ML20069L862

Auxiliary Feedwater System RISK-BASED Inspection Guide for the Mcguire Nuclear Power Plant

ML20069L862
Person / Time
Site:	Mcguire, McGuire
Issue date:	05/31/1994
From:	Bumgardner J, Gore B, Lloyd R, Moffitt N, Vo T Battelle Memorial Institute, PACIFIC NORTHWEST NATION
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-L-1310 NUREG-CR-5830, PNL-7784, NUDOCS 9406200324
Download: ML20069L862 (36)

Text

NU REG /CR-5830 PN L-7784 Auxiliary Feecwater System Risk-Based Insaection Guic e for the McGuire Nuclear Power Plant r m ,e- ~um" _

Prepared by J. D. Ilumgardner. R. C. Lloyd, N. E. Moffiii. f < . I'. Gore, 'l.V. Vo Pacific Northwest Laboratory Operated by Battelle Memorial Institute Prepared for U.S. Nuclear Regulatory Commission I

PDR DO K 050 369 G PDR

- ~ ~ -. _ - _ _ - . . --- - . .- . -

l l

AVAILABILITY NOTICE Avadabihty of Reference Matenals Cned in NRC Pubhcations Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Public Document Room, 2120 L Street. NW., Lower Level Washington DC 20555-0001

2. The Superintendent of Documents U.S. Government Printing Office, Mail Stop SSOP, Washington, DC 20402-9328 3 The National Technical Information Service, Springfield VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not in-tended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda: NRC buHetins, circulars, information notices, in-spection and investigation notices: licensee event reports: vendor reports and correspondence: Commission papers; and applicant and licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, international agreement reports, grant publications, and NRC booklets and brochures. Also available are regulatory guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commrssion Issuances.

Documents available from the National TechnicalInformation Service include NUREG-series reports and tech- ,

nical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technicallibraries include all open literature items, such as books, journal articles, and transactions. Federal Regtster notices. Federal and State legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations and non-NRC conference pro-ceedings are available for purchase from the organization Sponsoring the publication Cited.

Single copies of NRC draf t reports are available free, to the extent of supply, upon written request to the Office of Administration. Distribution and Mail Services Section, U.S. Nuclear Regulatery Commission, Washington, +

DC 20555-0001, Copies of Industry codes and standards used in a substantive manner in the NRC regulatory process are main-tained at the NRC Library,7920 Norfolk Avenue, Bethesda. Maryland, for use by the public, Codes and stan-dards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards Institute,1430 Broadway, New York, NY 10018.

DISCLAIMER NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government.

i Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, l expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of l such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights.

i

NUR EG/CR-5830 PN L-7784 Auxiliary Feedwater System Risk-Based Inspection Guide for the McGuire .

Nuclear Power Plant l l

Manuscript Completed: April 1994 Date Published: May 1994 Prepared by J. D. Ilumgardner, R. C. Lloyd, N. E. Moffitt, fl. E Gore, T.V. Yo Pacific Northwest Laboratory Richland. WA 99352 Prepared for Division of Systems Safety and Analysis Ollice of Nuclear Iteactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 NRC FIN L1310 l

l 4

l Abstract In a study sponsored by the U.S. Nuclear Regulatory Commission (NRC), Pacific Northwest Laboratory has developed and applied a methodology for deriving plant-specific risk-based inspection guidance for the auxiliary feedwater (AFW) system at pressurized water reactors that have not undergone probabilistic risk assessment (PR A), This methodology uses existing PRA results and plant operating experience information. Existing PR A-based inspection guidance information recently developed for the NRC for various plants was used to identify generic component failure modes. This informa- ,

tion was then combined with plant-specific and industry-wide component information and failure data to identify failure modes and failure mechanisms for the AFW system at the selected plants. McGuire was selected as one of a series of plants for study. The product of this effort is a prioritized listing of AFW failures which have occurred at the plant and at other pWRs. This listing is intended for use by NRC inspectors in the preparation of inspection plans addressing AFW risk-important components at the McGuire plant.

iii NUREG/CR-5830

i l

1 l

Contents i

Abstract . . .. . . . . . iii Summary . ... ... . . . vii 1 introduction . . .. . 1.1 2 McGuire AFW System . . . . . . 2.1 2.1 System Description . . . 2.1 2.2 Success Criterion . . ... . 21 2.3 System Dependencies . . . . . 2.1 2.4 Operational Constraints . . . . .. . 2.2 3 Inspection Guidance for The McGuire AFW System .. 3.1 l

3.1 Risk Important AFW Components and Failure Modes . ... . 3.1 3.1.1 Multi;le Pump Failures Due to Common Cause .. . . ... 3.1 3.1.2 Turbine Driven Pump Fails to Start or Run .. . . .. . . . ... . 3.3 3.1.3 Morcr Driven Pump A or B Fails to Start or Run .. . 3.4 3.1.4 Pump Unavailable Due to Maintenance or Surveillance . ... . . . .. 3.4 3.1.5 Air Operated Flow Control Valves Fail Closed . .. . . . . . 3.4 3.1.6 Motor Operated Isolation Valves Fall Closed . . . . . . ..... .. . 3.5 3.1.7 Manual Suction or Discharge Valves Fail Closed . . . . . . . 3.6 3.1.8 12 dage of Hot Feedwate ' rough Check Valves .

- . .. . .. 3.6 3.2 Risk Important AFW System Walkdown Table . . ,. . . . .. 3.7 4 Genenc Risk Insights From PRAs . . ,. ... .. . . . 4.1 4.1 Risk Important Accident Sequences involving AFW System Failure ... 4.1 4.2 Risk Important Component Failure Modes .... . . . . . .... . . 4.1 5 Failure Modes Determined from Operating Experience . . . . . . . . . .. 5.1 5.1 McGuire Experience . . .. . . ... . . . .. . . .... 5.1 5.1.1 Multiple Pump Failures . . . . . . . . 5.1 5.1.2 Motor Driven Pump Failures . . . . .. . . .. . 5.1 5.1.3 Turbine Driven Pump Failures .. . ., , ... . . . . . . 5.1 5.1.4 Flow Control and Isolation Valve Failures . . . ... 5.1 5.1.5 Check Valve Failures . . . ... . 5.1 5.1.6 Human Errors . . . . . . 5.1 ,

1 l

y NUREG/CR-5830 l

5.2 Industry Wide Experience .. . . . . .. . ... 5.2 i

5.2.1 Common Cause Failures . ., . . . . . . . 5.2 5.2.2 Human Errors . . . . . . . ..... . 5.4 5.2.3 Design / Engineering Problems and Errors . .. . .. . . .. 5.4 5.2.4 Component Failures . .. . .. . . . . . . . ,. 5.5 4

6 References . . . .. . . .. . .. . . .. 6.1 1

1 I

4 NUREG/CR-5830 vi

1 Summary This document presents a compilation of auxiliary feedwater (AFW) system failure information which has been screened for risk significance in terms of failure frequency and degradation of system performance. It is a risk-prioritized listing of failure events and their causes that are significant enough to warrant consideration in inspection planning at the the McGuire plant. This information is presented to provide inspectors with increased resources for inspection planning at McGuire.

The risk importance of various component failure modes was identified by analysis of the results of probabilistic risk assessments (PR As) for many pressurized water reactors (PWRs). Ilowever, the component failure categories identified l in PR As are rather broad, because the failure data used in the PRAs is an aggregate of many individuals failures having a l variety of root causes. In order to help inspectors to focus on specific aspects of component operation, maintenance and design which might cause these failures, an extensive review of component failure information was performed to identify and rank the root causes of these component failures. Both McGuire and industry wide failure information was analyzed.

Failure causes were sorted on the basis of frequency of occurrence and seriousness of consequence, and categorized as l

common cause failures, human errors, design problems, or component failures.

This information is presented in the body of this document. Section 3.0 provide brief descriptions of these risk-important failure causes, and Section 5.0 presents more extensive discussions, with specific examples and references. The entries in j the two sections are cross-referenced.

]

An abbreviated system walkdown table is presented in Section 3.2 which includes only components identified as risk important. This table lists the system lineup for normal, standby system operation.

This information permits an inspector to concentrate on components important to the prevention of core damage.

Ilowever, it is important to note that inspections should not focus exclusively on these components. Other components which perform essential functions, but which are not included because of high reliability or redundancy, must also be addressed to ensure that degradation does not increase their failure probabihnes, and hence their risk importances.

I i

i vii NUREG/CR-5830 l .

1 Introduction This document is one of a series providing plant-specific The remainder of the document describes and discusses inspection guidance for auxWary feedwater (AFW) sys- the information used in compiling this inspection guid-tems at pressurized water eactors (PWRs). This gui- ance. Section 4.0 describes the risk importance infor-dance is based on information from probabilistic risk mation which has been derived from PRAs and its assessments (PRAs) for similar PWRs, industry-wide sources. As review of that section will show, the failure operating experience with AFW systems, plant-specific events identified in PRAs are rather broad (e.g., pump AFW system descriptions, and plant-specific operating fails to start or run, valve fails closed). Section 5.0 experience. It is not a detailed inspection plar.. Sut rather addresses the specific failure causes which have been a compilation of AFW system failure information which combined under these broad events.

has been screened for risk significance in terms of failure frequency and degradation of system performance. The AFW system operating history was studied to identify the result is a ri3k-prioritized listing of failure events and the various specific failures which have been aggregated into causes that are significant enough to warrant consideration the PRA failure everits. Section 5.1 presents a summary in inspection planning at McGuire. of McGuire failure informaOn, and Section 5.2 presents a review of industry-wide failm mfcrmation. The This inspection guidance is presented in Section 3.0, industry-wide information was compiled from a variety 1 following a description of the McGuire AFW system in NRC sources, including AEOD analyses and reports, Section 2.0. Section 3.0 identifies the risk important information notices, inspection and enforcement bulletins, system components by McGuire identification number, and generic letters, and from a variety of INPO reports as followed by brief descriptions of each of the various well. Some Licensee Event Reports and NPRDS event failure causes of that component. These include specific descriptions were also revieweo. Finally, information human errors, design deficiencies, and hardware failures. was included from reports of NRP-sponsored studies of The discussions also identify where common cause fail- the effects of plant aging, which include quantitative ures have affected multiple, redundant components, analyses of reported AFW system failures. This industry-These brief discussions identify specific aspects of system wide information was then combined with the plant-or component design, operation, maintenance, or testing specific failure information to identify the various root for inspection by observation, records review, training causes of the broad failure events used in PRAs, which observation, procedures review, or by observation of the are identified in Section 3.0.

implementation of procedures. An AFW system walk-down table identifying risk important components and their lineup for normal, standby system operation is also provided.

1 I

1 1.1 NUREG/CR-5830 l

l

1 l

l 2 McGuire AFW System This section presents an overview of the McGuire AFW System Actuation Circuitry). In addition, the single system, including a simplified schematic system diagram. turbine-driven (TD) pump starts on a station blackout In addition, the system success criterion, system depen- condition.

dencies, and administrative operational constraints are also presented. The discharges of the motor-driven pumps are normally aligned so that the A pump supplies the A and B steam generators and the B pump supplies the C and D steam 2.1 Systern Description generators. Cross-connect valves are provided to allow feeding of any steam generator from either pump. The cross-connect valves are locked shut and administratively The AFW system provides feedwater to the steam genera.

controlled. The turbine-driven pump supplies water to all tors (SG) to allow secondary-side heat removal from the f ur steam generators, but through separate lines. Steam primary system when main feedwater is unavailable. The generator inlet isolation valves are locked open manual system is capable of functioning for extended periods, valves and the discharge isolation valves are motor opera-which allows (5ne to restore main feedwater flow or to ted. Flow control valves in each of the eight feedwater proceed with an orderly cooldown of the plant to where the residual heat removal (RilR) system can remove decay lines are pneumatic. Each line also contains multiple check valves to prevent leakage from the feedwater lines.

heat. A simplified schematic diagram of the McGuire AFW system is shown in Figure 2.1.

The Condensate Storage System (CSS), which is com-Prised of the CST, Upper Surge Tank and Condenser The preferred source of AFW pump suction is from the

!! twell, provides the normal suction sources for the upper surge tank (UST), with alternate suction sources AFW system and is required to store sufficient water to from the condensate storage tank (CST) and the condenser maintain the reactor coolant system (RCS) at hot standby hotwell. A common header supplies water to both the for tw hours followed by a cooldown to the point where motor-driven and turbine-driven pumps through a check vahe and a normally open motor controlled isolation RIIR system can be placed in service. All tank connec-valve. Two additional back-up sources of water for the ti ns except those required for instrumentation, auxiliary feedwater pump suction, and tank drainage are located AFW pumps are provided from the nuclear service water above this minimum level.

system (RN) and the condenser circulating water system (RC). Power, centrol, and instrumentation associated with each train are independent from each other. Steam for the turbine driven pump is supplied through SA-48 and SA-49 2.2 Success Criterion from steam generators B and C, from a point upstream of the main steam isolation valves. Each AFW pump is System success requires the operation of at least one pump equipped with a recirculation flow system which prevents supplying rated flow to two steam generators.

pump deadheading.

The system is designed to start up and establish flow 2.3 System Dependencies automatically. All pumps start on receipt of a steam generator low-low level signal. (The motor-driven pumps The AFW system depends on AC power for motor-driven start on low-low level in one SG, whereas, two SG low-pumps and motor-controlled isolation valves, DC power low level signals are required for a turbine-driven pump for control power to pumps, valves, and automatic actua.

start.) The motor-driven (MD) pumps start for the fol- tion signals, and instrument air for AFW flow control lowing conditions: safety injection, blackout, trip of both valves. In addition, the turbine-driven pump also require s main feedwater pumps, and AMSAC (ATWS Mitigation steam availability.

2.1 NUREG/CR-5830

AFW System 2.4 Operational Constraints six hours. With three AFW pumps inoperable, corrective action to restore at least one pump to operable status must When the reactor is critical the McGuire Technical Speci. be initiated immediately, and the plant must be shut down fications require that all three AFW pumps and associated to hot standby within six hours and in llot Shutdown flow paths are operable with each motor-driven pump within the following six hours.

powered from a different emergency bus. If one AFW pump becomes inoperable, it must be restored to operable The operability of the AFW system ensures that the status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the plant must be shut down to reactor coolant system can be cooled down to less than hot standby within the next six hours. If two AFW pumps 350 degrees froni normal operating conditions in the event are inoperable, the plant must be shut down to hot standby of a total loss of ot! site power.

within six hours and in flot Shutdown within the following i

NUREG/CR-5830 2.2 I

$ MAB T

w S n U

( (

A 3 N g, 1 I A

g 2 4

_I R 8

't " *

' 5 { s e

9 '

r s Q 6 1t

,'2 s

Q62' Qk 7 I 0

4 1

X6 1

}1 8 r

W

• F QQ

( (

g i r

s

[

) ]

4 2

6 6 1

1 Q a 1

14 N

g ,

s

- n ,

N*

1 1

W-I 2

1

, a "

x m W N *a t e

P A" ""

F i s

U

" S s

y T

W 2

F

=

V S

2 .

A 1

M05

' e 2

i r

u G c M

1 2

e r

u g

i F

D ,s C

S 2 X

D 7' 1 2 "

• 3 W5 1 e

+2

%,g "

' v^

Yr s  %

• 5 PW pW P p*

MO FL 6 uO rL 5 - M E

' e ' s TF TF T '

F r '

1 C 9 - C 4 e '

• My 6 E ( '

e M4 1 3 5 i 5 5 5 s T

F C * @ E 7 2

i r

C 2 - e 2

1 F

C

• m e 2

i r

C

• s 1 1 1 F F F C C C

.)

A B O G S' O hSG O WCGF , goGs N $y$%hg

i 3 Inspection Guidance for the McGuire AFW System in this section the risk important components of the 3.1.1 Multiple Pump Failures Due to McGuire AFW system are identified, and the important Couunou Cause {

failure modes for these components are briefly described.

These failure modes include specific human errors, design The following listing summarizes the most important .

deficiencies, and types of hardware failures which have multiple-pump failure modes identified in Section 5.2.1, I been observed to occur for these components, both at Common Cause Failures, and each item is keyed to l McGuire and at PWRs throughout the nuclear industry. entries in that section.

The discussions also identify where common cause fail- ,

ures have affected multiple, redundant components.

• Incorrect operator intervention into automatic system  !

These brief discussions identify specific aspects of system functioning, including improper manual starting and j or component design, operation, maintenance, or testing securing of pumps, has caused failure of all pumps, for inspection activities. These activities include; obser- neluding overspeed trip on startup, and inability to vation, records review, training observation, procedures restart prematurely secured pumps. CCl. At review, or by observation of the implementation of McGuire incorrect operator interpretation of control procedures. panel information during a loss of control room test caused difficulty in control of the AFW system which Table 3.1 is an abbreviated AFW system walkdown table resulted in an abnormally fast cool down.

which identifies risk-important components. This table lists the system lineup for normal (standby) system opera- Inspection Suggestion - Observe Abnormal and Emer-tion. Inspection of the identified components addresses gency Operating Procedure (AOP/EOP) simulator essentially all of the risk associated with AFW system  : raining exercises to verify that the operators comply operation. with procedures during observed evolutions. Observe surveillance testing on the AFW system to verify it is in strict compliance with the surveillance test 3.1 Risk Important AFW Components procedure.

and Failure Modes

• Valve mispositiening has caused failure of all Common cause failures of multiple pumps are the most pumps. Pump suction, steam supply, and instru-ment isolation valves have been involved. CC2.

risk-important failure modes of AFW system components.

At McGuire, the motor-driven AFW pumps start-These are followed in importance by single pump failures, level control valve failures, and individual check valve ed on a false signal. The operator actuated valves incorrectly in the recovery process.

leakage failures.

The following sections address each of these failure In3Pection Suggestion - Verify that the system valve alignment, air operated valve control and valve modes, in decreasing order of risk-importance. They pre-ctuating air pressures are correct using 3.1 Walk-sent the important root causes of these component failure down Table, the system operating procedures, and modes which have been distilled from historical records.

Each item is keyed to discussions in Section 5.2 where additional information on historical events is presented.

3.1 NUREG/CR-5830

=

Inspection Guidance operator rounds logsheet. Review surveillance pro-

• l_oss of a vital power bus has failed both the cedures that alter the standby alignment of the AFW turbine-driven and one motor-driven pump due to system. Ensure that an adequate return to normal sec- loss of control power to steam admission valves or to turbine controls, and to motor controls tion exists.

powered from the same bus. CC6.

• Steam binding has caused failure of multiple pumps.

'This resulted from leakage of hot feedwater past Inspection Suggestion - The material condition of the check valves into a common discharge header, with electrical equipment is an indicator of probable relia-several valves involved including a motor-operated bility. Review the Preventative Maintenance (PM) discharge valve. CC10. Multiple-pump steam bind- records to Ensure the equipment is maintained on an ing has also resulted from improper valve lineups, appropriate frequency for the environment it is in and _

and from running a pump deadheaded. CC3. that the PM's are actually being performed as re-quired by the program. Review the outstanding Cor-Inspection Suggestion - Verify that the pump dis- rective Maintenance records to Ensure the charge temperature is within the limits specified on deficiencies found on the equipment are promptly corrected, the operator rounds logsheet. Ensure any instruments used to verify the temperature by the utility are of an appropriate range and included in a calibration pro-

• Simultaneous startup of multiple pumps has caused gram. Verify affected pumps have been vented in oscillations of pump suction pressure causing accordance with procedures to ensure steam binding multiple-pump trips on low suction pressure, despite has not occurred. Verify that a maintenance work the existence of adequate static net positive suction request has been written to repair leaking check head (NPSil). CC7. Design reviews have identified valves, inadequately sized suction piping which could have yielded insufficient NPSH to support operation of

• Pump control circuit deficiencies or design modi- more than one pump. CC8.

fication errors have caused failures of multiple pumps to auto start, spurious pump trips during Inspection Suggestion - Ensure that plant conditions operation, and failures to restart after pump shut- which could result in the blockage or degradation of ,

down. CC4. At McGuire, similar incidences the suction flow path are addressed by system mainte-have occurred. Motor-driven pump electrical nance and test procedures. Examples include, if the leads were shorted to the turbine-driven pump AFW system has an emergency source from a water electrical circuitry causing incorrect operation of system with the potential for bio-fouhng, then the that pump. Incorrect set points and control cir- system should be periodically treated to prevent build-cuit calibrations have also prevented proper up and routinely tested to Ensure an adequate flow operation of multiple pumps. CCS. can be achieved to support operation of all pumps, or inspected to Ensure that bio-fouling is not occurring.

Inspection Suggestion - Review design change imple- Design changes that affect the suction flow path mentation documents for the post maintenance testing should repeat testing that verified an adequate suction required prior to returning the equipment to service. source for simultaneous operation of all pumps.

Ensure the testing verifies that all potentially impacted Verify that testing has, at sometime, demonstrated functions operate correctly, and includes repeating simultaneous operation of all pumps. Verify that sur-any plant start-up or hot functional testing that may be veillances adequately test all aspects of the system affected by the design change. design functions, for example, demonstrate that the AFW pumps will trip on low suction pressure.

NUREG/CR-5830 3.2

l Inspection Guidance 3.1.2 Turbine Driven Pump Fails to Start or right after such a trip may fail to indicate the problem due to warming and clearing of the Run steam lines. Surveillance should exercise all steam supply connections. DE2.

• Improperly adjusted and inadequately maintained I turbine governors ha ie caused pump failures.  !

IIE2, Problems include worn or loosened nuts, Inspection Suggestion - Verify that the steam traps are valved in on the steam supply line. For steam traps set screws, linkages or cable connections, oil that are on a pressurized portion of the steam line, leaks and/or contamination, and electrical failures check the steam trap temperature (if unlagged) to of resistors, transistors, diodes and circuit cards, Ensure it is warmer than ambient (otherwise it may be and erroneous grounds and connections. CF5.

stuck or have a plugged line), if the steam trap dis-Improperly maintained governors where oil level l charge is visible, Ensure there is evidence of liquid was found to be low have occurred at McGuire. l discharge.

Also, accidently shorted electrical leads to the turbine-driven pump control circuit have caused

• Trip and throttle valve (TTV) problems which failure of that pump.

have failed the turbine driven pump include physically bumping it, failure to reset it following Inspection Suggestion - Review PM records to Ensure testing, and failures to verify control room indica-the governor oil is being replaced within the desig.

tion of reset. HE2. Whether either the over-nated frequency. During plant walkdowns carefully speed trip or TTV trip can be reset without resett-inspect the governor and linlpges for loose fasteners, ing the other, indication in the control room of leaks, and unsecured or degraded conduit. Review TTV position, and unambiguous local indication vendor manuals to ensure PM procedures are per.

of an overspeed trip affect the likelihood of these formed according to manufacturer's recommendations errors. DE3. At McGuire, a steam supply valve and good maintenance practices.

was slow to operate due to a replaced orifice being too small.

• Terry turbines with Woodward Model EG gover-nors have been found to overspeed trip if full In5Pection Suggestion - Carefully inspect the TTV steam flow is allowed on startup. Sensitivity can overspeed trip linkage and Ensure it is reset and in be reduced if a startup steam bypass valve is good physical condition. Ensure that there is a good sequenced to open first. del, steam isolation to the turbine, otherwise continued turbine high temperature can result in degradation of

• Turbines with Woodward Model PG-PL governors the oil in the turbine, interfering with proper over-have tripped on overspeed when restarted shortly after speed trip operation. Review training procedures to shutdown, unless an operator has locally exercised the ensm operator training on resetting the TTV is speed setting knob to drain oil from the governor current.

speed setting cylinder (per procedure). Automatic oil dump valves are now available through Terry. DE4.

• Low lubrication oil pressure resulting from heat-up because of previous operation has prevented Inspection Suggestion - Observe the operation of the pump restart from failure to satisfy the protective turbine driven Aux Feed pump and Ensure that the interlock. DE5.

governor is reset as directed in OP/1/A/6250/02, by rotating the speed control knob fully in the counter Inspection Suggestion - Low oil pressure is a trip that clockwise direction, then fully in the clockwise direc.

tion. Ensure the turbine is not coasting over, which is in service at all times for the turbine driven AFW pump. Normally the low oil pressure occurs at ap-can result in refill of the speed setting cylinder.

proximately 1400 rpm and serves to protect the pump from low RPM operation. Ilowever, low oil pressure

• Condensate slugs in steam lines have caused tur due to a plugged filter will also cause a trip. Review bine overspeed trip on startup. Tests repeated 3.3 NUREG/CR-5830 l

inspection Guidance PM records toEnsure the filter is replaced on the be scheduled before the routine surveillance test, so designated frequency. credit can be taken for both post maintenance testing and surveillance testing, avoiding excessive testing.

3.1.3 Alotor Driven Pump A or E Fails to Review surveillance schedule for frequency and ade-Start or Run quacy to verify system operability requirements per Technical Specifications.

• Control circuits used for automatic and manual pump starting are an important cause of motor 3.1.5 Air Operated Flow Control Valves Fail driven pump failures, as are circuit breaker Closed failures. CF7.

TD Pumn Train: CA-36. 48. 52. 64 Inspection Suggestion - Review corrective mainte- MD Pumn Train: C A-40. 44. 56. 60 nance records when control circuit problems occur to determine if a trend exists. Every time a breaker is These normally closed air operated valves (AOVs) control racked in a PMT should be performed to start the flow to the steam generators. They fail open on loss of pump, assuring no control circuit problems have Instrument Air.

occurred as a result of the manipulation of the breaker. (Control circuit stabs have to make up upon

• Control circuit problems have been a primary racking the breaker, and cell switch damage can occur cause of failures, both at McGuire and elsewhere.

upon removal and reinstallation of the breaker.) CF9. Valve failures have resulted from blown fuses, failure of control components (such as

• Mispositioning of handswitches and procedural current / pneumatic convertors), broken or dirty deficiencies have prevented automatic pump start. contacts, misaligned or broken limit switches, HE3. Mispositioning of handswitches has control power loss, and calibration problems.

occurred at McGuire.

Inspection Suggestion - Check for control air system Inspection Suggestion - Confirm switch position using alignment and air lealo during plant walkdowns.

Table 3.1. Review administrative procedures con. (Regulators may have a small amount of external cerning documentation of procedural deficiencies. bleed to maintain downstream pressure.) Check for Ensure operator training on procedural changes is cleanliness and physical condition of visible circuit current. elements. Review valve stroke time surveillance for adverse trends, especially those valves on reduced 3.1.4 Pump Unavailable Due to Alaintenance testing frequency. Review air system surveillances to or Surveillance verify that moisture content of air is within established limits.

• Both scheduled and unscheduled maintenance

• Out-of-adjustment electrical flow controllers have remove pumps from operability. Surveillance caused improper valve operation, affecting multiple requires operation with an altered line-up, trains of AFW. CCl2. McGuire has experienced although a pump train may not be declared in-operable during testing. Prompt scheduling and Problems in individual trains.

performance of maintenance and surveillance In5Pection Suggestion - Review PM frequency and minimize this unavailability.

records, only upon a trend of failure of the con-Inspection Suggestion - Review the time the AFW tr llers.

system and components are inoperable. Ensure all

• Leakage of hot feedwater through check valves has maintenance is being performed that can be perfor.

caused thermal binding of flow control MOVs.

med during a single outage time frame, avoiding AOVs may be similarly susceptible. CF2.

multiple equipment outages. The maintenance should NUREG/CR-5830 3.4

. - - - - ~ _ - . .

Inspection Guidance 4 Inspection Suggestion - Covered by 3.1.1 bullet 3. actions are taken to aEnsure valve operability following an overtorque condition. Review the

• Inadequate air pressure regulation at McGuire has re- program to aEnsure EQ seals are renewed as required suited in control valve failure to operate and degraded during the restoration from testing to maintain the EQ operation due to low air pressure output from the rating of the MOV.

compressor, a plugged air line and a broken air line.

• Valve motors have been failed due to lack of, or Inspection Suggestion - Covered by 3.1.5 bullet 1. improper sizing or use, of thermal overload protective ,

devices. Bypassing and oversizing should be based

• Multiple flow control valves have been plugged by on proper engineering for desien basis conditions. l clams when suction switched automatically to an CF4. l alternate, untreated source. CC9.

Inspection Suggestion - Review the administrative Inspection Suggestion - Covered by 3.1.1 bullet 6. controls for documenting and changing the settings of thermal overload protective devices. Ensure the 3.1.6 Motor Operated Isolation Valves Fail information is available to the maintenance planners.

Closed

• Out-of-adjustment electrical flow controllers have MD Pump Discharge Isolation: CA-428. 46B. 58A. caused improper discharge valve operation, affecting g muhiple trains of AFW. CCl2.

TD Pump Discharce Isolation: CA-38 A. 50A. 54B.

Inspection Suggestion - Review PM frequency and M6g records, only upon a trend of failure of the Nuclear Service Water Suction Isolation: 15 A. I16B.

18B.86B controllers.

CSS Suction Isolation: CA-2. 4. 6. 7AC. 9B. I1 A MFW Temperine Flow Isolation: CF-151.153.155.

• Grease trapped in the torque switch spring pack of the operators of MOVs has caused motor burnout or ther-157 mal overload trip by preventing torque switch actua-These MOVs isolate flow to the steam generators and ti n. CF8.

provide AFW pump suction isolation. The discharge isolation valves and CST suction valves are normally open In3Pection Suggestion - Review this only if the MOV and the nuclear service water suction valves are normally testing program reveals deficiencies in this area, closed. They all fail as-is on loss of power.

• Manually reversing the direction of motion of

• Common cause failure of MOVs has occurred at operating MOVs has overloaded the motor circuit.

McGuire and elsewhere, from failure to use electrical Operating procedures should provide cautions, and circuit designs may present reversal before each signature tracing equipment to determine proper settings of torque switch and torque switch bypass stroke is finished. DE7.

switches. Failure to calibrate switch settings for high Inspection Suggestion - Review operating procedures torques necessary under desien basie accident conditions has also been involved. CCI1. and operator performance of valve positioning.

l

• Space heaters designed for preoperation storage have

. Inspection Suggestion - Review the MOV test records been found wired in parallel with valve motors which to Ensure the testing and settings are based on had not been environmentally qualified with them dynamic system conditions. Overtorquing of the valve operator can result in valve damage such as present. D E7.

l cracking of the seat or disc. Review the program to Ensure overtorquing is identified and corrective J 3.5 NUREG/CR-5830 I i

? 1

. 1 i

1

Inspection Guidance Inspection Suggestion - Spot check MOV's during -

Failure to follow good practices of written task MOV testing to Ensure the space heaters are assignment and feedback of task completion physically removed or disconnected. information 3.1.7 Manual Suction or Discharge Valves -

Failure to provide casily read system drawings, Fail Closed legible valve labels corresponding to drawings and procedures, and labeled indications of local TD Pump Train: CA-19: 21: 63. 51. 47. 35 valve position MD Pump Trains A: B: CA-25, 30: 87. 88: 59. 55.

43.39 In5Pection Suggestion - Review the administrative l controls that relate to valve positioning and sealing, l These manual valves are normally locked open. For each system restoration following maintenance, valve train, closure of the first valves would block pump suc. I beting, system drawing updating, and procedure tion, closure of the second valves would block pump dis, revision, for proper implementation charge and closure of the third set of valves would block discharge to steam generators A,B,C, and D respectively. 3.1.8 Leakage of Ilot Feedwater Through Check Valves:

• Valve mispositioning has resulted in failures of multiple trains of AFW. CC2. It has also been the MD Pump Trains A: B: CA-61. 57: CA-45. 41 dominant cause of problems identified during opera- TD Pumn Train: CA-65. 53. 49. 37 tional readiness inspections. HEl. Events have occurred most often during maintenance, calibration,

• Leakage of hot feedwater through several check or system modifications. Important causes of mis- valves in series has caused steam binding of multiple positioning include: pumps. Leakage through a closed level control valve in series with check valves has also occurred, as Failure to provide complete, clear, and specific would be required for leakage to reach the motor procedures for tasks and system restoration driven or turbine driven pumps. CCIO Failure to promptly revise and va'idate pro- Inspection Suggestion - Covered by 3.1.1 bullet 3.

cedures, training, and diagrams following system modifications

• Slow leakage past tiie final check valve of a series may not force upstream check valves closed, allowing Failure to complete all steps in a procedure leakage past each of them in turn. Piping orientation and valve design are important factors in achieving Failure to adequately review uncompleted true series protection. CFl.

procedural steps after task completion Inspection Suggestion - Covered by 3.1.1 bullet 3.

Failure to verify support functions after restoration a The turbine-driven pump at McGuire experienced reverse rotation and a pressurized suction which was Failure to adhere scrupulously to administrative attributed to a leaky swing check valve.

procedures regarding tagging, control and tracking of valve operations Inspection Suggestion - Covered by 3.1.1 bullet 3.

Failure to log the manipulation of sealed valves 1

t NUREG/CR-5830 3.6

Inspection Guidance 3.2 Risk Important AFW System damage. However, it is essential to note that inspections  ;

should not focus exclusively on these components. Other '

Walkdown Table components which perform essential functions, must also  ;

be addressed to ensure that their risk importances are not Table 3.1 presents an AFW system walkdown table in- increased. Examples include the (open) steam lead stop cluding only components identified as risk important. check valves and an adequate water level in the CST.

This information allows inspectors to concentrate their efforts on components important to prevention of core i

l l

l

)

i a

3.7 NUREG/CR-5830

Inspection Guidance i

Table 3.1 Risk Importance AlqV System Walkdown Table Actual Component # Component Name Required Location Position Electrical A Motor Driven Pump Racked In/

Closed B Motor Driven Pump Racked In/ _

Valve CA-2 CA Pump Suct From HTWL ISOL Open CA-4 CA Pump Suct From UST Open CA-6 CA Pump Suct From AFW CST Open CA-7 TD CA Pump Norm Suct ISOL Open CA-9 CA Pump B Norm Suct ISOL Open CA-11 CA Pump A Norm Suct ISOL Open CA-15 CA Pump A Suct From RN ISOL Auto / Closed CA-18 CA Pump B Suct From RN ISOL Auto / Closed CA-116 TD CA Pump Suct From RN HDR B Auto / Closed CA-86 TD CA Pump Suct From RN HDR A Auto / Closed CA-161 Aux FDWP Suct HDR RN Supply ISOL Closed CA-162 Aux FDWP Suct HDR RN Supply ISOL Closed CA-19 TD CA Suct ISOL Locked Open CA-25 CA Pump A Suct ISOL Locked Open CA-30 CA Pump B Suct ISOL Locked Open CA-67 TD CA Pump to UST Dome Throttle Open CA-68 TD CA Pump to UST Dome ISOL Open CA-20 TD CA Pump Throttle to UST Dome Open CA-71 CA Pump A to UST Dome Throttle Open CA-72 CA Pump A to UST Dome ISOL Open CA-27 CA Pump A Throttle to UST Dome Open CA-69 CA Pump B to UST Dome Throttle Open I

NUREG/CR-5830 3.8

1 Inspection Guidance I

i Table 3.1 Risk Importance AFW System Walkdown Table Actual Component # Component Name Required Location Position .

l CA-70 CA Pump B to UST Dome ISOL Open  ;

CA-32 CA Pump B Throttle to UST Dome Open CA-21 TD CA Pump Disch to S/G ISOL Locked Open CA-87 CA Pump A Disch to S/G ISOL Locked Open CA-88 CA Pump B Disch to S/G ISOL Locked Open CA-35 TD CA Pump Disch to S/G ID Locked Open Control Valve inlet ISOL CA-47 TD CA Pump Disch to S/G IC Locked Open l Control Valve Inlet ISOL CA-51 TD CA Pump Disch to S/G IB Locked Open Control Valve inlet ISOL CA-63 TD CA Pump Disch to S!G 1 A Locked Open Control inlet ISOL CA-55 CA Pump A Disch to S/G 1B Locked Open Control Valve Inlet ISOL CA-59 CA Pump A Disch to S/G 1 A Locked Open Control Valve Inlet ISOL CA-39 CA Pump B Disch to S/G ID Locked Open Control Valve Inlet ISOL CA-43 CA Pump B Disch to S/G IC Locked Open Control Valve Inlet ISOL CA-111 CA Pump A & B Disch X-Over to Locked Closed S/G ISOL CA-112 CA Pump A & B Disch X-Over to Locked Closed S/G ISOL CA-40 CA Pump B Flow to S/G D Open CA-44 CA Pump B Flow to S/G C Open CA-56 CA Pump A Flow to S/G B Open CA-60 CA Pump A Flow to S/G A Open CA-36 TD CA Pump Flow to S/G D Open i i

CA-48 TD CA Pump Flow to S/G C Open  !

l 3.9 NUREG/CR-5830 l

l Inspection Guidance Table 3.1 Risk Importance AFW System Walkdown Table Actual Component # Component Name Required Location Position CA-52 TD CA Pump Flow to S/G B Open CA-64 TD CA Pump Flow to S/G A Open CA-62A CA Pump A Disch to S/G .A ISOL Open CA-58A CA Pump A Disch to S/G B ISOL Open CA-46B CA Pump B Disch to S/G C ISOL Open CA-42B CA Pump B Disch to S/G D ISOL Open CA-38B TD CA Pump Disch to S/G D ISOL Open CA-50B TD CA Pump Disch to S/G C ISOL Open CA-54A TD CA Pump Disch to S/G B ISOL Open CA-66A TD CA Pump Disch to S/G A ISOL Open CF-151 S/G A CA Nozz Tempering ISOL Open CF- 153 S/G B CA Nozz Tempering ISOL Open CF-155 S/G C CA Nozz Tempering ISOL Open .

! CF 157 S/G D CA Nozz Tempering ISOL Open SA-5 S/G C SM to TD CA Pump Stop Check Open SA-6 S/G B SM to TD CA Pump Stop Check Open SA-49AB S/G B SM to TD CA Pump ISOL Closed SA48ABC S/G C SM to TD CA Pump ISOL Closed SA-1 S/G C SM to TD CA Pump Locked Open SA 2 S/G B SM to TD CA Pump Locked Open CAPT Trip and Throttle Valve Open CA-8 Piping Upstream of Check Valve Cool CA-10 Piping Upstream of Check Valve Cool C A-12 Piping Upstream of Check Valve Cool CA-37 Piping Upstream of Check Valve Cool l

CA-41 Piping Upstream of Check Valve Cool CA-45 Piping Upstream of Check Valve Cool NUREG/CR-5830 3.10

.. - . -_-= ~ .- . . - - . . - - - . _ _ - _ _ _ _ - _ .

I 1

Inspection Guidance Table 3.1 Risk Importance AFW System Walkdown Table Actual Component # Component Name Required Location Position CA-49 Piping Upstream of Check Valve Cool l CA 53 Piping Upstream of Check Valve Cool CA-57 Piping Upstream of Check Valve Cool I i

CA-61 Piping Upstream of Check Valse Cool CA-65 Piping Upstream of Check Valve Cool 3.11 NUREG/CR-5830 l

4 Generic Risk Insights from PRAs PRAs for 13 PWRs were analyzed to identify risk- Loss of Main Feedwater important accident sequences involving loss of AFW, to identify and risk-prioritize the component failure modes

• A feedwater line break drains the common water involved. The results of this analysis are described in this source for MFW and AFW. The operators fail to section. They are consistent with results reported by provide feedwater from other sources, and fail to INEL and BNL (Gregg et al 1988, and Travis et al, initiate feed-and-bleed cooling, resulting in core 1988). damage.

• A loss of main feedwater trips the plant, and AFW 4.1 Risk Important Accident fails due to operator error and hardware failures.

The operators fail to initiate feed-and-bleed cooling, Se(Iuences Involving AFW System resulting in core damage.

Failure Steam Generator Tube Rupture (SGTR)

Loss of Power System a A SGTR is followed by failure of AFW. Coolant is

• A loss of offsite power is followed by failure of lost from the primary until the refueling water AFW. Due to lack of actuating power, the power storage tank (RWST) is depleted. High pressure operated relief valves (PORVs) cannot be opened injection (HPI) fails since recirculation cannot be preventing adequate feed-and-bleed cooling, and established from the empty sump, and core damage resulting in core damage. results.

• A station blackout fails all AC power except Vital AC from DC invertors, and all decay heat removal sys- 4.2 Risk Important Component tems except the turbine-driven AFW pump. AFW subsequently fails due to battery depletion or hard-Failure Modes ware failures, resulting in core damage.

The generic component failure modes identified from PR A analyses as important to AFW system failure are

• A DC bus fails, causing a trip and failure of the listed below in decreasing order of risk importance, power conversion system (PCS). One AFW motor, driven pump is failed by the bus loss, AFW is subse-

1. Turbine-Driven Pump Failure to Start or Run.

quently lost completely due to other failures. Feed- '

and-bleed cooling fails, resulting in core damage.

Transient-Caused Reactor or Turbine Trip

3. TDP or MDP Unavailable due to Test or Maintenance.

• A transient-caused trip is followed by a loss of the '

PCs and AFW. Feed-and-bleed cooling fails either

4. AFW system Valve Failures due to failure of the operator to initiate it, or due to hardware failures, resulting in core damage. i

• steam adm,ss,on i i valves l 4.1 NUREG/CR-5830

Generic Risk Insights

• trip and throttle valves In addition to individual hardware, circuit, or instrument failures, each of these failure modes may result from o flow control valves common causes and human errors. Common cause fail-ures of AFW pumps are particularly risk important

• pump discharge valves Valve failures are somewhat less important due to the multiplicity of steam generators and connection paths.

• pump suction valves iluman errors of greatest risk importance involve: failures to initiate or control system operation when required;

• valves in testing or maintenance. failure to restore proper system lineup a'ter maintenance or testing; failure to verify operability after maintenance

5. Supply / Suction Sources via post maintenance testing; and failure to switch to alter-nate sources when required.

• condensate storage tank stop valve

• hot well inventory a suction valves.

1 NUREG/CR-5830 4.2 l

5 Failure Modes Determined from Operating Experience This section describes the primary root cause of AFW 5.1.3 Turbine Driven Pump Failures system component failures, as determined from a review of operating histories at McGuire and at other PWRs Eight events have occurred since 1981 that have resulted throughout the nuclear industry. Section 5.1 describes in decreased operational readiness or spurious starting of experience at McGuire. Section 5.2 summarizes informa- the turbine driven pump. Failure modes involved failures tion compiled from a variety of NRC sources, including in instrumentation and control circuits, pump hardware AEOD analyses and reports, information notices, inspec- failures, corrosion, mechanical wear, and human failures tion and enforcement bulletins, and generic letters, and during maintenance activities. Improper or inadequate from a variety of INPO reports as well. Some Licensee maintenance has resulted in high outboard bearing tem-Event Reports and NPRDS event descriptions were also peratures requiring pump shutdown and repair. Check reviewed. Finally, information was included from reports valve leakage has also resulted in pump reverse rotation.

of NRC-sponsored studies of the effects of plant aging, which include quantitative analysis of AFW system failure 5.1.4 Flow Control and Isolation Valve reports. This information was used to identify the various Failures root causes expected for the broad PRA-based failure events identified in Section 4.0, resulting in the inspection Approximately a hundred events since 1981 have resulted guidelines presented in Section 3.0. n impaired operational readiness of the air and motor operated flow control valves, and motor operated isolation valves. Principal failure causes were equipment wear, 5.1 McGuire Experience corrosion, instrumentation and control circuit failures, valve hardware failures, and human errors. Valves have The AFW system at McGuire has experienced failures of failed to operate properly due to blown fuses, failure of the AFW pumps, pump flow control and discharge isola. control components (such as I/P convertors), broken or tion valves, turbine trip and throttle valves, and nuclear dirty contacts, misaligned or broken limit switches, sersice water backup supply valves, and numerous system control power loss, and operator calibration problems.

check valves. Failure modes include electrical, instru- Human errors have resulted in improper: control circuit mentation and control, hardware failures, and human calibration, limit switch adjustment, installation of seals errors. and meter reassembly.

5.1.1 Multiple Pump Failures 5.1.5 Check Valve Failures There has been one incident where difficulty in control of More than twenty events of check valve failure have the AFW system caused an abnormally fast cooldown occurred since 1981. The predominant failure mode cited rate. There were three other incidents where the shorting was normal wear and aging, however, abnormal stress re-of an electrical ! cad or removal of the wrong wire caused sulting from inadequate design application was cited as the multiple pump failures. cause for check valve failure in several instances.

5.1.2 Motor Driven Pump Failures 5.1.6 Iluman Errors There have been seven events since 1981 that have re- There have been approximately twenty events affecting suited in failure of individual motor driven pumps. the AFW system since 1985. Personnel have inadver-Failures were caused by control circuit problems, open tently actuated the AFW pumps during testing, initiated breakers, and incorrect procedures.

5.1 NUREG/CR-5830

t Failure Modes would not restart due to a protective feature requiring AFW pump suction swapover to nuclear service water, complete shutdown, and the turbine-driven pump tripped mispositioned control switches during operation, and pro-vided improper maintenance. Both personnel error and on overspeed, requirmg local reset of the trip and throttle valve. In cases where manual intervention is required dur-inadequate procedures have been involved. Misunder-standing of operability requirements has resulted in ing the early stages of a transient, training should empha-size that actions should be performed methodically and equipment exceeding Technical Specification limits.

deliberately to guard against such errors.

CC2. valve mispositioning has accounted for a signifi-5.2 Industry Wide Experience cant fraction of the human errors failing multiple trains of AFW. This includes closure of normally open suction -

iluman errors, design / engineering problems and errors, valves or steam supply valves, and of isolation valves to and component failures are the primary root causes of sensors having control functions. Incorrect handswitch AFW System failures identified in a review of industry positioning and inadequate temporary wiring changes have wide system operating history. Common cause failures, 1so prevented automatic starts of multiple pumps. Fac-which disable more than one train of this operationally tors identified in studies of mispositioning errors include redundant system, are highly risk significant, and can failure to add newly installed valves to valve checklists, result from all of these causes. weak administrative control of tagging, restoration, inde.

Pendent verification, and locked valve logging, and inade-This section identifies important common cause failure quate adherence to procedures. lllegible or confusing modes, and then provides a broader discussion of the I cal valve labeling, and insufficient training in the deter-single failure effects of human errors, design / engineering mination of valve position may cause or mask misposi-problems and errors, and component failures. Paragraphs ti ning, and surveillance which does not exercise com-presenting details of these failure modes are coded (ig., plete system functioning may not reveal mispositionings.

CCl) and cross-referenced by inspection items in Section 3. CC3. At ANO-2, both AFW pumps lost suction due to st m binding when they were lined up to both the CST 5.2.1 Common Cause Failures and the hot startup/ blowdown demmeralizer effluent

, At NM neam created h mnm The dominant cause of AFW system multiple-train fail- ng tk tuMnehen pump hadeaded b one minum ,

ures has been human error. Design / engineering errors c am n pump s a g e same m et and component failures have been less frequent, but ea a3

• as amage e n n Pump nevertheless significant, causes of multiple train failures. (Region 3 Morning Report,1/17/90). Both events were caused by procedural inadequacies, CCI. Iluman error in the form ofincorrect operator intetvention into automatic AFW system functioning CC4. Design / engineering errors have accounted for a during transients resulted in the temporary loss of all smaller, but significant fraction of common cause failures.

safety-grade AF% pumps during events at Davis Besse Problems with control circuit design modifications at (NUREG-il54,1985) and Trojan (AEOD/T416,1983). Farley defeated AFW pump auto-start on loss of main In the Davis Besse event, improper manual initiation of feedwater. At Zion-2, restart of both motor driven pumps the steam ana feedwater rupture control system (SFRCS) was blocked by circuit failure to deenergize when the led to overspeed tripping of both turbine-driven AFW pumps een ppe w an au maue start ugnal .

pumps, probably due to the introduction of condensate I" #" '

"" "' ' "W P into the AFW turbines from the long, unheated steam cu t es gn wsa em an n an nt haw Men supply lines. (The system had never been tested with the f ed designs where failures of a single component could abnormal, cross-connected steam supply lineup which re- have failed all or multiple pumps (IN 87-34,1987).

sulted.) In the Trojan event the operator incorrectly stopped both AFW pumps due to misinterpretation of MFW pump speed indication. The diesel driven pump NUREG/CR-5830 5.2

Failure Modes 1

CCS. Incorrect setpoints and control circuit settings re- Pipes had not been routinely treated to inhibit clam sulting from analysis errors and failures to update pro- growth, nor regularly monitored to detect their presence,  ;

cedures have also prevented pump start and caused pumps and no strainers were installed. The need for surveillance to trip spuriously. Errors of this type may remain unde. which exercises alternative system operational modes, as i tected despite surveillance testing, unless surveillance tests well as complete system functioning, is emphasized by model all types of system initiation and operating condi- this event. Spurious suction switchover has also occurred lions. A greater fraction of instrumentation and control at Callaway and at McGuire, although no failures circuit problems has been identified during actual system resulted.

operation (as opposed to surveillance testing) than for other types of failures. CCIO. Common cause failures have also been caused by l component failures (AEOD/C404,1984). At Surry-2, CC6. On two occasions at a foreign plant, failure of a both the turbine driven pump and one motor driven pump i balance-of-plant inverter caused failure of two AFW were declared inoperable due to steam binding caused by pumps. In addition to loss of the motor driven pump backleakage of hot water through multiple check valves, whose auxiliary start relay was powered by the invertor, At Robinson-2 both motor driven pumps were found to be the turbine driven pump tripped on overspeed because the hot, and both motor and steam driven pumps were found governor valve opened, allowing full steam flow to the to be inoperable at different times. Check valve leakage turbine. This illustrates the importance of assessing the at Robinson-2 passed through closed motor-operated isola-effects of failures of balance of plant equipment which tion valves in addition to multiple check valves. At supports the operation of critical components. The instru- Farley, both motor and turbine driven pump casings were ment air system is another example of such a system. found hot, although the pumps were not declared inopera-ble. In addition to multi-train failures, numerous inci-CC7. Multiple AFW pump trips have occurred at dents of single train failures have occurred, resulting in Millstone-3, Cook 1, Trojan and Zion-2 (IN 87-53,1987) the designation of " Steam Binding of Auxiliary Feedwater caused by brief, low pressure oscillations of suction Pumps" as Generic Issue 93. This generic issue was re-pressure during pump startup . These oscillations solved by Generic Letter 88-03 (Miraglia,1988), which occurred despite the availability of adequate static NPSil. required licensees to monitor AFW piping temperatures Corrective actions taken include: extending the time delay each shift, and to maintain procedures for recognizing associated with the low pressure trip, removing the trip, steam binding and for restoring system operability.

and replacing the trip with an alarm and operator action.

CCI1. Common cause failures have also failed motor CC8. Design errors discovered during AFW system re- operated valves. During the total loss of feedwater event analysis a' the Robinson plant (IN 89 30,1989) and at at Davis Besse, the normally-open AFW isolation valves Millstone-1 resulted in the supply header from the CST failed to open after they were inadvertently closed. The being tm small to provide adequate NPSil to the pumps if failure was due to improper setting of the torque switch more than one of the three pumps were operating at rated bypass switch, which prevents motor trip on the high flow conditions. This could lead to multiple pump failure torque required to unscat a closed valve. Previous prob-due to cavitation. Subsequent reviews at Robinson identi- lems with these valves had been addressed by increasing f4d a loss of feedwater transient in which inadequate the torque switch trip setpoint - a fix which failed during NPSl! and flows less than design values had occurred, but the event due to the higher torque required due to high which were not recognized at the time. Event analysis differential pressure across the valve. Similar common and equipment trending, as well as surveillance testing mode failures of MOVs have also occurred in other sys-which duplicates service conditions as much as is prac- tems, resulting in issuance of Generic Letter 89-10, tical, can help identify such design errors. " Safety Related Motor-Operated Valve Testing and Sur-veillance (Partlow,1989)." This generic letter requires CC9. Asiatic clams caused failure of two AFW flow con- licensees to develop and implemert ; program to provide j trol valves at Catawba-2 when low suction pressure for the testing, inspection and amnance of all safety-caused by starting of a motor-driven pump caused suction related MOVs to provide assurance that they will function

}-

source realignment to the Nuclear Service Water system. when subjected to design basis conditions.

5.3 NUREG/CR-5830

1 Failure Modes CCl2. Other compcment failures have also resulted in failures (AEOD/C602,1986). In many cases these over-AFW multi-train failures. These include out-of-adjustment speed trips have been caused by slow response of a electrical flow controllers resulting in improper discharge Woodward Model EG governor on startup, at plants valve operation, and a failure of oil cooler cooling water where full steam flow is allowed immediately. This over-supply valves to open due to silt accumulation. sensitivity has been removed by installing a startup steam bypass valve which opens first,. allowing a controlled tur-5.2.2 Iluman Errors bine acceleration and buildup of oil pressure to control the governor valve when full steam flow is admitted.

HEl. The overwhelmingly dominant cause of problems identified during a series of operational readiness evalu. DE2. Overspeed trips of Terry turbines have been caused ations of AFW systems was human performance. The ma. by condensate in the steam supply lines. Condensate jority of these human performance problems resulted from slows down the turbine, causing the governor valve to incomplete and incorrect procedures, particularly with open farther, and overspeed results before the governor respect to valve lineup information. A study of valve valve can respond, after the water slug clears. This was mispositioning events involving human error identified determined to be the cause of the loss-of-all-AFW event at failures in administrative control of tagging and logging, Davis Besse ( AEOD/602,1986), with condensation en-procedural compliance and completion of steps, verifica. hanced due to the long length of the cross-connected tion of support systems, and inadequate procedures as steam lines. Repeated tests following a cold-start trip may important. Another study found that valve mispositioning be successful due to system heat up.

j events occurred most often during maintenance, calibra-tion, or modification activities, Insufficient training in DE3. Turbine trip and throttle valve (TTV) problems are determining valve position, and in administrative require- a significant cause of turbine driven pump failures (IN ments for controlling valve positioning were important 84-66). In some cases lack of TTV position indication in causes, as was oral task assignment without task comple. the control room prevented recognition of a tripped TTV, tion feedback. In other cases it was possible to reset either the overspeed trip or the TTV without resetting the other, This problem ilE2, Turbine driven pump failures have been caused by is compounded by the fact that the position of the over-human errors in calibrating or adjusting governor speed speed trip linkage can be misleading, and the mechanism control, poor governor maintenance, incorrect adjustment may lack labels indicating when it is in the tripped posi-of governor valve and overspeed trip linkages, and errors tion (AEOD/C602,1986).

associated with the trip and throttle valve. TTV-associated errors include physically bumping it, failure to DE4. Startup of turbines with Woodward Model PG PL restore it to the correct position after testing, and failures governors within 30 minutes of shutdown has resulted in to verify control room indication of TTY position follow- overspeed trips when the speed setting knob was not exer-ing actuation. cised locally to drain oil from the speed setting cylinder.

Speed control is based on startup with an empty cylinder.

IIE3. Motor driven pumps have been failed by human Problems have involved turbine rotation due to both pro-errors in mispositioning handswitches, and by procedure cedure violations and leaking steam. Terry has marketed deficiencies, two types of dump valves for automatically draining the 4 oil after shutdown (AEOD/C602,1986).

5.2.3 Design / Engineering Problems and At Calvert Cliffs, a 1987 loss-of-offsite-power event re-Errors quired a quick, cold startup that resulted in turbine trip due to PG-PL governor stability problems. The short-del. As noted above, the majority of AFW subsystem tumc m acd n w s nu Had n sMa Ma failures, and the greatest relative system degradation, has springs (IN 88-09, 1988). Surveillance had always been been found to result from turbine-driven pump failures.

preceded by turbine warmup, which illustrates the impor-Overspeed trips of Terry turbines controlled by Wood-t nce f testing which duplicates service conditions as ward governors have been a significant source of these much as is practical.

NU REG /CR-5830 5.4

s Failure Modes i

i l

l DES Reduced viscosity of gear box oil heated by prior thermally protected, yet in a way which emphasizes operation caused failure of a motor driven pump to start system function oser protection of the operator, due to insufficient tube oil pressure. Lowermg the pres-sure switch setpoint solved the problem, which had not M. The common-cause steam binding elfccts of check been detected during testing. valve leakage were identified in Section 5.2.1, entry CC10. Numerous single-train events provide additional QM. Waterhammer at Palisades resuhed in AFW line insights into this problem. In some cases leakage of hot and hanger damage at both steam generators. The AFW MFW past multiple check valves in series has occurred spargers are h>cated at the normal steam generator lesel, because adequate valve-seating pressure was limit ed to the and are frequently covered and uncovered during level vah es closest to the steam generators ( AEOD/C404, fluctuations. Waterhammers in top-feed ring steam gen- 1984L At Robinson, the pump shutdown procedure was erators resulted in main feedline rupture at Maine Yankee changed to delay closing the MOVs until after the check and feedwater pipe crackmg at Indian Point-2 (IN 84-32, valves were seated. At Farley, check valves were 1984), changed from swing type to lift type. Check vahe rework has been done at a number of plants. Different valve DE7. Manually reversing the direction of motion of an designs and manufacturers are involved in this problem, operating valve has resulted in MOV failures where such and recurring leakage has been experienced, even after loading was not considered in the design (AEOD/C603, repair and replacement.

1986). Control circuit design may prevent this, requiring stroke completion before reversal. M. At Robinson, heating of motor operated valves by check valve leakage has caused thermal binding and DE8. At each of the units of the South Texas Project, failure of AFW discharge valves to open on demand. At space heaters provided by the vendor for use in prein- Davis Besse, high differential pressure across AFW injec-stallation storage of MOVs were found to be wired in tion s alves resulting from check valve leakage has pre-parallel to the Class IE 125 V DC motors for several sented MOV operation ( AEOD/C603,1986).

AFW valves (IR 50-489/89-11; 50-499/89-11, 1989). ,

The valves had been ea,tronmentahy qualified, but not CE Gross check valve leakage at McGuire and with the non-safety-related heaters energized. Robinson caused overpressurization of the AFW suction piping. At a foreign PWR it resulted in a severe water-5.2.4 Component Failures hammer event. At Palo Verde-2 the MFW suction piping was overpressurized by check valve leakage from the Generic Issue ll.E.6.1, "In Situ Testing Of Valves" was AFW system (AEOD/C404,1984). Gross check valve divided into four sub issues (Beckjord,1989), three of leakage through idle pumps represents a potential diver-which relate directly to prevention of AFW system com- sion of AFW pump flow.

ponent failure. At the request of the NRC, in-situ testing of check valves was addressed by the nuclear industry, re- CJF4 Roughly one third of AFW system failures have sulting in the EPRI report, " Application Guidelines for been due to valve operator failures, with about equal Check Valves in Nuclear Power Plants (Brooks,1988)." failures for MOVs and AOVs. Almost half of the MOV This extensive report provides information on check valve failures were due to motor or switch failures (Casada, applications, limitations, and inspection techniques, 1989). An extensive study of MOV events (AEOD/C603, in-situ testing of MOVs was addressed by Generic Letter 1986) indicates continuing inoperability problems caused 89-10, " Safety Related Motor-Operated Valve Testing and by: torque switch / limit switch settings, adjustments, or j

i Surveillance" (Partlow,1989) which requires licensees to failures; motor burnout; improper sizing or use of thermal develop and implement a program for testing, inspection overload devices; premature degradation related to inade-and maintenance of all safety-related MOVs. " Thermal quate use of protective devices; damage due to misuse Overload Protection for Electric Motors on Safety-Related (valve throttling, valve operator hammering); mechanical Motor-Operated Valves - Generic issue II.E.6.1 problems (loosened parts, improper assembly); or the (Rothberg,1988)" concludes that valve motors should be torque switch bypass circuit improperly installed or 5.5 NUREG/CR-5830 i

Failure Modes adjusted. The study concluded that current methods and the MOV torque switch, due to grease trapped in the procedures at many plants are not adequate to ensure that spring pack. During a surveillance at Trojan, failure of MOVs will operate when needed under credible accident the torque switch to trip the TTV motor resulted in tripp-conditions. Specifically, a surveillance test which the ing of the thermal overload device, leaving the turbine valve passed might result in undetected valve inoperability driven pump inoperable for 40 days until the next surveil-due to component failure (motor burnout, operator parts lance (AEOD/E702,1987). Problems result from grease failure, stem disc separation) or improper positioning of changes to EXXON NEllULA EP-0 grease, one of only protective devices (thermal overload, torque switch, limit two greases considered environmentally qualified by switch). Generic Letter 89-10 (Partlow,1989) has subse- Limiitorque. Due to lower viscosity, it slowly migrates quently required licensees to implement a program ensur- from the gear case into the spring pack Grease change-ing that MOV switch settings are maintained so that the over at Vermont Yankee affected 40 of the older MOVs valves will operate under design basis conditions for the of which 32 were safety related. Grease relief kits are '

life of the plant. needed for MOV operators manufactured before 1975. At Limerick, additional grease relief was required for MOVs M. Component problems have caused a significant manufactured since 1975. MOV refurbishment programs number of turbine driven pump trips (AEOD/C602, may yield other changemers to EP 0 grease.

1986). One group of events involved worn tappet nut faces, h>ose cable connections, loosened set screws, im. G9. For AFW systems using air operated valves, almost properly latched TTVs, and improper assembly. Another half of the system degradation has resulted from failures involved oil leaks due to component or seal failures, and of the valve controller circuit and its instrument inputs oil contamination due to poor maintenance activities. (Casada,1989). Failures occurred predominantly at a few Governor oil may not be shared with turbine lubrication units using automatic electronic controllers for the Dow oil, resulting in the need for separate oil changes. Elec- control valves, with the majority of fadures due to electri-trical component failures included transistor or resistor cal hardware. At Turkey Point-3, controller malfunction failures due to moisture intrusion, erroneous grounds and resulted from water in the Instrument Air system due to connections, diode failures, and a faulty circuit card. maintenance inoperability of the air dryers.

l C 6. Electrohydraulic-operated discharge valves have CF10. For systems using diesel driven pumps, most of performed very poorly, and three of the five units using the failures were due to start control and governor speed them have removed them due to recurrent failures. Fail- control circuitry. IIalf of these occurred on demand, as ures included oil leaks, contaminated oil, and hydraulic opposed to during testing (Casada,1989).

pump failures.

2 For systems using AOVs, operability requires the M. Control circuit failures were the dominant source of . . ability of Instrument Air, backup air, or backun motor driven AFW pump failures (Casada,1989). This nitrogen. Ilowever, NRC Maintenuee Team inspections includes the controls used for automatic and manual start. have identified inadequate testing ot check valves isolating ing of the pumps, as opposed to the instrumentation in- the safety related portion of the l A :yatem at several utili-puts. Most of the remaining problems were due to circuit ties (Letter, Roe to Richardson) Generic Letter 88-14 breaker failures. (Miraglia,1988), requires licensees to verify oy test that air-operated safety related components will perform as M. "ilydraulic lockup" of Limitorque SMH spring expected in accordance with all design-basis events, packs has prevented proper spring compression to actuate including a loss of normal I A.

NUREG/CR-5830 5.6

6 References Beckjord, E. S. June 30,1989. Closeout of Generic AEOD Reports issue IL E.6.1, "In Situ Testing of Valves" Letter to V. Stello, Jr., U.S. Nuclear Regulatory Commission, AEOD/C404. W. D. Lanning. July 1984. Steam Washington, DC. Binding of Antiliary Feedwater Pumps. U.S. Nuclear Regulatory Commission, Washington, DC.

Brooks, B. P.1988. Application Guidelinesfor Check Valves in Nuclear Power Plants. NP-5479, Electric AEOD/C602. C. lisu. August 1986. Operational Power Research Institute, Palo Alto, CA. Etperience involving Turbine Overspeed Trips. U.S.

Nuclear Regulatory Commission, Washington, DC.

Casada, D. A. 1989. Antiliary Feedwater System Aging l Study. Volume 1. Operating Etperience and Current AEODIC603. E. J. Brown. December 1986. A Review Afonitoring Practices. NUREGICR-5404. U.S. Nuclear of Afotor-Operated Valve Performance. U.S. Nuclear Regulatory Commission, Washington, DC. Regulatory Commission, Washington, DC.

Gregg, R. E. and R. E. Wright.1988. Appendi.t Review AEOD/E702. E. J. Brown. March 19,1987. Af0VFail-for Dominant Generic Contributors. BLB-31-88. Idaho ure Due to Hydraulic Inckup From Etcessive Grease in l National Engineering Laboratory, Idaho Falls, Idaho. Spring Pack. U.S. Nuclear Regulatory Comrnission, Washington, DC.

Miraglia, F. J. February 17, 1988. Resolution of Generic Safety issue 93, " Steam Binding of Auriliary AEODIT416. January 22,1983. Loss of ESF Antiliary Feedwater Pumps" (Generic Letter 83-03). U.S. Nuclear Feedwater Pump Capability at Trojan on January 22, Regulatory Commission, Washington, DC. 1983. U S. Nuclear Regulatory Commission, Washington, DC.

Miraglia, F. J. August 8,1988. Instrument Air Supply System Problems Affecting Safety-Related Equipment Information Notices (Generic Letter 8814). U.S. Nuclear Regulatory Commission, Washington, DC. IN 82-01. January 22,1982. Antillary Fredwater Pump Lockout Resultingfrom Westinghouse W-2 Switch Circuit Partlow, J. G. June 28,1989. Safety-Related Afotor- Afodification. U.S. Nuclear Regulatory Commission, Operated Valve Testing and Surveillance (Generic Letter Washington, DC.

89-10). U.S. Nuclear Regulatory Commission, Washington, DC. IN 84-32. E L. Jordan. April 18,1984. Antillary Feedwater Sparger and Pipe Hangar Damage. U.S.

Rothberg, O. June 1988. 7hermal Overload Protection Nuclear Regulatory Commission, Washington, DC.

for Electric hiotors on Safety-Related Afotor-Operated Valves - Generic issue ll.E.6.1. NUREG-1296. U.S. IN 84~66. August 17,1984 Undetected Unavailability of Nuclear Regulatory Commission, Washington, DC. the Turbine-Driven Aarillary Feedwater Train. U.S.

l Nuclear Regulatory Commission, Washington, DC.

Travis, R. and J. Taylor.1989. Development of Guidancefor Generic, Functionally Oriented PRA-Based IN 87-34. C. E. Russi July 24,1987. Single Failures in Team inspections for BWR Plants-Identification of Risk- Auriliary Feedwater Systems. U.S. Nuclear Regulatory Important Systems, Components and Human Actions. Commission, Washington, DC.

TLR-A-3874-TGA Brookhaven National Laboratory, Upton, New York.

6.1 NUREG/CR-5830

. . -~- . .. - . _ . _ . __ . _ _ _ _ _ - _ _ _ _ _ _ - _ .

References IN 87-53. C. E. Rossi. October 20,1987. Aasiliary inspection Report Feedwater Pump Trips Resultingfrom fxw Suction Pres-sure. U.S. Nuclear Regulatory Commission, Washington, IR 50-489/89-11; 50-499/89-11. May 26,1989. South DC. Texas Project inspection Report. U.S. Nuclear Regu-latory Commission, Washington, DC.

IN 88-09. C. E. Rossi. March 18,1988. Reduced Reliability ofSteam-Driven Antiliary Feedwater Pumps NUREG Report Caused by Instability of Woodward PG-PL Type Governors. U.S. Nuclear Regulatory Commission, N UREG-1154. 1985. Loss of Main and Antillary Washington, DC. Feedwater Event at the Davis Besse Plant on June 9, 1985. U.S. Nuclear Regulatory Commission, IN 89-30. R. A. Azua. August 16, 1989. Robinson Unit Washington, DC.

2 Inadequate NPSH of Auriliary Feedwater Pumps. Also, Event Notification 16375, August 22,1989. U.S.

Nuclear Regulatory Commission, Washington, DC.

NUREG/CR-5830 (3.2

-. . . _ - . _ - . . - _ _ _ . - ~ , . - - -

1 PN L-7784 Distribution No.of No.of Copies Copies OFFSITE R. Travis Brookhaven National laboratory U.S. Nuclear Regulatory Commission Bldg.130 Upton, NY 11973 B. K. Grimes OWFN 9 A2 J. Bickel EG&G Idaho, Inc.

F. Congel P.O. Box 1625 OWFN 10 E4 Idaho Falls. ID 83415 G hl. Holahan Dr. D. R. Edwards OWFN 8 E2 Professor of Nuclear Engineering University of Missouri - Rolla A. C. Thadani Rolla, MO 65401 OWFN 8 E2 ONSITE W. T. Russell OWFN 12 G18 18 facific Northwest laboratory K. Campe J. D. Bumgardner OWFN I A2 L. R. Dodd B. F. Gore (5)  ;

10 J. Chung R. C. Lloyd l OWFN 10 A2 N. E. Moffitt B. D. Shipp 2 B. Thomas F. A. Simonen  !

OWFN 12 H26 T.V.Vo Publishing Coordination U.S. Nuclear Regulatory Commission - Technical Report File (5)

Region 2 S. D. Ebneter A. F. Gibson K. D. I2ndis L. A. Reyes 4 McGuire Resident inspector Office J. IL Taylor Brookhaven Nr.tional laboratory Bldg.130 Upton, NY 11973 i

(

Distr.1 NUREG/CR-5830 il

NRC poau 335 US. hucLE AR R EGUL ATOR Y COMMISSION 1. REPORT NUMBER fa'c*l nca.

noum BIBLIOGRAPHIC D ATA SHEET

' D E"."WiYM~ **'

<smmuveram on una ,,_, NUREGlCR-5830

2. TsTLE ANo SuenTLE PNL-7784 Auxiliary Feedwater System Risk-Based Inspection Guide for the 3.

McGuire Nuclear Power Plant DATE REroRT rustiSNEo oo i,, ,..a g

May 1994

4. FIN oR GR ANT HUM 8 E R i L1310 '

53AUTHOR (S) 6. TYPE of REPORT  !

J.D. Bumgardner, R.C. Lloyd, N.E. Moffitt, B.F. Gore, T.V. Vo Technical l

7. PE RioO COVE R ED idaem 04ee.s 9/92 to 4/94 l

g. PE.R Fo.RMING.o.RGA,NIZATioN

- - NAM E AND ADOR ESS ist mac p, se o% o<r=,., me, ea. u.1 dwed..r m.,wwe.<y c a. e a n y.eee, # .re.<.m Pacific Northwest Laboratory Richland, WA 99352

9. SPONSORING ORGANIZATION - f4AME AND ADORESS t/f mac. evee s ;de s er.ever., w.Nac o m. one er an u.1 mas , m.,ve avy co-e.deie4** e**nl Division of Systems Safety and Analysis  !

Office of Nuclear Reactor Regulation '

U.S. Nuclear Regulatory Commission Washington, D.C. 20555

10. SUPPLEMENTARY NOTES

11. ABSTRACT (200 =*wr er desti In a study sponsored by the U.S. Nuclear Regulatory Commission (NRC). Pacific Northwest 1.aboratory has develo, ped and applied a methodology for deriving plant-specific risk-based inspection guidance for the auxiliary feedwater (AFW) system at pressurized water reactors that have not undergone probabilistic risk assessment (PRA). This methodology uses existing PRA results and plant operating experience informatien.

Existing PRA-based inspection guidance information recently developed for the NRC for various plants was used to identify generic component failure modes. This information was then combined with plant-specific and industry-wide conponent information and failure data to identify failure modes and failure mechanisms for the AFW system at the selected plants. McGuire was selected as one of a series of plants for study. The product of this effort is a prioritized listing of AFW failures which have occurred at the plant and at other PWRs. This listing is intended for use by NRC inspectors in the preparation of inspection plans addressing AW risk-important componehts at the McGuire plant.

12. KE Y WoRDS/DESCH:PioRS tus# =erve er parones eri e e.est esser meeva da '.c.ev eae rween.J 13. AVA4LAsiLs t v 41 AT EutNI Unlimited I Inspection, Risk, PRA, McGuire, Auxiliary Feedwater (AFW) ... secuni r v cLAme sca noa ir r >

Unclassified a ra. J. n>

Unclassified

16. NUMBER OF PAGES

16. PRICE I

wac coau us a asi

1 Printed on recycled paper Federal Recycling Program

NUREGICR-5830 AUXILIARY FEEDWATER SYSTEM RISK BASED INSPECTION GUIDE MAY 1994 FOR TIIE MCGUIRE NUCLEAR POWER PLANT UNITED STATES 7, FIRST CLASS MAIL 5

NUCLEAR REGULATORY COMMISSION (;[ p31 953I y y3 y e g, POSTAGE AND FEES PAID WASHINGTON. D.C. 20555-0001 ~IV F3I5 g USNRC TP S- pg o _~.q go r y> B L IC A T I O N S SVCS "~

?VFN_gg7 -

OFFICIAL BUSINESS ' ION PENALTY FOR PRIVATE USE, $300 gg , gc

-J