NUREG/CR-2641

ORNL/TM-8271

The In-Plant Reliability Data

Base for Nuclear Power Plant

Components: Data Collection

and Methodology Report

J. P.

R. J.

Drago

Borkowski

D. H. Pike

F. F. Goldberg

I

I

i j

]hroAPt,,,

"Is(20gj Li,

Prepared for the

U.S. Nuclear Regulatory Commission

Office of Nuclear Regulatory Research

Division of Risk Analysis

Under Interagency Agreement DOE 40-550-75

9R4Rr 11

t

I

I

IIi

i

I

i

I

iI

I

I

I
Printed in the United States of America. Available from

National Technical Information Service

U.S. Department of Commerce

5285 Port Royal Road, Springfield, Virginia 22161

Available from

GPO Sales Program

Division of Technical Information and Document Control

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555

This report was prepared as an account of work sponsored by an agency of the

United States Government. Neither theUnited StatesGovernment nor any agency

thereof, nor any of their employees, makes any warranty. express or implied, or

assumes any legal liability or responsibility for the accuracy, completeness, or

usefulness of any information, apparatus, product, or process disclosed, or

represents that its usewould not infringe privately owned rights. Reference herein

to any specific commercial product, process, or service by trade name, trademark,

manufacturer, or otherwise, does not necessarily constitute or imply its

endorsement, recommendation, or favoring by the United States Government or

any agency thereof. The views and opinions of authors expressed herein do not

necessarily state or reflect those of the United States Government or any agency

thereof.

, .. .A

!
NUREG/CR-2641

ORNL/TM-8271

Dist. Category RG

Contract No. W-7405-eng-26

Engineering Technology Division

THE IN-PLANT RELIABILITY DATA BASE FOR NUCLEAR POWER

PLANT COMPONENTS: DATA COLLECTION AND

METHODOLOGY REPORT

J. P. Drago R. J. Borkowski

D. H. Pike

Oak Ridge National Laboratory

Francine F. Goldberg

U.S. Nuclear Regulatory Commission

Manuscript Completed - June 23, 1982

Date Published - July 1982

NOTICE This document contains information of a preliminary nature.

It is subject to revision or correction and therefore does not represent a

final report.

Prepared for the

U.S. Nuclear Regulatory Commission

Office of Nuclear Regulatory Research

Division of Risk Analysis

Under Interagency Agreement DOE 40-550-75

NRC FIN No. B0445

Prepared by the

OAK RIDGE NATIONAL LABORATORY

Oak Ridge, Tennessee 37830

operated by

UNION CARBIDE CORPORATION

for the

DEPARTMENT OF ENERGY

-V
iii

CONTENTS

Page

LIST OF TABLES ........................................................ v

FOREWORD ........... **************........... * ....... ..* ......... vii

ACKNOWLEDGMENT ........................... so .............. *o....o....... is

ABSTRACT ...... s..............*.....o ................. .....*.. 1

1. INTRODUCTION ...................... *....*.... o............. 1

1.1 Background ............................... 0 ......... ............ 1

1.2 Objectives ................................................ 2

1.3 Existing Data Sources ........ ......................... . 2

1.3.1 The NPRDS ....... ...*....So...... 3.....* 3

1.3.2 The LER system ......... ............................. .... ... 4

1.3.3 IEEE Standard 500 .......... ..................... 4

1.4 History and Features of IPRD System .................... 5

1.4.1 Complete component failure histories ............ 6

1.4.2 Nonsafety and safety-class components ........... 7

1.4.3 Population data ... o................................ s 7

1.4.4 Generic systems definitions ..................... 7

1.4.5 Repair data ..*O,..... 0.... t................................... 8

1.4.6 Consistent data selection and encoding ..... o..... 8

1.5 Data Collection, Analysis, and Reporting Schedule ...... 8

2. IPRD DATA BASE ......................... o ................. 9

2.1 General .... s ~ . .o ... . . .. . ,. . . . . . . . 0 9

2.2 Coding Conventions .. ..... o. ........ ...... ......... , , 10

2.3 Access to IPRD Records ................ O.. 10

2.4 Population Data ... ................ 0..... ............. 10

2.5 Failure Data ... ............. . ..................... , - 18

2.6 Repair Data .... ooo......... .0 .... .4-000.0 ....... ... 20

3. DATA COLLECTION AND ENCODING .................... . ......... 22

3.1 Data Collection ....................................... 22

3.2 Data Selection ..... o.*..oooe.... ................ ....... 23

3.3 Data Encoding ..... ............................ 23

3.3.1 Manual data entry .. ............................. 23

3.3.2 Computerized data entry ........ ................. 23

3.4 Quality Control ........... ......................... .. 24
iv

Pag~e

REFERENCES

Appendix A.

Appendix B.

. ... .. .. .. .. .. .. .. . ... ..0.. .. .. ..0 .. .. .. .. .. .. .. ..... ............................ 2 5

GENERIC SYSTEM DESCRIPTIONS ....... ..... o...... 27

GLOSSARY OF IN-PLANT RELIABILITY DATA

TERMINOLOGY ...... ...... ...... . ............. 81
I

v

LIST OF TABLES

Table Page

2.1 IPRD generic systems list .... ............ .................... 13

2.2 IPRD hierarchical numbers for pumps ........................ 16

2.3 IPRD component types codes ......................... . ...... 17

2.4 Pump failure cause codes . ........................... ....... 19

2.5 Failure severity codes ....... .............. ............... 20

2.6 Repair category codes ....................................... 21

A.1 Nuclear systems ............. ... ................. ,. . . 27

A.2 Engineered safety systems ................................. 38

A.3 Containment systems ..................................... 44

A.4 Electrical systems .. ..... .. *.* ........................... 52

A.5 Power conversion systems ............................... 58

A.6 Process auxiliary systems ................................. 66

A.7 Plant auxiliary systems .................................... 77
vii

FOREWORD

Since 1978 the American National Standards Institute/Failure Incidents Reports Review (ANSI/FIRR) committee has sponsored a voluntary program of visits to nuclear power stations for record collection at the

plant site and the conversion of these records into a comprehensive data

base to be applied to risk and reliability analyses. Additional funding

is provided by the U.S. Nuclear Regulatory Commission, Office of Nuclear

Regulatory Research. Oak Ridge National Laboratory (ORNL) is the prime

contractor and is primarily responsible for coordination of data coding

and analysis. Science Applications, Inc., as a subcontractor to ORNL,

provides technical assistance in the development of the In-Plant Reliability Data (IPRD) system and the IPRD generic systems descriptions.

As secretariat to the ANSI/FIRR committee, the Institue of Electrical

and Electronics Engineers (IEEE) Office of Standards provides assistance

in data handling and storage. The IEEE Subcommittee on Reliability (SC-5)

is responsible for selection and coordination of the data collection team

and plant visits as well as providing technical assistance.

As
ix

ACKNOWLEDGHENT

We appreciate the guidance and advice from the NRC Project Manager,

Dr. James W. Johnson of the Office of Nuclear Regulatory Research. We

also appreciate the fine work contributed by the members of the Computer

Science Division of ORNL, especially Betsy Horwedel. We would like to

thank Joseph R. Fragola of Science Applications, Inc. for his valuable

technical assistance. Special thanks go to SAI-Oak Ridge Office for its

substantial contributions to this document.

-J
TEE IN-PLANT RELIABILITY DATA BASE FOR NUCLEAR POWER

PLANT COMPONENTS: DATA COLLECTION AND

METHODOLOGY REPORT

J. P. Drago D. R. Pike

R. J. Borkowski F. F. Goldberg

ABSTRACT

The development of a component reliability data base for

use in nuclear power plant probabilistic risk assessments and

reliability studies is presented in this report. The sources of

the data are the in-plant maintenance work request records from

a sample of nuclear power plants. This data base is called the

In-Plant Reliability Data (IPRD) system. Features of the IPRD

system are compared with other data sources such as the Licensee

Event Report system, the Nuclear Plant Reliability Data system,

and IEEE Standard 500. Generic descriptions of nuclear power

plant systems formulated for IPRD are given.

Keywords: in-plant data, IPRD, reliability, data base,

nuclear power plant, probabilistic risk assessment, generic

system description, component.

1. INTRODUCTION

1.1 BackRround

Since the publication of the Reactor Safety Study WASH-1400 (Ref. 1)

in 1975, there has been a growing interest in and need for the use of

probabilistic techniques to assess the safety and reliability of nuclear

power generating stations. Both the interest and the need have intensified in the aftermath of the Three Mile Island accident, contributing to

the subsequent initiation of the Interim Reliability Evaluation Program

(IREP), a major risk assessment of four nuclear power plants. It is anticipated that the IREP program will be the forerunner of the National

Reliability Evaluation Program (NREP) effort involving the application of

probabilistic techniques to assess the reliability of all U.S. nuclear

power stations in operation, under construction, and in the design stage.

One of the major difficulties in performing a defensible risk assessment has been the lack of adequate equipment failure data. The lack of

hard data in developing the component failure rate estimates has been a

major contributor to the large uncertainties and was highlighted by the

well-publicized "Lewis Committee Report." Other studies, including WASH1400, have clearly identified the large uncertainties inherent in using

current data banks. Furthermore, some studies have raised the question of
2

the applicability of generic failure and repair rates to specific facilities. In some cases, it is suspected that plant-specific environmental A

and design conditions and operational practices may justify or require

modifying generic data to ensure applicability.

1.2 Obiectives

The major objective of the program described in this report has been

to provide an improved data base for use in probabilistic risk assessments. The method for accomplishing this objective has been to create a

detailed data base for selected components at various operating nuclear

power generating stations. All components of a particular type are included. The source of this detailed data is the in-plant maintenance

.fjjes. Thus, the resulting data base has been named the "In-Plant Reliability Data" (IPRD) system.

In addition to providing failure rates and component down times for

use in probabilistic risk assessments, potential uses of the IPRD include:

* revising of component test intervals and allowable down times;

* identifying generic problems and recurring failures;

* identifying the variables (e.g., environment, operating mode, system,

maintenance policy, etc.) that control component failure rates;

* providing, for a sample of components and plants, an extensive data

base against which to compare existing data sources (e.g., LERs and

NPRDS) to assess the degree to which these data. sources accurately

reflect the actual component reliability;

* correlating current incidents with previous failures;

* identifying trends and patterns in the failure characteristics of

particular components or aggregations of components; and

* identifying failure mechanisms over time for use in defining the

aging requirements for component qualification.

This report is the first in a series of publications on the IPRD system. It contains a detailed description of the data base, the procedures

used to collect and process the data, and working definitions of the terms

used in the encoding schemes. Subsequent publications will focus on the

display and analysis of failure and repair data for particular components.

It is anticipated that each component or related group of components will

constitute a separate publication. Currently, publications on pumps and

valves are planned.

1.3 Existing Data Sources

Before describing the features of the IPRD, it will be useful to

examine briefly three other major existing sources of nuclear reliability

data. These data sources are: (1) The Nuclear Plant Reliability Data

System (NPRDS) (Ref. 3); (2) The EG&G Idaho Studies,4-9 which calculated

component failure rates using Licensee Event Report (LER) data; and

(3) Institute of Electrical and Electronics Engineers (IEEE) Standard 500

(Ref. 10).
3

1.3.1 The NPRDS

The NPRDS (Ref. 3) provides utilities, The Nuclear Regulatory Commission (NRC), Architect-Engineers (AEs), and suppliers with reliability

data for safety-related components and systems of nuclear power plants.

At the time the IPRD program was started, the NPRDS was maintained by

'Southwest Research Institute (SRI) under contract to the Edison Electric

,Institute and under the direction of American Nuclear Society (ANS) Standards Committee ANS 58.20. Since January 1982 the NPRDS has been under

the direction of the Institute of Nuclear Power Operations (INPO). The

following information on NPRDS describes the data base prior to 1982.

Information on file in the NPRD system is derived from standard format

input reports prepared by staffs of nuclear utilities. Participation in

the system is voluntary. Some quality assurance was performed on the data

by SRI to eliminate obvious errors, and requests for corrections are sent

to utilities when necessary.

The NPRD system includes design data and other descriptive information on'each unit, such as unit owner; rating; type; Nuclear Steam Supply

system supplier; AE; and critical and commercial service dates, submitted

by the utility on a standard report form. It also includes engineering

'data and descriptive information for safety-related systems and components

for each unit, such as unit name, owner, component or system code designation, safety class, manufacturer model and serial number, operating environment, drawing number, and operation and testing data, submitted on a

- standard report form and updated as required. A quarterly operating report, submitted by the utility on a standard report form, includes such

information as unit name, owner, on-line time in hours, reactor critical

hours, standby and shutdown hours, and number of failure reports for the

quarter. A report of failure form, submitted quarterly by the utility on

a standard report form, includes such information as unit name, owner,

failed component or system code, component identification number, date of

failure, failure number, failure start and end times, failure description,

cause and corrective action, and failure classification.

The limitations of the NPRDS discussed below are being rectified by

INPO. However, prior to 1982 some of the major sources of inconsistency

in NPRDS were:

1. definition of systems;

2. definition of reportable scope (i.e., the size and makeup of the component population for which engineering and failure data were to be

reported);

3. designation of boundaries between components and ancillary equipment;

4. interpretation of reporting instructions and data element codes;

5. definition of a reportable component failure;

6. variations in the skill and training of individuals responsible for

reporting data to NPRDS; and

7. variations in the amount of effort spent in collecting and correcting

the data.
4

1.3.2 The LER system

For each licensed nuclear power plant, certain events or "reportable

occurrences" must be reported to the NRC in accordance with Regulatory

Guide 1.16 (Ref. 11). In order to collect, collate, store, retrieve, and

evaluate information concerning these events, the then Atomic Energy Commission (AEC) established in 1973 a computer-based data file of information extracted from licensee reports. This data bank is known as the LER

file.

The reportable events, known as LERs, are for the most part deviations from a plant's tech specs and as such they should include most failures of safety-related components. Though the LER system was not designed

to provide reliability information, enough information is available from

LERs for component failures to make the LER data base attractive as a

source of reliability data. Therefore, beginning-in FY 1978, the NRC

funded a project, the goal of which was to produce gross component failure

rate estimates from the LERs. The project was carried out at the Idaho

National Engineering Laboratory (INEL) by its contractor EG&G. To date,

reports have been produced on pumps,4 control rods and drive mechanisms,s

diesel generators,' valves,7 primary containment penetrations,' and instrumentation.'

The major limitations of the LER system derive from the fact that

it was not designed to be used as a source of reliability data.' It also

suffers from the data inconsistency problem similar to that described for

NPRDS. The list below summarizes the weaknesses of the LER system as a

reliability data base:

1. The LER data base does not contain plant population data. The

standard estimates of failure rate per unit time require knowledge of the

number of similar items and their exposure times. If failure rates per

demand are required, even more detailed information on the components is

necessary. This information is missing in the LER data base. The EG&G

Idaho study4-' utilized reactor plant Final Safety Analysis Reports

(FSARs) to obtain counts of pumps. The LER data could then be utilized

to obtain gross failure rate estimates of safety-related pumps and valves

for selected plants.

2. LERs are not submitted for every plant component. Failures of

nonsafety components may or may not be reported.

3. LERs may not be submitted for every type of failure even if the

component affected was a safety class component.

4. The reporting of data by different individuals in different organizations (see the discussion in Sect. 1.3.1, NPRDS) results in considerable inconsistencies in the LER data base just as it does for NPRDS.

1.3.3 IEEE Standard 500

Published in 1977, IEEE Standard 500 contains failure data for ge-

*neric electrical and electronic equipment. The failure data include failure rate ranges, failure modes, and environmental factors. Although a

substantial portion of the data contained was based either directly or

indirectly on in-plant experience, much of the data was obtained by a

consensus approach, a "Delphi study," using -200 experts throughout the
5

United States. The data from this Delphi study was therefore supplemented

with data obtained from nuclear facilities, fossil-fueled generating

plants, transmission grids, and other industries.

This effort represents a positive contribution in that failure rate

information is tabulated in readily usable form for selected components.

The primary limitations of IEEE data sources are: (1) the limited. component types addressed and (2) the difficulty in extracting the estimates

based on actual operating experience from those based on the Delphi evaluation.

1.4 History and Features of IPRD System

In this section, a brief overview of the IPRD system will be presented. A more detailed discussion of the data base can be found in

Chap. 2, and a description of the data collection and encoding'methodology is given in Chap. 3. -

In 1972, the IEEE published the first edition of Standard 352 (Ref.

12), which contains a basic methodology necessary to conduct a reliability

analysis; At the time of publication, it was recognized that this methodology was incomplete without a supporting data base. Work began to produce a data'base to support IEEE's Standard 352 and this culminated in

1977 with the publication of 'IEEE Standard 500. This data source was

limited to electrical, electronic, and sensing devices. This limitation

was due in part to the fact that'the organizational scope of IEEE was

limited to these devices. However, it was recognized by the nuclear community that-'the components within the IEEE scope were not the only sources

of concern from a plant risk and availability standpoint. In addition to

the electrical components, 'other significant components were mechanical in

nature and were therefore within the'scope of the American Society of

Mechanical Engineers (ASME). Because the scope of the components of interest was within ASME and the data base'-development and reliability

skills resided within the IEEE, it was decided that the future data'collection effort be sponsored cooperatively under the umbrella of the

American National Standard Institute (ANSI) federation.

It was this desire to expand the work on data to mechanical devices

which led to the creation of a data subcommittee of the ANSI Failure and

Incidents Reports Review (FIRR) Committee. This subcommittee was charged

specifically to' arrange for visits to operating nuclear plants and to collect in-plant information.' It was also the'responsibility of this committee to store this collected information until it could be used. To ensure

that proper experience and expertise was 'applied to the effort, and that

these stored data records could be readily accessed, the IEEE was granted

the secretariat of the FIRR Committee. The IEEE Reliability Subcommittee

(SC-5) was granted overall technical cognizance of the data collection,

storage,'and encoding effort. '

In 1978, this subcommittee'began collecting failure and repair data

from nuclear plant maintenance and repair files. This ongoing data collection effort has, for the most part, relied on industry volunteers for

its manpower requirements. Some financial support was obtained from the

NRC initially to cover administrative costs of the data collection effort

-I4
6

and later to establish a consistent data base on nuclear component reliability behavior for use in reliability and probabilistic risk assessments

(PRA). In this manner the raw in-plant maintenance records from which the

IPRD system has-been developed were collected.

The data base established in this study is unique in that it is a

comprehensive'collection of component population, failure, and repair data

for a sample population of operating nuclear generating units. The sample

includes data from both pressurized-water reactors (PWRs) and boilingwater reactors (BWRs), and will ultimately include the major nuclear steam

suppliers, a variety of AEs, and various operating utilities. For the

selected component types (including pumps and valves), the data extracted

from the plant maintenance logs will contain the majority of the failure

and repair information for nonsafety as well as safety-class components

from the time of commercial operation to the time when the data were collected. Preventive maintenance, casual maintenance, and some contractorperformed maintenance actions are not included. The sections that follow

discuss briefly the features that make the IPRD a unique source of nuclear

reliability data.

1.4.1 Complete component failure histories

Unlike either the NPRD or LER systems, IPRD includes an essentially

complete failure history (not just catastrophic failures) for all components included in the data base. Moreover, this history is traceable to

the original in-plant source documents, should further investigation or

checking be required. All failures are coded with one of three severity

levels:

1. Catastrophic - total inability of the component to perform its intended function.

2. Degraded - component operates at less than its specified performance

level.

3. Incipient - component functions as designed but the failure will

probably progress to the degraded or catastrophic level if left unattended.

The number of failures in different severity levels should be due, at

least in part, to the plant maintenance policies. For example, one would

expect a priori that a plant using a "run-to-fail philosophy" would tend

to have more catastrophic failures while an extensive preventive maintenance program would tend to discover more failures at the incipient level

before they progress to the degraded or catastrophic levels. Thus, the

effect of different plant maintenance policies can be investigated as well

as the effectiveness of the various preventive maintenance programs.

Since the IPRD system includes these noncatastrophic failures it has the

potential for providing information useful in establishing the optimum

level of preventive maintenance in a plant. However, not all plants list

incipient failures, and therefore only limited comparisons between plants

can be made. -

The completeness of the IPRD failure history for a given component

also makes it a potentially useful data source for studying incipient and
7

degraded failures, for looking at time-dependent effects such as burn-in

and wear-out, and for estimating the denominators required in computing

the maintenance contribution to human error rates. The human error rate

denominators, which are the number of opportunities for making an error,

are derived from the number of maintenance actions. Since IPRD includes

corrective maintenance records, it can provide more accurate estimates for

the human error rate denominator than other data bases that include only

the fraction of maintenance resulting from catastrophic failures.

1.4.2 Nonsafetv and safety-class components

Unlike NPRDS or LERs, IPRD includes nonsafety as well as safety-class

components. In addition to increasing the size of the component population, this feature eliminates the plant-to-plant inconsistencies inherent

in selection of reportable components based on safety class. Furthermore,

it will allow studies to be performed comparing the behavior of safetywith nonsafety-class components.

1.4.3 Population data

Unlike the LER system, IPRD includes detailed, plant-specific population data, derived from plant records. Population information is included

for every component in the data base, whether or not a failure has occurred for that component. Detailed information on component characteristics was included when available. Operational parameters such as duty

cycle, operating mode, and number of annual operations are not readily

available from the plant's records. Engineering judgement was used to

estimate these parameters where necessary. In addition, the component

population classification scheme employed by IPRD is designed to facilitate computerized data aggregation at any level desired (e.g., by plant,

unit, system, component size, environment, or operational mode). The desired aggregation is accomplished through use of a system code and~tierarchical number assigned to each component in the population.

-The hierarchical number gives information on the design of the component and the environment in which the component operates. Together, the

system and hierarchy codes provide a mechanism whereby failure and repair

data for similarly designed components operating in similar environments

'can be grouped together. This is important when calculating failure rates

and mean repair times because, typically, any one component has too few

failures to accurately estimate a failure rate or mean repair time. To

reduce the statistical uncertainty surrounding the estimated mean values,

it is usually desirable to pool data from components in different systems

and/or plants. Flexible data aggregation capability also facilitates the

investigation of characteristics that are controlling the components'

reliability behavior.

1.4.4 Generic systems definitions

IPRD uses a detailed set of generic systems definitions to allow

proper aggregation and comparison of components performing the same
8

functions in different plants. The Tennessee Valley Authority's Unique

Identification (UNID) of structures, systems, and components descriptions

had not yet been developed when the IPRD program initiated the generic

system description effort. Although a set of systems codes was developed

for NPRDS, these codes are not generic, nor were they judged to be adequate for the purpose of this study. Presently, NPRD is improving the

classification of components in the systems. The systems definitions used

in IPRD were developed specifically for this study and are described in

detail in Chap. 2 and Appendix A.

1.4.5 Repair data

The existence of repair time information is another unique feature of

IPRD. These data are important for probabilistic risk assessment studies

and for work on revision of allowed down times in plant technical specifications. Neither LERs nor NPRDS contain repair time data.

1.4.6 Consistent data selection and encoding

In contrast to NPRDS and LER systems, where the selected set of reportable data as well as the quality of the reported data varies considerably from plant to plant, the IPRD data are selected, encoded, and checked

by a small group of engineers. This does not eliminate biases which are

bound to exist when engineering judgment is used, but it is expected that

inconsistencies in the IPRD system will be reduced considerably.

1.5 Data Collection. Analysis, and Reporting Schedule

The initial phase of this project was to encode the pump data from

two nuclear generating units. Pumps were selected because the size of the

population (250 to 300 for a typical plant) is large enough to give a representative number of different components on which to test and perfect

the encoding methodology, yet small enough to be reasonable for a pilot

study.

The second phase of-the project increased the size of the data base

in two ways. The number of units was increased from two to six, and

valves were included as well as pumps.

The third phase of the project will be concerned with data analysis

and will concentrate on the calculation, analysis, and comparison of statistics such as failure rates and mean repair times.

The fourth phase will be devoted to further enlargement of the data

base to include other components and plant units.
9.

2. IPRD DATA BASE

2.1 General

The IPRD system contains population, failure, and repair data for

selected components. For each component the data base contains the entire

failure and repair history from the date of the reactor's commercial operation to the data collection date. The data base contains three distinct record types:

1. Population record: contains information about the design, operating-environment, operating mode, and functional name of the component.

One population record is constructed for each component.

2. Failure record: contains the failure report number, date, failure mode, failure cause(s), failure severity level, and failure description. One failure record is entered into the data base for each failure.

3. Repair record: contains the repair time, crew size, repair category, and repair description. One repair record is encoded for each repair action.

Thus, each component has one population record and a pair of records

(failure and repair) for each failure. The population records are matched

to the-failure and repair records by the component identification (ID)

number. 'The population record is created whether or not the component has

experienced any failures.

In-general, the various fields are encoded using coding schemes that

allow the user to select from a fixed list of possibilities. There are

certain limitations inherent when using fixed coding schemes. First, this

method limits the .user's flexibility since the user must select from a

fixed list of codes.' Second, there-is'a need for engineering interpretation of the failure and repair descriptions.

The major advantages of this encoding scheme are (1) that the variability for a given field is limited to that provided in the list of possible options and (2) data can be quickly and accurately retrieved from

the data base. For example, a listing of all bearing failures can be

produced by listing all failure records with that particular failure cause

code. Since the primary purpose of the data base is to produce failure

rates and mean repair times for various groupings of components, the data

base has been constructed to facilitate data aggregation and retrieval.

Where possible, existing coding schemes have been adopted as they are

or with some modification for use'in this-study. The-failure cause codes

for pumps were taken from the EG&G Idaho analysis of LER pump failure

data.4 The component type codes were adopted from the six-character component type codes used by the NPRDS and the LER system. Vendor codes are

identical to those used by NPRDS and the LER systems.

In those cases where no coding scheme existed or where existing

schemes were deemed to be'inadequate, new coding schemes were developed.

For example, a new code was developed for generic systems because the list

of systems used by NPRDS and the LER system was found to'be too limited

for this project. Hencei'a more comprehensive list was developed.

A detailed description of the in-plant data collection and encoding

process, including a discussion of quality assurance methods and estimation techniques for nonobjective data can be found in Chap. 3. The rest
10

of this chapter is devoted to a description of the individual data elements in the IPRD data base.

2.2 CodinR Conventions

Each field in each record of the data base is completed using one of

the codes available for that field. If the information does not exist,

the field is left blank or zero-filled. This is done, for example, in the

hierarchical number on the population card when information for a particular qualifier is unavailable. The only "free format" fields in the data

base are: (1) the plant-specific component ID field on the population

record, (2) the failure report number on the failure and repair records,

and (3) the description fields on each record.

2.3 Access to IPRD Records

The IPRD program is a pilot program and as such is developmental in

nature. The program was not intended to utilize the industrial data records for such purposes as identifying preferred vendors. The pilot program was seen from the outset as a method to supplement the aggregate

information contained in IEEE 500, the EG&G reports, and other sources.

For this reason, the published data base is limited to aggregate information such as aggregate mean values and error bounds. This limitation does

not significantly decrease the value of the results since the aggregate

information is of interest in a data base for risk assessments. The computer data records are recognized as a research data source and are accessible for the purpose of noncommercial research projects through the

auspices of the ANSI/FIRR committee, and/or through the IEEE Nuclear Power

Engineering Committee/Reliability Subcommittee (SC-5).

2.4 Population Data

The population record contains information on the design, operating

environment, and operating characteristics of each component. For example, a component could be a motor, valve, or pump with driver. A population record is entered for every component in the set of components selected, even if no failures have occurred for that component. Each data

field of the population record is described below. Figure 2.1 shows the

field arrangement of the population card for pumps. The fields on the

population record are:

1. Plant: A plant is a facility which contains one or more nuclear

power generating units. Each plant is assigned a unique identifier code.

2. Unit: A unit is a nuclear steam supply, its associated turbinegenerator, auxiliaries, and engineered safety features. This code is used

to identify each unit in multiunit plants.

3. System: A system is a combination of several pieces of equipment

integrated to perform one or more specific functions. A three-digit
I - % 4 - 7' .- I .

ORNL-DWG 82-6055 ETD POPULATION DATA RECORD

C C

N YStIu i COPOWENT I 0E DUTY ANNUAL C .41 A UI _ tOttE HIRRARCr AOD I NJtR COuONUBtR o POP 0 _ CYCLE o PERATIoNI VENDOR

t° _ TR I g to .R 999 6 20NENT COMPO495 I42 7 3 R10 1z. pop. I E I . . r r I id III, I I f -I' I I I SIIT r211- 2s-1 I 13 134 13 36 H-1- .1 T:a _ 11. r1T S rI I II II I I I -I I III I I 1 11111 11111111I II 111111111 I = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ... _... . ... ..... . . . . _ ..- ..

fUNCTIONAL NAME

1 I~l I H 111111111111111111 LLH I

FAILURE DATA RECORD

A FAILURE CAUSES II uaf I o D.~4 | [ | | FAILURE DATE RDAPAI4 N tALIUat

|I|: | 1 | 2 | 3 |Mc | 5 | 6 | t | | | | | 10 | ls | | COMPONtaD | MMODDV | RP NO MOD |

r II I ll a I I a 11I 1 1 4 121 1 111 I 1 is 2 1 7 2 30 1 32 1 1 I I 1 8 I 404 44 144 11 4911 9 1 13 1 9 7 1

0 I 1 9 AIURE CAU tSO DSCIRIPTION

so __ _ 20i 

REPAIR DATA RECORD

C

AIL

N | . l l REPAIR PAIREI ELAPSED P o ~~~~~ ~~~~~~~~~~~ REPAIR cpEw ~~~~~~~~~~~~~DATE REPAIR C

COMPONENTD I M M DDvYV) EPOIP1 No. SIZE TIME A

.. . R~~~~~~~~~~~~~IPAIR ACTIONSM) D1ISClWT1ON

I Illlllll-lllllllllllllllllllllllI'IllllllW~lllklIH NTI IIIITTI TTIII 'IIIITTITIITTIIITIT 

I-A

I--&

Fig. 2.1. IPRD population, failure, and repair data record forms for

pumps.
12

system code is used to identify the system which contains a particular component. The residual heat removal system is an example.

Each nuclear power plant is divided into a set of systems which provide the necessary functions for operation of the facility. Each plant

appears to have a unique definition of system boundaries, and a common

nomenclature has evolved. A set of system codes was developed for NPRDS;

however, these codes were judged to be inadequate for the purposes of this

study. Therefore, to allow proper aggregation and comparison of components performing the same function in different plants, a set of generic

systems was defined specifically for use in IPRD.

The IPRD generic systems list contains seven major system groupings.

Within each major grouping are various systems and their associated subsystems. The seven major systems groupings are

1. nuclear,

2. engineered safety,

3. containment,

4. electrical,

5. power conversion,

6. process auxiliary, and

7. plant auxiliary.

For the first three major groupings, there are significant differences between the BWR and the PWR designs. Hence, a separate list was

prepared for'these groupings. All other groupings are essentially the

same for BWRs and PWRs. Table 2.1 contains a complete list of the systems

and codes. A-detailed system description for each system is given in

Appendix A, along with other system titles, the major components of each

system, and system interfaces.

The approach used to generate the generic systems list was to evaluate several safety analysis reports (SARs). These include the CESSAR

System 80 (Ref. 13), RESAR-41 (Ref. 14), B-SAR-205 (Ref. 15), GESSAR-238

(Ref. 16), and Stone and Webster PSAR (Ref. 17), and the specific SARs for

William H. Zimmer Unit 1 (Ref. 18), Grand Gulf Units 1 and 2 (Ref. 19),

and Oconee.20 A systems list for the specific vendor and balance-of-plant

AE was developed. The specific plant systems listings were correlated by

function to generate the generic listing.

4. Driver: For pumps, this field delineates the prime movers and is

coded motor (M), diesel (D), and turbine (T).

5. Hierarchical number: The hierarchical number is used to categorize the component. A scheme analogous to that used by IEEE Standard 500

was adopted for this study. The coding scheme is based on developing a

set'of qualifiers of the form:

% .(2.('3. *ee Qn*

Each successive qualifier categorizes the component more specifically. For example, the hierarchical number categorization scheme for
13

Table 2.1. IPRD generic systems list

BWR PWR

Nuclear Systems - N

NMl Reactor core

NCQ Control rod drive system

N02.A Control rod drive hydraulic

system

N03 Reactor control system

N04 Reactor recirculation system

NOS Standby liquid control system

N06 Reactor protection system

N07 Neutron monitoring/nuclear

instrumentation system

NOS Residual heat removal/lowpressure safety injection

system

N09 Reactor water cleanup system

NMl Reactor core

N02 Control rod drive system

N0 Reactor control system

N04 Reactor coolant system

NOS Emergency boration system

N06 Reactor protection system

N07 Nuclear monitoring/nuclear

instrumentation system

NWB Residual heat removal/lowpressure safety injection

system

N0 Chemical and volume control

system (CVCS)

Engineered Safety Systems - S

Sol Reactor core isolation cooling

system

SCQ Engineered safety features actuation system

S03 Engineered safety features S03 Safety injection system

S03.A High-pressure coolant injec- S03.A High-pressure safety injection/core spray system tion subsystem

S03.B Safety injection tank/core

flood subsystem

503.C Low-pressure coolant injection S03.C Low-pressure safety injection

subsystem

S03.D Low-pressure core spray system

S03.E Automatic depressurization

system

S04 Remote shutdown system S04 Remote shutdown system

SOS Auxiliary feedwater system

Containment Systems - C

Col

C02

Primary containment and penetrations

Reactor building

C03 Containment heat removal

C04 Containment isolation system

C05 Containment purge system

C06 Standby gas treatment system

C07 Combustible gas control system

Cog Containment ventilation system

C09 Reactor building ventilation

system

ClO Containment spray system

C02 Reactor building/containment

and penetrations

C03 Containment cooling system

C03.A Ice condenser system

C04 Containment isolation

Cos Containment purge system

C07

C08

Combustible gas control system

Containment ventilation system

CIO Containment spray system

Cll Penetration room ventilation

system
I

14

Table 2.1 (continued)

BWR and PWR 1.

Electrical systems - E

E01 Rain power system

EOl.A Protective relaying and controls

E02 Plant AC distribution system

E02.A Essential power asytem

E02.B Nonessential power system

E02.C High-pressure core spray

power system

E02.D Protective relaying and

controls

E03 Instrumentation and control

power systems

E03.A DC power system

Vital DC power subsystem

Plant DC power subsystem

E03..B Instrument AC power system

Vital Instrument AC power

subsystem

Plant instrument AC power

subsystem

E04 Emergency power system

E04.A Diesel-generator fuel oil

subsystem

E04.B Diesel-generator cooling water

subsystem

E04.C Diesel-generator air subsystem

E04.D Diesel-generator lubrication

oil subsystem

E05 Plant lighting system

E05.A Essential lighting

EO5.B Nonessential lighting

E06 Plant computer

E07 Switchyard

E07.A DC control power system

E07.B Protective relaying

Power Conversion Systems - P

PO1

P02

P02 .A

P02 .B

P02 .C

P02 .D

P02 .E

P03

P04

Main steam system

Turbine-generator system

Electro-hydraulic control

subsystem

Turbine gland seal subsystem

Turbine lubrication subsystem

Stator (hydrogen) cooling

subsystem

Hydrogen seal oil subsystem

Turbine bypass system

Condenser and condensate

system

P04 .A

P04.B

P04 .C

P05

P05.A

P06

P07

P08

Condenser evacuation system

Condensate cleanup/pol ishing

system

Condensate heater drain subsystem

Feedvater system

Feedwater heater drain subsystem

Circulating water system

Steam generator blowdown

(PYR)

Auxiliary steam system

Process Auxiliary Systems - l

V01

10O1.A

lfMl.B

101 .C

102

W02 .A

Y02.B

W02 .C

W03

W03.A

W03.3

I04

V04 .A

Radioactive waste system

Gaseous radwaste system

offgas subsystem (DWR)

Liquid radwaste system

Solid radwaste system

Radiation monitoring system

Plant area radiation monitors

Environmental radiation

monitors

Process radiation monitors

Cooling water systems

Reactor building cooling

water system

Turbine building cooling

water system

Service water systems

Deminerallzed makeup water

system

104.B Station service water system

Essential service water

system

Nonessential service

water system

V04.C Chilled water system

105 Refueling system

106 Spent fuel storage system

I06.A Fuel pool cooling and cleanup system

107 Compressed air system

107.A Service air system

107.B Instrument air system

10o Process sampling system

109 Plant gas system

109.A Nitrogen system

W09.3 Hydrogen system

Plant Auxiliary Systems - X

101

S02

X02.A

X02.B

X03

X04

X05

X05.A

Potable and sanitary water

system

Fire protection system

later system

Carbon dioxide system

Communications system

Security system

Heating, ventilating. and

air conditioning systems

Control room habitability

X05.C Diesel building ventilation

system

X05.D Auxiliary building ventilation system

X05.E Fuel building ventilation

system

X06 Nonradloactive waste system

X06.A Gaseous waste subsystem

X06.B lJiquid waste subsystem

X06.C Solid waste subsystem

system

X05.B Turbine building ventilation

system - - - -- - -------------- -_____ ------ -__ --- - -_____________
15

pumps is shown in Table 2.2. Pumps in general are classified as category

3.1. A 'positive displacement pump is 3.1.1, while a centrifugal pump is

3.1.2. More qualifiers are added to more specifically define the pump

design. The last qualifiers define the operating environment. For example, the number 3.1.2.2.1.3.5.3 refers to a single suction-volute centrifugal pump operating with a head pressure of 100 to 990 psig, a horsepower rating 1000 to 9999 HP, and a fluid temperature greater than 3000F.

For electrical and electronic components, the hierarchies in IEEE Standard

500 will be used. For mechanical components, a hierarchical numbering

scheme will be developed for each component.

Together, the system and hierarchy codes provide a mechanism whereby

failure and repair data for similarly designed components operating in

similar environments can be grouped. This is important when estimating

component reliability parameters because typically any one component has

too few failures to accurately estimate a failure rate or mean repair

time. To reduce the uncertainty around the mean estimates, it is usually

desirable to pool data from components in different systems and/or plants.

Flexible data aggregation capability also facilitates the investigation of

the characteristics that are controlling the components' reliability behavior.

6. Component type code: A six-digit code, as displayed in Table

2.3, is used to cover the various types of equipment used in nuclear power

plants. This coding is essentially the'same as that used in NPRDS.

7. Component ID: This code is that used by the operating utility to

identify components. This is the ID used on internal plant equipment

lists, failure reports, and/or maintenance logs. This plant-specific

ID is retained to assure proper linkage between the IPRD data base and the

original plant maintenance data.

8. Component vendor: The vendor code is the four-digit code used by

NPRDS.

9. Population: The number of components with the same root component ID number. For example, a system that has four identical pumps in

parallel performing the same function with component IDs: PlA, PlB, PIC,

and PlD has a population number size of four.

10. Operating mode: This field is used to describe the component's

dominant mode of operation. For example, for pumps the three valid operating modes are running, alternating, and standby. The encoding of this

data element is based on professional engineering judgment and knowledge

of nuclear power plant operations.

11. Duty cycle: The percentage of time that the component is operational. The duty cycle estimate is necessary for computing the per hour

failure rates. The duty cycle is affected by the system in which the component is operating and the function that the component performs in that

system. Because the operational status of some components is dependent on

the plant operating status, two types of duty cycles are used: availability dependent and availability independent. The availability dependent

components are either directly proportional to plant-availability or the

complement of plant availability, that is (1 minus the plant availability

with 1 signifying the plant being available 100% of the calendar time).

For those components that are operated independently of plant availability status, the duty cycle is the percent of the time the component is

operational during the calendar time. The encoding of this data element
16

Table 2.2. IPRD hierarchical numbers for pumps

3.1 Pumps

3.1.1 Positive displacement

3.1.1.1 Reciprocating

3.1.1.1.1 Piston/crank shaft

3.1.1.1.2 Diaphragm

3.1.1.2 Rotary

3.1.1.2.1 Vane

3.1.1.2.2 Lobed impeller (Roots type)

3.1.1.2.3 Gear type

3.1.1.2.4 Axial piston (swash plate)

3.1.1.2.5 Radial plunger

3.1.2 Centrifugal (single or multistage)

3.1.2.1 Turbine

3.1.2.2 Volute (open/closed impeller)

3.1.2.2.1 Single suction

3.1.2.2.2 Double suction

x.y.z. Qualifiers - add digits at the end of the hierarchical number

(enter zero if unknown)

.x - head. psix

.1 - 1-9

.2 - 10-99

.3 - 100-999

.4 - >1000

.x - head. ft

.1 - 2.3-22

.2 - 23-230

.3 - 231-2.3 x 10'

.4 - >2.3 x 103

.y - Horsepower rating, HP

.1 - <1

.2 - 1-9

.3 - 10-99

.4 - 100-999

.5 - 1000-9999

.6 - >10000

.z - Fluid temperature, OF

.1 - <150

.2 - 150-300

.3 - >300
17

Table 2.3. IPRD component types codes

Component types Code

Accumulators, tanks ACCUMU

Air dryers AIRDRY

Annunciator modules ANNUNC

Batteries BATTRY

Blowers, fans, compressors BLOWER

Battery chargers CHARGE

-Circuit breakers, motor starters, fuses CKTBRK

Control rods CONROD

Control rod drive mechanisms CRDRVE

Demineralizers DEMINX

Electric connectors (cable, bus, wires) ELECON

Internal combustion engines (gasoline, diesel) ENGINE

Filters, strainers, screens FILTER

Fuel elements FUELIX

Generators, inverters GENERA

Electric heaters HEATER

Lifting devices (cranes, hoists, Jacks) HOISTX

Heat exchangers (coolers, heaters, evaporators, HTEXCH

steam generators)

Instruments, controls, sensors INSTRU

Mechanical function units (governors, gear boxes, MECFUN

varidrives)

Motors (electric, hydraulic, pneumatic) MOTORX

Penetrations, air locks, hatches PENETR

Pipes, fittings PIPEXX

Pumps PUMPXX

Recombiners RECOMB

Relays RELAYX

Shock suppressors and supports SUPORT

Switches SWITCH

Switchgear, load control centers, motor control SWCHGR

centers, panelboards

Transformers TRANSF

Turbines (gas, steam) TURBIN

Valves VALVEX

Valve operators VALVOP

Pressure vessels (reactor vessels, pressurizers, VESSEL

drywells)
18

is based on professional engineering judgment and knowledge of nuclear

power plant operations.

12. Anhual operations: The number of times during a year that the

component is cycled or demanded (e.g., starts, openings, closings, or

energizings). Annual operations are entered as a four-digit integer.

This number is needed for computing per demand failure rates for components operated in a cyclic fashion. The cycles or demands result from

either the system being required only periodically or from tests of the

component. The encoding of this data element is based on professional

engineering judgment, knowledge of nuclear power plant operations, and

familiarity with NRC technical specifications for periodic testing of

safety-related components.

13. Functional name: This field is a free-format field and is

provided for entering the component's functional name and any additional

information. Examples of functional names are charging pump, containment

isolation valve, and lockout relay.

2.5 Failure Data

The format of the failure record is shown in Fig. 2.1. The failure

record contains the following data fields.

1. Failure cause: The failure cause code is a two-digit code which

gives the circumstances during design, manufacture, or use that have led

to failure. Failure causes used for pumps are from the LER pump report'

and are given in Table 2.4. A maximum of 11 failure cause codes can be

assigned to a single failure record.

2& Component ID: (See Sect. 2.4).

3. Failure date: The month, day, and year are encoded using the

convention (mmddyy). The date recorded on plant maintenance records could

be either the date the failure actually occurred, the date that it was

detected, or the date the report was filled out. The actual failure date

is the preferred date. Usually, the detection date is the date recorded.

4. Report number: This is a six-character field used to cross reference the failure record with a specific plant maintenance record, thus

providing traceability to original data sources. For example, if the

plant uses maintenance work orders, the plant maintenance work order number would be entered.

5. Failure mode: The failure mode is the effect by which a failure

is observed. For pumps the failure modes are coded in the following

manner:

Code Description

A Fails to start

B Fails while running

C Low output

D Vibration

E Leak

F Other

Each type of component is assigned a unique set of failure modes.
19

Table 2.4. Pump failure cause codes

Code Description Code Description

00 Unknown 19 Failed fasteners/welds

01 Bearing failure 20 Improper clearances

02 Personnel error 21 Filter/strainer plugged

03 Seal/packing failure 22 Failed internals

04 Design error 23 Corrosion/erosion

05 Loose fasteners/couplings 24 Thermal/overspeed/overload trip

06 Shaft/coupling failure 25 Air/vapor bound

07 Blown fuse 26 Belt drive failure

08 Binding/bound/seized 27 Motor failure

09 Quality control 28 Switch failure

10 (Descriptor not assigned) 29 Damaged seal surface

11 Misalignment 30 Excessive vibration

12 Foreign material 31 High pressure

contamination

13 Bellows rupture 32 Brake failure

14 Procedural discrepancy 33 Clutch failure

15 Fabrication error 34 Cracked casing

16 Shaft key failure 35 Leaky fittings

17 Broken diaphragm 36 Failed/faulty mechanical

controls

18 Normal wear 37 Control circuit failures

6. Failure severity: The failure severity is a single-character

code intended to denote the extent to which the component is unable to

perform its designated function. The three levels of severity are

catastrophic, degraded, and incipient. Table 2.5 gives the codes and

a definition for each.

7. Failure cause description: This field is a free-format field and

is provided for entering the description of the failure from the maintenance work request. For example, "pump mechanical seal is leaking."
20

Table 2.5. Failure severity codes

Code Description Clarification

C Catastrophic The component is completely unable to perform

its function. For example, a pump is frozen and

will not operate; valve fails to open on demand,

fails to close on demand, or fails to change

positions on demand.

D Degraded The component operates at less than its specified performance level. A degraded failure does

not normally bring about failure of the component

to perform its intended function. For example,

low flow from pump, or partial opening, closing,

or position change of a valve.

I Incipient The component performs within its design envelope

but exhibits characteristics which, if left unattended, will probably develop into a degraded or

catastrophic failure. For example, in a pump,

a leak at the mechanical seal of pump, excessive

vibration, excessive noise or overheating is

classified as incipient. Note that an incipient

failure does not normally bring about failure of

the component to perform its intended function.

.,

2.6 Repair Data

Repair refers to the restoration or replacement of parts or components of material as necessitated by wear, damage, or failure of parts

to maintain the specific part or component in efficient operating condition." 1 The format of the repair record is shown in Fig. 2.1. The repair

record contains the following data fields:

1. Component ID: (See Sect. 2.4).

2. Repair date: The month, day, and year are encoded using the convention (mmddyy). The actual repair date is the preferred date but was

not usually available. For these cases the failure date is repeated.

3. Report number: This is a six-character field used to cross

reference the failure and repair records with a specific plant maintenance

record.

4. Crew size: A two-character field is used to record the number of

workers used to accomplish the repair.

5. Elapsed repair time: The actual repair time as documented on the

plant's maintenance work request is encoded on the IPRD repair card. In

most cases the repair time recorded is the calendar time required to repair or replace the component. Depending on the importance of the component to plant operation and the type and severity of the failure, the

.,
21

repair time may be considerably less than the component's unavailable

time. The plant's philosophy of what the repair time includes is important in the analysis of the component's unavailable time as well as in

comparing the down times of similar components in several plants.

- 6. Repair cateRorv: A single-character code is used to describe the

specific action taken to repair the component. Table 2.6 gives the codes

and definitions.

7. Repair action description: This field is a free-format field and

is provided for entering the description of the repair from the maintenance work request, for example, "replaced mechanical seal on pump."

Table 2.6. Repair category codes

Code Description Clarification

A Replaced The entire component is replaced.

component

B Minor repair An action that is relatively easy to perform,

- such as adjusting the stuffing nut on a pump

seal to reduce fluid leakage. Repair classification''is'made on the basis of task difficulty and not on the elapsed repair time.

C Major repair An action that is difficult or complex to perform, such as a pump overhaul.

D Reset/adjust Reset is an action to restore a mechanism, electrical circuit, or device to a prescribed

state.21 For example, reset a tripped circuit

breaker.

Adjust is an action to change the value of some

element of the mechanism or the circuit of the

instrument or of an auxiliary device to bring

the indication to a desired value, within a

specified tolerance for a particular value of

the quantity measured. 11 For example, increasing the range of a differential pressure transmitter.

E Recalibrate The adjustment to a known standard, to reconcile

output and'input value, usually numerically related by a defined mathematical expression by

adjustment of gain, zero set,' etc.

. .& . .
22

3. DATA COLLECTION AND ENCODING

3.1 Data Collection

The data collection effort on which this project is based began in

1978 under the auspices of the ANSI/FIRR committee. One of the purposes

of the data collection program was to establish a failure and repair data

base from which failure and repair statistics analogous to those in IEEE

Standard 500 could be obtained for mechanical devices in nuclear power

generating plants. The absence of such data was viewed by the FIRR committee as a serious impediment to any kind of systematic evaluation of

nuclear plant component reliability.

The data collection at a plant site typically proceeds as follows.

The FIRR committee obtains permission for a site visit from one of the

operating commercial nuclear power plants. A team leader is appointed

whose responsibility is to assemble a team of volunteers for the site

visit and to arrange for facilities such as office space and photocopy

equipment which will be needed by the volunteer team. The volunteer team

members work for nuclear component vendors, nuclear steam suppliers, AEs,

standards organizations, or any of a variety of industrial concerns who

have an interest in improving the performance of nuclear generating stations. A typical team consists of one leader and four team volunteers.

During the site visit, the volunteer team locates and copies any

plant population lists and attempts to obtain as much detail as possible

on description, specifications, and operating conditions of each component. In addition, the maintenance records are reviewed and those records

that are judged to be component failures are copied. In this sorting

process the following rules are followed:

1. All facility maintenance is excluded. Facility maintenance is

that maintenance concerned with housekeeping, plumbing, ambient lighting,

etc.

2. All construction and building modifications are excluded.

3. Routine or preventative maintenance items are excluded. Routine

or preventive maintenance is any maintenance done on a regular basis such

as lubrications, inspections, and calibrations. If, during the course of

routine or preventive maintenance, a component failure is discovered by

the maintenance crew, that component failure would be included in IPRD.

The routine maintenance would be excluded.

4. Spurious conditions are included. A spurious condition is any

condition reported as an abnormal component performance but which cannot

be verified or reproduced by the maintenance crew. An example of a spurious condition would be a meter reading that is reported as abnormal but

is shown by follow-up investigation to be normal.

Use of these four rules results in the collection of maintenance

items that are defined as component failures or corrective maintenance

items. By definition, corrective maintenance is any repair or replacement

action necessary to restore a component from a state of actual degradation

(i.e., catastrophic and degraded failures) or from a state of anticipated r

degradation (i.e., incipient failure).
7

23

Plant records are either duplicated using photocopy equipment or hand

transcribed. In those cases where computer files exist, the data files

are printed out. The plant data are maintained by the secretariat of the

FIRR committee and are physically located in the IEEE Standards Office in

New York.

3.2 Data Selection

The selection of plant data for inclusion in IPRD is made on the

basis of (1) the existence of population data, (2) the quality of failure

and repair data and (3) the ability to obtain hierarchical information on

components. Secondary considerations include trying to achieve an adequate balance among the four nuclear steam suppliers and the various AEs.

3.3 Data Encoding

3.3.1 Manual data entry

In the early phases of this project, population, failure, and repair

data were transcribed onto encoding forms. Data from the forms were key

punched to cards and the cards were read into the computer.

3.3.2 Computerized data entry

A computerized data entry system was developed to increase the efficiency and.productivity of staff as well as to reduce errors. The data

encoded by the clerical staff were

* Population record: plant, unit, component type, component ID, component vendor, functional name;

* Failure record: failure date, report number, failure cause text; and

* Repair record: repair date, crew size, repair time, repair action

text.

Data were encoded onto floppy disks using a minicomputer system. Printouts were subsequently produced. Data requiring engineering judgment were

encoded by engineers writing on these printouts, as follows:

* Population record: system, hierarchical number, operating mode, duty

cycle, annual operations;

* Failure record: failure cause, failure mode, failure severity; and

* Repair record: repair category.

The clerical staff then entered these data into a minicomputer to complete the data base entry.
24

3.4 Quality Control

Quality control checks data records for accurate and consistent enr

coding of the data fields. Quality control is performed in several different ways, including:

1. Computer consistency checks: The first level of quality control

was performed by computer software that checked for obvious errors during

data entry, such as making sure'that each code assigned was one of the

admissible codes. Other checks that were made include assuring that failure and repair records occurred in pairs and that a population record

existed for every pair of failure and repair records.

2. Engineering consistency checks: There were two separate steps to

check the engineering judgment used in assigning codes. To ensure that

the data were-classified accurately and consistently, a validation program

was developed. This step consisted of two major parts: individual record

checking and cross checking.

In the individual record checking procedure, an engineer reviewed

every population, failure, and repair record in the data base for completeness and accuracy of the coding with the descriptor fields, for instance, checking that the failure cause descriptor matchedithe failure

cause code. The cross checking procedure was performed by sorting the

data by a specific parameter such as failure cause code, failure mode,

severity code, and repair category. In this manner, the individual records were checked for coding consistency against those within the classification. Those records that were inconsistent with the definition of

the code classification as well as those that did not appear consistent

with the bulk of the records within that classification were corrected.

3. Data encoding checks: A final check was made to- assess the accuracy of data encoding. This check was made by taking a random sample of

records from the data copied by volunteer teams'during the'plant visit.

The original data was checked against the final IPRD entries. An estimate

was made of encoding accuracy. Where applicable the following fields were

checked:

A. Failure date,

B. Failure description,

C. Repair description,

D. Repair time, and

E. Report number.

I!
25

REFERENCES

1. U.S. Nuclear Regulatory Commission, Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Poier Plants, WASH1400 (NUREG-75/014) (October 1975).

2. H. W. Lewis et al., Risk Assessment Review Group Report to the U.S.

Nuclear Regulatory Commission, NUREG/CR-0400 (September 1978).

3. Southwest Research Institute, Reporting Procedures Manual for Nuclear

Plant Reliability Data System, Rev. 7 (December 1979).-

4. W. H. Sullivan and J. P. Poloski, Data Summaries of Licensee Event

Reports of Pumps at U.S. Commercial Nuclear Power Ptants., January 1,

1972., through April 30, 1978, NUREG/CR-1205 (January 1980).

5. W. H. Hubble and C. F. Miller, Data Summaries of Licensee Event Reports of Control Rods and Drive Mechanisms at U.S. Commercial Nuclear

Power Plants, January 1, 1972, th'rough April 30, 1978, NUREG/CR-1331

(February 1980).

6. S. P. Poloski and W. H. Sullivan, Data Summaries of Licensee Event

Reports ofDiesel Generators at U.S..:Commercial NucZear Power Plants.,

January 1, 1976, through December 31, 1978, NUREG/CR-1362 (March

1980). -

7. W. H. Bubble and C. F. Miller, Data Summaries of Licensee Event Reports of Valves at U.S. Commercial Nuclear Power Plants, January 1,

1976, through December 31, 1978, VoZe. I, II, and III,, NUREG/CR-1363

(June 1980).

8. D. W. Sams and M. Trojovsky, Data Summaries of Licensee Event Reports

of Primary Containment Penetrations at U.S. Commercial Nuclear Power

Plants, January 1., 1972, through December 31., 1978., NUREG/CR-1730

(September 1980).

9. C. F. Miller et al., Data Summaries of Licensee Event Reports of

Selected Instrumentation and Control Components at U.S. Commercial

Nuclear Power Plants from January 1, 1976, to December 31, 1978,

NUREG/CR-1740 (April 1981).

10. Institute of Electrical and Electronics Engineers, Inc., IEEE Guide

to the Collection and Presentation of Electrical., Electronic, and

Sensing Component Reliability Data for NucZear-Power Generating Stations, IEEE Standard 500., IEEE, 1977.

11. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.16, Reporting

of Operating Information - Appendix A., Technical Specifications,

Rev. 4 (August 1975).
I

26

12. Nuclear Power Engineering Committee of the IEEE Power Engineering

Society, An American National Standard IEEE Guide for General

Principles of Reliability Analysis of Nuclear Power Generating *

Station Protection Systems, IEEE, Std. 352, 1975.

13. Combustion Engineering Standard Safety Analysis Report (CESSAR).

14. Westinghouse Standard Safety Analysis Report (RESAR-41).

15. Babcock and Wilcox Standard Safety Analysis Report (B-SAR-205).

16. General Electric Standard Safety Analysis Report (GESSAR-238).

17. Stone and Webster PWR Reference Nuclear Power Plant Safety Analysis

Report (NRC Docket No. 50-495).

18. W. H. Zimmer Nuclear Plant Final Safety Analysis Report (NRC Docket

No. 50-358).

19. Grand Gulf Nuclear Station, Final Safety Analysis Report (NRC Docket

No. 50-416, 50-417).

20. Oconee Nuclear Station, Final Safety Analysis Report (NRC Docket No.

50-269, 50-270, 50-287).

21. F. Jay, Editor, IEEE Standard 100-1977, IEEE Standard Dictionary of

Electrical and ELectronics Terms, 2nd Ed., John H. Wiley and Sons.
I

27

Appendix A

GENERIC SYSTEM DESCRIPTIONS

A.1 Nuclear Systems - N

The nuclear system grouping is comprised of the reactor core and

those systems and subsystems that monitor and control the core's reactivity, remove heat from the core, and otherwise directly support the safe

operation of the reactor. The systems and subsystems that make up the

nuclear system grouping are shown in Table A.l. The following descriptions of systems are identified as applying to a boiling-water reactor

(BWR) or pressurized-water reactor (PWR) or both.

Table A.l. Nuclear systems

BWR PWR

NOl

N02

Reactor core

Control rod drive system

Reactor core

Control rod drive system

N02.A Control rod drive

hydraulic system

N03

N04

NO5

N06

N07

NO8

N09

Reactor control system

Reactor recirculation

system (including reactor

vessel and internals)

Standby liquid control

system

Reactor protection system

Neutron monitoring/nuclear

instrumentation system

Residual heat removal/

low-pressure safety

injection system

Reactor water cleanup

system

Reactor control system

Reactor coolant system

(including reactor vessel

and internals)

Emergency boration systema

Reactor protection system

Nuclear monitoring/nuclear

instrumentation system

Residual heat removal/

low-pressure safety

injection system

Chemical and volume

control system

aWestinghouse units have emergency boration as a unique

system. Babcock & Wilcox and Combustion Engineering units

pr.ovide emergency boration as a function of the CVCS.
28

NOI Reactor core (BWR and PWR)

The reactor core produces heat through nuclear fission. A reactor

core contains about 200 to 300 fuel assemblies in a PWR and -700 in a

BWR which are arranged in a lattice fashion approximating an upright

cylinder. The exact number of fuel assemblies varies with both the nuclear steam supply system (NSSS) vendor and the generation of the reactor

design. Fuel assemblies are constructed of uranium dioxide (UMO) pellets

surrounded by a Zircaloy cladding tube. The lattice structure of the

reactor core is a loose one that allows reactor coolant water to flow up

and around the fuel assemblies. Fmpty spaces are also left in the lattice for the insertion of control rods.

Systems that interface with the reactor core are the control rod

drive system and the reactor coolant system in PWRs or the main steam,

feedwater, and reactor recirculation systems in BWRs. There are also some

power and temperature measuring components that may be inserted directly

into the reactor core.

N02 Control rod drive system (BWR and PWR)

The control rod drive system is used for power shaping and reactivity

control. The control rod drive system is made of -50 control rod assemblies in PWRs and 185 in BWRs. The neutron absorber in the control rods

is boron carbide (B4C) or silver-indium-cadmium alloys. As with the fuel

assemblies, the exact number of control rod assemblies depends on the NSSS

vendor and the reactor design. Also included in the control rod drive

system is an energy source for the drive mechanisms. For PWRs the energy

source is electrical power, and for BWRs it is a charged hydraulic system.

When fully inserted into the reactor core, the control rods provide sufficient negative reactivity to stop the core's chain reaction while the

reactor is at operating temperatures. Power shaping is accomplished by

driving selected control rods to predetermined positions within the reactor core.

In PMRs, control rods are held above the reactor core suspended by

electromechanical devices. When a trip signal is received, the electrical currenst passing through the devices is interrupted causing them to release the control rods. The control rods then drop due to gravity through

their guide tubes into the reactor core. Control rod drive stators are

typically air cooled by the control rod drive mechanism fans that draw

air from the containment through a chiller.

For BWRs, hydraulic pressure is used to force the control rods up

into the core from their position below the reactor. The loss of electrical signal will actuate two pilot valves that in turn activate a scram

inlet valve and a scram exhaust valve. The scram exhaust valve operates

slightly before the inlet valve and exhausts water from the guide tube

above the control rod drive mechanisms drive piston. The scram inlet

opens to supply pressurized water to the bottom of the drive piston. This

dual action rapidly forces the control rod up into the reactor core. 4

Control rod drive systems in PWRs interface with the plant ac distribution system, the reactor building cooling water system, the dc power system, the reactor protection system, the reactor control system, and the
'29

reactor core. In BWRs, the control rod-drive system interfaces with the

plant ac distribution system, the reactor protection system, the reactor

control system, the control rod drive hydraulic subsystem, and the reactor

core.

N02.A Control rod drive hydraulic system (BWR). The control rod

drive hydraulic system supplies and controls the pressure and flow of

water to and from the BWR control rod drives through a hydraulic control

unit (HCU). There is one HCU for each control rod drive. The control rod

drive system is required to:

1. recharge the scram accumulators (part of the ECUs) during a scram

reset or during system startup'(a scram discharge volume is provided

for all control rod drives to receive the water displaced by the

drives during a reactor scram);

-2. maintain, during rod insertion or withdrawal, drive pressure sufficiently above reactor vesssel pressure to permit operation of drive

mechanisms;

3. supply cooling water to the HCUs; and

4. pressurize the return line slightly above reactor vessel pressure to

receive the normal drive discharge to the reactor vessel.

The control rod drive hydraulic system is a one-train system designed

to supply pressurized water to the hydraulic control units. The HCUs are

connected to'a pump discharge by'four'parallel piping headers: accumula-

*tor charging, drive, cooling, and return. Each HCU furnishes, on signal,

the pressurized water to a drive unit that positions a control rod. Each

HCU has anumber of valves that control water flow to and'from a drive

piston and an accumulator that stores sufficient energy to'fully insert

its associated control rod at lower reactor vessel pressures. The control

rod drive hydraulic system is'a Safety Class 2 system, and it is located

within the secondary containment.

Water is drawn from the condensate storage tank by one of two redundant pumps. The other pump is an installed spare. The water is filtered

on pump suction and again, by one of two drive water filters, on pump discharge.' A flow control valve downstream of the'drive water filters maintains a constant system flow rate. A charging water header supplies charging flow to each of the ECUs and to the drive header. Pressure in the

drive header is maintained by a pressure control valve located between the

charging and cooling headers.

Flow 'through the drive headers to the HCUs and the-return flow from

the HCUs are stabilized by passing the flow through two parallel, solenoid operated stabilizing valves. The drive header also supplies flow to

the cooling header. Cooling header pressure is maintained by a pressure

control valve located between :the drive and cooling headers.- A return

header routes water discharged from the HCUs during normal operation and

water passing through the cooling header pressure to the reactor vessel.

During a scram, water-discharged-through the HCUs flows into a common

header and then into an instrument volume. *This piping arrangement makes

up the scram'discharge system. -
30

The control rod drive hydraulic system interfaces with the following

systems:

* plant ac distribution

* reactor protection

* reactor control (rod control and information)

* condensate storage

N03 Reactor control system (BWR and PWR)

The reactor control system provides the means for monitoring and

controlling control rod position during normal operating conditions. The

objective of the reactor control system is to match reactor power as

closely as possible to unit demand while maintaining a controlled power

level and balanced flux distribution in the reactor core. In BWRs, this

is accomplished by a manual control system in which an operator can selectively position a single control rod or a control rod group. The electrical circuitry, switches, indicators, and alarms that are needed to provide

input signals for the control rod drive system make up the reactor manual

control system. In PWRs, the control function may be either automatic or

manual. While in the automatic mode, the input signal to the control rod

mechanisms is produced by comparing the reactor power level with the unit

demand as seen by the turbine. The relative difference between these signals controls the motion of the control rod drive mechanism. At low power

conditions, the reactor is under manual control by an operator. The operator may also assume manual control at any time while the reactor is in

a normal operating mode. The design and capabilities of the PWR reactor

control systems vary'depending on the NSSS vendor. In reactors designed

by Babcock & Wilcox (B&W), this system is called the integrated control

system (ICS). In B&W units, the ICS also controls the feedwater and turbine generator systems. Combustion Engineering (CE) uses the title reactor regulating system. The reactor control systems interface with the 120

Vac instrument power system, the control rod drive system, the nuclear

instrumentation system, an'd the nonnuclear instrumentation system of their

respective units.

N04 Reactor recirculation system (BWR)

The reactor recirculation system pumps reactor coolant through the

core. This is accomplished by two recirculation loops that are external

to the reactor vessel but inside the containment. A constant flow rate is

maintained by either variable speed pumps (older BWRs) or a flow control

valve (newer BWRs). The reactor recirculation system is a Safety Class 1

system. Electrical power for each recirculation loop is provided by separate power trains.

-The reactor vessel is also included as a part of the reactor recirculation system. The vessel contains, in addition to the core, the core

support structures; the steam separators and dryers; the jet pumps; the

control rod guide tubes; distribution lines for feedwater, core sprays,

and liquid control; the in-core instruments; and other components. The
31

reactor core is cooled by demineralized water that 'enters the lower portion of the core and boils as it flows'upward through the fuel bundles.

Steam leaving the core is dried by the steam separators and dryers located

in the'upper portion of the reactor vessel. The steam is then directed

to the turbine by the main steam system.

A typical recirculation loop (in newer BWRs) contains four motor

operated valves and one hydraulically operated valve, a recirculation

pump, and twelve jet pumps. TWo motor operated valves are used as pump

suction and pump discharge valves. A third motor operated valve is used

to bypass the larger discharge shutoff valve to warm the pipeline during

the hot standby condition. The last motor operated valve is in a line

that bypasses both the flow control valve and the discharge shutoff valve.

This valve is manually set to adjust bypass flow control. The hydraulically operated flow control valve is located between the recirculation

pump and the discharge shutoff valve. Downstream of the bypass line and

discharge shutoff valve are the jet pumps. The jet pumps are internal to

the reactor vessel and are located between the inner vessel wall and the

core shroud. For older BWRs, the flow control valve is omitted and a

variable speed recirculation pump is used.

Systems interfacing with the reactor recirculation system are

* main steam and feedwater (through the vessel)'

* control rod drive

* reactor core

* plant ac distribution

* dc power (for pump and valve control circuitry)

* instrument air (for flow control valve)

* high- and low-pressure core spray, reactor core isolation cooling,

residual heat removal, and reactor water cleanup (all through the

vessel)

* reactor building cooling water (recirculation pump motor cooling)

* reactor vessel support -

N04 Reactor coolant system (PWR)

The reactor coolant system transports heat from the reactor core to

the steam generators where steam is produced for use in the unit's turbine. Depending on the NSSS vendor and the generation of the design,

two to'four coolant loops are'used. Loop design may involve one reactor

coolant pump and one steam generator per loop or two reactor coolant pumps

and one steam-generator per loop. The reactor coolant system is a Safety

Class 1 system. Electrical power is provided by two or three separatebuses depending on reactor design. The reactor coolant system is contained entirely within the containment building.

In PWRs, reactor coolant pressure is maintained by a pressurizer that

is connected to the piping between the reactor vessel outlet and the steam

generator inlet (hot leg). Pressure is controlled by altering the saturation temperature and pressure of the steam and water inside the pressurizer. Condensing the steam volume by spraying cooler water into it has

the net effect of reducing system pressure. Increasing the steam temperature by using electric heaters to heat the water volume has the effect of
32

increasing system pressure. A system of pressure relief valves is provided to prevent overpressurizing the reactor coolant system.

The steam generators are vertical shell and tube (either straight or

U-tube) heat exchangers in which hot reactor coolant water passes through

the tubes heating secondary water on the shell side to the boiling point.

Steam drying is accomplished inside the steam generators. Steam leaving

the steam generators is transported to the unit's turbine by the main

steam system.

The reactor vessel is an integral part of the reactor coolant system.

The vessel makes up a part of the primary system pressure boundary, and

it contains the reactor core, the core support structures, the in-core instruments, and the control rod guide tubes. In the B&W NSSS, vent valves

are placed between the upper plenum and the downcomer.

The reactor coolant system interfaces with the following systems:

• reactor core

* control rod drive

* plant ac distribution

• do power (for pump control circuitry)

* high-pressure safety injection

* residual heat removal

* chemical and volume control

* emergency boration (Westinghouse reactors)

* main steam and feedwater (through the steam generators)

* reactor building cooling water (reactor coolant pump motor cooling)

* reactor vessel support

* reactor cooling system piping

N05 Standby liquid control system (BWR)

The standby liquid control system is designed to operate in the event

that an insufficient number of control rods can be inserted into the reactor to shut it down in a normal manner. Although the standby liquid control system does not operate as quickly as the control rods, it does provide a redundant, independent, and diverse method for bringing the fission

process to suboriticality and maintaining subcriticality as the reactor

cools. The standby liquid control system operates by injecting concentrated boric acid into the coolant water. The system is sized to bring

the reactor from rated power to cold shutdown. The standby liquid control

system is a manually initiated Safety Class 2 system.

A typical system' configuration has two redundant pumping trains drawing from a common boric acid solution tank and discharging into a single

line connecting to the reactor vessel. A recirculation line through a.

test tank is also provided. The standby liquid control system is located

within the reactor building and penetrates primary containment. Electrical power is provided by two separate independent buses.

Systems typically interfaced with the standby liquid control system

are

* essential ac distribution subsystem

* do power (for pump and valve control circuitry)
33

* demineralized water

* reactor core and reactor recirculation (inside the vessel)

N05 Emergency boration system (PWR)

In the event of a steam line break or -the spurious actuation of a

main steam pressure relief valve in the presence of a stuck rod, PWRs require the rapid injection of a concentrated boron solution to control reactivity and to shut down the reactor. In reactors of Westinghouse design, this function is provided by the emergency boration system. In CE

and B&W reactors, boron injection is a function-of the chemical and volume

control system. The emergency boration system is a Safety Class 2 system

that penetrates containment. Electrical power is supplied by the essential ac distribution subsystem.

The emergency boration system is often a single train system with

redundant boron injection pumps. The pumps draw suction from a single

tank and discharge into a header that connects to the suction side of each

of the reactor coolant cold legs. Piping also connects the reactor coolant pump discharge to the boron injection tank. A recirculation loop is

provided for testing and recirculation of concentrated boric acid and usually contains a pump and surge tank.

The emergency boration system interfaces with the following systems:

* essential ac distribution subsystem

* reactor coolant

* chemical and volume control

* do power (for pump control circuitry)

* emergency core cooling system actuation

N06 Reactor protection system (BWR and PWR)

The reactor protection system monitors the reactor,- reactor coolant

system, and other plant parameters important to safety. Upon an abnormal

condition of any one or a combination of the various parameters, it instructs the control rod drive system to shut down the reactor to prevent

fuel damage and in some instances to prevent the overpressurization of the

reactor coolant system. The parameters typically monitored are

* reactor power and core power balance (axial and radial) -

* reactor coolant temperature and pressure

* operation of the reactor coolant or reactor recirculation pumps

* dry well (primary containment) pressure

* feedwater flow

* turbine operation

This list is not inclusive; other-parameters may be monitored depending on the NSSS vendor and the generation of the design.

Reactor protection systems are Class 1E systems and typically consist

of three or four signal processing channels that are kept electrically

independent and physically separate. The channel outputs are combined

into a two-out-of-three (2/3) or~a two-out-of-four (2/4) voting logic.
34

The manner in which the 2/4 logic is developed depends on the NSSS vendor. Each signal processing channel monitors all of the plant parameters

used by the particular design. When an abnormal condition of any of the

parameters is sensed by a channel, the channel goes into a "trip" state.

The coincidence of two signals on any of the three or four channels will

cause the reactor protection system to initiate a reactor trip or shutdown.

Systems that interface with the reactor protection system are

* nuclear instrumentation or neutron monitoring

* nonnuclear instrumentation

* ac instrument power

* control rod drive

N07 Neutron monitoring/nuclear instrumentation system (BWR and PWR)

The neutron monitoring or nuclear instrumentation system is used to

monitor reactor performance and to provide this information to the plant

operators, the reactor control system, and the reactor protection system.

The neutron monitoring/nuclear instrumentation systems are typically made

up of four to six subsystems depending on the NSSS vendor. A source range

monitor subsystem provides neutron flux indications during startup and low

power operation. The intermediate range monitor system operates during

low- and intermediate-power operations. In some designs, it may also inr

put into the reactor protection system. The power range monitor subsystem

provides flux indications during full power operation. It is the prime

source of neutron flux information for the reactor protection system.

These three subsystems measure average reactor power and power imbalances.

Some designs incorporate a local power range subsystem, which can provide

detailed information about neutron flux throughout the reactor core and

under any power level operation. In-core monitoring subsystems are also

included and are usually used to calibrate the other subsystems. A rod

block or rod withdrawal inhibit subsystem is also common and is used to

prevent control rod withdrawals unless reactor coolant flow rates are

within established boundaries.

The various sensors, with the exception of the in-core monitors, are

mounted on the outside of the reactor vessel. All subsystems connected to

the reactor protection system are classified as Class IE. In-core monitors are typically utilized for fuel management and are not classified

1E.

Systems that interface with the neutron monitoring/nuclear instrumentation system are

* ac instrument power

* reactor protection

* reactor control

* control rod drive
35

N08 Residual heat removal/low-pressure safety injection system

(BWR and PWR)

The residual heat removal/low-pressure safety injection system (RHR/

LPSIS) is a versatile system that performs several functions during the

various states of reactor operation. Its primary function is to remove

heat from the reactor core during normal shutdown, loss-of-coolantaccident (LOCA), and post-LOCA conditions. It may also assist in containment heat removal and containment spray operations. The RHR/LPSIS is a

Safety Class 2 system which is powered by the essential ac distribution

subsystem. In some designs the RHR/LPSIS is called the decay heat removal/low-pressure safety injection system or the shutdown cooling/lowpressure safety injection system.

The RHR/LPSIS is a two- or three-train system depending on the NSSS

vendor and the design generation. Each train of the two-train designs has

a 100% capacity and is redundant to the other train. Three-train designs

require two of the three trains to operate in order to accomplish their

function. Each train consists of a pump and a heat exchanger with their

associated valves. In PWRs, the pumps can be aligned to draw suction from

the borated refueling water storage tank, the containment sump, or a hot

leg (or legs) of the reactor coolant system. In BWRs, suction is from the

suppression pool. After passing through the heat exchanger, discharge

piping may connect at several points and be valved in or out depending on

the operational mode of the RHR/LPSIS.

During a normal shutdown, valve alignment directs flow from the reactor coolant system hot leg (suppression pool in BWRs) through the RHR

pumps and heat' exchangers into the reactor vessel (reactor recirculation

system pump discharge in BWRs). Following a large LOCA, the LPSIS goes

into a coolant injection mode when reactor vessel pressure lowers enough

to permit operation. In this case, valve alignment directs suction from

the borated or refueling water storage tank (still the suppression pool in

BWRs) through the pumps and heat exchangers or piping to the reactor vessel. When the water level in the borated or refueling water storage tank

falls to a predetermined height, suction in PWRs is changed over to the

containment sump and the storage tank is usually valved out to prevent

pump cavitation. This phase of operation is known as the recirculation

mode. In BWRs, the recirculation mode has the same flow path as the injection mode. In some cases, suction is taken off RHR/LPSIS piping for

containment spray or high-pressure coolant injection. In BWRs, suppression pool temperature can be limited by directing a portion of the cooled

LPSIS flow into the suppression pool. This is called the containment heat

removal mode. The RHR/LPSIS interfaces with the following systems:

* essential ac distribution subsystem

* dc power (for pump and valve control circuitry)

* reactor coolant/reactor recirculation

* reactor building service water, reactor building cooling water or the

chemical and volume control (for secondary heat exchanger cooling)

* refueling (in PWRs)

* engineered safety features actuation
36

Other interfaces may include:

* containment spray system

* reactor core isolation cooling system (in BWRs)

* high-pressure safety injection system

NO9 Reactor water cleanup system (BWR)

The reactor water cleanup system is used to recirculate a portion of

the reactor coolant through a filter-demineralizer system to remove particulate and dissolved impurities from the reactor coolant. It is also

used to remove excess coolant from the reactor system in a controlled

fashion. The reactor water cleanup system is a nonsafety system even

though a portion of its piping is a part of the reactor coolant pressure

boundary. These piping sections can be isolated if necessary.

One of two parallel cleanup recirculation pumps draws suction from

reactor recirculation system piping and discharges through a series of

regenerative and then nonregenerative heat exchangers. Flow out of the

nonregenerative heat exchangers may be passed through one of two parallel

filter-demineralizer units, or the filter-demineralizers. may be bypassed.

From the filter-demineralizers or the by-pass, flow can be directed back

through the regenerative heat exchangers and into the feedwater system

piping or directly to the condensate system. It is also possible to direct flow into the liquid radwaste system.

The reactor water cleanup system interfaces with the following

systems:

* plant ac distribution

* de power (for pump and valve control circuitry)

* reactor recirculation

* containment isolation

* reactor building closed cooling water (secondary side of nonregenerative heat exchangers)

* feedwater

* condensate storage

* liquid radwaste

N09 Chemical and volume control system (PWR)

The chemical and volume control system (CVCS) controls the volume,

purity, and boric acid content of the reactor coolant. The CVCS also provides seal injection water for the reactor coolant pumps. Coolant purity

is controlled by continuously purifying a bypass stream of reactor coolant. Adjustments in coolant volume are made automatically to maintain a

predetermined level in the pressurizer. A "bleed and feed" technique is

used to control the boric acid concentration in the reactor coolant. In

B&W and CE units, the CVCS also supplies the emergency boration function.

The CVCS is in general a nonsafety system even though portions of it,

such as the emergency boration piping and those sections of piping that

form a part of the reactor coolant pressure boundary, are safety grade

piping. Electrical power is supplied by the plant ac distribution system.
37

In B&W units, the chemical addition and boron recovery system, the

letdown and purification system, and portions of the high-pressure injection system are the equivalent of the chemical and volume control system.

For coolant purification, a typical flow path through the CVCS is

letdown from the reactor coolant system, usually through a regenerative

heat exchanger into a series of filters and the demineralizers to the

volume control tank. Charging pumps draw suction from the volume control

tank and discharge, usually, back through the regenerative heat exchanger

into the reactor coolant system cold leg piping. The volume control tank

acts as a supply of coolant for increasing reactor coolant inventory and

as a storage tank for inventory reduction.

The volume control tank is typically tied to the borated or refueling

water storage tank or the boric acid mix tanks through boric acid transfer

pumps and filters.- Boric acid concentration in the reactor coolant is

controlled by diverting the letdown stream. to the boron recovery subsystem

and sending either concentrated boric acid or demineralized water through

the charging pumps.

Reactor coolant pump seal leak off is collected in a header and directed, usually, through a cooling heat exchanger to the volume control

tank. From there the.'charging pumps send a stream of flow through one of

two redundant filters-and a flow control valve into a header connected to

each reactor coolant pump's seals..-.

Systems that interface with the chemical and volume control system

are

* plant ac distribution

* dc power (for pump and valve control circuitry)

* reactor coolant

* reactor building cooling water system (for nonregenerative heat

exchanger secondary flow)

* demineralized water

* engineered safety features actuation

* refueling -

* liquid radwaste (for sluice from the filters and demineralizers)

* instrument air (for flow control valve)

* gaseous radwaste (vents)

A.2 Engineered Safety Systems - S

The engineered safety systems.grouping is made up of those systems,

other than containment systems, that are used'to mitigate the effects of

a reactor accident such as an LOCA.' Thesystems and subsystems that make

up the engineered safety system's grouping are listed in Table A.2. The

following systems descriptions are identified as relating to a BWR or PWR

or both.

SO1 -Reactor core isolation cooling system (BWR)

The reactor core isolation cooling system (RCIC) provides makeup

water to the reactor vessel when the vessel is isolated. The RCIC system
38

Table A.2. Engineered safety systems

BWR PWR

S01 Reactor core isolation

cooling system

S02 Engineered safety features

activated by a number of

independent control

systems

S03 Engineered safety features

S03.A High-pressure core

injection/spray system

S03.B

Engineered safety features

actuation system

Safety injection system

High-pressure safety

injection subsystemG

Safety injection tank/

core flood subsystema

Low-pressure safety

injection subsystem (a

functional mode of the

residual heat removal

system)a

S03.C Low-pressure coolant

injection (a functional

mode of the residual heat

removal system)

S03.D Low-pressure core spray

system

S03.E Automatic depressurization

system

S04

SOS

Remote shutdown system Remote shutdown system

Auxiliary feedwater system

aB&W units have these as separate, independent systems.

is an automatically initiated system designated to maintain an adequate

water level in the reactor vessel. The RCIC system is a Safety Class 2

system that penetrates primary containment. Electrical power is provided

by the do power system.

The RCIC system's primary source of water is the condensate storage

tank. The secondary source is the suppression pool. Valves may also be

aligned to provide water from the RHR/LPSIS. A steam turbine-driven pump

draws suction from these three sources and discharges through a shutoff

valve into the reactor vessel. Steam to operate the turbinle is generated

in the reactor vessel by decay heat in the reactor core.

Systems that interface with the RCIC are

* Reactor coolant (in the suppression pool and in the form of steam for

the turbine)

* dc power (for pump'and valve control circuitry plus electrical power

for valve operators)
39

* residual heat removal/low-pressure safety injection

* condensate storage

SC2 Engineered safety features actuation system (PWR)

The engineered safety features actuation system (ESFAS) monitors a

number of plant parameters important to safety. An abnormal indication of

any of these parameters will cause the ESFAS to activate and the corresponding mitigation system to prevent the occurrence of excessive offsite

radiation. Typical parameters that are monitored are

* reactor coolant or pressurizer pressure

* reactor building pressure

* refueling or borated water storage tank water level

* steam generator pressure (shell side)

The mitigating actions initiated by the ESFAS are

* high-pressure safety injection

* low-pressure safety injection

* containment isolation

* low-pressure change to recirculation

* containment cooling through ventilation

* containment spray

* steam generator level control (in some systems)

There is no equivalent of the ESFAS in BWRs. Each BWR system that

provides the equivalent of one of the above-functions has its own actuation and control system

The ESFAS is a Class IE system that consists of three or four signal

processing channels for each parameter which output typically into two 2/3

or 2/4 voting logics. The exact combination of signal processing channels

and voting logics for a particular reactor depends on the NSSS vendor. An

abnormal value for any of the monitored parameters will cause its signal

processing channel to go into a "trip" state for each of the two voting

logics. The coincidence of two tripped channels for the same parameter

will cause the ESFAS to actuate the associated mitigation system or systems.

Systems that interface with the ESFAS are

* instrument ac power

* nonnuclear instrumentation

* high-pressure safety injection

* residual heat removal/low-pressure safety injection

* containment cooling

* containment spray

* auxiliary feedwater

* any system with valves that must be closed to isolate the containment
40

S03 Safety injection system (PWR)

The safety injection system is composed of three subsystems: the

high-pressure safety injection subsystem, the safety injection tank/core

flood subsystem, and the low-pressure safety injection subsystem. In B&W

units, these subsystems are treated as individual systems. Each subsystem

is discussed below.

S03.A High-pressure safety injection subsystem (PWR). The highpressure safety injection subsystem (IPSIS)-is designed to operate for

small LOCAs when reactor coolant pressure has not been significantly reduced. In this circumstance, the HPSIS injects borated water into the

reactor coolant system to provide cooling to limit core damage and fission

product release and to ensure an adequate shutdown margin. The HPSIS is

actuated by the ESFAS and is powered electrically by the essential ac

distribution subsystem. The HPSIS is a Safety Class 2 system.

The HPSIS has two or three redundant trains depending on the NSSS

vendor. A typical train consists of a high head pump that draws suction

from the refueling water storage or volume control tank, again depending

on the NSSS vendor. All pumps are started on an initiation signal. The

pumps discharge flows into the cold legs or hot legs of each reactor coolant loop. The particular connection point depends on the NSSS vendor.

Both B&W and CE units have cold leg connections.

The UPSIS interfaces with the following systems:

* engineered safety features actuation

* essential ac distribution subsystem

* do power (for pump and valve control circuitry)

* chemical and volume control or refueling

* residual heat removal/low-pressure safety injection (for alternate

suction)

S03.B Safety injection tank/core flood subsystem (PWR). The safety

injection tank/core flood subsystem is a-passive system that requires no

external signal or. power source to operate. It is designed to rapidly

inject cooling water into the reactor vessel when vessel pressure falls

below a predetermined level. The safety injection tank/core flood subsystem is a Safety Class'2 system.

In Westinghouse and CL designed reactors, the safety injection tank

subsystem is a subsyste m'of the safety injection system. In B&W units,

the core flood system is a separate, system that shares common reactor

vessel inlet piping with the RHR/LPSIS.

ITypically, there is one safety injection tank for each safety injection train. The tanks contain borated water and are pressurized to about

600 psig. Nitrogen is used to provide the charging pressure. The outlet

of a safety injection tank is connected to a check valve that directs flow

out of the tank. In series with the check valve is a motor operated isolation valve. Under normal operating conditions, the motor. operated

valves are open and reactor coolant pressure against the check valve outlets is enough to keep the valves closed. In the cold shutdown condition

when reactor vessel pressure is not high enough to prevent the check

valves opening, the motor operated valves are closed. In the event of a

large LOCA, reactor vessel pressure will decrease. When the pressure has
41

lowered below the charging pressure in the safety injection tanks, the

check valves will open, injecting cooling water into the vessel. The

safety injection tanks contain enough borated water to cover the reactor

core.

Systems that interface-with the safety injection tank/core flood

subsystem are:

* reactor coolant

* nitrogen subsystem of the plant gas system

* borated or refueling water storage tank

* other subsystems of the safety injection system or the RHR/LPSIS

* plant ac distribution (for motor operated valve operation)

* engineered safety features'actuation

S03.C Low-Pressure safety injection subsystem (PWR). In some plants

low-pressure safety injection is a function of the RHR/LPSIS,'which is

discussed in Sect. NM8.

S03 Engineered safety features (BWR)

Reactors of General Electric design do not have a single equivalent

of the safety injection system. There are four systems that perform

essentially the same functions, but they actuate and operate more or less

independently. The four systems are high-pressure core injection/spray

(JPCI/S), low-pressure coolant injection, low-pressure core spray (LPCS),

and automatic depressurization. Each is described below.

S03.A High-pressure core iniection/spray system (BWR). The HPCI/S

system maintains an adequate coolant inventory inside the reactor vessel*

to keep fuel cladding temperatures below fragmentation temperature in the

event of small breaks in the reactor coolant pressure boundary. In older

BWR designs, an injection system was used to input cooling water into the

feedwater lines for core cooling. New BWR designs use a spray sparger

mounted above the reactor core'for cooling water injection. The HPCI/S

system cooling is used to help decrease vessel pressure to allow operation

of the low-pressure cooling systems. In the new'BWR designs, the HPCI/S

system operates independently of all other systems. It is provided its

own dedicated power system. The HPCI/S system is'a Safety Class 2 system

that penetrates primary containment.' The HPCI/S system may be used as a

backup to the RCIC system.

The HPCI/S system is a single train system that may have redundant

pumps. Suction may be drawn from the condensate storage tank or the suppression pool. Pump discharge is through a series of check valves into

the feedwater line (old BWRs) or the spray sparger (new OWRs). The HPCI/S

system is actuated by its own control system on the occurrence of high

containment pressure or low water level in the vessel. A recirculation

line is provided'for testing.

Systems that interface'with'the HPCI/S system are

* essential ac distribution subsystem (old BWRs) or HPCI/S power system

(new BWRs)

* dc power (old BWRs for pump'control circuitry)
42

* condensate storage

* feedwater (old BWRs)

e suppression chamber

S03.C Low-pressure coolant iniection system (BWR). Low-pressure

coolant injection is a function of the RHR/LPSIS which is discussed in

Sect. N08.

S03.D Low-pressure core spray system (BWR). The low-pressure core

spray (LPCS) system is designed to deliver low-pressure cooling water to a

spray sparger located over the reactor core. The LPCS system has the

ability to cool the fuel by spraying water into each fuel channel. The

LPCS system can only be activated after reactor vessel pressure has been

reduced. In conjunction with the automatic depressurization system or the

HPCI/S system, the LPCS system can maintain fuel cladding below the fragmentation temperature. The LPCS system is a Safety Class 2 system and is

powered from the essential ac distribution subsystem.

The LPCS system consists of a single independent pump that draws

suction from the suppression pool and discharges through a series of check

valves into the low-pressure spray sparger over the reactor core. The

LPCS system is actuated by its own control system upon the indication of a

reactor coolant pressure boundary breach, but it is prevented from operation until after reactor vessel pressure is reduced. A recirculation line

is provided for testing.

The following systems interface with the LPCS system:

e essential ac distribution subsystem

* dc power (for pump control circuity)

* suppression pool

* instrument air (for air operated check valve inside containment)

S03.E Automatic depressurization system (BWR). The automatic depressurization system operates to reduce reactor vessel pressure to permit the operation of low-pressure cooling systems in an LOCA situation in

which the HPCI/S system is not maintaining adequate coolant inventory.

The automatic depressurization system is a control system that actuates

some of the relief valves mounted in the main steam lines. The automatic

depressurization system actuates on the indication that a reactor coolant

pressure boundary breach has occurred, that the HPCI/S system is not providing sufficient coolant flow, and that the LPCS or the RHR/LPCIS pumps

are in operation. The automatic depressurization system is a Class 1LE

system.

The only system with a direct interface with the automatic depressurization system is the main steam system.

S04 Remote shutdown system (BWR and PWR)

The remote shutdown system, in both BWRs and PWRs, usually consists

of a remote control panel from which the systems necessary to bring the

plant to a safe cold shutdown can be operated. The controls on the panelboard are redundant to their counterparts in the control room, and they

are to be used in the event that the control room is damaged or becomes

uninhabitable. The controls on the remote shutdown panel vary between
43

NSSS designs. In some instances the remote shutdown system is a bunkered

system. It is designated as a Class 1E system and interfaces with the

following systems:

* control rod drive

* nuclear instrumentation

* nonnuclear instrumentation

* essential ac power

SO Auxiliary feedwater system (PWR)

The auxiliary feedwater system (or emergency feedwater system) is

designed to provide an adequate supply of cooling water to the steam generators so that they can act as heat sinks for decay heat removal from the

reactor core in the event of a loss of power, a feedwater line malfunction, a small LOCA, or a main steam line break. The system is a Safety

Class 3 system with the-exception of the piping between the isolation

valves and the connections to the feedwater piping. These sections of

piping are Safety Class 2. The auxiliary feedwater system generally penetrates containment. Electrical power is provided by the essential ac distribution subsystem. A turbine-driven pump is supplied steam from taps

on the main steam lines. The auxiliary feedwater system is actuated by

its own control system. Actuation may be initiated by a loss of ac power,

a decrease in feedwater header pressure, a safety injection signal, low

level in the steam generators, or a manual signal. During startup, the

auxiliary feedwater system is used to increase steam generator pressure

by drawing suction from the condensate storage tank. This provides enough

steam to start the main feedwater pumps.

The auxiliary feedwater system typically consists of two motor driven

feedwater pumps and one steam turbine driven feedwater pump. The two

motor driven pumps are sized for 50% capacity each; the turbine driven

pump is sized for 100% capacity. Operation of only one pump is needed.

All start on the actuation signal. The turbine driven pump will operate

as long as steam is available from the main steam lines and dc control

*power is available. The pumps usually draw suction from two or more

sources. Among the sources may be an auxiliary feedwater storage tank,

the condensate storage tank, the service water system, and the condenser

hot well. The pumps' discharge typically passes through a common header

before entering the piping connected to the main feedwater lines. There

is at least one auxiliary feedwater line for each main feedwater line.

Flow control in each auxiliary feedwater line is established by a flow

control valve.

The following systems interface with the auxiliary feedwater system:

• main steam system

* feedwater system

* essential ac distribution system

* dc power system (for pump control circuitry)

* engineered safety features actuation system

* condensate system

* condenser storage system
I

44

e demineralized water system (makeup to the auxiliary feedwater storage

tank)

* instrument air system (for pneumatic valves)

A.3 Containment Systems - C

The containment systems grouping is made up of the containment (primary and secondary, as applicable) and those systems needed to prevent

containment overpressure, to prevent excessive leakage from the containment to the environment, and to provide a habitable atmosphere inside containment. The systems and subsystems that make up the containment systems

grouping are listed in Table A.3. The following systems are identified as

relating to a BWR or a PWR or both.

Table A.3. Containment systems

BWR PWR

CHl

C02

C03

Primary containment and

penetrations

Reactor building

Containment heat removal

(a function of the residual

heat removal system)

Containment isolation system

I

C03.A

C04

Reactor building/containment

and penetrations

Containment cooling system

Ice condenser systema

Containment isolation (a

function of the ESFAS and

the various piping systems

that penetrate containment)

Containment purge system

,,

C05

C06

C07

C08

CO9

Cl0

Cli

Containment purge system

Standby gas treatment system

Combustible gas control

system

Containment ventilation

system

Reactor building ventilation

Containment spray system

Combustible gas control

system

Containment ventilation

system

Containment spray system

Penetration room ventilation

system

aUnique to one series of Westinghouse units.
45

C01 Primary containment and penetrations (BWR)

The purpose of the primary containment is to contain the radioactive

fluids and fission products that may'result from postulated accidents

inside the containment. Primary containment design in BWRs features two

primary variations of the basic design. Primary containment consists of

the dry well, a steel and concrete structure that houses the reactor vessel, the reactor recirculation loops, the control rod drive mechanisms and

hydraulic subsystem, and other components, the wet well, or suppression

pool; and the standpipes connecting the dry well and wet well. In older

BWR designs, the dry well was an inverted "light bulb" structure and the

wet well was a steel torus'(doughnut) positioned below the dry well. Both

were housed in'the reactor building,'or secondary containment. New BWR

designs feature a primary containment much like that in PWRs. Dry well is

a steel-reinforced concrete'structure. The suppression'pool'is a toroidal

chamber in the concrete structure below the dry well, which is a part of

the reactor building. Rooms within both the old and new-design structures

are provided for the associated reactor systems and components..'

Penetrations provide controlled access through the primary containment for piping, electrical cabling,'other plant equipment, and personnel.

Penetrations are'normally'sealed by double 0-ring or double gasket seals.

Personnel and equipment penetrations are air lock assemblies in which the

inner and outer'doors are interlocked to prevent their simultaneous opening. Numerous electrical and piping penetrations'are installed. Two personnel hatches and an equipment hatch are typical.

C02 Reactor building (BWR)

The reactor building in BWRs is the secondary containment. During

plant operations, such as refueling, when the primary'containment must be

breached, the reactor building functions as the primary containment. The

reactor building houses the primary containment and various reactor support and safety system equipment; The reactor building is more typical of

older BWRs. In the newer designs, there is only a containment structure;

the primary-secondary distributions are not made.

C02 'Reactor buildina/containment and Penetrations (PWR)

As in BWRs, the PWR containments are designed to'mitigate the consequences of postulated accidents inside containment'by 'containing the radioactive fluids and'fission products that may be produced 'by the accidents.

The containment is usually a cylindrical or hemispherical carbon steel

lined, reinforced concrete'structure that houses the reactor vessel, reactor coolant system,'control'rod-drive mechanisms, the emergency sump,

various instrumentation, and other equipment.- In some instances there is

an air space, or-annulus,' between-the carbon steel liner'and the concrete

'structure. Numerous electrical and piping penetrations pass through the

containment structure. Two'personnel hatches, a'fuel'transfer tube, and

one'equipment hatch'are typical. The electrical and piping penetrations

are sealed by double 0-ring or double'gasket seals."' All connecting cabling or piping passes'through'a-penetrating room before attaching to the
46

penetrations. The penetration room contains any gases that may leak

through the penetrations during an accident situation. Equipment and

personnel hatches are double door air locks interlocked to prevent the

simultaneous opening of both doors.

C03 Containment heat removal (BWR)

In BWRs, containment heat removal is a function of the RHRILPSIS,

which is discussed in Sect. N08.

C03 Containment cooling system (PWR)

The containment cooling system is designed to help return containment

pressure to a low value following a pipe break inside containment by cooling and condensing the steam generated by the break. The containment

cooling system typically works together with the containment spray system

and the water in the emergency sump to reduce containment pressure. The

containment cooling system is totally housed inside the reactor building.

It is a Safety Class 2 system. Electrical power is provided by the essential ac distribution subsystem and the actuation signal is generated by

the ESFAS on the occurrence of a 4-psig pressure inside containment.

The containment cooling system may also be known as the reactor

building cooling system or a subsystem of the containment atmosphere recirculation system.

A typical system configuration has two to three fans that discharge

through cooling coils into a common header. Fan suction is taken from air

registers near the roof of the reactor building. After passing through

the cooling coils and common header, the fan discharge is directed by

ductwork into the lower portion of the reactor building structure. The

air then flows upward through the reactor building and around the reactor

vessel gaining heat as it rises. As the intake registers, the cycle is

started again.

The containment cooling system interfaces with the reactor vessel,

the reactor building, and the essential ac distribution subsystem.

C03.A Ice condenser system (PWR). In a number of units of Westinghouse design, an ice condenser cooling system is built into the containment structure. The ice condenser is designed to help limit pressure

inside the containment following an LOCA or a steam line break. As with

the containment cooling system, pressure reduction is achieved by condensing the steam generated and released to the containment during an accident. A glycol system keeps the ice frozen. The ice condenser system is

a Safety Class 3 system.

The ice is kept in "baskets" located in an annular space between the

inner containment wall and the containment's steel liner. The ice baskets

are also located at a level above the reactor vessel. Channels are provided to allow air flow through and between the ice baskets.

Following an accident, steam released to the containment causes the

internal pressure to build. At a designated differential pressure level,

doors in the inner containment wall will open allowing the steam to enter

the bottom of the annular ice storage space. The steam is forced up
47

through the ice baskets, condensing as it rises. At the top of the annular region, the cooled air is directed back into the inner containment

where it further condenses some of the steam inside the containment. Natural circulation keeps the cycle operating until equilibrium is reached.

A glycol refrigeration system having two redundant pumps and heat

exchangers keeps the ice in its frozen state.

The containment structure and the essential ac distribution subsystem

are the only systems that interface with the ice condenser system.

C04 Containment isolation system (BWR)

The purpose of the containment isolation system is to prevent the

release of significant amounts of radioactive materials from the reactor

coolant pressure boundary following an accident or certain transients.

This is accomplished by monitoring selected plant parameters and, on

the occurrence of an abnormal indication in one, initiating the closure of

selected valves in various systems that penetrate containment. The conditions that will initiate the containment isolation system include:

e reactor trips (level 2 or 3)

* high radiation in the main steam line

* high temperature in the main steam line

* high flow in the main steam line

* low pressure in the main steam line

* high dry well pressure

* high radiation at containment ventilation exhaust

The containment isolation system is a class 1E system, and it is

powered from separate buses in the do power system.

Four instrument channels are used for each parameter monitored by the

containment isolation system. The output of these channels is fed into

two 2/4 voting logics. When an abnormal condition is sensed by one of the

channels, it goes into a "tripped" state. The loss of a logic power supply will also cause its associated channel to trip. The coincidence to

two or more tripped channels will initiate a containment isolation. The

channel outputs are also fed directly to the main steam isolation valves

where a trip signal from channels 1 or 4 will activate one solenoid actuation valve. Channels 2 or 3 will activate the other solenoid. Both solenoid valves must operate to trip the isolation valve.

Systems that interface with the containment isolation system are the

dc power system and the various systems in which containment isolation

valves are located.

C04 Containment isolation (PWR)

Containment isolation is one of the functions provided by the ESFAS

in PWRs. This system is discussed in Sect. S02.
- I I

48

COS Containment purge system (BWR and PWR)

The containment purge system is designed to provide a habitable working environment for personnel inside the containment structure by reducing

airborne radioactivity and providing outside air during periods of extended occupancy. The containment purge system is a nonsafety system

powered by the plant as distribution system. The containment purge system

works in essentially the same fashion in both BWRs and PWRs.

In some designs, the containment purge system may be a subsystem in a

containment atmosphere recirculation and cleanup system.

The containment purge system is usually divided into two subsystems:

supply and exhaust. The supply subsystem uses a fan to draw in outside

air. The air is filtered before entering the fan and heated after discharge. Then the'air is exhausted to the containment. The exhaust 'subsystem also uses two fans to draw air from the containment. Containment

air passes through a multistage filtering system before it enters the

fans. Fan exhaust discharges through the unit vent. The exhaust is usually monitored for radiation. On the occurrence of high radiation, selected dampers are closed and the air flow goes into a recirculation mode.

Some designs have a filtration system that can be connected to most or all

of the containment air systems. The dual action of removing and filtering

containment air and bringing in fresh air tends to lower the airborne

radioactivity levels inside containment.

Systems that typically interface with the containment purge system

are the plant as distribution system, the containment system, and in some

instances a glycol system for heating the fresh air.

C06 Standby gas treatment system (BWR)

The standby gas treatment system limits the release of airborne radioactive materials to the environment under accident conditions.' The

system is activated by the following signals:

* high dry well pressure

* low reactor vessel water level

* high radiation in the fuel handling area ventilation system

* manual initiation

The standby gas treatment system is a Safety Class 3 system that is

supplied electrical power by the essential ao distribution system.

The standby gas treatment system is a two-train system whose principal components are fans and multistage filters. Depending on design,

the multistage filters may be on the suction side or the exhaust side of

the fans. Flow control is established by a motor operated valve on the

side of the fan opposite the filter. A normally isolated cross-tie is

sometimes provided between the fans' suction piping. Fan suction is normally drawn from the containment, ventilation system.

The essential ac distribution system and the containment ventilation

system typically interface with the standby gas treatment system. The dc

power system may also be used for fan control circuitry.
49

C07 Combustible kas control system (BWR and PWR)

The combustible gas control system monitors the hydrogen content inside containment after an LOCA and maintains the concentration at a safe

level. The system in newer designs is usually divided into two subsystems: the hydrogen recombiner subsystem, which is a Safety Class 2 'system, and its backup, the dilution air subsystem, which is nonsafety.

Older designs typically have a Safety Class 3 dilution air system. The

recombiner subsystem is supplied electrical power by the essential ac distribution. The dilution'air system is-supplied by the nonessential portion of the ac distribution system in newer designs. Both BWR and PWR

systems operate in essentially the same manner.

In older designs this system may be referred to as a hydrogen purge

system.

The recombiner subsystem design usually features two redundant recombiners with their associated fans, after-coolers, and ductwork. The comrbiners may'be'either'catalytic orelectric.- The dilution air subsystem

'has two'piping trains, a'supply train and an exhaust train, which operate

in the same manner as a containment purge system (Sect. C05). The'exhaust

subsystem may also discharge into the gaseous radwaste system. A hydrogen

analyzer continuously monitors containment air and actuates an alarm when

the hydrogen concentration'reaches a preset level, usually less than 4%.

The combustible gas control system is manually initiated.

The plant ac distribution system is the primary interface for the

combustible gas control system. The gaseous radwaste system may also

interface.'

C08 Containment ventilation system (BWR and PWR)

-The containment ventilation system circulates air within the containment to maintain the bulk air temperature suitable for personnel and

equipment. The containment ventilation system is a'nonsafety system and

is supplied power from th'e plant'ac distribution system. This system

operates continuously under normal plant conditions but is shut off under

accident conditions. Ventilation systems in both BWRs and PWRs work in

the same fashion with ductwork branching to supply a flow of air to each

of the rooms and compartments within the containment.

The containment ventilation system may also be called the reactor

building ventilation system, or it may be a subsystem of the containment

atmosphere recirculation system. The containment ventilation system may

be divided into various subsystems also. In BWRs the subsystems may include the dry well ventilation system. Those PWR containments that have

an annulus (the air space between the steel liner and the reinforced concrete) typically have an annulus ventilation system as a subsystem.

The containment ventilation system typically consists of two or three

fans with their associated ductwork and dampers. The fans generally discharge into a common header from which the ductwork branches into the

various rooms and compartments. -Some systems have a filtering unit installed 'in the ductwork. The system is manually operated from the control

room.

The plant ac distribution system is the only system that directly

interfaces with the containment ventilation system.
50

C09 Reactor building ventilation system (BWR)

Older BWR designs may have a reactor building ventilation system that

is totally separate from the containment (or dry well) ventilation system.

The purpose of this system is to maintain the bulk air temperature in the

reactor building (or secondary containment) suitable for personnel or

equipment. The system is operated in the same fashion and is designed

essentially the same as the containment ventilation system. It is also a

nonsafety system.

ClO Containment spray system (PWR and BWR)

The containment spray system provides a water spray to the containment following an LOCA or steam line break to limit containment pressure

and to minimize the release of radioactive iodine and particulates to the

environment. The containment spray system is a Safety Class 2 system

found in all PWR designs. Newer BWR designs have a containment spray that

is a subsystem of the RHR/LPSIS (Sect. N08). Electrical power for the

containment spray pumps is provided by separate buses of the essential ac

distribution subsystem. The containment spray system is normally housed

in the auxiliary building, with the exception of the spray headers and

nozzles, which are in the containment.

The containment spray system may also be called the reactor building

spray system.

There are a number of possible configurations for the containment

spray system. It is normally a two- or three-train system that either

draws suction directly from the refueling water storage tank and the

emergency sump or indirectly from these sources through the RHR/LPSIS or

the safety injection system. Most systems have chemical addition tanks

from which sodium hydroxide (NaOH) or hydrazine is added to the spray

water. These chemicals have the dual effect of improving iodine removal

from the containment atmosphere and neutralizing much of the corrosive

effects of the boric acid in the refueling storage tank water. Each of

the two or three piping trains has a containment spray pump that discharges into a spray header or headers inside the containment. In some

designs, the pumps discharge through containment spray heat exchangers.

The containment spray system may be manually actuated or it may be automatically actuated by the ESFAS. The occurrence of high containment pressure (about 10 psig) causes the ESFAS to actuate containment spray.

The following systems typically interface with the containment spray

system:

* essential ac distribution subsystem

* dc power system

* refueling water (condensate storage system for BWRs)

* emergency sump

* residual heat removal/low-pressure safety injection system

* reactor building cooling water (when heat exchangers are included)

* chemical and volume control (for the addition of sodium hydroxide or

hydrazine)
51

Cl Penetration room ventilation system (PWR)

Those reactor buildings that do not have a steel liner usually have

a penetration room through which all connections to electrical or piping

penetrations must pass. The penetration room sits outside of and adjacent

to the reactor building. After an accident, some leakage will occur

around the electrical and piping penetrations. The penetration room ventilation system is designed to prevent this leakage from escaping to the

environment. It is a Safety Class 3 system and is powered by the essential ac distribution subsystem.

The penetration room ventilation system is a two-train system. The

two redundant fans draw suction from the penetration room and discharge

through a multistage filter unit into the unit vent. On the occurrence of

high radiation at the vent, the system goes into a recirculation mode or

the flow is routed to the gaseous radwaste system. The suction from the

penetration room keeps it at a slightly lower pressure than the outside so

that any leakage is into the room rather than from the room. The penetration room ventilation system is manually actuated from the control room.

Systems that may interface with the penetration room ventilation system are the essential ac distribution subsystem and, possibly, the gaseous

radwaste system.

A.4 Electrical System - E

The electrical system grouping is made up of those plant systems that

supply electrical power to either the utility grid or other plant systems

or that are purely electrical in nature. These systems are essentially

the same in both BWRs and PWRs. The systems are listed in Table A.4.

EO1 Main power system

The main power system receives electrical power from the unit generator and directs it to the unit step-up transformer where the electrical

voltage is raised to a level compatible with the utility transmission system. The main power system is a nonsafety system.

There are two basic arrangements of the main power system. In the

first, an isolated phase bus is used to connect the unit generator to the

unit step-up transformer. The second arrangement has a split isolated

phase bus and two "half size" unit step-up transformers. In both cases,

taps are provided on the isolated phase bus for connections to a unit

auxiliary transformer. Some newer designs also incorporate generator

breakers that are located between the unit generator and the unit step-up

transformers. The isolated phase bus normally is provided with a cooling

system. Unit step-up transformers may be either a three-phase transformer

or three single-phase transformers.

Protective relaying for the main power system is designed to protect

the system's equipment from damage should a fault condition occur. If a

fault occurs, the relaying system will initiate the opening of the appropriate circuit breakers to isolate the faulted equipment. Relays that
I

52

Table A.4. Electrical systemsa

EO1 Main power

EOl.A Protective relaying and controls

E02 Plant ac distribution system

E02.A Essential power system

E02.B Nonessential power system

E02.C HPCS power system (BWRs)

E02.D Protective relaying and controls

E03 Instrumentation and control power systems

E03.A Do power system

Vital dc power subsystem

Plant de power subsystem

E03.B Instrument ac power system

Vital instrument ac power subsystem

Plant instrument ac power subsystem

E04 Emergency power system

E04.A Diesel generator fuel oil subsystem

E04.B Diesel generator cooling water subsystem

E04.C Diesel generator starting air subsystem

E04.D Diesel generator lubrication oil subsystem

E05 Plant lighting system

EO5.A Essential lighting

E05.B Nonessential lighting

E06 Plant computer

E07 Switchyard

E07.A Do control power system

E07.B Protective relaying

aThe electrical systems for both BWRs and

PWRs are essentially identical.

provide instantaneous overcurrent or time overcurrent protection and differential zone protection are typical.

Systems that interface with the main power system are

* turbine generator

* switchyard

* plant ac distribution (through the unit auxiliary transformer)

E02 Plant ac distribution system

The plant ac distribution system is the normal source of electrical

power for the plant under normal operating conditions, and it is the preferred choice under accident conditions. The system is divided into two

subsystems that are typically kept separated. The essential ac distribution subsystem provides electrical power to those systems that are required to bring the plant to a safe shutdown following an accident and
53

that are needed to mitigate the effects of an accident. This subsystem is

designated as Class lE. The essential ac'distribution subsystem is further divided into two or three distinct trains, depending on design.

These trains are kept electrically'separate and separated physically as

much as possible. Redundant-equipment in safety related piping systems

is supplied power from separate electrical power trains. The nonessential ac distribution subsystem supplies electrical power to the remainder

of the plant's systems. It is designated as a nonsafety system. [In some

newer BWR designs, a high-pressure core spray (HPCS) power system is provided. This system is dedicated solely to powering the equipment needed

for the HPCS system. The HPCS power system is designated Class 1E and is

kept separate from all others.]

The plant ac distribution system is a'hierarchical arrangement of

switchgear at various voltage levels. Both essential and nonessential

subsystems are constructed in this manner. There are usually three or

four different voltage levels within the plant ac distribution system.

The two highest levels are fed from the unit generator through a unit

auxiliary transformer when the unit is operating. The unit auxiliary

transformer is a tertiary transformer with the two secondary windings

having different voltage levels. When the unit is shut down, these two

voltage levels are fed from the switchyard through a startup transformer

or, in the case of a generator -breaker design, from the switchyard through

the unit step-up transformers and the unit auxiliary transformers. The

startup transformers are also'tertiary. The highest of the voltage levels

is either 13,800 or 6,900NV. The reactor coolant or reactor recirculation

pump motors are fed from here. The next voltage 'is the 4160-V level. The

essential and nonessential distinctions are first made here. Most large

pump motors in the plant are supplied from these-switchgear. Also, the

lower voltage switchgearare.supplied from the 4160-V switchgear. In some

design, there are essential and nonessential switchgear at this level.

Other designs have one set of switchgear with both essential and nonessential loads. In the event of an -accident, all loads are shed from the

siwitchgear, but only the essential loads are added back. When normal

power is not available, the emergency power system is generally connected

at the 4160-V level.

The next voltage level is either 600 or 480-V. Switchgear at this

level are fed from 4160-V switchgear through-auxiliary transformers.- This

voltage level is used to-supply power to medium to small pump and fan

motors and large valve operator motors.- Some plants also have. switchgear

at the 208- or 120-V level. These switchgear are supplied from the 600-

or 480-V level through auxiliary transformers. Small valve operator and

pump or fan motors are-supplied power-from these switchgear. Some instrumentation may also be included on these switchgear. The separation between the nonessential and the various trains of the essential subsystems

are maintained at these voltage levels.

-Switchgear at all of the-various voltage levels typically have two

incoming breakers through which they are supplied power. Only one of the

breakers is usually closed at any one time. Undervoltage relays are' supplied to coordinate the operation'of the normally closed and normally open

incoming breakers. At the 13,800/6,900-V and the 4,160-V levels, synchronizing relays are provided to prevent the paralleling of two voltage

sources unless they are synchronized.
54

Each of the incoming and feeder breakers in the plant ac distribution

system have protection from being damaged by electrical faults in other

equipment. At the 13,800/6,900- and 4,160-V levels, instantaneous overcurrent and time overcurrent relays provide this protection. At the lower

voltage levels, instantaneous magnetic and thermal magnetic coils that

actuate the circuit breakers are used. Thermal overloads are also used.

The following systems interface with the plant ac distribution system:

* main power

* switchyard

* emergency power

* do power (load off the 600/480-V switchgear plus control power for ac

circuit breakers)

* plant safety related systems (essential ac distribution subsystem)

* plant nonsafety related subsystems (nonessential ac distribution subsystem)

E03 Instrumentation and control power systems

The instrumentation and control power systems provide either do or

ac power to the instruments and control circuits for the plant. The do

power system is designed to supply either 125 or 250 V do to its designated loads. The distinction between safety and nonsafety power supplies

is kept in these systems. Each system in discussed in the following sections.

E03.A De power svstem. The do power system supplies an uninterruptible source of do electrical power to some instrumentation and numerous control circuits in the plant. Those do loads that are safety related

are supplied from a vital do power subsystem. Other do loads are supplied

from the plant dc power'system. (BWRs having an HPCS power system also

have a dedicated do bus for the HPCS system.)

The vital do power subsystem is composed of four separate panelboards that are supplied electrical power by a battery charger connected

in parallel with a 125-V battery. The battery chargers are connected to

the 600/480-V switchgear in the essential ac distribution subsystem (Sect.

E02). In the event of a loss of ac power, the batteries are sized to

carry their associated loads for a number of hours. Control circuits for

ac circuit breakers and the inverters for the instrument ac power system

(Sect. E03.B) are the primary loads on the do panelboards. The vital do

power subsystem is a Class 1E system.

The plant de power subsystem is constructed-in much the same manner

as the vital do power subsystem except that it sometimes is arranged to

supply 250- as well as 125-V do power. The loads on the plant dc power

subsystem are essentially the same as those on the vital subsystem except

that they are nonsafety loads, and the plant subsystem is a nonsafety

system.

The do power system interfaces with the following systems:

* plant so distribution

* instrument ac power
55

* most of the safety related plant systems (vital subsystem for control

circuitry)

* most of the nonsafety plant systems (plant subsystem for control circuitry)

E03.B Instrument ac power system. The instrument ac power system

provides an interruptible source of 120 V, single-phase ac power to the

plant's instrumentation and the plant computer. Safety related instrumentation is supplied from the vital instrument ac power subsystem. The

plant computer and nonsafety instrumentation is supplied by the plant

instrument ac power subsystem. (BWRs having an HPCS power system have a

dedicated 120-V ac bus and HCPS instrumentation.)

The vital instrument ac power subsystem is made'up of four separate

panelboards. Each panelboard is supplied power from an inverter that is

connected to a corresponding vital dc power panelboard or from a nonsafety, regulated power supply through a static selector switch. The

vital instrument ac power subsystem is a Class 1E system.

The plant instrument ac power subsystem is supplied by inverters or

by a regulated, 120-V, single-phase supply. The plant computer must be

connected to the regulated supplies. Other nonsafety instrumentation, including the turbine generator electrohydraulic control system, is supplied

by an appropriate number of panelboards. The exact number depends upon

the particular design. The plant instrument ac power subsystem is a nonsafety system.

Systems interfacing with the instrument ac power system are

* dc power

* plant computer

* reactor protection

* engineered safety features actuation (PWRs)

* turbine generator electrohydraulic control

* other safety related instrumentation (vital subsystem)

* other nonsafety related instrumentation (plant subsystem)

E04 Emergency power system

The emergency power system is designed to supply an adequate-amount

of electrical power to safely shut down the plant when the normal ac power

supply has been lost. The system has two distinct portions: an electrical system and a supporting group of mechanical systems. The electrical

portion is designated Class 1E and the-mechanical systems are classified

as Safety Class 3. (BWRs that have an HPCS power system are provided with

a dedicated emergency power system for the HPCS system loads.)

The electrical-portion of the emergency power system typically consists-of a diesel powered generator, s circuit breaker to connect the

generator to the 4160-V switchgear, under-voltage relays on the 4160-V

sw'itchgear to actuate the emergency power system, and the load shedding

and sequencing circuitry. There are typically two emergency power trains.

The supporting mechanical subsystems are discussed in the following sections.
56

The plant ac distribution system and the do power system are the only

plant systems that interface with the electrical portion of the emergency

power system. '

E04.A Diesel generator fuel oil subsystem. The diesel generator

fuel oil subsystem supplies the fuel to run the generators in the emergency power system. There is a fuel system for each diesel. Each fuel

system is sized to hold a 7-d supply of fuel oil when the diesel is operating under maximum loading conditions. The diesel'generator fuel oil subsystem is a Safety Class 3 system.'

Each fuel system has two storage tanks: a large storage tank and a

smaller day tank. Two redundant pumps are supplied to transfer fuel oil

from the storage tank to the day tank. The pumps can be manually actuated

or the level in the day tank can actuate them. Depending upon the design,

the day tank may supply fuel to the diesel via a fuel pump, or gravity

feed'may be used.

The diesel generator fuel oil subsystem interfaces with the essential

ac distribution subsystem and the do power system.

E04.B Diesel generator cooling'water subsystem. The diesel generator cooling water subsystem provides cooling for the diesel generators

while they are running. The system may also have a loop for warming the

diesel jacket'to prevent thermal shock when the diesel starts. Each diesel has a cooling system. The diesel generator cooling water system is a

Safety Class 3 system.

Typical system configuration features redundant pumps that discharge

into the diesel jacket. Pump suction draws from the diesel jacket through

a heat exchanger and a lubrication oil cooler. A surge tank is provided

to regulate water inventory. A recirculation loop is also provided with a

heater and its own pump for jacket warming. The temperature of the water

leaving the diesel jacket i's monitored. If an excessive'temperature is

reached, a diesel'shut-off circuit is actuated.

Systems that interface with the diesel generator cooling water subsystem are

* essential ac distribution subsystem

* do power (for contrbl 'circuitry)

* station service water (heat exchanger cooling)

* diesel generator lubrication oil subsystem

E04.C Diesel generator starting air subsystem. The-diesel generator

starting air subsystem'supplies compressed air to starting motors on the

diesel generators to provide for a rapid start of the diesel. Each diesel

has a starting air system. The diesel generator starting air system is a

Safety Class 3 system.

This system is typically a two-train system. Each train has an air

compressor that exhausts into a grouping of receivers, or compressed air

storage tanks. Compressor-suction is taken from the atmosphere and filtered before entering theicompressor. A cross tie is typically provided

between the two-trains.

The essential ac distribution subsystem and the do power system interface with the diesel generator starting air subsystem.

E04.D Diesel generator lubrication oil subsystem. The diesel generator lubrication oil subsystem supplies oil to lubricate the moving
57

parts of the diesel generator. Each diesel has a lube oil system. The

system is designated-as Safety Class 3.:-

The system features a loop with-a motor driven pump to increase oil

pressure enough to permit starting the diesel. This loop is- sometimes

filtered and heated. Once the diesel has started, it provides lube oil

pumps that circulate oil throughthe engine. The recirculation loop

usually has a filter and a lube oil cooler.

The systems that interface with the diesel generator lubrication oil

system are the essential ac distribution subsystem, the dc power system,

and the diesel generator cooling water subsystem.

E05 Plant lighting system

The plant lighting system provides adequate illumination in the plant

for personnel to perform their required tasks. The system-is'typicallydivided into essential and nonessential subsystems. The essential-subsystem is Class .E and provides lighting for those areas in the plant in -

which personnel activity will be required after an accident. The nonessential-subsystem is a nonsafety system and is disabled following an

accident. Outdoor lighting may also be provided.

The plant lighting panelboards are usually-loads on either the vital

instrument ac power subsystem or the 120-V level of the nonessential-ac

distribution system depending on the safety designation of the lighting

system.

E06 Plant computer

The plant computer may be used for a number of functions. The exact

list of functions depends upon each design. Typical among the functions

are

* monitoring and printout of plant parameters

* performance of calculations based on.plant parameters

* various information displays through either.a printer or a cathode

ray tube (CRT)

* in some designs, control of selected balance-of-plant systems

The plant computer is a nonsafety component. Its power is supplied

through a regulated, 120-V, single-phase power supply.

E07 Switchvard

The switchyard is the line between the unit and the utility's transmission grid. A number of transmission lines typically distribute-the

power produced-by the unit to transmission substations that further distribute the power. The switchyard is usually connected to the unit

through the unit step-up transformer. It may also provide power through

a startup transformer when the unit is shut down., The switchyard is not

safety related, and in many cases may not be considered a part of the

unit.

Many switchyard designs feature a two-bus arrangement with a "breakerand-a-half" scheme connecting them. This arrangement is very flexible and
58

prevents a single active failure from isolating a line. Differential zone

protective relaying as well as instantaneous and time overcurrent relaying

is used to protect switchyard equipment. The switchyard is also provided

its own dc power system for circuit breaker control circuitry.

The switchyard interfaces with the main power system and sometimes

the plant ac distribution system.

A.5 Power Conversion System - P

The power conversion system grouping is made up of the systems and

components that are used to transform, or to support the transformation

of, heat energy produced by the reactor core into electrical energy. The

systems and subsystems comprising the power conversion system grouping are

listed in Table A.S. The list of systems is essentially the same for both

BWRs and PWRs. The major difference is that under normal operating conditions, the main steam, turbine generator, condensate, and feedwater systems in BWRs use radioactive coolant in either a gaseous or liquid form.

The steam-water cycle in PWRs does not use irradiated water.

Table A.S. Power conversion systemsa

POl Main steam

P02 Turbine generator

P02.A Electrohydraulic control subsystem

P02.B Turbine gland seal subsystem

P02.C Turbine lubrication subsystem

P02.D Stator (hydrogen) cooling subsystem

P02.E Hydrogen seal oil subsystem

P03 Turbine bypass

P04 Condenser and condensate

P04.A Condenser evacuation

P04.B Condensate cleanup/polishing

P04.C Condensate heater drain subsystem

POS Feedwater

POS.A Feedwater heater drain

P06 Circulating water

P07 Steam generator blowdown (PWR)

P08 Auxiliary steam

aThe power conversion systems for both

BWRs and PWRs are essentially the same.

The major difference is environmental - the

BWR system has slightly radioactive steam

passing through the main flow path even

under normal conditions.
59

P01 'Main steam system

The main steam system is used to transport the steam generated in the

reactor vessel in BWRs or the steam generators in PWRs''to the turbine generator. The interface with the turbine generator is at the turbine stop

valves. Depending upon the design, from two to four steam lines may be

used. The main steam system is a nonsafety system that penetrates containment, although portions of the system are safety related (up to the

main steam isolation valves). :

After leaving containment, several pressure relief valves are connected in parallel to the main steam lines. Groups of these are normally

set to open at three succeedingly higher pressure levels. Next in the

steam lines are the main steam isolation valves (SIVs). These valves are

usually pneumatically actuated and require two coincident signals from

the engineered safety features actuation system to actuate a closure. The

MSIVs are Safety Class 3 components. Between the MSIVs and the turbine

stop valves are a number of steam taps. There is one tap in each leg for

the turbine-bypass-to-condenser lines and the atmospheric dump valves.

Taps are also provided to supply steam for the main feedwater pump turbines, the auxiliary or emergency feedwater pump turbines, and the moisture separator reheaters. A connecting line for the auxiliary steam system is also provided.

The main steam system interfaces with the following systems:

* dc power (for MSIV control circuitry)

* reactor vessel (BWRs)

* instrument air

* reactor coolant (through steam generators in PWRs)

* turbine generator

* turbine bypass

* feedwater

* auxiliary feedwater

* auxiliary steam

P02 Turbine generator system

The turbine generator is the device used to transform mechanical

energy in the form of moving steam to electrical energy. This is done by

using steam to turn the turbine. Connected to the turbine shaft is an

electrical generator in which a loop is rotated through a magnetic field,

producing an electrical current in the loop. The turbine generator is a

nonsafety system that is supported by a number of subsystems. (Note that

in BWRs the turbine building is a part of secondary containment.)

The turbine is normally a four-stage device with the stages mounted

axially along the turbine shaft. The first stage is a high-pressure turbine; the last three stages are low-pressure turbines. The high-pressure

turbine is driven by the main steam system. From the exhaust of the highpressure turbine, the steam'is directed through the moisture separator

reheaters and then to the low-pressure turbines. The low-pressure turbine% exhaust into the condenser. Taps are provided on the high- and lowpressure turbines to supply steam to the condensate and feedwater heaters.
60

Generator output is connected to the main step-up transformer through an

isolated-phase bus.

The turbine is controlled-by an electrohydraulic control (EHC) subsystem. The turbine is controlled by regulating the flow of steam through

it. The EHC subsystem accomplishes this by throttling the turbine control

valves and intercept valves. To trip the turbine, the turbine stop valves

are closed, shutting off the steam supply. Generator voltage is controlled by an exciter system.

Systems that interface with the turbine generator system are

* main steam

* electrohydraulic control subsystem

* turbine gland seal subsystem

* turbine lubrication subsystem

* stator (hydrogen) cooling subsystem

* hydrogen seal oil subsystem

* main power

* feedwater and condensate (through steam supply to the water heaters)

a W *. condenser

P0~~112.A -Electrohydraulic control subsystem. The EHC subsystem controls the turbine by regulating the steam flow through the turbine. The

EHC subsystem is capable of remote, manual, or automatic starting of the

turbine, loading the turbine at a preset rate, and holding load and speed

at-a preset level. The EHC subsystem typically has three distinct sections: a speed control unit, a load control unit, and a valve positioning

unit. Steam flow through the turbine is accomplished by throttling the

operated turbine control valves and intercept valves. Trips

are accomplished by closing the turbine stop valves. Turbines designed by

Allis-Chalmers provide a backup mechanical-hydraulic control system.

P02.B Turbine nland seal subsystem. The turbine gland seal subsystem seals the turbine shaft between both turbine casings and between

the exhaust hoods and the atmosphere. This prevents air from leaking into

the turbine and steam from leaking into the turbine building. The shaft

seals are labyrinth-type or pressure-packing glands through which steam is

passed outward away from the turbine. The seals exhaust into a gland

steam condenser.

P02.C Turbine lubricating subsystem. The turbine lubricating subsystem supplies oil to lubricate the moving parts of the turbine generator. The subsystem is divided into two parts: a lubricating oil section

and an oil conditioning system. The lubricating oil section consists of

bearing oil pumps, an oil reservoir, and oil coolers in series. The oil

conditioning section is made up of a clean oil storage tank, a used oil

storage tank, a filtering unit, and an oil transfer pump. Water from the

turbine building cooling water system is used to cool the oil in the heat

exchangers.

P02.D Stator (hydrogen) cooling subsystem. The stator (hydrogen)

cooling subsystem is used to remove heat from the coils of the generator

stator. Hydrogen is used to fill the stator housing and keeps the stator

windings moisture free. When replacement of the hydrogen is necessary, it

is displaced by carbon dioxide (C02), and then a fresh supply of hydrogen
61

is added. This system consists of.pressure regulators and controls for

the hydrogen gas and a.-carbon dioxide circuit for purgingcoperations.

-P02.E Hydrogen-seal oil subsystem. .The hydrogen seal oil subsystem

is used to prevent hydrogen leakage through the generator shaft seals.

This system circulates oil through the shaft.'seals, entraining any hydrogen that should leak into them. The system consists of pumps, storage

tanks, and the controls necessary to degasify the oil before returning it

to thezshaft seals;

P03 Turbine byvass system

The'turbine bypass system allows the NSSS to follow an -50% step load

reduction to the turbine generator without causing a reactor-trip or lifting the main steam pressure relief valves. The turbine bypass system is a

nonsafety system.

The turbine bypass system consists of a pneumatically or electrically

operated turbine bypass valve and controls, one or two isolation valves

and controls, and associated piping for each main steam line. On the

occurrence of a large reduction in electrical load, the turbine bypass

valves open, relieving main steam directly to the condenser. Some designs

use a'group of small turbine bypass'valves in parallel rather than a

single large valve for each steam line. This helps prevent an uncontrollable cooldown if a valve sticks open. The turbine bypass valves are

opened automatically by the turbine EHC subsystem following a large load

reduction. During a normal'shutdown of the reactor, the turbine bypass

valves are opened manually to release steam generated by 'decay heat in the

reactor. As cooldown continues, the turbine bypass valve is throttled

closed, eventually transferring the decay heat removed'to the residual

heat removal/low-pressure safety'injection system.

The turbine bypass system'interfaces withthe following systems:

* main steam

* condenser'

* EHC subsystem"

* instrument air '

* plant ac distribution (for motor 'operated isolation valves)

P04 Condenser and-condensate system

The function of the condenser is-to condense steam from the lowpressure turbine exhausts, the feedwater pump'turbines, and the turbine

bypass 'system. The condensate system takes condensed steam from the condenser and heater drains and delivers it to the feedwater system. Along

.the way, the condensate is purified and heated. The condenser and condensate system is a nonsafety system. -

The condenser is a triple-shell, single-pass water box in which circulating cooling water is used to condense steam from the turbine. As the

steam condenses into a liquid, it is collected in the hotwell sections of

the condenser. In the event one train of the circulating cooling water is

lost, a condenser circulating water pump is activated to provide water to

both sides'of the condenser shell.
62

The condensate system draws the condensed steam from the hotwells

through two or three condensate pumps. The pumps discharge through the

steam jet air ejectors and gland steam condensers before passing to the

condensate cleanup/polishing system. This system may be bypassed. The

exact order of these components and systems varies with design. From the

condensate cleanup/polishing system, the system water pressure is raised

by two or three condensate booster pumps. The discharge from these pumps

is passed through a string of condensate heaters. From the condensate

heaters, the water enters the feedwater system. A condensate tank provides makeup water to the condenser to maintain hotwell level. A number

of flow control and isolation valves are scattered throughout the system.

Their operation generally requires instrument air or electrical power.

Condensate makeup is provided by the demineralized water system.

The condenser and condensate system interfaces with the following

systems:

* turbine generator

* turbine bypass

* feedwater

* turbine gland seal subsystem

* condenser evacuation subsystem

* condensate cleanup/polishing system

* auxiliary feedwater

* auxiliary steam

* demineralized water

* instrument air

* dc power

* plant ac distribution

P04.A Condenser evacuation system. The condenser evacuation system

is designed to provide the initial vacuum in the condenser shells during

startup, to maintain the vacuum during condenser operation, and to dispose

of noncondensable gases collected from the condenser. The loss of condenser vacuum allows buildup of noncondensable gases that inhibit the heat

transfer capability of the condenser. The condenser evacuation system is

a nonsafety system.

Steam jet air ejectors are used to remove noncondensable gases from

the condenser and to maintain the vacuum in the condenser shells. This is

done by passing a jet of steam through the condenser shells. The passage

of the steam creates a vacuum that draws the noncondensable gases into the

jet stream. The air ejectors exhaust into the gaseous radwaste system.

The steam jet air ejectors function by using auxiliary steam. Motor

driven air removal pumps are provided for initial condenser shell side air

removal.

The condenser evacuation system may also be known as the condenser

vacuum system or the vacuum system.

Systems interfacing with the condenser evacuation system are

* condensate

* auxiliary steam

* gaseous radwaste

* plant ac distribution
63

P04.B Condensate cleanup/iolishing system. The condensate cleanup/

polishing system removes impurities from the condensate water that result

from condenser tube leakage. This results in a high purity effluent capable of meeting feedwater and steam generator chemistry standards. This is

a nonsafety system.

The condensate cleanup/polishing system consists of several mixed-bedtype demineralizers. The exact number depends upon design; however, sufficient capacity is usually provided for operation at full condensate flow

while one of the demineralizers is being regenerated. Differential pressure around the demineralizers is monitored to detect impaired flow. At a

preset pressure level, a bypass valve is opened to prevent demineralizer

damage.

The condenser cleanup/polishing system interfaces with the following

systems:

* condensate

* plant ac distribution

P04.C Condensate heater drain subsystem. The condensate heater

drain subsystem collects the steam condenser. The condensate heater drain

system is a nonsafety system.

The steam passing through the shell side of the condensate heaters is

collected in a common header. Depending upon design, either gravity flow

or motor operated pumps return the water to the condenser.

The condenser, the main steam system (extraction steam), the condensate system, and the plant ac distribution system interface with the condensate heater drain system.

POS Feedwater system

The feedwater system takes condensate from the condensate system,

heats it, raises its pressure, and'delivers it to the steam generators in

PWRs or the reactor vessel in BWRs to be boiled off as steam. The feedwater system is a nonsafety system that penetrates containment.

In general, two steam-turbine-driven main feedwater pumps draw suction from the condensate system.- 'In some plants (particularly the Westinghouse design), electric powered main feedwater pumps are provided.

Both pumps are needed for full operation. The pumps discharge through a

string of feedwater heaters into a'common header. From the header, one

feedwater line goes to each steam generator in PWRs. The BWRs generally

have two lines that go to the reactor vessel. These lines each contain

a feedwater regulation valve that is used to throttle feedwater flow to

match unit demand. A parallel loop bypasses the feedwater regulation

valves and contains the startup valves. These valves are used to throttle

feedwater flow during startup. Both the feedwater regulation valves and

the startup valves are pneumatically operated. Control is provided by the

feedwater control system except in the case of B&W designs. Here control

is provided by the integrated control system. In PWRs, the connections

to the auxiliary feedwater system are made in this section of piping.

Containment isolation is provided by the flow control valves and check

valves.
64

The systems that interface with the feedwater system are

* condensate

* main steam (including extraction steam)

* reactor core and reactor vessel (BWRs)

* reactor coolant (PWRs)

* auxiliary feedwater (PWRs)

* integrated control (Babcock & Wilcox units)

* feedwater heater drain subsystem

* instrument air

* plant ac distribution

POS.A Feedwater heater drain system. The feedwater heater drain

system collects the steam condensed in the feedwater heaters and returns

it to the main condenser. In some designs, this system is combined with

the condensate heater drain system to form a single heater. drain system.

All of these are nonsafety systems.

The condensed steam is collected in a common header. It may then be

either gravity fed or pumped back to the main condenser.

The condenser, the main steam system (extraction steam), the feedwater system, and the plant ac distribution system interface with the

feedwater heater drain system.

P06 Circulating water system

The circulating water system provides cooling water to the condenser

to condense the steam exhaust from the turbine. The circulating water

system is the ultimate heat sink for the plant.' Two designs are prevalent: an open system and a closed system. The open system draws raw

water from outside the plant, passes it through the condenser, and discharges it back into the water source at another location. The closed

system recirculates cooling water through the condenser to cooling towers

and back. The cooling towers transfer heat to the surounding air. Makeup

water is provided by a raw water source. The circulating water system is

a nonsafety system.

The circulating water system may also be called the condenser circulating water system.

The system consists of several pumps. Again, the exact number depends upon the particular design, flow control, and isolation valves, and

for open systems,. a system of moving screens on the intake to strain out

debris in the raw water. Other water systems may take suction from the

circulating water system, depending on design.

The circulating water system interfaces with the following:

* condensate

* environment

* plant ac distribution system

* de power system (for isolation valves)
65

P07 Steam Eenerator blowdown system (PWR)

In CE and Westinghouse designs, the steam generator blowdown system

is used in addition to the chemical feed section of'the feedwater system

and the condensate cleanup/polishing system to control the chemical'composition and solids concentration of the feedwater in the steam'generators. In B&W plants, steam generator design and water chemistry do not

require this system.' This is a nonsafety system.

Each steam generator is provided with a blowdown line containing a

flow control valve and a containment isolation valve. The lines join in a

common header. From the header, blowdown steam enters a system of blowdown concentrator reboilers. Main steam is used to evaporate the blow

down. Main steam condensate-flows from the reboilers into reboiler receivers (tanks) where it is directed back to first stage reheaters. Bottom liquid represents the difference between the blowdown feed rate and

the evaporation rate. This flows into the base of a separator where it

is drawn off. Bottom liquid is normally discharged from the plant; however, if radioactivity is detected in the liquid, it is diverted to the

liquid radwaste system. Any residual liquids in the separators are

periodically blown down to a sludge pot and sent to the solid radwaste

system.

Systems interfacing with the steam generator blowdown system are

* main steam

* liquid radwaste

* solid radwaste

* instrument air

* dc power (for valve control circuitry)

P08 Auxiliary steam system

The function of the auxiliary steam system is to supply heating steam

through the plant and to recover the condensed steam from the equipment

served. At multi-unit plants, this system is often shared by the units.

It is a nonsafety system.

Steam for the system may be obtained from taps on the main steam

lines when the unit is operating or from a fossil-fired auxiliary boiler

when the unit is shut down. Steam flows from these sources through a

common header to the various pieces of equipment served in the plant.

Condensate is collected and pumped back to the boilers. Surge tanks are

provided to hold up extra fluid.

The auxiliary steam system interfaces with the following:

* boron recovery subsystem of the CVCS

* domestic hot water tank

* various evaporators in waste systems

* demineralized water storage tank heaters

* condensate storage tank heaters

* steam jet air ejectors

* turbine gland seal subsystem
66

A.6 Process Auxiliary Systems - V

The process auxiliary systems grouping is made up of those systems

and subsystems that support the plant systems directly involved in the

process of safely producing electrical power. The systems and subsystems

of the process auxiliary systems groupings are essentially the same for

both BWRs and PWRs. They are listed in Table A.6.

W61 Radioactive waste system

The radioactive waste system is used to collect radioactive wastes

from the plant and to reduce the concentration of the radionuclides to as

low a level as is practicable so that the wastes can be safely released

Table A.6. Process auxiliary systemsa

W01 Radioactive waste

101.A Gaseous radwaste

W01.A1 Offgas subsystem (BWRs)

WOl.B Liquid radwaste

WOl.C Solid radwaste

W02 Radiation monitoring

W02.A Plant area radiation monitors

W02.B Environmental radiation monitors

W02.C Process radiation monitors

W03 Cooling water

W03.A Reactor building cooling water

W03.B Turbine building cooling water

'04 Service water

W04.A Demineralized makeup water

W04.B Station service water

Essential service water

Nonessential service water

W04.C Chilled water

W05 Refueling

W06 Spent fuel storage

W06.A Fuel pool cooling and cleanup

W07 Compressed air

W07.A Service air

W07.B Instrument air

W08 Process sampling

W09 Plant gas

W09.A Nitrogen

W09.B Hydrogen

aThe process auxiliary systems are essentially the same for both BWRs and PWRs.
67 -

or stored. There are three subsystems to handle each of the three states

in which waste is produced: gaseous, liquid, and solid. Each of these

subsystems are discussed below.

WO1.A Gaseous radwaste system. The gaseous radwaste system is usually made up of two portions: the process gas (hydrogenated) and lowactivity process vent (aerated) streams. The process gas (hydrogenated

portion of the system is designed to remove fission product gases from

the reactor coolant letdown stream and from the liquids collected in the

reactor coolant drain tank in PWRs. In BWRs, fission product gases are

removed from the reactor coolant through the offgas subsystem discussed

in Sect. WO1.Al. The process gas portion of the gaseous radwaste system

is a Safety Class 3 system. Radioactive gases collected from reactor

building vents, from the steam jet air ejectors (in PWRs), and from the

process gas adsorption bed gas drain are collected by the low-activity

process vent portion of the system. These gases are filtered, monitored,

and, if the concentration of radioactive nuclides is low enough, discharged to the environment. The low-activity process vent portion of the

gaseous radwaste system is a nonsafety system. Both portions may penetrate containment.

Other names used to identify the gaseous radwaste system are

* radioactive gaseous waste

* gaseous waste disposal

* gaseous radioactive waste

There are numerous designs of this system. Almost all are unique

in some manner; however, a large number of them involve gas compressors

along with a filtration and monitoring section. Those designs that remove dissolved gases from liquids use a degasifier for this purpose.

Some designs feature hydrogen control using a recombiner. Most all of

the major components have installed spares. After collecting the waste

gases, most systems run the gases through a system of filters, dryers,

and air compressors. When hydrogen is a concern, a recombiner is normally used early in the process. After processing, the gases are monitored, and if their level of radioactivity is low enough, they are released to the atmosphere. If the level is too high, the gases may be

either recycled or sent to a holdup storage tank until the level of

radioactivity falls to a predetermined level. The specific arrangement

of the equipment in the gaseous radwaste system is highly dependent upon

the architect-engineer and the utility-involved with the design of the

plant.

Systems interfacing with the gaseous radwaste system are

* plant ac distribution

* chemical and volume control (PWRs)

* combustible gas control

* boron recovery subsystem (of CVCS)

* various vents and drains

* containment isolation (BWRs) or engineered safety features actuation

(PWRs)

* condenser evacuation subsystem

* liquid waste subsystem
68

* refueling

* instrument air

* offgas subsystem (BWRs)

WO1.Al OffRas subsystem. The offgas subsystem is used in BWRs to

collect the fission product gases from the reactor coolant. These gases

are separated from the coolant in the steam jet air ejectors of the condenser evacuation subsystem as noncondensable gases. The discharge of

the steam jet air ejectors is directed to-a series of filters and compressors. The output of these components can be either released to the

atmosphere (if radioactivity levels are low) or routed to the gaseous

radwaste system (Sect. WO1.A). The offgas subsystem is a Safety Class 3

system.

System equipment typically includes filters, fans (or compressors),

radiation monitors', and valving. The arrangement is left largely up to

the architect-engineer and operating utility.

Systems interfacing with the offgas subsystem are

* plant ac distribution

* condenser evacuation subsystem

* instrument air

* gaseous radwaste

W01.B Liquid radwaste system. The liquid radwaste system collects

potentially radioactive liquids from the plant and treats them to reduce

their concentration of radioactive nuclides. The liquid radwaste system

penetrates containment. The system may be designated a Safety Class 3

system or a nonsafety system, depending on design.

Other names that may be- used for the liquid radwaste system are

* radioactive liquid waste

* liquid radioactive waste

* liquid waste disposal

System design usually includes two piping systems that connect at

several points. One section of piping is used for high-level radioactive

liquids; the'other is for low-level radioactive liquids. Liquids from

the process gas section of the gaseous radwaste system, from the boron

reicov'ery subsystem (PWRs), the steam generator blowdown system (Westinghouse and CE units), the'offgas subsystem (BWRs), or from'the solid radwaste system enter the high-level section. The low-level section collects from the low-level' process vent section of the'gaseous radwaste

system, the laundry and showers, and from the boron recovery subsystem

(PWRs). Drain tanks are the first components in either section of piping. One of two'paralleled pumps draws suction from its'associated set

of tanks. The high-level pumps discharge into a waste evaporator and

then condenser. This combination removes impurities from the liquid.

Periodically, the sludge in the bottom of the evaporator is drained,

cooled, and sent to the solid radwaste system. The condensed liquid is

pumped through a cooler into a series of demineralizers and filters.'

Upon exiting, the liquid is transferred to'a storage tank for reuse in

the plant if it has had its radioactivity level reduced enough. If the
69

level is still high, it is transferred to the low-level section. From

the initial tanks, the low-level pumps discharge through a set of filters

into a waste evaporator where laundry and shower waste liquid is 'added.

Again, suspended solids are separated and sent to the solid radwaste subsection. The low-level distillate'is released to the environment if the

level of radioactivity is low enough. If the level is above the release

value, it is recycled or stored in a tank until the amount of radioactivity has been reduced.

The following systems interface with the liquid radwaste system:

* plant ac distribution

* gaseous radwaste

* solid radwaste

* 'containment isolation (BWRs) or engineered safety features actuation

(PWRs)

* chemical and volume control (PWRsH

* steam generator blowdown'(Westinghouse and CE units)

* laundry and showers

* offgas subsystem (BWRs)

WO1.C Solid radwaste subsystem. The solid radwaste system is'used

to collect, holdup, solidify, package, and store radioactive materials

prior to their shipment off-site to a disposal facility. This system may

be classified as'nonsafety or-Safety Class 3, depending on design. It

does not penetrate containment. Wastes' such as sludge, spent resins from

demineralizers, spent filter cartridges, and miscellaneous solid materials that have become contaminated with use are treated in the solid

radwaste system.

Other names used to identify this system are

* radioactive solid waste

* solid waste disposal

* solid radioactive waste

The sludge and resins entering'the system go to a holdup tank. When

it is sufficiently filled for processing,' it is transferred to an evaporation cycle that further solidifies the wastes.' Next, a' solidifying

material is added, and the combination is placed into a container. After

solidification is complete, the container is capped, libeled, and stored

awaiting removal from the site.-' Compressible solid wastes'ire compressed

into a container before a mixture of sludge and solidifier are added to

immobilize them. Noncompressible materials are handled in the same manner except that they are not compressed. After solidifying, these con--

tainers'are capped, labeled, and'stored also.,

Systems interfacing with the solid radwaste system are -

* plant ac distribution

* liquid radwaste -

* chemical .and volume control (PWRs) A

* boron recovery subsystem (of CVCS)

* reactor water cleanup (BWRs) ,

*' condensate cleanup/polishing subsystem
70

* steam generator blowdown (Westinghouse and CE units)

* demineralized makeup water

* filters from many systems

* contaminated tools, clothing, cloths, etc.

W02 Radiation monitoring system

The radiation monitoring system is provided to ensure that any substantial abnormal radioactivity that is released can be detected within a

reasonable amount of time. A level of protection philosophy is employed

in that various points in the process systems are monitored, the plant

itself is monitored, and the environment surrounding the plant is monitored. Limits are established by lOCFR20.

All points where potentially radioactive materials may enter the

environment are monitored and alarmed. Usually the monitors' output is

tied into control circuits to shut off equipment to stop the release.

Selected areas inside the plant are monitored and alarmed. The plant is

divided into zones with increasingly stringent levels used to generate

alarms as potential contact with the environment is increased. Areas

where plant personnel are expected to spend large amounts of time are

also monitored. All monitors have independent power supplies to prevent

losing a number of monitors because of a single failure. Areas outside

the plant are monitored to ensure that no radioactivity exceeding established levels is released without detection. These environmental monitors may be either fixed or mobile.

W03 Cooling water systems

Numerous water systems are used in a nuclear plant. Some that are

directly involved in the power generation process and in safeguards protection have already been discussed. Other auxiliary systems that support these systems' operation are listed below. The design of these systems varies greatly from plant to plant as well as from NSSS vendor to

vendor; however, they all provide the same basic functions. Among these

are cooling water systems, demineralized makeup water systems, service

water systems, and chilled water systems.

W03.A Reactor building cooling water sVstem

The reactor building cooling water system provides an intermediate

cooling loop for removing heat from the engineered safety systems and

transferring it to the essential service water system. The reactor

building cooling water system is designated as Safety Class 3 and is

typically subdivided into two or three distinct trains. The number of

trains is dependent on the number of engineered safety systems provided

by each reactor vendor. Electrical power for each train is provided

through separate emergency buses. The reactor building cooling water

system penetrates containment in PWRs and secondary containment in BWRs.
71

The reactor building cooling water system may be called by several

iames. Among these are

* component cooling water

* reactor plant component cooling water

* reactor building closed cooling water

A typical train of the reactor building cooling water system will

consist of one or more (redundant) pumps and their associated motors

connected in series with a heat exchanger for transferring heat to the

essential service water system and several parallel piping legs that

connect to the various engineered safety systems.

Systems that typically interface with the reactor building cooling

water system are

* essential ac power

* essential service water

* containment spray

* residual heat removal/low-pressure safety injection

* high-pressure safety injection (PWRs)

* containment cooling/heat removal

* spent fuel cooling and cleanup

Other interfacing systems are

* reactor coolant/recirculation

e chemical and volume control (PWRs)

* spent fuel storage and cooling

* liquid and gaseous radwaste

* containment isolation (BWRs) or the engineered safety features

actuation (PWRs)

W03.B Turbine building cooling water system. The turbine building

cooling water system provides an intermediate cooling loop for removing

heat from components located inside the turbine and auxiliary buildings

and transferring it to the nonessential service water system. Coolers

in such systems as the chemical and volume control system, the chilled

water system, the reactor water cleanuptsystem, and the steam generator

blowdown system are cooled by the turbine building cooling water system.

This system does not penetrate containment and is designated as a nonsafety system. Electrical power is supplied by the nonessential ac distribution system.

The turbine building cooling water system may be called by other

names. Among these are

* recirculating water

* turbine plant component cooling water

* turbine building closed cooling water
72

System design typically involves a single train with redundant

pumps. Pump discharge flows through the tube side of a turbine building

cooling water heat exchanger before entering a common header. Several

parallel piping legs leave the header and pass through the shell side of

various heat exchangers.

Systems that interface with the turbine building cooling water system are

• nonessential ac distribution subsystem

* chemical and volume control (PWRs)

* reactor water 'cleanup (BWRs)

* chilled water

* steam generator blowdown (Westinghouse and CE units)

W04 Service water systems

W04.A Demineralized makeup water system. The demineralized makeup

water system' is the source of high-purity water for use as primary grade

water in the primary auxiliary systems, such as condensate in the secondary auxiliary systems, and for general use wherever demineralized water

is needed inside the plant. The demineralized water system is a nonsafety system that penetrates containment. Electrical power is provided

by the nonessential ac distribution subsystem.

The demineralized water system is normally divided into two sections: a water treatment section and a storage and transfer section.

The water treatment section is supplied water by a tap on the circulating

water system. This water enters a settling tank, and then it is passed

through a series of filters and demineralizers until it reaches a high

level of purity. -It is then sent to the demineralized water storage tank

for use in the various water systems in the plant. Onie of two redundant

pumps is used to transfer the water. The storage tank, transfer pumps,

and associated piping make up the transfer section of the system.

The following systems interface with the demineralized makeup water

system:

* nonessential' ac distribution

* standby liquid control'(BWRs)

'o reactor water cleanup (BWRs)

* chemical and volume control (PWRs)

* auxiliary feedwater (PWRs)

* condenser and condensate

* circulating water

* auxiliary steam

* solid radwaste

* potable and sanitary water

* chilled water

• spent fuel cooling and cleanup

* reactor and turbine building cooling water

* service water
73

W04.B Station service water system. The station service water \ system is used to transfer heat from the cooling water systems and

various other plant components .to the ultimate heat sink (usually the'

circulating water system). In most designs, there is one -service water

system, but it is broken into essential and nonessential subsystems. The

essential service water subsystem is designated a Safety Class 3 system

and is powered by the essential ac distribution subsystem. The nonessential service water system is a nonsafety'system and is usually isolated

from the essential subsystem by a safeguards signal. -

The station service water system is a two-train system. Redundant

pumps draw suction from taps on the circulating water system piping.

Some designs have a third pump as an installed spare. The pumps usually

discharge into a common header (for nonessential use) and two parallel,

redundant headers (for essential use). The common header can be isolated

by a motor operated valve.

From the common header, legs branch off to provide cooling water

flow for the turbine building cooling water cooler, for cooling jackets

and large motors in the turbine and auxiliary'buildings, and for the nonsafety Beating, Ventilating, and Air Conditioning (EVAC) water chillers.

Each leg of the essential portion branches into parallel legs that connect to redundant components such as the reactor building cooling water

heat exchanger, the fuel pool makeup (emergency),' safety EVAC water

chillers, cooling'jackets of large motors inside containment, and the

diesel generator cooling water heat exchangers. Flow from all the paralleled legs join together at a common discharge header and flow back

into the circulating water.

Systems interfacing with the station service water system are

* plint ac distribution (both subsystems)

o circulating water

* reactor and turbine building cooling water.

* chilled water

* compressed air

* reactor coolant and reactor recirculation (motor cooling)

* diesel-generator cooling water

W04.C Chilled water system. The chilled water system provides cold

water to various HVAC air cooling coils and generator leads coolers. The

chilled water system is normally divided into two parts. T7ypically, ,a

Safety Class 3 portion of the system provides'cooling water to the safety

related air cooling systems inside containment. A nonsafety portion supplies cooling water to generator-lead coolers and to HVAC cooling units

throughout the plant but outside containment. The nonsafety portion can

be isolated on receipt of a safeguards signal.

The chilled water system is a closed loop system. Two or three

pumps, depending on design, draw water from mechanical refrigeration

units that are serviced by'the station service water system. The pumpsdischarge into a common header that branches to god to each of the'associated coolers. Isolation valves are provided to ensure flow to the

safety related coolers durirg accident conditions. Flow from the various

coolers returns to the refrigeration units. 'A surge tank is usually provided to control system water inventory.
74

Systems interfacing with the chilled water system are

* essential ac distribution subsystem

* containment cooling (PWRs)

* HVAC

e turbine-generator

* station service water

* containment isolation (BWRs) or the engineered safety features

actuation (PWRs)

WOS Refueling system

The refueling system is used to exchange new fuel assemblies for

used ones at the end of each fuel cycle. The refueling system is designed to meet Seismic Category I requirements. The system is also designed so that all refueling activities take place under water to take

advantage of water's shielding and cooling capabilities.

A typical system consists of equipment in three places: in the

reactor building, in the spent fuel building, and in the fuel transfer

tube connecting the reactor building and spent fuel building. Equipment

in the reactor building typically consists of one or two fuel handling

bridges (depending on design), a control rod assembly handling tool (in

PWRs), various cranes and hoists, and, to aid in control, an underwater

closed circuit television system. In the spent fuel building, there is

typically a fuel handling bridge, fuel storage racks, and a new fuel

handling tool. The transfer tube is, itself, a part of the system. It

may actually be two tubes: one for fuel entering the reactor building

and one for fuel leaving the reactor building. The transfer tube, or

tubes, can be isolated through the use of valves at the entrance to the

reactor building. A carriage or a boom, depending on design, is used to

move fuel assemblies through the transfer tube. The transfer tube and

the containment in PWRs are flooded with borated water from the refueling, or borated, water storage tank. In BWRs, water for flooding is

drawn from the condensate storage tank.

The refueling system interfaces with the plant ac distribution system, the spent fuel storage and cooling system, the condensate system

(PWRs), the reactor core, and the control rod drive system (PWRs).

W06 Spent fuel storane system

The spent fuel storage system is used to store spent fuel assemblies

that have been taken from the reactor core. The spent fuel storage system is designed for Seismic Category I loads and for tornados and external missiles. The atmosphere in the spent fuel building is confined and

filtered.

The spent fuel pool is the major component of the spent fuel storage

system. It is normally filled with primary grade demineralized water.

In PWRs, borated water is added from the refueling or borated water

storage tank. Storage racks in the bottom of the pool hold the spent

fuel assemblies and maintain an adequate separation to prevent the fuel

from reaching criticality.
I

75

The spent fuel storage system interfaces with the refueling system,

the demineralized water system, and the fuel pool cooling and cleanup

system.

W06.A Fuel pool cooling and cleanup system. The fuel pool cooling

and cleanup system removes decay heat from the spent fuel and provides

clarification and purification for the water in the fuel pool and refueling, or borated, water storage tank. The fuel pool cooling and cleanup

system is a Safety Class 3 system. Electrical power is supplied from the

essential ac distribution subsystems. The cooling and purification sections of the system may be completely separate or the purification section may divert a portion of the cooling stream through the filters and

demineralizers. The cooling portion typically uses two independent, redundant piping trains, each with a pump and cooler. If the cooling and

purification sections are combined, taps are provided in each line to

divert flow through-the filters and demineralizers. The purification

section is also a two-train system with-taps on the cooling piping lines,

or with pumps and suction points in the spentfuel pool and refueling

cavity. Pump discharge passes through a filter and into a demineralizer.

The number of filters and demineralizers depends upon the system's design. From the demineralizer, the flow returns to the spent fuel pool.

A loop is also provided for recirculating water in the refueling, or

borated, water storage tank through the filtration system.

The fuel pool cooling and cleanup system interfaces with the essential ac distribution system, the spent fuel storage system, the demineralized water system, and the reactor building cooling water system (for

secondary coolant flow).

W07 Compressed air system

The compressed air system supplies compressed air throughout the

plant for pneumatic valve operation, instrumentation (where pneumatic

systems are used), and for use with pneumatic tools. The system has two

major subsystems: the instrument air subsystem and the service air

subsystem. The instrument air subsystem is frequently divided into a

Safety Class 3 portion that supplies loads inside containment and a

nonsafety portion for the remainder of the plant.

The service and nonsafety instrument air portion are sometimes combined. This system normally has two 100% capacity or three 50% capacity

air compressors. Each compressor has an intake filter and aftercoolers

into a common header. Air receivers are provided to store compressed

air. A service air leg branches from the common header in addition to

the instrument air legs. Each'instrument air leg contains an air filter

and a 100% capacity air dryer. In designs featuring a separate containment instrument air system, air is drawn from and discharged to the containment, creating a situation of no pressure increase inside containment. As with the nonsafety portion, two compressors with filters, aftercoolers, and air dryers make up two redundant trains. Each train also

has air receivers to store the compressed air.

Systems interfacing with'the compressed air system are

* plant ac distribution

* station service water (for aftercooler secondary flow)

* various systems having pneumatically operated valves and instruments
76

W08 Process sampling system

The process sampling system provides a means of drawing samples from

various process systems and the facilities for analyzing the samples.

Samples drawn from inside the containment have remotely operated valves

for isolation purposes. Typical of the analysis performed on the samples

are boron concentration (PWRs), fission product radioactivity level, hydrogen and oxygen gas content, pH, corrosion product concentration, and

conductivity. The system is designed to be manually operated on an inrtermittent or continuous basis under all plant conditions.

The process sampling system features numerous lines connecting process piping to sample sinks. Hot lines have sample coolers with secondary flow provided by the station service water system. Those samples on

which conductivity analysis are performed have a constant temperature

bath to minimize errors in measurement caused by temperature differences.

Demineralized water is provided at the sample sinks for rinsing purposes.

All sample sinks drain into the liquid radwaste system.

The process sampling system interfaces with the following systems:

* various process systems requiring chemical analysis

* station service water

* demineralized water

* liquid radwaste

* containment isolation (BWRs) or the engineered safety features

actuation (PWRs)

W09 Plant gas system

The plant gas system is used to supply compressed gases to the various places it is needed in the plant. It is a nonsafety system. The

plant gas system normally features a nitrogen and a hydrogen subsystem.

Both the compressed nitrogen and hydrogen are provided in gas bottles. Each of the bottles discharges through a pressure control valve

into a header with parallel piping legs to distribute the gas.

Nitrogen bottles connect to

* safety injection accumulators

* volume control tank (in some designs)

* refrigerant dryers

* charcoal bed gas adsorbers

* gas compressors

* gaseous vents and drains (for purging)

Hydrogen bottles connect to-the volume control tank (in some designs) and the generator stator cooling subsystem.

A.7 Plant Auxiliary System - X

Plant auxiliary systems are provided to support plant activities

and personnel. They are typically nonsafety systems. Design of these
77

systems varies greatly because almost all are plant specific. The systems and subsystems of the plant auxiliary system grouping are discussed

below and listed in Table A.7.

a Table A.7. Plant auxiliary systems

101 Potable and sanitary water

X02 Fire protection

X02.A Water

X02.B Carbon dioxide

X03 Communications

X04 Security

X05 HVAC

XOS.A Control room habitability

XOS.B Turbine building ventilation

X05.C Diesel building ventilation

X05.D Auxiliary building ventilation

X05.E Fuel building ventilation

X06 Nonradioactive waste

X06.A Gaseous waste

X06.B Liquid waste

X06.C Solid waste

aPlant auxiliary systems for both

BWRs and PWRs are essentially identical.

X01 Potable and sanitary water system

The potable and sanitary water system provides water throughout the

plant (except in containment) for drinking water, showers, laundries, and

restroom facilities. It is a nonsafety system. The source of water may

be a local water system or, in remote locations, the circulating water

system. If circulating water is used, stations are provided for filtration and chemical addition to insure the water is safe for consumption.

A common header is used to distribute the water, and another collects'discharge. Discharge returns'to a'local sewage system when available,' or

through a sewage processing station before release to the plant water supply (downstream of intakes). '

X02 Fire protection system

The fire protection system is designed to detect, annunciate, and

extinguish any fires that'may 'occur and to provide'some mitigation for

the effects of the fires.' The fire protection is generally a nonsafety

-system. - It is typically divided into two subsystems: a water system and

a carbon dioxide system.
78

The water system is used in all areas of the plant except those that

contain electrical equipment. Two water pumps are usually provided. One

of these may be steam turbine driven. The pumps discharge into a header

that supplies various fire hoses and overhead sprinklers throughout applicable areas of the plant. The water supply is taken from the circulating

water system in most cases. Heat actuated detection devices activate the

systems and annunciate its operation.

The carbon dioxide system is used to protect areas such as the cable

spreading room, switchgear rooms, and electrical penetrations and tunnels. This system is'supplied CO2 from a storage tank. Piping connects

the storage tank with valved distribution points in electrical areas.

Heat actuated sensors operate the system. Rooms that require occupancy

during normal operation, such as the control room, use portable CO2 extinguishers.

X03 Communications system

The communications system is designed to provide reliable communications between essential areas of the station and to essential locations

remote from the plant during all plant conditions. To ensure this capability, a diverse communications system is provided. Intraplant communications are provided by:

* a page/party public address and evacuation alarm system

* a sound powered telephone system

* a hand-held portable radio system

* a private branch telephone exchange (PBX)

Off-site communications systems include:

* local telephone service

* a microwave link through the utility's system-wide communications

system

X04 Security system

The security system is designed to protect vital areas of the plant

from intrusion by nonauthorized personnel. The system includes many

levels of protection from the fence around the exclusion area to security

procedures to microwave detection systems to card-keyed locks on doors

within the plant. Because these designs are considered proprietary,

little information is available about them.

X05 HVAC system

The HVAC system removes heat, ventilates, and maintains a comfortable environment for personnel in the various buildings and rooms of the

power plant. (Containment cooling and ventilating systems are excluded

from this group.) The HVAC system is made up of a number of individual

systems. Each of the major equipment and personnel areas normally has
79

its own system. Some designs, however, have a central system. The HVAC

systems are nonsafety systems with the exception of the control room

HVAC. The HVAC systems for safety related equipment are safety related

if they are required for equipment operability.

All HVAC systems feature one or two trains, each with a fan, a filtration system, and an air cooler. Most are closed systems with return

and discharge registers in appropriate positions to maximize air flow

through the rooms.

Typical EVAC systems are provided for:

* control room

* switchgear rooms

* cable spreading room

* electrical tunnels

* diesel generator room (usually ventilation only)

* battery rooms

* solid waste and decontamination building

* turbine building (usually ventilation only)

* fuel building

* administrative building

X06 Nonradioactive waste system

The nonradioactive waste system is used to process all gaseous,

liquid, and solid wastes that do not contain radionuclides and that are

not handled by the radioative waste system (W01) that is discussed earlier in this document. It is not a safety system. This system is

divided into three subsystems by waste category, similarly to W01: gaseous, liquid, and solid. Each of these subsystems are discussed below.

X06.A Gaseous waste subsystem. This category is included for consistency, but there are very few nonradioactive or uncontaminated gases

generated, and those that are present are usually handled by the radioactive waste system.

X06.B Liauid waste subsystem. The liquid waste system collects

liquid wastes that are not contaminated with radionuclides and may,

therefore, be handled more simply and much less expensively. There is a

large amount of this type of waste generated in both BWR and PWR power

plants.

X06.C Solid waste subsystem. The solid waste system handles routine nonradioactive wastes similar to any large chemical plant and is

separated from the radioactive waste system for economic reasons. In

most power plants, the solid wastes generated are combustible and are,

therefore, incinerated for volume reduction; the resultant ash is disposed of in sanitary landfills.

The nonradioactive waste system interfaces with virtually every

other system in the plant.
81

Appendix B

GLOSSARY OF IN-PLANT RELIABILITY DATA TERMINOLOGY

B.1 General Terms

Architect-engineer.

American National Standards Institute.

AE

ANSI

BOP system

BWR

Component

Corrective maintenance

Demand failure rate

Failure

FSAR

Balance-of-plant system: system that supports

the nuclear steam supply system.

Boiling-water reactor.

An off-the-shelf item procured as a basic

building block for a system (e.g., pump or

valve). It is to be distinguished from nuts,

bolts, seals, and other smaller piece parts.

Operationally initiated maintenance (i.e.,

maintenance motivated by a problem'detected

in operations or test).

Probability of failure to function per demand,

where functioning may be starting, changing

state, etc.

Termination of the ability of a part or component to perform its design function.

Final safety analysis report. This document is

issued by the utility as construction nears

completion and the design of the plant is

finalized.

System that is common across many plants, regardless of nuclear steam supply system vendor

and light-water reactor type.

Institute of Electrical and Electronics Engineers.

Licensee event report. Data collected since

1969 on safety-related component malfunctions,

failures, human errors, and procedural deficiencies.

Generic system

IEEE

LER

LWR

NPRDS

NSSS

Light-water reactor. Subsets are BWR and PWR

(see separate definitions).

Nuclear Plant Reliability Data System.

Nuclear steam supply system. Consists of the

reactor, hardware directly connected with the

reactor vessel, and equipment directly associated with the reactor coolant and the principal

subsystems.
82

P&ID

Plant

Piping and instrument diagram. This is an engineering drawing that shows the functional

location of components such as pumps, valves,

and instruments in a system.

A facility that contains one or more nuclear

power generating units.

Prescheduled or preplanned maintenance (i.e.,

maintenance motivated by a desire to prevent

operating problems).

Preliminary safety analysis report.

Pressurized-water reactor.

Preventive maintenance

PSAR

PWR

SAR

System

Safety analysis report. Subsets are PSAR and

FSAR.

A collection of components arranged to provide

a desired function (e.g., containment spray

system or residual heat removal system).

Probability of failure to function per unit

time.

Time failure rate

B.2 Failure Types

Catastrophic failure

Common cause failures

Degraded failure

Demand-related failure

Generic failure

Incipient failure

Time-related failure

Failure where component is completely unable

to perform its design function.

Failures of two or more components or systems

due to a single cause.

Failure where component operates at less than

its specified performance level.

Failure that is most probably associated with

one or more demands for a component to start,

change state, etc.

Failure that is common across many components,

systems, or plants.

Failure where component performs within its

design envelope but exhibits characteristics

which, if left unattended, could develop into

a degraded or catastrophic failure.

Failure that is most probably associated with

the normal activity and exposure of a component

over a reasonable span of time.

B.3 Definitions of IPRD Variables

Annual operations Number of starts or demands of a component during a typical one-year period.
83

Availability

Component ID

Component type code

Component vendor code

Crew size

Duty cycle

Failure cause code

Failure

ttion

cause descripFiilure date

Failure mode code

Failure severity code

Functional name

Hierarchical number

Operating mode

Plant code

Repair action description

Repair category

Proportion of nonoutage hours in a given unit's

operations over a specified period of time, per

the NRC's Licensed Operating Reactors: Status

Summary Report ("The Gray Book"), NUREG-0020.

Plant-specific code name for component.

Six-letter code which identifies a component.

One-letter/three-digit code for the component's

manufacturer. Same codes are used in NPRD.

Number of people in the maintenance crew that

performed the repair of the failed component.

Percentage of time that the component is active

in a particular plant operating mode during a

typical one-year period if always in good repair.

Two-digit code keyed to causes such as design

error, seal/packing failure, normal wear, personnel error, or leaky fittings (may be multiple failure causes).

Failure record text description of failure

event.

Month, day, and year (mmddyy) associated with a

failure. Depending on plant'reporting procedures, this date could be the date of failure

occurrence, the date of failure detection, or

the date of the written failure report.

A one-letter code keyed to characterizing the

effect by which a failure is observed.

One-letter code keyed to "catastrophic, degraded, incipient" (see separate definitions).

Population record text description of component's function.

Summarizes a component's physical and operating

characteristics (e.g., for a pump, positive

displacement vs centrifugal type, head, horsepower, and operating temperature).

The component's dominant mode of operation.

For pumps, a one-letter code keyed to running,

alternating, or standby.

Two-digit coded plant-number.

Repair record text description of repair action as filed on the plant's maintenance work

request.

Indicates the degree of repair performed on the

component.
84

Repair date

Repair time

Report number

System code

Month, day, and year (mmddyy) associated with

the repair of a failed component. Depending on

plant reporting procedures, this date could be

the date of component repair initiation or completion.

Elapsed clock time to the nearest half-hour required to repair a failed component, reported

as a real number with a decimal point.

Plant-specific report number or log page number

where failure or repair is recorded.

One-letter/two-digit code for the generic system to which a component is assigned. Letter

code keyed to "Nuclear (N), Engineered Safety

(S), Containment (C), Electrical (E), Power

Conversion (P), Process Auxiliary (W), Plant

Auxiliary (x)."
85

NUREG/CR-2641

ORNL/TM-8271

Dist. Category RG

Internal Distribution

1-5. R. 3. Borkowski 31. A. L. Lotts

6. H. I. Bowers 32. F. R. Mynatt

7. J. R. Buchanan 33. D. J. Pack

8. T. S. Burns 34. D. H. Pike

9-13. T. E. Cole 35. T. W. Robinson, Jr.

14. W. B. Cottrell 36. I. Spiewak

1i. D. J. Downing 37. H. E. Trammell

16-20. J. P. Drago 38. D. B. Trauger

21-25. G. F. Flanagan 39. ORNL Patent Office

26. P. M. Haas 40. Central Research Library

27. W. 0. Harms 41. Document Reference Section

28. B. M. Horwedel 42-43. Laboratory Records Department

29. H. Inhaver 44. Laboratory Records, R.C.

30. H. E. Knee

External Distribution

45. F. Balkovitz, EG&G Idaho, Inc., P.O. Box 1625, Idaho Falls, ID

83415

46. R. Bari, Brookhaven National Laboratory, Dept. of Nuclear Energy, Upton, NY 11973

47. B. Buchbinder, Division of Risk Analysis, Office of Nuclear

Regulatory Research, U.S. Nuclear Regulatory Commission,

NL5650, Washington, DC 20555

4f. J. Fragola, SAI, 274 Madison Ave., Suite 1501, New York, NY

10016

49. F. F. Goldberg, Office of Resource Management, U.S. Nuclear

Regulatory Commission, M.S. 608A, Washington, DC 20555

50. J. A. Hartung, Rockwell International, 8900 DeSota Ave., Canoga

Park, CA 91304

51-60. 3. W. Johnson, Risk Methodology and Data Branch, Division of

Risk Analysis, Office of Nuclear Regulatory Research, U.S.

Nuclear Regulatory Commission, NL-5650, Washington, DC 20555

61. C. Mason, SAI, 800 Oak Ridge Turnpike, Oak Ridge, TN 37830

62. J. Minarick, SAI, 800 Oak Ridge Turnpike, Oak Ridge, TN 37830

63. 3. Penland, SAI, 800 Oak Ridge Turnpike, Oak Ridge, TN 37830

64. W. Sullivan, EG&G Idaho, Inc., P.O. Box 1625, Idaho Falls, ID

83415

65. Office of Assistant Manager for Energy Research and Development,

Department of Energy, ORO, Oak Ridge, TN 37830

66-335. Given distribution as shown in category RG (10-NTIS)

tUS. GOVERNMENT PRINTING OFFICE: 1982-546-067/91
ANL

TIS LIBRARIES

00222351

62

'0 .