ML20126M186

High Pressure Coolant Injection System RISK-BASED Inspection Guide for Hope Creek

ML20126M186
Person / Time
Site:	Hope Creek
Issue date:	12/31/1992
From:	Shier W, Villaran M BROOKHAVEN NATIONAL LABORATORY
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-A-3875 BNL-NUREG-52338, NUREG-CR-5923, NUDOCS 9301080225
Download: ML20126M186 (57)

Text

.

NUREG/CR-5923 BNL-NUREG-52338 High Pressure Coolant ,

Injection System Ris:(-Based l Inspection Guice for Hope Cree:(

Prepared by ,

- M. Villaran. W. Shier -

! 3.vokhaven National Laboratory L

Prepared for U.S. Nuclear Regulatory Commission i

i L

L If r

l l.

l ..

9301080225 921231 PDR ADOCK 05000354

, l. G PDR l

. - . . . . . . . . , . - - - . . . - . . . . - , , , - - . . - , . _ , . . . . . . . . - . . - . . - - - . - - ~ . -

a AVAILABlWTY NOTICE AvaAabdity of Reference Materials Cited in NRC Pubhcations

~

Most documents cit 6d in NRC publications will be available from one of the'following sources:

1. The NRC Public Document Room. 2120 L Street, NW,, Lower Level, Washington, DC 20555 2, The Superintendent of Documents, U.S. Governrnent Printing Office, P.0, Box 37082, Washington.

DC 20013-7082 3, The National Technicallnformation Service, Springfield, VA 2216t Although the listing that follows represents the ma}ority of documents cited in NRC publications, it is not intended to be exhaustive, Referenced documents availabis for inspeetlan and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda: NRC bulletins, circulars, information notices, Inspection and Investigation notices; licensee event r6 ports; vendor reports and correspondence; Commis-sion papers; and applicant and licenses documents and correspondence, The following documents in the NUREG series are available for purchase from the GPO Saies Program; formal NRC staff and contractor reports, NRC-sponsored conference proceedings, international agreement .

reports, grant publications, and NRC booklets and brochures, Also avaltable are regulatory guides, NRC regulations in the Code of Federe! Regulations, snd Nuclear Regulatory Cornmission Issuances.

Documents available from the National Technical Information Service include NUREG-series reports and technical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commis-ston, forerunner agency to the Nuclear Regulatory Commission.

Documents avaHable from public and special technical libraries include all open literature items, such as books, journal articles, and transactions, f ederat Register notices, Federal and State legl lation, and con-grossional reports can usua3y be obtained from these libraries, Documents such as theses, dissertatlons, foreign reports and translations, and non-NRC conference pro +

ceedsgs are available for purchase from the orgarJ2ation sponsoring the publication cited.

SirJe copios of NRC draft reports are ava!!able free,. to the extent of supply, upon written request to the Office of Administration. Distribution and Mad Services Section, U.S. Nuclear Regulatory-Commission, Washington, DC 20555, Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Ubrary 7920 Norfolk Avenue, Bethesda, Maryland, for use by the public, Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards institute,.1430 Broadway, New York, NY 10018.

DISCLAIMER NOTICE 1

This report was prepared as an account of work spoasored by an agency of the United States Govemment.

Neither the United States Govemment nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use .

by such third party would not infringe privately owned rights.

4

{

,--.~,_n._-n, ...._..-n,,-,.,n.n,._,, _ _ c _ _ - _ ,_ ._ ,,,,,- _ -_. , _ . , - , , _ , , - . _nn , -, e

=.-

NUREG/CR-5923' BNL--NUREG--523381 High Pressure Coolant Injection System Risk-Based Inspection Guide for Hope Creek i

h .Ydlara , W. Shier Brookhaven National Laboratory

. Prepared for

- U.S. Nuclear Regulatory Commission

'i 4

i

~

88 9888R 38A88 6 G PDR O .

-y. -

mm:-

nn ;2;;

my~ - - -

y v; ,

.- s ,

h - S h 14 _

mg_ ,

.g.

M 1t 7

T AVAILABILITY NOTICE .

Q AvaHabaty of Reference Materials Cnod in NRC Publications ~

Most documents cited in NRC publications wDl be avaRable from one of the following sources:

1, The NRC Public Document Room,2120 L Street; NW.! Lower Levety Washington; DC 20555 ;

2. The Superintendent of Documents U.S. Government Printing Office, P.O. Dox 37082 Washington, t; ,

00 20013-7082

3. The National Technicalinformation Service; Springf) eld, VA 22161

. Although the Esting that fonows represents the majority of documents cited h NRC publications, it is noti intended to be exhaustive.

Raf arenced documents avaBable for inspection and copying for a fee from the NRC Public Document Room ' i l include NRC correspondence and intomal NRC memoranda; NRC t ulletins, circulars, informatIon notices.-

Inspection and invest lDation noticesi Briensee event reports; vendor reports and correspondence; Commise -

-slon papers: ard applicant and Econsee documents and correspondence,' Ju The 'fonowing docurnents in the NUREG series are avatable for purchase from the GPO Sales Progrand formal NRC staff and contractor reportsi NRC-sponsored conference proceedings, International agreement -

reports, grant publicatkane, and NRC booklets and brochures - Also avaNable are regulatory guides. NRC /

regulatione in the Code of Federal Regulations, and Nuclear Regulatory Commission issuances, Documents available from the National Technical information Service hclude NUREG-series reports and ; e techn! cal reports piepared by other Federal agencies and reports prepared by the Atomic Energy Commis H sion, forerunner agency to the Nuclear Regulatory Commission, A ~

- Documents avaHable from public and special technical Ebrarlos include a0 open lierature items, ~such as :

books, journal articles, and transactions,; Federal Register notices Federal and State legislation, and con-.-

grossional reports con usually be. obtained from these Rbraries. -

1 d;

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proy- ,

ceedings are avaliable for purchase from the organization sponsoring the pubucation cited /. O Single copies of NRC draft reports are avatable treac to the extent.)f supplycupon written request to tho ?

-Office of Administration, Distribution.and Mall Services Section, U.SJ Nuclear Regulatory Commissionc *

,d

' Washington, DC 20555.

Ccples of hdustry codes and standards used in a substantive manner in the NRC regulatory process are D

' maintained at the NRC Library 7g20 Norfolk Avenue, Bethesdai Maryland, for use by the pubuci Codes and standards are usually copyrighted and may be purchased fram the originating organization or, if they are -

American National Standards, from the American National Standards institute,1430 Broadway, New York, NY : 10018, e

g 4 - DISCLAIMER NOTICE s

,This report was prepared as an e xount of work sponsored by an agency of the Unitod States Govemment.1

Nelthor the United States Govemment nor any agency thereof, or any of their employees, makes any warranty',' - ,

expressed or impiled, or assumes any legal ilability of responsibility for any third party's use, or the resutts of { R

- such use, of any information, apparatus, p*0 duct or process disclosed in this report, or repreeants that its use by sVCh third party would not infringe privately owned rights k

~

h.b_3

NUREG/CR-5923 BNL-NUREG-52338 Higa Pressure Coo ant Injection System Risi-Based Inspection Guice for Hoae Creer Manuscript Completed: October 1992 Date Published: December 1992 Prepared by M. Villaran, W. Shier Prepared by J. W. Chung, NRC Program Manager Brmkhaven National Laboratory Upton, NY 11973 Prepared for Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555 NRC FIN A3875

_ _ -. _ . . . - . _ - .... . __ _._ . . . _ - . - _ . _ _ . _ . _ . . . . . _ _ _ . ~ . . _ . . ~ . _ _ - . ..

.i AllSTRACT The liigh Pressure Coolant injection (llPCI) system has been examined from a risk perspective. A System Risk-Based Inspection Guide (S RIG) has been developed as an-ald to llPCI system inspections at ilope Creek. Included in this S RIG is a discussion of the role of -

i HPCI in mitigating accidents and a presentation of a PRA based failure modes which could '

prevent proper operation of the system.

The S RIG uses industry operating experience. including plant specific illustrative examples to augment the basic PRA failure modes. It is designed to be used as a reference for both routine inspections and the evaluation of the significance of component failures. ,

?

4 5

h

.c e ---e tw eevre.,--...a.,--1 .-a-,,,-w2-.-e,e- . www w e , y,<. -, car , - ., --,,.= %-e e y a y. , e--, e..ars e-a-v er we's y ef=' -g-y r wr- i e mwie c ev-w i-w v v v -r viv r -'v- e v vie *v'" w' w = -- - &' v r* 9 **t-e*'Y- 's T

CONTENTS Page ABSTRACT . . . . . . . . . . . .. . . ........ . ...... .. iii

SUMMARY

. . . . . .. .. ...... . .... . ...... ... ix ACKNOWLEDGEMENT. , . .... . .... ............... . xi 1 INTRODUCrlON . .... . . .... ..... ....... . ...... 11 1.1 Purpose.. .. . ... .. . .. . . . . . . 11 L2 Application to inspections .. . ............... ... . 1-1 2 HPCI SYSTEM DESCRIPTION . , . . . . ... .. . . . .. 2-1 3 ACCIDENT SEQUENCE DISCUSSION ...... ........ . . 31 3.1 Loss of High Pressure injection and Failure to Depressurize . . . . 3-1 3.2 Station Blackout (SBO) With Intermediate Term Failure of High Pressure Injection . . . . . 31 3.3 Station Blackout with Short Term Failure of High Pressure Injection . . . . 3-2 3.4 ATWS With Failure of RPV Water Level Control r High Pressure . . ... ... . . ..... 32 3.5 Unisolated LOCA Outside Containment . . .. . ... . 3-3 3.6 Overall Assessment of IIPCI Importance in the Prevention of Core Damage .. . .. ... 3-3 4 PRA-DASED HPCI FAILURE MODES . . .. . . 41

5. HPCI SYSTEM WALKDOWN CHECKLIST BY RISK IMPORTANCE . 5-1 _

6 OPERATING EXPERIENCE REVIEW . . . . , . ... . . 6-1 6.1 HPCI System Failure Modes . .. .. ..... . ... 6-1 6.2 HPCI Failure No. 2-System Unavailable Due to Test or Maintenance Activities . . . . . ...... . . ..

6,7 6.3 HPCI Failure No. 3-False High Steam Line Differential Pressure Isolation Signal ........ , . . 6-8 6.4 HPCI Failure No. 4-Turbine Steam Inlet Valve Fails to Open . . 68 6.5 HPCI Failure No. 5-Pump Discharge Valve Fails to Open . . 6-8 6.6 HPCI Fai!ure No. 6-HPCI Systems Interaction . . . . . . . . . . 6-9 6.7 HPCI Failure No. 7-System Actuation Imgic Fails . . 6-9 6.8 HPCI Failure No. 8-False Area Temperature isolation Signal 6-10 6.9 HPCI Failure No. 9. False Low Suction Pressure Trips . . . 6-10 6.10 HPCI Failure No.10-False High Turbine Exhaust Pressure Signal . . 6-11 6.11 HPCI Failure No. Il-Normally Open Turbine Exhaust Valve Fails Closed 6-11 6.12 HPCI Failure No.12-Condensate Storage Tank / Suppression Pool Switchover Logic Fails . . .. .. .. . . 6-11 6.13 HPCI Failure No.13-Suppression Pool Suction Line Valve Fails to Open 6-11 v

CONTENTS (Cont'd)-

6.14 IIPCI Failure No.14. Minimum Flow Valve Fails to Open . . . . . . . . 5 12 6.15 Contribution of Iluman Error to System Unavailability . . . . . . . . . . 6 12 6.16 Support Systems Required for IIPCI Operation . . . . . . . . . . . . . . . 6-1_3 6.17 Simultaneous Unavailability of Multiple Systems , . . . . . . . . ..... 14 6.18 LOCA Outside Containment ........... ............ .... 15

7.

SUMMARY

. .. ..... .. . . ......... ............. ., 7-1 8 REFERENCES. . . . . . . . . . . . .......... ..................... -_8-1 -

APPENDICES _

A-1 Summary ofIndustry Survey ofliPCI Operating Experience liPCI Pump or Turbine Fails t'o Start or Run . . . . . .............. A-1 A-2 Selected Examples of AdditionalllPCI Failure Modes identified During Industry Survey . . ..... .......... . ... A-9 vi

- . . . - . . , _ . . - . , . .. ..,g.. ~ . - _ ,

i j g --

FIGURES

.2a - I IPCI Wa t e r Syst e m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

32 2b I IPCI Ste a m Sys t e m _ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

23.

4 TAllLES 41 HPCI PRA-based Failure Summary . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . 4-2 4-2 Hope Creek 2 HPCI System RIO Summary . . . , . . . . . . . . . . . . . . . . . . . 4'3. l 5 Hope Creek Unit 2 HPCI System Checklist . . ........,........... - 5 2- )

l 6-1 <

6-1 HPCI Failure Summary . . . , . . . . . . . . . . ........ ...... ....

6-2 HPCI Pump Turbine Fails to Start or Run HPCI Failure No.1 Subcategories . . . . . . .... ...... .... ...... 63 A 1 HPCI Pump or Turbine Fails to Start . .

Industry Survey Results . . . . . . . . . ..... . ................. A-2

- A Summary of Illustrative Examples of Additional-

............ ................... A-10 HPCI Failure Modes. . . . . .

1.

5 s-vii 1

l

'I

. , . ~ . . . _ . . . . . . a . ._~.;_ . . . . . . _.-.-..._...._.--,..._-,..,,_,;... . . . . ; . ,_ a _., ,.. . , , m. .,, . ; . . . ,Ql

SUh1 MARY

' His System Risk Based Inspection Guide has been developed as an aid to llPCI system inspections at 11 ope Creek. The document presents a risk based discussion of the role of HPCI in <

accident mitigation and provides PRA-based HPCI failure modes (Sections 3 and 4). . hiost PRA.

oriented inspection plans end here and require the inspector to rely on his experience and knowledge of plant specific and BWR operating history, However, the system RIG uses industry operating experience, including illustrative examples, to augment the basic PRA failure modes. The risk-based input and the operating experience have '

been combined in Tan'e 4-2 to develop a composite BWR 11PCI failure ranking. His information can be used to optimize NRC resources by allocating proactive inspection effort based on risk and industry experience, in conjunction, the more important or unusual component faults are rellected

j. - in the walkdown checklist in Section 5. This, along with an assessment of the operating experience found in Section 6, provides potential areas of NRC oversight both for routine inspections and the

" post mortems" conducted after significant failures.

A comparison of Ilope Creek and the industry-wide BWR, HPCI failure distributions is presented in Table 4 2. Although the plant specific data are limited, certain Hope Creek components appear to exhibit a somewhat higher than expected contribution to total HPCI failures.

However,it should be noted that a large number of components have shown failures less than the overallindustty experience. These components are candidates for greater inspection activity and the generic prioritization should be adjusted accordingly, This generic ranking of HPCI failures has not been revised to reflect the presently available Hope Creek LER data, because the plant specific distribution of HPCI failures is expected to change with time.

As the plant matures, operational experience is assimilated by the utility's staff and reflected in the plant procedures. For example, the incidence of inadvertent _ HPCI isolations due to'-

surveillance and calibration activities is expected to decrease. Conversely, in time, aging related faults are expected to become a contributor to the Hope Creek HPCI failure distribution. De operating experience section, identifies several aging related failures which occurred at Duane-

. Arnold, Hatch, Cooper and Brunswick, generally in the pump and turbine electronics.

This report includes all HPCI LERs up to mid-1989. -Subsequent LERs can be correlated with the PRA failure categories, used to update the plant specific HPCI failure contribution, and compared with the more static HPCI BWR failure distributi_on. The industry operating experience

is developed from a variety of BWR plants and is expected to exhibit less fluctuation with time

-than -a single plant.' This information can be trended to predict where additional inspection oversight is warranted as the plant matures.

- Recommendations are made throughout this document regarding the inspection activities for the HPCI System at Hope Creek. Some are of a generic nature, but some relate to specific maintenance, testing or operational activities at Hope Creek.

ix

1. : The plant actions to monitor and control the temperature in the HPCI toom should be --

reviewed / and the effect of the loss of room cooling on continued OPAD ZZ 135 IIPCI operation should be evaluated.

= 2. - Within the context of the use of HPCI in an ATWS event, the use of IIPCI to restore pressure vessel water level should be evaluated periodically.

3. The turbine exhaust rupture disks have been installed with a structural backing to prevent-cyclic fatigue failures.

4. The inspector should confirm that the licensee acknowledges the complexity of the turbine speed control by having a trained staff to test and repair it.

5. - Licensee response to NRC Bulletin 88-04 should be reviewed to determine if the design of the -

minimum flow bypass line is adequate.

x

. ACKNOWLEDGEMENT The authors wish to express their appreciation to the NRC Program Manager for this project. .

Dr. J.W. Chung, for his technical direction, and to the NRC Project Manager for llope Creek,.

- Allison Keller for her assistance and guidance during the site visit.

- We express our gratitude to members of the technical staff at the llope Creek site for their detailed review and constructive comments that contributed to the overall quality of this document.

In particular, the comments of Anthony Tramomtana and Bruce llall were especially helpful.

Finally, we wish to thank Ann Fort for her patience and help in the preparation of this manuscript.

1 xi t

. , . , . _ . , , . . . . , _ , _ , . . . . ....__,_,,_.,_._,..m_,.___,,,_,--,.,_.__,. ..,__,___,m..__,,~,,,__,. ,,,.m ,,,_,,....,.,_....._,,..m.,

l I

1. INTRODUCTION 1.1 Purrose This llPCI System Risk Based inspection Guide (S RIG) has been developed as an aid to NRC inspection activities at llope Creek. The liigh Pressure Coolant injection (llPCI) system has been examined from a risk perspective. Assumed BWR accident sequences that involve llPCI are vescribed in Section 3 both to review the system's accident mitigation function and to identify system unavailability combinations that can greatly increase risk exposure. Section 4 describes ar.d prioritizes the PRA-based IIPCI failure modes for inspection purposes. He results of a BWR operating experience review are presented in Section 6 to illustrate these failure modes.- Section 6 also provides additional information in related areas such as llPCI support systems, human errors, and system interactions. A list of risk significant components is contained in Section 5. and references are provided in Section 8.

1.2 /.\.yptication to inspections This inspection guide can be used as a reference for both routine inspections and for identifying the significance of component failures. The information presented can be used to prioritize day-to-day inspection activitics, and the illustrative IIPCI failures can suggest multiple inspection perspectives. The S-RIG is also useful for NRC inspection activities in response to system failures. The accident sequence descriptions of Section 2 in e , junction with, the discussion of multiple system unavailability (Section 6), provide some insight into combinations of system outages that can greatly increase risk. The discussion of the operating experience review provides information on the various failure mechanisms, and the corrective actions taken. This could be useful to the inspector when reviewing a licensee's response to a llPCI system failure. The system RIG can also be used for trending purposes. Table 4-2 provides a summary of the llPCI operating experience,in particular the industry wide distribution ofliPCI failure contributions. Those failure modes wMeh account for a larger fraction of the IIPCI system failures are candidates for increased inspection activity. Since the plant specific failure distribution is expected to vary over time, a mechanism to update and trend the llope Creek HPCI experience, in comparison to the more static industry experience, is discussed.

1-1

i

2. IIPCI SYSTEM DESCitIPTION The llope Creek liigh Pressure Coolant injection (IIPCI) system is a single train system consisting of turbine-driven injection and booster pumps, piping, valves, controls, and instrumentation. A simpli6ed now diagram is shown in Figure 2-1. The system is designed to pmr.i) a minimum of 5600 gpm into the reactor ves.el over a range of reactor pressures from 200 to 1135 psig when automatically activated by low reactor water level (-38 inches) or high drywell pressure (1.68 psig), or when manually initiated. Two sources of makeup water are available.

Initially, the llPCI pump takes suction from the condensate storage tank (CST) through normally open motor-operated valve, F004. The pump suction automatically transfers to the suppression pool on low CST level or high suppression pool level. This transfer is accomplished by a signal that opens the suppression pool suction valve, F042. Once this valve is fully open, valve position-limit switch contacts automatically close the CST suction valve.

Upon llPCI initiation, the normally closed injection valves, F006 and ilV8278, automatically opens, allowing makeup water to be pumped into the reactor vessel through the "A" feedwater header (2600gpm) and the "A" core spray header (30(X) gpm). A minimum-Oow bypass is provided for pump protection. When the bypass is open, Dow is directed to the suppression pool. A full-flow test line is also provided to recirculate water back to the CST. The two isolation valves are equipped with interkes to automatically close the test line (if open) upon generation of an llPCI initiation signal.

He llPCI turbine is driven by reactor steam. The inboard and outboard IIPCI isolation valves, F002 and F003, the steam line to the llPCI turbine are normally open to keep the piping to the turbine at an elevated temperature, thus permitting rapid startup. Upon receiving a signal from the llPCI isolation logie, these valves, will close and cannot be reopened until the isolation signal is cleared and the logic is reset. Isolation valve f 002 is powered from 480V AC power, Channel C, and controlled by isolation logic Division 3. F003 is powered from 480V AC power Channel A, and controlled by isolation logie Division 3.

Steam is admitted to the llPCI turbine through valve F001, turbine stop valve, and turbine -

control valve. These valves are normally closed and are opened by an llPCI initiation signal.

Exhaust steam from the turbine is discharged to the suppression pool, while condensed steam from the steam hues and leakage from the turbine gland seals are routed to a barometric condenser, which drains to the radwaste system when llPCI is in standby and back to the booster pump when IIPCI is operational.

The llPCI system is automatically actuated on low reactor water level (level 2) or high drywell pressure. If automatic actuation fails, the system can be manually initiated from the control room.

2-1

Full Flow

@X F004 *,"!.'"8t" Combined HPCI RCIC /TeGne Return To Minimum Flow Line CST 1:01. Valve ]@7y,

$V006 V026 V025 V014 V023 V013 -4 From RCtC X X N IN AP Jockey oaa. \ V003 HV l'* "" I'.**

hPump n

,, $8278 &

] '

V024 PCI I I I 1 b G' ""* *

'"U"v$e' ump V003 @ 3600 N

Booster 10O --O...

/

w. na nem uae W HV Pump F059 IU PSV PSV T $ F006 &

@_ gYI

'! c , W.*.'E.*f ,i SealCond I_

c.S.m2:'

• A* Core Spray a """ ""

LO. HPCI HV v Cooler HPCI Gland F012g^

FD FD vgs g FD k V03,2 Vos V038 - v0j1 '4*lUS"g'v.'1".*0.. pey V008 HV c=4.uc.h.e h_

'EF026""ZUl*" ';,ia,=f;*,'

HV gy c.,,,,,,,, ,,,, g Vacuum Mp 0,,2 F025""O'Os***

a_ 4 Mn$o7 denser

] t 4922 1s01. Valve Suppression Pool (Torus) To CRW 9

! To Reactor Buildin0 i Ditaus1 Control To Rad Wasts To Clean Rad Waste Figure 2a HPCI Water System 2-2

Reactor O

p "C" Main Steam Line Ele nt Primary Containment To RHR To RHH i

/ HV F002 HV F003 "A" "B" )

Leak

• "* *"!l10 " ^

Detection l f w

\\

(Not Used)

VentstoTorusRoom f RuP! e HV F100 'F Dlsc 489480 1 1* 16*

h_h Rupture 16*

Disc E9 St"a 80'= E'Ta' Tur Po)in ra ll HV HV HV - V012 X F079 Vacuum F075 F071 FD

o. Breakers . . V004 V011 % HV y{)*C'."JE" "***

_{Tj W W

• 4 F023

'A From

",= PSV PSV i, = ig" " AnWay ? '"'*""""'

7; Meam HV mya F077 F076 =ll", '**" ., gyi,,

p. F029 IEE" V008 Torus Strainer V009 Steam LV N

[ p Gland Seal Condenser Trap j05,4

' Ir From RCIC yac P p To Main Condenser Figure 2b IIPCI Steam System 2-3

l l

3. ACCIDENT SEQUENCE DISCUSSION The role of the llPCI system in the prevention of reactor core damage is veluable information that can be applied in the normal day to-day inspection activities. If a plant has its own Probabilistic Risk Assessment (PRA), this information is readily available. Not only are plant specifie- design and operating nuances considered, but the accident sequences, systems and component risk importances are generaFy quantified and prioritized.

Since most plants do not currently have PRAs, the application of risk insights is less straight.

forward. An ongoing PRA-based Team Inspection hiethodology for the Risk Applications Branch of NRR has developed eight ,epresentative BWR accident sequences based on a review of the available PRAs'. Because of design and opentional similarities, these representative accidents can be applied to other DWRs for risk based iuspections. This information can be used to allocate inspection resources commensurate with risk importance. In addition, if single or multiple systems are degraded or unavailable, this methodology can be used to designate those accident sequences that have become more critical due to the unovailability of a key system (s). This can allow the inspector to focus on the remaining systems / components within a sequence to assure continued availability and minimize plant risk. Five of the eight sequences include the llPCI system, for mitigation or as a potential initiator and are discussed below.

3.1 Inss of liich Pressure inicetion and Failure to Depressuri7e His sequence is initiated by a general transient (such as htSIV closure, loss of feedwater, or loss of DC power), a loss of offsite power, or a small break LOCA. The reactor successfully scrams. The power conversion system, including the main condenser, is unavailable either as a direct result of the initiator or due to subsequent htSIV closure. The high pressure injection (llPI) systems (llPCl/RCIC) fail to inject into the vessel. The major causes of unavailability include one system disabled due to test or maintenance, and system failures such as turbine / pump faults, or pump discharge, or steam turbine inlet valves failing to open. The CRD hydraulic (CRDH) system can also be used as a source of high pressure injection, but the failure of both CRD pump or unsuccessful flow control station valving prevents sufficient RPV injection. The operator attempts _

to manually depressurize the reactor pressure vessel (RPV), but a PRA-based common cause failure of the safety relief valves (SRVs) defeats both manual and automatic depressurization of the teactor vessel. The failure to depressurize the vessel after liPI failure results in core damage due to a lack of vessel makeup.

3.2 Station Blackout (SBOlvith Intermediate Term Failure of liigh Pressure lniection This sequence is initiated by a loss of offsite power (LOOP) The emergency diesel generators (EDGs) are unavailable, primarily due to hardware faults. hiaintenance unavailability is a secondary contributor. Support system malfunctions include EDG room or battery /mit:hgear room IIVAC failures, service water pump, or EDO jacket cooler hardware failures. IIPCI and RCIC are initially available and provide vessel makeup.

31

~

The high pressure injection systems can provide makeup until:

+

the station batteries are depleted; or a

the system fails due to environmental conditions i.e.,- high lube oil temperatures or high turbine exhaust pressure due la the high suppression pool temperature and pressure; or the RPV is depressurized and can no lonwr support HPCI or RCIC operation; or a

the !!PCI high area temperature logic isolates the system or long term exposure to high temperatures disabler the turbine driven pump.

The reactor building environmental conditions n also impact long term IIPCI system opera-tion. 'Ihe reactor building liVAC and IIPCI toom cu.; ling are dependent on AC power. Although at ilope Creek, the high area temperature isolation logic is not operable under SBO conditions, there is long term EQ concern (operability of Iristrumentation and controls) if the HPCI toom temperature approaches 160*F. -The plant actions to monitor and control high area temperature:

should be revi ewed, including any calculations necessary to establish--a time frame for;the -

implementation of these actions.

- 3.3 Etation Blackout with Short Term Failure of liigh Pressure iniection This SBO sequence is similar to the previous sequence except the high pressure injection systems fail early. Station battery failures (including PRA-based common mode) hre an'important contributor to this sequence, because llPI systems and the EDGs are DC dependent. .HPCI 1 unavailability due to turbine / pump failures and maintenance unavailability is also significant, Core 4 damage oaurs shortly after the failure of allinjections systems.

This sequence is a major contributor to the Hope Creek core melt risk,~primarily because the -

short term failures of HPI do not allow sufiicient tune to align the fire water supply to the vessel.

- As such, the Hope Creek HPCI/RCIC availability estimates are a significant influence on the total -

core damage frequency. The following sections of this report will provide information to assess HPCI system and component availability.

3.4 ATWS with Failure of RPV Water I evel Control at High Pressure This sequence is initiated by a transient with initial or subsequ, u. wlSIV closure and a failure of the reactor protectmn system. Attempts to manually scram are not' successful,L ho' w ever the Standby Liquid Control System (SLCS) is initiated By definition, the condenser and the feedwater :

system are unavailable. The BWR Owner's Group Emergency Procedure Guidelines (EPGs) had

, recommended "PV water level reductions to control reactor power below 5% and the BWR representative sequence was based on that philosopby, 1

32

This sequence postulates a failure to ensure sufficient RPV makeup at high pressure to pre-vent core damage. The inability to maintain RPV water level above the top of the active fuel (TAF) requises manual emergency depressurization, which may tesult in core damage before the low pressure ECCS can inject.

Within the context of this accident sequence, (i.e., time available for success) the licensee capability to perform the logie bypasses should be evaluated periodically. With regard to IIPCI system availability, the remaining sections will discuss system failures and availability evaluation.

3.5 Unisolated 1.OCA Outside Containment The initiator is a large pressure boundary failure outside containment with a failure to isolate the rupure. The piping failure is postulated in the following systems: main steam (60%),

feedwater (12G), high pressure injection (209), and interfacing LOCA (8G). The percentages indicate the estimated relative core damage contribunon of each system:

An interfacing LOCA initiator is defined as the initial pressurization of a low pressure line which results in a pressure boundary failure, compounded by the failure to isolate the failed line.

The failure is typically postulated in a low pressure portion of the core spray (CS) system, the LPCI, shutdown cooling and (to a lesser extent), the HPCI or RCIC pump suction or the head spray line of RHR system.

The unisolated LOCA outside containment results in a rapid loss of the reactor coolant system (RCS) inventory, climinating the suppression pool as a long term source of RPV injection.

Piping failures in the reactor building can also result in unfavorable environmental conditions for the ECCS. Unless the unaffected ECCS systems or the condensate system are available,long term RPV injection is suspect and core damage is likely.

There have been several HPCI pump suction overpressurization events, primarily during 3 surveillance testing of the normally closed pump discharge motor-operated valve' This is of _

particular concern for the configuration with a testable air-operated check valve in series with the normally closed MOV, because of the valve's history of leakage. Hope Creek does not have this design feature in the IIPCI system.

3.6 Overall Assessment of IIPCI importance in the Prevention of Core Damace As previously stated, the high pressure injection function (HPC1/RCIC/CRDH) and feedwater contribute to mitigation of five of the eight representative BWR accident sequences, The system failures for all eight sequences were prioritized by their conMibution to core damage The HPl function in averecate was in the high importance category. Other high risk important systems are

'timergency AC Power and RPS. The llPCI system itselfis of medium risk importance, because of the multiple systems that can successfully provide vestel makeup at high pressure. For comparison, other systems with a nmdium risk importance are: Standby Liquid Coeet Automatic / Manual Depressurization Service Water, and DC Power 3-3

=

4. PRA BASED llPCI FAILURE MODES PRA models may be used for inspection purposes to prioritize systems, components and hu-man actions from a risk perspective. This enables the inspection effort to be apportioned based on a core damage prevention measure called risk importance. The HPCI failure modes for this system Risk-Based Inspection Guide (System RIG) were developed from a review of BWR plant specific RIGS" and the PRA-Based Team Inspection Methodology'. The component failure modes are presented in Table 4-1, grouped by risk significance. Table 4 2 contains a summary of the opeming experience for the industry and for Hope Creek with regard to these risk significant failure modes. Appendices A 1 and A-2 provide more detailed information on the failure events, and are sorted by failure mode.

PRAs are less helpfulin the determination of specific failure modes or root cauas and do not -

generally provide detailed inspection guidance. This makes it necessary for an inspector to draw on his experience, plant operating history, Licensee Event Reports (LERs), NRC Bulletins, Information Notices and Generic Letters, INPO documents, vendor ins >rmation and imitar sources to conduct an inspection of the PRA-prioritized items. To accomplish this task, Sectix 6 presents the results of a detailed review of the HPCI operating experience. The aforementioned sources of HPCI information are correlated by PRA failure mode to previde illustrative inspection examples. This information was also used to develop the system walkdown checklist p:esented in the next secuan.

t 41

Table 4-1 IIPCI PRA-based Failure Summary COMPONENTS' High Risk Imrmrtanca 2 Pump or Turbine Fails to Start or Run System Unavailable Due to Test or Maintenance Activities =

Tmbine Steam Inlet Valve (F001) Fails to Open Suppression Pool Suction Isolation Valve (F042) Fails to Open Medium Risk Imrertance2 CST / Suppression Pool Switchover logic Fails 1 1

Iower Risk imrartance2 Pump Discharge inboard Isolation Valve (F006 and 8278) Fails to Open Minimum Flow Valve (F012) Fails to Open, Given Delayed Activation of Pump 4.

Discharge Valves?

Normally Open Pump Discharge Valve (F007) Fails Closed or is Plugged

• CST Suction Line Check Valve (V006) Fails to Open CST Suction Line Valve (F004) Plugged Pump Discharge Check Valve (V003) Fails to Open

. Suppression Pool Suction Line Check, Valve (V008) Fails to Open Normally Open Steam Line Containment Isolation Valve (F002 or F003) Fails Closed Steam Line Drain Pot Malfunctions Turbine Exhaust Line Faults, including: . ,

• Normally Open Turbine Exhaust Valve (F071) Fails Closed Turbine Exhaust Check Valve (V004) Fails to Open '

Turbine Exhaust Line Vacuum Breaker (F076 F077) Fails to Operate False High Steam Line Differential Pressure Signal False High Area Temperature Isolation Signal False low Suction Pressure Trip False High Turbine Exhaust Pressure Signal System Actuation logic Fails Pump Suction Strainer Blockage i 8

See Section 6 for a discussion of IIPCI human errors.

2-The Fussell Vesely importance Measure is used to rank the system components. This measure --

combines the risk significance of a failure or unavailability with the likelihood that the failure / unavailability will occur.

3 5- At ilope Creek, valves F006 and 8278 must be delayed.

Industry experience indicates a medium risk importance.

1 4-2 l l

I

Table 4-2 flope Creek IIPCI System LER Sursey Compared with tralustry Survey flope Creek All EWRs Comments I mi!ure Ranking' Failure Description Number of railures' Faihm Contribution (%)

Failure

1. of Failures Contribution' (%)

IIPCI 1%mp or Tur4>ine Fails to Start or Run turbine speed control I 10 l

faults 16 II 20 4 7 2 lube oil supply faults II i turbine overspeed and 0 0 H S reset problem inserter trips or N/A N/A 7 4 failures turtyne stop salse 0 0 fait es 5 3 turbine exhaust 0 0 rupture disk failures 5 3 0 0 flow controller failures 5 3 turbine control talse 0 0 faults 3 2 0 0 loss of lube oil cuoling 2 1 O O miw.-valid high flow 2 I during testing Fails to Start or Run 3 30 64 40 I SUBTOTAL

' Tahic 4-2 (Cont'd)

All BWRS Failure Ranking

• IIep Creek Comunents Failure Description Failure

1. of Failures Contribution' (%) Number of Failures' Failure Contrilmuon %

System Unavaltal>Ie due 27 2 4 40 to tam Activities 43 False Ifigh Stenen IJne Differential Pressure 5,7 6 3 0 0 Signal 10-Turtsine-Steam Inlet Valve (FD01) Fails to 0 4 5 4 0 Opn '8 Pump Discharge Valve 5- 5 'O O (RWM) Fails to Open 8 Systems Interactions 2 6 0 0 II A Fail litTI 3 is Systems Actuation logic 8 3 7 0 0 Fails 4 False Ifigh Area -

Teniperature Isolation 5,7 2 8 3 30 Signal 3 False lerw Suction 5,7 -

9 0 0 Pressure Trip 2 1 False Ifigh Turbine

<1 10 - 'O O 5// '

lihaust Signal I r

Normally Open Titrt>ir.e Exhaust Valve Fails

<1 11 0 0 Closed 1 CST / Suppression Pool ' 9

o

-m.

g- e 5

• =

~ }a t-

3. O Ed ef .. .=- E m^"

A

• 2 1.e - -

~

-G. 4-5 t- r h-< en~., -- , ,, r -:.- , . , -- ..v. . , . . . , -. . we,-,w.e- .-* ~ ,. - -- ....-4-.-..rr,, e.c . -e,..,.-. ~ :- s4

Table 4 2 Notes

.1, Failure contribution is expressed as a percentage of all significant liPCI failures as developed by the Operating Experience Review.

2.

- Failure rank'ing is a subjective prioritization based on PRA and operational input, recovery potential, current accident management philosophy and conditional failures, as applicable.

3. Ilope Creek significant IIPCI failures are based on a review of all available LERs.

4. Although some caution is warranted Ae to the limited plant specific data, this failure mode seems to comprise a disproportionate fraction of the llope Creek IIPCI unavailability. This -

area is a candidate for enhanced inspection attention.

5. Failure importance was upgraded from the PRA-based ranking of Table 41.

6. Failure importance was downgraded from the PRA based ranking of Table 4-1.

7.

IIPCI isolation and trip logies are significant contributors to unavailability. The system can be isolated by a single malfunction, yet instrument surveillance intervals can be greater than the more reliable actuation logie.

8.

Unlike the system trip and isolation logic the actuation logie arrangement (one out-of-two twice) diminishes the importance of a single instrument to reliable system operation. At least two low RPV level or two high drywell pressure sensors must fail. As discussed in Section 6, availability is more dependent on control power.

9.

The latest BWROG Emergency Procedure Guidelines deemphasize the suppression pool as an injection source.

10. Conditional on the delayed opening of the pump discharge line valve, F006.

11. Unlike the rest of the failure modes listed herein, Systems Interactions" is not PRA-based.

It was identified as a significant failure mechanism during the operating experience review and -

is discussed in Section 6.

4-6

. ., . . . . ~ . . . .- . .. -- . . - -. ~ .. - . - -.

t m

_ 5. IIPCI SYSTEM WALKDOWN CIIECKLIST llY IllSK _IMPORTANCE i Table 5.1 presents the_ liPCI system walkdown checklist for use by the inspector. . His information permits inspectors to focus their efforts on components important to system availability

- and operability. - Equipment locations and power sources are p, tvided to assist in the review of this system.

l l

1 1

4 51

. - . ~ . -

Table 5-1 Hope Creek HPCI System Walkdown Checklist i

l' .

,ACIUAL-DESCRWHON ID NO.'. LOCA* HON - . POWER SOURCE & LOCATION STANDBY  ? VALVE POSITION POSnION A. Components ofIligh Risk Significance Note: All circuit breakers should be closed (ON)

, Turbine Steam Isdation Valve F001 11PCI Room l 72-251081 Cosed Inboard Steam Isolation Valve FJ02 DiW 4310 52-232203 Open Dev.102 10B232 Outixurd Steam Isolation Valve 1103. IIPCI Pipe Chase 52-212053 Open 10D212 l

Pump Inboard Discharge Valve F006 Pile Chase 72-251051 C osed i' , 10D151 (WI) .

s>

B. Components of. Medium Risk Significance j . CST Suction isolation Valve HX)4 IIPCI Room 72-251-92 Open i Pump Outboard Discharge Valve 1T07

" -* 72-251071 Open ,

Pump Minimum How Valve F012, ' Torus 72-251112 Gosed -

Pump Suction liom Suppression Pool fBt2 ' 72-251131 Cosed Full How Test Valve to CST ' RJ08 Corridor 4112 72-2511103 Occed Bev.54 1

4 4

I

/

4 4

i 4

y # r'-e s- f 4 v -

w v, e a __ ____u-._m_:._2.._ _ ._.- ..,_-

6. OPERATING EXPERIENCE REVIEW As previously stated, an operating experience review was conducted to integrate recent industry experience with PRA derived failure modes. Approximately 200 IIPCI Licensee Event Reports (LERs) from the period 1985 to mid 1989, were reviewed for applicability to the PRA failure modes for llPCI. Sixty two L.ERs did not have a corresponding failure mode. 'These LERs generally documented successful system challenges, administrative deviations, or seismie/ equipment qualification concerns. The remaining 140 LERs documented 159 IIPCI faults or degradations.

As presented in Table 6-1, these failures have been categorized by PRA failure mode to provide a relative indication of their contribution to all llPCI faults. Each of the fourteen PRA-based failure modes that has corresponding industry failures is discussed below. Selected LERs, identified during the operating experience review, are summarized to illustrate typical failure mechanisms and potential corrective actions. Where applicable, other sources of background information, including NRC Bulletins, Information Notices, inspection Reports, NUREOs, and AEOD Reports are cited. Hope Creek failure experience over the plant life is also integrated into the discussion of each IIPCI failure mode.

The illustrative LERs for the first failure mode,"IIPCI Pump or Turbine Fails to Start or Run", a,c presented in Table A-1; the LERs for the balance of the failute modes are presented in Appendix A-2. The text provides complementary information on the failure distribution within a subsystem.

Table 61 IIPCI Failure Summary Failure Tntal llPCIFallurecontributiou N umlwr Description Failures' (%)

Pump or Turbine Fails to Start or Itun 64 40 1

2 System Unavailable Due to Test or Maintenance Activities 43 27 3 Fat;c liigh Steatn 1.ine Dilferential Pressure Isolation Signal 10 6 -

Turbme Steam lutet Valve (FOOL) Fath to Open 8 5 4

Pump Discharge Valve (F006) Faik to Open 8 5 5

6 Systems Interactiotu Fail llPCI 3 2 4 3 7 System Actuation logic Faik 8 Fahe 11 gh Area Temperature 1 solation Signal 3 2 9 False low Suction Pressure Trip 2 1 10 Fahe 11igh Turbine lixhaust Signal l <l 11 Normally Open Turbine lixhaust Valve Faib Closed t <!

12 CST / Suppression Pool Switchover logic Fails I <l 13 Suppression Pool Suction Valve (F042) Faih to 6 4 Open Minimum Flow Valve (Fol2) Fath to Open 5 3 14 139 Developed during the llPCI Operating F.xperience Review which examined IIPCI IJilO from 1985 to mid )

1989.

6-1

6.1 HPt i Sntnn Failure Modes llPCI Fallure No,1. Pump ur Turbine Falls in Start or Itun The major contributor to liPCI system unavailability, both from a risk and operational viewiuint,is the failure of the turbine driven pump to start or continue running. His failure mode includes many interactive subsystems and components which can make root cause analysis and component repair a complex task. His has been tctlected in 11WR PRAs by the variation in the subsystems that coraprise this failure of the pump or turbine to start or run. This has resulted in some confusion in the application of PRA insights to inspection. For the purposes of this study, this failure has been defined as those com[vnents or functions that directly support the operation of the pump or turbine. Table 6 2 presents the subcategories that are included in Faliure No.1 as well as the number of faults each subcategory contributed. He "IIPCI Pump or Turbine Fails-- -

to Start or Run" basic event accounted for 64 failures or 41% of the llPCI faults in this operating experience review.

6.1.1 Turbine Speed Control Faults The tuibine speed is controlled automatically by a control system consisting of a flow controller and an electro hydraulic turbine governor. The turbine governor system receives the flow controller signal input and converts it into hydraulic-mechanical motion to position the governor (control) valve. The system has a " ramp" generator which upon turbine start, will control the acceleration rate up to a speed corresponding to the flow controller output demand signal. he

" ramp" rate is adjustable.

Turbine speed control faults are a major contributor to the pump failure to start. Sixteen failures were identified in the industry survey, including:

• six electro-mechanical governor (EG M) control box faults,

• two dropping re_ tor assembly (resistor box) failures, one ramp generator / signal converter box failure,

• r.te magnetic speed pickup eable, one speed control potentiometer, and

• five motor speed changer / electro-mechanical hydraulic (EG-R) actuator failures.

The ramp generator and signal converter box malfunction occurred at ilope Creek in 1986 (1.ER 86-081). In this event, a slow IIPCI response time was attributed to less than optimal turbine kop gain and ramp time settings.

The llPCI turbine speed controlis a very complex area that requires specialized attention. The inspector should confirm that the licensee acknowledges the complexity of the turbine speed control by having a trained specialist on staff, a good working relationship with the appropriate vendors, and adequate vendor oversight on proposed modifications or repairs.

62

__.__u._s..m__.. .__ _.n_.u__m.__ .- - _ _ _ _..-_._..amm_____ . _ _ _ _ - - - ' I

l l

Table 6 2 IIPCI Puinp Turbine Falls to Start or Hun IIPCI Failure Nu 1 Subcategories identitled !)uring the Industry Suncy Subcategory Description LER Failures I Turbine $ peed control faults, including EG M control box 6 Motor speed changer 5 l (EG R actuator remote sen'o) i Resistor box. 2 16.

Ratup generator / signal converter box 1 Magnetic speed pickup eable 1 Speed control potentiorneter 1 Lube oil supply faults 11 ,

Turbine over speed and auto reset p oblerns 8 Inverter trips or failures 7 Turbine stop valve failures 5 Turbine exhaust rupture disk failures 5 Fow controller failures 5 lurbine control valve faults .3  ;

loss of lube oil cooling . _

2 }

Misecllaneous: Valid high stcarn flow during testing _ .L. l TOTAL 64 63 g

r. -,w+1-m y- vv-- 6r97ya,,,yo- ..v,...r y 9 - a c 9,p. .~ ,-,-,ym,, --%ww w w- r--,...-,,w., ,.-w.,<,e-w. , , _ ,. .y ew wy-,,-e e -w we w

i

)

6.1.2 Lube Oil Supply Faults -j

\

His subcategory consists of eleven failures to provide sufficient lubricating oil to various turbine components. As presented in Table A.1 most of the faults are related to the auxiliary oil  :

pump and include two bearing failures and tive auxiliary oil pump pressure switch faults. %:ce i other events involving low bearing oil pressure events were attributed to valve mispositions and oil contamination.

Ilope Creek experienced two lube oil supply faults:

1. LER 90-009 reported a design deficiency that did not provide a low point draw off line ,

that allowed oil contamination due to water and sludge accumulation.

1

2. LER 88 010 described an event where two mispositioned oil control valves that prevented  !

the system from delivering rated flowin the time required by the Technical Specifications. l 6.1,3 Turbine Over speed and Auto Reset Problems The mechanical overspeed trip function is set at 125 percent of the rated turbine speed.- ne displacement of the emergency governor weight lifts a ball tappet whleh displaces a piston that allows oil to be dumped through a port from the oil operated turbine stop valve. This allows the spring force acting on the piston inside the stop valve oil cylinder to close the stop valve. He overspeed hydraulic device is capable of automatic reset after a preset time delay.

Overspeed and auto reset problems contributed eight failures to the turbine driven pump failure category. Two events were attributed to failure of the electrical terruination to the reset solenoid vilves. Two failures were caused by the swelling of the polyurethane tappet in the' _

l overspeed trip device tapped assembly head. An additional failure occurred at Dresden 2 in 1987 -

due. to a loose hydraulic control system pressure switch contactor arm. Additional sourecs of. -

infortnation on turbine overspeed trips are information Notice 86-14',8614 Supplements 1 and 2', ,

and AEOD case Study Report CdO2"'.

Ilope Creek has not had any reportable occurrences in this area, b t

6.1.4 IIPCI inverter Trips or Failures P

The lipCI inverter _ is powered from a 125V DC bus and ultimately powers the turbine speed

- control circuit, There have been seven inverter problems, Three were attributed to internal-electronics faults, and one overheating event due to an integral cooling fan failure,Dese Licensee - '

Event Reports did not consider the aging of the electronics as a potential root cause. NRC  :

research has concluded that inverter performance is' related to ambient temperature and has i developed specific inspection and testing rccomniendations to monitor inverter performance and

- detect incipient failures." -Two additional problems involved short term unavailability of the inverter, One was a blown fuse; the other ivas an inverter trip because the high voltage trip.

setpoint drifted low. At the time, the battery charger, supplying power' to the ' inverter, was operating in the equalize mode; the input voltage to the inverter was 144V DC, -

11 ope Creek does not have an inverter in the llPCI system. ,

64

,e 4-, g e -

,,.--g,,-3--. 5 -,---r .,w~,-., -% -. .-..,,e ,v. ,b.,,e . .m%.-'..e.,.- z em -- en

ti.l.5 Turbine Stop Valve Faihnes

'the stop valve is located in the steam supply line close to the inlet connection of the tutbine.

'lhe primary function of the valve is to close quickly and stop the flow of steam to the tuibine when so signaled, A secondary function of this hydraulically opesated valve is to open slowly to proude a controlled rate of aduission of steam to the turbine and its governing valve.

'lhe operating expciience data had 5 failures of the turbine stop valve. Two were caused by large oil leaks One failure at Duane Ainold was attributed to the aging of the lluna N rubber thaphragtn in the pilot oil trip solenoid valve.

Ilope Creek had no turbine stop valve failuies.

~

M.6 Turbine lhhaust 1(upture Disk Failures

't he 111 Cl turbine has a set of two mechanical rupture diaphragms in setics which protect the exhaust piping and turbine casing from overpressure conditions. When the inner disk ruptures, prem..e switches cause turbine trip and lil'Cl isolation signals. Inw pressure steam tiows past the ruptured diaphragm through a restricting orifice directly into the lil'Cl room. 1(upture of the second dak would vent the turbine exhaust into the llPCI pump room without flow testriction.

The nominal rupture pressure is approximately 175 psig.

'Ihe live turbine exhaust ruptote disk tailures that were a part of the operating experience icview, all occuued in 1985. One was attributed to cyclie latigue, two were attributed to water haminer due to cariyover hom the exhaust line drain pot; and the root cause of two other failures was a manufacturing detect.

'lhere were no llope Creek rupture disk failures.

6.1.7 Ilow Contioller Failutes The flow controller in conjunction with the cicetro. hydraulic tmbine governor, control turbine speed and pump tiow. The flow controller senses pump discharge tiow and outputs a contiol signal to the tuihine governor to maintain a constant pump discharge flow rate over the pressure range of operation, llow controller f aults accounted foi live lil'Cl failures. The dominant failure (31.lills) was the failure of the flow controller to function in the automatic mode. Manual control was still available however None of the reported tiow contioller failuies occurred at ilope Creek.

6.1.8 Turbine Control Valve Faults The three control valve faults were attributable to different root causes. A leaking oil supply line prevented proper operation of the valve. Susquehanna 2 apparently suffered a mechanical failure dating (1lill 86 008). 'lhe last incident was a potential failure due to broken lifting beam bolts. AEOD 1(eport T906" provides additional information on the contributors to the bolt failures. Ilope Cicek icported no turbine control valve faults.

65

4 I

6.1.9 loss of 1.ube Oil Cooling

-l 1

1he loss of lube oil cooling can be caused by faults in the cooling water lines to and from the  ;

cooler, cooler leakage, or flow blockage. A prolonged loss of tube oil cooling can lead to turbine bearing failure. The lube oil temperature is monitored by a temperature indicating swi'ch with  ;

control room annunciation. *lhis category has two failures, both involving the diaphragm of .

i pressure control valve. Neither of these failures occuired at ilope Creek.  !

6.1.10 Miscellaneous Valid liigh Steam flow During Testing

]

Another potential system failure involves the practice of running the auxiliary oil pump to - i lubricate the turbine bearings or to clean a system ground. Monticello used this practiec to attempt {

10 elcar a ground in the electro hydraulic governor. When the fault did not clear, a system test was initiated to confirm IIPCI operability. _ When the operator opened the turbine steam admission r valve to simulate a cold quick start, the system isolated on high steam flow; The operation of the : ~

auxiliary oil pump caused the hydraulically operated turbine stop valve to move from its full closed  ;

- to its full open position. When the stop valve leaves the fully dosed position it initiates a ramp l ,

generator that provides a flow signal to the turbine steam admission valve, allowing it to move to the open position._ Since the auxiliary oil pump had been running for some time the ramp .!

generator had timed out and a maximum steam now demand signal was sent to the control valve.  ;

This prevented the turbine steam admission valve from restricting steam flow as it noimally would =;

during a turbine start, resulting in high steam flow and a system isolation. .

Plant procedures address running the auxiliary pump periodically to keep the turbine bearings i lubricated. When the auxiliary oil pump is running, the high pressure coolant injection system will' isolate if an automatic initiation signal is received at any time after the ramp generator has timed out, which occurs after approximately 5 15 seconds. The plant has taken the following corrective actions to address the problem:

A modification has been approved that will climinate ramp generator initiation while the auxiliary oil pump is running unless a valid initiation signal occurs.

+

'1he high pressure coolant injection system operating proceduies have been revised to include cautions addressing system inoperability when the auxiliary oil pump is running.

-+

'lhe operating procedures that verify system operability have been revised to include precautions about system status before and during the test. The' control system ramp generator function during the opening of the steam admission valve is described in these procedures.

In summary, this is a sigmficant concern because a common plant practice has the potential to '

disable the IIPCI system, llope Creek operating procedures should be reviewed to ensure that the appropriate cautions are provided to the operator concerning disabling the llPCI system.

L i-6-6

6.2 UKl Failure No. 2 S.ystem Unavailable Due to Test or hiai fRnance Activitica A probabilistic risk assessment develops estimates of system unavailability generally using a fault tree. The fault tree is a diagrammatic representation of the known contributors to system unavailability. In addition to component failures, the sptem may not be functional due to testing or maintenance (T&ht) activities. In a single train system, like llPCI, test and inaintenance activities on one component tend to disable the entire system. It is important to keep the llPCI T&ht contribution as low as possible because it is as important to system unavailability,

'the toot sources of excessive llPCI T&hi unavailability we examined as part of this operating experience review. Forty three examples of test or maintenance errors (27% of allllPCI failures) were divided into three contributors to T&ht unavailability. Inadequate maintenance or inadequate post maintenance testing accounted for 22 IIPCI failures. The problems includedvalve packirig leaks, misadjusted torque switch settings, miscalibrations of a steam lina differential pressure instrument and an EGR actuator, improper connection of a gland exhauster drain line to the tube (high pressure) side of the gland seal condenser, system adjustment without a retest, and a rag lef t in the turbine sump which disabled t he shaft driven oil pump. Only two of these errors were discovered in an llPCI operational test at low pressure. The bulk of these events occurred during maintenance or surveillance testing at power.

An incident occurred at llope Creek (1.ER 86-082) where the operators were forced to declare llPCl inoperable after discovering that the flow controller proportional gain had been adjusted without a retest of the sptem. IIPCI was returned to service after the retest.

A second T&ht category consisting of 4 events, is attributable to human error that inadvertently or incorrectly disables the llPCI system. Pertinent examples include the disabling of the wrong ilPCI system at a two unit site, mistakenly disabling the auxiliary oil pump due to a smoke odor in the llPCI room, and valving errors which later caused a low pump suction trip or inadequate lube oil pressure.

The final category, " system inadvertently disabled during testing," consists of thirteen personnel -

errors that temporarily disabled the llPCI system. These incidents include steam line containment isolation valve closure due to errors during testing of the isolation logie, a valve motor failure due to overheating caused by excessive stroking during a surveillance test, and an inverter trip caused by personnel error which resulted in a high voltage condition affecting both Channel C battery chargers. This last event occurred at ilope Creek and is described in LER 89 009. An additional event, that was reputed at ilope Creek in LER 88-033, involved the failure of a technician to 1

properly engage a bypass switch during a steam leak surveillance. As a result, the steam supply line was isolated.

In summary, the T&ht component of system unavailability must be continuously monitored by the inspector to assure it is as low as possible. The licensee should be administratively limiting the time that the HPCI system is in test or maintenance during operation. System restoration should be vigorously pursued; ilPCI should not be down for days, if it can reasonably be repaired in hours. if feasible, putions of the system should be tested during outages. In addition, llPCI unavailability can also be minimized by adequate root cause analysis and effective corrective action to avoid multiple system outages to address the same failure.

6-7

l l

6.3 IIPCI Failure No. 3 - False flich Steam Line Differential Pressure Isolation Sicnal F

The llPCI system is constantly monitored for leakage by sensing steam flow rate, steam p essure, area temperatures adjacent to llPCI steam lines and equipment, and high IIPCI turbine ,

exhaust pressure.

The steam 110w rate is monitored by two differential pressure switches located across two-l-

different cibows in the steam piping inside the primary containment. The flow mensurement is derived by measuring differential pressure across the inside and outside radius of each cibow. If a .

!cak is detected, the system isolates the llPCI steam line and actuates a cantrol room annunciator.  !

At ilope Creek, this flow measurement is done using a venturi measuring device. <

This failure category has 10 LERs which constitute 6% of the total llPCI failures. There are i no llope Creek LERs in this category; however, there is one potential problem area with -;

surveillance testing of these instruments. On July 1,1990, a broken terminal lug was found during  :

a surveillance test of the high steam flow auto isolation logic that made one train of the steam supply isolation logic inoperable ~ Consideration should be given to the use of test jacks-on -

terminals accessed frequently for surveillance.  ;

Additionalinformation can be found in Information Notice 8216". *

~ 6.4 HPCI Failure No. 4 Turbine Steam Inlet Valve Falls to Opsn .

This motor operated valve is a normally closed. DC powered gate valve. This valve opens on automatie or manualinitiation signal, provided the turbine exhaust valve is open, to admit reactor steam up to the turbine stop valve. ,

There have been 8 failures of this valve to open on demand comprising 59F of all llPCI

l. failures, including:

two cases of mechanical / thermal binding at Brunswick 1 1 one stuck valve at Cooper attributed to the restelliting of the disk L

• one valve motor failure at Fitzpatrick due to insuffielent stem lubricationc Other failures were attributed to loose torque switch adjustment screws, potentially insufficient- ,

opening torque conectns, and sticking MCC relays.

liope Creek did not have any reportable failures of the turbine steam inlet valve to open. ,

6.5 IIPCI Failure No. 5 - Pumn Discharce Valve Fails to Onen The pump discharge motor operated valve is a normally closed DC powered gate valve that is automatically opened upon system initiation. The failure of this valve to open disables IIPCI ll injection into the reactor vessel. ,

There have been 8 pump discharge failures documented in the operating experienc( review.

This failure mode accounts for 5% of all system failures.

6-8 i

g egy. g+ .y c--g. syy,g--31 m mennpa'-efA-a t e7*eg J gr wa*-->,-e- *9q9i.p+9.,iyec- 4.i.y,.96't>p.'9y/mwg4,gr.,-p,r g- sp e w -p- ygmy y wtig,. g 4-gy-p y w y 9 a.i.e.aing%g. y c gg 9-g m ,y 9-w*..g y.g y 9p y.9 9 > p f gry y yes w% g ei

One valve failure was due to a set of mispositioned auxiliary contacts in the valve motor starting time delay relay. Other failures are more generie, including two failed motors, a ground of the DC control voltage at the torque switch, and inadequate torque concerns due to the use of starting resistors in the valve ruotor circuitry.

'the llope Creek design includes two pump discharge valves.There were no reportable failures of the llPCI with these valves 6h llPCI Failure No. 6 IIPCI Systems Interactions Systems interactions refer to unrelated system failures that can disable llPCI. Although there is no associated PRA category, the industry operating experience review identitled the following system interactions that disabled the llPCI system:

1, During a flic protection system surveillance test, approximately one gallon of water drained onto a battery motor control center (MCC) causing a circuit breaker overload trip and valve inoperability.

I 2. A eracked flow control valve test coupling sprayed water on a battery MCC and disabled j a main steam line drain loss of power monitor. IIPCI was disabled when the MCC was deenergized to inspect and dry the components.

3. An automatic sprinkler system in the llPCI room activated after a system test. The probable cause was vapor huildup from the leakolf drain system that activated on ionization detector.

4. Sete ,a drift in a Fenwat temperature switch caused activation of a deluge system during 2.t'Cl turbine overspeed test.

There were no reported LERs involving systems interactions at ilope Creek.

6.7 UPCI Failure No,7 System Actuation logie Fails Startup and operation of the llPCI system is automatically initiated upon detection of either low water levtl( 38 inches decreasing) in the reactor vessel or high drywell pressure (~ 1.68 psig.

increasing). The llPCI system can also be manually initiated by arming and then depressing the manual initiation switch in the control room.

There were four LERs associated with this failure mode. The LERs illustrate that the failure of the llPCI actuation logic is more likely due to common causes such as the loss of power.

Unlike the llPCI trip logie, the redundancy (one out of two twice) and the diversity (Iow vessel level /high drywell pressure) of the actuation logie make it less susceptible to individual sensor failures.

No system actuation logie failures were reported at ilope Creek.

6-9

6.8 IIPCI Failure No. 8 False Area Temperature Isolation Signal

(

he llPCI system is constantly monitored for leakage by sensing steam flow rate, steam pressure, and area temperatures adjacent to the steam line and equipment. If a leak is detected, i the system is automatically isolated and alarmed in the control room. De 11 ope Creek ambient temperature monitoring system includes:

Equipment room ventilating air inlet and outlet high differential temperature.  ;

Emergency air enoler inlet high temperature.

l

• IIPCI torus compartment high temperature.

+

Pipe routing area high temperature.

IIPCI isolation will occur when any of the temperature switches trip. This category accounted for three llPCI failures (2% of all failure) in the industry survey. In addition, llope Creek reported the following failures: '

1. LER 87 007 reported a steam line isolation that occurred during normal operation and -

was attributed to design error. The temperature differential setpoint approximated that .;

of normal operation and was subsequently increased.

2. A ventilation system design error that caused isolation of an outboard steam supply valve l during normal operation was reported in LER 87-007. The minimum intake temperature D setpoint was too low and caused a high differential temperature between the 11PCI area intake and exhaust; as a result, the steam leak detection logie was actuated.

3. A failure in Riley temperature module in the steam leak detection system caused the -

spurious actuation of the llPCI high room temperature actuation and the isolation of the inboard steam supply valve. This event is reported in LER 87 027.

4. LER 90-002 reported the closure of an outboard steam supply isolation valve based on a high room differential temperature signal. This signal was initiated due to an excessive temperature differential between ventilation supply and the HPCI room exhaust temperature. An inoperative temperature controlloop was the cause of this event.

6.9 IIPCI Failute No. 9 - False low Suetion Pressure Trins

[ '

The purpose of the low pump suction pressure trip is to prevent damage to the liPCI pumps due to loss of suction. ' A pressure switch actuates to cause the turbine stop valve to close.

There have been two turbine trips attributed to false low suction pressure signals. One L

occurred at Cooper occause the low suction pressure switch isolation valve was inadvertently closed, and the second instance occurred at Brunswick 2, when llPCI isolated immediately after an initiation signa. Hope Creek had not had any llPCI (or RCIC) system isolations due to false low suction pressure trips.

6-10

-# "wC4 W -T Peug *rw W-- y T-$-'Tv MW9rvv af eT ry e we ni@9v y y v- --

wMeg

• r y- -

y. g,1r^ --Nu rwwe rse 4re gMN Ny7 y 'y -w te N'- y9gyr ryy,- --yoy y --oy--- y-y-.e

6.10 HPCI Failure No.10 False liigh Turbine !!=haust 1lressute Signal The high turbine exhaust pressure signalis one of several protective turbine trip circuits that close the turbine stop valve. The high turbine exhaust pressure signal is generated by pressure switches and is indicati e of a turbine or a control system malfunction.

There were no LliRs involving false high turbine exhaust pressure signals reported by llope Creek.

6.11 llPCI Failure No.11 Normally Open Turbine lhhaust Valve Faik Closed The failure of any of the turbine exhaust valves to open results in a turbine trip due to a valid high turbine exhaust signal. One facility had a failure of the turbine exhaust line swing check valve.

The valve internals were found wedged in the downstream MOV and had the potential to trip the turbine due to high exhaust pressure. The failure was attributed to the forceful cycling of the swing check discs under low flow conditions. Reference 14 can provide additional background information.

Ilope Creek reported no failmes in this category.

6.12 IIPCI Failure h'o.12 - Condensair Stonge Tank / Suppression Poo]_Switchover incie Faik In the standby mode, the llPCI pump suction is normally aligned to the condensate storage tank (CST) Urx n a low CST level signal or a high suppression pool level signal, the suppression pool suction valve automatically opens with subsequent closure of the CST suction valve (F004).

System operation continues with the llPCI booster pump suction from the suppression pool.

The operating experience review found one example of a degraded llPCI pump suction switchover logie. One of the suppression pool level switches was out of calibration due to a slight amount of foreign material that was deposited on the float.

6.13 IIPCI Failure No.13_- Suppression Pool Suetion Line Valve (F042) Fails to Orsen The suppression pool llPCI pump suction valve is a normally closed, DC powered valve. The liPCI system is initially aligned to the condensate storage tank. The suppression pool suction valve is opened and the CST suction valve is closed on a CST low water level or a high suppression luol level signal. The importance of this llPCI failure mode has been diminished by the current emergency procedure guide"nes which emphasize the continued use of outside injection sources.

This requires operator action to bypass the llPCI suppression pool switchover logic to prevent the opening of the suction line valve. This is especially true for the decay heat removal (non ATWS) sequence where it is likely that the CST makeup can be maintained.

There have been six failures of the suppression pool suction valve to open, representing 4%

of all llPCI failures. All occurred during system surveillances. The valve failures are generic in nature and include two motor failures due to insulation degradation, one misadjusted torque switch, a limit switch failure and a valve disk separation. One of these valve failures occurred at ilope Creek.

6 11

6.14 11PCLfailure No.14 Minimum Flow Valve Falls to Ooen

.He minimum flow bypass line is provided for pump protection. The bypass valve, automatically opens on a low How signal of < 550 gpm when the pump discharge pressure is greater than 125 psig. When the bypass is open, flow is directed to the suppression pool. -De valve automatically closes on a high now signal (> 650 gpm). During an actual system demand, the failure of the minimum flow valve to open is important only if the opening of the pump discharge valves is significantly delayed. In general, this combination of events is not probabilistically significant. With regard to system operation and testing in the minimum now mode, the licensee response to llulletin 88 04" should be reviewed to determine if the design of the rninimum flow bypass line is adequate. Unless there is a design concern or a recurring problem with either comptment, inspection cifort should be minimized in this area.

Ilope Creek did not have any reportable problems with the minknum How valve F012..

De Operating Experience Review did not identify any llPCI failures for the following PRA.

based failure modes:

Normally Open Pump Discharge Valve Fails closed or is Plugged

+

Pump Discharge Check Valve Fails to Open a

CST Suetion Line Check Valve Fails to Open CST Suetion Line Manual Valve Plugged

• Suppression Pool Suetion IJnc Check Valve Fails to Open

• Normally Open Steam Line Containment isolation Valve Fails Closed

+

Steam Line Drain Pot Malfunctions Turbine Exhaust Line Vacuum 11reaker Fails to Operate Suppression Pool Suetion Stramer Illockage

~

Re PRA based prioritization of IIPCI failures correlates well with the actual industry failure experience. With the exception of the first failure mode (MOVT007), tdl of the faults that follow have been designated as " low importance"in the PRA based ranking of Section 4. At ilope Creek, all of the failure modes listed abo e have been designated as low importance" -

6.15 Contribution of lluman Error to System Unavailability -

The potential for human error exists for activities such as, maintenance, calibration, surveillance and, of course, operation. Probabilistic Risk Assessments typically emphasize operator error both in fault trees (system failure diagrams) and in the event trees that describe accident sequences. As such, these failures are usually gross actions that can fall a complete system.

Typical PRA based llPCI human _ errors are:

L Failure to manually start the high pressure injection system if automatic actuation fails.

2. Failure of the operator to transfer pump suction from the CST to the suppression pool-

. after a pump trip on low suction pressure due to CST unavailability.

3. Failure to drain llPCI steam line d_ rain pot, given drain valve failures.

6 12

__ _= _ _ _ _ _ _ . _ - _ _ .__ _ __ __

4. Failure to provide makeup to the CST during an A*lTVS event. -

5. Failure to transfer pump suction frorn the suppression pool to the CST during an event with a high suppression pool temperature, nere are two cases when this must be performed, one during an NITVS event and one during a non NnVS event with the failure of suppression pool cooling.

6. Failure to override the llPCI high temperature isolation logie (for station blackout sequences).

7. Operator recovery from initial failure of IIPCI.

8. Miscalibration of IIPCI sensor (s) disables system actuation, high RPV level isolation or results in false isolation signals.

9. Failure to reset the llPCI system for operation after testing or maintenance.

With the exception of the last two entries, these human errors are either: a) conditional, that is, they noust be considered within the context of an llPCI failure or isolation (errors 1,2 and 3) -

or b) event speci6e (items 4 through 7). These requirements make direct observation unlikely,The potential for these human errors can be evaluates indirectly by a review of the licensee procedures and observation of operator performance at a simulator.

The last two human errors can occur during normal operation and are, therefore, more i inspectable. Resident inspectors routinely examine surveillance, calibration, and maintenance

! practices and procedures, and perform ECCS control room and plant lincup verifications. IIPCI operability is con 6rmed by checking the steam supply and exhaust lineup, pump suction and discharge lineups and the control function settings (hand / auto station in automatic).

There is a sceand source of hurnan error that is not readily discernible in most risk-assessments because it is not considered as a separate failure. -It is the _ human contribution to component unavailability. The component failure estimates are developed from plant speci6e experience, if enough data exists, or from other, more generic, data sources. In either case, the unavailability estimate of a_ standby component is based on the number of failures per total demands. This estimate inherently includes all failures caused by human error. Dased on the operating experience review, it is estimated that more than 50% of the llPCI failures have a human error contribution.-

As previously indicated, the examination oflicensee practices and procedures, as well as the'-

application of industry experience, can help reduce that portion of the'IIPCI unavailability that is due to human error, in the reactive mode, a thorough root cause analysis and suitable corrective measures can prevent similar occurrences in t'a future.

6.16 Sypfort Systems Required for liPCI Ooeration The high pressure coolant injection system is dependent on other systems '(called support systems) for successful operation. These systems are:

6 13

DC Power For system control (125 V DC), valve movement (250 V DC): and auxiliary oil pump (250 V DC).

IIPCI Actuation RPV level and primary containment pressure instrumentation for system l initiation and shutdown, Ihiom Cooling For llPCI pump room cooling to support long term operations. This function requires service water (for cooling) and AC power for the fan motor.

During the llPCI Operational Experience Review the support system influence on llPCI ,

availability was apparent. The loss or degradation of the DC battery or bus that powers llPCI has a straightforward effect. Besides the battery charger problems or fuse openings, the more unusual DC system problems included a battery degradation due to corrosion of the plates. De suspected cause was a galvanic reaction due to plate weld metalimpurities. 'Another concern is insufficient voltage at the load during transients which cousd trip the station inverters or fail hiOVs (Browns Ferry 1, Brunswick 1 & 2 and Nine hiile Point 1). This would be of particular concern during a loss of offsite power or a station blackout event.

The effect of the loss of room coo!ing on continued ilPCI operation is not as clear. The system is typically required to support long term IIPCI operation. Besides the random failures which can occur at any time, there is one sequence specific effect that should be examined. During station blackout, the room cooling is lost when continued IIPCI operation is critical. The licensee actions to preserve HPCI operation should be examined. - For example, some plants will open pump room doors to promote convective cooling, but that does not necessarily assure continued HPCI operation. The licensee should have pump room and steam line temperature calculations -

or have other proceduralized provisions (bypass high temperature isolation) to assure long term

' IIPCI operability.

The RPV level or high drywell pressure instrumentation is required for multiple ECCS systems .

including IIPCI. The operating experience review did not have any pertinent examples of failures -

of the ECCS actuation logie which directly affected llPCI.

At Hope Creek, llPCI toom cooling is independent of AC power during station blackout conditions and requires both the service water system and SACS.

l- In summary, support system problems can impact iiPCI operation sometimes in a less than straightforward manner. In the context of specific accident sequences; these support systems may be more prone to failure. The inspector should verify licensee awareness of these interaction relations and con 6rm that compensating measures are adequate.

6.17 Simultaneous Unavailability of hiuttiple Systems-hiuttiple system unavailability is of concern because of the increased risk associated.with continued operation. Although technical specineations tend to limit the risk exposure somewhat, s the licensee should avoid planned multiple system outages, if possible.

6-14 +

i e vs v

. - - ~ ~ - - - . - - -- --. . - - - - ~- - -----

l Within the context of the accident sequences discussed previously (Section 3), certain combinations of system unavailability result in a much grer.tet risk of core damage. For example, the llPCI operating experience review had nine LERs that documented simultaneous llPCI and RCIC unavailability. During this period, the probability of core damage is greatly increased for accident sequences that require llPCI and RCIC for mitigation. This would include all the i sequences described in the Accident Sequence Description except 'Unisolated LOCA Outside ~

Containment.' %c unavailability of IIPCI and an emergency diesel generator would have similar impact on plant risk. Additionally, the $1multaneous unavailability of IIPCI and ADS (one LER, due to logic testing) somewhat impacts Sequence 1,' Loss of liigh Pressure injection and Failure to Depressurize."

Although some of these LER examples of multiple system unavailability were due to random failures, the majority involve licensee decisions to disable a system for surveillance whe.n anothu - i i

critical system is not operable. Unless absolutely necessary, these configuistions should be avoided, as frequent entry into Technical Specification greatly increases the risk of core damage.

6.18 LOCA Outside Containmen1 1 Unlike the llPCI failures described earlier which describe the unavailability of the system for core damage mitigation, four events have occurred where llPCI is a potentialinitiator of a LOCA '

outside containment. Dese LER: consist of degradations of the steam line isolation function and -

pump suction line overpressurizations. The twu steam line isolation problems both occurred at Dresden 2. One was a steam line differential pressure transmit _ter with a non conservative setting.  ;

De other was a failure of the inboard containment isolation valve to close. ,

he remaining two incidents weie inadvertent pressurizations of the llPCI low pressure piping.

A pump suction overpressurization occurred at Fermi (LER 87 030) during a system test A '

pressure surge of- 800 psig occurred in the llPCI pump suction piping after a turbine trip. The event was attributed to the slow closure of pump discharge lift check valve. The licensee replaced the valve with a swing check, which is expected to close faster.

i Dresden 2 (on October 31,1989) declared llPCI inoperable due to' elevated piping:

temperatures in the pump discharge line. The 26(PF temperature was caused by feedwater back leakage througl. the closed injection valves, Discharge piping supports were damaged, attributable to waterhammer caused by steam void collapse upon system initiation, in addition to the potential ,

for piping damage, steam binding of the pumps is also a consideration. Information Notice 89 36" provides additional information on elevated ECCS piping temperature.

In general, the IIPCI LOCA outside containment initiator is a very small contributor _to. total: .

core damage. The diverse steam line break detection logic and the downstream feedwater check valve reduce the potential for an unisolated LOCA outside contalmuent._ The examples presented -

above are potential areas ofinspection to assure that plant design or operation does not increase the potential for this initiator.

6 15 h#-^t- s..--w 4%----1mq-9,.3--yyamm--ei,,--.girg. a+-%.imirv- yy N e , wq.gy.+iai. y a qq y p- e-4,g n +.,i.ep--.neg-..y, y,p gg.,--..9 9 q w gs-e,ay mis r4-- ' spi hg -gT-- r ruww 6--;p-mq.h-mgr-g-+y p,y. h- py

7.

SUMMARY

'lhis System Risk Ilased Inspection Guide has been developed as an aid to llPCI system inspections at ilope Creek. The document presents a risk-based discussion of the llPCI role in accident mitigation and provides PRA-based llPCI failure modes. In addition, the System RIO uses industry operating experience, including illustrative examples, to augment the basic PRA fMlure modes. The risk based input and the operating experience have been combined in Table 4 2 to develop a composite BWR llPCI failure ranking. This information can be used to optimize NRC resources by allocating proactive inspection effort based on risk and industry experience. In addition, component faults are summarized in Section 6, and provide potential insights both for routine inspectiota and the " post mortems" conducted after significant failures.

The llope Creek operating experience review has identified a relatively small number of LIIRs when compared to other plants. Ilowever, the following component failure modes have shown a higher percentage of occurrence when compa:cd to the industry survey results:

• turbine lobe oil supply faults a system unavailability due to T&M activities

• false high temperature isolation signal These components should be given additional attention during future routine and specialized inspection activities.

i 7-1

8. REFERENCES

1. Brookhaven National Laboratory (BNL) Technical Letter Report, TLR A 3874 T6a," Identification of Risk Important Systems Components and lluman Actions for BWRs,"

August 1989.

2. Shoreham Nuclear Power Station Probabilistic Risk Assesstuent, Docket No. 50 322, long Island IJghting Co., June,1983.

3. Brookhaven National laboratory (UNI.) Technical Report A 3453 87 5

• Grand Gulf Nuclear Station Unit 1. PRA. Based System Inspection Plans," J. Usher, et al., September,1987. .

4. BNL Technical Report A 3453 87 2,"lJmerick Generating Station, Unit 1. PRA. Based System Inspection Plans " A. Fresco, et al., May,1987  ;

5. BNL Technical Report A.3453 87 3, "Shoreham Nuclear Power Station, PRA. Based System Inspection Plans," A. Fresco, et al., May,1987.

6. BNL Technical Report A 3864 2, " Peach Bottom Atomic Power Station, Unit 2, PRA. Based  ;

System inspection Plan," J. Usher, et al., April,1988. .

7. BNL Tt-chnical Report A 3872-T4, " Brunswick Steam Electric Plant, Unit 2. Risk Based l i

Inspection Guide," A. Fresco, et al., November,1989.

8. NRC Information Notice 86-14 "PWR Auxiliary Feedwater Pump Turbine Control Problems".

March 10,1986.

9. NRC Infortnation Notice 86-14 Supplement 1, 'Overspeed Trips of AFW, llPCI and RCIC-Turbines" December 17,1986; Supplement 2, August 26,1991.

10. NRC AEOD Case Study Report C602," Operational Experience involvirig Turbine Overspeed .

Trips," August,1986.

11, NUREG/CR 5051, " Detecting and Mitigating Battery Charger and Inverter Aging," W.E.

Gunther, et al,, August,1988.

12. NRC AEOD Technical Review Report T906, " Broken Lifting Beam Bolts in llPCI Terry Turbine," April 18,1989. .

13. NRC Information Notice 8216. "IIPCI/RCIC liigh Steam Flow Setpoints," May 28,1982,

14. NRC Information Notice 82 26. "RCIC and HPCI Turbine Exhaust Check Valve Failures,"-

- July 22,1982.

15. NRC Bulletin 88-04,

• Potential Safety Related Pump less," May 5,1988.

16. NRC Information Notice 89 36,' Excessive Temperatures in Emergency Core Cooling System Piping located Outside Containment", April 4,1989.

'I

~;

a- . . _ . . . . . _ . . . , , -_.._,u.. .__;, ...;_.:u__..,_._._,..._,[.,-__.,,5, _ . , , , , _ . . _ .

Al'I'ENDlX A 1 SUhih1ARY 0171NDUSTitY SURVliY 01: lil>CI Ol'ERATING !!Xi'liRll!NCl!

lil'Cl l'Uhil' OR TURillNI! 17 Alls TO START OR RUN A1

i ir +

' Table A-1 HPCI Pump or TurNne Fails to Start - Industry Survey Results i

4-L 1 Fadere Desc. Root Cause Correctrve Measures Corr _a cats impection Gedance l: 'IURittNE SPEFD CONTT4OL FAULTS r .-

3 EGM contrtd Im raatfunctiort Two smular failures attributed to agmg EGM prmted circuit teards wdl b. Each of these EGM amarot twm r l ..

3 effects due to kmg term coergitaten amt replaced at eight year intervals. fadmees inerred at okier pla its possit4y elevated andient temperatures. Additional IIPCI remp room owdeg and appear to be ageng related. [

An EGM printed cucuit board failed and added. t t

I aused a false high steam tion signal De accend faitere incohed the electromcs in ,

? , the corarolImx chassis.

i i

EGM control ta had a ground. Two prmted ciremt boards replaced.

7 incalibration d nun voltane settings. Recalavatmo d wohage sette=s.  !

Failed transietor in the EGM control tom. Bcu replaced. Surveir.ance procedures being expended to venfy l proper functinning d the output X' speed circuit.

, ia -

1- Motor speed HPCI faded auto initiation surveinana Error was eat detected Jarmg a t changer!EG-R because the electrical connections between prewmus test at 150 psig. Pr ,.c " u  ;

actuator malfunctons. ~ governor control and gmerrmr valve ' revised to functiorzany test the

}. electrobydraulic servo we+e in error. grwernor control system darmg the i

id ic= pressure serveillance testag-

• k Capacitor faaere in mocor year ani Replaced capacennr Faanse sisy hoe been caused by Ans%ent temperatures in j

.g excesswe itPCI rame cw a areas should be ,

tempratre. verdied with specdications.

• 4 i Imprtper gapmg and foreign accumulation Compnnent replaced or serviced.

L. I _ on contacts-f i-EG R actuator groended as pin connection Corrtmon graducts removed.

i. due to the accumulation d corrosion

' prodects there were three m .sce d this event that have been attributed to a .

V design change in the actuator pin -

1 c:mnections.  ;

I

Tame A-1 HPCI Pump or Turbine Fails to Start - Industry Survey Results Comments ins g ctxm Cnudance R c= 4 Cause ' Carcetrve Measures failure Desc.

Reutt<v box destgt deficiency + penal test Res>stor bos mW.ed to enswe Drcypmg ressior sNwed output voltage imufGuent when EGM crmtrol box ud! reten.t assernNy proNems.

eput vedtsy at design minemum. required nAtage under worst case condttk,es.

pesstor ces ponent rerlaced Resktor I adere Gan: and terre setimes reset. Setters had nos been nuh6ed Ramp Fenerator signal Sk= IIPCT restwmv time annbuted based em pr=er asccwm wst converter tw3x. encorrect turhoe kyy pain and rang tmw prottam w ittn es.

CaHe darnaged dmmg IIPCI mairtenance Canle repaired.

Maenete speed j picitep cabic. prewntmg spred feedbad to the speed ermtroikr leve controt etwms panel terem#ms Repaired panet termnatumt Speed wotrni prwent wwmter_

f Utill Oil. Site'PT.Y i l' A t '1.B. )

.> Mscrmettdt replaced. 2 additamal failures due to Auxihary od pt np Mumwirds unhut precurie swach fadt 0 mscalibration. and one pessure switch fads. attrhted to a poete d tefim tape that t*hvAed wasmg onGce of switc!t I

i trua.e bydf auhc cnr. trol mtem pressu*e Cornponeet adjusted. 1 swuch contacting arm.

Pump replaced. 5 mhr event prme nuwir f At;xdiarv <4 pump Pump bearmg fadure degraded pump l beanng faihtee mas pwuNy due fadure per'ormame&mer discharge pressure. to dadv use to supply r4 to f bearing had fra recently replaced turbe asw vahe.

l I i preential human error.

Vahrs crvrectly p=;sticmed, handks Two simda- events haw occurred Addttional inw Ifumaa error. AJ1 camtroi vahes at other plants.

mrr.vsnymed. rem <wed. Surveiuance revised to twaring od pressure ched al pressure durmg turbe txturrenws, tesi.

De 3,uess of periodrativ ParafGo m Itdie od coated pston cause1 Piston cleaned. sampieg luSe <st shnu3d be take oil contaminat'am. twndog of hydracic trip retav. wenf;ed.

5 L

r Table A-1 PPCI Pump or Turbine Fuls to Start - Industry Survey Results  ;

y - -- [

Failure Desc. Root Cause Correctat Measures Comments  ; 12 pectus Guadave t TUR f3tNE '

OVFRSPEED AND I AUTU RESI T PFOiltFMS L

Electrical terminstkm toose electrical termination on solenoid Wiring to the soienords wdl be The enrretswe acskm for a [

failures waht anI danNed the remote reset restrained to reduce stram on the similar earlier ewm apparently funcikw failure attributed to normal termicathms. dal not address the root cause d I

liPCI vtbratk n. the failere.

Ovenpeed trtp device Overspeed trip device tappet assembly Tappet remxhmed_ Similar awarrence at another tapped binding.

• head was bmding in vaive body. plant.

Polyurethane tappet, previously machined l per GE guidance, had esperienced j additional grc=1h ) ,

a lome bjdrauisc control svstem pressure Repaired contactor arm. 1%ne.

y switch contactor arm. -

" Drain port blocked _ Erratic stop valve operatkwt. Blocked dram Drain port cleared. Additional. information on  !

part in over: peed trip and a sto reset turhme oterspeed trips is piston assembly casaed trip mechankm to prcmded in NRC Irformation  ;

cycle between tripped and normas Notux 86-14 and %14. Sapp.1. j pnussons.-  ;

INVERTER TRIPS I OR Fall 11RES -

1 Inverter tripped and could not be reset Re;4 aced inverter.

due to a failed diode. See Ret 14 for effects cf imerter  ;

agmg and preventative measures. j Inverter failed due to the failure d an Replaced inverter. A sundar event imeiving a internal capachor. ruptured capacitor occurred at  ;

another plant.

Internal electronic Inverter overheating due to a failed Repaired or replaced cooling fan.

faults integral crioting fan. t Inverter failure due to blown fuse. Replaced fuse. [

i I

s

1 i jj fiI ) l1, l!

} !jE 1 iJjI .nk l

e t

a ch t r

u aeto n e wm s k

t mv nd cae w iD

's ao e

u s ea t

c a e.

r a

c r r

aal 4, En

- ad k

h t

u sf a e G

W d su n 4as d

e r omM s

r t r

e d' lt re a s e nt s t

wsta uwr

dfop c a d t

c anCh .

i c s sse m t tamde R s r M

5 c

- e ugt

noe4:

r r nc t f ec ed r

pnmd a D,bt O

d e

yu w s s a

.e e

p m

t s ca t t h ;u Of ac ehtvih r t md oi c e e - Eaah A;t v eef xda .

I r c t r g .

t n

a dx c

• mse= r t

ed e

a n

s t

a p

k C

E r e es m,v t e e sr g u .

l u

s e

r 5

x e I im d es a e e e

r r

nch ath u es t v eat pf pe a .

n n c R a e

c o ehr e m uh de a

r h=

ev y t a s rzt e e c si u e e m e l

e.

ea deht t

vr s r

e s

c s bwt tah a ab f rh d e d

m u t e e d f vt ew :a re S r r e e rs av t

r a e a m mr y h 7 wk r pee d t

r s

u G w d S

r F9 s

0 imkASSTwh c

a p

e u t

e h ef a

d n e +

v sa I

y h 1r e r u

r a3 an

- s 5 tc g t w m &v rvt um s.

r e enwt h e mLu q . tr r a I s - t.s d wt a Ve r tn S s

n a dgd az mcen t o d d r a S aa n e r r eEe e s n n o ee te s

s t e r n .

m e h Nc o t s

mGin r e u c a h a vh re t

s r e r cr p ce g ~ ta e g u

jeh d pc q ataf e c t l

s e u o d e a a f ekc !am pr a e 3 det h t ne m

i a r wt u kl

$ pw t

e d r 5

c a , e cc beMnbd q

F e re a e c r r l tpigve a e

e utr w d r g e te a e aa 1 im e -ev e M t

nxn e w pd tn e m a

w u r dse r e tn -n v s den i

n

• pf f t d x s

r ed e pr an *s e h cdm een t

s ks d t b o r-H e i h e o r

r t e n s kf u r e r rr mf mm d i

e ngtsu u c ke e

'T n i c emro tn r

hah eede Ua e

am t on r.- s* n

!af ya h r T IWpch r

r u n s r q n, a s r is c a d r r

o C E a F Ys ch t t' r r e e w Ra pAf e a im a- t ex o

p 1 m t i 4; s

msr g u w s t

n to d s u r tne he cu cc p t

P tp ft m a e s cao I

N ~or a g s

s c det ma yv p-u eb e c C e y r r t u c x u t

a r u c s r l. ond umi d

P r e r b a les e a a pdi j n e t a u o H u al s f Et s r od e ad a r v e u re ah c ev r dih a t n e

t s r e wt d :Vi t

1 Wden ov du m s

mb a w u r e d u e es )e . s w

e e mc A tphs t d np a t Fpnr t

r a

t ac Me d nta e r pi tsc hek v a n I

g b ts e ornr weh k t to d c a s e d s n l

b a u e

fn v

k ar n

e p

c t

e to oo a c o d, u na t 6nnk a a n nn g.

c T d wJy ooh nt s ts Mpu wid a a e r r s e . k t

t Rwm :ke pa eed c

s u tw de% e ly w c

u mv e

udw e Ma gb tn e u h rc a s gN ret t C

r e

k

- bb l

a r a m rd r er ri mNe r u e n a t

n c t kme re th ha apd T.

ha ai a

k m ha Tt m e ghr n

e m

r n ia n Vc mf nn Oane o mJ-r J

md- u R I d w Yd a s Vkg d m I f S d E N P F w K s

t S O "t i k 0

h a

t i

c

. T S

I T

n e 5 v f i

e u

s e F F A i l

x ip a

c ETfs P g

D c  !

i . N '

w Nt T lo l

i n s t l P 1A T U f ha re e P \ O e r tr F hc d

e R t n Mt c u eJ M

1 '

L y F

a WV A

C o %hav I Mf a R N T F C l

,i gg

>*t. r

!,j!f) Illll t 11

i I

f Table A-1 HPCI Pump or TurNne Fails to Start - Industry Survey Results  !

I Failure' Desc ' Root Cause . Corrective Measures Cweents Inspection Guktance I Water hammer . Dhaust diaphragm ruptured by water Ibcied Ime deared, rupture Jak I A simaar event has emurred at induced drsk rupture, carrywer from exhaust Itne drain por due replaced another plant. Duratina and I to a bkxked drain line. fregnency of exhaust line

• blow &mn increased r Ft DW CONTR OLIER Fall.URES Fadures appear to be aging Ambent oceddens in Failure lo ctmtrol in Defectrve amplifier card and solder joint Repairs performed related. yet it appears scwee '

automatic. areas containmf this ,

- attribtned to aging. bcensees do not intend to eqwpment should be periodically replace sensi*rve wriGed agamst .  ;

egurpment or otherwise address sprofica:Lws..

the rcwx cause of these failures,

'[

.i $

Dropping resistor failed in the imtrument Resistors R26. R24. am! rener dede amplifier cucuitsy due to normal heat of C24 all appeared to be affected tw [

i operatka ambient temperatures and were

}

replaced _

L

>- l g Internattent operatkm of inte nal switch %c slight oxidised cnntacss merc i contacts did not allow the controller so cleaned and lubricated. In the kmg i

I: read the flow setpoint in auto. term. permanent jumpers will be insta!1ed to tmpass the switches.

-f l

Gear train failure. Isme fastener caused intermed; ate Fear to . Procedures will be remed to requee '

unmesh which prevented adjustment of the a periodic check of the gear tram

[

controGer settina. and fasteners.

Mscabbration INoontroller indicated a flow of 400 CentroUer recairbrated-gpm when sysicm not in operation. Failure L attributed to miscabbration j

WRittNE - <

(.

CONTRO1, VAIVE FAUL13  ;

l Control oil leak. Ort supply line nipple leaking because - Nipple repaired. plant persormel plant personnel stepped on line to gain informed of failure cause.

f t

access to control valw. - ,

t

,. i o

5

.f

[

I  ;

f i ' \ ll lI1 lll:IIi n

s e e e r

to s -r t

ht si e

k r

dud at e ewt e n p c e emh m a

d iu G

ona1 si p cCi e

n ve g r tq N h l by r

tal P it d t o

o nai t

y a r g c kefr r a. m e r i c l p e pnu u tn e yzn n O d.eim d maru I

m t e S h a vr t

r a e d p m bi tc s , aL amer n . a g nc a aI l

t Mt n t

u d ade a r pf u 7en a el r etdt t ta e r f s

e 1 tmdem( s e m as r r e ts e f i m. I t

w e R tr a a d hs e r e u s o nh oeb e mt r mt Ru rca r

y pt e em r o n

i ocN e e

vr Ra t

pp t Id a o c a as Dhe c ymri N I f u s t

n Or e a coo r

la n gmt.

ei-r p d s

S tu n e

m E p Aof e

r r eahr el a e

r puc ma m.

y r o u +t t

r m d: pn e pt t

s Co r peim emse Pi e s r

c o d ap Ad g r

hl T

eha te p u " ct s d

n t; I s n n s

- ay l oi e .

t icf r e i nn t

a r ej otae t t

,s e

t lumu t d st pe S n se utt pr daic e o i o e nr m po ra r sa t r e ot t r r a s i s s h

t t

e p u pre pc l

i e

r e xr s n mic a

wg ep us a u g g p s r. m p F a e

a r .

a a r n pd a e hcead e f g omot n M ob; dn o s a a ta r ym g

i e t nm r v et ae n k n br t c

e e e r tor e f - te ha i d an n! n T

u e r nmm s

e - n o a e min r g oi u i mma a u i c c o n v l nor e h n r C F e Acoa o

p m .pn d u d moy dnt u a P le gt r u r p ia a r s ts a ot s nt 1

I f C s t ehede h prd du c gr s s t

n e P

t dgTk a in m hs a oh I b in s.a c d eh Iu ad s n r t I t n (

mc ak a ltoc r

ic e w ol e c ie a s e ep r b er e r :a 4 u c 1

- b e c de e rum u qi tpo wc! a !

A t

get n wa c e m r pf u e inis t e s t mda ta m u pne om mo l

b f

l i r or r

t i x

n a mor no eppug o r t f f a t et a datoin ms, ilos t T h c g e o v r F 5 sh w h et u n . ia e e ie s y t e1 eh s

t a h e te lr r

s e m g

S T

d a e U d pn c l int u h h

etnh av t C t o sopn e e er a g qs ue lo t

f oi r a I_h Va t ta e d uo es at u r x e pm e c d p o Cnp s rbe ce itw R i ur me Sdi P er u e x

Uh 5b c t 1.

ge 1 S

d lu n r 0 s U F e r O f

h ia D 'T f lu c

rg U s

a N s h f e a v

m f G 5 A D

t F N 3 1 e dt ew O J 1

O I

1 i

t u S -

d eom r a S 0 V T a h e O 0 C tM I Tb 1 C P

>a ltlI1llfl [I llifl f' fl l1 lt llil lI l

Al'PENDIX A-2 SELEClliD I!XAMI'I.ES OF ADDITIONAL lil'Cl Fall.URli MODES IDENTIFIED DURING INDUSTRY SURVEY A9

-_ ._.__-________mm_.__-__._.m __,______

j i

Table A-2 Summary of Illustrative Examples of Additional IIPCI Failure Modes [

i Failure Dese. Root Cause Cnrrective Measures Gwnments impecsson Gunfance ft liPCI Failure 3- Dtfierential pressure transmitter failed due Ampfsfier card crmnection was Rmemont Transmitter NRCInformation Notice  :

False II;gh Steamiine to inadequate connection of ampbfier secured. 851*> prwuks additional [

Differential Pressure condition card was either incorrectly informatum on steamime Isolation Sgnat seated during instahtm or worked kwe. pressure measurement. l t

Miscahbration and a stuck pressure Wrong corntnion value caused Rosemont Transmitter [

indicator disabled both dmsions of high '

md%askm and was corrected. I AP transmittert Trammitter opera:ing outside toleranas Reca!#ated transmitter Conservatiwty narrne instriement j due to incrv7ect setpoint adjustment toleranws were used durmg the ,

setprint adjustment. The i instrument was a Rc-t i Transmrtter.

Setpoint drift cause spurious system Scipsnt was adjusted. Bartna trammitter increased cabbratxm isolations fregwncy may be

> - o

$ctpsnt draft caused by moisture snarusinn Unknown Barton transmitter.

through the dial rod shaft seal IIPCI failure 4 - Mechanicahhermal bindmg cf disk due to Interim enrrective action was drdimg TMs fadare was attributed to ,

TurNne Sscam Inlet inadequate cicarances. a hoke in the valve disk. Double procedural and traming Valve [F001) fails to dsts were to be insaa!Ied durmg a madequacies-  ;

' pen o failure refueling outage as a long -

term sedution. f "Ihermal binding of disk. Replaced motor gears and installed The thermal buv5eg can occur A four hour systern f larger power supply cable to motor. for ~2 hours after system is warmep may be required returned to service folkmng a by pmcedures to i cooldown. circumwas this problent Motor failure Surge prosection added to shunt coil Motor faDute caused by Mgh l cf DC mosor control circuitty. voltage transient in shunt coit that occurred when supply g breater opened.

Failures Na 2 and 6 are discussed in Section 6 of the text.

l t

i

._, ._. _ _ ._ z ,-4 ._. . . - . _ _ _ . _ _ __

Table A-2 Summary of mustrative Eumdes of Alfitbcal IIPCI Failure Mcdes Correarve Measures Ccemems Iwm Genlawx Fadure Desc. Root Cause Mrxw =mdegs fa&d die when Other sa'erv related MOV, Mmor ladee. Vahrr reparred and trwque switch HPCI Fadure 4- torque sertmg out of adprstet were ak a$ccred

^ adystmera screws =ere crvrectly (ctrt d) s<xqued.

due t., kwe toruve switch Prncedures oce revv.ed adpsment screws. and torque switch trwter plates were ista:kd Vahe motor fu!ure due to mcorrect steam Vaht rwor was repfaced.

lubricatm I

Rermwed step startmg resntort Oher DC MOVs =cre aM INPO SER 25AA and lacersee review deternmed that rake NRC Irlorma!.on Nxece f rmght not c;wn cue to mstfrocet iorque.

cra!uated.

??C p* further "i

rh j

Manitened auaiiary cwaas w. startmg Repbced cimtads IIPCI Fadure 5 -

Pump D scha ge time de'ay relay f,r v3he ent*w.

Vahe iFYst] I'aih to Viht mottw re;4 aced Fadere attrhrted to heat related Vaht motor fadure

@n " reakdn=n <4 wahe mnter C eternah.

Ptwenta! pedice may a"ec: INPO SE R 25-68 ami I;censee revie= determined that vahe mn Sep startirqr resisters had rec been crmsidered in the torque anakses other DC MOVs NRCinfmearm Nxcc l het msufrecct torque to gen. pro =W addekwa: l and =er* removed 1 gwdance. i l

Fuse failure due to electrical groundmg. Fase reciaced and ground crvrected l HPCI Fadure 7 - '

Miem Actuatm Further dzscussum in AEOD Systets faded to actuate due to inadegwe Desipt c d&d.  ;

Ihic Fads Rep wt E*C. 1 seal in tune.

Failed g*=er s%pty resstor.

Resstor rep (xei HPCI Fadare 8 -

Faise H:gh Area Moduie replaced Ne= a odel re;4acement Temperature Isolatre Faded te perarnre emitormg moduk.

ccr sured Sgnal Mmsmum mtake set;wwet ,

Desirs error. l ten perature was increased.

Fadures No 2 and 6 are dacessed in Sectre 6 of the text.

si

}

2 h 2 et bf e

[

y o c d mk n n e d e mu a a r yt r a s t

e (* nc .

urea l

n 1 r -.

e 2 e w o n d

G ereCI

{h s t t s r s ._

n o eue c f v

latc t u de

._.A.a. c.:s -

t c

i n

e5 e ,

t. v fai ac .

c e

p r

e =4 s e

s u on en s e

4. eb .

h a s y f

s n eck r x._

I R wn gi T aAF s g

Rsf a m d g la d e e e .

m.

i ta ug r f r e v d

_ d s mr up o

u M. r s m c e yr te a

r

a e mve t

wi r c us c n el a , o s

c a - w a w s

ads e we a- c op e t v

mte d

e o

hc e L.

de te d e mp r n

g .

i e s

t o

s o-s ef n e u er n e a d

M w r e

h a , t wu du- o e frl k=h s

. s kd a s w s -i w A. u nr d -

e er g s

a s k ,h a

dfd a e e r e . d dn r ui rt d c c,. rk l te a u s n oan e x n es t a i

ahd e l h l

i s g e n wg h o e c t hg eua eg r e f sOo e t

ug s

a s r phas t ab lt e r m F t s t n r ddi a c t boda ns p r dc a e gt a t .

a vs i ;h !ut- a o i I

C *c n ti a ac e :m o eo w

n. e oi a e rg n

- a hrs A i t  :

d ui .

el re P , i e u er l

ao as th e ct c

8gs hr ieer mci a s I

I L

C Nd c et Si n Fad u

Ao r i s l

f a T cw Dfod e l

a n

i o

t i

d eg d r A uy s tr f

o d gw e

a c r s a t roc i .

e s a d h l e lp e Vo c p r e c t i s

a u r d u m s a lp e t.de s .

d a e h c e c a c d n d -

x A xa wd r e E M n e lp a d m r w

k e n e f e i a t p

e e s a

r n t a d p e v n e v s dei o r e e s t

c r e b r i

t e e

. u s k h c

c a c h c a e h c

a r r n s c e n lpte ac lp v e

r o o e e or e e la i

t s r h w =s u C N P C $ Rp R R V 5 llI I f

o s r

o y e t e r r n e

n a u i s m m ha lia -

n n d m e f

w ioa r t

n L e g

u e s e z ta t e t n a v v n d t S la h l a ta lu e s t m e m x c v r t a e 2-v i t

k b

h inta e s

u m

t s

a r

o d t e

n w c a gov j d u r oh'c o s c a f ht A i t e h e i n d; d

t ei le :a o de

. r u c f o d hs ini f

o a e uw d s f

o b n m s

s t

u tu h t u d t ar e ;i 6

a i h c k e r

i m o Wo c t e

a p lba ~

n o

T c ny p

sV s e ee . t h c

c e s r it e

s elt s n d eO m

h c

r u ud i t h c m epc u c e

u a et e n

o iM it l

i ad w it e oi s S C r r i s

t s d w s f e t

e w s ts i nd i n

ue' o ue r d s e

r t

n s v sd e a r

r h ai t l e

v oar tog e r

it h

ee ht r d

e o r o xb r' e m a a a s R Pi n C Eb 1 Mde T U V Vt s s

v c

a d

lo e e r

'se v e o P

l a

a n - n - d - v -

6

- o 04 t er e lo V 9 itc 1 t s n 2m 3 la' 4 d

ePoV 1 ros u 1 n 1 < 1 1 n

c e up e rTs eph( e auk er s s

i ek w

n a n ene n rSi r r r r s

e u u h re deOx Eil s u erpi s e oip uF se 2 D i wT l

a d gP ai ay a l

iapa l

d a

l ia mO a e Foe F1 1 t Fllan eF FuF Fs isl en O F uo N r

u I

Ces l ru s se I

Ce a a s

ul Cmie I

b v I

ctg 5c e srno Cpt a t I Cisl mt s e

P hh n g l

r rl PS P pci l P mi r HC1 e i

a Plar a ~si P oua u ua a u F I I FP I I Ft S l NTV l I SSF I

1 1 MF l, a

j F

>:. N l ,fj jI i[lllI t! t' .,

l l

IllEllullUll0N No. of Copjn Sp. of Copin OFFSITE U.S. Nuclear Regulatory 211. Gon e Cornniission Pacific Northwest 12b.

Richland WA 99352 A. El llassoni OWIN IG E4 W. D. Ileckner 26 llrookhaven National 1.ab. _

OWFN 10 E4 W. Gunther (10)

K. Cainpe R. Ilail OWIN 10 E4 J. liiggins W. Shit r (5) 10 J.Chung J. Taylcr OWFN 10 E4 M. Villaran 0 F. Congel Technical Publishing (5)

OWFN 10 E4 Nuclear Safety Library (2)

A. Thadani OWIN 141121 1 Ms. Allison Keller U.S. NRC Alyson Keller NRR/PD1 OWFN 13 E21 Mail Stop 14D4 Washington, DC 20555 E. V. Inibro OWFN 9 Al 2 11. E. Polk OWFN 121I26 10 PSE&G llope Creek llancock Bridge 4 llope Creek Nuclear Plant Resident inspector, ii.K. Lathrop 4 U.S. Nuclear Regulatory Commission Region 1 2 J. Bickel EG&G Idaho, Inc.

P.O. Box 1625 Idaho Falls, ID S3415

w RgeonM us u s wuctt An utout AtORv coweission i. Agi,wytgy ense Asse=tshesi tew** bees. it any )

NRCM 1907, 2*N BIBLIOGRAPHIC DATA SHEET is,, s ,nt,.n. on ,3, ,. r.,s NUREG/CR-5923

a. m u Amusuuriin BNL-NUREG-52338 High Pressure Coolant Injection System Risk-Base (i inspection Guide for Hope Creek a oAtt atront rueussio uo~i j vi.a December 1992

4. F IN OR GR ANT NUMBE R A3875

6. AulhettS) 6 TYPt OF REPORT M. Villaran, W. Shier

7. PL R100 COV E R L D iswtue,*e peeess SP F R NG 0 NilAl BON - NAML AND ADDHESS ft, NMC.proveer Dewmen OHav er Aeroa. U.S heter A%ary C: , **e, ame+at **8'ves; de s omewsur, po,en Brookhaven National Laboratory Upton, NY 11973 s e, ,wo .e,. ss. ..e o a ona. .- us a . , c.

ogssgRisyc Anu Avios - n AMt Aso AooRtss ,,, unc. ,

Division of Systems Safety and Analysis Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washingtoit, DC 20555 10 SuPPtf MENTARY NOTts

11. AB31 R AC i (100 wone or mm)

The High Pressure Coolant Injection (HPCI) system has been examined from a risk perspective. A System Risk-Based Inspection Guide (S-RIG) has been developed as an aid to HPCI system inspections at Hope Creek. Included in this S-RIG is a discu.sion of the role of HPCI in mitigating accidents and a presentation of a PRA-based fa; lure modes which could prevent proper operation of the system.

The S-RIO uses industry operating experience, including plant speci6c illustrative examples to augment the basic PRA failure modes. It is designed to be used as a reference for both routine inspections and the evaluation of the signi6cance of component failures.

12. K E Y Yv0ROS/DE SCR'P T OH$ (t er wense or parears she# een essor sweescreers m Jerereny the soport. l la Av AILA6 skit V 4f A1(Mil' uniimited 14 hCUHi t Y CLA5$stiCAf TON I1%es ,eerl BWR Type Reactors-Reactor components, BWR Type Reactors-Reactor Safety, unciassified Hope Creek-1 Reactor-High Pressure Coolant Injection, High Pressure Coolant ua a-~

Injection-Risk Asse'sment, Hope Creek-1 Reactor-Risk Assessment, Reactor Cooling unciassified Systems, Reactor Accidents, High Pressure Coolam injection failures h NUM8tH OF FAGES I

l 16 PHICE NRC F ORM US (3 391

h i

f ll l

1.

l Printed on recycled paper

[

f Federal Recycling Program l

.NUREG/CR-5923. IIIGli PRESSURE COOLANT INJECTION SYSTEM RISK-BASED DECEMBER 1992 INSPECTION GUIDE FOR If0PE CREEK UNITED STATES p,g37 cL,33 g,,L NUCLEAR REGULATORY COMMISSION PosTAcE AND FEES PA!D WASHINGTON, D.C. 20555-0001 usNac PERMIT NO. G-67 OFFIC1AL BUf 4 NESS PENALTY FOR PRIVATE USE; $300 s

4 m.. __. b - ve at ,-eew- r 4 ~ - ri m-+ *--a 4w # - -4.-- , + .,-m-. , i+=9