ML20105D087

Auxiliary Feedwater System RISK-BASED Inspection Guide for the St. Lucie Unit 1 Nuclear Power Generation Station

ML20105D087
Person / Time
Site:	Saint Lucie
Issue date:	08/31/1992
From:	Gore B, Pugh R, Vo T Battelle Memorial Institute, PACIFIC NORTHWEST NATION
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-L-1310 NUREG-CR-5896, PNL-8102, NUDOCS 9209240293
Download: ML20105D087 (31)

Text

.. _ _. _ _ _ _ _ _ _ _..

~

l NUREG/CR-5896 l

l PNL-8102 l

i k

Auxiliary Feedwater System Risk-Based Inspection Guide for tae St. Lucie Lnit 1 Nuclear Power Generation Station i

t i

I l

Prepared by

}

R. T gh, H. F. Gore, T. V, Vo i

t Pacific Nu.hwest Laboratory i

Operated oy llattelle Memorial Institute Prepared for U.S. Nuclear Regulatory Commission i

P

.h i

9209240293 920831 PDR ADOCK 0500 S

G

.. _,. -. _.. _ _,. _ _.... _. - _ _ _ _ _..... _ _. _.... _. ~ _ - _. _.., _.,.. _ _ _ _. _ _ -,

AVAILAJIUTY NDTICE Avattabdity of Reference Matenais Cited in NRO Pubhcatsons Most documents cited in NRC publications will be available from one of the following sources:

1.

The NRC Public Docurr,ent Room 2120 L Street, NW., Lower Level, Washington, DC 20555 2.

The Superintendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washington, DC 20013-7082 3

The National Technicalinformation Service Springfield, VA 22161 Although the katlng that follows represents the majority of documents cited in NRC pubilcations, it is not -

Intended to be exhaustive.

Referenced documents availab!a for inspection and copying for a fee from the NRC Public Document Rcom include NRC correspondence and internal N ',: memoranda: NRC bulletins, circulars, Information notices, inspection a,.d invest lgation notices: ticensee event reports: vendor reports and correspondence; Commis-tion papers; and applicant and licensee documents and correspondence, The following documents in the NUREG serles are available for purchase from the GPO Sales Program:

formal NRC staff and contractor reports, NRC-sponsored conference proceedings, international agreement reports, grant pubhcations, and NRC booklets and brochures. Also available are regulatory guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission issuances.

Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Comtr.:s-sion, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, such as books, journal articles, and transactions, Federal Register notices, Federal and State legislat!on, ano con-grossional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations. and non-NRC conference pro-ceedings are availaole for purchase from the organi2ation sponsoring the publicatic cited.

Single copies of NRC draft reports are availaolo free, to the extent of supply, upon written request to the Off6ce of Administration, Distribution and Mail Services Section, U.S. Nuclear Regulatory Commission, Washington, DC 20555.

Copies of Industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Ubrary,7920 Norfolk Avenue, Bethesda, Maryland, for use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organt2ation or, if they are Ams-tcan National Standards, from the American National Standards Institute,1430 Broadway, New York, NY 10018.

t DISCLAIMER NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government.

Neither the United States Govemment nor any agency thereof, or any of their employees, makes any wvarranty, expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third pa.1y would not infringe privately owned rights.

k

[

i NUREG/CR-5896 PNL-8102 -

i Auxiliary Feedwater System Risk-Based Inspection Guide for the St. Lucie Unit 1 Nuclear Power Generation Station d

Manuscript Completed: June 1992 Date Published: August 1992 Prepared by R Pugh, H. F. Gore, T, V, Vo

~

Pacific Northwest laboratory

. Richland, WA 99352 Prep:tred for Division of Radiation Protection and Emergency Preparedness Omce of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555 NRC FIN L1310 i

l 1

E I

Abstract In a study sponsored by the U.S. Nuclear Regulatory Commission (NRC), Pacific Northwest and applied a methodoiogy for deriving plant-specific risk based inspection guidance for the auxilia (AFW) system at pressurized water reactors that have not undergone probabilistic risk asses methodology uses existing PRA results and plant operating experience information. Existing PRA guidance information recently developed for the NRC for various plants was used to identi ure modes. His information was then combined with plant-specific and industry-wide component info failure data to identify failure modes and failure mechanisms for the AFW system at the selected pla Unit I was selected as one in a series of plants for study. The product of this effort is a prioritized l urcs which have occurred at the plant and at other PWRs. This listing is intended for use by NRC ins preparation of inspection plans addressing AFW risk.important components at St. Lucie U_.1 plan NUREG/CR-58%

iii

~

t Contents Summary....

iii l

introduction..

1.1 2

St. Lucie EFW System...

2.1 2.1 System Description...

2.1 2.2 S uccess Cr i t e r io n..........,.............................................................

2.3 2.3 Sys t e m De pe nde ncies...................................................................

2.3 2.4 Ope ra t io na l Co ns t r a in ts................................................................

2.3 3 Inspection G uidance for the St. Lucie EFW System...............................................

3.1 3.1 Risk Important AFW Components and Failure Modes.........................................

3.1 3.1.1 Multiple Pump Failures Due Tb Common Cause.........................................

3.1 3.1.2 %rbine Driven Pump IC Fails to Stat t and Run........................................

3.1 3.1.3 Motor Driven Pumps I A or IB Falls to Start or Run....................................

3.4 3.1.4 Pump 1 A or IB Unavailable Due to Maintenance or Surveillance..........................

34 3.1.5 Failure of Motor Operated Wives MV09-9. MV09 10. MV09 11, MV09-1L.....,...........

3.4 3.1.6 Manual Suction or Discharge Wives Fall Closed........................................

3.4 3.1.7 Leakage of Ilot Feedwater Through Check Wives......................................

3.5 3.2 Risk Important EFW System Walkdown *Pable..............................................

3.5 4 Gene ric Risk Insights from P ras.............................................................

4.1 4.1 Risk Important Accident Sequence involving AFW System Failures.............................

4.1 4.2 Risk Importar.t Component Failure Modes..................................................

4.1 5 Failure Modes Determined from Operating Experience.........................................

5.1 5.1 St. Lucie Experience.........

5.1 5.1.1 AFW Pump Control logic. Instrumentation and Electrical Pailures.......................

5.1 5.1.2 liigh AFW Pump BearingTbmperatures 5.1 5.1.3 Failate of AFW Pump Discharge Flow Control Wives to the Steam Generators.............

5.1 5.1.4 AFW W rbine 'llip and Throttle Wlve.................................................

5.1 5.1.5 AFAS and AFW Related Instrumentation..

5.1 5.1.6 C h e c k W ives........................................................................

5.2 5.1.7 H u m a n E r ro rs.......................................................................

5.2 5.2 Industry. Wide Experience.............

5.2 5.2.1 Common.Cause Entlures...

5.2 5.2.2 H u m a n E r ro rs...................................................................

5.4 5.2.3 Design! Engineering Problems and Errors..............................................

5.4 5.2.4 Component Failures.

5.5 6 Refe re nces..................,

6.1 v

NUREG/CR.5896

{

l

.-----------A

Figure Q

2.1 St. Lucie Auxilia ry Feed wate r................................................................

2.2 s

Table 4

l 3.1 Risk Important AFW System \\W!kdown Table.................................................

3.2 I

f J

4 i

i 4

1 1

J 1-i a

9

)

4 1

I J

f i

I

+

4 b.

f f

i

,t -

i vil NUREG/CR-58%

h J

q-

,,a ww,-y,m-,

--r-n

~. - -,

e

~.,

-.-rn.-~,-

g ye-..mua e

n-m.-+-e--,--

-_~

f 1

N Summary i

j This document presents a compilation of auxiliary feedwater (AFW) sptem ailure information which has licen r

screened for risk significance in terms of failure frequency and degradation e stem performance. It is a risk-i prioritized listing of failure events and their causes that are significant enough to warrant consideration in inspection planning at the St. Lucie Unit 1 Nuclear Power Plant. This information is presented to provide inspectors increased resources for inspection planning at St. Lucie Unit 1.

I The risk impor /_nce olvarious component failures modes was identified by analysis of the results of probabilistic risk assessments (PRAs) for many pressurized water reactors (PWRs). However, the component failure categories identi.

fled in PRAs are rather broad, because the failure data used in the PRAs is an aggregate of many indMdual failures 4

having a variety of root causes. In order to help inspectors focus on specific aspects of component operation, mainte-4 l

nance, and design which might cause these failures, an extensive review of component failure information was pet.

j formed to identify the rank and root causes of these componcnt failures. Both St. Lucie Unit I and industry-wide failure information was analyzed. Pailure causes were sorted on the basis of frequency of occurrence and seriousness j

of consequence, and categorized as common cause failures, human errors, design problems, or component failures.

4 This information is presented in the body of this cocument. Section 3.0 provides brief descriptions of these risk-important failure causes, and Section 5.0 presents more extensive discussions, with specific examples and references.

The entries in the two sections are cross-referenced. An abbreviated system walkdown table is presented in Section 3.2 that includes only components identified as risk important. This tat le lists the system lineup for normal, standby system operation.

i This information permits an inspector to concentrate on components important to the prevention of core damage.

I 110 wever,it is important to note that inspections should not focus exclusively on these components. Other compo.

nents which perform essential functions, but which are not included because of high reliability or redundancy, must also be addressed to ensure that degradation does not increase their failure probabilities, and hence their risk importance.

Due to the similarity of badup emergency teedwater systems, industry wide data from both Westinghouse and Com-bustion Engineering design nuclear plants was used in the development of this document. Because of the difference in I

terminology between the two designs, auxiliary feedwater system (AFW) and emergency feedwater system (EFW) may both be found in this document and used to refer to a plants' emergency backup feedwater system.

J r

ix NUREG/CR-5896 e

-,--- - - +

w

---

t.,

.-ys-+

.,-.7--

+ce,w-

,v ve u-

.-p.

m-e ew e

es,-

w-

,- vr y m

l 1

1 Introduction 4

This document u one c.f a series providing plant specific The remainder of the document describes and discusses 4

l inspection guitmcc for auxiliary feedwater (AFW) sys-the information used in compiling this inspection guid-tems at presurized water reactors ""WRs). This guid-ance. Section 4 describes the risk importanec informa-ance Wsed on information from probabilistic risk tion which has been derived from PRAs and its sources.

ass,ssments (PRAs) for similar PWRs, industry-wide As review of that section will show, the failure cate-o[ crating experience with AFAV systems, plant-specific gories identified in PRAs are rather broad (e.g., pump AISV system descriptions. and plant-specific operating fails to start or run, valve fails closed). Section 5 addres-crperience. it is not a detailed inspection plan, but ses the specific failure causes which have been combined i

rather a compilation of AFW system failure information under these categories, which has been screened for risk significance in terms of failure frequency and degradation of system perform-AFTV system operating history was stuul to identifv a

l ance. The result is a risk prioriti7ed listing of failure the various specific failures which have been aggiegated events and their causes that are significant enough to into the PRA failure mode categories. Section 5.1 pre-warrant consideration in inspection planning at sents a summary of St. Lucie 1 failure information, and St. Lucie Unit 1.

Section 5.2 presents a review of industry-wide failure information. The industry-wide information was com-l Dis inspection guidance is presented in Section 3, piled from a variety of NRC sources, including AEOD i

following a description of the St. Lucie Unit 1 AIAV analyses and teports,information notices, inspection system in Section 2. Section 3 identifics the risk and enforcement bulletins, and generic letters, and from important system componen's by St. Lucie Unit 1 iden-a variety of INPO reports as well. Some Licensec Event tification numbers, followed by brief descriptions of Reports and NPRDS cvent descriptions were also re-cach of the various failure causes of that component.

viewed. Finally,information was included from reports l

Dese include specific human errors, design deficiencies, of NRC-sponsored studies of the effects of plant aging, and hardware failurcs. The discussions also identify which include quantitative analyses of reported AITV where common cause failures have affected multiple, re-system failures. This industry-wide information was 4

dundant components. These brief discussions identify then combined with the plant-specific failure informa-4 specific aspects of system or component design, opera-tion to identify the various root causes of the PRA faii-tion, maintenance, or testing for inspection by observa-ute categories, which are identified in Section 3.

J tion, records review, training observation, procedures -

review, or by observation of the implementation of pro-cedures. An AFW system walkdown table identifying 4

risk important components and their lincup for normal, standby system operation is also provided, d

i 1.1 i,UREG/CR-5896

=

1 2 St. Lucie Unit 1 AFW System This section presents an overview description of the driven AMV pumps (IB and 1A), while an independent -

St. Lucie Unit 1 AFW system, including a simplified supply header provides suction for the turbine driven schematic system diagram. In addition, the system pump (IC). Control, and instrumentation associated success criterion, system dependencies, and adminis-with each pump are independent from one another.

l trative operational constraints are also presented.

Steam for the turbine driven pump is supplied by each of the two main stearn lines from a point between the containment penetration and the main steam isolation 2.1 Systent Description vahes. Each of the steam supply lines to the turbine has a motor-operated steam supply valve. The steam from The AFW system provides feedwater to the steam gen.

cither supply line is directed to the turbine sia a trip and i

crators (SG) to allow secondary-side heat removal from throttle valve and a governor vahc. The motor operated the primary sptem when mam feedwater is unavailable.

steam supply ulve, the trip and throttle valve, and the The system is capable of functioning for extended mntrols to the governor are supplied with power from periods, which allows time to restore main feedwater an em;rgency DC power source. Each ABV pump dis-flow or to proceed with an orderly cooldown of the plant charge is designed with a recirculation flow path to pre-to where the shutdown cooling sptem (SCS) can re, vent pump deadheading. Flowrate of the recirculation move decay heat. A simplified r.chematic diagram of the flowpath is restricted by a flow limiting orifice to ensure AFW system is shown in Figure 2.1.

adequate AFW supply is provided for heat removal when needed. Each auxihary feedwater pump discharge f

The AFW system is controlled automatically by an is provided with a check vahe and a locally operated Auxiliary Feedwater Actuation Signal (AFAS). Initi, isolation vahc. The Auxihary Feedwater System dis-ation of an AFAS automatically actuates the AFW charge piping and vaMag arrangement is designed with sptem to provide an AFW supply to the steam gener-the Geribility to allow any pump to supply feedwater to ators on low steam generator water level. When an either or both steam generators. De supply lines te AFAS signal is generated, the turbine-driven pump and each steam generator are provided with control vahes to the motor-driven pump supplying the steant generator ensure isolation of a faulted steam generator and the in a low level condition, are automatically started. 'Ib continued feeding of the non-faulted steam generator.

deliver Dow to the affected steam generator, auxiliary The feedwater valves to the S/Gs associated with the feedwater flow control valves receive an open signal.

steam driven AFW pump (MV09-12 and MV-09-11)

When steam generator level is regained and levelis have DC motor operators which are powered from greater than the AFAS actuation setpoint, the flow Emergency DC Buses. He feedwater valves to the S/Gs control valves will receive a chne signal. The actuation associated with the AC motor driven AFW pumps circuit will operate as described unless a steam gener, (MV-09-9 and MV-09-12) are AC motor operated ator is determined to be ruptured, as defined if a low valves which are powered from vital AC buses.

water level trip is accompanied by either a steam gener-ator delta pressure or a feed water header delta pressure Unit 1 Condensate Storage Tank is the normal source of trip of the associated steam generator,and no rupture water for the AFW System and is requ! red to store suffi-cient demineralized water to maintain the reactor cool-has been detected in the other stcain genenator. The actuation circuit is designed to prevent the discharge of ant system (RCS) at hot standby wndklons for one (1)

AFW to a runtured steam generator.

hour tollowed by subsequent moldown to 325 E He CST and all interconnecting piping below the minimum The nortital AFW pump suction is from the condensate required reserve lev ' for emerEenev steam generator 1

storage tank. The system is designed with two (2) inde-feed is a Seismic Cla.. I system. A cross-tie from the pendent supply headers. One header sulmlies the motor 2.1 NUREG/CR-58%

't

~ -,,

r

--a-n r-g -

r i

AFW Sptem 2

,3 aa

~5g 0

$e g

sa a

i i

B E

5 0

d9 m

bcN D4 5

B B

E 5

+o d<M A

3 55 3

5:

g*,

g*4 3

U x

2 v=

a e

e s=f5 3

g

!s S

I g

e 7>-

g e'g

• -s

/w., y w.$

g g

~

-g>

g 8

8 m

r-ara a re a; r: a^ $

i..

E t s 'a s 's Le

=2 8

e E e.

B

.Em ms a

a 6

Q

=:

O 9

T N

3.

a a

T T

t N

.3 8

m s

e

.a 2

8 8 VE g

N78 8

d g

8 AE A5 k

E E

0 a

E i

5:

t"

@1 N V'n o

a w

4 xes Xi ei

'/

X!

Xi Xi W4 8

E

\\

5 b

D%

N Esss vE

• aEE

Ls 8"

()

)

V N

=

vs

=

Ag~

5 g

E t-o 5N NUREG/CR-5896 2.2 i

1 AFW System l

Unit 2 CST to the suction lines of Unit 1 AFW pumps, powered valves, and an automatic actuation signal. In provides a backup supply of demineralized water in the addition, the turbine-driven pump also requires steam event ofloss of Unit 1 CST availability.

2.2 Success Criterion 2.4 Operational Constraints Sptem success requires the 9peration of at least one When the reactor is critical the St. Lucie Unit 1, pump sup}nying rated Dow to at least one of the two

'Itchnical Specifications require that all AFW pumps steam generators, la this condition, the system is cup-and associated flow paths are operable with the motor.

able of decay heat removal *ufficient to allow placing the driven pumps powered from a separate, operable vital plant in a safe shutdow11 coualtion, bus and the turbine driven pump capable of being powered from an operable steam supply system. If one EFW pump bemmes inoperable, it must be rutored to 2J System Dependencies operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the plant must be in HOTSHUTnOWN within the next twelve hours.

The AFW system depends on train-4clated AC power for the motor-driven pump and associated flow control The St. Lucie Unit 1 Tbchnical Specifications require i

l and cross-connect valves. DC power is required for the condensate storage tank (CST) to be operable with a motor operated valves associated with the turbine minimum contained water volume of 116,000 gallons discharge flowpath, control power to pumps and DC available for use.

i h

i l

1 I

l l

2.3 NUREG/CR-5896 l

l L

I n

~*-eY m

w.

g y,

4y v-ev--9 3*

wr wwsq q-,

--p

1 3 Inspection Guidance for the St. Lucie AFW System In this section the risk important components of the Common Cause Failures, and each hem is keyed to St. Lucie AFW system are identified, and the important entries in that section.

modes by which they are likely to fall are briefly des-i cribed. These failure modes include specific human Incorrect operator intervention into automatic sys-errors, design problems, and types of hardware failures tem functioning, including improper manual start-which have been observed to occur for these types of Ing and securing of pumps, has caused failure of all components, both at St. Lucie and at PWRs throughout pumps, including overspeed trip on startup, and in-the nuclear industry. The discussions also identify ability to restart prematurely secured pumps. CC1.

where common cause failures have affected multiple, redundant components. These brief discussions identify Wlve mispositioning has caused failure of all specific aspects of system or component design, opera-pumps. Pump suction, steam supply,and instru-t"n, maintenance, or testing for observation, records ment isolation valves have been involved. CC2.

review, training observation, procedures resiew or by observation of the implementation of procedures.

Steam binding has caused failure of mult ple pumps.

This resulted from leakage of hot feedwatar past Table 3.1 is an abbreviated AFW system walkdown table check valves into a common discharge header, with 6ch identifles risk important components. This table several valves im'ohed including a motor-operated lists the system lineup for normal, standby system opera-discherge 521ve. CC7.

tion. Inspection of the components identified addresses essentially all of the risk associated with AFW system Pump control circuit deficiencies or design modifi-operation.

cation errors have caused failures of multiple pumps 3

to tuto o 7, spurious pump trips during operation, anc failures to restart after pump shutdown. CC3.

3.1 Risk important AFW Components inwrrect setpoints and control circuit calibrations h*** "" P'***"t'd "P*' P*'"'i

" f """i l*

P P

1 and Fa11ure Modes pumps. CC4.

Common.cause failures of multiple pumps are the most Loss of a vital power bus has failed both the turbine.

risk-important failure modes of AFW system compon.

driven and one motor-driven pump due to loss of ents. These are followed in importance by single pump control power to steam admission valves or to tur-failures, level control valve failures, and individual check bine controls, and to motor controls powered from vahr backleakage failures.

the same bus. CC5.

l The following sections address cach of these failure 3.1.2 'Ibrbine D" n Pump 'lC" Fnits to modes,in decreastng order ofimportance. ncy present 4

Start or Rur the important root causes of these component failure modes which have been distilled from historical records.

Each item is keyed to discussions in Section 5.2 which Improperly adjusted and inadequately maintained present additional information on historical events, turbine governors have caused pump failures both at St. Lucie and elsewl ere. HE2. Problems include 3.1.1 Multiple Pump Failures due to Common

"" '.1 sened nuts, set screws, linkages or cable connections, oil leaks and/or contamination, and se electrical failures of resistors, transistors, diodes and 2

circuit cards, and erroneous grounds and He following listing summarizes the most important connections. CF5.

multiple-pump failure modes identified in Section 5.2.1, i

4 3.1 NUREG/CR-5896

.,v

,---y wr--

- ~,

Inspection Guidance low lubrication oil pressure resulting from heatup "Ibtry turbines with Woodward Model EG gover. -

a nors have been found to overspeed trip if full steam due to previous operation has prevented pump flow is alkmed on startup. Sensitivity can be restart due to failure to satisfy tbc pretectjve reduced if a startup steam bypass valve is sequenced interlock. DES, to open first. DE1.

3.1.4 Purnps '1A" or 'IB" UnavaitaMe Duc

'Ibrbines with Woodward Model PG-PL governors to Maintenance or Surveillance have tripped on overspeed when restarted shortly after shutdown, un! css an operator has locally Both scheduled and unscheduled maintenance re-exercised the speed setting knob to drain oil from move pumps from operability. Surveillance requires the governor speed setting cylinder (per procedure).

operatiots with an altered line-up, although a pump Automatic oil dump valves are now available train may not be declared inoperable during testing.

through Tbrry. DE4.

Prompt scheduling and perfonaance of mainten.

Condensate slugs in steam lines have amused turbine overspeed trip on startup. 'Ibsts repeated right after 3.1.5 Failure of Motor Operated Valves such a inp may fall to indicate the problem due t V-09-9, M%09-10, M%09-11,M%09-12 warming and clearing of the steam lines. Surveil-lance should exercise all steam supply connections.

These motor operated valves control or isolate flow DE2..

from the AFW pumps to each of the steam generators.

Thrbine stop valve (!W. 08 3) problems which have They fail as-is on loss of power.

failed the turbine driven pump include physically -

Common-cause failure of MOVs has occurred at a

bumping it, failure to reset it following testing, and St. Lucie from failure to use electriceI signature failures to verify control room indication of reset.

HE2. _Whether either the overspeed trip or TIV tracing equipment to determine proper settings of trip can be reset vithout resetting the other,indi.

torque switch and torque switch bypass switches. -

Pailure to alibrate switch settings for high torque.

cation in the control room of TTV position, and unambiguous localindication of an overspeed trip necessary under design basis accident conditions has l

affect the likelihood of these errors. DE3.

also been invoNed._ CC8.

3.1.3 Motor Driven Pumps "1 A' or "1B" Fail At St. Lucie, valve failure has resulted from -

cerroded circuit components caused by environ -

to Start or Run mental conditions, l

l Control circuits used for automatic and manual Wlve motors have been failed due to lack of, or pump starting at: an important cause of motor improper sizing or use of thermal overload protec-driven pump faiures, as are circuit breaker failures.

tive devices; Bypassing and oversir.ing should bc l_

CF6. Contral cir.uit and breaker failures have been

- based on proper engineering for desien basis -

i experienced at St. Lucie-conditions. CF4.

l At St. Lucie, high pump bearing temperatere has Out.of. adjustment electrical flow controllers have been found due in part to loose bearings resulting caused improper discharge valve operation, affect.

l-from inadequate vendor tunintenance information.

ing multiple trains of AFW. CCl2.

i Mispositioning of handswitches and procedural a

. Grease trapped in the torque switch spring pack of j

l deficiencies have prevented automatic pump start.

Limitorque SMB motor operators has caused 'notor HE3.

burnout or thermal overload trip by preventing torque switch actuation. CF7.

NUREG/CR.5896 3.2

Inspection Guidance Manually reversing the direction of motion of oper-Pailure to verify support functions after ating MOVs has overloaded the motor circuit.

restoration.

Operating procedures should provide cautions, and 1

j circuit designs may prevent reversal before cach Pailure to adhere scrupulously to ade inistrative I

stroke is finished. DE7.

procedures regarding tagging, control and track.

ing of valve operations.

Space heaters designed for preoperation storage have been found wired in parallel with valve motors Failure to log the manipulation of scaled valves.

]

wMch had not been environmentally qualified with thera present. DE8.

Failure to follow good practices of written task i

assignment and feedback of task completion 3.1.6 Manual Suction or Discharge Valves Fail information.

Closed Failure to provide casily read system drawings, TD Pump *1C": Valves V12508. V09140 legible valve labels corresponding to drawings I.

V09158.V09152 and procedures, and labeled indications of local j

MD Pumn 'l A*: Valves V12498. V09108. V09120 valve position.

l MD Pump *1B': %Ives V12302. V09124. V09136 i

These manual valves are normally locked open. For 3.1.7 Leakage ofIlot Feedwater through each train, closure of the first valve listed would isolate Check Valves:

pump suction from all possible sources. Closure of the i

second valve would block all pump discharge to the Between Pump 'l A* and MFW: Wlves V09107 I

steam generatots. Closure of the third or fourth valve V09119 listed would result in the pumps inability to supply flow Between Pump *lB' and MFW: Wives V09123.

to at least one S/G.

V09135 Between Pump *1C* and MFW: Wives V09139

%1ve mispositioning has resulted iu failurcs of mul-V09157. V09151 tiple trains of AFW. CC2. It has also been the dominant cause of problems identified during oper-leakage of hot feedwater through several check ational readiness inspections. HEl. Events have valves in series has caused steam binding of multiple

)

occurred most often during maintenance, calibra-pumps. leakage through a closed level control tion, or system modifications. Important causes of valve in series with check valves has al3o occurred, mispositioning include:

as would be required for leakage to reach St. Lucic's AFW pumps. CC7.

- Failure to provide complete, cicar, and specific procedures for tasks and system restoration.

Slow leakage past the final check valve of a series may not force upstream check valve closed. Other

- - Failure to promptly revise and validate proced-check valves in series may leak similarly. Piping.

utes, training, and diagrams following sptem orientation and valve design are important factors modifications.

in achieving true series protection. CF1.

Pailure to complete all steps in a procedure.

3.2 Risk Important AFW System Failure to adequately review uncompleted procedural steps after task completion.

Walkdown Thble

' Table 3.1 presents an AFW sptem walkdown table including only components identified as risk important.

3.3 NUREG/CR-5896

Inspection Guidance The lineup indicated is for normal power operation.

but which are absent from this tab!c because of high -

'Ihis information allows inspectors to concentrate their reliability or redundancy, must also be addressed to efforts on components important to prevention of core ensure that their risk importances are not increased.

damage. Ilowever,it is essential to note that inspec-Examples include the an adequate water level in the tions should not focus exclusively on these comments.

CST, and the (closed) valves cross connecting the Other comFments which perform essential functions, discharges of the AIM pumps.

NUREG/CR-58%

3.4 i

,,,n.,-n a

.-~+.,,,,,,, -+ -...

Inspection Guidance hble 3.1 Risk Important ABY System Walkdown %ble Actual Component #

Component Name Required Position Position Bkr 1-20212 1 A AFW Pump Breaker Racked in/Open ControlPowcr Available Bkr 120412 IB AFW Pump Breater Racked In/Open Control Power Available 1 A Flownath-V12498 1 A AFW Pump Suction locked Open V09108 1A AFW Pump Discharge locked Open MV-09-9 1 A AFWlidt to 1A S/G Ckned VO9120 A AFW Hdr to 1 A S/G lsol.

Locked Open 1B Flowpath V12502 IB AFW Pump Suction Locked Open V09124 IB AFW Pump Discharge locked Open MV-0910 IB AFW Hdr to 1B S/G Closed V09136 B AFW Hdr to IB S/G isol, locked Open IC Flowpath V12508 1C AFW Pump Suction Locked Open V09140 1C AFW Pump Discharge

. Locked Open MV-09-12 C AFWIidr to IB S/G Closed MV-09-11 C AFW Hdr to I A S/G Closed V09158 C AFW Hdr to IB S/G lsolf locked Open V09152 C AFWIidt to 1A S/G lsol locked Open 3.5 NUREO/CR-58%

.l

Inspection Guidance Telaie 3.1 (contd)

Actual Component #

Compor.nt Name Requimi Position Ibition LQ_ Steam SurTJly V08164 MV4E14 Outlet isol.

Incked Open MV4&l4 IB S/G Supply to IC AIM Pump Closed V08144 MV-08-14 Outlet 1s01.

Locked Open V08113 MV4E 13 Outlet isol.

Locked Open MV4E.13 1 A S/G Supply to IC ATM Pump Closed V08131 MV418-13 Outlet isol.

Locke4 Opcn MV4&3 1C AIM Pump T and T Wlve Chised 2

Crop 41e Flowpath MV4nl4 B to A AIM Hdt Crou Tlc Closed 2-M V4

• 13 A in B AIM Hdt Cross Tle Closed CST kolation V12497 CST to INIB AIM Pumps incknl Open V12506 cst to IC AIM Pump locked Open V12177 Unit 2 CST to INIB AIM Pumps Incked Closed i

V12175 Unit 2 CST to IC AIN Pump locked Closed Qeck Whn V09107 Piping Upstream of Check Whc Cool V09123 Piping Upurcam of Check Who Cool V09139 Piping Uptream of Check Wlve Cm; C

NUREG/CR-5896 3.6

I 4 Generic Risk insights from PHAs t

PRAs for 13 PWRs were analyred to identify tisk-provide feedwater from otteer sources, and fall to important accident sceuences invoking kiss of AFW initiate ferd-and-bleed moling, resulting in core and to identify and ris t. priorf tlic the compon.nt faihire damage,.

modes imched. %c icsults of this analysis are des.

cribed in this section. Rey are consistent with results A low of main feedwater trips the plant, and AIM reported by INEL and IINL (Gregg et al.1988, and fa!!s due to operator error and hardware failures.

' Davis et al 1988).

De operntors fall to initiate feed and bleed cooling, resultingin core damage.

4.1 RiskImportant Accideilt Sequences sicam oenerator1bbe Runture Inmiving AFW System Failure

- A soTR is fonowed by fauure of AFW, Coolant is Ims of Power Swtem lost from the primary until the RWST is depleted.

IIPl falls since recirculation cannot be established A lou of offsite power is followed by failure of AFW. Due to lack oractuating power, tbc PORVs cannot be opened, preventing adequate feed.and.

bleed cooling, and resulting in core damage.

4.2 Risk ImEortant ComI>onent Failure Modes A station blackout falls all AC power except Vital AC from DC invertors, and all decay heat removal The generic mmponent failu'c modes identified from sptems except the turbine-driven AFW pump.

PRA analyses as important to AFW system failure are AFW subsequently fails due to battery depletion or listed below in decreasing order of risk importance.

hardware failures, resulting in core damage.

1. 'Ibtbine Driven Pump Failure to Start or Ruso A DC bus fails, causing a trip and failure of the power conversion system. One AFW motor-driven 2.

Motor Driven Pump Failure to Start or Run.

[

pump is failed by the bus los,, and the turbine-l driven pump fails due to loss of turbine or valve 3,

TC'F or MDP Unavailable due to 'Rst or L

control power. AFW is subsequently lost com.

Maintenance.

l pictely due to otler failures. Fced-and bleed ccol-ing falls because PORV control is lost, resulting in 4,

AFW System %1ve Failures core damage.

• - steam admissionvalves

'Ransient Caused Reactoror*ItirbineTrin trip and throttic valve A transient-caused trin is followed by a less of PCS

+

and AFW, Feed.and-bleed moling fails r.;mer due flow controlvalves to failure of tbe operator to initiate it,or due to

. hardware failures, resulting in mre damage.

' pump discharge valves loss of Main Feedwater pump suction valves A feedwater line break drains the mmmon water

• - valves in testing or maintenance.

source for MFW and AFW. The operators fall to 4.1 NUREO/CR-58%

e i

t

[-,. y. -

+

+v e.-m_,...m.

- -,-v.m.~

-,-._.,w_,

.m..-,v,...,,r,,..mmw%,,,,-,w.cm,.

,,.,m,c-#.g.,#3 y+w,mve3,.,..-,

o 3 -,

,.p.

,y

,9-.,

,, + -,,, -.

Ocnetic Risk Insights 5.

Supply / Suction Sources from emnmon tacses and hum 9n enom. Common-mux failures of AFW pumps are particularly risk condertsate atotage tank stop valve

- important. Whc fallu,tes arc somcwiaiicsi importatit duc to the multiplMt) of steatu yncrators and connec-hot well inventory tion paths. Ilutnan errors of greatest risk importana t svohc: faltures to initiate or control system operation suction vakes, when required; failure to restore proper s)sicm lineup a

aftet main'enancn or testing; and failure to switch to in addition to indhidual hardwaf e, circuh, of instru.

alternate murces wlxn rquired.

nient failures,cach of these failure modes thay result i

a s

n 4

. NUREG/CR-5896

- 4.2 i

wn,

..wn.a.

l

(

5 Fniture Mocles Deterrninett froni Opernting Experience his section ducribes the primary root causes of S.1.2 Illgh AITY Pump 11 caring Tbmixrntures component failures of the AFW system, as determined from a rniew of operating historin at St. Lucie Unit i liigh bearing temperatures were found on one AFW and at other pWRs throughout the nuclear industry.

pump, and bearing damage was also found when the Section 5.1 describes experience at St. Lucie ' Unit 1.

Other A W pumps were subsequentlyinspected. He Section 5.2 summarires information compiled from a problem was traced to loose bearings resulting from variety of NRC sources, including AEOD analp.es and inadequate vendor information addressing pump reas-reports,information notices, inspection and enforco-sembly cfter ma ntenance. Maintenance pmcedures ment bulletins, and generic letters, and from a variety of have been modified, climinating this potential wmmon INPO reports as well. Some Licensec Event Reports cause mode of pump failure.

(LERs) and NPRDS cvent descriptions were also reviewed. Fmally,information was included from S.I.3 Failure of AITY Pump Discharge Flow reports of NRC-spcmsored studies of the effects of plant Control Valves to 'lhe Steam Generators aging, which include quantitative analyses of AFW system failure reports. His information was used to idenufy the vanous root causcs expected for the broad Eighteen (18) failures of tbc AFW pump dhcharge flow control valves were found in the events examined.

PRA-based failure categories identified in Section 4, nese resulted from failures of valve control circuits, resulting in the inspection guidelines presented in Secuon 3.

valve operators and valve breakers. Failures have resulted from DC control grounds, valve binding, dirty or worn er ntacts, improper torque -witch operation, electrical wmp(ment failure, frayed wiring, and valve 5.1 St. Lucie Unit 1 Experience operator mechanical failure. Failure causes are mechanical wear, contact oxidation, inadequate or fifty four (54) reports of AFW system equipment fail.

Improperly performed maintenance or testing activities urcs at St. Lucie between 1982 and 1990 were reviewed.

and improper design and/or installatiori.

Rese include failures of the AFW pumps, pump dis.

charge flow control valves to steam generators, and 5.1.4 AITV'nirbine THp and Throttle Ynive pump suction and discharge valves.' Failure modes i

include electrical,instrutncntation, hardwarc f ailures, Drec (3) failures of the AFW Trip and nrottle salve and human errors.

were found in the events examined. Dese failurcs resulted from solenoid failure, misadjusted limit 5.1.1 AITY Pump Controllenic.

switches,and trip linkage failure, niilure cause.t are instrumentation and Elec6rient Failures mechanical wear, component aging, and inadequate maintenance or testing activitics.

Seven (1) failures of the AFW pumps to start, run, trip when required or achieve rated speed ute found in the 5.1.5 AFAS and AINY Related events examined. Dese occurrences resulted from fail-Instrumentation ces of the turbine governor, breakers, relays and con-tacts, turbine overspeed device, faulty wiring and power F ftcen (15) failures related to AFAS or system status supplies. He feiture causes are mechanical wear, type instrumentation were found in the events corrosion, or improper design and installation.

5.1 NUREO/CR-5&X2 m. -

Ibiture Modes examined. Dese failures resulted from electrical com.

and mmponent failurcs have been less frequent, but piment failure, bistable card failure and electrical nevertheless significant, causes of m citiple train failures.

grounds. Failure causes are normal aging. corroded

[ft, '{uman error in the form ofincorrect operator l

ter minals, water intrusion in cable runs and trans-initters, and inadequate component cooling.

intervention into automatic ETAV sptem functioning during transients resulted in the temporary loss of all 5,1.6 Check Valves safety grade AIAV pumps during eser ts at Davis Besse (NUREO.ll541985) and 'Rojan (AEOD/T4161983).

Seven (7) cvenh of check valve failure were found in the in the Davis Besse event, improper manualinitiation of events examined. in all but a few cases normal wear and the steam and icedwater rupture control system aging was cited as the failure mode, resulting in leakage.

(SFRCS) led to overspeal tripping of both turbine-driven AIAV pumps, probably due to the introduction of 5.1,7 Ilumnn Errors mndensate into the AFW turbines from the long, unheated steam supply lines. (De stem had never been tested with the abr >rmal, cross-amnected steam Several events rehting directly to significant human crtars affecting the AIAV system were found in the supply lineup which resulted.) in the Trojan event the events examined. Wlve operators have been installed operator incorrectly stopped both AFW pumps due to incorrectly or damaged after maintenance activities.

misinterpretation of MIAV pump spcalindication. De improper adjustmeut of v thc components has resulted dicsci driven pump would not restart due to a protective in valve binding and motor damage. Improperly feature requiring complete shutdown, and the turhine-adjusted torque switches, and equipment failurn due to driven pump tripped on overspeed, requiring h> cal reset air in hydraulic lines has resulted in equipment failure of the trip and throttle vahc. In cases where manual or decreased operability. Ikith personnel ctror and intervention is required during the early stages of a inadequate procedures have been involved.

transient, training should emphasize that actions should be performed methodically and deliberately to guard against such errors.

5.2 Industry Wide Experience m %!ve mispositioning has accounted for a signifi-cant fraction of the human ctrots falling multiple trains Iluman errors, design /engineerint. poblems and errors, of AIAV. *lhis includes closure of normally open auction and co.nponent failurcs are the primary root causes of valves or steam supply valves, and of isolation valves to AIAV System failures identified in a review of industry sensors having control functions. Incorrect handswitch wide system operating history Common-cause failures, positioning and inadequate temporary wiring changes which disable more than one train of this operationally have also prevented au'omatic starts of multiple pumps.

redundant system,are highly risk significant and can Ibetors identified in studies of mispositioning errors result from all of these causes.

include failure to ndo newly installed valves to valve checklists, weak administrathc control of tagging, This section identifics important common cause failure restoration,indepetident verification, and locked valve modca, and then provides a broader discussion of the logging, and inadequate adherence to procedures. lileg-single failure effects of human errors, design /

- ible or confusing local valve labeling, and insufficient engineering problems and errors, and component fail-training in the determination of valve position may ures. Paragraphs presenting details of these failure cause or mask mispositioning, and sune". lance which modes are coded (e.g., CCl) and cross. referenced by does not exercise complete sptem functioning may not inspection items in Scrtion 3.

reveal mispositionings.

5.2.1 Common Cause Fnilures

[fl Design /coginecting errors have accounted for a De dominant cause of AISV system multiple-train fall-urcs has been human error. Design /eng necting errors NUREG/CR-58%

5.2

__J

Pallure Modes failures. Problems with control circuit design nullfi-CC7. Common cause failures have also been caused by cations at Rirley defeated AIM pump auto start on loss component failures (AEOD/C4441984). At Surry-2, of main fccdwater. At Zion 2, restart of bot! 'aotor loth the turbine driven pump and one motor driven driven pumps was bkicked by circuit failure to dcener+

pump were declared inoperable due to steam binding rire when the pumps had been tripped with an auto-caused by backleakage of hot water through multiple matic start signal present (tN 82-01 1932). In addition, check valves. At Robinson 2 toth motor driven pumps AIM control circuit design reviem at Salem and Indian were found to be hot,and both motor and steam drhen Point have identified designs where failures of a single pumps were found to be inoperabic at different times.

component could have failed all or multiple pumps 11ackleakage at Robinson 2 passed through closed (IN 87 341987).

motor +perated 1 olation valves in addition to multiple check valves. At Rirley, both motor at:d turbine driven CC4. Itarrect setpoints and controlcircuit settings pump casings were found hot, although the pumps were resulting from analysis errors and failures to update not declared inoperabic, in addition to multi-train fall.

procedures have also prevented pump start and caused ures, numerota incidents oisingle train failurcs have a

pumps to trip spuriously. Errors of this type may occurred, resulting in the designatiot, of " Steam Binding remain undetected despite surveillance testing, unless of Auxiliary Redwater Pumps

• as Generic issue 93.

surveillance tests model all types of system initiation.

His generic issue was resolved by Generic letter 88-03 and operating conditions. A greater fraction ofinstru.

(Miraglia 1988), which required licensecs to monitor mentation and control circuit problems has beer. Identi.

AIM piping temperatures cach shift, and to maintain fled during actual system operation (as opposed to sur-procedures for recogninng steam binding and for veillance testing) than for other types of failures.

testoring system operability.

CCS On two occasions at a foreign plant, failurc of a M Common cause failures have also failed motor balance-of plant inverter caused failure of two AIM operated valves. During the totalloss of fecdwater event pumps. In addition to kiss of the motor driven pump at Davis Besse, the normally-open AIM isolation valves whose auxiliary start relay was powered by the invettor, failed to open after they were inadvertently closed. De the turbine driven pump tripped on overspeed because failure was due to improper setting of the torque switch the governor valve opened, allowing full steam flow to bypass switch, which prevents motor trip on the high the turbinc. Dis illustrates the importance of assessing torque required to unscat a closed valve. Previous the effects of failurcs of balance of plant equipinent problems with these valves had been addressed by which supports the operation of critical components.

Increasing the torque switch trip setpoint.-a fix w hich De instrument air system is another example of r uch a failed during the event due to the higher torque required system.

due to high differential pressure across the valve.

Similar common mode failures of MOVs have also CCli. Asiatic clams caused failure of two AIM flow occurred in other systems, resulting in issuance of controlvalves at Catawba-2 when low suction pressure Generic letter 89-10,

• Safety Related Motor-Operated caused by starting of a motor driven pump caused

%1ve 7tsting and Surveillance (Partlow 1989).* His suction source realignment to the Nuclear Service generic letter requires licensecs.to develop and imple-Water system. Pipes had not been routinely acated to -

ment a program to provide for the testing, inspection inhibit clam growth, not regularly monitored to detcet and maintenance of all safety related MOVs to provide their presence, and no straincts were installed. The assurance that they will function when subjected to need for surveillance which exercises alternative sy5 tem design basis conditions.

operational modes, as well as complete system function-ing, is emphasized by this event. Sput.aus suction CC9. Other component failures have also resulted in switchover has also occurred at Callaway and at AFW multi train failures. ncsc include out-of-McGuire, although no failurcs resulted.

adjustment cicettical flow controllers resulting in 5.3 NUREG/CR-58%

Pauurc Modes improper discharge valve operation, and a tallure of oil overspeed trips have been caused by slow response of a Woodward Model EO overnor on startup, at plants nioler cooling water supply valves to open due to sitt E

accumulation.

w here full steam flow is allowed immediately. His over.

sensitivity has been ternoved by installing a startup 5.2.2 liuman Errors steam bypass valve which opens first, allowing a con-trolled turbine accelcretion and buildup of oil pressure lih %c overwhelmingly dominant cause of problems to controlIhe governor valve when full sicam flow is t

identified during a scrics of operational readiness admitted.

cvaluations of AFW sptems was human performance.

He majority of these human performance problems DE Overspeed trips of'Rrry turbines have been resulted from incomp9te and incorrect pnicedures, caused by condensate in the sicam supply Imes. Con.

particularly with respect to valve lineup information.

densate slows down the turbine, causing the governor A study of valve mispositioning events invohing human valve to open farther, and overspeed results before the error identified failures in administrative control of governor valve can respond, after the water slug clears.

tyging and logging, procedural compliance and mm.

R'i was determined to be the muse of the loss-of all.

pletion of steps, verification of support sptems, and AFW event at Davis Besse (AEODAB21986), with con-inadequate procedures as important. Another study densation enhanced due to thelonglength of the cross-found that vahe mispositioning events occurred most wnnected steam lines Repeated tests following a cold.

often during maintenance, calibration, or tuodification.

start trip may be successful due to system heat upi acthitics. Insufficient trainingin determiningvalve position, and in administrative requirements for DE3.1brbine trip and throttic valve (TTV) problems controlling valve positioning wtre important causes, as are a significant cause of turbine driven pump failures was oral task assignment without task completion (IN 84-66). In r,ome cases lack of TTV position indica.

feedback.

tion in the control room prevented recognition of a tripped TTV, in other cases it was possible to reset ilE2. Turbine driven pump failures have been caused by cither the overspeed trip or the TTV without resetting human errors in calibrating or adjusting governor speed the other. His problem is compounded by the fact that l

control, poor governor rnaintenance, incorrect adjust.

the position of the overspeed trip linkage can be mis.

ment of governor valve and overspeed trip linkages, and leading, and the mechanistu may lack labels indicating errors associated with the trip and throttic valve. TTV.

when it is in the tripped position (AEOD/C6021986).

associated errors include physically bumping it, failure j

to restore it to the correct por,ition after testing, and DE4. Staitup of turbines with Woodward Model PG-failures to verify control room indication of TTV posi.

PL governors within M minutes of shutdown has t

(

tion following actuation.

resulted in overspeed trips when the speed setting knob was not exercised kically to drain oil from the speed HE3, Motor drhen pumps have been failed by human setting cylinder. Speed control is based on startup with l

crrors in udspositioning handswitches, and by procedure an empty cylinder. Problems have involved turbine deficiencies.

rotation dec to both prscedure violations and leaking steam. Tbtry has marketed two types of dump valves for 5.2.3 Design / Engineering Problems and automatically draining the oil after shutdown Ermrs (AEOD/C6021986).

en s, a tepcment DE1. As noted above, t>c majority of AFW subsptem failures, and the greatest t ' lathe sptem degradation, sc@cd a W,mM stanup that resuhed in ym, e has been found to result fn 'm tuteine-driven pump fail-trip uc toNgmcrnos stabiUty proNems. De n crm c n ah was m, stanadon of stWr utes. Overspeed trips of *ll try turbines controlled by -

Woodward governors have ocen a significant source of buffer springs (IN 88-091988). Surveillance had alwap these failures (AEOD/Cu 21986). In many cases these en prece e ne wmp, c

ustrates the NUREG/CR 5896

$.4

~

Ibilure Modes iroportance of testing which duplicates service maintenance of all safety related MOVs. "nermal conditions as much as is practical.

Oscilnad Protection for Electric Motors on Safety-Related Motor Operated Valves - Generic luue !!.E.6.1 pf1 Reduced viscosity of gear tus oil bested by prior (Rothberg 1988)' concludes that valve motors should be operation caused failure of a motor driven pump to start thermally protected,yet in a way which emphasizes due to insufficient lube oli pressure. lxwering the splem function over protection of the operator.

pressure switch setpoint solved the problem,whic!) had not beeti detected during testing.

CE The m.nmoncuse steam binding effects of check valve leakage were identified in Section 5.2.1, entry Dfli Waterhammer at Palisades resulted in Al~W line CC10. Numerous single train events provide additional and hanger damage at both steam generators. De AIT insights into this p.oblem. In some cases leakage of hot spargers are located at the norrnal steam generator level.

MIN pau multiple check verves in series has occurred and are frequently covered and uncovered during lesel because adequate valve. seating pressure was limited to fluctuations. Waterhammers in top. feed ring steam the valves closest to the steam generators (AEOD/C4N generators resulted in main feedline rupture at Maine 1984). At Robinson, the pump shutdown procedure was Yankee and feedwater pipe cracking at Indian Point 2 changed to delay ch> sing the MOVs until after the check (IN 84-321984).

valves were scated. At Ibricy, check valves were changed from swing type to lift typc. Check valve pE7. Manually reversing the direction of rnotion of an rework has been donc at a number of plants. Different i

operating valve has resulted in MOV failures where valve designs and manufacturers are involved in this l

such loading was not considered in the design problem, and recurring leakage has been uperienced.

(AEOD/C6031986). Controlcircuit design may prevent even after repair and replacement.

this, requiring stroke completion before reversal.

CF2. At Robinson, heating of motor operated valves by DFX At cach of the units of the South Taaa Project, check valve leakage has caused thermal binding and fall-space heaters provided by the vendor for use in pre-ute of ATM discharge valves to open on demand. At installation storage of MOVs were found to be wired in Davis Besse, high differential pressure across AFW parallel to the Clau 1E 125 V DC mo' ors for several injection valves resulting frors check vahc leakage has AFW valves (IR 50-489M9 11; 50499/89 11 1989). De prevented MOV operation (AEOD/C6031986).

valves had been erwironmentally qualified, but not with the non safety-related heaters energired.

CF3. Gross check valve leakage at McGuire and Robinson causcd overpressurization of the AFW sue.

5.2.4 Comp < merit Failures tion piping. At a foreign PWR it resulted in a severe waterhammer event. At Palo Verde-2 the MFW suction Generic issue ll.E.6.1, *In Situ 1bsting Of Wives

• was piping was overpressurized by check vale leakage from

~

divided into four sub-issues (Beckjord 1989), three of tht. AFW system (AEOD/C4N 1984). Gross check which relate directly to prevention of AFW system valve leakage through idic pumps represents a potential component failure. At the request of the NRC,in situ diversion of AFW pump flow.

testing of check valves was addressed by the nuclear industry, resulting in the EPRI report,' Application Qi Roughly one third of AFW >ystem failuses have Guidelines for Check Valves in Nuclear Power Plants been due to valve operator failures, with almut equal (Brooks 1988).* This extensive report provides failures for MOVs and AOVs. Almost half of the MOV information on check valve applications, limitations, failures were doc to motor or switch failures (Casada and inspection techniques. In situ testing of MOVs was 1939). An extensbc study of MOV cvents (AEOD/C603 addressed by Generic Irtter 8910,' Safety Related 1986) indicates continuicg inoperabili'y problems Motor Operated Valve Testing and Surveillance' caused by: torque switch / limit switch c.:ttings, (Partlow 1989) which requires licenwes to develop and adjustments, or failures; motor burnout; improper sizing impleacnt a program for testing, inspection and or use of thermal ovcitoad devices; prematurc 5.5 NUREG/CR 5896 -

Failure Modes degradation related to inadequate use of protective NEBULA EP-C,rcase,one of only two greases con-desices; damage due to misuse (valve throttling, valve sidered emironmentallyqualified by Limitorque. Duc operator hammeringh mechanical problems (loosened to lower viscosity,it slowly migrates from the gear case parts, improper assembly); or the torque switch bypass into the spring pack. Orcase changeover at Vermont circuit improperly installed or adjusted. The study Yankee affected 40 of the older MOVs of which 32 were concluded that current methods and procedates at many safety related. Orcase ret:cf kits are needed for MOV plants are not adequate to assure that MOVs will operators manufactured before 1975. At Limerick, operate when needed under credible accident cor di-additional grease relief was required for MOVs manu-tions. Specifically, a surveillance test which the valve factured since 1975. MOV refurbishment programs may passed might result in undetected valve inoperability yield other changeovers to EP-0 grease, due to component failure (motor burnout, operator parts failure, stcm disc separa' ion) or Improper posi.

CFM. Nr sptems using AOVs, operability requires the tioning of protective deviers (thermal overload, torque availability of instrument Air, backup air, or backup switch, limit switch). Generic Letter 89-10 (Partlow nitrogen. Ilowever, NRC Maintenance'Itam Itapec.

1989) has sutecquently required licenseca to implement tions have identiflu! inadequate testing of check valves a program ensuring that MOV switch settings are main-isolating the safety-rclated portion of the (A sptem at tained so that the valves will operate under design basis several utilitics (1xtter, Roe to Richardson). Generic conditions for the life of the plant.

Letter 88-14 (Miraglia 1988), requires licensees to verify -

by test that alt-operated safety-related components will CF5. Component problems have caused a significant perform as expected in accordance with all design-basis number of turbine drhen pump trips (AEOD/C602 cvents, including a loss of normal IA.

1986). One group of events involved worn tappet nut faces, hose cable connections, loosened set screws, CTV For AFWsystems using air operated valves, improperly latched TIVs, and improper assembly.

almost half of the $ptem degradation has resulted from Another involved oil leaks due to :amponent or scal failures of the valve controller circuit and its in trument failures, and oil contaminatior, due to poor maintenance inputs (Casada 1989). Failures occurred predominantly aethitics. Governor oil may not be shared with turbine at a few units using automatic clectronic controllers for lubrication oil, resulting in the need for separate oil the flow control vahes, with the majority of failures due changes. Electrical component failures included tran-to electrical hardware. At 'Ibrkey Point-3, controller si, tor or resistor failures due to moisture intrusion, malfunction resulted from water in the Instrument Air erroncous grounds and ccmnections, diode failures, and

- sptem due to maintenance inoperabih:y of the air a faulty circuit card.

dryers.

CF6. Control circuit failurcs were the dominant source CF10 For sptems using dicsci driven pumps, most of of rnotor drhen AFW pump failures (Casada 1989).

the failures were due to start control and governor speed This includes the controls used for automatic and control circuitry. Half of these occurred on demand, as nu.noal starting of the pumps, as opposed to the instru-oppo cd to during testing (Casada 1989).

mentation inputs. Most of the remaining problems were due to circuit breaker failures.

CFl1. Wr systems using AOVs, operability requires the availability of instrument Air, backup alt, or backup CF7. "liydraulic lockup

• of Limitorquc SMB spring nitrogen.110 wever, NRC Maintenance 'Ibara inspec-packs has prevented proper spring compression to tions have identified inadequate testing of check valves actuate the MOV torque switch, due to grease trapped isolating the safety-related portion of the IA system at in the spring pack. During a surveillance at 'Rojan,-

several utilitics (letter, Roc to Richardson). Gencric failure of the toique switch to trip the TIV motor letter 8814 (Miraglia 1988), requires licensees to verify resulted in tripping of the thermal overload device, by test that air-operated safety-related components will leaving the turbine driven pump inoperable for 40 days perform as expected in accordance with all design. basis until the next surveillance ( AEOD/E7021987).

(vents, including a loss of normal IA.

Problems result from gicase changes to EXXON NUREG/CR 58%

5.6

- ]

6 References Beckjord, E S. Juoc 30,1989. Closcout ofGenericIssue AEGD Reports ll.E.61, 'In Situ Testingof Ialves*. lxtter to V. Stello, Jr., U.S. Nuclear Regulatory Commission, hhington, AEOD/C404. W. D. lanning. July 1984. Steam Binding DC ofAutillaryFeedwaterPumps. U.S. Nuclear Rcgulatory Commission, Whington, DC Brooks, B. P.1988. Application Guidelinesfor Check Valves in NuclearIDwer Plants. NP 5479, Elcetric AEODIC602. C 1isu. August 1986. Operational Power Research Institute, Palo Alto, California.

ErperienceInvolving 7hrbine Overspeed Rips. U.S.

Nuclear Regulatory Commission, Washington, DC Casada,D. A.1989. AuriliaryFredwaterSystem Aging Study l'olume 1. Operating Erperience and Current AEODlC603. E J. Btown. Deccmber 1986. A Review AfonitcwingPractices. NUREGICR-5461. U.S. Nuclear ofAfotor-Operated l'alveIrrformance. U.S. Nuclear Regulatory Commission, Washington, DC Regulatory Commission, Washington, DC.

Gregg, R. E, and R. E. Wright.1988. Appendir Review AEOD/E702. E.J. Brown. March 19,1987 Afol' for Dominant Generic Contributors. BLB-31-88.1dano Failure Due to ilydraulic Lockup From Ercessive Grease National Enginecting Laboratory, Idaho Ibils, Idaho.

in Spring Pack. U.S. Nuclear Regulatory Commission, Washington, DC Miraglia, E J. February 17,1988. Resolution of Generic Safety issue 93, ' Steam Bindmg ofAuriliary Feedwater AEODIT416. January 22,1983. Loss of ESFAuxiliary Pumps'(Generic Lener88 03). U.S Nuclear Regulatory Feedwater Pump Capability at hojan on January 22, Commission, Washington, DC 1933. U.S. Nuclear Regulatory Commission, hhington, DC Miraglia, E J. August 8,1988. Instrument Air Supply System Problems Affecting Safety-Related Equipment Information Notices (Generic Letter 8814). U.S. Nuclear Regulatory Commission, Washington, DC

_ IN 82-0l. January 22,1982. Auriliary feedwater Pump.

Lockout Resultmgfrom ifistinghouse W 2 Switch Circuit Partlow, J. O. June 28,1989. Safety-Related Afotor.

Afodification. U.S. Nucicar Regulatory Commission.

Operated Valve Testing and Surveillance (Generic Letter Washington, DC 89-10). U.S. Nuclear Regulatory Commission,

. Whington, DC IN 84-33. E L Jordan. April 18,1984. Auriliary FeedwaterSpargerandPipe flangarDamage. U.S.

Rouerg, O. June 1938. ThermalOverload Protection Nuclear Regulatory Commission, Washington, DC for Electric Afotors on Safety.Related hiotor. Operated Valves - Generic issue ll.E.61. NUREG-1296 U.S.

IN 84-66. August 17,1984 Undetected Unavailability of Nuclear Regulatory Commission, Washington, DC the 7hrbine-Oriven Aurillaryfeedwater hain. U.S.

Nuclear Regulatory Commission, Washington, DC

'Ravis, R. and J. Taylor 1989. Development of Guidancefor Generic, Functionally or4nted PRA. Based IN 87 34. C E Rossi. July 24,1987. Single Failuresin i Team inspectionsfor till'R Plants Identification ofRhk-AuriliaryFeedwaterSystems. U.S. Nuclear Regulatory Important Systems, Components and fluman Actions.

Commission, Washington, DC TLR-A-3874.T6A Brookhaven National 12boratorv, Upton, New York.

6.1 NUREG/CR.58%

I References IN 87 53. C E. Rossi. October 20,1987. Auriliary inspection Regwitt fiedwater Pump THps Resultingftom Low Suction Pressure. U.S. Nuclear Regulatory Commission, IR 50-489/89-11: 50-499F1-11. May 26,1989. South Washington, DC Texas Project inspection Report. U.S. Nuclcar Regulatory Commission, Washington, DC IN M40. C E. Russi. March 18,1988. Reduced Reliability ofSteam Drivrn Auxiliary Fetdwater Pumps NUREG Report Caused 1 Instabilityof1iintwardIGPL Type 7

Governors. U.S. Nuclear Regulatory Commission, NUREO 1154.1985. Loss o/ Main andAuritiary

%%shington, DC Fredwater Event at the Davis Bessc Plant on June 9,1985.

U.S. Nuclear Regulatory Commission, Washington, DC IN 89 30. R. A. Arua. August 16,1989.- Robi/ucm Unit 2inadequateNPSIiofAutiliaryFredwaterPumps. Also, Eveni Notification 16375, August 22,1989. U.S.

Nuclear Regulatory Commission, Washington, DC I

NUREG/CR-5896

.6.2 l

,~~_...m.,__.__,___.,

I i

Distribution I

Distribution l

No. of No of contes Copies OFFstTE 4

St. Lucie Resident inspector Office i

l 18 ILS. Nuclear Reculatory Commission J. It 'Ihylor Brookhaven National laboratory B. K. Grimes Building 130 OWFN 9 A2 Upton, NY 11973 E Congel R.'Rasis OWFN 10 E4 Brookhaven Nationalimboratory Building 130 R. Barrett Upton, NY 11973 OWFN 10 A2 i

R. Gregg A El Bassioni EO&O Idaho, Iric.

OWFN 10 A2 P.O. Box 1625 Idaho Ibils, ID 83415 S. M. Long OWIH 10 A2 Dr. D. R. Edwards Professor of Nuclear Engineering K. Campe University of Missouri Rolla OWFN 1 A2 Rolla, MO 65401 10 J.Chung ONSITE OWFN 10 A2

'M Pacific Northwest laboratory 2

B. 'Ihomas OWFN 12 }{26 S. R. Doctor L R. Dodd 3

U.S. Nucicar Reculatory Commission -

B. E Oore (10)

Recion 2 N. E. Moffitt R. Pugh (5)

A. E Olttson E A. Simonen K. D. Landis T. V. Vo L A. Reyes Publisning Coordination Tbchnical Report File (5) i k

Distr.1 -

,. - - -. ~ -..., - ~,... - -.... - - ~

ev2C sonw 335 UA. NUCLt A2 MIGULaTO2V COMMI55 TON

1. R E PO817 &#UM a t h 11'; oet L'"'.'.1"".l.'. ",%7 ""-

w 22a BIBLIOGRAPHIC D ATA SHEET NUREG/CR-5896 a.,~-.,,,,.,

PNL-8102

.' Til ti A ND Suf f s T L.i Auxiliary feedwater System Risk-Based Inspection Guide for the St. Lucie Unit 1 Nuclear Power Generation Station 3

C'"""

j m,

htstst 1992 e f !% Oh GN A % f NUYliE A L1310

$.vw.os, o nu os aieOur R. Pugh, B.f. Gore, T.V. Yo Technical

n u ua cav t s t a n~

c.....

e u n s o a Mmc.C..a san g a T or, - n.v t m e.o avou t ss m

c. -

o.

u"

, v4 =,L

-.,, c-ee a w

..a >

Pacific Northwest Laboratory Richland, WA 99352

9. SPON504 ING Oa G ANIZ A TION - N AM E A ND ADDR E SS vt eac. evse "L*==

.aew". d e.*"orm. w== **C D===.a 0"e* *, ae,.a. u A 4 c=c a wwww C.== e a.

su a.so, as s1 Division of Radiation Protection and Emergency Preparedness Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555

10. bVPP!.EME NT Ast y NOT ES II, AE ST RaCT trao

,se a es.

In a study sponsored by the b.S. Nuclear Regulatory Commission (NRC),

ic Northwest Laboratory has developed and applied a methodology for deriving plant-specific risk-based inspection guidance f or the auxiliary f eedwater ( AFW) system at pressurized water reactors that have not undergone probabilistic risk assessment (PRA). This methodology uses existing PRA results and plant operating experience information.

Existing PRA-based inspection guidance information recently develeped for tne NRC for various plants was used to identify generic component failure modes.

This information was then combined with plant-specific and industry wide component information and failure data to identify failure modes and failure mechanisms for the AFW system at the selected plants.

St. Lucie Unit I was selected as one of a series of plants for study.

The product of this of fort is a prioritized listing of AFW failures which have occurred at the plant and at other PWRs. ' This listing is intended for use by NRC inspectors in the preparation of inspection plans addressing AFW risk-importar.t components at the St. Lucie Unit 1 plant, n t o wo m osect sca :P T on s,o..

....~,

-u oava%+*+5'ait***'

Unlimited

..... u. t. u. w..c. i.v Auxiliary Feedwater System ( AFWS) risk-based inspection guide Unclassified St. Lucie Unit 1 Nuclear Fower Generation Station probabalistic risk assessment (PRA)

Unclassifiec' lb 1UMB L A Of PAGl5 16 PRIOt a ec som.s 33,;agi v

l

i Printed on recycled paper Federa Recycling Program l

5 Tile ST. LUCIE UNIT 1 NUCLEAR POWER GENERATION $TATION

. UNITED STATES rinsT CLASS t/A't PosTAGEA*:0 t Ets PArc NUCLEAR REGULATORY COMMISSION vst:ac WASHINGTON, D.C. 20555-0001 PERMtT P40. G 67 OFFICIAL BUSINESS pggggy FOR F'nivATE USE, S3M I

? 't y e

- =..

.n p O [.i j C % v <

'u 4 I ' *

'"r

.a.

- V L 7,

~ ' " h. r.

a c ;, ' 'L : r

I 7 3.,

, oc W :i e u a.

' ' ~

j,.

c F

~