4 2 contains a summary'of j the operating experience for the industry and for Fermi. Unit 2 with regard to these risk significant failure modes. . PRAs are less helpfulin the determination of specific failure modes or root causes and do not . generally provide detailed inspection guidance. This makes it necessary for an inspector to draw - on his experience, plant operating history, Licensee Event Reports (LERs). NRC.. Bulletins, ; Information Notices and Generic Letters. INPO documents, vendor information and similar.
- sources to conduct an inspection of the PRA-prioritized items. To accomplish this task, Section ;
6 presents the results of a detailed review of the HPCI operating experience. The aforementioned : sources of HPCI information are correlated by PRA failure mode to provide illustrativeinspection examples. This information was also used to develop the system walkdown checklist presented in : .. the next section. { I P t
.i l
l
.i
-t
'h
?
4-1 j i i
+
7 k e Table 4-1 HPCI PRA-based Failure Summary
. COMPONENTS' High Risk Imnortance:-
Pump'or Turbine Fails to Start or Run System Unavailable Due to Test or Maintenance Activities Turbine Steam Inlet Valve E41-F001 Fails to Open Pump Discharge Inboard Isolation Valve E41-F006 Fails to Open Medium Risk Importance2 CST / Suppression Pool Switchover Irgic Fails Suppression Pool Suction Isolation Valves E41 F042 or E41-F041 Fail to Open . Normally Open Pump Discharge Outboard Isolation Valve E-41-F007 Fails Closed or is" Plugged Pump Minimum Flow Bypass Valve E41-F012 Fails to Open, Given Delayed Activation of Pump Discharge Inboard Isolation Valve, E41-F006. Lower Risk Importance2 , CST Suction Line Check Valve E41-F019 Fails to Open - CST Suction Line Manual Valve F010 Plugged Normally Open CST Pump Suction Valve E41-F004 Fails Closed or is Plugged :i Pump Discharge Check Valve E41-F005 Fails to Open - , Suppression Pool Suction Line Check Valve E41-F045 Fails to Open _ _ . Normally Open Steam Supply Inboard or Outboard Isolation Valve E41-F002 or E41-F003 , Fails Closed
' Steam line Drain Pot Malfunctions : >
Turbine Exhaust Line Faults, including: Normally Open Turbine Exhaust Valve E41.F021 is Plugged - ,
- Turbine Exhaust Check Valve E41-F049 Fails to Open Turbine Exhaust Line Vacuum Breaker E41-F075 or E41-F079 Fails to Operate False High Steam Line Differential Pressure Signal False High Area Temperature Isolation Signal False low Suction Pressure Trip:-
False High Turbine Exhaust Pressure Signal System Actuation logic Fails , Suction Strainer Fails to Pass Flow l
-i i
' See Section 6 for a discussion of I-IPCI human' errors.'
2 The Fussell-Vesely importance Measure is used 'to rank the system components.- His measure combines the risk significance of a failure or ' unavailability with the likelihood that the' failure / unavailability will ' occur.
]
4-2
~;
ji' i!, lj iil 1,ljij) . -
] llj s
t ne 7 m 4 A 4 m o C 7 0 0 0 0 O 1 6 6 7 0 0 7 2 3 3 2 i m r e F y r a m m u M 1 1 0 0 l 0 0 0 0 O 3 $~ G 3 I R m e ts y S I C P I I 2 'g t n m r ikn e F a R 2 3 2- e 1 4 r u le l ia b a F T
't
'n o i
t s u Rb
%ri t
t l 7 5 J 3 3 2 1 1 7 2 6 I n i 0 o 4 l C lA e r u il a F s g c e d e u e n l o s n s r e in n n i n t a e u s l w n d - o l i tr l u e' r l i s c o u le J er i er u u a d . s u i a i l f H I v hRr c b se tp o f e ts al fr i mu e r .l i h r o a r ai ae l i y p o l ig t r r s uf i oLA t t o o le o c i t lp S m s tr h n i i a v e r s c p r e p p ak t t P e i e el o hs is lo n e d i rT t i S
) pt a p u vb ir r u h ts s tc l t
tao h a UnA 1 mt s s o o t s ed t u i e r tn lat SI iei e s l t iS l r e s e e e r r i e e p e s tn n s f
.an "l i
w m M in s o l u l o in t tr ur inem inru t i t a tol U I e l t ci r e i a I s bl r u t tw be r s e l bl br tp mhl u s s s r lsS e& e sf eu Cl u e ifmia uu t u l T F Pi a u a u mia D e soa o imd i f g lI l' t f l t t t f t r f l F e pn~lFI S i ai ) iS l Ab y[. . . LiI . . w
'A .tc e
fg e 4 4
. o.
m r-
.& m
- o. . . . -
e o e e 1 WE' n
.C r
IO e s e e e e e e e o e v - t
=
=
N *iu E o t
=
=
j e - e e e e e e ~e o e e, C h
$=
z
~
t g 2 3 u 5 c g' . w m e n a e : u a r. E v m E
.i
. - g. .
C z e e 2 ms
# :e
<u - - -
i;; y m m .m m n n - y v v n e
=v
<tx
=
,a
- tau g - I g e -.
E
=.c
-3 2-m i8
- E hk em 11 tC -
( 2 e e 5m )5
-w .e y
=. * -m .- y j -* c
=c e -
.c 1. =.w e ,- -
m Iv g7 e c e- ta
. ga f. e u ~* e =a -I a tq ;;
e .= ..~ - g =- a y m- e . - u xy*=- e 7>gc x. -
.e m .e a +E,..,, .
n 's.
.e
- e n* -t 9*
e Ob E2 4 .e 6- ' E *y -
= c* -
t" en N' .h 2
*n -
t - - y e t j
*=
g-g *b e EI &=
*h N $
& '. g #
g a W
- Hb N & "
3 T2g pg E m. ,c p Eg *E
- 2. .ge fc .ac e ;>.=.
.e g p .=
e Q -
=
m m e5 .e,.- w. mW
=. Wp-m a .
6- 6g z6Vn- g vss mA~ 4-4
. i
. Table 4-2 Notes 1
- 1. . Failure contribution is expressed as a percentage of all significant HPCI failures as developed _
by the Operating Experience Review.-
- 2. Failure ranking is a subjective prioritization based on PRA and operational input, recovery q potential, current accident management philosophy and conditional failures, as applicable.'
- 3. Fermi 2 significant HPCI failures are based on a review of all available LERs up to October 1,1992. ,
- 4. Although some caution is warranted due to the limited plant specific' data, this failure mode seems to comprise a disproportionate fraction of the Fermi 2 HPCI unavailability. This area; is a candidate for enhanced inspection attention.
- 5. Failure importance was upgraded from the PRA-based ranking of Table.4-L
- 6. Failure importance was downgraded from the PRA-based ranking of Table 4-1.
- 7. HPCI isolation and trip logics are significant contributors to unavailability. The system can be isolated by a single malfunction, yet instrument surveillance intervals can be greater than the more reliable actuation logic.
- 8. Unlike the system trip and isolation logic the actuation logic arrangement (one.out-of-two ,
twice) diminishes the importance of a single instrument to reliable system operation. At least two low RPV level or two high drywell pressure sensors must fail. >
- 9. - The latest BWROG Emergency Procedure Guidelines deemphasize the suppression pool as an injection source.
I
- 10. Conditional on the delayed opening of the pump discharge line valve, F0()6.
- 11. Unlike the rest of the failure modes listed herein,
- Systems Interactions"is not PRA-based.. j It was identified as a significant failure mechanism during the operating experience review and is discussed in Section 6. :
i f i i 4-5 i i k
p:
- 5. IIPCI SYSTEM WALKDOWN CllECKLIST BY RISK IMPORTANCE I-Table 5.1 presents the' HPCI system walkdown checklist for use by .the inspectorJ This -
information permits inspectors to focus their efforts on componentsimportant to system availability.: and operability.! Equipment locations and power sources are provided to assist in the review of this system. (; 1
'l 5-1
[. I :_ :. - =._ __ _:__._ . A
Table 5-1 FERMI Unit 2 HPCI System Checklist Description - ID NO. location " Power Source and location Standby Position - ~ Actual Position . A. Components of Illgh Risk Significance Turbine Steam isolation Vahr 1001 RBSB-Illt MCC 2Pil-1.Pos.4BAB3-G11 Cosed + Steam Supply Inboard Isolation Vahr 1002 Drywell G. 583',0*At MCC 72C-3A:Pos.4A:RB2-B13 Open Steam Supply Outboard Isolation Vahc IU)3 Rill Steam Tbnnel MCC 2P111.Pos.911:All3-G11 Cosed Pump Discharge inboard Isolation Vahr IUXi RB1-Steam Tunnel MCC 2Pil-1.Pos.7A:AB3-Gil Closed Auxiliary Oil Pump C005 RBSil-1111 MCC 2PU-1.Pos.2A.All3-G11 Auto (E41-R614) Inverter IWG Relay Room (Bottom - 130VDC Cabinet 2Pil2-6.Pos.7 On of 11111 P612) Relay Room. RB2-F12 II. Components of Medium Risk Sign!!iennce r Condensate Storage to Pump Suction IU14 RBSil-Illt MCC 2Pil-1.Pos.4A:AB3-G11 Open Pump Discharge Outboard Isolatien 1007 RBSil-lill MCC 2Pil 1.Pos.8A:AB3-G11 Open Pump Minimum Ilow flypass Vahr 1012: RBSil-lill MCC 2PB-1.Pos.4C:AB3-G11 Cosed INmp Suction From Suppression Pool 1042 Torus. D.546 5'Az MCC 2PB-1:Pos.10ll:All3-G11 Cosed - Inboard Isolation Turbine Exhaust Stop Valve 1021 Torus.lu.560,13'Az MCC 2PB-1:Pos.1211:A!!3-Gil Open ' Itmp Suction from Suppression Pool 1041 RBSD-Ill1 MCC 2PD 1:Pos.10A:AB's-011' Closed Outboard Isolation INmp Test Return ljne to CST 1011' ABil-G12 MCC 2Pil-1.Pos.3C:AU3-G11. Cosed (Power OFF with fuses removed) NOt 7A&B II21-P016. P036 RBB-Fl$. RUB BIO liigh Steam Flow isolation Instruments - In Service N65 FA&ll . II21-P080. IM1 AB4-F12. A134-F11 , g y %, + .-- 4myy v9-- + e f g yw e+. w 9 9
-- r e.,- y s- -
v--J- ei -w +-g
1 l l B
- 6. OPERATING EXPERIENCE REVIEW A review of the operating experience was conducted to integrate recent industry experience !
with PRA derived failure modes for the HPCI system. Approximately 200 HPCI Licensee Event j Reports (LERs) from the period 1985 to mid 1989, were reviewed for applicability to the PRA l failure modes for HPCI. Sixty-two LERs did not have a corresponding failure mode. These LERs j generally documented successful system challenges, administrative deviations, or seismic / equipment j qualification concerns. He remaining 140 LERs documented 159 HPCI faults or degradations. As ; presented in Table .5-1, these failures have been categorized by PRA failure mode to_ provide a { relative indication of their contribution to all HPCI faults. Each of the thirteen PRA-based failure j modes that has corresponding industry failures is discussed below. Selected LERs, identified i during the operating experience review, are summarized to illustrate typical failure mechanisms and { potential corrective actions. Where applicable, other sources of background information, including l NRC Bulletins, Information Notices, inspection Reports, NUREGs, and AEOD Reports are cited. ; Fermi 2 failure experience over the plant life is also integrated into the discussion of each HPCI j failure mode. !
.f The illustrative LERs for the first failure mode,"HPCI Pump or Turbine Fails to Start or i Run", are presented in Table A-1. The accompanying text provides supplemental information on i the failure distribution within a subsystem, he balance of the failure modes are presented in 1 Table A-2. j i
6.1 HPCI System Failure Modes l IIPCI Failure No.1 - Pump or Turbine Fails to Start or Run The major contributor to HPCI system unavailability, both- from a risk and operational viewpoint,is the failure of the turbine driven pump to start or continue running. This failure mode .l' includes many interactive subsystems and components which can make root cause analysis and component repair a complex task. This has been reflected in BWR PRAs by the variation in the subsystems that comprise this failure of the pump or turbine to start or run. This has resulted in .) some confusion in the application of PRA insights to inspection. For the purposes of this study, l this failure has been defined as those components or functions that directly support the ' operation f of the pump or turbine. The "HPCI Pump or Turbine Fails to Start or Run" basic event accounted p for 64 failures or 419e of the HPCI faults.in this operating experience review. ! Table 6-2 provides a detailed breakdown of the subcategories of HPCI Failure No.1 "HPCI ! Pump or Turbine Fails to Start or Run". In the discussion that follows, Fermi Unit 2 LERs are i provided along with the most likely root cause, the corrective action taken, and any appliable comments. This information should provide the inspector with additional insight into the particulars of each subcategory. Tables A-1 and A-2 supplement this descriptive material Eith i examples of industry-wide failures in these categories. J l 6-1 . i i
)
- a. Turbine Speed Cemtrol Faults The turbine speed is controlled automatically by a control system consisting of a flow controller and an electro-hydraulic turbine governor. The turbine governor system receives the flow controller signal input _ and converts it into hydraulic-mechanical motion to position the governor (control) valve. The system has a
- ramp" generator which upon turbine start, will control the acceleration rate up to a speed relative to the flow controller output signal. The " ramp" rate-is adjustable.
Turbine speed control faults are a major contributor to the pump failure to start. The-sixteen failures identified in the LER survey include: six electro-mechanical governor (EG-M) control box faults, two dropping resistor assembly (resistor box) failures, one ramp generator / signal converter box failure, .;
+
one magnetic speed pickup cable malfunction, a speed control potentiometer problems, and five EG-R electro-mechanical-hydraulic actuator failures. ! Although there has been only one HPCI turbine speed control LERs submitted by Fermi 2 l this is very complex equipment that requires specialized attention. The inspector should confirm that the licensee acknowledges the complexity of the speed turbine control by having a trained specialist on staff, a good working relationship with the appropriate' vendors, procedures' for- ' aligning the controller, and adequate vendor oversight with regard to proposed modifications or-repairs.
- The one LER related to this failure mode was LER 91-020. The HPCI turbine failed to-o . start due to a problem with the hydraulic actuator (EGR).' The governor valve would not open. ,
The root cause was determined to be water intrusion which caused some corrosionof the EGR. A degraded barometric condenser vacuum pump was the reason why water was able to contaminate i the lube oil system. ; Fermi's operating history to date has been favorable to date in this area. One of the reasons-may be the location of the EGM and ramp generator in the relay room. This cooler emironment > is likely to improve the performance of the electronics associated with the turbine speed control; 'i function. At other plants, the turbine controls are located in the HPCI room, which tends to be ti hotter and .more humid. c I I
.i I
?
6-2 -I i i
v - ,, .. .. . .
^
t Table 6-1 IIPCI Failurr Summary Failure Total HPCI Failure
- Number Description - Failures * - Contribution (%)
.1 . Pump or Turbine Fails to Start or Run : 64 . 40 2 System Unavailable Due to Test or Maintenance Activities 43 27:
3 False High Steam Line Differential Pressure Isolation Signal - 10 6:
'4 Turbine Steam Inlet Valve (F001) Fails to .
Open 8' 5_ 5 Pump Discharge Valve (F006) Fails to Open 8 15. 6 Suppression Pool Suction Valves (F041.F042) Fails to Open . 6 4 7 Minimum Flow Valve (F012) Fails to Open 5- 3-8 System Actuation logic Fails 4 '3 ' 9 False High Area Temperature Isolation Signal 3 2 10 False Low Suction Pressure Trip' 2 1 11 False High Turbine Exhaust Signal l' ' <1 12 Normally Open Turbine Exhaust Valve (F021) 1 <1 Fails Closed 13 CST / Suppression Pool Switchover logic Fails - 1 -' <1
' Systems Interactions Fail HPCI .3 2
-159-Developed during the HPCI Operating Experience Review which examined HPCI LERs' from 1985 to mid 1989. _
No PRA system failure mode; operating experience is discussed in Section 6.
.Iy 6-3 :l 4
I = 1
l-h Table 6-2 II'PCI Pump Turbine Fails to Start or Run - IIPCI Failure No. I Subcategories , Subcategory Description LER Failures , Turbine speed control faults, including EG-M control box 6 Motor speed changer 5 .. (EG-R actuator remote servo) Resistor box 2 16-Ramp generator / signal converter box 1 Magnetic speed pickup cable 1 F Speed control potentiometer 1 Lube oil supply faults 11 Turbine over-speed and auto reset problems 8 Inverter trips or failures -7 Turbine stop valve failures 5 Turbine exhaust rupture disk failures 5 Flow controller failures 5 Turbine control valve faults 3-Loss oflobe oil cooling 2 Miscellaneous: Valid high steam flow during testing
. _2_
TOTAL 64-
'I 6-4
p i
- b. Lube Oil Supply Faults
'Diis subcategory consists of eleven failures to provide sufficient lubricating oil to various !
turbine components. As presented in Table A-1, most of the faults are rela'ted to the auxiliary oil : pump and include two bearing failures and five auxiliary oil pump pressure switch faults. Three [ low bearing oil pressure events were attributed to valve mispositions and one instance oflube oil- . contamination. Reference 9 provides additional sources ofinformation. l t Included in the above industry survey LERs for this subcategory is one Fermi 2 incident (LER l 87 006) invohing a lubricating oil supply fault. During post-maintenance operability testing, the i HPCI tmbine had to be shutdown after receiving a low bearing oil pressure alarm. The root cause ! was incorrectly positioned oil supply valves to the governor bearing and thrust bearing ; I
- c. Turbine Over-speed and Auto Reset Problems :
The mechanical over-speed trip function is set at 125 percent of the rated turbine speed. The ! displacement of the emergency governor weight lifts a ball tappet which displaces a piston that ; allows oil to be dumped through a port from the oil operated turbine stop valve. This allows the ; spring force acting on the piston inside the stop valve oil cylinder to close the stop valve. The _! over-speed hydraulic device is capable of automatic reset after a preset time delay. Over-speed and auto reset problems contributed eight failures to the turbine dnven pump failure category. Two events at Quad-Cities Unit I were attributed to failure of.the electrical i termination to the reset solenoid valves. A failure which occurred a: Dresden 2 in 1987 was due to a loose hydraulic control system pressure switcu contactor arm. A blockage of a drain port in the over-speed trip and auto reset piston assembly caused erratic operation of the turbine stop valve . r during a surveillance at Limerick 1. Additional sources ofinformation on turbine over-speed trips are Information Notice 86-14, 86-14 Supplement 1,86-14 Supplement 2, and AEOD Case Study ' Report C602*". j i
- d. IIPCI Inverter Trips or Failures l The HPCI Inverter is powered from a 125V DC bus and ultimately powers the turbine speed f control circuit. There have been seven inverter problems. Three were attributed to internal i electronics faults, including two capacitor failures, and one overheating event due to an integral cooling fan failure. These Licensee Event Reports did not consider the aging of the electronics as ~ ;
a potential root cause. Reference [14] provides information on inverter aging. This study has o confirmed that inverter performance is related to ambient temperature and recommends specific : inspections and tests to monitor inverter performance and detect incipient failures.Two additional - ! problems involved short term unavailability of the inverter. One was a blown fuse; the other was ~ Ll an inverter trip when the battery cha4ger was placed in the equalize mode. The high voltage trip , setpoint on the inverter had drifted low. .
.I 6-5 ;
- e. Turbine Stop Valve Failures ne stop valve E41-F067 is located in the steam supply line close to the inlet connection of the turbine. %c primary function of the valve is to close quickly and stop the flow of steam to the turbine when so signaled. A secondary function of this hydraulically operated valve is to open .
slowly to provide a controlled rate of admission of steam to the turbine and its governing mive. The operating expenence data contained 5 failures of the turbine stop valve. One reportable event invohing the HPCI turbine stop valve took place at Fermi 2 (LER 85 039). During startup testing, an oilleak (approximately 1GPM) developed at the operator of the turbine stop valve E41-F067 requiring manual trip of the HPCI turbine. The leak was caused by a loose flange between the pilot valve cylinder and the hydraulic cylinder of the valve operator. t'. Turbine Exhaust Rupture Disk Failures The HPCI turbine has a set of two mechanical rupture diaphragms (D003 and D004)in series which protect the exhaust piping and turbine casing from overpressure conditions. When the inner disk (D003) ruptures, pressure switches cause turbine trip and HPCI isolation signals. Iow pressure steam flows past the ruptured diaphragm through a restriction orifice directly into the HPCI room. Rupture of the second disk (D004) would vent the turbine exhaust into the HPCI pump room without flow restriction. He nominal rupture pressure is approximately 175 psig. The five turbine exhaust rupture disk failures that were a part of the operating experience review, all occurred in 1985. As indicated in Table A-1, one was attributed to cyclic fatigue. The installation of rupture disks with a structural backing (or the periodic inspection of the older type design of disk) was recommended to prevent cyclic fatigue failures. Two other failures were attributed to water hammer due to carryover from the exhaust line drain pot. AEOD Report E402" provides additional, earlier examples of turbine exhaust rupture disk failures. The remaining two failures had manufacturing defects as their root causes. There were no Fermi 2 rupture disk failures.
- g. Flow Controller Failures The flow controller in conjunction with the electro-hydraulic turbine governor controls turbine speed and pump flow.The flow controller senses pump discharge flow and produces a 4 to 20 milliamp output signal to the turbine governor to maintain a constant pump discharge flow rate over the pressure range of operation.
Flow controller faults accounted for five HPCI failures. He dominant failure (3 LERs) was the failure of the flow controller to function in the automatic mode. Manual control was still available, however. He final controller malfunction was a loose fastener which caused a failure of the gear train. There were no LERs invohing flow controner failures at Fermi 2 noted in the plant specific - LER survey. 6-6
.. . _______ _ d
m.
- h. - Turbine C<mtrol Valve Faults The three control valve faults were attributable to different root causes. At Pilgrim 1, a leaking oil supply line prevented proper operation of the valve during an HPCI pump operability
- test. Susquehanna 2 apparently suffered a mechanical failure during surveillance testing which resulted in reduced steam flow to the turbine and failure to reach rated pump discharge pressure.
The last incident was a potential failure due to broken lifting beam bolts. AEOD Report T906* provides additional information on the contributors to the bolt failures.
- here were no reportable incidents in this category at Fermi 2.
- i. IAss of Lube Oil Cooling The loss of tube oil cocling can be caused by faults in the cooling water lines to and from the cooler, cooler leakage or flow blockage. A prolonged loss of tube oil cooling can lead to turbine bearing failure. The lube oil temperature is monitored by a temperature indicating switch TSE-N203 with control room annunciation. This category has two failures, both involving the diaphragm of control valve E41-F035 (PCV-F035).
There were no LERs noted in this category at Fermi 2.
- j. Miscellaneous-Valid High Steam Flow During Testing Another potential system failure involves the practice of running the auxiliary oil pump to lubricate the turbine bearings or to clear a system ground. Monticello used this practice to attempt to clear a ground in the electro-hydraulie governor. When the fault did not clear, a system test was initiated to confirm HPCI _ operability. When the operator opened the turbine control vah>e to simulate a cold quick start, the system isolated on high steam flow. The operation of the auxiliary oil pump caused the hydraulically operated turbine stop valve to move from its full closed to its full open position. When the stop valve leaves the fully closed position it initiates a ramp generator-that provides a flow signal to the control valve, allowing it to move to the open position. Since the auxiliary oil pump had been running for some time the ramp generator had timed out and a maximum steam flow demand signal _was sent to the control valve. This prevented it from restricting steam flow as it normally would during a turbine start resulting in high steam flow and .
a system isolation. Plant procedures address running the auxiliary pump periodically to keep the turbine bearings lubricated. When the auxiliary oil pump is running. the high pressure coolant injection system will isolate if an automatie initiation signal is received at any time after the ramp generator has timed out, which occurs after approximately 10 to- 15 seconds. The plant-has taken the following. corrective actions to address the problem: I
- A modification has been approved that will eliminate ramp generator initiation while the -
auxiliary oil pump is running unless a valid initiation signal occurs.- The high pressure coolant injection system operating procedures have been revised to include cautions addressing system inoperability when the auxiliary oil pump is running. 6-7
d; f De operating procedures that verify system operability have been revised to include .i precautions about system status before and during the test. The control system ramp generator function during the opening of the steam admission valve is described in these , procedures. At Fermi, a modification was made to the ramp generator circuityr to permit operation of the : auxiliary oil pump without affecting HPCI operability. . EDP-12738, approved on April 30,1992, makes the ramp generator dependent on both the F067 and F001 valv.:s opening. F001 will not open unless there is an actuation signal. So, in essence, the ramp generator will not be initiated unless there is an actuation signal and the auxiliary oil pump is operating. IIPCI Failure No. 2 - System Unavailable Due to Test or Maintenance Activities In addition to component failures, the system may not be functional due to. testing or ; maintenance (T&M) activities. In a single train system, like HPCI, test and maintenance activities , on one component usually disable the entire system. It is important to keep the HPCI T&M j contribution as low as possible because it is so important to system unavailability. l l The root sources of excessive HPCI T&M unavailability were examined as part of this operating experience review. Forty-three examples of test or maintenance errors (27% of all HPCI j failures) were divided into three categories: 1) inadequate maintenance or post-maintenance ] testing,2) human error that inadvertently or incorrectly disables the HPCI system, and 3) system ,
't
~
inadvertently disabled during testing activity. Inadequate maintenance or inadequate post maintenance testing accounted for 22-HPCI- . failures. The problems included valve packing leaks, misadjusted torque switch settings, miscalibrations of a steam line differential pressure instrument and an EGR actuator, improper ~! connection of a gland exhauster drain line to the tube (high pressure) side of the gland seal : condenser, system adjustment without a retest, and a rag inadvertently left in the turbine sump .! which disabled the shaft driven oil pump. There were three incidents at Fermi 2 which fall into this category. -In one case (LER 85 041),
- an unauthorized blank gasket in the lubricating oil line led to low lube oil pressure to the HPCI ;
turbine and forced a manual trip of the turbine. The root cause was a personnel error resulting [ from inadequate procedure implementation, and a lack of documentation for the gasket installation. The second event (LER 86 026) involved a fire in a safety-related motor control ; center (MCC) supplying three HPCI valves. The cause was attributed to personnel error resulting
- in an incorrect ' field wiring installation, which was undetected during subsequent testing and [
inspections. The third event was a failure of a high steam line flow differential pressure isolation ; transmitter E41N057B (LER 89 004). Part of the problem identified was an incorrect head :; correction value applied during the transmitter calibration which resulted in a Division II isolation - 7 setpoint error in a non-conservative direction with respect to Technical Specifications. The affected procedure was revised and the instrument recalibrated to implement the proper head correction value. , y Another T&M category, " system inadvertently disabled during testing," consists of thirteen' ; personnel errors that temporarily disabled the HPCI system. These incidents include steam line. L containment isolation valve closure due to testing errors during isolation logic testing, one valve : 3 6-8
]
k
i motor failure due to overheating caused by excessive stroking during a surveillance test, and a'n !' inverter trip caused by personnel error which resulted in a high voltage condition affecting both - Channel C battery chargers. Unlike the first two categories, the majority of these failures have a ; high probability of recovery. i There were two problems of this type reported by Fermi 2. During a HPCI/RCIC room area l temperature surveillance test in 1985 (ER 85 054), a technician lifted the wrong thermocouple j leads at a switch module causing an isolation of HPCI. Procedure inadequacy was identified as the i root cause. In the second event (ER 88 024), an HPCI isolation occurred when the technician i attached his volt-ohm meter to the wrong terminals. Human error was blamed for this incident. l, In summary, the T&M component of system unavailability must be continuously monitored by .l the inspector to assure it is as low as possible. The licensee should be- administratively limiting the time that the HPCI system is in test or maintenance during operation.' System restoration should . be vigorously pursued; HPCI should not be down for days, if it can reasonably be repaired in - ! hours. If feasible, portions of the system should be tested during outages. In addition, HPCI '! unavailability can also be minimized by adequate root cause analysis and effective corrective action to avoid multiple system outages to address the same failure. Other, less frequent, contributors include inadvertent or unnecessary removal from service and system isolations during calibration or surveillances. IIPCI Failure No. 3 - False Iligh Steam Line Differential Pressure Isolation Signal The HPCI system is constantly monitored for leakage by sensing steam flow rate, steam pressure, area temperatures adjacent to HPCI steam lines and equipment, and high HPCI turbine exhaust pressure.
] !
If a leak is detected, the system responds with an alarm and an automatic HPCI isolation. The . steam flow rate is monitored by two differential pressure switches located across two different. l elbows in the steam piping inside the primary containment. The flow measurement is derived by 1 measuring differential pressure across the inside and outside radius of each cibow. If a leak is , detected, the system isolates the HPCI steam line and actuates a control room annunciator. , This failure category has 10 ERs which constitute 6% of the total HPCI failures. Fermi 2 '.; discovered a potential failure of both high differential pressure instrume.nts during a channel check' ; (ER 89 004). Division I had a stuck indicator on a Rosemount 710DU master trip unit; Division II was miscalibrated due to the use of the wrong static head correction value. Several failures were - due to unknown or unspecified causes. Among these was an incident at Fermi 2 (ER 86 029). A downscale failure of a Rosemount transmitter that monitors HPCI steam line flow caused the j inboard HPCI steam supply isolation valve E41-F002 to close on 8/23/86 and again on 8/26/86. ;
'1 An earlier Fermi 2 incident (ER 85 055) involving erroneous differential pressure transmitter .;
output led to an isolation of the inboard HPCI steam supply valve E41-F002. The root cause here l was poor connection between the amplifier card and the connector pins. The board was either ! installed incorrectly or had worked loose since the original installation. 3 At the time of the site visit, two additional ERs that had occurred in this area were reviewed with the licensee. These are ERs 90-008 and 90-012. In the first case, a spurious isolation signal , 6-9 i I _ _ _ _ _ - _ - _ _ _ _ _ - __ .- - - \
was generated due to a noisy pressure transmitter. An engineering design change (EDP 11819) ; was implemented which installed a capacitor across the outputs of E41-N057A and B. This " filter" . attenuated the process noise signal sufficiently to prevent a spurious HPCI isolation. LER 90-012 was related to a circuit board failure in E41-N057 which could have prevented an isolatioon from occuring, if required. 1 Additional information can be found in Information Notice 82-16". HPCI Failure No. 4 - Turbine Steam Inlet Valve E41-F001 Fails to Open j Motor operated valve E41-F001 is a normally closed, DC powered gate valve. This valve opens on automatic or manual initiation signal, provided the turbine exhaust valve E41-F021 is open, to admit reactor steam up to the turbine stop valve. There have been 8 failures of this valve to open on demand comprising 5'7o of all HPCI-failures, including: two cases of mechanical / thermal binding at Brunswick 1 one stuck valve at Cooper attributed to the restelliting of the disk one valve motor failure at Fitzpatrick due to insufficient stem lubrication. Other failures were attributed to loose torque switch adjustment screws, potentially insufficient opening torque concerns, and sticking relays in the MCC. . Fermi 2 reported no LERs in this category over the plant life. : HPCI Failure No. 5 - Pump Discharge Valve E41-F006 Fails to Open Motor operated valve E41-F006 is a normally closed DC powered gate valve that is. <' automatically opened upon system initiation. The failure of this valve to open disables HPCI ; injection into the reactor vessel. There have been 8 pump discharge failures documented in the operating experience review.' This failure mode accounts for 5% of all system failures. : i At Fermi 2, one LER (88 028) was noted in which the HPCI pump discharge valve E41-F006 failed to open as required during surveillance testing. The spare space heater bracket in the valve's limit switch compartment was grounding out the control voltage at the torque switch; together with: . a pre-existing ground, the opening contactor coil of the MOV was shorted out of the circuit. A prior non-LER incident occurred at Fermi on 1/3/88 when the valve tripped out on motor thermal -, overload during testing. Failure of the motor insulation in the motor operator was the cause. ; HPCI Failure No. 6 - Suppression Pool Suction Line Valve E41-F042 arid /or E41-F041 Falls to - Open At Fermi 2 there are two 260 VDC powered suppression pool HPCI pump suction valves,E41-F042 and E41-F041,in series with a check valve instead of the MOV and check valve arrangement
]!
found at many BWRs. The HPCI system is . initially aligned to the condensate storage tank. The. q 6-10 [ a i
s
~
suppression pool suction valves are opened and the CST suction valve is closed on a CST low water level or a high suppression pool level signal. The importance of this HPCI failure mode has j been diminished by the current _ emergency procedure guidelines which emphasize the continued use of outside injection sources. This requires operator action to bypass the HPCI suppression pool .l switchover logic to prevent the opening of the suppression pool suction valves E41-F042 and E41-
~
F041. This is especially true for the decay heat removal (nonATWS) sequence where it is likely - that the CST makeup can be maintained. : i There have been six failures of the suppression pool suction valve to open, representing 4% of all HPCI failures. All occurred during system suiveillances. The valve failure: are generic in nature and include two motor failures due to insulation' degradation, one misadjusted torque switch, a limit switch failure and a valve disk separation. Ahhough none of these failures is readily_ ' recoverable, this failure mode is not as critical as it once was. Fermi 2 reported no failures of these valves to open over the plant life. IIPCI Failure No. 7 - Minimum Flow Valve E41-F012 Fails to Open i The minimum flow bypass line is provided for pump protection. The bypass valve, E41-F012,' , automatically opens on a low flow signal of 650 gpm when the pump discharge pressure is greater than 125 psig. When the bypass is open, flow is directed to the suppression pool. : The valve , automatically closes on a high flow signal or when the turbine inlet or stop valves (F001'or F067)_
, are closed. During an actual system demand, the failure of the minimum flow valve to open is: )
important only if the opening of the pump discharge valve E41-F006 is.significantly delayed. In - , general, this combination of events is not probabilistically significant. With regard to system - , operation and testing in the minimum flow mode, the licensee response to Bulletin 88-04" should - , be reviewed to determine if the design of the minimum flow bypass line is adequate. Unless there - is a design concern or a recurring problem with either component, inspection effort should be : minimized in this area. There were no incidents reported by the Fermi 2 involving a failure of the'HPCI pump ' minimum flow valve E41 F012. IIPCI Failure No. 8 - System Actuation Logie Fails ! Startup and operation of the HPCI system is automatically initiated upon detection of either low-low reactor vessel water level (110.8 inches decreasing) in the reactor vessel or high drywell o pressure (1.68 psig, increasing). The HPCI system can also be manually initiated by arming and I then depressing the manual initiation switch in the control room.
~
q There were four LERs associated with this failure mode in the industry LER survey. Three; . were fuse problems, one of which was attributed to an electrical grounding between the barometric a condenser level switch and the switch housing connections. The remaining LER documents a . , design problem where the system failed to actuate because the low level signal was not scaled ing j for a sufficient period of time. This appears to be similar to a Shoreham HPCI logic concern that L was the subject of AEOD report E4078. - q
.i 6-11
]
l r
i The LERs illustrate that the failure of the HPCI actuation logic is more likely due to common : causes such as the loss of power. Unlike the HPCI trip logic, the redundancy (one out of two ; twice) and the diversity (low vessel level /high drywell pressure) of the actuation logic make it less susceptible to individual sensor failures. 1 HPCI Failure No. 9 - False High Area Temperature Isolation Signal ! t The HPCI system is constantly monitored for leakage by sensing steam flow rate, steam , pressure, and area temperatures adjacent to the steam line and equipment. If a leak is detected, i the system is automatically isolated and alarmed in the control _ room. At Fermi' 2, the- ] temperatures of the HPCI equipment area and room cooler inlet are continuously monitored by local temperature sensors for evidence of system steam leakage. These sensors are positioned at -i locations representative of the area ambient temperatures so that they areless affected by radiated heat from operating equipment or high energy fluid piping. Thus, any registered temperature rise , is usually caused by a source such as a steam leak. This category accounted for three HPCI failures (2% of all failures).Two component failures-occurred. One was attributed to the failure of a resistor in the power supply for temperature monitoring module N603D. The second failure occurred when E41-N602C (Riley Tempmatic 86 module) failed. The failure was considered an isolated event; however, the licensee intends to ;
~
replace these modules with a newer model. i There were no LERS noted involving false high area temperature isolation signals at Fermi 2 , over the plant life. j HPCI Failure No.10 - False Low Suction Pressure Trips The purpose of the low pump suction pressure trip is to prevent damage to the HPCI pumps -l due to loss of suction. Pressure switch (PSE-N010) actuates to cause the turbine stop valve to close. Fermi 2 has not had any HPCI system isolations due to false low suction pressure trips. 9 HPCI Failure No.11 - False High Turbine Exhaust Pressure Signal + l The high turbine exhaust pressure signal is one of several protective turbine trip circuits that i close the turbine stop valve and isolate the HPCI system. The high turbine exhaust pressure signal-
- is generated by pressure switches PSE-N017A(B,) and is indicative of a turbine or a control system malfunction. !
0 The operating experience review found one LER. Quad-Cities 2 had a false high turbine .! ' exhaust trip that could not be reset. The cause of the trip was corrosion of the pressure switch seals (Barksdale diaphragm type, model 02W-M15055) which allowed moisture into the casing and ,i shorted the wiring. [ t There were no LERs noted involving false high turbine exhaust pressure signals at Fermi 2 .. over the plant life. { k 6 12
?
t,
~,
IIPCI Failure No.12 - Normally Open Turbine Exhaust Valve Fails Closed c The failure of any of the turbine exhaust valves in the closed position results in a turbine trip due to a valid high turbine exhaust signal. A failure of the turbine exhaust line swing check valves has occurred. The valve internals were found wedged in the downstream MOV (E41-F021) and - had the potential to trip the turbine due to high exhaust pressure. The failure was attributed to - the forceful cycling of the swing check discs under low flow conditions. References 15 and 20 can provide additional background information. Fermi 2 did not report any LERs invohing the failure of the turbine exhaust valves to close. IIPCI Failure No.13 - Condensate Storage Tank / Suppression Pool Switchover Logie Falls In the standby mode, the HPCI pump suction is normally aligned to the condensate storage-tank (CST). Upon a low CST level signal via. level switch LSt N002 or:LS,, N003 or a .high '> suppression pool level signal via level switch LSn N015 A or B, the suppression pool suction valves E41-F042 and E41 F041 automatically open with subsequent closure of the CST suction valve E41 F004. System operation continues with the HPCI booster pump suction from the suppression pool. ne operating experience review found one example of a degraded HPCI pump suction switchover logic. One of the suppression pool level switches was out of calibration due to a slight amount of foreign material that was deposited on the float. This PRA-based HPCI failure mode has become less important due to changes in the BWR _ Emergency Procedures which generally advocate the continued use of water sources that are -
~
external to the containment. This avoids potential ECCS degradation due' to high suppression pool . temperature (HPCI high lube oil temperature) while simultaneously increasing suppression pool-mass. The end result is that an HPCI pump suction transfer to the suppression pool is no longer ' that desirable and the operator, especially in decay heat accident sequences, is likely to bypass the . switchover logic to maintain the CST suction source, or to realign if a switchover to the pool has ; occurred. Therefore, the inspection focus should be on the continued viability of the CST as an injection source during an accident sequence. For example, does the CST have sufficient capacity to satisfy long term injection requirements or are procedures and training in place to provide-makeup? Dere have been no LERs reported at Fermi 2 over the plant life which dealt with problems in the condensate storage tank / suppression pool switchover logic. , Other Failures He Operating Experience Review did not identify any HPCI failures for the following PRA - based failure modes: ' 4 Normally Open Pump Discharge Valve E41-F007 Fails Closed o'r is Plugged Pump Discharge Check Valve E41-F005 Fails to Open ; CST Suction Line Check Valve E41-F019 Fails to Open , CST Suction Une Manua_1 Valve (F010) Plugged l Suppression Pool Suction Line Check Valve E41-F045 Fails to Open I
)
6-13 l
Normally Open Steam Line Containment Isolation Valve E41-F002 Fails Closed
- Steam I.ine Drain Pot Malfunctions
- Turbine Exhaust Line Vacuum Breaker E41-F075 or E41-F079 Fails to Operate The PRA-based prioritization of HPCI failures correlates well with the actual industry failure experience. With the exception of the first failure mode listed above for E41-F007.'all of the faults listed above have been designated as " low importance'in the PRA-based ranking of Sectior?
4. 6.2 Contribution of Human Error 1 The potential for human error' exists for activities such as, maintenance,- calibration, surveillance, and operation. Probabilistic Risk Assessments typically emphasize operator error both 1 in fault trees (system failure diagrams) and in the event trees that describe accident sequences. As - ., such, these failures are usually gross actions that can fail a complete system. Typical PRA-based . I HPCI human errors are: . r
- 1. Failure to manually start the high pressure injection system if automatic actuation fails.
- 2. Failure of the operator to transfer pump suction from the CST to the suppression pool after a pump trip on low suction pressure due to CST unavailability. :
- 3. Failure to drain HPCI steam line drain pot, given drain valve failures.
- 4. Failure to provide makeup to the CST during an ATWS event.
i
- 5. Failure to transfer pump suction from the suppression pool to the CST during an event with a high suppression pool temperature. There are two cases when this must be. e performed, one during an ATWS event and one during a non-ATWS event with thel :
failure of suppression pool cooling. .
- 6. Failure to override the HPCI high-temperature isolation logic (for station blackout sequences). ;
- 7. Operator recovery from initial failure of HPCI. ;
- 8. Miscalibration of HPCI sensor (s) disables system actuation, high RPV level isolation or results in false isolation signals, i
- 9. Failure to reset the HPCI system for operation after testing or maintenance.
f With the exception of the last two entries, these human errors are either: a) conditional, that
- is, they must be considered within the context of an HPCI failure or isolation (errors 1,' 2 and 3),; ,
or b) event specific (items 4 through 7). These requirements make ' direct observation unlikely. The potential for these human errors can be evaluated indirectly by a review of the licensee procedures . ; and observation of operator performance at a simulator.
, a j
6-14 i L j L ! a [ ?} e .
"Ihe last two human errors can occur during normal operation and are therefore more inspectable. Resident Inspectors routinely examine surveillance, calibration, and maintenance -
practices and procedures, and perform ECCS control. room and plant lineup verifications. HPCI operability is confirmed by checking the steam supply and exhaust lineup, pump suction and , discharge lineups and the control function settings (hand / auto station in automatic). 6.3 Support Systems Reauired for HPCI Operation The high pressure coolant injection system is dependent on other systems (called support systems) for successful operation. These systems are: DC Power For system control (130 V DC) and valve . movement (260 V DC). Room Cooling For HPCI pump room cooling to support long term operations. This function requires service water (for cooling) and AC power for the fan motor. HPCI Actuation RPV level and primary containment pressure instrumentation for system initiation and shutdown. The review of operating experience revealed the influence of support systems' on HPCI availability, ne loss or degradation of the DC battery or bus that powers HPCI has -a straightfonvard effect. Besides the battery charger problems or fuse openings, the more unusual - DC system problems included a battery degradation due to corrosion of the plates. De suspected. cause was a galvanic reaction due to plate weld metal impurities. Another concern is insufficient voltage at the load during transients which could trip the station inverters or fail MOVs (Browns. Ferry 1, Brunswick 1 & 2 and Nine Mile Point 1). This would be of particular concern during a loss , of offsite power or a station blackout event. The effect of the loss of room cooling on continued HPCI operation is not as clear. The q' system is typically required to support long term HPCI operation. Besides the random failures which can occur at any time, there is one sequence specific effect that should be examined. During station blackout, the room cooling is lost when continued HPCI operation is critical, ne licensee , actions to presetve HPCI operation should be examined. For example, some plants willopen pump room doors to promote convective cooling, but that does not necessarily assure continued HPCI operation. The licensee should have pump room and steam line temperature calculations or have other procedure provisions (bypass high temperature isolation) to assure long term HPCI operability. There was one related reportable event (LER 85 043) which involved the room cooler for~ , RCIC and Division I Core Spray at Fermi 2. De room cooler was found in the "off' position by ~: the shift supenrisor during his control room walkthrough. No reason could be found, however,7
. procedures were revised to verify the operational status of ECCS room coolers during each shift ~ 1 turnover.
The RPV level or high drywell pressure instrumentation is required for multiple ECCS systems including HPCI. The operating experience review did not have any pertinent examples of failures -i o of the ECCS actuation instrumentation logic which directly affected HPCI. 6-15' y i
W e .. N 7 t In summary, support system problems can impact HPCI operation sometimes in a less than-straightforward manner. In the context of specific accident sequences these support systems may , be more prone to failure. The inspector.should verify licensee awareness of these interaction -
- relations and confirm that compensating measures are adequate. ,
6.4 HPCI Systems Interactions ! Unlike support system failures, such as room cooling or DC power, systems interactions refer to unrelated system failures that can disable HPCI. Although there is no PRA category, the operating experience review contained examples of system interactions, all fire protection system malfunctions, that disabled HPCI. A fire protection system surveillance test was being performed at the Fitzpatrick plant, when approximately one gallon of water was drained onto a battery motor control center (MCC). Water drained into the breaker cubicle for the HPCI steam supply valve causing a breaker overload trip and valve inoperability. Water falling from a control room HVAC vent onto an analog trip system panel disabled multiple systems at Hatch 1 including HPCI. The HPCI trip solenoid was energized which disabled the system. The water was caused by the activation of the fire protection deluge , system in a control room HVAC filter train. The HPCI system at Dresden 3 was disabled when the room sprinkler system activated after - H a HPCI system test. The probable cause was the buildup of steam vapor from the leakoff drain system which activated an ionization detector. The calculation of HPCI pump room temperature during system operation, especially when the ventilation system is disabled, should be reviewed.- The mmplete loss of AC power disables HPCI room cooling, resulting in high temperatures which could activate the fire protection system. 6.5 Simultaneous Unavailability of Multiple Systems Multiple system unavailability is of concern because of the increased risk associated with-continued operation. Although technical specification 3.0.3 tends to limit the risk exposure somewhat, the licensee should avoid planned multiple system outages, if possible'. Within the context of the accident sequences discussed previously (Section 3), certain combinations of system unavailability result in a much greater risk of core damage. For example, y the HPCI operating experience review had nine LERs that documented simultaneous HPCI and RCIC unavailability. There were two cases (LER 86 037 and LER 86 048) at Fermi 2 in which both HPCI and RCIC were inoperable in operational condition 1 as a result of personnel error. ; On another occasion (LER 87 006) at Fermi 2, with HPCI inoperable for maintenance. Technical . i Specification 3.0.3 was intentionally entered into and RCIC was made inoperable for surveillance > testing. During this period, the probability of core damage is greatly increased for accident
- sequences that require HPCI and RCIC for mitigation. This would include' all the sequences : '
described in the Accident Sequence Description except "Unisolated LOCA Outside Containment." ' The unavailability of HPCI and an emergency diesel generator would have similar impact on plant' risk. Additionally, the simultaneous unavailability of HPCI and ADS (o~ne LER, .due to logic .; testing) somewhat impacts Sequence 1, " Loss of ' High Pressure Injection and Failure to Depressurize? ; 6-16
Although some of these LER examples of multiple system unavailability were due to random failures, the majority involve licensee decisions to disable a system for surveillance when another critical system is not operable. Unless absolutely necessary, these configurations should be avoided,
. as frequent entry into technical specification 3.0.3 greatly increases the risk of core damage.
6.6 LOCA Outside Containment Unlike the HPCI failures which describe the unavailability of the system for core damage mitigation, four events have occurred where HPCI is-a potential initiator for.a LOCA outside-containment. These LERs consist of degradations of the_ steam line isolation function and pump suction line overpressurizations. The two steam line isolation problems both occurred at Dresden
- 2. One was a steam line differential pressure transmitter with a non conservative setting. The; other was a failure of the inboard containment isolation valve to close. No root causes were stated.
There were two incidents of pressurizations of the HPCI low pressure piping. A pump suction overpressurization occurred at Fermi (LER 87 030) during a system test. A pressure surge of 800 psig occurred in the HPCI pump suction piping after a turbine trip. The event was attributed to the slow closure of pump discharge lift check valve E41-F005. The licensee replaced the valve with a swing check, which is expected to close faster. More recently,(October 31,1989) Dresden 2 declared HPCI inoperable due to elevated piping temperatures in the pump discharge line. The 260*F temperature was caused by feedwater back leakage through the closed injection valves. Discharge piping supports were damaged, attributable - to waterhammer caused by steam void collapse upon system initiation. In addition to the potential l for piping damage, steam binding of the pumps is also a consideration. Information Notice 89-36" ' provides additional information on elevated ECCS piping temperature. The Duane Arnold plant notified the NRC (11/03/89) of a potential interaction between the'- fire protection system and the HPCI/RCIC steam leak detection systems. The HPCI and RCIC isolation setpoints are a room temperature of 175*F or a differential temperature between sensors of 50 F. The water deluge fire protection system has a fusible link of 160*FJ These setpoints can cause deluge system activation that prevents the detection of a steam leak.1 The licensee plans to increase the fusible link temperature to 200 F and remove the rate of change actuation of the deluge system. (See the HPCI Systems Interactions Subsection for a related concern.) In general, the HPCI LOCA outside containment initiator is a very small contributor to total core damage. The diverse steam line break detection logic and the downstream feedwater check ^
- valve reduce the potential for an unisolated LOCA outside containment. The examples presented above are potential areas of inspection to assure that plant design or operation does not increase..
the potential for this initiator.
) 1 6-17
- 7.
SUMMARY
P
- This System Risk-Based Inspection Guide (System RIG) has been developed as an aid 'to.
HPCI system inspections at Fermi. The document presents a risk-based discussion of the HPCI role in accident mitigation and provides PRA-based HPCI failure modes. In addition, the System . RIG uses industry operating experience, including illustrative examples, to augment the basic PRA - failure modes. - The risk-based input and the operating experience have been combined in Table 4-2 to develop a composite BWR HPCI failure ranking. This information can be used to optimize NRC resources by allocating proactive inspection effort based on risk and industry experience. In addition, component faults are summarized in Section 6, and provide potential insights both for routine inspections and the " post mortems" conducted after significant failures. The Fermi operating experience review has identified the 'following component failure modes that have shown a higher percentage of occurrence: system unavailable due to testing and maintenance activities ; false high steam line differential pressure These failure modes should be given additional attention during future routine and specialized . inspection activities. 9 3 f f a i
?
.)
~
7-1 1
n
- 8. REFERENCES.
L Brookhaven National Laboratory (BNL) Technical Letter Report,. TLR-A-3874-T6a,
" Identification of Risk Important Systems Components and Human Actions for BWRs,"
~ August 1989.
- 2. Shoreham Nuclear Power Station Probabilistic Risk Assessment, Docket No. 50-322, Long -
Island Lighting Co., June,1983.
- 3. NRC Case Study Report, AEOD/C502, "Overpressurization of Emergency Core Cooling Systems in Boiling Water Reactors," Peter Lam, September,1985. ,
- 4. Brookhaven National Laboratory (BNL) Technical Report A-3453-87 5 " Grand ' Gulf Nuclear Station Unit 1, PRA-Based System Inspection Plans,"J. Usher, et al., September,1987.
- 5. BNL Technical Report A-3453-87-2," Limerick Generating Station, Unit 1, PRA-Based System Inspection Plans," A. Fresco, et al., May,1987.
- 6. BNL Technical Report A-3453-87-3,"Shoreham Nuclear Power Station PRA-Based System t Inspection Plans," A. Fresco, et al., May,1987.
- 7. BNL Technical Report A-3864 2, " Peach Bottom Atomic Power Station, Unit 2, PRA Based System Inspection Plan," J. Usher, et al., . April,1988.
- 8. BNL Technical Report A-3872-T4, " Brunswick Steam Electric Plant, Unit 2, Risk-Based Inspection Guide," A. Fresco, et al., November,1989.
- 9. NRC IE Circular 80-07, " Problems with HPCI Turbine Oil System," April 3,1980.
- 10. NRC IE Information Notice 86-14, *PWR Auxiliary Feedwater Pump Turbine Control Problems", March 10,1986.
- 11. NRC IE Information Notice 86-14 Supplement 1, *Over-speed Trips of AFW, HPCI and' :
RCIC Turbines", December 17,1986.
- 12. NRC Information Notice.86-14, Supplement 2, "Over-speed Trips of AFW, HPCI, and RCIC Turbines," August 14,1992.
- 13. NRC AEOD Case Study Report C602, " Operational Experience Involving Turbine Over speed Trips," August,' 1986.
- 14. NUREG/CR 5051, " Detecting and Mitigating Battery Charger and Inverter Aging," W.E. _
Gunther, et al., August,1988.
'i
- 15. NRC AEOD. Report E402, " Water Hammer in 'BWR High Pressure Coolant Injection Systems," January,1984.
8-1 : , d u i
t
-i
- 16. NRC AEOD Technical Review Report 1906, " Broken Lifting Beam Bolts in HPCI Terry' !
Turbine," April 18,1989. ; 1
- 17. NRC Information Notice 82-16, "HPCI/RCIC High Steam Flow Setpoints," May 28,1982. -l i
- 18. NRC Bulletin 88-04, Potential Safety Related Pump loss," May 5,1988. j
- 19. NRC AEOD Engineering Evaluation Report E407, Initiation and Indication Circuitry for High Pressure Coolant Injection (HPCI) Systems," March 26,1984.
- 20. NRC Information Notice 82-26, "RCIC and HPCI Turbine Exhaust Check Valve Failures," ~
July 22,1982. .l q
- 21. NRC Information Notice 89-36, " Excessive Temperatures in Emergency Core Cooling System Piping located Outside Containment", April 4,1989. l i
5 k t i t
'i
.i .
.f i
f 5 t 8-2 i i r 4
s e i l
. I APPENDIX 'A-1
SUMMARY
OF INDUSTRY SURVEY OF HPCI OPERATING EXPERIENCE l
.i HPCI PUMP OR TURBINE FAIISTO START OR RUN q
-t t
b P
' f'.
- j.
'i
.i -
t 6 i s 1 i i1
?
l
<t
- 1
.l
.I A-1
~ -
L Table A-1 ' HPCI Pump or Tufbine Fails to Start or RunD-; Summary of Industry Survey Results l'ailure Dese. Root Coure Cerrective Measures Cemments Inspection Guidana TttRBINE SPEED CONDtOL FAULT 5 - EGM control box malfunction ho similar failures attributed to aging . EGM printed circuit boards will be Each of these EGM control box effects due to long term energization and replaced at eight year Intervals. failures occurred at older plants lessibly elevated ambient temperatures. Additional llPCI pump room cooling and appear to be aging related.
-An EGM printed circuit board failed and added.
caused a false high steam Dow signal. "the second failure involved the electronics in ~ , 1 the control box chassis. 1 EGM control box had a ground. Do printed circuit boards replaced. Miscalibration of null voltage settings. Recahbration of voltage settings. Failed transistor in the EGM control box. Box replaced. Surveillance procedures being expanded to verify y proper functioning of the output 4 speed circuit. Motor speed IIPCI failed auto initiation surveillance Error was not detected during a changer /EG-R - because the electrical connections between previous test at 160 psig. Prowderes actuator malfunctions. gmtrnor control and getrnor valve revised to functionally test the electrohydraulic servo were in error. governor control system during the low pressure surveillance testing. Capacitor failure in motor gear unit. Replaced capacitor Failure may have been caused by ' Ambient temperatures in - excessive llPCI room - equipment areas should be temperature. verified with specifications. ' Improper gaping and foreign accumulation Component replaced or serviced. on contacts. EGR actuator grounded at pin connection Corrosion products removed. due to the accumulation of corrosion - products. There were three owurrences of this event that have been attributed to a . design change in the actuator pin connect'ons. l' 4. egemWW % -rW* **7 "Mi V 'F MS# f*t- f g ? ev, ym c- y-wy k ? gen e w w gwp t.pg.o"i -te, 9 - g i n ,-eei e -e-g w w ," y- . .- w ,2g."=w++-- d-=--*>
Table A-1_ IIPCI Pump or Turbine Fails to Start or Run - Summary of Industry Survey Results Failure Dese. - Root Cause . Corrective Measures Comments inspection Guidance Dropping resistor Resistor box design deficiency-special test Resistor box mndified to ensure assembly problems. showed output voltage insufficient when EGM x,ntrol box will receive input voltage at design minimum. required voltage under worst case conditions. Resistor Failure Resistor component replaced Ramp generatorAignal Slow IIPCI response time attributed Gain and time settings reset. Settings had not been modified converter box. incorrect turbine loop gain and ramp time based on power ascension test settings. program. Magnetic speed Cable damaged during IIPCI maintenance Cable repaired. pickup cable. preventing speed feedback to the speed controller. Speed control loose control room panel terminations. Repaired panel terminations. potentiometee. LUBE Olt SUPPLY FAULT 3 b Auxiliary oil pump Microswitch within pressure switch fails. Microswitch replaced. 2 additional failures due to pressure switch fails. . miscalibration, and one attnbuted to a piece of teflon tape that blocked sensing orirne of switch.
' lease hydraulic control system pressure Component ' adjusted.
switch contacting arm. Auxiliary oil pump Pump bearing failure degraded pump ; . Pump replaced, Similar event-punip motor failure. performance / lower discharge pressure, bearing failure was possibly due .
. bearing had been recently replaced- to daily .se to supply oil to potential human error, turbine stop vah'e. ' Additional low'- lluman error. All control valves Valves wrrectly positioned, handles : Two similar events have txturred bearing oil pessure mispositioned.
removed. Surveillance revised to at other plants. occurrences. ~ check oil pressure during turbine test. l Lube oil Paraffm in lube oil coated piston caused / Piston cleaned. "Ihe process of periodically contamination. -- binding of hvdraulic trip relay. - sampling tube ou should be verified. ~
Table A-1 IIPCI Pump or Turbine Fails to Start or Run - Summary of Industry Survey Results Failure Desc. Root Cause Corrective Measures Comments Inspection Guidann TURDINE OVERSPEED AND AlJIU REslir I'ROBIDt S Electrical termination loose electrical ternsination on solenoid Wiring to the solenoids will be 'Ihe wrredive action for a failures ' valve enil disabled the. remote reset restrained to reduce strain on the similar earlier W.nt apparently function. Failure attributed to normal terminations. did not address the root cause of lipCI vibration, the failure. Overspeed trip device Overspeed trip device tappet assembly Tappet remachined. Similar occurrena at another tapped binding. head was binding in vaht body. plant. Polyurethane tappet, previously machined per GE guidance, hal experienced additional grewth. Imose hydraulic control system pressure Repaired contactor arm. None. switch contactor arm. A Drain port blocked. Erratic stop valve operation. Blocked drain Drain port cleared. Additionalinformation on port in overspeed trip and auto reset turbine twerspeed trips is piston assembly caused trip mechanism to provided in NRC Information cycle between tripped and normal Notice 8614 and 5614. Supp.1. positions. INVER ITR TRIPS OR FAILURES . Inverier tripped and could not be reset Replaced inverter. ... . due to'a failed diode. See Ref.14 for effects of inverter - aging and preventative measures, 1 invertet failed due to the failure of an Replaced inverter. A simitat event involving a internal capacitor, ruptured capacitor occurred at another plant. Internal electronic Invertet overheating due to a failed Repaired or reptsted cooling fan, faults integral conting fan. Inverter failure due to blown fuse. Replaced fuse, _ _ . _ _ _ , ~ , - - , - . , . - . . - . ,, . , . , -, .. ,,- ,. . - . . . , . . , -- -. _ .
m _ [ '] Table A 1 IIPCI Pump or Turbine Fails to Start or Run - Summary of Industry Survey Results railure Dese. Root Cause Corrective Measures Comments Inspection Guidance Inverter trip due to high vc4tage setpoint Equalize voltage was reduced drift. allowing inverter to reset. TURBINE STOP VALVE 1%ILURES Control oil leaks. Oil teak developed at pilot valve Flange bolts torqued. Similar event at another plant. assembly / hydraulic cylinder flange bolts were loose. Pilot oil trip solenoid Valve stuck open due to disintegration of Valve's expendable parts now valve. diaphragm that caused valve plunger to scheduled for replacement at every stick above the sect. third refueling outage. Valve would not open due to excessive Piston rings were fabricated from Further discussion in IE Circular leakage of piston rings in hydraulic resin impregnated leather. Vendor 80 07 cylinder actuator. recommended replacement every five
.y years. Potential aging enncern.
Mechanical valve Valve and actuator stems separated at split Balance chamber adjustment was Similar failure occurred involving Overstress and ultimate failures. coupling. Balance chamber adjustment performed in 1985 per GE SIL 332. a loose valve position sensor fracture will usually occur drift believed to have caused increased Adjustment will be checked quarterly bracket that caught on actuator at the undercut on the momentum and disk twertravel. for a minimum of 3 quarters. housing when the valve opened. coupling threads due to The valve failed in the open reducing ;ross section. position. Incipient stem failure may . be indicated by circumferential cracks in-threaded stem area. TURillNE EXIIAUST RUI7URE DI$K . Cyclic fatigue.- Inner rupture disk failed due to cyclio Both disks replaced with an Imprcwed design appears to AEoD Reptxt E402 fatigue (alternating pressure and vacuum improved design that has a structural eliminate the cyclic fati5ue - prcwides additional within the exhaust line). Vacuum occurs backbg to prevent flexing during ; failute mode. examples of turbine during cold quick starts with cold piping. exhaust line vacuum conditions. exhaust rupture disk failuret _ , , . .. ._. ,. . . - , . , , - , - . .- . - ~ , , - , ._ . - . . - . . . _ .
Table A-1 'IIPCI Pump or Turbine Fails to Start or Run - Summary of Industry Survey Resuits - Failure Dese. Root Cause Corrective Measures Comments ' Inspection Guidance Water hammer - Exhaust diaphragm ruptured by water Blocked line cleared; rupture disk A similar event has occurred at induced disk rupture. carrytwer from exhaust line drain' pot due replaced. another plant. Duration and to a blocked drain line, frequency of exhaust line % blowdown increased.
-1 FLOW i CONTROLLER FAILURES Failures appear to be aging Ambient conditions in Failure to controlin Defective emplifier card and solder joint Repairs performed. related, yet it appears some areas containing this automatic. . ' attributed to aging. licensees do not intend to equipment should be periodically replace sensitive verified against equipment er otherwise address specifications.
the root cause of these failures. Dropping resistor failed in the instrument Resistors R26, R24, and rener diode amplifier circuitry due to normal heat of C24 all appeared to be affected by y operationc ambient temperatures and were g replaced. Intermittent eperation of internal switch 1he slight oxidized contacts were contacts did not alkw the controller to cleaned and lubricated. In the long' . read the flow setpoint in auto. term, permanent jumpers will be installed to bypar4 the switches. Gear train failure. - tme fastener caused intermediate gear to Frocedures will be revised to require unmesh which prevented adjustment of the a periodic check of the gear train . controller setting. - and fanteners. Miscalibration Ilow controller indicated a flow of 400 Controller recalibrated. gpm when system not in operation. Failure attributed to miscalibration. TURDINt! CONTROL VALVE FAULT 5 - Control oil leak. Oil supply line nipple leaking because Nipple repaired; plant personnel plant personnel stepped on line to gain . informed of failure ceuse, acass to control valve. V t l E . _ . . - _ - . . . . _ , , , ~,.L_....-. - , , - - . _ ___, __ _ - . , , , , _ . . -
Table A-1 -HPCI Pump or Turbine Fails to Start or Run - Summary of Industry Survey Results railure Desc. Root Cause Corrective Measures Comments Inspectirm Guidance Throttle vatve fising Six of the eight lifting beam bolts failed licensee to change thread lubricant: Per AEOD, Report 1906, beam bolting failure, due to stress corrosinn cracking of non-metal bearing petroleum jelly improper heat treatment and the improperly heat treated bolts. The recommended. use of a ayper based anti- ; remaining two bolts were cracked. seizure comptwnd were majoe .l~- contributors to this failure. LOSS Off LUBE OIL PCV_IES had an inonrrect diaphragm Formation of a procurement Additional LER reported a COOUNG installed due to inadequate mntrols to engineering group. diaphragm failure resulting in a 5 update plant information with indusuy gpm leak No cause stated. PCV-IW5 failunt. experience. MITELIANEOUS Used auxiliary oil pump to flush oil A modirication was proposed to ' The periodic tse of the auxiliary . Operating procedures through the governor to clear a ground, ehminate ramp generator initiation - oil pump is a common practice should be reviewed to Subsequently, system isolated on startup on auniliary oil pump startup, untest that can disable the llPCI ensure that cautions because the oil pump causes the stop and a valid initiation signal is present_ sptem. identify IIPCI system - control valves to go full open. inoperability.when the auxiliary oil pump is running.
>f
-4 3
._.n.L L_-- - -- s ~ w *
- y f
p
' APPENDIX A-2 SELECTED EXAMPLES OF ADDITIONAL HPCI FAILURE MODES-IDENTIFIED DURING INDUSTRY SURVEY 4
b i y .h
?
i .p
- I l< A-8 l
Table A-2 Summary of Illustrative Examples of AdditionalIIPCI Failure Modes Failure Desc. Root Cause Corrective Measures Comments Inspection Guidana IIPCI Failure 3 - Differential pressure transmitter failed due Amplifier card evnnection was Rosemont Trammitter NRCInformation Notice False Ifigh 5teamline to inadequate cunnection of amplifier ' secured. 82-16 provides additional Differential Pressure condition card was either incorrectly information on steamline Isolation Signal seated during installation or worked kyse. - pressure measurement. Miscalibration and a stuck pressure . Wrong conversion value caused Rosemont Transmitter indicator disabled both divisions et 4h miscalibration m'nd was corrected. AP trammitters. Transmitter operating outside tolerances Recalibrated transmitter Comervatively narrow instrument due to incorrect setpoint adjustment tolerances were used during the setroint adjustment The instrument was a Rosemount Transmitte r. Setpoint drift cause spurious system - 5etpoint was adjusted. Ilarton transmitter increased calibration isolations - frequency may be necessary.
> Setpoint drift caused by moisture intrusion Unknown Barton transmitter.
g through the dial tod shaft teal llPCI Failure 4 - MechanicalAhermal binding of disk due to Interim corrective action was drillins Ihis failure was attributed to Turbine Steam inlet ~ inadequate clearances. a hole in the valve disk. Double procedural and training Valve (1901) fails to disks were to be installed during a inadequacies.
- open failure refueling outage as a long term solution.
Thermal binding of disk Replaced motor gears and installed 'the thermal binding can onur . A four hour system larger power supply cable to motor, for ~2 hours after system is warmup may be required - returned to service following a by procedures to moldown. circumvent this problem. Motor failure - Surge protection added to shunt coil . Motor failure caused by high of DC nwtor control circuitry. - voltage transient in shunt coil that occurred when supply breaker opened.
. Failures No. 2 and 6 are discussed in Section 6 of the text.
- _ _ . . u _ _ ,. . - , . . - - a._ -~ - . .. ~ .. - . _ _ . _ . - _ _ -. . ,-
TaNe A-2 Summary of Illustrative Examples of Additional IIPCI Failure Modes Failure Dese. Root Cause Corrective Measures Comments Inspection Guidana - IIPCI l'ailure 4 Motor failure. Valve repaired and torque switch Motor windings failed due when Other safety related MOVs (cont'a) adjustment screws were correctly torque setting out of adjustment were also affected. torqued. due to jorne torque switch Procedurca were revised adjustment screws. and sorque switch limitee plates were installed. Valve motor failure due to incorrect steam Valve motor was replaced. lubrication Ucensee review deterrnined that valve Removed step starting resistors. Other DC MOVs were also INPO SER.25-88 and might not open due to insufrKient torque. evatusted. NRC Information Notice SA-72 provide further guidance. ilPCI Failure 5 Mispositioned auxiliary contacts in starting Replaced contacts. Pump Discharge - time delay relay for valve motor. Valve (IT1rm) Faile to Open Valve motor failure Valve motor replaced. Failure attributed to heat relaled breakdemn of vafve motor internals. c Ucensee review determined that valve may Step starting resistors had not been Potential proNem may affect INPO SER 25-88 and have insufficient torque to open. considered in the torque analyses other DC MOVs NRCInformation Notia and were removed. provide additional guidana. IIPCI Failure 6 - Motor failure. Windmg insulation Replaced motor. Voltage surge liigh voltage transients occurred Suppression Pool . degraded due to high voltage transients. protection added to circuitry. as supply breaker was opened Suction Une Valves (tutt.1982) Torque switch out of adjustment. Recalibrated. Fail to Open - Umit switch out of adjustment. Replaced limit switch. Valve stem separated from disk.. Valve repaired. Three bolts failed due to tensP,e 'nese valves were overlood. Other similar valves - manufactured by were inspcted. Associated Control Equipment. Inc.
~ Failures No. 2 and 6 are disemsed in Section 6 of the text. , _ . . ,.u-..- -. ..-,.,..,.-,..._..m. .- .. ,- .a., ,m a -, .. a .. _ -~ . . - _ _ _ . . . ~ , . - ,2
F Table A-2 Summary of Illustrative Examples of Additional IIPCI l'ailure Modes Failure Dese- Root Cause Corrective Measures Comments inspection Guidance IIPCI Failure 7- Valve inoperable due to damaged motor Switch replaced. Damage resulted frem overtravel Design changes may be Minimum Flow Valve . starter disconnect switch, of operating handle due to poor required as a result of this (F012) Fails to Open design. failure. IIPCI Failure 8 - Fuse failure due to electrical grounding. Fuse replaced and ground corrected. System Actuation ~' logic Fails System failed to actuate due to inadequate Desien modified. Further discussion in AEOD seal in time. Report E407 IIPCI Failure 9
- Failed power supply resistor. Itesistor replaced.
False Iligh Area Temperature isolation Failed temperature rnomtoring module Module replaced. New model replacement Signal txmsklered. Design error. Minimum intake setpoint temperature was increased.
> llPCI Failure 10- Pressure switch isolation valve None. Isolated pressure switch actuated O- False low Suction inadvertently closed, due to changing environmental Pressure Trip conditions.
IIPCI Failure 11 - Corrosion of pressure switch seats. Pressure switch replaced. Seal certosion allowed moisture False Ifigh wrbine into casing and shorted wiring. Exhaust Pressure Signal IIPCI Failure 12 + Exhaust line swing check valve failure Check valve replaced. Feiiure of check valve was References [21] and (22] Normaily Open bkxked M OV attributed to overstreswd cythng prtwide further Turbine Exhaust due to high exhaust pressure. information. Valve (F021) Fails Closed IIPCI Failure 13 - Irvel switches out of calibration Switches replaced. Accumulation of foreign material CST / Suppression Pool on float caused failure. togic Fails Failures No. 2 and 6 are discussed in Section 6 of the text.
~
.g DISTRIBUTION .
, No. of Conies No. of Conics .
- OFFSITE U.S. Nuclear ' Regulatory '2 - B. Gore Commission Pacific Northwest Lab.-
V Richland, WA- 99352 ~ n A. El Bassoni OWFN 10 E4 ONSITE W. D. Beckner 26- . Brookhaven National Lab. OWFN 10 E4 A. Fort (5) . l W. Gunther (10) . K. Campe R. Hall OWFN 10 E4 J. Higgins J. Taylor 10 J.Chung R. Travis OWFN 10 E4 - M. Villaran - A. Thadani Technical' Publishing (5) . OWFN 8 E2, Nuclear Safety Library (2); B. K. Grimes l D. Baksys . OWFN 9 A2 . Illinois Dept. of Nue; Safety ' 103 S. Outer Park Drive -- , J. N. Hannon Springfield, II ' 62704 OWFN 13 E21
-E. V. Imbro OWFN 9 Al
'2 H. E. Polk OWFN 12 H26 .
4 Enrico Fermi Nuclear Plant . Inspectors Office 4 . U.S. Nuclear Regulatory Commission - Region 3 2 J. Bickel ' . EG&G Idaho, Inc. i P.O. Box 1625 Idaho Falls, ID '83415 j' b
\
T a
~
NRC f ORM 335 UE. NUCLE AR LE1ULATO.;Y COMMis$3ON 1, i.EPO..:T NUMBE A NRC 1107 any w.m BIBLIOGRAPHIC DATA SHEET ceesan,wim,=on,s.r,o -so
- NUREG/CR-5959 2.mLE AND SUBMLE BNL-NUREG-52352 High Pressure Coolant Injection (HPCI) System Risk-Based Inspection Guide for Enrico Fermi Atomic Power Plant, Unit 2 3~ oAn REPoRreuBmD 0,,, ,,,,
.in m m rv ' 1449
- 4. FIN oR GRANT NUMBE R A3875
- h. AUTHoRIS) 6. TYPE oF REPORT M. Villaran, R. Travis, W. Gunther Technical l[ 7.n RioD covERtDr, eos r
- 8. PE RFoRMING oRG ANIZATloN - NAME AND ADDRESS tar wac. prorea o===a, Offne er nosen, us wucen perumvery commenen.and - . enreem;# eenwereer.smme name sad enemne essend Brookhaven National Laboratory Upton, NY 11973
- 9. $PoNSORING o3GANIZATioN - N AME AND ADDRESS fit a RC trpe ~%saw m amme ;#emerreew prerie WAC Dermen. Offse or Aspen, ui ww*se mesehrery e ener motime eneen.D Division of Systems Safety and Analysis Office of Nuclear Reactor Regu~ m ion U.S. Nuclear Regulatory Commis/ an Washington, DC 20555
- 10. SUPPLEMENTARY NOTES
- 11. ABST R ACT (m es,e er has
'Be High Pressure Coolant Injection (HPCI) system has been examined from a risk perspective. A System Risk-Based Inspection Guide (S-RIG) has been developed as
' an aid to HPCI system inspections at the Enrico Fermi Unit 2 Nuclear Power Plant. >
Included in this S-RIG is a discussion of the role of HPCI in mitigating accidents and a presentation of PRA-based failure modes which could prevent proper operation-of the system. The S-R1G uses industry operating experience, including plant-specific illustrative examples to augment the basic PRA failure modes. It is designed to be used as a reference for both routine inspections and the evaluation of the significance of ' component failures.
- 12. KE Y r/ORDS/DESCH:PloR$ rust mese er.,messw sner em susse sessmeners ** heeway we superr.s ,3. AvAeLABlut Y $1 AltMi NT BWR Type Reactors-Reactor components, BW Type Reactors-Reactor Unlimi ted Safety. Reactor High Pressure Coolant, Injection, High Pressure "**'""'"'"""""
Coolant Injection-Risk Assessment, Reactor-Risk, Assessment, Reactor ""'*' Cooling Systems, Reactor Accidents, High Pressure Coolant Injection - w1nw ma failures "***' Uncl assi fi ed th. NUMBER of PAGES
- 16. PRICE teRC FORM 336 (24e)
j Printed on recycled paper Federal Recycling Program u - -__ --- - o
~
~ N UlMUtrt,1AhlsLIA M.MJ3s0BIC3 (HPCI) GAn24 RISK-BASED INSPECTION CUIDE . --JANUARY 1993 ~
. FOR ENRICO FERMI ATOMIC POWER PIANTe UNIT 2 ;'
s
' UNITED STATES ~
NUCLEAR REGULATORY COMMISSION FIRST CLASS MAlb 12055513oe31 s 1 1 L "J i R G' POSTAGE AND FEES PAID -
? WASHINGTON, D.C. 20555-0001 US s' 9 C - 0 3 D'4 usNRc
'IV FOIo R DURLICATIONS PVC5 T P S - t' D P - eJ U '7 F r, PERMIT NO. G-67 p1; -
OFFICIAL BUSINESS . Wesw;NGTON DC ~"#c PENALTY FOR PRIVATE USE. $300 w f -' F k I s ] i. t'W'-F* $ 4%* g g. 9}}