NUREG/CR-5404

ORNL-6566/V1

Vol. 1

Auxiliary Feedwater System

Aging Study

Prepared by D. A. Casada

Oak Ridge National Laboratory

Prepared for

U.S. Nuclear Regulatory

Commission

l
AVAILABILITY NOTICE

Availability of Reference Materials Cited in NRC Pubilcations

Most documents cited In NRC pubilcations will be available from one of the following sources:

1. The NRC Public Document Room, 2120 L Street, NW. Lower Level, Washington. DC 20555

2. The Superintendent of Documents, U.S. Government Printing Office. P.O. Box 37082. Washington,

DC 20013-7082

3. The National Technical information Service, Springfield, VA 22181

Although the listing that follows represents the majority of documents cited In NRC publications. It Is not

Intended to be exhaustive.

Referenced documents available for Inspection and copying for a fee from the NRC Public Document Room

Include NRC correspondence and internal NRC memoranda; NRC Office of Inspection and Enforcement

bulletins, circulars, Information notices, Inspection and Investigation notices; Ucensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents In the NUREG series are available for purchase from the GPO Sales Program:

formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and

brochures. Also available are Regulatory Guldes, NRC regulations In the Code of Federal Regulations, and

Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service Include NUREG series reports and

technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Comnmsslon, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries Include all open literature Items, such as

books, Journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the

Office of information Resources Management, Distribution Section. U.S. Nuclear Regulatory Commission,

Washington. DC 20555.

Copies of Industry codes and standards used In a substantive manner In the NRC regulatory process are

maintained at the NRC Ubrary, 7920 Norfolk Avenue. Bethesda. Maryland. and are available there for reference use by the pubilc. Codes and standards are usually copyrighted and may be purchased from the

originating organization or. If they are American National Standards, from the American National Standards

Institute, 1430 Broadway. New York, NY 10018.

DISCLAIMER NOTICE

This report was prepared as an account of work sponsored by an agency of the United States Government

Neitherthe United States Government nor any agency thereof, orany of their employees, makes any warranty,

expresed or Implied, or assumes any legal liability of responsibility for any third party's use, or the results of

such use, of any Information, apparatus, product or process disclosed In this report, or represents that its use

by such third party would not Infringe privately owned rights.
NUREG/CR-5404

ORNL-6566/V1

Vol. 1

RV

Auxiliary Feedwater System

Aging Study

Manuscript Completed: January 1990

Date Published: March 1990

Prepared by D. A. Casada

W. S. Farmer, NRC Program Manager

Oak Ridge National Laboratory

Operated by Martin Marietta Energy Systems, Inc.

Under DOE Contract No. DE-AC05-840R21400

Oak Ridge National Laboratory

Oak Ridge, TN 37831

Prepared for

Division of Engineering

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555

NRC FIN B0828
Hi

ABSTRACT

This report documents the results of a study of the Auxiliary Feedwater (AFW)

System that has been conducted for the U. S. Nuclear Regulatory Commission's Nuclear

Plant Aging Research Program. The study reviews historical failure data available from the

Nuclear Plant Reliability Data System, Licensee Event Report Sequence Coding and Search

System, and Nuclear Power Experience data bases. The failure histories of AFW System

components are considered from the perspectives of how the failures were detected and the

significance of the failure. Results of a detailed review of operating and monitoring

practices at a plant owned by a cooperating utility are presented. General system

configurations and pertinent data are provided for Westinghouse and Babcock and Wilcox

units.
V

CONTENTS

Pae

ABSTRACT...................................................................................... iii

LIST OF FIGURES ............................................................. ix

LIST OF TABLES ............................................................. xi

ACKNOWLEDGMENTS. . .................................................................... xiii

ACRONYMS..................................................................................... xv

1. INTRODUCTION ANTD SUMMARY . ..........................................

1

1.1 BACKGROUND ............................................................ 1

1.2 SUMMARYOFRESULTS .......................................................... 3

REFERENCES.............................................................................. 4

2. GENERIC AFW SYSTEM DESIGN ...................................... . 5

2.1 INTRODUCTION ............................................................ 5

2.2 SYSTEM BOUNDARIES AND INTERFACING SYSTEMS .............. . 5

2.3 AFW SYSTEM FUNCTIONAL REQUIREMENTS AND

TYPICAL DESIGNS ........................................................... 5

2.3.1 Generic Functional Requirements ......................................... 5

2.3.2 Design Configurations ................................................ 6

2.3.3 AFW System Starting ................................................ 13

2.3.4 AFW System Operation ................................................ 14

2.3.5 Example AFW System Requirements for Various Accident

Conditions.................................................................... 14

3. REFERENCE PLANT DETAILED DESIGN . .......................................... 21

3.1 COMPONENT DESIGN FUNCTIONS, CONTROLS, AND

INDICATION.......................................................................... 21

3.1.1 Pump Suction Check Valves: C-3, -4, and -5 ............................ 21

3.1.2 Emergency Service Water to Motor-Driven Pump Suction

Isolation Valves: MOV-1, -2, -3, and -4 .................................. 23

3.1.3 Emergency Service Water to Turbine-Driven Pump Suction

Isolation Valves: MOV-5, -6, -7, and -8 .................................. 24

3.1.4 Motor-Driven AFW Pumps .............................................. 26

3.1.5 Turbine-Driven AFW Pump ................................................ 28

3.1.6 Pump Miniflow Check Valves: C-6, -8, and -10 ........... ............. 33

3.1.7 Common Miniflow Check Valves: C-1 and -2 ........................... 33

3.1.8 Pump Discharge Check Valves: C-7, -9, and -11 .......... ............. 34
vi

3.1.9 Motor-Driven AFW Pump Level Control Valves: LCV-1/1A,

-3/3A, -5/5A, and -7/7A ................................................ 34

3.1.10 Turbine-Driven Pump Level Control Valves: LCV-2, -4, -6, and -8.. 36

3.1.11 Level Control Valve Check Valves: C-12, -13, -14, -15, -16, -17,

-18, and -19 ................... ................................ 37

3.1.12 SG B and C AFW to Main Feed Check Valves: C-21, -22, -24,

and -25........................................................................ 38

3.1.13 Main Feedwater Check Valves: C-20, -23, -26, and -27 ............... 38

3.1.14 Feedwater Isolation Valves: FWIV-1, -2, -3, and -4 .................... 39

3.1.15 SG Blowdown Isolation Valves (BDIVs): BDV-1, -2, -3, and -4 .... 39

3.1.16 AFW Turbine Steam Supply Valves: MOV-11 and -12 ................. 40

3.1.17 AFW Turbine Steam Supply Isolation Valves: MOV-9 and -10 ....... 42

3.2 REVIEW OF PROCEDURES RELATING TO AFW COMPONENTS .. 43

3.2.1 Pump Suction Check Valves: C-3, -4, and -5 ............................ 44

3.2.2 Emergency Service Water to Motor-Driven Pump Suction

Isolation Valves: MOV-1, -2, -3, and -4 .................................. 46

3.2.3 Emergency Service Water to Turbine-Driven Pump Suction

Isolation Valves: MOV-5, -6, -7, and -8 .................................. 50

3.2.4 Motor-Driven AFW Pumps ................................................ 52

3.2.5 Turbine-Driven AFW Pump ................................................ 57

3.2.6 Pump Miniflow Check Valves: C-6, -8, and -10 .......... .............. 62

3.2.7 Common Miniflow Check Valves: C-1 and -2 ........................... 64

3.2.8 Pump Discharge Check Valves: C-7, -9, and -11 .......... ............. 65

3.2.9 Motor-Driven AFW Pump Level Control Valves: LCV-1/1A,

-3/3A, -5/5A, and -7/7A ................................................ 67

3.2.10 Turbine-Driven Pump Level Control Valves: LCV-2, -4, -6, and -8.. 70

3.2.11 Level Control Valve Check Valves: C-12, -13, -14, -15, -16, -17,

-18, and -19 ................... ................................ 72

3.2.12 SG B and C AFW to Main Feed Check Valves: C-21, -22, -24,

and -25........................................................................ 74

3.2.13 Main Feedwater Check Valves: C-20, -23, -26, and -27 ............... 75

3.2.14 Feedwater Isolation Valves: FWIV-1, -2, -3, and -4 .................... 76

3.2.15 SG Blowdown Isolation Valves: BDV-1, -2, -3, and -4 ........ ....... 77

3.2.16 AFW Turbine Steam Supply Valves: MOV-11 and -12 ................. 80

3.2.17 AFW Turbine Steam Supply Isolation Valves: MOV-9 and -10 ....... 82
vii

3.3 FAILURE MODES AND FEATURES THAT ARE NOT DETECTABLE

BY CURRENT MONITORING PRACTICES .................................... 84

REFERENCES.............................................................................. 99

4. AFW SYSTEM FAILURE DATA REVIEW AND ANALYSIS ...................... 100

4.1 INTRODUCTIO ........................................................

100

4.2 ORNLDATABASEFORMATION ............................. 101

4.3 ANALYSIS RESULTS ......................................................... 104

4.3.1 General Summary .104

4.3.2 Method of Detection Summary .105

4.3.3 Subsystem Review Summary .107

4.3.4 Plant Age Review Summary .107

4.3.5 Component Group Review Summary .110

4.3.6 Review by Plant .126

5. AFW SYSTEM CONFIGURATIONS . .............................................. 132

6. RESULTS, CONCLUSIONS, AND RECOMMENDATIONS ....................... 150

6.1 RELATIVE SIGNIFICANCE OF AFW COMPONENTS . ............... 150

6.1.1 Results ............................................... 150

6.1.2 Conclusions .............. ................................. 150

6.2 ADEQUACY OF CURRENT MONITORING PRACTICES ... 151

6.2.1 Results ............................................... 151

6.2.2 Conclusions ............................................... 154

6.3 RECOMMENDATIONS................................... 155

APPENDIX A. RELEVANT TECHNICAL SPECIFICATIONS ........................ 157
ix

LIST OF FIGURES

Figuree

2.1. AFW system for two-loop plant ........................................................ 7

2.2. AFW system for three-loop plant ...................................................... 8

2.3. AFW system for four-loop plant ....................................................... 9

2.4. Typical AFW system actuation logic ................................................... 15

2.5. RCS pressure response to loss of feedwater .......................................... 17

2.6. SG pressure following loss of feedwater .................... ......................... 17

2.7. RCS pressure response to feedline break .................... ......................... 19

2.8. SG pressure following feedline break ........................... ...................... 19

3.1. Plant A auxiliary feedwater system . ................................................... 22

3.2. Pump suction check valves configuration ............................................. 23

3.3. AFW turbine speed control circuit ..................................................... 30

3.4. Turbine speed during startup .......................................................... 3 1

3.5. Pump miniflow and discharge check valves configuration .......................... 34

3.6. Turbine-driven pump level control valve check valve configuration ............... 37

3.7. Motor-driven pump level control valve check valve configurations ................ 38

3.8. AFW to main feedwater check valve configuration ............. ..................... 38

3.9. Turbine steam supply transfer sequence ............................................... 41

4.1. Failure count and relative system degradation distributions ......................... 104

4.2. Method of detection summary .......................................................... 105

4.3. Failure by subsystem summary ........................................................ 107

4.4. Pump driver summary................................................................... 110

4.5. Sources of turbine drive failures ....................................................... 112

4.6. Turbine I&C/governor failure summary by detection method ......... ............. 114

4.7. Sources of pump motor drive failures ................................... ............... 114

4.8. Valve operator failure summary ........................................................ 116

4.9. Sources of air-operated valve operator failures ....................................... 119

4.10. Sources of motor-operated valve operator failures ................................... 122

4.11. Sources of pump failures................................................................ 124

4.12. FCs and operating experience for plants in the ORNL data base ........ ........... 127

4.13. Sources of component-related degradation ............................................ 128

4.14. Reported FCs per year, by source . .................................................... 129

4.15. Scatter diagram of the fraction of FCs available from NPRDS data as a

function of the average number of FCs per year for all data base plants ....... .... 130

4.16. RSD: component percentage contribution for top five plants ......... .............. 131
xi

LIST OF TABLES

Table Page

2.1. Pump combinations for failure data base plants ............. ........................ 11

2.2. Number of motor- and turbine-driven pumps for failure data base plants:

summary................................................................................. 11

3.1. Pump suction check valves (SCV): C-4 (motor-driven pump A), C-3 (motordriven pump B), and C-5 (turbine-driven pump) ............. ...................... 85

3.2. Emergency service water (ESW) to motor-driven pumps supply valves:

MOV-1, -2, -3, and -4 ........................................................... 86

3.3. Emergency service water to turbine-driven pump suction isolation valves:

MOV-5, -6, -7, and -8 ............................................................ 87

3.4. Motor-driven AFW pumps............................................................. 88

3.5. Turbine-driven AFW pump ........................................................... 89

3.6. Pump miniflow check valves: C-6, -8, and -10 ............. ........................ 90

3.7. Common miniflow check valves: C-1 and -2 ........................................ 90

3.8. Pump discharge check valves: C-7, -9, and -11 ..................................... 91

3.9. Motor-driven AFW pump level control valves: LCV-1/1A, -3/3A, -5/5A, and

-717A ........................................................... 92

3.10. Turbine-driven pump level control valves: LCV-2, -4, -6, and -8 ................ 93

3.11. Level control valve check valves: C-12 through -19 ........... ..................... 94

3.12. Steam generator B and C AFW to main feed check valves: C-21, -22, -24,

and -25................................................................................... 94

3.13. Main feedwater check valves (FWCV): C-20, -23, -26, and -27 ....... .......... 95

3.14. Feedwater isolation valves: FWIV-1 through -4 ............. ....................... 95

3.15. Steam generator blowdown isolation valves (BDIVs): BDV-1 through -4 ....... 96

3.16. AFW turbine steam supply valves: MOV-11 and -12 . . 97

3.17. AFW turbine steam supply isolation valves: MOV-9 and -10 ........ ............. 98

4.1. Component categorization.............................................................. 103

4.2. Component failure record summary ............................... ................... 103

4.3. FCs, by discovery method............................................................. 106

4.4. ASE, by discovery method ........................................................... 106

4.5. RSD, by discovery method............................................................ 106

4.6. FCs, by subsystem affected ........................................................... 108

4.7. ASE, by subsystem affected ........................................................... 108

4.8. RSD, by subsystem affected ........................................................... 108

4.9. FCs per reactor year, by 5-year groups .................... .......................... 109
xii

4.10. RSD, by 5-year groups (normalized for numbers of reactor years operation) ... 109

4.11. Pump driver type summary data ................................................... 111

4.12. Turbine FCs by detection method ................................................. 113

4.13. Turbine ASE by detection method .................................................. 113

4.14. Turbine RSD by detection method ................................................. 113

4.15. Pump motor FCs by detection method ............................................... 115

4.16. Pump motor ASE by detection method ............................................... 115

4.17. Pump motor RSD by detection method ............................................... 115

4.18. Diesel subcomponent FCs by detection method .................... ................. 117

4.19. Diesel subcomponent ASE by detection method .................................... 117

4.20. Diesel subcomponent RSD by detection method .................................... 117

4.21. FCs, by valve operator type ................................................. 118

4.22. ASE, by valve operator type .................................. 118

4.23. RSD, by valve operator type .................................. 118

4.24. Air-operated valve FCs ..................................... 120

4.25. Air-operated valve ASE ................................................. 120

4.26. Air-operated valve RSD ....................... .......................... 120

4.27. Motor-operated valve FCs ....................... .......................... 121

4.28. Motor-operated valve ASE ....................... .......................... 121

4.29. Motor-operated valve RSD ................................... 121

4.30. Valve type FCs ................................................. 123

4.31. ValvetypeASE ...................... 123

4.32. Valve type RSD ...................... 123

4.33. Pump subcomponent FCs ...................... 125

4.34. Pump subcomponent ASE ...................... 125

4.35. Pump subcomponent RSD ...................... 125

5.1. General AFW configurations .................................................... 133

5.2. B&W and Westinghouse plant thermal and pump design ratings ........ ......... 135

5.3. AFW MDP actuation signals for Westinghouse and B&W plants ........ ........ 137

5.4. AFW TDP actuation signals for Westinghouse and B&W plants ........ ......... 139

5.5. Numbers of B&W and Westinghouse plant valve operator types ................. 142

5.6. Flow control and isolation valve types, normal positions .......................... 144

5.7. Test loop and recirculation control types ............................................. 146

5.8. Normal suction supply quantity and suction switchover method .................. 148

6.1. Estimated test frequency for Plant A AFW system components ................... 153
xiii

ACKNOWLEDGMENTS

The guidance and organizational direction provided by D. M. Eissenberg, W. S.

Farmer, and W. L. Greenstreet are appreciated. Assistance provided in the acquisition of

failure data by G. A. Murphy, W. E. Norris, and W. P. Poore mI was instrumental to the

historical failure analysis portion of the study. The help provided by C. P. Stafford in the

retrieval of plant configuration information and the general support that he provided in the

conduct of this study is greatly appreciated. A major portion of this study would not have

been possible without the help of a number of utility employees. The assistance and

information provided by R. L. Clark, R. Galante, and J. R. Wolfgong are gratefully

acknowledged. Finally, the advice and contributions, both prior to and during this study,

of colleagues who prefer to remain nameless were of immense value. The perspectives

gained by interaction with these fellows are of inestimable worth.
xv

LIST OF ACRONYMS

The following is a list of acronyms that are used frequently throughout this paper.

ACP Auxiliary control panel

AFW Auxiliary feedwater system

AMSAC Anticipated transient without scram mitigating system actuation circuit

AOV Air-operated valve

ASME American Society of Mechanical Engineers

ASE Average system effect

B&W Babcock and Wilcox

BDIV Blowdown isolation valve

BMDLCV Bypass motor-driven pump level control valve

BWR Boiling water reactor

CMCV Common miniflow check valve

CST Condensate storage tank

DCV Discharge check valve

DDP Diesel-driven pump

EHOV Electrohydraulic-operated valve

ESF Engineered safety feature

ESW Emergency service water

FC Failure count

FSAR Final safety analysis report

FWIV Main feedwater isolation valve

GV Turbine governor valve

I&C Instrumentation and control

INEL Idaho National Engineering Laboratory

INPO Institute for Nuclear Power Operations

IST In-service test

LCO Limiting condition for operation

LCV Level control valve

LCVCV Level control valve check valve

LER Licensee Event Report

LOFW Loss of main feedwater

MCB Main control board

MCC Motor control center

MCV Miniflow check valve

MDLCV Motor-driven pump level control valve

MDP Motor-driven pump

MFCV Main feedwater check valve

MFLB Main feed line break

MI Maintenance test/inspection

MOV Motor-operated valve

MOVATS Motor Operated Valve Analysis and Test System'>

MSIS Main steam isolation signal

MSLB Main steam line break

MSSV Main steam safety valve

NPAR Nuclear Plant Aging Research

NPE S. M. Stoller's Nuclear Power Experience

NPRDS INPO's Nuclear Plant Reliability Data System

NPSH Net positive suction head

NRC Nuclear Regulatory Commission
xvi

NSSS Nuclear steam supply system

OP Operating procedure

ORNL Oak Ridge National Laboratory

PORV Power-operated relief valve

PS Pressure switch

PWR Pressurized-water reactor

PZR Pressurizer

RCP Reactor coolant pump

RCS Reactor coolant system

RGSC Ramp generator/signal converter

RSD Relative system degradation

SB Station blackout

SCV Pump suction check valve

S G Steam generator

SI Safety injection

SOV Solenoid-operated valve

SSIV Steam supply isolation valve

SSV Steam supply valve

ST Surveillance test

TDLCV Turbine-driven pump level control valve

TDP Turbine-driven pump

T&T Trip and throttle valve (for AFW turbine)
1. INTRODUCTION AND SUMMARY

The Nuclear Plant Aging Research (NPAR) Program was established by the Office of

Nuclear Regulatory Research of the Nuclear Regulatory Commission (NRC) to identify

sources of degradation, their effects, and available methods of degradation and failure

detection.

Nuclear plant safety-related systems are composed of combinations of electrical and

mechanical pieces of equipment that are intended to function in a coordinated manner to

support and/or allow normal plant operation while fulfilling specific roles in the mitigation

of anticipated transients and design basis accidents. The NPAR Program has identified

several types of components for detailed study. The studies of these individual

components have identified component-specific failure modes and causes, associated

stressors, and available monitoring methods.

This review of the auxiliary feedwater (AFW) system, used at pressurized-water

reactor (PWR) plants, has been conducted under the auspices of the NPAR Program. The

primary purposes of the review were to

1. determine the potential and historical sources and modes of failure within the AFW

system,

2. identify currently applied means of detecting known sources and modes of degradation

and failure, and

3. evaluate the general effectiveness of the current monitoring practices and identify specific

areas where enhancements appear needed.

This study, which was conducted by Oak Ridge National Laboratory (ORNL),

consisted of the following elements:

1. identification of general types of AFW system design configurations,

2. analysis of historical failure data, and

3. detailed review of a cooperating utility's AFW system design and their current operating

and monitoring practices.

1.1 BACKGROUND

Particularly since the Three Mile Island 2 accident, the AFW system has historically

been recognized as critical to successful mitigation of plant transients and accidents. In

recent years, operating incidents involving failures of AFW system components have been

among the leading events identified in the "Precursors to Potential Severe Core Damage

Accidents" reports,1 which identify the leading risk significant events for calendar years.

In the years 1984 through 1986, seven of the top ten events at PWRs, from a core damage

risk standpoint, involved partial or total failure of the AFW system.

Operational problems with the AFW system have been diverse in nature. Information

Notices and Bulletins and other mechanisms of information feedback and regulatory action

have been issued by the NRC that identify problems that have been experienced with AFW

systems. The following are provided as examples of failures involving the AFW system

that have resulted in NRC feedback.

Bulletin 85-01, "Steam Binding of Auxiliary Feedwater Pumps," discussed a number

of historical events in which backleakage of hot feedwater into the AFW system had

resulted in overheating of AFW discharge and suction piping and steam binding of AFW

pumps. The bulletin required the establishment of routine monitoring of AFW piping for
2

backleakage and the development of procedures to identify backleakage and restore the

system to operable condition should it occur.

Bulletin 85-03, "Motor Operated Valve Common Mode Failures During Plant

Transients Due to Improper Switch Settings," was issued primarily as a result of the June

9, 1985, loss of main feedwater and AFW at the Davis-Besse plant. AFW was lost

because of improper torque and limit switch settings on AFW system motor-operated

valves. (This episode was also discussed in Information Notice 85-50.)

Information Notice 86-01, "Failure of Main Feedwater Check Valves Causes Loss of

Feedwater System Integrity and Water-Hammer Damage," was issued to provide

information feedback on the November 21, 1985, failure of several check valves in the

main feedwater system at San Onofre 1. Failure of these check valves allowed draining of

the steam generators (SGs) and prevented AFW from reaching the SGs until gate valves

were closed by operator action. Sufficient draining occurred to result in condensationinduced water hammer when AFW began to refill the drained Main Feedwater piping.

Information Notice 86-09, "Failure of Check and Stop Check Valves Subjected to

Low Flow Conditions," was issued as a result of a number of failures of stop check valves

in the steam supply piping to the AFW turbines at the Turkey Point Units. The failures

occurred as the result of chattering induced by low flow that resulted from leakage past

motor-operated valves in series with the stop check valves.

Information Notice 86-14, "Overspeed Trips of AFW, HPCI, and RCIC Turbines,"

issued following the Davis-Besse event in 1985, discussed several types of turbine

overspeeding events that had occurred historically. A review of overspeed events of

turbine-driven pumps was conducted by the NRC Office of Analysis and Evaluation of

Operating Data. This review resulted in the publication of "Operational Experience

Involving Turbine Overspeed Trips," AEOD/C602, which in turn provided the basis for

this Information Notice.

Information Notice 87-53, "Auxiliary Feedwater Pump Trips Resulting from Low

Suction Pressure," was issued as a result of low-suction pressure trips of AFW pumps at

several plants because of suction pressure fluctuations that resulted from a variety of

transient system conditions.

These problems are examples of the diverse types of failures experienced in the AFW

system. Numerous other operating experiences have been fed back to industry through

both the NRC and the Institute of Nuclear Power Operations.

In reviewing the role that aging plays in failures such as these, there are some

important points to be considered. First of all, a combination of factors, including design,

maintenance, operation, aging, and other considerations may be involved. These factors

are not necessarily independent from one another. For example, a poorly designed

component or system may require that it be operated in a manner that is not necessarily

conducive to extended service of either that component or other components.

An example of this can be seen in many AFW system designs in relation to flow

paths available to a pump. If the only full flow path available for the pump is to the SGs,

required monthly or quarterly testing will normally be done under recirculation flow only.

It has become clear that running these pumps at low flow rates is deleterious to the pump

and pump life.2 But delivering flow to the SGs also has undesirable effects in terms of

nozzle thermal stress. The result is that the pumps are run under recirculation flow only for

testing (as well as often being run at low flow rates during routine plant startup and

shutdown) and accumulated wear results. If pump failure ultimately results, it would be

difficult to ascribe the failure to a particular cause such as aging. In reality, the failure may

result from the combination of poor system design, undesirable operating conditions,

insufficient maintenance attention, excessive test frequency requirements, etc.

This difficulty of determining the extent to which a particular failure is aging-related

extends to most component failures. The only failures that can be readily dismissed as not

being aging-related are those that occur within a short time after a component is placed in
3

service. The quantification of "short time" depends upon the particular component and its

operating conditions. For example, through-wall erosion of piping downstream of a

control valve would normally be viewed as an aging-related failure. However, a failure of

this nature could occur in a time span ranging from days to decades, depending upon the

piping material and layout, service conditions, and other factors.

A second point relative to aging is pertinent when considering systems. A system, as

noted above, is composed of a group of components, such as pumps, valves, motors,

piping, etc. The system ages only as the individual components age. The types of

components most subject to wear and aging may vary significantly from system to system,

however. Furthermore, even for the same type of system, certain components may

experience substantial service wear at one facility and very little at another because of the

combination of design, maintenance, and operating factors involved. Other studies

performed under the NPAR Program address important components within the AFW

system and the aging stressors for these individual components.

A third important factor in determining the ORNL approach was an Idaho National

Engineering Laboratory (INEL) study that reviewed historical failure data from the Institute

of Nuclear Power Operation's Nuclear Plant Reliability Data System (NPRDS) (similar to

the NPRDS data that were reviewed by ORNL in this study) and made judgments as to

whether individual failure episodes were aging related. 3 The INEL report was based upon

some of the same failure data that were used in this study (the review of failure data is

discussed in Chap. 4).

Because of these factors, the ORNL approach to the AFW system study has focused

on how and to what extent the various AFW system component types fail, how the failures

have been and can be detected, and on the value of existing testing requirements and

practices, rather than attempting to focus on the extent to which aging (vs design or

operating practices, for example) is responsible for failure or degradation.

On the other hand, in the review of a particular plant's design and operating practices,

it is possible to determine, in a relative manner, the extent to which design, test, and

operating requirements can contribute to aging for particular components. For instance, if a

check valve routinely experiences low flow rates during system operation, and is located

just downstream of a flow disturbance, a judgement can be made that the particular valve

will be likely to experience a relatively high rate of service wear compared with a similar

valve in more optimal conditions. Aging concerns of this nature are addressed in this

study. However, the individual component configuration and operating conditions may

vary considerably from plant to plant, and even within the same system.

1.2 SUMMARY OF RESULTS

The analysis of historical failure data and the detailed review of a cooperating utility's

AFW system design and monitoring practices provided complementary results. The single

largest source of historical AFW system degradation, based upon the historical failure data

review, is the turbine drive for AFW pumps. Note that the turbine proper has been a

relatively reliable and rugged piece of equipment. However, the turbine auxiliaries,

including the governor control and trip and throttle valve, have contributed substantially to

the overall turbine problems.

The failures of valve motor and air operators combined were found to have resulted in

approximately the same level of degradation of the AFW system as the turbine drives alone.

Pump failures and check valve failures were also significant contributors to system

degradation.

For each of the component types and for the various sources of component failures,

the methods of failure detection were designated and tabulated. The most notable feature of

this aspect of the study was that instrumentation and control (I&C) related failures
4

dominated the group of failures that were detected during demand conditions (as opposed

to failures detected as the result of periodic monitoring or routine observations made by

operators or other personnel). This finding was corroborated by the detailed review of the

operating plant's monitoring practices, because many of the potential failure sources not

detectable by the current monitoring practices were related to the I&C portion of the

system.

It was also observed that a number of conditions related to design basis demands are

not being periodically verified. Examples of these include pumps not being verified at

design flow/pressure conditions, turbines not being verified to be capable of delivering

required flow at low steam pressures, various control sequences not being checked, and

automatic pump suction transfers not being tested.

Another observation was that some components or certain parts or aspects of

components appear to be tested in excess of what failure history indicates to be appropriate.

In contrast, as can be gathered from comments above, other aspects of certain parts of

AFW systems are either never tested or receive less than thorough testing. Enhanced

testing requirements appear to be needed to reduce excessive testing while at the same time

ensuring that thorough performance verification is conducted periodically.

REFERENCES

1. J. W. Minarick et al., Martin Marietta Energy Systems, Inc., Oak Ridge Natl. Lab.,

Precursors to Potential Severe Core Damage Accidents, USNRC Report NUREG/CR4674 (ORNL/NOAC-232), December 1986.

2. M. L. Adams and E. Makay, Martin Marietta Energy Systems, Inc., Oak Ridge Natl.

Lab., Aging and Service Wear of Auxiliary Feedwater Pumps for PWR Nuclear Power

Plants, NUREG/CR-4597, Vol. 1 (ORNL-6282/V1), July 1986.

3. B. M. Meale and D. G. Satterwhite, An Aging Failure Survey of Light Water Reactor

Safety Systems and Components, USNRC Report NUREG/CR-4747 (EGG-2473,

Vol. 2), July 1988.
5

2. GENERIC AFW SYSTEM DESIGN

2.1 INTRODUCTION

AFW system designs in U.S. PWRs vary considerably, in part because of the general

evolution of design requirements imposed by the NRC, but largely because the AFW

system is generally designed by the plant's Architect-Engineer. As a result, even two

plants with similar nuclear steam supply systems (NSSSs) that are constructed during the

same time frame can have significant differences in AFW system design. To provide some

insight into AFW system designs and the bases for those designs, both generic and plantspecific discussions are provided. Section 2.3 briefly discusses generic system functional

requirements and some typical designs and serves as an introductory overview of the AFW

system. More specific insight into the design of an individual plant's system is provided in

Chap. 3.

2.2 SYSTEM BOUNDARIES AND INTERFACING SYSTEMS

For the AFW system to accomplish its design requirements, proper functioning of

interfacing system components is required. The AFW system interfaces with a number of

systems, including but not limited to the

1. main feedwater system,

2. main steam supply system,

3. SG blowdown system,

4. emergency service water (ESW) system,

5. engineered safety features actuation system, and

6. electrical and instrumentation power distribution systems.

The components that comprise the interface for the AFW system have been reviewed, in

part, by this study. The detailed review of a specific plant's AFW system (Chap. 3)

included a review of the interfacing components; however, the failure data search (Chap. 4)

did not address these interfacing components. The interfacing components were not

included in the failure data search because the system affected by the failure of these

components would typically be assigned as the system to which the components belonged,

rather than the AFW system. However, failure of an interfacing system component can

degrade the associated AFW train(s) just as severely as failure of a component designated

as an AFW system component.

2.3 AFW SYSTEM FUNCTIONAL REQUIREMENTS AND TYPICAL

DESIGNS

2.3.1 Generic Functional Requirements

The AFW system's principal role is to support removal of stored and decay heat from

the reactor coolant system (RCS). The SGs act as a heat sink during both normal operation

and following reactor trips. During normal operation, the main feedwater system provides

feedwater to the SGs, where it is converted to steam and then used to drive the main turbine

and provide process steam for various plant equipment. During normal power operation,
6

the AFW system is in standby (except when in test). Following an operating transient or

accident, as well as during routine startups and shutdowns,* the AFW system is used to

provide a safety-related source of water to the SGs. The water delivered by the AFW

system is heated and vaporized in the SGs. Steam thus generated can be released to the

atmosphere through the safety-related main steam safety valves or atmospheric dump

valves or to the atmosphere and/or condenser through nonsafety-related steam dump

valves.

The AFW system must not only support the heat removal but allow the heat removal

to take place in a controlled manner even under design basis accident conditions. There are

four general functional requirements of the AFW system:

1. provide flow to intact SGs following design basis transients/accidents,

2. isolate flow to faulted or ruptured SGs,

3. maintain a liquid barrier between the RCS and the environment following design basis

accidents to ensure that any primary to secondary tube leakage is "scrubbed" before

release, and

4. support normal startup and shutdown evolutions.

As noted, the AFW system is used, at most plants, in support of normal plant startup

and shutdown. However, this is not the primary basis for its design. Rather, it is

specifically designed for the mitigation of the consequences of design basis transients and

accidents, including loss of main feedwater (LOFW), main feed line break (MFLB), main

steam line break (MSLB), small- and large-break loss-of-coolant accidents, SG tube

rupture, and others. In addition, proper functioning of the AFW system is critical to the

ability of a plant to deal with an important accident condition, station blackout, which has

not been historically treated as a design basis accident.

2.3.2 Design Configurations

A broad range of AFW system designs exist at operating plants. Figures 2.1-2.3

provide flow diagrams that are representative of the cross section of existing PWR AFW

systems. This section discusses some general design configuration features. Because of

the diversity of AFW system designs, it is difficult to depict adequately AFW systems in

general. A compilation of operating plant pump and driver, valve and valve operator, and

other general configurational information for Westinghouse and Babcock and Wilcox

(B&W) plants is provided in Chap. 5.

2.3.2.1 Pump suction sources

Most plants have a dedicated storage tank, commonly designated as the condensate

storage tank (CST) that is used to maintain a reserve inventory of high-quality water for the

AFW pumps. The inventory available for the AFW pumps may actually come from

multiple sources, depending upon plant design. For purposes of this discussion, the

normal source(s) of water will be referred to as the CST. Plants under Standard Technical

Specifications have a designated inventory that must be maintained in the CST during

Modes 1-3. The CST is safety grade and seismically qualified at some plants, but not at

others. Normal system alignment would have the suction flow path from the CST to the

*At some plants, nonsafety-related startup feedwater systems are available and used

to support plant startup and shutdown in lieu of the AFW system.
ORNL-DWG 90-3300 ETD

FW

.MS

ED

.MS FW

ESW

Fig. 2.1. AFW system for two-loop plant.
ORNL-DWG 90-3301 ETD

Fig. 2.2. AFW system for three-loop plant.
ORNL-DWG 90-3302 ETD

FW .MS

MS

MS

ESW

Fig. 2.3. AFW system for four-loop plant.
10

AFW pumps open, and in fact, manual valves in the suction flow path may be required to

be locked open.

The majority of plants also include a backup source of water, normally from the

plant's ultimate heat sink system, which is commonly called the emergency service water

(ESW) system. Depending upon plant design, the ESW may be the only safety-grade

source of water (e.g., if the CST is nonsafety grade). Switchover from the CST or other

normal supply sources to the ESW may be either automatic or manual. Low suction

pressure is the normal switchover condition monitored for plants including automatic

switchover. Some plants use suction pressure transmitters to provide AFW pump tripping

under low suction pressure conditions (this trip function has been removed at several plants

and replaced with an alarm only to avoid spurious tripping). Even for plants that do not

use automatic switchover, low suction pressure instrumentation may furnish main control

board indication and annunciation to provide the operator with an indication of the need for

suction transfer. CST or other normal water source level instrumentation also provides the

operator with suction status. For plants with manual switchover only, some provide totally

remote switchover capability, while others require local valve realignment.

Check valves are normally included in the normal suction supply lines to prevent flow

reversal into the CST if ESW must be used as the suction source. In cases where the

normal suction sources are nonsafety grade, the suction check valve forms the boundary

between safety-grade and nonsafety-grade portions of the AFW system.

2.3.2.2 Pumps

All three flow diagrams (Fig. 2.1-2.3) indicate two motor-driven and one turbinedriven pump per plant. This is the most typical configuration; however, there are a number

of pump combinations at operating plants. In addition to variations in the number of

pumps per unit, the type of drivers vary. There are various combinations of motor-,

turbine-, and diesel-driven pumps in the AFW pump population. Among Westinghouse

and B&W plants included in the ORNL failure data base (discussed in Chap. 4), six

different AFW system pump combinations were identified. A summary of general pump

and SG configuration information for the plants in the failure data base is provided in

Tables 2.1 and 2.2. Plant-specific SG and pump configuration information is provided in

Chap. 5.

Motor-driven pumps receive their power from emergency busses (there are some

plants which designate one or more nonsafety-related motor-driven pumps as part of the

AFW system; however, these pumps were not included in this study). Pump breaker

closure not only starts the associated pump, but auxiliary contacts for the breaker are often

used to provide control signals to other AFW system features.

Steam for the turbine-driven pumps is supplied by one or more (typically two) SGs.

There are a number of steam supply control arrangements. Some plants start the turbine by

opening a normally closed trip and throttle (T&T) valve, located immediately adjacent to the

turbine. Other plants leave the T&T valve normally open and start the turbine by opening

one or more upstream isolation valves. Some plants have pressure control valves in the

steam supply line that limit steam pressure available to the turbine; at other plants, full

steam pressure is available to the turbine (less line and governor losses). Turbine speed

and therefore pump flow, are controlled by turbine governor valve position. The governor

valve operator receives control signals typically based on turbine speed and, for some

controllers, flow or other differential pressure measurement (e.g., steam supply to pump

discharge differential pressure).

Some plants include nonsafety-related pumps that are similar in function to the AFW

pumps. Where available, these pumps are used in support of normal startup/shutdown (in

some cases, they are referred to as startup feed pumps). While these pumps have not been

considered in this study, their availability can have a substantial impact upon the service
Table 2.1. Pump combinations for failure data base plants

Two-loop Three-loop Four-loop

Configuration plants plants plants Total

One MDP, one TDP 5 1 0 6

Two MDP, one TDP 8a 9 20 37

One MDP, one DDP 0 0 1 1

One TDP, one DDP 0 0 1 1

Two TDP 1 0 1 2

Three TDP 0 2a 0 2

Total 14 12 23 49

a Note: Includes units sharing one or more pumps.

Table 2.2. Number of motor- and turbine-driven pumps

for failure data base plants: summary

Two-loop Three-loop Four-loop

Configuration plants plants plants Total

Total MDPs 17 19 41 77

Average number MDPs / plant 1.50 1.58 1.78 1.65

Total TDPs 15 13 23 51

AveragenumberTDPs/plant 1.07 1.33 1.00 1.10

I-.-
12

wear of AFW pumps and other AFW equipment because the AFW pumps would not be

routinely used for startup/shutdown purposes. The nonsafety-related pumps can also

substantially enhance the availability of postaccident secondary cooling. As an example,

following the June 1985 Davis-Besse loss of feedwater and AFW, feed flow to the SGs

was ultimately restored by use of a startup feed pump.

2.3.2.3 Pump discharge and recirculation flow

Pump discharge lines include flow paths to the SGs and minimum recirculation flow

paths. The recirculation flow may be controlled by orifices, line size, control valves, or a

combination of these means. Some plants include both a minimum recirculation flow path

and a full-flow test loop, both of which recirculate flow to the CST or other suction source.

Other plants use a common flow path for both, while others do not have a full-flow test

loop but only a miniflow recirculation path. A tabulation of full-flow test loop availability

is provided in Chap. 5.

Recirculation flow paths, both of the full-flow and the miniflow variety, may include

valves that automatically isolate under certain conditions. For instance, plants with fullflow recirculation test loops typically include automatic isolation valves that close if an

automatic start signal occurs. Other plants provide for automatic isolation of the miniflow

path if the associated pump is the only available pump or if delivered flow to the SGs is

sufficient to provide what has been determined to be adequate for pump protection.

In a number of plants, the miniflow recirculation flow paths include check valves

upstream of where the individual pump lines join to form a common recirculation line

header. The apparent design function of these valves is to provide train separation,

although there are no such valves in some plants. For those plants that do not have these

check valves, the apparent rationale is that orifices or other flow-limiting devices would

limit cross train flow, thereby eliminating the need for train separation offered by check

valves. For a sample of plants for which nominal minimum recirculation flow rates were

specified in the FSAR, the flow velocities at check valves in the miniflow lines ranged from

1 to 15 ft/s. While, as noted, the only apparent function of these valves is to provide train

separation, those valves that routinely experience flow velocities less than that required for

full stroking (estimated to be in the range of roughly 8 to 15 ft/s, depending upon the

specific check valve design), can be fairly susceptible to service wear. Inasmuch as

testing, if any, associated with the recirculation check valves is to verify that the required

flow rate is supported, substantial degradation or failure of these valves may not be

detectable.

Valving between the pumps and the SGs provides for control of individual pump

flow, flow to specific SGs, and a means of preventing backleakage from the SGs or from

main feedwater. The arrangements of valves between the pump discharge and the SGs

vary considerably in terms of numbers, operator types, layout configuration, control signal

sources, and normal standby position.

Some plants use automatic discharge pressure control valves for motor-driven pumps

to provide pump runout protection. These valves may be either normally closed or open

and receive a control signal following pump start. The valve control signal is normally

geared toward maintaining discharge pressure or flow at a designated setpoint. The

capability to adjust the control setting from the main control room may or may not exist.

Other plants do not use automatic valve positioning to regulate individual pump

flow/discharge pressure; rather, nonadjustable, fixed means, such as cavitating venturis,

flow-restricting orifices, or valves locked in a throttled position are utilized. For yet other

plants, it is not clear, from FSAR descriptions and other information available, what, if

any, pump runout protection, other than operator action is available.
13

Most pump discharge lines include discharge check valves to prevent reverse flow

from other pumps as well as to prevent backleakage of main feedwater. For a sample of

plants reviewed, the flow velocities that would be experienced at design flow rates for the

motor-driven pumps ranged from 5 to 12 ft/s. Note that when AFW pumps are used

during startup/shutdown evolutions, they would normally be run at substantially less than

the design flow rates. For the pumps that are used for this service, discharge check valves

can be subject to accelerated service wear. Unlike the miniflow check valves, the function

performed by these valves is critical to successful system operation.

2.3.2.4 Flow distribution

Pump discharge line configurations normally allow more than one SG to be fed by

each pump (although some two-loop plants are arranged such that only one pump normally

feeds one SG). All three-loop plants are configured such that all three SGs are fed by all

pumps, while most four-loop plants are designed and normally aligned to allow feeding of

all four SGs by a turbine-driven pump and feeding of two SGs by each motor-driven

pump. Control of flow to individual SGs is provided by a variety of combinations.

Motor-, air-, electrohydraulic-, and solenoid-operated valves are used as flow control

devices. There are diverse control designs for the valves. Control valves at some plants

are normally closed while corresponding valves are normally open at other plants. Those

that are normally closed typically receive an open signal on associated pump start or AFW

actuation signal. At some plants, the flow distribution valves automatically modulate to

maintain a preset flow or SG level; while at other plants, the valves go to a full open or

other fixed position and remain there unless repositioned by an operator.

The flow distribution valves may be used as a part of a faulted SG isolation system,

which automatically detects and isolates any SG that is depressurized. This system

supports the functions of both ensuring that intact SGs can receive AFW flow as well as

minimizing the adverse impact of feed or steam line breaks on the RCS and containment.

Other plants rely upon flow-limiting devices, such as cavitating venturis, on a temporary

basis following a faulted SG event, and ultimately upon operator action to detect and then

to isolate flow to the faulted SG. Yet other plants depend solely upon operator recognition

and isolation of the faulted SG, with no automatic break detection and isolation or fixed

flow-limiting devices available. Note that the valves used in the AFW system to isolate

flow are not normally seat leak tested, even if they are classified as containment isolation

valves.

Some plants have dedicated AFW SG nozzles, while the AFW discharge lines at

other plants connect with main feedwater piping upstream of the SGs. Various

combinations of check valves and isolation valves are used to avoid backleakage of hot

feedwater or steam into the AFW system. There are typically several check valves, and in

some cases, closed isolation valves in series between the pumps and the SGs.

2.3.3 AFW System Starting

AFW systems are started automatically when monitored plant conditions provide

indication that AFW operation is warranted. The specific signals monitored, like all other

aspects of the AFW system, vary from plant to plant. There are several sources of

automatic starting, however, which are fairly common, including safety injection, low SG

level, loss of offsite power (typically emergency bus undervoltage), reactor coolant pump

trip, and main feed pump trip. Typically, automatic start signals will either start AFW

pumps immediately, or as a part of load sequencing. In either case, the pumps are usually

started within a minute following the start signal initiation.
14

AFW start signals also actuate other equipment that is crucial to AFW system

success. For example, some plants have normally closed discharge valves that must open

to allow flow to reach the SGs. These valves receive an open signal on AFW initiation.

Other equipment that is not specifically part of the AFW system may also respond automatically on an AFW start signal. For example, SG blowdown isolation valves may receive an automatic closure signal from the AFW start signal, thereby helping to ensure

that the flow delivered to the SGs can be converted to steam (vs draining off without

changing phase).

Manual start capability for all AFW pumps is typically provided at the main control

board as well as at the remote shutdown panel. Additionally, local stations may be

provided for pump starting and stopping.

A typical logic diagram showing the origination of AFW start signals and the

equipment actuated as a result is provided in Fig. 2.4. A detailed discussion of AFW

system actuation for a specific unit is provided in Chap. 3.

2.3.4 AFW System Operation

Following AFW system starting, whether as the result of automatic or manual

starting, the system responds to both manual and automatic control functions. The sources

of the control signals are diverse. Flow to the SGs is controllable through valves that

open/close/modulate in response to automatic control and/or manual control signals. These

signals may be based on flow, level, or pressure. Turbine-driven AFW pump speed is

controlled automatically, normally based on flow, differential pressure, speed, and/or other

signals. Turbine speed can also normally be controlled by remote manual action.

Typical AFW system design would initiate flow to the SGs automatically at full flow

and require operator action to control or isolate flow. However, as noted previously, some

plants do have automatic level controls. Some facilities also have an automatic isolation

feature that detects and isolates faulted (depressurized) SGs. Other plants incorporate flowlimiting venturis or orifices to prevent excessive flow from being delivered to a faulted SG.

Following a reactor trip, as well as during normal startup and shutdown evolutions in

which the AFW system is actuated, the instantaneous flow to the SGs may vary from zero

to several hundred gallons per minute. Following a reactor trip, while decay heat load is

fairly high, typical practice for a plant with a turbine-/motor-driven pump combination

would be to stop the turbine-driven pump following plant stabilization and then control SG

level using only the motor-driven pump(s). Under very low decay heat conditions, for

example, during routine startup and shutdown, SG feed control practices may vary from

plant to plant and even from operator to operator. For example, if there are no specific

procedural requirements and demand is low, one operator may elect to "batch" feed the

SGs by starting and stopping a pump periodically. Another may also "batch" feed, but

leave the pump running in recirculation flow in between batching. A third method would

be to continuously feed at very low flow rates, while also maintaining recirculation flow.

During these low-flow periods, the minimum number of pumps would be run (the

minimum number depending upon plant configuration and specifically how many SGs can

be fed by a particular pump). Note that some plants with nonsafety startup feed pumps can

avoid running at low flow for protracted periods or repeated starting and stopping of the

AFW pumps.

Operating guidance and practices for a specific plant are included in Chap. 3.

2.3.5 Example AFW System Requirements for Various

Accident Conditions

The various accident scenarios create somewhat different demands upon the AFW

system. To provide some insight into these demands, three types of events, LOFW,
ORNL-DWG 90-3303 ETD

2/3 LO-LO

LEVEL, SG A

2/3 LO-LO

LEVEL, SG B

2/3 LO-LO

LEVEL, SG C

AND

OR

UE

Fig. 2.4. Typical AFW system actuation logic.
16

MFLB, and MSLB, will be discussed in relationship to the AFW system functions. In

considering these events, remember that the general role of the AFW system is to support

stabilization of the plant at hot standby conditions, and then to support plant cooldown and

depressurization to the point where the residual heat removal system can be placed into

service. The discussion of these events is intended to serve to illustrate both this general

role and supplementary functions as well.

The following discussions of plant response to various transient/accident conditions

are based on general trends noted in the review of the Accident Analysis sections from a

number of plants' FSARs. Note that the overall response of one plant to an initiating

transient may differ substantially from the response of another plant to the same transient

conditions. Furthermore, the plant response, as presented in FSAR analyses, is generally

overstated (as a result of conservatism built into licensing based analyses) and is heavily

dependent upon modeling methodology. As an example, no control system operation is

assumed in safety analyses, unless it would be adverse to the analysis results. In reality,

operation of control systems, when available, substantially mitigates overall plant response

in most cases.

Note that the response of the parameters monitored (RCS and SG pressure) is very

sluggish with respect to AFW initiation; that is, starting of an AFW pump does not create

an immediately observable effect. In contrast, the effect of the lifting of a main steam

safety valve (MSSV) can be immediately seen for two reasons: relative size and

thermodynamic effect. AFW pump capacity is small relative to MSSV capacity. A typical

single MSSV is capable of relieving a mass flow rate of roughly two to four times the

design mass flow rate of a typical AFW pump. Note that there are several safety valves per

SG. Secondly, because the preponderance of heat removal is associated with the

vaporization of SG fluid, and because in safety analyses the SG level never falls to a point

where no fluid exists, no observable change is associated with delivery of AFW to the

SGs. However, failure to deliver AFW to the SGs would have substantial impact on the

results of any transient, because the RCS heat sink would degrade and eventually be lost.

2.3.5.1 Loss of main feedwater

The LOFW scenario is an event that can be classified as expected; that is, it is to be

expected that all plants will suffer at least partial LOFW events several times during plant

life. The LOFW event is a heatup event [i.e., one in which the RCS temperature, pressure,

and pressurizer (PZR) level increase in response to the transient] and represents the most

general demand for the AFW system, that is, to merely provide flow to the SGs for heat

removal when the normal feedwater supply is not available.

Total or partial LOFW can be initiated by any one of several circumstances, including

main feedwater pump trip, main feedwater control valve closure, main feedwater isolation

valve (FWIV) closure, and a host of other events. (In turn, these LOFW initiators can

occur as the result of a multitude of causes, such as blown fuses, solenoid valve failure,

main feedwater pump motor or turbine failure, etc.).

Charts showing typical accident analysis trends of RCS and secondary pressure

following LOFW are presented in Figs. 2.5 and 2.6. These parameters are shown because

certain key conditions can be readily seen from their curves. Following LOFW, SG levels

drop, and RCS temperature and pressure begin to increase. Reactor trip could occur on

any one of a number of trip signals, such as steam/feed flow mismatch, low SG level, high

PZR pressure, etc. For total LOFW events, reactor trip would be expected to occur in

short order (<1 min). Following the reactor trip, RCS temperature and pressure would

initially drop but then gradually start to increase because of loss of forced RCS coolant

flow (assumed to occur at the time of reactor trip). The AFW system is neither designed to
17

ORNL-DWG 90-3304 ETD

c.m

cJn

CZ,

2600

2400

2200

2000

1800

1600

1400

1200

PZR SAFETY PZR SAFETY LIFTS

LIF-TS R

LOSS OF

FEEDWATER

AFW FLOW

INITIATED

DECAY HEAT REMOVAL

GREATER THAN DECAY

HEAT INPUT, ALLOWING

SUFFICIENT COOLDOWN TO

BEGIN DEPRESSURIZING

THE RCS

10 I 10010 I l lO10000

TIME (s)

Fig. 2.5. RCS pressure response to loss of feedwater. .

I - _ - ORNL-DWG 90-3305 ETD 14A -

1200 -

1000 -

AFW FLOW

INITIATED

C,,

C.,

0

c-,

800

600

400

LOSS OF

FEEDWATER SECONDARY PRESSURE

REACHES SG SAFETY

SETPOINT

200

I O I I I

10 100 1000 10000

TIME (s)

Fig. 2.6. SG pressure following loss of feedwater.
18

prevent reactor trip nor to prevent the initial heatup response that occurs before the trip;

rather, it serves to mitigate the longer term posttrip heatup.

Following the reactor trip and the associated initial cooldown/depressurization, the

RCS pressure increases to the point where the PZR safeties again lift to limit pressure.

Secondary pressure increases to reach MSSV setpoint pressure. Both hot- and cold-leg

temperatures increase because of loss of forced flow. Natural circulation flow develops

because of the hot-leg/cold-leg temperature differential created by the SGs. Primary to

secondary temperature differential may reach 30 to 400F. Ultimately, as decay heat input

decreases, even a single AFW pump can deliver adequate flow to allow heat removal to

equal and then exceed decay heat input. Under the most limiting conditions (from a safety

analysis standpoint) where no credit for control functions or for operator intervention is

taken and assuming a limiting single failure, it can be 10 to 30 min following the reactor

trip before heat input/heat removal equilibrium is reached. After this point, the RCS could

be maintained at roughly Hot Standby conditions (although at an elevated temperature

because of natural circulation vice forced circulation conditions), using only AFW and the

MSSVs. Cooldown can be effected by use of SG power-operated relief valves or

atmospheric dump valves.

2.3.5.2 Main feed line break

The response of the plant to an MFLB can vary considerably, depending on a number

of factors, particularly the SG design and the location of the break. If the break occurs

upstream of an FWIV or main feedwater isolation check valve, and those components

function properly, the plant response will not be considerably different than that for a

LOFW event. If the break occurs downstream of an FWIV, plant response can range from

that associated with a substantial cooldown to the most severe analyzed heatup event.

If the main feedwater nozzle is located in a position such that a break in the line would

result in the portion of the SG above the operating water level being exposed, the plant

response will be a rapid cooldown and will appear similar to, though not quite as severe as

the response to an MSLB. On the other hand, if the nozzle connection is such that the

liquid portion of the SG is exposed, the plant response will differ substantially. The latter

type event will be discussed here.

Figures 2.7 and 2.8 provide an indication of the respons6 of RCS and SG pressure

following a liquid portion feedline break. Level in the affected SG is lost fairly rapidly,

resulting in a reactor and turbine trip. Secondary pressure rises quickly following the

turbine trip. At the same time, the broken feedline is a source of depressurization for all

SGs, resulting in a rapid turnaround of the pressure spike. Pressure in all SGs continues

to drop rapidly until a main steam isolation signal (MSIS) occurs. Following the MSIS,

the SGs are decoupled, and the faulted SG is readily identifiable.

The feedline break both prevents or minimizes feedwater flow reaching the SGs as

well as drains the water from the affected SG, thereby reducing the inventory that is

available for heat removal (although some heat is removed by the water that is blowing out

the break, it is primarily sensible heat and represents a small fraction of the potential heat

removal associated with the heat of vaporization).

From the perspective of the AFW system, the main feature associated with the MFLB

event that is different from the LOFW event is that one SG is totally depressurized. The

early plant response is somewhat similar to a steam line break (cooldown); but following

the MSIS and the decoupling of the SGs, the event becomes a heatup transient similar to

the loss of feedwater transient, with the exception that one less SG is available for heat

removal. Also, note that unless automatic or manual control takes action to minimize or

isolate flow to the faulted SG, very little AFW flow may actually reach the intact SGs,

because flow would preferentially go to the low-pressure SG.
19

ORNL-DWG 90-3306 ETD

RCS AT PZR SAFETY

/ VALVE SETPOINT

REACTOR TRIP

Cd,

2600

2400

2200

2000

1800

1600

1400

1200

FAULTED SG ISOLATED

TIME (s) __

Fig. 2.7. RCS pressure response to feedline break.

ORNL-DWG 90-3307 ETD

REACTORJTURBINE

_ TRIP f AK / Ad INTACT SG(s) AT

r I I N\ / SAFETY VALVE SETPOINT

1400

1200

1000

800

600

400

2(0)

U,C

MAIN STEAM ISOLATION

ISOLATES FAULTED SG

- INTACT SG(S)

------- FAULTED S(;

TIME (s)

Fig. 2.8. SG pressure following feedline break.
20

As a result, various combinations of design features and operator actions are

employed to ensure that the intact SGs can be fed following an MFLB. Some plants

employ an automatic isolation scheme in which a faulted SG is sensed by process

instrumentation and automatically isolated by means of AFW discharge valves. Some other

plants rely, at least in part, on flow-limiting devices, such as cavitating venturis, to prevent

an excessive amount of flow going to a faulted line (thereby robbing the intact SGs of

feed). Other plants depend on operator action to detect and isolate a faulted SG.

2.3.5.3 Main steam line break

The MSLB is a design basis accident that creates a substantially different plant

response than LOFW or MFLB. The MSLB causes a rapid cooldown, depressurization,

and contraction of the RCS. Using the most limiting assumptions associated with design

basis accident analyses, an MSLB may create a sufficient cooldown to cause a return to

criticality, even after the reactor is tripped (because of a high negative moderator

temperature coefficient). While not required during the early phases of an MSLB, because

the break itself causes a substantial cooldown of the RCS, the AFW system, for most plant

designs, would be automatically initiated by conditions resulting from the MSLB. Because

any flow delivered to the faulted SG would serve to enhance the cooldown, termination of

the flow is necessary. Also, if an MSLB were to occur inside containment, a substantial

increase in containment temperature and pressure could occur. Any AFW flow delivered to

the faulted SG would serve to magnify the temperature and pressure increase. As in the

case of the MFLB, the various combinations of design features and operator actions are

required to terminate flow to the faulted SG, although in this case, the need to terminate

flow is driven more by the need to avoid excessive cooldown and steam release to

containment than by the need to ensure that adequate flow is delivered to intact SGs.
21

3. REFERENCE PLANT DETAILED DESIGN

A cooperating utility allowed ORNL to review the details of the AFW design at an

operating plant, along with associated operating, surveillance, and maintenance procedures.

Further reference to this plant will be as "Plant A." The design of the Plant A AFW system

will be discussed in Sect. 3.1; Sect. 3.2 provides additional information on Plant A

procedural practices.

A simplified system flow diagram of the Plant A AFW system is provided in Fig.

3.1. The design requirements and actual design features of each of the major system

components will be discussed in detail. The major configuration and design features of the

system are

1. two motor-driven pumps, each capable of delivering flow to two SGs;

2. one turbine-driven pump, capable of delivering flow to all four SGs;

3. AFW discharge lines that connect with the main feed headers;

4. steam supply to the AFW turbine from either SG A or D; and

5. the normal supply of water from the CST, with ESW acting as a backup source.

There are several AFW automatic start signals. The motor-driven pumps (MDPs)

start on

1. safety injection,

2. low-low level in one SG,

3. trip of either main feed pump at >80% power,

4. trip of both main feed pumps (at any power), and

5. station blackout (SB) signal.

The turbine-driven pump (TDP) starts on the same signals, except that low-low level in two

SGs must exist for TDP start.

In addition to the pumps starting automatically, other AFW system features are

automatically actuated. These will be discussed in detail for each of the specific

components.

3.1 COMPONENT DESIGN FUNCTIONS, CONTROLS, AND

INDICATION

3.1.1 Pump Suction Check Valves: C-3,* -4, and -5

3.1.1.1 Component Function and Design Features

The SCV opens on pump start to allow water from the CST to reach the pump

suction. If the CST is depleted or for other reason a low suction pressure condition exists,

the motor-operated ESW to AFW pump suction isolation valves open to admit water to the

pump suction. When this occurs, the pump SCV closes to prevent backflow of ESW to the

CST.

*The component and procedure references used in this report are not the actual

references used at Plant A. The references were modified in order to maintain

confidentiality of the plant. However, the report is internally consistent in use of

component and procedure references.
10 SGF) PCV-2O~N

_ 11 9 y~~~~~~~~~SG BA PCV2 C24%9

-10 ~~~~~LCV -3A FW _MS IV- 1 - STAEAM

FWIV2BV22

LCV-1A F2IV-1 C-27 Boy-lilA

}X~~~~~~~~~ is C-33

t :TFT | _ -

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ~~~~SG BLOWDOWN

NOV-9 MOV-10

Fig. 3.1. Plant A auxiliary feedwater system.
23

The MDP SCVs are 8-in. swing check valves. The TDP SCV is a 10-in. swing

check valve.

The general arrangement of the pump SCVs, including approximate distances from

the nearest upstream elbow, are shown in Fig. 3.2. Note that there are 3 to 4 nominal pipe

diameters between the elbow and the SCVs for the MDPs, while approximately one pipe

diameter is between the elbow and the SCV for the TDP.

ORNL-DWG 90-3309 ETD

FROM FROM

CST CST

MOTOR-DRIVEN PUMPS TURBINE-DRIVEN PUMP

Fig. 3.2. Pump suction check valves configuration.

Under the design basis flow conditions of 465 gal/min for the MDPs and 920 gal/min

for the TDP, the average approach velocities to the SCVs are -3 and 4 ft/s, respectively.

Under test alignment conditions where the pumps are on recirculation flow only, the

velocities for both type pumps' SCVs are <114 ft/s. During startup/shutdown support,

when the MDPs are run on a continuous basis, the MDP SCVs would see varying flow

conditions, with the bulk of the time on recirculation only, but occasional "batching" flow

rates of 165 gal/min, which would correspond to a velocity of -1 ft/s.

3.1.2 Emergency Service Water to Motor-Driven Pump Suction Isolation

Valves: MOV-1, -2, -3, and -4

3.1.2.1 Component Function and Design Features

ESW is the safety-grade supply of water for the AFW pumps; the CST is the normal

supply source, but is nonsafety, nonseismic class. The switchover must occur quickly

enough so that the pumps are not damaged or air bound because of loss of required suction

head. At the same time, inadvertent switchovers should be avoided to prevent the

introduction of lake water into the AFW system.

The ESW supply valves to the MDPs are normally closed 8-in. gate valves with

480-V ac motor operators (LIMITORQUE SMB-000). The permissives required for the

valves to open are (1) low suction pressure sensed by 2/3 pressure switches in the pump

suction header, and (2) the associated pump is running. The pump running permissive is

provided by pump breaker auxiliary contacts (52S/a).

The suction pressure switches for each of the MDPs are upstream of the manual

suction isolation valves (locked open valves) and the SCV. A main control board alarm

annunciates if any suction pressure switch is "made." No time delay is associated with the

alarm. The relays that energize on the 2/3 low suction pressure logic have a built-in 4-s

time delay before they provide their part of the permissive to open the valves.
24

The open coil for the valve motor is deenergized by limit switch (no torque switch in

the open coil circuit). The close coil circuit includes a torque switch that is bypassed by a

limit switch except for the final 2 to 3% of stroke. Thermal overload heaters for the valves

have been removed and replaced with jumpers.

Because there are few or no occasions when significant flow is delivered through the

piping sections between the upstream isolation valves and the ESW headers, the potential

exists for accumulation of Asiatic Clams in the stagnant piping. To combat this potential,

the plant provides for chlorination (0.2 to 2.0 ppm) of the piping sections whenever the

intake temperature exceeds 600F. Chlorination on a year-round basis is also required for

microbiologically induced corrosion control, if chlorine discharge limits are not exceeded.

3.1.2.2 Controls

1. Main control board (MCB) handswitches (HS-l/2A and HS-3/4A) with "OPEN,"

"CLOSE," and "AUTO" positions (the CLOSE and OPEN positions spring return to

AUTO). Note that MOV-1 and -2 are controlled from a single handswitch, as are

MOV-3 and -4.

2. Motor control center (MCC) handswitches (HS-1/2C and HS-3/4C) with "OPEN,"

"CLOSE," and "AUTO" positions (the CLOSE and OPEN positions spring return to

AUTO).

3. Transfer switches at the MCCs with "AUX" and "NOR" positions (XS-3/4 and XS1/2). The MCB controls are enabled in "NOR," and the MCC controls are enabled in

"AUX." The automatic transfer circuit is enabled with the transfer switches in either

position.

4. Local control panel with "OPEN," "CLOSE," and "STOP" pushbuttons. These controls

are not affected by the transfer switch position; however, the STOP pushbutton

provides contacts (which are "made" as long as the pushbutton is not depressed) that

enable the valve open and close coil seal-in circuits for MCB or MCC control.

3.1.2.3 Indication/Alarms

1. Valve position indicating lights at MCB, MCCs, and local control panel.

2. MCB annunciation of low suction pressure condition (1/3 logic). Note that the alarm

that is lit is labeled "PS-3A COND STG TANK HDR TO AUX FWPS PRESS LOW."

The alarm actually comes in if a low suction pressure condition is sensed by 2/3

instruments for any of the three pumps, including the PS-1, -2, or -3 set.

3. Input to the "TRANSFER SWITCH IN AUX MODE" common annunciator.

4. Status monitoring system (which provides to operators, via control room monitor,

indication of off-normal conditions for a large number of plant components) inputs:

Valve open; No power to valve operator.

3.1.3 Emergency Service Water to Turbine-Driven Pump Suction Isolation

Valves: MOV-5, -6, -7, and -8

3.1.3.1 Component Function and Design Feature

The ESW supply valves to the TDP are normally closed 10-in. gate valves with

480-V ac motor operators (LIMITORQUE SMB-00). The automatic open permissives are

(1) low suction pressure sensed by 2/3 pressure switches in the pump suction header, and

(2) TDP starting.

The pump starting portion of the permissive originates from a T&T valve stem limit

switch that closes when the T&T valve is half-open. If a low suction pressure condition
25

exists after the turbine trip and throttle valve has reached the midpoint of its open stroke, a

5.5-s time delay relay (AAA) energizes. Energization of the AAA relay, in turn, closes

contacts that cause two other relays (BBB and AAB) to energize. (Note that the AAB relay

has another 5.5-s time delay before energization.)

The BBB relay causes contacts in the MOV-7 and -8 open coils to close, resulting in

the valves starting to stroke open. If the low suction pressure condition clears in the 5.5 s

between energization of the BBB relay and the energization of the AAB relay, all the relays

will deenergize, MOV-7 and -8 will continue to open (because of a seal-in for the open

coil), and MOV-5 and -6 will not be affected.

If, however, the low suction pressure condition has not cleared within the 5.5 s, the

AAB relay will energize, resulting in contact closure that energizes relay CCC, which in

turn causes contacts in the MOV-5 and -6 open coils to close, and the valves will then

stroke open. In addition, the AAB relay closes a contact that energizes relay BBA, which

closes contacts in the MOV-7 and -8 close coil circuit. When the MOV-7 and -8 valves

have fully opened, their open coils deenergize, their close coils energize, and the valves

stroke back to the shut position. (A similar automatic closure circuit does not exist for

MOV-5 and -6.)

The intended result of the sequence is that if the low suction pressure condition does

not clear within the 5.5-s period following the start of the opening of MOV-7 and -8, the

MOV-5 and -6 valves will open and the MOV-7 and -8 valves will stroke back to the shut

position, thereby avoiding cross-train connection while providing the safety grade suction

source to the TDP.

The open coil for each valve motor is deenergized by a limit switch (no torque switch

in the open coil circuit). The close coil circuit includes a torque switch that is bypassed by

a limit switch except for the final 2 to 3% of stroke. Thermal overload heaters for the

valves have been removed and replaced with jumpers.

3.1.3.2 Controls

1. MCB handswitches (HS-7/8A and HS-5/6A) with "OPEN," "CLOSE," and "AUTO"

positions (the CLOSE and OPEN positions spring return to AUTO). Note that MOV-5

and -6 are controlled from a single handswitch, as are MOV-7 and -8.

2. MCC handswitches (HS-7/8C and HS-5/6C) with "OPEN," "CLOSE," and "AUTO"

positions (the CLOSE and OPEN positions spring return to AUTO).

3. Transfer switches at the MCCs with "AUX" and "NOR" positions (XS-7/8 and

XS-5/6). The MCB controls are enabled in "NOR," and the MCC controls are enabled

in "AUX." The automatic transfer circuit is enabled with the transfer switches in either

position.

4. Local control panel with "OPEN," "CLOSE," and "STOP" pushbuttons. These controls

are not affected by the transfer switch position; however, the STOP pushbutton

provides contacts (which are "made" as long as the pushbutton is not depressed) that

enable the valve open and close coil seal-in circuits for MCB or MCC control.

3.1.3.3 Indication/Alarms

1. Valve position indicating lights at MCB, MCCs, and local control panel.

2. MCB annunciation of low suction pressure condition (1/3 logic). Note that the alarm

that is lit is labeled "PS-3A COND STG TANK HDR TO AUX FWPS PRESS LOW."

The alarm actually comes in if a low suction pressure condition is sensed by 2/3

instruments for any of the three pumps, including the PS-1, -2, or -3 set.

3. Input to the "TRANSFER SWITCH IN AUX MODE" common annunciator.

4. Status monitoring system inputs: valve open; no power to valve operator.
26

3.1.4 Motor-Driven AFW Pumps

3.1.4.1 Component Function and Design Features

Each MDP must start in response to automatic or manual start signals and provide a

flow rate of >440 gal/min to two SGs with the SGs at 1085 psig (lowest safety valve

setpoint pressure plus 2% accumulation). The flow requirement is based upon accident

analysis assumptions.

The MDPs are Ingersoll-Rand nine-stage (3HMTA-9) pumps that are provided with

three-phase, 6600-V, 500-hp motors.

The motor breaker closes on the following signals:

1. SI,*

2. low-low level in one SG,*

3. trip of either main feed pump at >80% power,

4. trip of both main feed pumps (at any power),

5. SB,'

6. manual (from the MCB, the pump breaker cubicle, or a local panel), and

7. anticipated transient without scram mitigating system actuation circuit (AMSAC).

If proper supply bus voltage is available when an automatic start signal occurs, the

AFW pumps will be immediately started. A sequencing time delay is built into the SB start

signal, which is actually not initiated by an SB (total loss of on-site ac power), but rather

by a temporary emergency bus undervoltage condition (commonly referred to as loss of

offsite power). For the pumps to start, the undervoltage condition must first exist (for at

least 5 s), and then clear (when the diesel generator output breaker is closed). There is a

time delay of -30 s from undervoltage condition initiation until pump starting in the SB

portion of the AFW pump starting circuit. The 30 s consists of -10 s for the associated

emergency diesel-generator to achieve rated speed and reenergize the emergency bus plus a

20-s time delay in the AFW pump breaker closing circuit as a part of diesel load

sequencing. Should an SI signal occur during the 20 s associated with the AFW timers,

the timing sequence will be reinitiated (the other automatic start signals, such as low-low

SG level, do not affect load sequencing).

Note that either an SI or SB start signal blocks the signals related to low-low SG level

and main feed pump trip. If control has been switched from the MCB to auxiliary control

(6.9-kV switchgear), all automatic start signals, except for SB, are disabled.

If an AFW pump is running (because of either a manual or automatic start signal) at

the time that an undervoltage condition occurs, the pump is tripped, and then subsequently

automatically sequenced onto the emergency bus, as described previously. While an

undervoltage condition exists on the emergency bus, manual pump start is blocked;

however, once the bus is reenergized, manual start capability is restored.

The pump motors are provided with electrical fault protection by time and

instantaneous overcurrent relays, as well as neutral overcurrent relays.

Minimum flow protection is provided by a recirculation line with a flow-restricting

orifice. The design flow through the recirculation line is 25 gal/min (per pump). Reference

flows (for pump in-service testing) are 34.2 and 31.5 gal/min for the A and B pumps,

respectively.

*Safety-related start signal.
27

Design runout protection for each pump is provided by a cavitating venturi. The

venturi is sized to limit flow through it to 650 gal/min (limiting total pump flow to -675

gal/min, including recirculation flow).

Based on pump and system head curves (from design calculations), the MDPs are

capable of delivering 462 gal/min to the SGs with the SGs at 1085 psig (note that the 462

gal/min to the SGs includes an allowance for 25-gal/min recirculation flow). Thus, the

pumps have a 5% nominal design flow margin relative to safety analysis requirements.

Pump net positive suction head (NPSH) protection is offered by an automatic

switchover from the normal suction source, the CST, which is a nonsafety, nonseismic

source, to the safety-grade, seismically qualified ESW system. The automatic transfer

scheme requires that a low suction pressure condition (2 psig) be detected by 2/3 pressure

switches, and that the associated pump be running (as indicated by the closure of pump

breaker auxiliary contacts 52S/a). A 4-s time delay is built into the automatic transfer

circuit to avoid spurious transfer. The valves that are automatically opened for the suction

transfer are 480-V ac motor operated valves that are powered off of the same train as the

associated pump.

The pump motor includes auxiliary breaker contacts that provide inputs to various

indication and control functions:

1. Each of the associated MDP level control and bypass level control valve circuits have

two sets of contacts that are affected. One set opens on pump start (52S/b) to

deenergize the level control valve solenoid, thereby allowing the valve to modulate; the

other set closes on pump start (52S/a) to provide a portion of the logic necessary to

accomplish the automatic transfer from level control valve control to bypass level

control valve control (the other portion of the logic is made up by a pressure switch).

2. An auxiliary contact (52S/b) opens on pump start to provide a closure signal to the SG

BDIVs.

3. Each alternate suction supply isolation valve open circuit has a pump motor auxiliary

contact that closes on pump start (52S/a) to provide a portion of the logic necessary to

accomplish the automatic opening of the valve (the other portion of the logic is made up

by operation of 2/3 of the associated suction pressure switches).

4. An auxiliary contact opens on pump start (52S/b) to deenergize a relay (lX) that, in

turn, blocks a continuing closure signal to the breaker.

5. Pump status lights and monitoring system inputs receive inputs from other auxiliary

contacts.

3.1.4.2 Controls

The MCB control switches for the AFW MDPs have the following positions:

1. START (with spring return to AUTO),

2. STOP (with spring return to AUTO),

3. AUTO, and

4. PULL TO LOCK.

Pump start and stop controls are also provided at the pump motor switchgear cubicle

and at a local control panel. A transfer switch is provided at the switchgear cubicle to allow

transfer from MCB control to auxiliary control. With the transfer switch in the

"NORMAL" position, the pump control at the MCB is enabled; in the "AUXILIARY"

position, control at the pump switchgear cubicle is enabled. The local control panel

controls are always enabled, regardless of transfer switch position.
28

3.1.4.3 Indication/Alarms

1. Motor ammeters located at MCB and at motor switchgear cubicle

2. Overcurrent annunciator

3. Pump motor breaker indicating lights at MCB and motor switchgear cubicle: Green - open (pump off) and Red - breaker closed (pump running)

4. White light at MCB to indicate either an overcurrent condition or motor starting lockout

logic failure

5. Input to the "TRANSFER SWITCH IN AUX MODE" common annunciator

6. Pump discharge pressure

7. Individual SG header flow (note that the flow being monitored includes flow from the

TDP, but is labeled as "MOTOR AFWP FLOW")

8. Status monitoring system inputs: pump "RUNNING," pump handswitch in "PULL TO

LOCK," pump "PWR OFF" (indicates no control power to pump breaker or breaker in

racked out position)

3.1.5 Turbine-Driven AFW Pump

3.1.5.1 Component Function and Design Features

The TDP provides a diverse means of delivering AFW to the SGs with no reliance on

ac power (with the exception of 120-V ac instrument busses that are energized by dc busses

through an inverter). The turbine is started by opening of the T&T valve, which occurs in

response to several automatic signals:

1. SI,*

2. SB signal (from two relays on either Train A or Train B),*

3. low-low SG level in 2/4 SGs,*

4. trip of both main feed pumps at any power level,

5. trip of either main feed pump at >80% power, and

6. AMSAC.

The TDP is an Ingersoll-Rand five-stage (3HMTA-5) pump that is driven by a

noncondensing turbine (Terry Turbine, type GS-2) at a nominal operating speed of 3970

rpm. Included as an integral part of the turbine drive are the dc motor-operated T&T valve,

a hydraulic governor valve (GV), and associated governor control circuitry.

The T&T valve can be used, as its name implies, for both throttling and overspeed

protection purposes. However, it is not normally used for throttling.

The T&T valve automatically closes for the following conditions:

1. electronic overspeed trip (4300 rpm),

2. mechanical overspeed trip (4900 rpm), and

3. failure of the TDP to develop 100 psig discharge pressure within 60 s after the T&T

valve opens. This closure is provided to allow automatic transfer of the steam supply

source from SG A (normal source) to SG D (alternate source).

The overspeed tripping not only protects the turbine itself, but provides inherent

pump runout and discharge piping overpressurization protection as well. Both the

electronic and mechanical overspeed trips are accomplished by unlatching the T&T valve

*Safety-related start signal.
29

from its operator. In the case of the electronic overspeed trip, the motor operator

automatically drives to the closed position following the trip and relatches the valve. If the

open signal is still present, the valve will automatically reopen. For the mechanical

overspeed trip, the valve motor will also automatically drive shut following the trip, but

local manual reset of the mechanical trip lever is required before the valve can be reopened.

Both the electronic and the mechanical overspeed trips are annunciated in the main control

room.

If the TDP fails to develop 100 psig discharge pressure within 60 s after the T&T

valve begins to open, an automatic transfer of steam supply source occurs. The sequence

involves driving the T&T valve shut, closing the normal steam supply valve (MOV-1 1),

opening the alternate steam supply valve (MOV-12), and then reopening the T&T valve.

This entire sequence is accomplished automatically. See the discussion for MOV-l1 and

-12 for further details of the automatic steam supply transfer.

The thermal overload switches for the T&T valve motor operator are bypassed if any

automatic open signal is present (note that the switches are bypassed in both the open and

close direction, as long as one of the automatic open signals is present).

The torque switch in the open direction is bypassed for the full stroke for all

automatic and manual open strokes. The torque switch in the closed direction is bypassed

except for the final 2 to 3% of stroke.

T&T valve stem limit switches provide control and indication inputs to several

support functions associated with the AFW system:

1. enable the ramping function of the GV control circuit,

2. provide a start signal to the TDP room ventilation fan,

3. start the 60-s timer for the automatic steam supply transfer circuit,

4. enable the automatic closure feature for the valve's motor operator in the event of an

overspeed trip,

5. provide close signal to the SG BDIVs,

6. provide a permissive signal to allow opening of the ESW isolation valves in the event of

low suction pressure, and

7. provide local and MCB indication of valve position.

Turbine speed is normally controlled by the turbine GV, which is a 3-in.

hydraulically operated plug valve with a Woodward EG governor (Fig. 3.3 provides a

simplified schematic of the GV control configuration). Varying hydraulic pressure is

exerted on the GV remote servo piston by the governor's hydraulic actuator. Oil pressure

for the actuator is developed by an internal gear-driven pump, which is driven off of the

turbine shaft (the turbine lube oil pump, which is also shaft driven, supplies oil to the

governor actuator). The oil pressure delivered by the actuator to the remote servo is

controlled by an electrical input signal to the actuator that comes from the governor's

electric control box.

During steady state operation of the turbine, three summed signals make up the net

signal delivered to the actuator: (1) a motor-operated potentiometer provides a minimum

control setpoint (positive input), (2) a ramp generator/signal converter (RGSC) provides a

positive input signal that is based upon pump discharge flow, and (3) a negative feedback

signal from a turbine speed sensor. The RGSC also provides a mechanism for controlled

ascension from idle to normal operating speed by varying its portion of the input. The

initial signal output is an idle speed signal. As the T&T valve opens, a limit switch initiates

a ramp signal that gradually increases the RGSC output over roughly a 15-s period,

allowing the turbine speed to increase accordingly until it can be controlled by the steady

state signals (see Fig. 3.4).
ORNL-DWG 90-3310 ETD

T&T MAIN

VALVE - STEAM

SUPPLY

ELECTRICAL CONTROL

-~ HYDRAULIC CONTROL

STEAM

WATER

,,,,,,,,,,,,,,,MECHANICAL OVERSPEED TRIP

Fig. 3.3. AFW turbine speed control circuit.
31

ORNL-DWG 90-3311 ETD

E

B TURBINE

SPEED C

A

TIME AFTER T&T VALVE BEGINS TO OPEN

A. Initial acceleration as T&T valve admits steam

B. Turbine governor oil pressure builds up and is able to

drive governor valve in closed direction

C. Turbine at "idle' speed

D. Turbine speed accelerating in conjunction with ramp signal

E. Turbine achieves normal operating speed

Fig. 3.4. Turbine speed during startup.

The RGSC has an internal low signal selector that results in its output being based

upon the lesser of the ramp signal or the flow signal, which is an input to the RGSC.

Thus, during startup, the ramp signal increases to the point where it exceeds the'flow-based

signal, and from that point on, the three steady state signals noted above are controlling.

The general process associated with turbine startup from standby to normal operating speed

is explained below.

In standby conditions, the GV is normally held in the full-open position by springs in

the servopiston/GV linkage. There is no hydraulic pressure, since the source of hydraulic

pressure originates from the oil pump, which is driven off of the turbine shaft. When the

trip and throttle (T&T) valve begins opening, the turbine begins to roll, and the shaft driven

oil pump is able to develop discharge pressure. Because the GV repositioning from fullopen to the control position depends upon the development of the discharge pressure, there

is an associated initial lag in speed control development. This lag can be seen in Fig. 3.4.

Initially turbine speed increases rapidly until the GV actuator develops pressure and starts

to close the valve in response to the low positive demand signal associated with the idle
32

speed signal in conjunction with the rapidly increasing negative feedback from turbine

speed (Section A of Fig. 3.4). As the GV closes, the speed increase is halted, and speed is

reduced to the idle speed (Section C). As the T&T valve continues to open, the ramp is

initiated by a stem-actuated limit switch, and the RGSC output signal gradually increases

(Section D) to the point where the steady state speed associated with balanced flow and

speed signals is reached (Section E).

Normally, turbine speed will be controlled automatically, as described above,

following an automatic turbine start. However, turbine speed, and hence total pump flow

can be manually controlled by use of a controller at the MCB. For the controller to be used

in manual following an automatic start, the MCB control switch must initially be transferred

to an "Accident Reset" position and then pulled to its manual position. It can then be turned

to either increase or decrease the signal being sent from the flow controller to the turbine

speed control circuit.

An exception to the switch to manual control occurs in the case of automatic pump

start upon the loss of either main feed pump with the plant at >80% power. In this case,

the TDP flow control cannot be put in manual (the "Accident Reset" relay is nulled by an

open contact in the controller input). However, the open contacts reclose once plant power

has decreased to <75%, restoring the "Accident Reset" capability. Note that the 80% and

75% power-related actions depend upon nonsafety-related equipment (such as nonsafety

pressure sensors, electrical contacts, and power supply). The pump design nominal capacity is 920 gal/min (including 40 gal/min recirc),

2600-ft total developed head with the turbine operating at 3970 rpm and the SGs at 1085

psig. As pressure in the SGs is reduced, the TDP capability decreases until the nominal

design capacity is 525 gal/min, 325-ft total developed head with the steam supply source at

125 psig, and turbine speed at 2200 rpm. The flows cited do not include minimum

recirculation line flow, which is nominally 40 gal/min. Note that manual speed control is

required as steam supply pressure is reduced.

Pump NPSH protection is offered by an automatic switchover from the normal

suction source, the CST, which is a nonsafety, nonseismic source, to the safety-grade, seismically qualified ESW system. The automatic transfer scheme requires that a low

suction pressure condition exist (13.9 psig on 2/3 pressure switches), and that the T&T

valve has reached at least the half-open point of its stroke. A 5.5-s time delay is built into

the automatic transfer circuit to avoid spurious transfer. See the discussion for MOV-5, -6,

-7, and -8 for further details of the automatic suction source transfer.

3.1.5.2 Controls

1. MCB valve control handswitch with "CLOSE," "OPEN," and "NOR" (Normal), with

a spring return to "NOR." With the switch in "NOR," this switch has no impact on the

valve automatic function.

2. MCB valve trip pushbutton with "TRIP" and "NOR" (Normal) positions, with spring

return to "NOR." Depressing the pushbutton has the same effect as an electronic

overspeed trip.

3. MCB Controller for TDP speed/flow control with both Manual and Auto positions (i.e.,

in for Manual, out for Auto). In Manual, turbine speed (and hence pump flow) can be

raised or lowered. Accident Reset positions are provided to allow resumption of

manual control following an automatic start of the turbine.

4. Transfer switch located at a local control panel with "AUX" and "NOR" positions,

which allows transfer of T&T valve control to local. Note that with the control

transferred to local, all of the valve automatic open functions as well as the electronic

overspeed trip are blocked.
33

5. Pushbuttons at local control panel to "OPEN," "CLOSE," and "TRIP" the T&T valve

(these pushbuttons are only enabled if the transfer switch is in the "AUX" position).

6. Another local control pushbutton, labeled "STOP," to interrupt T&T valve stroking at

any point in the open or close stroke. When this pushbutton is in the normal, released

position, it provides contacts that must be "made" for any open or close strokes to

occur.

7. Motor-operated potentiometer located near the TDP that allows some control over

turbine speed. This control would normally only be used in setting the governor

minimum control setpoint.

3.1.5.3 Indication/Alarms

1. T&T valve position indicating lights at MCB and local controls

2. Annunciator for electronic overspeed trip

3. Annunciator for mechanical overspeed trip

4. Status Monitoring System signal for T&T Valve open; no power to T&T Valve; no

power to speed control (this would also indicate no power to automatic suction source

transfer relays)

5. TDP flow controller MANUAL/AUTO indicating lights at MCB

6. TDP flow indication at MCB and at local controls

7. Reference minimum control speed (from motor operated potentiometer input to turbine

speed control circuit) at MCB and at local controls

8. Turbine speed indication at MCB and at local controls

9. Indicating light at Auxiliary Control Room panel for the AMSAC test circuit

3.1.6 Pump Miniflow Check Valves: C-6, -8, and -10

3.1.6.1 Component Function and Design Features

The miniflow check valves (MCVs) are 1-1/2-in. swing check valves that open on

pump start to allow a portion of the pump discharge flow to be recirculated to the CST.

The check valves provide train separation for the three pump recirculation lines, which join

to form a common recirculation header.

Nominal flow rates for the MDPs and TDPs are 25 and 40 gal/min, respectively, with

flow being primarily limited by breakdown orifices in each recirculation line. At these flow

rates, the average flow velocities are about 6 ft/s for C-6 and -8 and 9 ft/s for C-10.

Note that the flow rates provided by the minimum flow lines are substantially less

than the continuous flow currently specified by the pump vendor for the pumps (e.g., the

current specified continuous minimum flow rate for the MDPs is 170 gal/min). As is the

case for AFW systems at most operating plants, the minimum flow rates allowed by the

recirculation orifices are sufficient to prevent overheating, but not sufficient to provide

protection against pump degradation from low-flow operation.

3.1.7 Common Mininlow Check Valves: C-1 and -2

3.1.7.1 Component Function and Design Features

The common miniflow check valves (CMCVs) are 3-in. swing check valves that must

open on pump start to allow a portion of the pump discharge flow to be recirculated to the

CST.
34

Under most AFW test or operating conditions, the CMCVs see extremely low flow

rates, with average flow velocities of about 0.6 ft/s. Even under the maximum test

conditions (associated with "full" stroking of the CMCVs), the flow velocities would be <5

ft/s.

3.1.8 Pump Discharge Check Valves: C-7, -9, and -11

3.1.8.1 Component Function and Design Features

The DCVs are 6-in. swing check valves that are normally closed in standby

condition. The DCV opens on associated pump start to allow pump discharge flow to

proceed through the flowpaths to the SGs. The DCV for a particular pump, along with an

additional check valve in the pump discharge flowpath (level control valve check valve),

prevents flow reversal from another pump in the event a pump fails to start. The DCVs

also prevent, along with other check valves and the normally closed level control valves

(LCVs), backleakage from main feedwater during normal operation.

The layout of the discharge check valves is shown in Fig. 3.5. At design flow rates

(440 gal/min for the MDPs and 880 gal/min for the TDP), the average velocities at the

check valves are -5 ft/s for C-7 and -9 and 11 ft/s for C-i1.

ORNL-DWG 90-3312 ETD

Miniflow Check Valves

/21 I ffI

Discharge Check Valves

MOTOR-DRIVEN PUMPS TURBINE-DRIVEN PUMP

Fig. 3.5. Pump miniflow and discharge check valves configuration.

3.1.9 Motor-Driven AFW Pump Level Control Valves: LCV-1/1A,* -3/3A,

-5/5A, and -7/7A

3.1.9.1 Component Function and Design Features

The motor-driven pump level control valves (MDLCVs) and the BMDLCVs are

normally closed, with controls in "AUTO" in standby condition, and open/modulate

following associated pump start. SG level of 33% is automatically maintained by the airoperated valves.

*Note: Valves with the "A" suffix to the number will be referred to as BMDLCV

(bypass MDLCV).
35

If a pressure of <400 psia downstream of the valves is sensed with the associated

pump running, an automatic transfer from the MDLCVs to the BMDLCVs is initiated. The

purpose of the transfer from the 4-in. MDLCVs to the 2-in. BMDLCVs is to prevent excessive pressure drop across the 4-in. valves. In addition to responding automatically to allow flow to intact SGs following an AFW actuation signal, the operator must be able to regain manual control of the MDLCVs and BMDLCVs following certain design basis accidents (e.g., feedline or steamline breaks). This is necessary to ensure that intact SGs can be fed as well as limiting the extent

of containment pressurization and RCS cooldown. The normally closed MDLCVs fail open on loss of air or control signal power. On loss of solenoid power, the valves modulate based on control signal input. Associated

pump breaker auxiliary contacts (52S/b) open when the pump starts and deenergize the

MDLCV solenoids, allowing the valves to modulate. The normally closed BMDLCVs fail closed on loss of air or solenoid power. If control signal is lost, the BMDLCVs will go full open (if solenoid energized) or full closed (if solenoid deenergized). The automatic transfer from the MDLCVs to the BMDLCVs

occurs if a pressure of <400 psia downstream of the valves exists (low pressure condition

must exist for 15 s to enable the automatic transfer). SG level can be manually controlled after any accident signal by taking the valve's handswitch first to "Accident Reset," and then to "Manual" or "Manual Bypass." In "Manual," the MDLCV position can be manually controlled from the control room. In "Manual Bypass," the MDLCVs will be closed, but the BMDLCVs will modulate in

response to manual adjustment from the control room. An exception to the switch to manual control occurs in the case of automatic pump start on the loss of either main feed pump with the plant at >80% power. In this case, the MDLCVs cannot be put in manual (the "Accident Reset" relay is nulled by open contacts in the controller input); however, the switch to "Manual Bypass" can be made with the result of the MDLCV going closed and the BMDLCV responding to manual adjustment from the control room. In addition, the open contacts reclose once plant power has decreased to <75%, restoring the "Accident Reset" capability. Note that the 80% and 75% power- related actions depend upon nonsafety-related equipment (such as nonsafety pressure

sensors, electrical contacts, and power supply).

3.1.9.2 Controls

1. MCB switches for the MDLCVs and BMDLCVs (HS-lA, -3A, -5A, and -7A) are dualswitch sets. The upper switch has the following positions: "MANUAL," "MANUAL

BYPASS," and "AUTO (DEPRESS FOR ACC RESET)." The switch depression for

accident reset has a spring return to "AUTO."

2. The lower switch, which is enabled when the upper switch is in "MANUAL" or "MANUAL BYPASS" only, has "RAMP OPEN" and "RAMP CLOSE" positions,

with spring return to center. 3. Transfer switches for each valve set are located at the Auxiliary Control Panel (ACP). Transferring to the ACP has the same effect on the controller as an accident signal, because the controller will switch from manual to automatic level control.

4. A level-indicating controller (LIC-1, -3, -5, -7) is provided for each valve set at the ACP. It is via these controllers that the automatic level control setpoint is established.

3.1.9.3 Indication/Alarms

1. Valve position indicating lights (for both MDLCVs and BMDLCVs) at MCB

2. Valve controller MANUAL or AUTO indicating lights at MCB
36

3. Loop level indication at MCB

4. High and low SG level alarms at MCB

5. Input to the "TRANSFER SWITCH IN AUX MODE" common annunciator

6. Status monitoring system input to indicate that solenoids are deenergized, allowing

MDLCVs to modulate

3.1.10 Turbine-Driven Pump Level Control Valves: LCV-2, -4, -6, and -8

3.1.10.1 Component Function and Design Features

The TDLCVs, which are normally closed 3-in. globe valves with controls in

"AUTO," open/modulate following pump start. An SG level of 33% is automatically

maintained by the air-operated valves. Individual TDLCVs automatically close if a pipe

break downstream of the pertinent valve is sensed. During normal operation, the TDLCVs,

along with in-series check valves, prevent backleakage of main feedwater into the AFW.

The normally closed TDLCVs fail closed on loss of air or control signal power. An

accumulator is provided to allow valve modulation in the event of loss of control air. On

loss of solenoid power, the valves modulate based on control signal input. The TDLCV

solenoids are deenergized when TDP discharge pressure, as sensed by pressure switches

PS-10 (for LCV-6 and -8) and PS-11 (for LCV-2 and -4), reaches 100 psig.

To provide pipe break protection, two pressure switches are located downstream of

each TDLCV (e.g., PS-18 and -19 for LCV-2). If either of the two pressure switches

closes (setpoint = 100 psia), the associated TDLCVs solenoid will be energized, resulting

in valve closure. Note that a 30-s time delay, beginning with initial solenoid

deenergization, is built into the auto-closure circuit. If the TDLCV handswitches are in

manual before an automatic pump start, the controllers will automatically transfer from

manual to automatic. SG level can be manually controlled after any accident signal by

taking the valve's handswitch first to "Accident Reset," and then to "Manual."

An exception to the switch to manual control occurs in the case of automatic pump

start upon loss of either main feed pump with the plant at >80% power. In this case, the

TDLCVs cannot be put in manual (the "Accident Reset" relay is nulled by open contacts in

the controller input). However, once plant power has decreased to <75%, the open

contacts reclose, allowing restoration of the "Accident Reset" function and the subsequent

transfer to manual. Note that the 80% and 75% power-related actions depend on

nonsafety-related equipment (such as nonsafety pressure sensors, electrical contacts, and

power supply).

3.1.10.2 Controls

1. MCB switches for the TDLCVs (HS-2A, -4A, -6A, and -8A) are dual-switch sets. The

upper switch has the following positions: "MANUAL" and "AUTO (DEPRESS FOR

ACC RESET)." The switch depression for accident reset has a spring return to

"AUTO."

2. The lower switch, which is enabled when the upper switch is in "MANUAL" only, has

"RAMP OPEN" and "RAMP CLOSE" positions, with spring return to center.

3. Transfer switches for each valve are located at the Auxiliary Control Panel (ACP).

Transferring to the ACP has the same effect on the controller as an accident signal,

because the controller will switch from manual to automatic level control.

4. Level indicating controllers (LIC-2, -4, -6, and -8) are provided for each valve set at a

local control panel, located just outside the TDP room. It is by means of these

controllers that the automatic level control setpoint is established.
37

3.1.10.3 Indication/Alarms

1. Valve position indicating lights at MCB

2. Valve controller MANUAL or AUTO indicating lights at MCB

3. Pipe break detection indication at MCB

4. Loop level indication at MCB

5. High and low SG level alarms at MCB

6. Input to the "TRANSFER SWITCH IN AUX MODE" common annunciator

7. Input to Status Monitoring System to indicate that solenoids are deenergized, allowing

valves to modulate

3.1.11 Level Control Valve Check Valves: C-12, -13, -14, -15, -16, -17,

-18, and -19

3.1.11.1 Component Function and Design Features

The level control valve check valves (LCVCVs) are 4-in. swing check valves that

open to allow pump discharge flow to reach the SGs. The LCVCVs , along with pump

DCVs, prevent flow reversal from another pump if a pump fails to start. The LCVCVs

also prevent, along with the level control valves and the pump DCVs, backleakage from

hot, pressurized main feedwater during normal operation. The LCVCVs form a pipe class

boundary consistent with the latter function; piping downstream of the LCVCVs has

design pressure and temperature ratings of 1085 psig and 6000F, whereas piping upstream

of the LCVCVs is rated at 1650 psig and 1200F.

Under design basis flow (220 gal/min) conditions, the average velocity in the 4-in.

piping at the LCVCV is -6 ft/s. At the "batching" flow rate used in support of

shutdown/startup evolutions of 75 gal/min, the velocity is -2 ft/s.

The TDP LCVCVs are located in a run of piping and valves that would greatly

contribute to flow turbulence in the vicinity. A simplified schematic of the layout (not to

scale) is shown in Fig. 3.6. As shown, the LCVCV is located immediately downstream of

the LCV, and 900 elbows are in close proximity to isolation valves located just upstream

and downstream.

The MDP LCVCVs are not symmetric in arrangement. The "A" and "B" MDP

LCVCVs are arranged as indicated in Fig. 3.7. As shown in the figure, the "A" pump

LCVCVs would be subject to more turbulence because of the elbow located just upstream

(-ift).

ORNL-DWG 90-3313 ETD

Control valve immediately upstream of check valve

Fig. 3.6. Turbine-driven pump level control valve check valve

configuration.
38

ORNL-DWG 90-3314 ETD

~1 ft from elbow to valve Considerable length of straight pipe

upstream of check valve

"A" Motor-Driven Pump "B" Motor-Driven Pump

Fig. 3.7. Motor-driven pump level control valve check valve

configurations.

3.1.12 SG B and C AFW to Main Feed Check Valves: C-21, -22, -24, and

-25

3.1.12.1 Component Function and Design Features

The main feed check valves (MFCVs) open to allow pump discharge flow to reach

the SGs. The MFCVs (along with the level control valves, level control valve check

valves, and the pump discharge check valves) prevent backleakage from hot, pressurized main feedwater during normal operation. The MFCVs are located inside containment. No

comparable valves are in the AFW to SG A and D main feed lines (the AFW to main feed

connection for these SGs is outside of containment).

The MFCVs are 4-in. swing check valves. Under design basis flow (220 gal/min)

conditions, the average velocity in the 4-in. piping at the MFCVs is -6 ft/s. At the

"batching" flow rate used in support of shutdown/startup evolutions of 75 gal/min per SG,

the velocity is -2 ft/s. The piping arrangement for the MFCVs is depicted in Fig. 3.8. The

upstream MFCV is located immediately downstream of an elbow, and the second MFCV is

located -4 in. downstream.

ORNL-DWG 90-3315 ETD

-4 in. between valves

To SG 2/3

Fig. 3.8. AFW to main feedwater check valve configuration.

3.1.13. Main Feedwater Check Valves: C-20, -23, -26, and -27

3.1.13.1. Component Function and Design Features

The main feedwater check valves (FWCVs) must close in the event of loss of main

feedwater flow to ensure that adequate AEW flow is delivered to the SGs.

The FWCVs are 16-in. swing check valves. The normal, full-power flow condition

for each FWCV is -9000 gal/min, with an average velocity of -18 ft/s. This velocity

should be sufficient to both maintain the FWCVs in the fully open position and avoid

fluttering, as long as the plant is operated at full-power conditions.
39

3.1.14 Feedwater Isolation Valves: FWIV-1, -2, -3, and -4

3.1.14.1. Component Function and Design Features

The FWIVs, which are normally open to allow passage of feedwater to the SGs,

close automatically in response to the following signals:

1. any SI signal,

2. hi-hi level (on 2/3 channels) in the serviced SG, and

3. reactor trip and low Tavg (2/4 channels).

From the standpoint of the AFW system, the principal purpose of the FWIVs is,

along with check valves located downstream of the FWIVs, to provide an isolation between

the AFW connections to the main feed lines and the nonsafety portion of the main

feedwater system, thereby assuring that auxiliary feedwater is delivered to the SGs.

The FWIVs are 16-in. gate valves with 480-V ac motor operators (LIMITORQUE

SB-4). The thermal overload heaters for the FWIVs have been replaced with jumpers.

Motor deenergization during a close stroke, whether initiated manually or automatically,

occurs when the "ac" limit switch opens. Motor deenergization during the open stroke

(note that all open strokes are manually initiated) occurs when the "bo" limit switch opens.

No torque switches are incorporated into the FWIV control circuits. Also, no thermal

overload protection is provided for the FWIVs, because the thermal overload heaters have

been removed and replaced with jumpers.

Note that the FWIVs do not close automatically for all AFW automatic start signals

(e.g., low-low SG level or blackout). In fact, the automatic closure signals are oriented

toward avoiding excessive cooldown rates or overfilling of the SGs rather than to support

the AFW system functions.

3.1.14.2 Controls

1. The MCB switches for the FWIVs have "OPEN," "CLOSE," and "AUTO" positions.

Both the "OPEN" and "CLOSE" positions are spring return to "AUTO."

2. Transfer and OPEN/CLOSE control switches are also provided at the MCCs.

3.1.14.3 Indication/Alarms

1. Valve position indicating lights at MCB and MCCs

2. Input to the "TRANSFER SWiTCH IN AUX MODE" common annunciator

3. Status monitoring system inputs: valve closed; no power to valve operator

3.1.15 SG Blowdown Isolation Valves (BDIVs): BDV-1, -2, -3, and -4

3.1.15.1 Component Function and Design Features

One BDIV is located in each SG blowdown line, outside of containment. The BDIVs

must close in response to start of any AFW pump to ensure that the AFW flow delivered to

the SGs can be converted to steam and released through the main steam safeties or PORVs

(instead of being drained off as liquid through the blowdown lines), thereby accomplishing

the intended heat-removal function.

The BDIVs are 2-in. air-operated angle valves that fail closed on loss of air or

solenoid power and close automatically in response to the start of AFW pumps. The

BDIVs are train oriented. The BDIVs from SGs A and C close on the start of the B MDP

or the TDP, and the BDIVs from SGs B and D close on the start of an MDP or the TDP.
40

The pump-start indications used by the control circuitry for the BDIVs are

1. MDPs: 52S/b pump breaker auxiliary contacts, and

2. TDP: T&T valve stem actuated limit switch (bc position).

The BDIVs also receive a close signal on a Containment Phase A Isolation (the only

automatic Phase A Isolation comes from an SI signal). Note that each BDIV is in series

with another (e.g., BDV-1A is in series with BDV-1, with BDV-lA located inside of

containment and BDV-1 outside). The inside containment blowdown isolation valves

receive an automatic closure signal on Phase A Isolation, but not on AFW pump start. To

provide for a single-failure proof design, from the containment isolation standpoint, the

inside and outside valves receive their closure signals and solenoid power from different

trains; for example, BDV-1 receives its Phase A Isolation signal from the B train of the

Solid State Protection System, whereas BDV-lA receives its signal from train A.

A couple of noteworthy design features are associated with the BDIVs. As noted

previously, the BDIVs from SGs A and C close on the start of the B MDP (or the TDP).

However, the B MDP feeds SGs C and D. Similarly, the BDIVs from SGs B and D close

on start of the MDP that feeds SGs A and B. A second notable feature is that although

from a containment Phase A Isolation standpoint valve redundancy is provided in the SG

blowdown isolation system, there is no valve redundancy from the standpoint of closure on

AFW starting. There is redundancy, from a closure signal standpoint because each BDIV

receives a closure signal from both the start of an MDP as well as the TDP (which, in turn,

receives start signals from both trains).

3.1.15.2 Controls

The control switches for the BDIVs are ganged switches, with a single handswitch

controlling both BDV-1 and -IA. Individual transfer switches are provided for each valve

(including separate switches for the inside containment valves) in the auxiliary control

room. Repositioning the transfer switches from "NOR" (MCB Control) to "AUX" results

in deenergization of the valve solenoid, thereby closing the valve. The BDIVs have no

other control switch.

The BDIVs can be reopened from the MCB by the operator following closure in

response to an AFW pump start (even if the AFW pump is still running) by taking the

handswitch to the open position (and holding it in the open position until fully open).

3.1.15.3 Indication/Alarms

1. Valve position indicating lights at MCB

2. Input to the "TRANSFER SWITCH IN AUX MODE" common annunciator

3.1.16 AFW Turbine Steam Supply Valves: MOV-11 and -12

3.1.16.1 Component Function and Design Features

The AFW turbine is supplied with a normal steam supply source, SG A, via normally

open MOV-1 1. If SG A is unavailable to supply steam to the turbine (e.g., in the event of

a feedline break to SG A), an alternate steam supply is automatically provided from SG D

via normally closed MOV-12.

The steam supply valves (SSVs) are 4-in. gate valves. They are equipped with 480-

V ac motor operators (LIMITORQUE SMB-00) that are powered by two separate safetyrelated busses.
41

If the TDP discharge pressure has not reached 100 psia within 60 s after the T&T

valve has begun to open, the control circuit for the SSVs is designed to transfer steam

supply sources for the turbine automatically (See Fig. 3.9). Three permissives are

necessary for the transfer to initiate:

1. the T&T valve has started to open (note that a seal-in of this portion of the permissive

exists until either the required pump discharge pressure is reached or until MOV-12 is

fully open),

2. MOV-12 is not fully open ("bo" contacts are closed), and

3. the TDP discharge pressure, as sensed by PS-10, has not reached 100 psia.

If these permissives are met for 60 s, a relay energizes that causes the T&T valve to

reclose and MOV-lI to close. Once MOV-I1 is closed, MOV-12 will start to open. The

T&T valve will start to reopen as soon as it has closed. If MOV-12 reaches full open

before the T&T valve, both valves will stay open. However, if the T&T valve reaches full

open before MOV-12, it will cycle closed and open again (and will continue to cycle

closed/open until MOV-12 is fully open).

ORNL-DWG 90-3316 ETD

Fig. 3.9. Turbine steam supply transfer sequence.
42

MOV-1 1 motor operator rotor-actuated limit switches are used for the following

purposes in MOV- 12:

1. "bc" contacts provide the permissive to allow the MOV-12 open coil to energize in

conjunction with the automatic steam supply transfer, and

2. "ac" contacts cause MOV-12 to close if it is opened with MOV-1 1 not closed.

Both valves have seal-in circuits for their open and close coils.

The SSVs include thermal overload contacts, which are not bypassed, in both the

open- and close-coil circuits. The open coil for each valve motor is deenergized by a limit

switch (no torque switches are provided in the open-coil circuits). The close-coil circuit

includes a torque switch that is bypassed by a limit switch, except for the final 2 to 3% of

stroke.

3.1.16.2 Controls

1. MCB valve handswitches (HS-1lA and HS-12A) with "CLOSE," "OPEN," and

"AUTO." Both "CLOSE" and "OPEN" are spring return to "AUTO."

2. MCC open/close switches (HS-1 IC and HS-12C).

3. Transfer switches located at the MCCs, with "NOR" and "AUX" positions (XS-l1 and

XS-12). In "NOR," the MCB controls are enabled, and in "AUX," the MCC switches

are enabled. The automatic functions of the valves are enabled with the transfer

switches in either position.

3.1.16.3 Indication/Alarms

1. Valve position indicating lights at MCB and MCC provide input to the "TRANSFER

SWITCH IN AUX MODE" common annunciator

2. Status monitoring system inputs: valve closed; no power to valve operator

3.1.17 AFW Turbine Steam Supply Isolation Valves: MOV-9 and -10

3.1.17.1 Component Function and Design Features

The steam supply isolation valves (SSIVs) provide automatic isolation of the common

steam supply header from the AFW turbine if a high-temperature condition (1480F) is

detected in the TDP room.

The SSIVs are 4-in. gate valves. They are equipped with 480-V ac motor operators

(LIMITORQUE SMB-00) that are powered by two separate safety-related busses.

When a high-temperature condition is sensed , the close coil is energized to drive the

valve shut. Two temperature switches that are wired in series must sense a hightemperature condition for a valve to close (two temperature switches are dedicated to each

valve).

The SSIVs include thermal overload contacts, which are not bypassed, in both the

open- and close-coil circuits. The open coil for each valve motor is deenergized by a limit

switch (no torque switches are provided in the open coil circuits). The close-coil circuit

includes a torque switch that is bypassed by a limit switch, except for the final 2 to 3% of

stroke.

3.1.17.2 Controls

1. MCB and MCC valve handswitches (HS-9 and -10), with "PULL AUTO," "INMAN," "CLOSE," and "OPEN" positions (the CLOSE and OPEN positions are used
43

with the handswitch pushed in for manual valve operation). The handswitches are

spring return to Auto.

2. Transfer switches located at the MCCs, with "NOR" and "AUX" positions (XS-9 and

-10). In "NOR," the MCB controls are enabled, and in "AUX," the MCC switches are

enabled. The automatic functions of the valves are enabled with the transfer switches in

either position.

3.1.17.3 Indication/Alarms

1. Valve position indicating lights at MCB and MCC

2. Input to the "TRANSFER SWITCH IN AUX MODE" common annunciator

3. Status monitoring system inputs: valve closed; no power to valve operator, MCB valve

handswitch not in auto

3.2 REVIEW OF PROCEDURES RELATING TO AFW COMPONENTS

When plants are originally designed, analyses are performed to verify that safety- related systems, such as the AFW system, will be able to function to mitigate effectively the

consequences of design basis accidents and transients. These analyses are documented in

the FSAR (typically Chap. 15). Inherent in these safety analyses are assumptions relative

to normal alignments, equipment availability and capability, automatic actions, and other

characteristics. Although changes to the plant design and procedures that control plant and

system operation may be made (as long as the constraints dictated in 10 CFR 50.59 are

satisfied), it is critical that the plant be maintained within the envelope of assumptions made

in the safety analyses.

As a part of the plant operating license, plants are issued a set of Technical

Specifications that must be met. Tech Specs specify minimum operating condition

requirements for systems and components, referred to as Limiting Conditions for Operation (LCO). The Tech Specs also specify surveillance requirements that designate, in general

terms, the scope and frequency of, as well as acceptance criteria for, testing that must be

performed to verify satisfaction of the LCO. The primary intent of the Tech Specs is to

ensure regularly the continuing validity of assumptions made in conjunction with safety

analyses. Whereas Tech Specs provide the general skeleton or framework for this continuing

validation of safety analysis assumptions, the individual plant surveillance procedures, developed specifically to meet the Tech Spec requirements, are actually used to perform the

validation.

Several Tech Specs for the Plant A address aspects of the AFW system. The Tech

Specs that are listed in Appendix A, while plant-specific, are fairly representative of those

for most operating plants.

A review of procedures related to the monitoring and operation of the AFW system at

Plant A was conducted to

1. determine the extent to which the various types of failures could be detected by programmatic monitoring or routine operating practices, and

2. estimate the amount of service associated with testing of the components.

Although relevant operating and maintenance procedures were also reviewed, the

principal focus of this review was the set of procedures that are used to satisfy AFWrelated surveillance requirements.

Monitoring practices and operating guidelines relative to each of the component types

discussed in Sect. 3.1 follow. The general purpose of each procedure as it relates to the

subject component, estimates of the service associated with testing, and pertinent comments
44

are provided. Note that the frequency of testing-related operation tables that are provided

for each component may include procedures not discussed for that component because the

component may be actuated by a test that is not used to demonstrate operability of the

component but that does cause its operation. An example of this would be where an SI

signal is simulated to verify that an MDP starts in response to the SI signal. The TDP

would also start (or at least the T&T valve would open) in response to this signal, but the

test may not be used to demonstrate operability of the TDP.

Based on the review of the surveillance, operating, and maintenance procedures, a

compilation of failure sources that would not be detectable by the current monitoring

practices was developed. A summary of this compilation is provided in Sect. 3.3.

Note that at the time that the review of the surveillance, maintenance, and operating

practices was being conducted, several fairly significant procedural revisions, as well as

complete rewrites, were in process. In fact, some previously nondetectable failure sources

were made detectable as a result of changes. Because this process was ongoing, some of

the observations made relative to failure nondetectability will probably be invalid when this

report is issued. The observations should be recognized for what they are - a picture of the

monitoring/operational practices in place for a specific plant at a particular time. It is

believed, however, that these observations are reasonable indicators of AFW system

monitoring practices as a whole.

3.2.1 Pump Suction Check Valves: C-3, -4, and -5

3.2.1.1 Surveillance and maintenance tests/inspections

ST-8 and -9 are quarterly tests in which the AFW pumps are run in their recirculation

flow path. These tests are performed to meet ASME Section XI testing requirements for

the pumps and are also used to demonstrate partial stroking of the SCVs. The flow rates

through the valves during this testing is -1/10 of the required design flow.

ST-14 is performed quarterly to verify that the SCVs close under reverse

pressure/flow conditions. The test is performed by pressurizing the piping downstream of

the SCV with demineralized water (using a vent connection on the pump casing) and

observing that a reverse pressure differential of >3 psid exists across the SCV.

ST-15, which is performed during each entry into hot standby conditions,

demonstrates that the pumps can deliver design basis flow to the SGs. The test thereby

demonstrates that the SCVs stroke open sufficiently to allow the required flow to pass

through them. The total of flow rates to the SGs must be >440 gal/min for the MDPs and

2880 gal/min for the TDP. Note that flow through the check valves would exceed flow

delivered to the SGs by the amount of flow delivered through the recirculation flow path.

ST-28, which is performed on a refueling frequency, calls for the disassembly and

inspection of several check valves. Note that this ST is not performed to meet a specific

Tech Spec surveillance requirement, and is not required by the ASME Section XI program,

but is performed as a consequence of the San Onofre water hammer event (see NUREG11901 and IE Notice 86-092). The valves are organized in groups of four. One valve out

of each group is disassembled and inspected each refueling outage; so each valve will be

inspected about every 6 years. If a valve fails to meet the acceptance criteria (see below),

all other valves in the group are to be inspected during the same outage. The TDP SCV,

along with the DCVs, make up one group of valves to be disassembled and inspected in

ST-28.

Acceptance criteria are

1. all internal parts in place and showing no signs of abnormal wear;

2. all internal locking devices, including tack welds, in place and in good condition; and

3. all internal surfaces in good condition and showing no signs of abnormal wear.
45

3.2.1.2 Frequency of test operation

The MDP SCVs are stroked according to the following procedures:

Number of

Procedure full(F)fpartial(P) strokes Eteuency

ST-3A 5P Refueling

ST-6 5P Refueling

ST-9 1P Quarterly

ST-15 IF Hot standby (•quarterly)a

ST-16 1P Refueling

MI-2A and -2B 1P Refuelingb

MI-3A and -3B 1P Refuelingb

a It is assumed that this test is performed twice per year.

b The MI tests are performed on an alternating basis; that is, one train is tested per

refueling outage.

Total estimated test-related partial strokes per year: The test frequency information

given above would yield -13 partial strokes per year; however, the MDPs are used for

protracted periods during startups and shutdowns and with varying flow rates, with the

dominant amount of time spent at relatively low flow rates or in recirculation flow only.

Thus, the valves are partial stroked much more frequently than indicated by testing.

Total estimated test-related full strokes per year: 2. (The only time the valves would

be likely to experience full stroking would be during testing, although some infrequent

operational demands could result in substantial, if not design basis, flow rates through the

valves.)

The TDP SCV is stroked per the following procedures:

Number of

Procedure full(F)/partial(P) strokes Frequency

ST-7 3P Refueling

ST-8 2P Quarterly

ST-15 2F Hot standby (<quarterly)a

ST-27 2P Refueling

a It is assumed that this test is performed twice per year.

Total estimated test-related partial strokes per year: 11. Note that the TDP normally

would not be used to support startups or shutdowns.

Total estimated test-related full strokes per year: 4. The only time the valves would

be likely to experience full stroking would be during testing although some infrequent

operational demands could result in substantial, if not design basis, flow rates through the

valves. Note that the phrase "full strokes" refers to conditions under which the flow rate

through the valve is at or near the maximum that occurs, not necessarily a condition under

which the check valve is fully open.
46

3.2.1.3. Relevant operating instructions

Because the TDP would be seldom used to support startup/shutdown evolutions, the

normal operating procedures primarily affect the MDP SCVs.

OP-1 includes precautions that state:

AFW Pumps should continue to run on recirculation to avoid hanger damage and

extend motor life. AFW LCV's should be maintained in manual to avoid steadystate low flow conditions that could result in damage to hangers in the Turbine

Building, Condensate Transfer Pump damage, and/or intermittent actuation of

AFW pump suction pressure switches. Just prior to criticality LCV Controller

will be placed in AUTO positions.

While in a low flow condition or Mode 3, AFW should be "batched" or "slugged"

at =75 gal/min to each steam generator to prevent vibration damage and

inadvertent ESW swapover. This flowrate will also ensure that S/G nozzle

cracking does not occur.

GOP-1 (Unit Heatup from Cold Shutdown to Hot Standby) and GOP-2 (Plant

Startup from Hot Standby to Minimum Load) include similar precautionary statements.

3.2.1.4 Comments

A noteworthy feature of the testing program for the SCVs is the fact that the TDP

SCV is included in the periodic disassembly and inspection procedure (ST-28), whereas

the MDP SCVs are not. This is difficult to understand in that the MDP SCVs see

considerably more service because the MDPs are used to support plant startup and

shutdown. Also note that the low suction pressure switches for the MDPs are located

upstream of the SCV's; thus, failure of an SCV to open fully, thereby creating low suction

pressure conditions at the pump suction (but not upstream of the check valves) could occur

and not be detected by the suction pressure switches.

The extremely low velocities that the MDP SCVs would experience, in conjunction

with the fact that the layout geometry is not particularly beneficial for flow stability

(because of the proximity of the upstream elbow), indicate that the probability of disk

oscillation related wear would be relatively high (in comparison with that experienced by

the average check valve in a standby system). Although the wear rate as a function of

hours of service would be expected to be relatively high, the wear rate as a function of plant

life should be relatively low (because the system is not in service the vast majority of the

time).

3.2.2 Emergency Service Water to Motor-Driven Pump Suction Isolation

Valves: MOV-1, -2, -3, and -4

3.2.2.1 Surveillance and maintenance tests/inspections

ST-6, which is performed every 18 months, is used to satisfy Tech Spec Surveillance

Requirement 4.7.1.2.b for the MDP ESW valves. The testing is performed on only one of

the two in-series valves at a time to avoid intrusion of ESW water (lake water) into the

AFW system; therefore, the valves are stroked under low- or no-flow conditions (some

minor flow does occur during the MOV-2 and -4 valve tests because the tell-tale drain

valves between the two isolation valves are open). The automatic stroking is initiated by

manually closing the associated pump breaker auxiliary contacts to simulate a pump

running condition and by depressurizing all three suction pressure switches. The testing
47

sequence for each pump's valve set is to test each upstream valve (MOV- 1 or -3) first and

then test the downstream valve (MOV-2 or -4). The upstream valve (MOV-1 or -3) is

stroked after the breaker for the downstream valve's motor operator is opened. To

accomplish the testing of the downstream valves (MOV-2 or -4), the procedure calls for the

"thermal overloads" ("thermal overloads" is procedure terminology - note that the thermal

overloads for these valves have been removed and replaced by jumpers) to be removed

from MOV-1 or -3 after completing the MOV-1 or -3 portion of the test. This requirement

allows the suction pressure switches to energize the relays that automatically open MOV-2

or -4 without causing MOV- 1 or -3 to open (the low suction pressure relays are located in

the MCCs for MOV-1 and -3). MOV-1 and -3 are not restroked after testing MOV-2 and - 4.

ST-10, -11, and -13 are used to implement the ASME Section XI valve in-service

testing requirements. The testing sequence called for is to first test the downstream valve

and then test the upstream valve to avoid intrusion of lake water into the AFW system. The

tell-tale drain is closed during the valve stroking and reopened following completion of the

test. Stroking is performed by use of the MCB switch. The maximum allowable stroke

time for each of the four valves is 42 s.

ST-25 is a calibration and functional test procedure that satisfies Tech Spec

Surveillance Requirements 4.3.2.1.1.B.6.g (calibration) and 4.3.2.1.1.C.6.g (functional

test). The functional test is required every 31 days, and the calibration is required every 18

months.

The general testing sequence is as follows:

1. The associated MDP control switch is placed in PULL TO LOCK to prevent inadvertent

stroking of either valve (because the pump must be running to complete the open

permissive).

2. The downstream valve breaker is opened to prevent the valve from inadvertently

opening.

3. The "A" pressure switch is isolated and depressurized, and the associated MCB alarm is

verified.

4. Using a test rig, the pressure at the switch is varied, and the switch setpoint is checked

(and adjusted, if necessary). The test rig is then disconnected, the pressure switch is

unisolated, and the alarm is verified to have cleared.

5. Similar checks are performed on the "B" and "D" switches, except that following the

check on the "D" switch, the "D" switch is left isolated and depressurized. The "B"

switch is then isolated and depressurized, and the contacts that must close to cause the

"A" and "B" valves to open are verified to be closed.

6. The switches are then restored to normal configuration and their sensing lines refilled.

Note that only the B + D pressure switch coincidence is checked. Also note that no

distinction is made in the procedure between the channel functional test and the channel

calibration.

MI-4 is a procedure that provides instructions on the testing of motor-operated valves

using the MOVATS system, which is used to assess the general mechanical and electrical

control conditions of the valves.

MI-5 is a preventive maintenance procedure for LIMITORQUE actuators that is used

to maintain equipment qualification. It provides for inspection and cleaning of electrical

components; cleaning, inspection, and relubrication of the geared limit switch train;

inspection and replacement (if needed) of gaskets; setting the limit switch positions

according to MI-6A; measuring resistance from each phase to ground from the supply

breaker; inspection and replacement (if needed) of the operator lubricant; cleaning and

relubrication of the valve stem; lubrication of the sleeve top bearing (if a grease fitting is

provided); inspection of the shaft seal for excessive leakage; and inspection of the-spring

pack for hardened grease.
48

MI-6A is a corrective maintenance procedure that is used periodically (as invoked by

MI-5) to adjust motor-operated valve limit and torque switch settings. Limit switch

settings, based either on valve travel measurement or the number of handwheel turns, are

set as follows: (1) open limit switch set to open at 95 to 98% of valve travel, and (2) close

limit switch set to open at 97 to 98% of valve travel.

MI-7 is used to verify the time delay relays associated with the automatic transfer

from the CST to ESW time out at 4 s. The procedure does not actuate any equipment - it

only verifies timing. There is no designated frequency of testing. A commitment to

periodically calibrate the timers was made in a licensee event report ([ER) filed by Plant A.

3.2.2.2 Frequency of test operation

The ESW isolation valves are stroked according to the following procedures:

Procedure Number of full strokes Frequengy

ST-6 1 Refueling

ST-10 and -13 1 Quarterly

Total estimated test-related full strokes per year: 5. All strokes are performed under

no-flow conditions.

3.2.2.3 Relevant operating instructions

OP-1, which is the AFW system operating procedure, specifies that the ESW

isolation valves are to be "Operable-Closed" and the telltale drain valves "Open." The

Precautions section states that "If the suction pressure of the motor-driven AFW pumps fall

below 2 psig for 4 s, the suction will shift from CST to ESW. If suction swaps over,

Assistant Unit Operator (AUO) should close telltale valves on all AFW Pumps." The

procedure also includes instructions on switching the suction source from CST to ESW if

"pump suction drops to 2 psig and auto swap over does not occur." Manually switching to

ESW requires shift supervisor approval and is accomplished in the following sequence:

1. close telltale drain valve,

2. open the outboard valve (e.g., MOV-1), and

3. open the inboard valve (e.g., MOV-2).

Note that the operator does not have remote indication of suction pressure, but there

is a local suction pressure gage for each pump.

A single low suction pressure alarm annunciates when any one of the pressure

switches for either of the MDPs or the TDP closes (total of nine pressure switches).

OP-3 is the annunciator response procedure for AFW-related alarms. The annunciator

procedure states that the origin of the annunciator is from PS-lA, -2A, or -3A. (In reality,

the B or D switches for each of the sets will also cause annunciation.) It also states that if

2/3 pressure switches for a given pump reach their setpoint, the pump will automatically

switch over to ESW as the suction source. The "Immediate Action" section of OP-3 has

the operator "verify opening of appropriate ESW suction supply valves."

3.2.2.4 Comments

Several comments are relative to the testing of these valves:

1. Because there is no indication of suction pressure in the main control room, when a low

suction pressure alarm is received, the operator cannot know whether multiple switches
49

on multiple pumps have "made" because of an actual low suction pressure condition or

whether only a single switch has closed spuriously. Therefore, the operator cannot

know which are the "appropriate" valves (as designated in OP-3). (It has been

observed at another plant that when the motor-driven AFW pumps are started up with

their discharge valves to the SGs open, a low-suction pressure alarm annunciates

routinely because of transient pressure conditions. However, when started up on

recirculation flow only, the alarm is not received. Note that this plant has suction

pressure indication in the main control room for all AFW pumps, as opposed to Plant

A, which has no indication.) Given the natural reluctance of an operator to switch over to ESW and the availability of

only a single annunciator operated from multiple switches, along with the operating procedure requirement to secure shift supervisor permission before switching to ESW

in the operating procedure (OP-1), considerable question exists concerning how the

operator would respond to an alarm. Note that no time delay is associated with the

suction pressure alarm (instead, the delay is built into the automatic valve opening

circuit). 2. No testing currently conducted can verify that these valves will open in conjunction with

an actual low suction pressure condition and that the pumps running will achieve

satisfactory results ("satisfactory results" include the requirements that (1) the pump suction switchover takes place quickly enough to prevent loss of required NPSH for

the pumps and (2) adequate steady state flow is provided to the pumps to allow the

AFW design-flow requirements to be met). Because of the water chemistry problems associated with the switchover, there is an understandable desire not to test this feature.

However, because ESW is the only safety-grade source of water for the pumps, the

ability for the transfer to occur satisfactorily is critical.

3. Manual isolation valves and check valves are between the pressure switches and the

MDPs. Thus, the pressure switches would not detect and correct for a stuck closed

check valve or an improperly positioned manual isolation valve.

4. Because no flow is delivered through the valves, the capability of the suction flow paths

to support required AFW flow is not demonstrated.

5. The A + B and A + D pressure switch logic is not verified to result in valve opening. 6. ST-6 does not verify restoration of operability for MOV-1 and -3 following replacement of the "thermal overloads" (jumpers) after testing MOV-2 and -4. Inasmuch as the part of the control circuit that is needed for valve operation is interrupted for the test, but the

valve position indicator lights portion of the control circuit remains intact, continuity in

the valve operation portion of the circuit is not verified to have been reestablished.

7. The pipe configuration associated with the ESW suction valves is such that a small

amount of lake water will intrude into the AFW system each time the inboard valve is

stroked because the ESW valves are located in a vertical section of pipe. Because this

section of piping is normally relatively stagnant, the potential for Asiatic Clam buildup and/or microbiologically induced corrosion exists. However, the procedure that is

implemented to deal with Asiatic Clams (ST-30) opens up bypass treatment lines in the

ESW to AFW pump suction piping to ensure that the lines are treated when

environmental (temperature) conditions warrant action to minimize Asiatic Clam

buildup. Note that ST-6, which is performed every 18 months, provides for flushing

out any ESW water left after the upstream valves are stroked by leaving the drain valves

open during the downstream valve stroking. However, this good practice is not

adopted in ST-10, which is performed quarterly. 8. The section of piping downstream of each MDP's check valve in the normal suction

path from the CST is safety-grade, seismically qualified piping, whereas the piping upstream of the check valve is not. The length of piping downstream of the check

valve to the MDP contains only enough water for a couple of seconds of pump operation before air would be drawn into the pump casing should the piping upstream of the check valve fail. It appears that the time delay before automatic valve opening
50

was initiated, as well as the fact that the valves are fairly slow stroking valves, might

create conditions under which the MDPs became at least partially air-filled before the

transfer was completed. Note that this concern is common with the TDP.

3.2.3 Emergency Service Water to Turbine-Driven Pump Suction Isolation

Valves: MOV-5, -6, -7, and -8

3.2.3.1 Surveillance and maintenance tests/inspections

ST-7, which is performed every 18 months, is used to satisfy Tech Spec Surveillance

Requirement 4.7.1.2.b for the TDP ESW valves. The testing is performed on only one of

the two in-series valves at a time to avoid intrusion of ESW water (lake water) into the

AFW system; therefore, the valves are stroked under no-flow conditions. The automatic

stroking is initiated by manually opening the T&T valve (with an upstream steam supply

valve closed to prevent a pump start) and by depressurizing all three suction pressure

switches. The testing sequence for each pump is to first test the upstream valve and then

test the downstream valve to avoid intrusion of lake water into the AFW system. The test

provides evidence that the valve sequencing (MOV-7 or -8 valve begins to open, then

MOV-5 or -6 valve begins to open, and then MOV-7 or -8 valve closes) takes place,

although the sequence is not timed. Note that the test, as written, will actually cause the

MOV-7 or -8 valve to stroke open, then shut, and repeat the cycle until either the T&T

valve is opened or two of the three suction pressure switches are repressurized.

ST-10, -11, and -13 are used to implement the ASME Section XI valve in-service

testing requirements. Stroking is performed by using the MCB switch. The maximum

allowable stroke time for each of the four valves is 55 s. The tell-tale drain valve is closed

during testing and reopened after testing.

ST-25 is a calibration and functional test procedure that satisfies Tech Spec

Surveillance Requirements 4.3.2.1.1.B.6.g (calibration) and 4.3.2.1.1.C.6.g (functional

test). The functional test is required every 31 days, and the calibration is required every 18

months.

With the breakers for MOV-7 and -8 and MOV-5 and -6 open (to prevent valve

stroking), the pressure switches (PS-3A, B, and C) are checked, one at a time, to verify

that the switch closes at the proper suction pressure (using a pressure source, with the

pressure switch isolated from the suction header). The low suction pressure alarm at the

MCB is verified to come in and then to clear for each switch.

After the pressure switches are checked/calibrated, a portion of the automatic

switchover circuitry is verified as follows:

1. the steam supply to turbine is isolated by closing MOV-9 and -10,

2. the T&T valve is opened (needed to provide permissive), and

3. each of the 2/3 pressure switch coincidence logic combinations is checked to verify that

relays BBA, BBB, and CCC energize.

No distinction is made in the procedure between the channel functional test and the channel

calibration.

MI-4 is a procedure that provides instructions on the testing of motor-operated valves

using the MOVATS system, which is used to assess the general mechanical and electrical

control conditions of the valves.

MI-5 is a preventive maintenance procedure for LIMITORQUE actuators that is used

to maintain equipment qualification. It provides for inspection and cleaning of electrical

components; cleaning, inspection, and relubrication of the geared limit switch train;

inspection and replacement (if needed) of gaskets; setting of the limit switch positions

according to MI-6A; measuring resistance from each phase to ground from the supply

breaker, inspection and replacement (if needed) of the operator lubricant; cleaning and
51

relubrication of the valve stem; lubrication of the sleeve top bearing (if a grease fitting is

provided); inspection of the shaft seal for excessive leakage; and inspection of the spring

pack for hardened grease.

MI-6A is a corrective maintenance procedure that is used periodically (as invoked by MI-5) to adjust motor-operated valve limit and torque switch settings. Limit switch

settings, which can be set based either on valve travel measurement or the number of

handwheel turns, are set as follows: (1) open limit switch set to open at 95 to 98% of valve

travel, and (2) close limit switch set to open at 97 to 98% of valve travel.

MI-7 is used to verify the time delay relays associated with the automatic transfer

from the CST to ESW times out at 5.5 s. The procedure does not actuate any equipment - it only verifies timing. There is no designated frequency of testing. A commitment to

periodically calibrate the timers was made in an LER filed by Plant A.

3.2.3.2 Frequency of test operation

The ESW isolation valves are stroked according to the following procedures:

Procedure Number of full strokes Frequeny

ST-7 la Refueling

ST-10 and -13 1 Quarterly

a MOV-7 and -8 will be stroked open and closed continuously in ST-7 until the T&T

valve is closed; however, only one stroke is assumed here.

Total estimated test-related full strokes per year: 5. All strokes performed under noflow conditions.

3.2.3.3 Relevant operating instructions

See the discussion under Sect. 3.2.2.3 for ESW supply valves MOV-1, -2, -3, and

-4.

3.2.3.4 Comments

No testing is conducted to verify that these valves will open in conjunction with an

actual low-suction pressure condition and the pump running will achieve satisfactory

results ("satisfactory results" include the requirements that (1) the pump suction switchover

takes place quickly enough to prevent loss of required NPSH for the pump and (2)

adequate flow is provided to the pump to allow the AFW design-flow requirements to be

met). Because of the water chemistry problems associated with the switchover, there is an

understandable desire not to test this feature. However, because ESW is the only safetygrade source of water for the pumps, the ability for the transfer to occur satisfactorily is

critical. Because no flow is delivered through the valves, the capability of the alternate

suction flow paths to support required AFW flow is not demonstrated.

The piping section between the valves (e.g., between MOV-7 and -8) is horizontal

with a normally open telltale drain valve. This section of piping is thus normally air-filled.

This should minimize the potential for Asiatic Clam and/or microbiologically induced

corrosion in the piping between the valves but does cause some concern relative to the

introduction of air into the pump in the event of automatic swapover. Water in the piping

sections upstream of MOV-5 and -7 is normally relatively stagnant, and therefore the

potential for Asiatic Clam buildup and/or microbiologically induced corrosion exists. Some

mitigation is provided, however, because the procedure that is implemented to deal with
52

Asiatic Clams (ST-30) opens up bypass treatment lines in the ESW to AFW pump suction

piping to ensure that the lines are treated when environmental (temperature) conditions

warrant action to minimize Asiatic Clam buildup.

The length of piping downstream of the check valve in the normal suction path from

the CST is safety-grade, seismically qualified piping, whereas the piping upstream of the

check valve is not. The length of piping downstream of the check valve only contains

enough water for a few seconds of pump operation before air would be drawn into the

pump casing should the piping upstream of the check valve fail. It appears that the time

delay before automatic valve opening was initiated, as well as the fact that the valves are

fairly slow stroking valves, might create conditions under which the TDP became at least

partially air-filled before the transfer was completed.

3.2.4 Motor-Driven AFW Pumps

3.2.4.1 Surveillance and maintenance tests/inspections

ST-3A and -3B (3A is for "A" train, and 3B is for "B" train), which are performed on

an 18-month frequency, are titled "Loss of Offsite Power with SI DG A/2B-B Containment

Isolation Test." Note that both trains are tested every 18 months. The testing for a single

train is discussed below.

Several AFW pump-related functions are checked in this test:

1. The MDP is verified to be stripped from its bus following deenergization of the bus

(note that diesel-generator start due to bus undervoltage is inhibited during bus

deenergization).

2. With the bus still deenergized, an SI signal is initiated. This causes the diesel to start

and causes loads (including the associated AFW pump) to sequence on.

3. After resetting the SB and SI signals, restoring normal power to the bus, and securing

the diesel, another SI signal is generated. Both MDPs are verified to start on the SI

signal.

4. After resetting the SI signal and performing testing that is not directly related to AFW,

the associated AFW pump bus is deenergized, and the automatic diesel-generator start

associated with undervoltage is unblocked, allowing the diesel to start and reenergize the

bus. The associated AFW pump is verified to start.

Note that (1) the testing sequence in items 1 and 2 results in AFW pump start from an

SI signal with a preexisting SB signal, (2) the testing sequence in item 3 results in pump

start from SI only, and (3) the item 4 sequence starts the pump from SB only. All starts of

the pumps are performed with the system aligned for recirculation flow only.

ST-6, which is performed on an 18-month frequency, is titled "Motor-Driven

Auxiliary Feedwater Pump and Valve Automatic Actuation." The following test sequences

are included in ST-6:

1. An SI signal is simulated by manually pushing the SI slave relay, and the MDPs are

verified to start.

2. A low-low SG level in one SG is simulated by tripping 2/3 level bistables for a single

SG, and the MDPs are verified to start.

3. A trip of the "A" main feed pump in coincidence with simulated plant power at >80% is

verified to start both MDPs.

4. A trip of the "B" main feed pump in coincidence with simulated plant power at >80% is

verified to start both MDPs.

5. A trip of both main feed pumps is verified to start both MDPs.
53

The pumps are not verified to start on an SB signal, since the procedure takes credit

for the SB starts in ST-3A and -3B. All ST-6 starts of the AFW pumps are performed with

the system aligned for recirculation flow only.

ST-9, which is a quarterly test, is titled "Motor Driven Auxiliary Feedwater Pumps."

Each pump is started and run with the system aligned for recirculation flow only. The

conditions monitored are flow, suction and discharge pressure, and vibration, according to

ASME Section XI (which is invoked by Tech Spec 4.0.5) requirements. Flow through the

pump miniflow line is measured using temporary ultrasonic flowmeters. Pump suction and

discharge pressure are also monitored using test pressure gages. Vertical and horizontal

vibration of the pump inboard bearing is also monitored. Acceptance criteria are as

follows:

Paramete Acptable Al= Reuired action

MDP "A" in-service test ranges

Suction pressure, psig >11 NA <11

Pump delta-P, psid 1524 to 1661.5 (No low range) <1524 and >1677.8

1661.5 to 1677.8

Flow rate, gal/min 29.4 to 45.1 26.0 to 29.4 and <26.0 and >47.2

45.1 to 47.2

Horizontal vibration, mils 0 to 1.0 1.0 to 1.5 >1.5

Vertical vibration, mils 0 to 1.0 1.0 to 1.5 > 1.5

MDP "B" in-service test ranges

Suction pressure, psig >11 NA <11

Pump delta-P, psid 1464 to 1565.4 (No low range) <1464 and >1580.7

1565.4 to 1580.7

Flow rate, gal/nin 27.1 to 41.6 23.9 to 27.1 and <23.9 and >43.5

41.6 to 43.5

Horizontal vibration, mils 0 to 1.0 1.0 to 1.5 >1.5

Vertical vibration, mils 0 to 1.0 1.0 to 1.5 >1.5

ST-15, which is performed for each entry into Mode 3 (but not to exceed quarterly),

is titled "AFW Check Valve Opening Test During Hot Standby and Hot Shutdown." While

the purpose of the test is to demonstrate stroking of check valves in the lines between the

pump discharge and the SGs, it is also the only test that demonstrates anything other than

recirculation flow from the pumps. The acceptance criteria for the test are that each pump is

able to deliver >220 gal/min simultaneously to each of the SGs serviced by the pump.

Other than specifying that the testing is to be conducted in Mode 3 or 4, there are no

prerequisites relative to system conditions (such as SG pressure).

ST-19, which is performed on an 18-month frequency, is titled "Automatic Load

Sequence Timer Functional Test." The test verifies that the MDP sequencing timer time

delays are set at 20 s nominal (19 to 21 s is the acceptable range).
54

ST-20, which is performed on an 18-month frequency, is titled "Response Time Test

of Auxiliary Feedwater System Auto-Start Relays." It is performed in conjunction with

ST-6 and, in fact, only specifies response time test points to be monitored during the

performance of ST-6. The only AFW pump-related response times measured are those

associated with trip of the main feed pumps. The times measured are from trip of the main

feed pumps until energization of the relays that cause the AFW pumps to start. The times

are used in ST-22 to determine system response time.

ST-22, which is performed on an 18-month frequency, is tided "Engineered Safety

Feature Response Time Verification." No equipment is actuated by the test; rather, the test

compiles response time measurements from several other surveillance procedures,

including ST-20 and -21, as well as from several response time tests for portions of

channels performed in several MI tests.

For each of the automatic AFW actuation signals, total channel response time is

calculated. Four response times are calculated for each start signal:

1. TDP response time,

2. TDP LCV response time,

3. MDP response time, and

4. MDP LCV response time.

The greatest time of these four is taken as the total actuation response time.

Each of the four response times is calculated by adding several components that

together make up (or simulate) the time from process change until the actuated equipment

has reached its safety function condition (pumps have developed the required discharge

pressure or valves have reached the full-open position). The maximum allowable response

time specified in the procedure is 59.1 s (1.5% less than the Tech Spec value of 60 s to

provide for recorder chart speed accuracy). Since the MDPs, under SB conditions, would not be sequentially loaded onto the

diesel until about 30 s after an undervoltage condition occurred, the MDPs or the MDP

LCV response times should be greater than the TDP and TDP LCV response times. Note

that the TDP and the LCVs are not dependent upon diesel starting, since their power and

control circuits are dependent upon 125-V dc and 120-V ac vital, power.

The SB response time inputs to ST-22 from MI-3A and -B are based on a combined

SI/SB signal, and the response times measured are from the diesel start signal (instead of

the undervoltage condition, which must exist for 1.5 s before the diesel start signal is

generated) until the MDPs have reached full discharge pressure. Note that fixed "Response

Time Factors" are added to the time inputs from MI-3A and -B (as well as those from

MI-2A and -B) to account for the difference in pressure development time for recirculation

conditions, under which the test is conducted, and full-flow conditions. The response time

factors are variable and range from 3.32 s ("A" pump factor in MI-2A) to 4.96 s ("B"

pump factor in MI-3B).

Also note that the response times calculated for the MDPs do not include any time

associated with the automatic realignment of pump suction from the nonsafety-related

source (CST) to the safety-related ESW source. A low suction pressure condition must

exist for 4 s after pump start to initiate the automatic suction source transfer. The motoroperated valves that open to provide the alternate suction source have maximum allowable

stroke times of 42 s specified in the ST-10, -11, -12, and -13 series of tests.

While not part of a formal procedure (rather, based on an operations group instruction

letter), auxiliary operators check the temperatures of the pump discharge lines once per shift

for evidence of backleakage of main feedwater. This monitoring is performed in response

to IE Bulletin 85-013 and Generic Letter 88-03.4
55

3.2.4.2 Frequency of test operation

The MDPs are operated according to the following test procedures:

Procedu Number of pump startsa Evuengy

ST-3 5 Refueling

ST-6 5 Refueling

ST-9 1 Quarterly

ST-15 1 Hot standby (•quarterly)b

ST-16 1 Refueling

MI-2A and -2B 1 Alternate refuelingc

MI-3A and -3B 1 Alternate refuelingc

a Note that all of these starts, with the exception of ST-15, are performed under

recirculation flow only, and, even in ST-15, the flow rate to the SGs is manually changed

from a relatively low flow to >220 gal/min per SG by manual control.

b It is assumed that this test is performed twice per year.

c The MI tests are performed on an alternating basis; that is, one train is tested per

refueling outage.

Total estimated test-related starts per year: The above test frequency information

would yield about 14 pump starts per year for testing purposes. Most of the testing would

involve a brief time (few minutes) of pump operation. If the average pump run duration

per test were 15 min, the average annual run time would be -3.5 h. However, the MDPs

would be used for protracted periods during startups and shutdowns at varying flow rates,

with the dominant amount of time spent at relatively low flow rates or in recirculation flow

only. Occasional pump starts could be expected in conjunction with reactor trips or other

unplanned events. Thus, while the number of test-related starts may exceed the number of

unplanned and nontest starts, the amount of time spent running for test purposes is

expected to be small, relative to the amount of run time in support of normal plant

evolutions.

3.2.4.3. Relevant operating procedures

OP-1 is the AFW system operating procedure. Several procedural requirements

affecting MDP operation are included in the OP:

1. A precaution states that the AFW pumps should be run on recirculation flow (as

opposed to stopping and starting the pumps) during conditions when SG demand is low

to avoid hanger damage and to extend motor life. Another precaution stipulates that

AFW should be batched at =75 gal/min (under manual LCV control) to each SG to

prevent vibration damage and inadvertent swapover from the CST to ESW suction as

well as to prevent SG nozzle cracking.

2. If time permits, the LCVs are taken under manual control and closed before starting an

MDP.

3. Following pump start, the pumps are inspected locally (no specific direction provided

for the inspection).

4. For purposes of placing the AFW system in its standby condition, the MDP control

switches are specified to be in AUTO.

5. Precautions are included that the "pump discharge lines should be <125OF (cool to

touch)" to ensure against backleakage binding of the pumps. Note that Plant A is

probably less susceptible to backleakage than many other plants since its LCVs are
56

normally closed (some plants have only check valves between the pumps and the SGs or

main feed lines).

6. The procedure recommends that operation of the MDPs at flow rates in excess of 525

gal/min be avoided when the SG pressure is between 385 and -865 psig. The stated

purpose is to avoid high levels of vibration around the cavitating venturi when the flow

rate is high enough to result in cavitation. (Below 385 psig, the bypass LCVs should

provide sufficient backpressure to prevent cavitation.)

GOP-I and -2 and GOP-3 (Plant Shutdown from Minimum Load to Cold Shutdown)

include some of the same precautions relative to operation of the MDPs. GOP-2 specifies

that the AFW pumps be used to maintain SG level until the main feed pumps are

maintaining SG level and specifies that the main feed pumps should be started at -1%

reactor power.

3.2.4.4 Comments

The flow testing of the MDPs is performed under recirculation flow (roughly 25

gal/min) conditions. This testing is done to satisfy Tech Spec 4.7.1.2 as well as ASME

Section XI testing requirements. While the testing satisfies regulatory requirements, it does

little in the way of demonstrating pump capability. In fact, the best evidence of pump

capability provided by any testing is from ST-15, which verifies that each MDP is capable

of delivering at least 440 galmin to the two SGs served, although pressure conditions are

not specified.

The operating procedures include precautions to minimize adverse effects upon the

pump motors, piping hangers, and other system equipment However, the actions taken to

accomplish those ends are deleterious to the pumps. The pumps, during startup and

shutdown periods when relatively low flow rates are required, are run continuously in

recirculation. As discussed in NUREG/CR-4597, 5 operating pumps for long periods of

time at low-flow conditions can result in accelerated pump degradation. IE Bulletin 88-046

discussed this problem and required utility response. It does not appear, based on the

operating guidance offered by Plant A procedures, that this issue has been thoroughly

addressed.

All of the automatic start signals for the MDPs are adequately verified by testing to

result in pump starting. The pumps are also verified to be stripped from their buses in the

event that an undervoltage condition occurs with the pumps already running. All automatic

start signal testing is done with the pumps aligned for recirculation flow only. One of the

tests in which automatic loading is verified is ST-3A and -3B. This test is principally

oriented toward demonstrating diesel operability, including verification that the

automatically connected diesel loads do not exceed the diesel's 2000-h rating. Note that, as

conducted, the test does not accurately simulate demand condition loads, since the AFW

pumps (as well as other pumps) are operating under recirculation flow only, and since the

power demanded under recirculation would be substantially less (roughly half) than that at

full flow.

The ability for the pumps to successfully negotiate the transition from their normal

source of water (CST) to their safety-related source (ESW) is not demonstrated. Actual

delivery of lake water into the AFW system is clearly not desirable from a chemistry

perspective. However, the time requirement for sensing a low-suction-pressure condition,

timing out of the time delay relay, and opening of the ESW valves sufficiently to meet

pump flow requirements appears to be marginal from the standpoint of ensuring that a

pump would not become vapor bound.

The pump auxiliary contacts, which provide control signals to the LCVs, the alternate

suction source valves, and SG blowdown valves, are not verified to function properly.
57

The response times measured for the MDPs include an allowance for the time

required to reach the required flow rate (as an adder to the time required to reach steadystate pressure in the recirculation condition) but do not include an allowance for the time

that would be required for the automatic transfer of the suction source from the CST to

ESW. If the MDP response time were defined to include the maximum allowable stroke

time for the alternate suction source valves, the pumps would not be able to satisfy the 60-s

response time identified in Tech Specs. The 60 s is a somewhat arbitrary, generic Tech

Spec time. Some accident/transient analyses do take credit for AFW start at 1 min (for

instance, loss of normal feedwater). However, the relatively small amount of time for

transfer to the safety-related ESW as the suction source, provided the transfer occurs

satisfactorily, should have minimal or no observable impact upon the results. Note that the

analysis for a feedline break does not assume flow initiation until 10 min (because operator action must be relied upon to isolate the faulted SG).

3.2.5 Turbine-Driven AFW Pump

3.2.5.1 Surveillance and maintenance tests/inspections

ST-7, which is conducted on an 18-month frequency, verifies that the T&T valve

opens, with steam supply isolated by an upstream valve, in response to each automatic

open signal (with the exception that the blackout signal is tested on only one train). The

turbine is also actually started (steam supply is unisolated) three times by ST-7, with the

pump discharge lined up for recirculation flow only. The three starts are for trip of the A

main feed pump, trip of the B main feed pump, and trip of both main feed pumps.

ST-8 is a quarterly test of the AFW TDP. The test is conducted with the pump

discharge lined up for recirculation flow only. This test is conducted to fulfill the

requirements of Tech Spec Surveillance Requirements 4.0.5 and 4.7.1.2.a.2. Temporary

ultrasonic flowmeters are used to measure flow through the pump miniflow line (there is no

permanent miniflow line flow instrumentation). The T&T valve is opened to start the

turbine by operation of the valve's control switch at the MCB, and the pump is run with

only its recirculation flowpath available. Pump speed for the test is the normal operating

speed of 3970 rpm. The established TDP in-service test acceptance criteria are as follows:

parameter Acceptable Alert Required action

Suction pressure, psia >11 NA <11

Pump delta-P, psid 1194.6 to 1310.2 1183 to 1194.6 and <1183 and

1310.2 to 1323.0 >1323

Flow rate, gal/min 47.1 to 62.3 39.3 to 47.1 and <39.3 and

62.3 to 66.2 >66.2

Horizontal vibration, mils 0 to 1.44 1.44 to 2.16 22.16

Vertical vibration, mils 0 to 1 1.0 to 1.5 >1.5

Note that the suction pressure acceptance criteria are specified in psia vs psig. This appears

to be inconsistent with the Tech Spec allowable low-suction pressure setpoint of 13.9 psig.
58

ST-10, -11, and -13 are surveillance procedures that implement valve stroke time and

remote position indication requirements of the ASME Section XI Pump and Valve IST

Program. Valve stroke time for the T&T valve, based on remote (MCB) indication, is

measured quarterly. The test is conducted with steam isolated (MOV-9 closed). Stroke

time is measured from closed to open by holding the valve handswitch to OPEN. The

maximum allowable stroke time for the T&T valve is 19 s.

ST-15 is conducted at shutdown, as a part of the Pump and Valve IST Program. Its

intent is to full stroke several check valves, including TDP discharge check valves and

steam supply check valves. Full stroking is demonstrated by verifying Ž220 gal/min to

each SG with only the TDP running. This also provides an indication of TDP performance,

since the procedure requires delivery of 2220 gal/min to each SG simultaneously, but total

pump flow and developed head are not recorded. SG pressure is not recorded, but the

procedure specifies that the TDP-related check valves be stroked with steam pressure >842

psig.

ST-21 is an engineered safety features (ESF) response time test in which the response

times for the TDP following main feed pump trip signals (performed in ST-7) are tabulated.

A reference response time from signal initiation until the T&T valve begins to open (valve

stem limit switch "ac" contacts close) is also determined.

ST-22 is an ESF response time test in which response times determined from

numerous supporting tests are compiled and compared with allowable values. The

response times for starting the TDP following an SI signal, a low-low SG level signal, an

SB signal, and the main feed pump trip signals are tabulated. The time interval measured is

the time from start signal generation until the pump discharge pressure stabilizes.

Note that the TDP is actually started, for response time measurement purposes, only in response to the main feed pump trip signals (see discussion under ST-7 and -21).

Response times for various portions of the automatic initiation circuits are recorded in

procedures MI-2 and -3 and ST-21 and are coordinated in ST-22 to determine total channel

response times. Also note that the T&T valve is not opened, nor verified to open, for the

low-low SG and SB signals.

ST-27 is a calibration procedure for the AFW turbine controls and is conducted on a

refueling frequency. The test performs the following T&T valve-related checks:

1. The mechanical trip is manually actuated using the local trip lever. The open coil circuit

of the valve is verified to be interrupted. The mechanical trip is manually reset, and

restoration of the open coil circuit is verified.

2. The stem-actuated limit switch that provides initiation of the governor control ramping

function is verified to close when the valve is 1/8 to 1/4 open. Total stroke length is

also verified.

3. A calibration of the speed sensor that is used for indication and for the electronic

overspeed trip is performed. A signal generator is used to allow the calibration to be

performed without the turbine operating. The electronic overspeed trip point is verified

(using the signal generator).

The test also performs a number of checks related to the governor and governor

control circuit, including the following:

1. Resistance of the electromagnetic speed pickups for the turbine is checked.

2. A full governor control loop calibration is performed. This calibration includes the

control speed sensor, RGSC, and the speed setting potentiometer. Most aspects of the

calibration are performed with the turbine idle.
59

3. An actual start of the turbine is conducted to verify that the turbine comes up to 2200

rpm with the minimal flow demand signal and then controls at 3970 rpm at the full-flow

demand signal. Note that the speed feedback portion of the circuitry is deleted for this

portion of the test. With the turbine operating, the turbine is manually tripped using the

mechanical trip lever.

4. Following resetting of the turbine trip device and reconnecting of the lifted speed

feedback leads, the turbine is verified to "quick start" and come up to normal operating

speed (3970 rpm) in 15 +2/-1 s.

Note that the starts of the turbine for ST-27 are done with only the miniflow

recirculation flow path available.

MI-2 and -3 are a series of instrument maintenance procedures that determine

response times for most reactor protection and ESF circuits, including portions of the TDP

actuation circuits. The various portions of the ESF response time for the T&T valve are

determined. The times are compiled in ST-22.

MI-4 is a procedure that provides instructions on the testing of motor-operated valves

using the MOVATS system, which is used to assess the general mechanical and electrical

control conditions of the valves.

MI-5 is a preventive maintenance procedure for LIMITORQUE actuators that is used

to maintain equipment qualification. It provides for inspection and cleaning of electrical

components; cleaning, inspection, and relubrication of the geared limit switch train;

inspection and replacement (if needed) of gaskets; setting of the limit switch positions,

according to the MI-11.2 series; measurement of resistance to ground from the supply

breaker, inspection and replacement (if needed) of the operator lubricant; cleaning and

relubrication of the valve stem; lubrication of the sleeve top bearing (if a grease fitting is

provided); inspection of the shaft seal for excessive leakage; and inspection of the spring

pack for hardened grease.

MI-6 is a corrective maintenance procedure that is used periodically (as invoked by

MI-5) to adjust motor-operated valve limit and torque switch settings. Limit switch

settings, which can be set based either on valve travel measurement or the number of

handwheel turns, are set as follows:

1. Open limit switch: Set to allow valve to open to within 98 to 99% of full travel (the

open limit switch is initially set at -90% of full travel, then the valve is stroked

electrically and valve travel measured, and the open limit switch setting is modified as

necessary to achieve the 98 to 99% travel).

2. Close limit switch: Set to allow valve to close to within 99 to 100% of full travel (but

with the limit switch set to open at no greater than 98% of full travel).

While not part of a formal procedure (rather, based on an operations group instruction

letter), auxiliary operators check the temperatures of the pump discharge lines once per shift

for evidence of backleakage of main feedwater. This monitoring is performed in response

to IE Bulletin 85-013 and Generic Letter 88-03.4
60

3.2.5.2 Frequency of test operation

The T&T valve is stroked according to the following test procedures. Note that the

turbine is not started by all tests because upstream steam supply valves are closed before

stroking the T&T valve.

Number of T&T

Procedure full strokes/pump starts Frequency

ST-3 4a/0 Refueling

ST-6 1/0 Refueling

ST-7 11/3 Refueling

ST-8 212 Quarterly

ST-1I and -13 1/0 Quarterly

ST-15 2/2 Hot standby (•quarterly)b

ST-25 1/0 Monthly

ST-27 4/2 Refueling

MI-2A and -2B 1/0 Refuelingc

MI-3A and -3B 1/0 Refuelingc

a Estimated; the procedure does not identify any stroking, but multiple signals that

cause valve opening are created.

b It is assumed that this test is performed twice per year.

cThe MI tests are performed on an alternating basis; that is, one train is tested per

refueling outage.

Total estimated test-related T&T full strokes per year: 43.

Total estimated test-related turbine starts per year 15.

3.2.5.3 Relevant operating instructions

OP-1 is the AFW system operating procedure. It includes the following guidance:

1. A precaution states that the AFW pumps should be run on recirculation flow (as

opposed to stopping and starting the pumps) during conditions when SG demand is low

to avoid hanger damage and to extend motor life. Another precaution stipulates that

AFW should be batched at -75 gal/min (under manual LCV control) to each SG to

prevent vibration damage and inadvertent swapover from the CST to ESW suction, as

well as to prevent SG nozzle cracking.

2. Following pump start, the pump is inspected locally (no specific direction provided for

the inspection).

3. A precaution states that the TDP should not be operated at <2200 rpm (the turbine idle

speed). Although not specified in the procedure, the rationale behind this limitation is to

prevent the rotational speed from approaching the TDP's first critical speed, calculated

by the vendor to be 1900 rpm.

4. A precaution states that the pump discharge lines should be <1250F. This precaution is

included to ensure against backleakage binding of the pumps. Note that Plant A is

probably less susceptible to backleakage than many other plants because its LCVs are

normally closed (some plants have only check valves between the pumps and the SGs or

main feed lines).

5. A precaution states that when admitting steam to a cold line, the steam supply valve

should be cracked manually to warm the line slowly to prevent hammering the line.
61

OP-1 also provides valve and breaker lineup and control information for system operations. The valve checklist specifies that the T&T valve is to be "Closed and

Operable", and that it is latched and the mechanical overspeed trip is reset. The procedure provides directions on starting up the TDP from the main control room and locally. It is

noted that the GV will fail open on loss of control power and that turbine speed can be

controlled locally by manually operating the T&T valve. The procedure specifies that the

T&T valve should be positioned to maintain the pump discharge pressure 100 psi greater

than the steam supply pressure if so operated.

The procedure includes a note that an auxiliary power supply to the T&T valve is

available but does not include directions on how to place it into service, nor does it include

the normal position for the manual transfer switch.

The flow controller for the GV control circuit is specified to be in "AUTO," with its

setpoint at 100% (provides a flow demand signal to the governor RGSC that is equivalent

to 880 gal/min).

Another section of the OP advises that if the turbine trips on overspeed because of the

flow controller failing to control flow automatically, the controller should be placed in

manual and the output set at 20% before restarting.

GOP-1, -2, and -3 include some of the same precautions relative to operation of the

TDP.

3.2.5.4 Comments

1. Several accident demand conditions, as well as support functions associated with the

T&T valve, are not verified by periodic testing:

a. Bypassing of the valve thermal overload switches is not verified. (The system

design causes the thermal overload switches for the T&T valve to be bypassed by

contacts that are actuated by all safety-related starts of the TDP.)

b. The automatic steam supply transfer, which is built into the design to allow the

turbine to operate in the event that its normal steam supply source is unavailable, is

not verified by testing. This automatic transfer includes an auto-closure and a

subsequent auto-open of the T&T valve. There are several tests in which the

automatic steam supply transfer should occur (although steam is isolated from the

T&T valve by MOV-9 and -10 during the tests), for example, ST-3A and -3B and

ST-7. However, there is no note or precaution in the procedures that the automatic

transfer will occur, nor is there verification that the transfer does, in fact, occur.

Several potential sources of failure are not checked in conjunction with the steam

supply transfer. In addition, some components that are checked, for instance, the

T&T valve motor, are more seriously challenged by the back-to-back stroking that is

required.

c. Proper setting and functioning of the following stem position limit switches are not

verified by surveillance testing:

*The switch that results in automatic closure of SG BDIVs and provides the

permissive to allow automatic transfer to the alternate steam supply source. (Also

note that there are several relays that must energize to cause these functions to

occur which are likewise not checked.)

* The switch that causes the TDP room ventilation fan to start.

* The switch that causes the T&T valve operator to automatically drive to the shut

position following an electronic overspeed trip.
62

2. The T&T valve is not included in the Tech Spec list of valves for which verification of

thermal overload protection operability is required (and therefore the settings of its

thermal overload heaters/switches are not checked by a surveillance test). Note that,

according to comment la, the bypassing of the thermal overload switches is also not

verified for the T&T valve. If the bypassing of the thermal overload switches were

verified, the thermal overload setting would be of less significance.

3. Automatic operation of the T&T valve closing coil to drive the motor to shut, thereby relatching the motor to the valve (and allowing the valve to automatically reopen, if the

open signal is still present), following an electronic overspeed trip is not verified.

4. The electronic overspeed trip setpoint is tested under nonoperating conditions (turbine

not running). While the ability to trip the turbine using the mechanical trip lever is

performed in ST-27, the mechanical trip setpoint is not tested periodically. Therefore,

no test verifies that the electronic overspeed trip will precede, and thereby avoid, the

mechanical overspeed trip. (Note that an electronic overspeed trip is preferred, from an

operational standpoint, because the mechanical overspeed trip requires local resetting.) 5. Only one train of the SB signal is verified to cause opening of the T&T valve in ST-7.

The test that is conducted is performed by jumpering contacts, as opposed to simulating

the signal (e.g., by deenergizing both sets of initiating relays). The train to be tested is

left to operator discretion. Although both trains of SB relays (the relays that cause

closure of the contacts noted to be jumpered above) are tested as a part of response time

testing for the MDPs (in ST-3A and -3B), the T&T valve is not verified to open.

6. With the exception of the testing of DCVs which is performed in ST- 15, the test-related

runs of the TDP are performed with only the miniflow recirculation flow path available.

There is no monitoring of the pump/turbine capability other than with minimum flow,

plus the incomplete (only flow is recorded) indication provided by ST-15.

7. The tests for the TDP, as allowed by Tech Specs, are not required unless the steam

supply pressure is >842 psig (see Tech Spec Surveillance Requirement 4.7.1.2.a.2).

However, as indicated in the "Basis" section for Tech Spec 3/4.7.1.2, the AFW system

is depended upon to provide flow to the SGs until the RCS reaches 3500F. Assuming

no temperature differential between the RCS and the secondary side of the SGs, the

corresponding saturation steam pressure would be -120 psig. There is no testing of the

TDP's ability to operate properly at reduced steam supply pressures.

3.2.6 Pump Miniflow Check Valves: C-6, -8, and -10

3.2.6.1 Surveillance and maintenance tests/inspections

ST-8 and -9 are quarterly tests in which the AFW pumps are run in recirculation only.

The MCVs are deemed to be operable in these procedures if recirculation flow, as measured

by the use of a strap-on ultrasonic flowmeter, is at least 47 gal/min for the TDP and 29/27

gal/min for MDPs A/B.
63

3.2.6.2 Frequency of test operation

The MDP MCVs are stroked according to the following procedures:

Ercednre Number of full strokes

ST-3A and -3B 5 Refueling

ST-6 5 Refueling

ST-9 1 Quarterly

ST-15 1 Hot standby (<quarterly)a

ST-16 1 Refueling

MI-2A and -2B 1 Alternate refuelingb

MI-3A and -3B 1 Alternate refuelinge

a It is assumed that this test is performed twice per year.

b The MI tests are performed on an alternating basis; that is, one train is tested per

refueling outage.

Total estimated test-related full strokes per year: The above test frequency information

would yield about 14 full strokes per year; however, the MDPs are used for protracted

periods during startups and shutdowns, with varying flow rates, with the dominant amount

of time spent at relatively low flow rates or in recirculation flow only. Thus, the valves are

stroked much more frequently than indicated by testing. Note that "full strokes" refers to

conditions when the flow rate through the valves is at or near the maximum that occurs, not

necessarily a condition where the check valve is fully open.

The TDP MCV is stroked according to the following procedures:

Procedure Number of full strokes Frequency

ST-7 3 Refueling

ST-8 2 Quarterly

ST-15 2 Hot standby (<quarterly)a

ST-27 2 Refueling

a It is assumed that this test is performed twice per year. Also note that the TDP is

not assumed to already be operating when ST-15 is performed, as are the MDPs.

Total estimated test-related full strokes per year: 15. The only time the valves would

be likely to experience full stroking would be during testing, although there might be some

infrequent operational demands that would result in substantial, if not design-basis, flow

rates through the valves. Note that "full strokes" refers to conditions when the flow rate

through the valve is at or near the maximum that occurs, not necessarily a condition where

the check valve is fully open.

3.2.6.3 Comments

The flow rates through the minimum flow lines are substantially less than current

vendor-recommended minimum flow for both the MDPs and TDP. At the minimum

acceptable flow rates through the miniflow lines of 29/27 gal/min for the MDPs and 47

gal/min for the TDP, the line velocities are 6 and 11 ft/s, respectively. Under these

conditions, and particularly in light of the fact that the miniflow orifice is immediately

upstream of the MCVs, disk oscillation would be expected.
64

The measurement of flow through the lines is by a strap-on ultrasonic flowmeter.

The test procedures do not specify exactly where to place the flowmeter. The repeatability

and accuracy of the ultrasonic flowmeter indication, in light of the lack of specification of

location as well as inherent instrumentation inaccuracy, would be expected to be relatively

poor.

3.2.7 Common Miniflow Check Valves: C-1 and -2

3.2.7.1 Surveillance and maintenance tests/inspections

ST-9 is a quarterly test in which the MDPs are run in recirculation only. The CMCVs

are deemed to have been partially stroked in this procedure if recirculation flow, as

measured by the use of a strap-on ultrasonic flowmeter, is at least 27 gal/min (MDP B).

ST-16 is performed once every 2 years for the specific purpose of demonstrating

operability of the CMCVs. The test is performed by operating both MDPs and the TDP

with only the recirculation flow path to the CST available. Flow rates are not recorded.

3.2.7.2 Frequency of test operation

The CMCVs are stroked according to the following procedures:

Procedure Number of full/partial strokes Frquency

ST-3A and -3B lop Refueling

ST-6 lOP Refueling

ST-7 3P Refueling

ST-8 2P Quarterly

ST-9 2P Quarterly

ST-15 3P Hot standby (_quarterly)a

ST-16 lF Refueling

ST-27 2P Refueling

MI-2A and -2B IP Alternate refuelingb

MI-3A and -3B 1P Alternate refuelingb

a This test is assumed to be performed twice per year.

b The MI tests are performed on an alternating basis; that is, one train is tested per

refueling outage.

Total estimated test-related strokes per year: The above test frequency information

would yield about 39 partial strokes and 1 full stroke per year, however, the MDPs are

used for protracted periods during startups and shutdowns, with varying flow rates, with

the dominant amount of time spent at relatively low flow rates or in recirculation flow only. Thus, the valves are partially stroked much more frequently than indicated by testing. Note

that "full strokes" refers to conditions when the flow rate through the valve is at or near the

maximum that occurs, not necessarily a condition where the check valve is fully open.

3.2.7.3 Comments

Running a number of pumps in recirculation simultaneously, as is done in ST-16,

does not provide a reliable indication of operability of the check valves, because flow is not

measured. To demonstrate required operability, the actual flow of each pump (or at a

minimum, the combined flow through the CMCVs) should be measured.
65

Note that the flow velocities through the CMCVs are extremely low, even under

conditions where all three AFW pumps are running simultaneously. An estimate of

velocity through only one CMCV and through both of the parallel CMCVs for various

nominal flow rates is provided below:

Flow Number of Velocity (ft/s) Velocity (ft/s)

(gal/rnin) pumps runningn both CMVs en

25 One MDP 1 0.6

40 TDP 2 1

90 All pumps 4 2

The fact that the conditions under which these valves would be stroked from shut to

open would normally be at very low velocities (including the ST-16 test, in which the

maximum expected flow is passed through the valves) suggests that the valve wear rate, as

a function of service hours, would be fairly high.

3.2.8 Pump Discharge Check Valves: C-7, -9, and -11

3.2.8.1 Surveillance and maintenance tests/inspections

ST-15, which is performed during each entry into hot standby conditions,

demonstrates that the pumps are able to deliver design-basis flow to the SGs. The test

thereby demonstrates that the DCVs stroke open sufficiently to allow the required flow to

pass through them. The total flow rates to the SGs must be >440 gal/min for the MDPs

and 2880 gal/min for the TDP.

ST-28, which is performed on a refueling frequency, calls for the disassembly and

inspection of several check valves. Note that this ST is not performed to meet a specific

Tech Spec surveillance requirement and is not required by the ASME Section XI program

but is performed as a consequence of the San Onofre water hammer event (see NUREG11901 and IE Notice 86-092). The valves are organized in groups of four. One valve out

of each group is disassembled and inspected each refueling outage; so each valve will be

inspected about every 6 years. If a valve fails to meet the acceptance criteria (see below),

all other valves in the group are to be inspected during the same outage. The DCVs, along

with the TDP SCV, make up one group of valves to be disassembled and inspected in

ST-28.

Acceptance criteria are

1. all internal parts in place and showing no signs of abnormal wear;

2. all internal locking devices, including tack welds, in place and in good condition; and

3. all internal surfaces in good condition and showing no signs of abnormal wear.

While not part of a formal procedure (rather, based on an operations group instruction

letter), auxiliary operators check the temperatures of the pump discharge lines once per shift

for evidence of backleakage of main feedwater. This monitoring is performed in response

to IE Bulletin 85-011 and Generic Letter 88-03.2
66

3.2.8.2 Frequency of test operation

The MDP DCVs are stroked according to the following procedure:

Procedure Number of full strokes Freuency

ST-15 1 Hot standby (Uquarterly)a

a It is assumed that this test is performed twice per year.

Total estimated test-related full strokes per year: 2. The only time the valves would

be likely to experience full stroking would be during testing, although there might be some

operational demands, such as total or partial loss of feedwater that would result in

substantial, if not design-basis, flow rates through the valves. Note that since the MDPs

are used during startup and shutdown periods, their DCVs would be partially stroked

frequently since the pumps are used to maintain SG level.

The TDP DCV is stroked according to the following procedure:

Procedure Number of full strokes Frequency

ST-15 2 Hot standby (_quarterly)a

a It is assumed that this test is performed twice per year.

Total estimated test-related full strokes per year: 4. The only time the valves would

be likely to experience full stroking would be during testing, although there might be some

infrequent operational demands that would result in substantial, if not design-basis, flow

rates through the valves.

3.2.8.3 Relevant operating instructions

Because the turbine-driven AFW pump would seldom be used to support

startup/shutdown evolutions, the normal operating procedures primarily affect the MDP

DCVs. The precautions noted in section 3.2.1.3 (for the pump SCVs) also apply to the

DCVs.

3.2.8.4 Comments

The function of preventing reverse flow from either a parallel AFW pump or from

main feedwater is accomplished by several valves, including the DCVs. The disassembly

and inspection performed, as well as the full-flow testing that is performed, help ensure

that the valve strokes open freely. The disassembly and inspection also provide some level

of assurance that the valve will not allow an extreme amount of reverse flow. There is no

testing which attempts to verify that each specific valve keeps reverse flow to less than

some acceptable value. However, as long as the series of valves, including, for example, a

closed LCV and its downstream check valve as well as the DCV, are demonstrated to

prevent reverse flow, it is not viewed as particularly critical that the leaktightness of a

specific valve be known.

At the maximum flow required for test conditions (220 gal/min per SG in ST-15), the

velocity through the MDP DCVs is -6 ft/s. At the flow rate associated with "batching" the

SGs during shutdown periods (75 galmin per SG, or 150 gal/min total, per OP-1 and

GOP-1 and -2), the velocity is -2 ft/s. These velocities are very low, especially

considering the location of the DCVs (see Fig. 3.5), and disk oscillation would be

expected.
67

3.2.9 Motor-Driven AFW Pump Level Control Valves: LCV-1/1A, -3/3A,

-5/5A, and -7/7A

3.2.9.1 Surveillance and maintenance tests/inspections

ST-4, which is conducted on an 18-month frequency, is a channel calibration

procedure. The procedure performs a loop calibration on the SG-level instrument loops,

from the level transmitters all the way through to the valves themselves. The procedure

verifies valve position as a function of demand throughout the demand range. It verifies

that the air supply pressures for the valve operators and the valve .P converters are correct.

It also verifies that the setpoints for the pressure switches that cause the control to transfer

from the MDLCVs to the BMDLCVs (PS-1, -3, -5, and -7) are proper. The check of the

pressure switch setpoints is redundant to a check performed in ST-18.

ST-6, which is performed every 18 months, verifies that the MDLCV and BMDLCV

controllers switch from manual to automatic and that the automatic controllers cause the

valves to open/close in response to SG level below/above setpoint, in response to

simulation of each automatic AFW actuation signal. The test is performed with the manual

isolation valves downstream of the LCVs closed, thereby preventing delivery of flow to the

SGs. The portion of the test that simulates an SB signal does so by jumpering two sets of

contacts (operated by the two undervoltage relays) which are normally open but go closed

when the associated 6.9-kV bus experiences an undervoltage condition. (Note that the

relays which deenergize to cause the contacts to close are verified to cause the MDPs to

start in MI-3, but the specific contacts that affect the MDLCVs and BMDLCVs are not

verified to operate when the relays deenergize.)

ST-10, -11, and -13 are surveillance procedures that implement valve stroke time and

remote position indication requirements of the ASME Section XI Pump and Valve IST

program. Valve stroke times for the MDLCVs and the BMDLCVs are checked, using

remote (MCB) position indication, on a quarterly basis. Valve stroke times, based on local

observation of valve stem movement, are checked every 2 years and compared with stroke

times recorded remotely. Local position is verified to agree with remote position indication

every 2 years. The maximum allowable stroke times identified for the MDLCVs and the

BMDLCVs are as follows:

Maximum Maximum

stroke time stroke time

MDLCV (s) BMDLCV (s)

LCV-1 14.4 LCV-lA 25.2

LCV-3 11.2 LCV-3A 25.3

LCV-5 15.6 LCV-5A 14.0

LCV-7 10.2 LCV-7A 15.6

The stroke time of an MDLCV is checked by first putting the valve handswitch in

MANUAL BYPASS and ramping the BMDLCV to full open. (Under these conditions, the

MDLCV solenoid is energized, keeping it closed, while its controller, which is used for

both the MDLCV and the BMDLCV, provides a maximum open signal.) The handswitch

is then placed in the MANUAL position, which deenergizes the MDLCV solenoid, causing

the MDLCV to open. Stroke time is measured during this open stroke. A similar sequence

is used for stroke time testing the BMDLCVs, except that the handswitch is transferred

from MANUAL to MANUAL BYPASS to initiate the stroke.

ST-20 is a test in which the response times of various portions of the AEW actuation

circuitry are checked. This test measures the times in conjunction with actual equipment

operations that occur when ST-6 is conducted. The times that are applicable to the
68

MDLCVs and BMDLCVs are the times from main feed pump trip until energization of

relays that result in the transfer of the valve controllers from manual to automatic.

ST-22 is an ESF response time test in which the response times for the MDLCVs are

measured. The times are measured from a simulated low-level signal input to the level

controller from the level transmitter (note that this is not the same as the low-low SG level

signal that causes AFW actuations to occur) until the MDLCVs are full open. The times are

actually measured in MI-2; in ST-22, the valve stroke response times from MI-2 are added

to the relay response times and to other portions of the channel response time (logic and

master relay response time) to calculate the total response time of the MDLCVs. The total

response times for each of the MDLCVs, as well as the TDLCVs, the MDPs, and the TDP,

are compared; and the maximum time associated with any of these components is

designated as the ESF response time for AFW.

ST-24, which is performed monthly, verifies that the controllers for the MDLCVs

and BMDLCVs respond appropriately to level deviation signals. If the test is performed

during a time when the applicable pump is being used to maintain SG level (during

shutdown), the test will use both valve position change and observed flow to verify

stroking. If the applicable pump is not in service to maintain SG level, the pumps are

simulated to be running, and valve operability is based upon indicated position change in

response to level deviation signals. The latter (pump not in service for level maintenance) will be the normal test condition.

Note that this test verifies that the controller responds to transfer of the MCB switches

from MANUAL to AUTO (with a preestablished level deviation) and also verifies

controller response to adjustment of the automatic control setpoint at the ACP.

MI-2 is a response time procedure, performed once per refueling outage (one train is

performed each outage), in which the time required for each MDLCV to stroke from closed

to open in response to a simulated low SG level signal input to the valve controller is

measured. The time is used in ST-22 to determine total AFW actuation response time.

MI-2 also checks the response time for relays that result in the transfer of the valve

controllers from manual to automatic.

MI-7 is used to verify the time delay relay associated with the automatic transfer from

the MDLCVs to the BMDLCVs times out at 15 s. The procedure does not actuate any

equipment; it only verifies relay timing. There is no designated frequency of testing.

3.2.9.2 Frequency of test operation

The MDLCVs are stroked according to the following procedures:

Procedure Number of full strokes Frequency

ST-4 1 Refueling

ST-6 6 Refueling

ST-10 and -13 1 Quarterly

ST-15 1 a,b Hot standby (a quarterly)C

ST-24 1 Monthly

MI-2A and -2B la Alternate refuelingd

a Only the MDLCVs are stroked (the BMDLCVs are not).

b This is the only test in which the valves open to allow flow.

c It is assumed that this test is performed twice per year.

d Each MDLCV is stroked once every other refueling outage.

Total estimated test-related full strokes per year: The above test frequency information

would yield about 23 full strokes per year for the MDLCVs and 21 for the BMDLCVs;
69

however, both the MDLCVs and the BMDLCVs would be used routinely to support

normal plant operation during startup and shutdown periods. Multiple partial or full strokes

would occur during these evolutions.

3.2.9.3 Relevant operating instructions

OP-1, which is the AFW system operating procedure, specifies that the level

controllers at the ACP be set for 33%.

The procedure also includes the following practices or requirements related to the

MDLCVs and BMDLCVs:

1. For startup of an MDP, the procedure advises the operator to close all LCVs, if time

permits, and to control SG level by manually throttling the associated LCVs.

2. For MDLCV manual local operation, the procedure provides directions as to the

physical location of the valves, cautions the operator to maintain flow from an MDP to

<200 gal/min in Mode 5 or 6, and has the operator maintain level by throttling either the

upstream or downstream isolation (gate) valves. A note is provided advising the

operator that the MDLCVs fail open and the BMDLCVs fail closed on loss of power or

air.

3. A precaution stipulates that AFW should be batched at -75 gal/min (under manual LCV

control) to each SG to prevent vibration damage and inadvertent swapover from the

CST to ESW suction as well as to prevent SG nozzle cracking.

3.2.9.4 Comments

All testing is performed with the MDLCV control switches in MANUAL/MANUAL

BYPASS. The normal, standby switch position is AUTO. With the switches in

MANUAL, the LCV solenoids will be continuously deenergized, and therefore valve

position will be controlled by the controller only. In normal system configuration, the LCV

solenoids are energized (and the LCVs are therefore closed) and deenergize when the

associated pump starts, thereby allowing the LCVs to modulate. The circuit change that

causes the solenoids to transfer from the energized to the deenergized state (opening of

pump breaker auxiliary contacts 52S/b) is not demonstrated.

The simulation of an SB signal to verify responses of the MDLCVs and BMDLCVs

is done by jumpering the blackout contacts that are normally open, but close in response to

loss-of-bus-voltage conditions. The contacts that are jumpered are the contacts that cause

the TDP to start as well as enabling the TDLCVs, MDLCVs, and BMDLCVs to perform

their required automatic level control functions. Although the blackout relays are verified to

deenergize to cause other contact operations (associated with the start of the MDPs) in other

procedures, the contacts that are jumpered for testing simulation purposes are not verified

to operate properly (close when the relays deenergize).

The automatic transfer from MDLCV to BMDLCV control is not demonstrated. The

pressure switches that initiate the transfer are verified to close at the correct setpoint (in

ST-4), but the pump breaker contacts (52S/a), which provide another portion of the auto

transfer permissive, as well as the relay and associated contacts that effect the transfer, are

not verified to operate. The principal significance of not testing these components is that in

the event of a faulted SG, failure of the faulted SG's MDLCV to transfer over to BMDLCV

would result in continuing flow through the larger valve to the faulted SG.

The ability of the ACCIDENT RESET switch position to transfer the controller back

to manual control in the presence of an accident signal is not demonstrated. Although the

ACCIDENT RESET switch position is used several times in the surveillance tests, the

simulated accident signal is always removed first, thereby rendering the transfer to

ACCIDENT RESET meaningless. The primary importance of being able to transfer to

manual control is to provide the operator with the capability of dealing with either a
70

situation where the controller(s) malfunctions in AUTO or where a faulted SG condition

exists and flow to the faulted SG needs to be isolated (which would not occur

automatically, since a low SG level condition would exist). Note that automatic transfer

from MDLCV to BMDLCV control should occur when the downstream pressure is <400

psig; however, this is also not demonstrated to occur.

In addition to the fact that the ACCIDENT RESET switch is not demonstrated, there

exists a design condition for which the MDLCVs cannot be reset to manual control. When

the plant has been operating at >80% load, a main feed pump trip will result in automatic

start of the AFW pumps. Even for automatic starts of the AFW pumps from other sources

(such as SI) which occur first, the feed pump trip start signal would also be generated. A

single contact, which is operated by a nonsafety-grade pressure switch that senses HP

turbine impulse pressure, would prevent transfer of any of the MDLCV controllers from

automatic to manual without additional operator intervention (such as the lifting of leads),

in the event that it sticks closed. (Note that it is set to open at <75% power.) The ability to

reset the controls to manual and isolate a faulted SG within 10 min is taken credit for in the

feedline and steamline accident analyses.

None of the surveillance tests that officially demonstrate the OPERABILITY of the

MDLCVs put any flow through the valves; however, ST-15, which is used to demonstrate

full stroking of various check valves, does demonstrate that the valves can be opened

(using the manual controls) to allow 2220 gal/min to each SG.

3.2.10 Turbine-Driven Pump Level Control Valves: LCV-2, -4, -6, and -8

3.2.10.1 Surveillance and maintenance tests/inspections

ST-4, which is conducted on an 18-month frequency, is a channel calibration

procedure. The procedure performs a loop calibration on the SG level instrument loops,

from the level transmitters all the way through to the valves themselves. The procedure

verifies valve position as a function of demand throughout the demand range. It also

verifies that the air supply pressures for the valve operators and the valve I/P converters are

correct.

ST-7, which is conducted on an 18-month frequency, verifies that the TDLCV's

controllers switch from manual to automatic and then open/close the valves in response to

level below/above control setpoint, in response to each automatic TDP start signal (except

that the blackout signal is tested on only one train). No flow is delivered in this test

because downstream isolation valves are closed. All tests are conducted with the valve

switches in "MANUAL" (the normal position is "AUTO").

ST-10, -11, and -13 are used to implement the ASME Section XI valve in-service

testing requirements. The TDLCVs are stroked once per quarter under these procedures for

remote stroke time measurement. Every 2 years, the valves are stroked for verification of

consistency between local and remote stroke time measurement and position indication. No

flow is delivered to the SGs in this test. The maximum allowable stroke times for the

TDLCVs, as identified in ST-10, are as follows:

LCV-2: 102.6 s

LCV-4: 132.0 s

LCV-6: 126.0 s

LCV-8: 112.0 s

The valves are stroked, per ST-l0, by placing the valve handswitch in MANUAL and

then ramping the valve open using the manual controls.

ST-22 is an ESF response time test in which the response times for the TDLCVs are

measured. The times are measured from a simulated low-level signal input to the level

controller from the level transmitter (note that this is not the same as the low-low SG level
71

signal that causes AFW actuations to occur) until the TDLCVs are full open. The times are

actually measured in MI-2. In ST-22, the response times for the TDLCVs, as well as those

for the MDLCVs, the TDP, and the MDPs, are compiled. The maximum time associated

with any of these components is designated as the ESF response time.

ST-24 is a monthly test by which the proper responses of the automatic controller to

above/below setpoint deviation signals are verified. Note that this test verifies that the

controller responds to transfer of the MCB switches from MANUAL to AUTO (with a

preestablished level deviation) and also verifies controller response to adjustment of the

automatic control setpoint at the ACP.

MI-2 and -3 are a series of procedures that determine response times for most reactor

protection and ESF circuits, including portions of the TDP actuation circuits. The various

portions of the ESF response time for the TDLCVs are determined. The times are compiled

in ST-22.

3.2.10.2 Frequency of test operation

The TDLCVs are stroked according to the following procedures:

Procedure Number of full strokes equency

ST-4 1 Refueling

ST-7 7 Refueling

ST-10 and -13 1 Quarterly

ST-15 2a Hot standby (<quarterly)b

ST-24 1 Monthly

MI-2A and -2B 1 Alternate refuelingc

a This is the only test in which flow through the TDLCVs is exhibited (the TDLCVs

are opened after the TDP is started, and Ž220 gal/min to each SG is verified).

b It is assumed that this test is performed twice per year.

c The MI tests are performed on an alternating basis; that is, one train is tested per

refueling outage.

Total estimated test-related full strokes per year: 26

3.2.10.3 Relevant operating instructions

See the discussion for the MDP LCVs (MDLCVs) under Sect. 3.2.9.3 above. The

comments also apply to the TDLCVs.

3.2.10.4 Comments

A check valve is provided in the control air line upstream of the accumulator

connection. The function of the check valve is to ensure that, in the event of control air

loss, the air in the accumulator will be available for valve stroking. This check valve is not

tested, nor is the ability of the accumulator (in the absence of continuing control air supply)

to stroke the LCV demonstrated periodically.

The maximum allowable stroke times for the TDLCVs established in ST-IO appear to

be very high and inconsistent with the allowable ESF response time for AFW (60 s). Also,

the response time for the TDLCVs is measured under no-flow conditions. Because these

are fail-closed valves, stroke times under flow conditions (vs no flow) would be expected

to increase.
72

The automatic pipe break detection function, which isolates the TDLCV to a faulted

SG, is not tested. Two sets of pressure switches (TDP pressure switches PS-10 and -11

and the pressure switches downstream of the TDLCVs: PS-14 and 15, PS-16 and -17,

PS-18 and -19, and PS-12 and -13), along with relays and contacts that must change state

in response to pressure switch closure, are required to operate properly in order for the

automatic isolation to occur. Although both sets of pressure switches are checked to verify

that the switches close at the proper pressure, the relays and associated contacts that

actually cause isolation are not verified. Note that even though the TDLCVs close by

design, this is not a Tech Spec required function for Plant A (faulted SG isolation is a Tech

Spec requirement for some other plants).

The ability of the ACCIDENT RESET switch position to transfer the TDLCV

controller back to manual control in the presence of an accident signal is not demonstrated.

Although the ACCIDENT RESET switch position is used several times in the surveillance

tests, the simulated accident signal is always removed first, thereby rendering the transfer

to ACCIDENT RESET meaningless. The primary importance of being able to transfer to

manual control is to provide the operator with the capability of dealing with either a

situation where the controller(s) malfunctions in AUTO or where a faulted SG condition

exists and flow to the faulted SG is not automatically isolated (note that the automatic

isolation feature is not verified).

In addition to the fact that the ACCIDENT RESET switch is not demonstrated, there

exists a design condition for which TDLCVs cannot be reset to manual control. When the

plant has been operating at >80% load, a main feed pump trip will result in automatic start

of the AFW pumps. Even for automatic starts of the AFW pumps from other sources

(such as SI) which occur first, the feed pump trip start signal would also be generated. A

single contact, which is operated by a nonsafety-grade pressure switch that senses HP

turbine impulse pressure, would prevent transfer of any of the TDLCV controllers from

automatic to manual without additional operator intervention (such as the lifting of leads),

in the event that it sticks closed. (Note that it is set to open at <75% power.) The ability to

reset the controls to manual and isolate a faulted SG within 10 min is taken credit for in the

feedline and steamline accident analyses.

No testing is conducted in which the TDLCVs are verified to open/close automatically

with their control switches in AUTO, which is the normal condition. All testing in which

the valves are stroked, whether manually or by the automatic controller, is done with the

valve control switch in MANUAL. The contacts that would open to deenergize the valves'

solenoids with the switches in AUTO are therefore never demonstrated. (Note that the

relays that operate the contacts are also not verified to operate.)

None of the surveillance tests that officially demonstrate the OPERABILITY of the

TDLCVs put any flow through the valves; however, ST-15, which is used to demonstrate

full stroking of various check valves, does demonstrate that the valves can be opened

(using the manual controls) to allow >220 gal/min to each SG.

3.2.11 Level Control Valve Check Valves: C-12, -13, -14, -15, -16, -17,

-18, and -19

3.2.11.1 Surveillance and maintenance tests/inspections

ST-1S, which is performed during each entry into hot standby conditions,

demonstrates that the pumps are able to deliver design-basis flow to the SGs. The test

thereby demonstrates that the LCVCVs stroke open sufficiently to allow the required flow

to pass through them. The total of flow rates to the SGs must be >440 gal/min for the

MDPs and >880 gal/min for the TDP.

ST-28, which is performed on a refueling frequency, calls for the disassembly and

inspection of several check valves. Note that this ST is not performed to meet a specific

Tech Spec surveillance requirement and is not required by the ASME Section XI program
73

but is performed as a consequence of the San Onofre water hammer event (see NUREG11901 and IE Notice 86-092). The valves are organized in groups of four. One valve out

of each group is disassembled and inspected each refueling outage; so each valve will be

inspected about every 6 years. If a valve fails to meet the acceptance criteria (see below),

all other valves in the group are to be inspected during the same outage. The MDP

LCVCVs (C-13, -15, -17, and -19) make up one group, and the TDP LCVCVs (C-12,

-14, -16, and -18) make up another group of valves that are disassembled and inspected in

ST-28.

Acceptance criteria are

1. all internal parts in place and showing no signs of abnormal wear;

2. all internal locking devices, including tack welds, in place and in good condition; and

3. all internal surfaces in good condition and showing no signs of abnormal wear.

3.2.11.2 Frequency of test operation

The MDP LCVCVs are stroked according to the following procedures:

Procdure Number of full strokes Frequenc

ST-15 1 Hot standby (•quarterly)a

a It is assumed that this test is performed twice per year.

Total estimated test-related full strokes per year: 2. The only time the valves would

be likely to experience full stroking would be during testing, although there might be some

operational demands, such as total or partial loss of feedwater, that would result in

substantial, if not design-basis, flow rates through the valves. Note that since the MDPs

are used during startup and shutdown periods, their LCVCVs would be partially stroked

(in manual) frequently since the pumps are used to maintain SG level. Note that "full

strokes" refers to conditions when the flow rate through the valves is at or near the

maximum that occurs, not necessarily a condition where the check valve is fully open.

The TDP LCVCVs are stroked according to the following procedures:

Procedure Number of full strokes Equency

ST-15 1 Hot standby (•quarterly)a

a It is assumed that this test is performed twice per year.

Total estimated test-related full strokes per year: 4. The only time the valves would

be likely to experience full stroking would be during testing, although there might be some

occasional operational demands, such as total or partial loss of normal feedwater, that

would result in substantial, if not design-basis, flow rates through the valves. Note that

"full strokes" refers to conditions when the flow rate through the valves is at or near the

maximum that occurs, not necessarily a condition where the check valve is fully open.

3.2.11.3 Relevant operating instructions

Because the turbine-driven AFW pump would seldom be used to support

startup/shutdown evolutions, the normal operating procedures primarily affect the MDP
74

LCVCVs. The precautions noted in section 3.2.1.3 (for the pump SCVs) also apply to the

LCVCVs.

3.2.11.4 Comments

The batch flow rate that is specified by the operating procedures for the AFW lines to

the SGs during startup/shutdown (75 gal/min) corresponds to a flow velocity of 2 ft/s.

This low flow rate (and complicated by the piping configuration for the "A" pump lines - see Fig. 3.7) would be expected to contribute to disk oscillation and wear.

The function of preventing reverse flow from either a parallel AFW pump or from the

main feedwater system is accomplished by several valves, including the LCVCVs. The

disassembly and inspection performed, as well as the full-flow testing that is performed,

help ensure that the valve strokes open freely. The disassembly and inspection also

provide some level of assurance that the valve will not allow an extreme amount of reverse

flow. There is no testing which attempts to verify that each specific valve keeps reverse

flow to less than some acceptable value. However, as long as the series of valves,

including, for example, the combination of a closed LCV, the associated LCVCV, and the

pump discharge check valve, are demonstrated to prevent reverse flow, it is not particularly

critical that the leaktightness of a specific valve be known.

The requirement to inspect the TDP LCVCVs at the same frequency as the MDP

LCVCVs does not appear supportable from the standpoint of susceptibility to operationally

induced wear. It would appear that less emphasis on the TDP LCVCVs would be

reasonable (perhaps only disassemble and inspect one valve every other refueling outage).

3.2.12 SG B and C AFW to Main Feed Check Valves: C-21, -22, -24, and

-25

3.2.12.1 Surveillance and maintenance tests/inspections

ST-15, which is performed during each entry into hot standby conditions,

demonstrates that the pumps are able to deliver design-basis flow to the SGs. The test

thereby demonstrates that the MFCVs stroke open sufficiently to allow the required flow to

pass through them. The total of flow rates to the SGs must be >440 gal/min for the MDPs

and >880 gal/min for the TDP.

ST-28, which is performed on a refueling frequency, calls for the disassembly and

inspection of several check valves. Note that this ST is not performed to meet a specific

Tech Spec surveillance requirement and is not required by the ASME Section XI program

but is performed as a consequence of the San Onofre water hammer event (see NUREG11901 and IE Notice 86-092). The valves are organized in groups of four. One valve out

of each group is disassembled and inspected each refueling outage; so each valve will be

inspected about every 6 years. If a valve fails to meet the acceptance criteria (see below),

all other valves in the group are to be inspected during the same outage. The MFCVs make

up one group of valves that are disassembled and inspected in ST-28.

Acceptance criteria are

1. all internal parts in place and showing no signs of abnormal wear,

2. all internal locking devices, including tack welds, in place and in good condition; and

3. all internal surfaces in good condition and showing no signs of abnormal wear.
75

3.2.12.2 Frequency of test operation

The MFCVs are stroked according to the following procedures:

Procedure Number of full strokes euency

ST-15 3 Hot standby (•quarterly)a

aIt is assumed that this test is performed twice per year.

Total estimated test-related full strokes per year: 6. The only time the valves would

be likely to experience full stroking would be during testing, although there might be some

operational demands, such as total or partial loss of feedwater, that would result in

substantial, if not design-basis, flow rates through the valves. Note that since the MDPs

are used during startup and shutdown periods, the MFCVs would be partially stroked

frequently since the pumps are used to maintain SG level.

3.2.12.3 Relevant operating instructions

See the precautions noted in section 3.2.1.3 (for the pump SCVs). The MFCVs

would be most frequently exposed to flow rates of -75 gal/min.

3.2.12.4 Comments

The velocity at the MFCVs during the "batching" of AFW to the SGs at 75 gal/min

would be about 2.4 ft/s, which is less than that required to fully open the MFCVs. In

addition, as noted previously, disk oscillation due to turbulence would be expected in light

of the piping configuration. However, the combination of disassembly and inspection and

flow monitoring appear to provide reasonable assurance that degradation of these valves

would be detected and corrected.

3.2.13 Main Feedwater Check Valves: C-20, -23, -26, and -27

3.2.13.1 Surveillance and maintenance tests/inspections

ST-29, which is performed during cold shutdown with the SGs depressurized,

verifies closure of the FWCVs by monitoring the extent of backleakage of water from the

SGs. The test acceptance criteria allow a leak rate of about 16 gal/min.

ST-28, which is performed on a refueling frequency, calls for the disassembly and

inspection of several check valves. Note that this ST is not performed to meet a specific

Tech Spec surveillance requirement and is not required by the ASME Section XI program

but is performed as a consequence of the San Onofre water hammer event (see NUREG11901 and IE Notice 86-092). The valves are organized in groups of four. One valve out

of each group is disassembled and inspected each refueling outage; so each valve will be

inspected about every 6 years. If a valve fails to meet the acceptance criteria (see below),

all other valves in the group are to be inspected during the same outage. The FWCVs make

up one group of valves to be disassembled and inspected in ST-28.

Acceptance criteria are

1. all internal parts in place and showing no signs of abnormal wear;

2. all internal locking devices, including tack welds, in place and in good condition; and

3. all internal surfaces in good condition and showing no signs of abnormal wear.
76

3.2.13.2 Frequency of test-related operation

The FWCVs are not stroked for test purposes. The normally open valves would

close when normal feedwater flow to the SGs is terminated, either during routine plant

shutdown or following certain transients, such as loss of feedwater or feedwater isolation.

3.2.13.3 Comments

As noted above, the test that checks for backleakage (ST-29) allows up to about 16

gal/min seat leakage under depressurized conditions where the only driving force is the

elevation head associated with the water level in the SGs.

Assuming that (1) the reverse flow rate through the check valve is proportional to the

square root of the pressure drop and that (2) the valve disk/seat geometry is not affected by

the difference between test and demand pressure and temperature conditions, the 16 gal/min

allowable backleakage under depressurized conditions would correspond to about 130

gal/min per SG at the pressure of the lowest SG safety valve. This appears to be

unacceptable.

3.2.14 Feedwater Isolation Valves: FWIV-1, -2, -3, and -4

3.2.14.1 Surveillance and maintenance tests/inspections

ST-10, -11, and -13 are surveillance procedures that implement valve stroke time and

remote position indication requirements of the ASME Section XI Pump and Valve IST

program. Valve stroke times for the FWIVs, based on remote (MCB) indication, are

measured quarterly. Stroke time is measured by turning the handswitch to closed and

measuring the time until the valve-open indicating light is off and the closed indicating light

is on. The maximum allowable stroke time for the FWIVs is 7.5 s.

MI-4 is a procedure that provides instructions on the testing of motor-operated valves

using the MOVATS system, which is used to assess the general mechanical and electrical

control conditions of the valves.

MI-5 is a preventive maintenance procedure for LIMITORQUE actuators which is

used to maintain equipment qualification. It provides for inspection and cleaning of

electrical components; cleaning, inspection, and relubrication of the geared limit switch

train; inspection and replacement (if needed) of gaskets; setting of the limit switch

positions, according to MI-6B; measurement of resistance from each phase to ground from

the supply breaker; inspection and replacement (if needed) of the operator lubricant;

cleaning and relubrication of the valve stem; lubrication of the sleeve top bearing (if a

grease fitting is provided); inspection of the shaft seal for excessive leakage; and inspection

of the spring pack for hardened grease.

MI-6B is a corrective maintenance procedure that is used periodically (as invoked by

MI-5) to adjust motor-operated valve limit and torque switch settings. Limit switch

settings, which can be set based either on valve travel measurement or the number of

handwheel turns, are set as follows:

1. Open limit switch: Set such that the valve will open to within 98 to 99% of full travel,

where "full travel" is the distance from valve to seat contact (closed) to backseat contact

(open).

2. Close limit switch: Set such that the valve will close to within 99 to 100% of full travel.
77

3.2.14.2. Frequency of test-related operation

The FWIVs are stroked according to the following procedures:

Procedure Number of full strokes ErgquenU

ST-3A and -3B 4 Refueling

ST-10 and -13 1 Cold shutdowns

ST-29 1 Cold shutdowns

a Assumed to occur once per year (in addition to refueling outages).

Total estimated test-related full strokes per year: 5

3.2.14.3 Relevant operating instructions

From an AFW perspective, the operating procedures of importance are the emergency

operating procedures. Emergency procedures require early verification of closure of the

FWIVs. The emergency procedure that is initially used for normal posttrip purposes, EOP1, "Reactor Trip or SI," has the operator verify that the FWIVs (and upstream main feed

control valves) are closed as one of the early actions (Step 7). Main feed isolation is also

verified in step 3 of EOP-2, "Reactor Trip Response." EOP-2 would be transitioned into

from EOP-1 following a reactor trip without safety injection being required. While the

checks in these two procedures are the primary means by which the operator is instructed to

ensure that the FWIVs are closed, main feed isolation is also verified in other procedures

that may be transitioned into as conditions dictate (e.g., step 2 of E-2, "Faulted SG

Isolation").

3.2.14.4 Comments

The power supplies for the motor-operated FWIVs at Plant A are not strongly tied to

the AFW system. For instance, the FWIV to SG B is operated by a motor powered off of a

"B" train bus, while SG B is fed by MDP A, which is powered from an "A" train bus. A

similar circumstance exists for the SG C FWIV (powered from "A" train) and the AFW

pump used to feed SG C ("B" pump). Also, as at most plants, the signals that

automatically start the AFW pumps do not provide a close signal to the FWIVs.

From a feedline break perspective, the function of these valves is fairly important.

The San Onofre event is a good example of the importance that these valves have in

assuring that AFW is actually delivered to the SGs. The FWIVs are not leak-rate checked;

however, the fact that they are gate valves should minimize the probability of excessive seat

leakage.

3.2.15 SG Blowdown Isolation Valves: BDV-1, -2, -3, and -4

3.2.15.1. Surveillance tests

ST-10, -11, and -13 are surveillance procedures that implement valve stroke time and

remote position indication requirements of the ASME Section XI Pump and Valve IST

program. Valve stroke times for the BDIVs, based on remote (MCB) indication, are

measured quarterly. Stroke time is measured by turning the hand switch to closed and

measuring the time until the valve open indicating light is off and the closed indicating light

is on. Note that the test instructions do not advise the operator to maintain the switch in the

"Open" position when reopening the valve (or initially opening it for stroke time
78

measurement). Note that the BDIVs do not have a seal-in circuit, and therefore require that

the operator hold the switch to "Open" until the valve is fully open. (The reason that this is

noteworthy is that the stroking procedures for other valves that have the seal-in circuit,

such as FCV-1-17 and -18, do advise the operator to hold the switches during stroking).

The maximum allowable in-service test stroke times for the BDIVs follow:

BDV-1: 7.2 s

BDV-2: 10.0 so

BDV-3: 7.4 s

BDV-4: 10.0 so

ST-3A and -3B are tests that verify automatic operation of plant equipment in

response to various simulated conditions, including SI, loss of offsite power, and Phase A

containment isolation. These tests are performed on an 18-month frequency, during Mode

5 (cold shutdown). The BDIVs are verified to close during the Phase A isolation signal

portion of the test. The test does not specifically call for the BDIVs to be reopened

following the Phase A sequence. Subsequent test sequences, such as the SI sequence,

result in the generation of a closure signal to the BDIVs (because the AFW pumps start on

an SI signal and because an SI signal causes a Phase A isolation signal). However, closure

is not verified in the test, and, in fact, it is probable that the BDIVs would not be reopened

after the Phase A isolation test.

3.2.15.2 Frequency of test operation

The BDIVs are stroked according to the following procedures:

Procedure Number of full strokesa Frequency

ST-3A and -3B 2 Refueling

ST-7 1 Refueling

ST-8 1 Quarterly

ST-9 1 Quarterly

ST-10 and -13 1 Quarterly

ST-15 1 Hot standby (•quarterly)b

ST-25 1 Monthly

ST-27 1 Refueling

a Stroking of the valves is only called for in ST-10 and -13 and ST-3A and -3B;

however, valve stroking should occur automatically in the other procedures because the

AFW pumps are started. Note that there are other tests conducted during refueling

shutdowns that cause AFW pumps to start, and thus cause closure signals to be sent to the

BDIVs; however, since SG blowdown would normally be secured during this time, there

is no stroking assumed.

b It is assumed that this test is performed twice per year.

Total estimated test-related full strokes per year: The above test frequency information

would yield about 29 full strokes per year; however, the BDIVs would also be stroked

open and closed during plant startup and shutdown.

*Based on Technical Specification limitations.
79

3.2.15.3 Relevant operating instructions

OP-2 is the SG blowdown operating procedure. It specifies a maximum blowdown

flow rate of 75 gal/min per SG. Per OP-2, the BDIVs are closed whenever blowdown is

secured. However, the procedure specifically instructs that the BDIVs are not to be used to

secure blowdown, rather that they are to be closed after blowdown is secured (flow is

isolated by a common downstream regulating valve). The procedure also specifies that the

BDIVs not be used to place blowdown in service. Blowdown is placed in service by

initially opening one SG BDIV (and inside isolation valve) to pressurize the piping

upstream of the common line isolation valve, then opening the BDIVs from the other SGs,

and finally opening the common regulating valve. (One of the intents of this sequence is to

minimize water hammer associated with either securing blowdown or placing it in service.)

GOP-1, which is the general operating instruction for taking the plant from cold

shutdown to hot standby, specifies that blowdown is to be placed into service when the

RCS is -200 0F.

GOP-3, which is the general operating instruction for taking the plant from minimum

load to cold shutdown, specifies that blowdown is to be secured when the RCS is <2000F.

The emergency procedures, which are based on generic Westinghouse guidelines,

frequently associate the SG blowdown valves with AFW. For example, in EOP-0

("Reactor Trip or SI Emergency Procedure"), the procedural instructions that "Verify AFW

Status" include the following conditions for verification:

AFW pumps - RUNNING

AFW LCVs in AUTO

If SG level < 33%, then verify AFW flow

SG blowdown valves - CLOSED

3.2.15.4 Comments

The BDIVs are not verified to close in response to start of the AFW pumps. There is

not a specific Tech Spec requirement that requires BDIV closure in response to an AFW

pump start. However, failure of the BDIVs to close would substantially diminish the

effective flow delivery capability of the AFW pumps. The impact that blowdown has on

AFW is implicitly confirmed by the inclusion of blowdown isolation verification under the

heading of "AFW Status" in the emergency procedures. The impact of unisolated

blowdown can, in part, be gathered from the 1985 water hammer event at San Onofre (See

NUREG-1 1901).

The fact that verification of blowdown isolation is included in the emergency

procedures under "AFW Status," which is checked at an early point in the procedures,

provides some assurance that the valves will be closed following a transient-induced reactor

trip (whether as a direct result of the AFW pumps starting or as a result of operator action).

The stroke testing of the BDIVs, which is done as a part of the ASME Section XI

program, strokes the valves manually and does so by use of the ganged switch that controls

not only the BDIV but the inside containment isolation valve as well. The flow conditions

under which the BDIVs are stroked are not specified. The ability of the BDIVs to close and

the speed with which they would close depends, in part, on the extant flow and pressure

conditions. The worst case conditions under which the valves would have to close would

be at high pressure and flow, and without the assistance provided by the simultaneous

closure of the inside containment isolation valves. (These valves only close on a Phase A

isolation, which in turn, only occurs automatically as the result of an SI. Note that design-
80

basis demand conditions for the BDIVs, and the AFW system, correspond to heat-up

conditions that would not necessarily cause an SI.) The testing that demonstrates

operability of the BDIVs causes both the BDIVs and the inside containment isolation valves

to close and is performed under nominal pressure/flow conditions.

3.2.16 AFW Turbine Steam Supply Valves: MOV-11 and -12

3.2.16.1 Surveillance and maintenance tests/inspections

ST-10, -11, and -13 are surveillance procedures that implement valve stroke time and

remote position indication requirements of the ASME Section XI Pump and Valve IST

program. Valve stroke times for MOV-1 1 and -12, based on remote (MCB) indication, are

measured quarterly. MOV-1 1 is stroke time tested from open to closed by turning the valve

hand switch to the CLOSE position and holding the switch in CLOSE until the valve open

indicating light is off and the closed indicating light is on. MOV-12 testing is similar,

except that it is stroke-timed from closed to open. It is noteworthy that by keeping the

valve hand switches in the CLOSE or OPEN position until valve travel is complete, the

seal-in features of the valve open and close coils are not demonstrated. Valve stroke times,

based on local observation of valve stem movement, are checked every 2 years and

compared with stroke times recorded remotely. Local position is verified to agree with

remote position indication every 2 years. The maximum allowable stroke times for the

SSVs are 15.9 s for MOV-1 1 and 20.0 s for MOV-12.

ST-23, which is performed every 18 months, verifies that the thermal overload

heaters are operating properly. The thermal overload trip time at rated full load current is

demonstrated to be greater than twice the maximum allowable stroke time, and the trip time

at locked rotor current is demonstrated to be between 10 and 15 s.

MI-4 is a procedure that provides instructions on the testing of motor-operated valves

using the MOVATS system, which is used to assess the general mechanical and electrical

control conditions of the valves.

MI-5 is a preventive maintenance procedure for LIMITORQUE actuators that is used

to maintain equipment qualification. It provides for inspection and cleaning of electrical

components; cleaning, inspection, and relubrication of the geared limit switch train;

inspection and replacement (if needed) of gaskets; setting of the limit switch positions, per

MI-6A; measurement of resistance from each phase to ground from the supply breaker,

inspection and replacement (if needed) of the operator lubricant; cleaning and relubrication

of the valve stem; lubrication of the sleeve top bearing (if a grease fitting is provided);

inspection of the shaft seal for excessive leakage; and inspection of the spring pack for

hardened grease.

MI-6A is a corrective maintenance procedure that is used periodically (as invoked by

MI-5) to adjust motor-operated valve limit and torque switch settings. Limit switch

settings, based either on valve travel measurement or the number of handwheel turns, are

set as follows: (1) open limit switch set to open at 95 to 98% of valve travel, and (2) close

limit switch set to open at 97 to 98% of valve travel.

MI-8 is used to verify the time delay relay associated with the automatic steam supply

transfer times out at 60 s. The procedure does not actuate any equipment; it only verifies

timing. There is no designated frequency of testing. A commitment to periodically calibrate

the timers was made in a licensee event report filed by Plant A.
81

3.2.16.2 Frequency of test operation

The SSVs are stroked according to the following procedures:

Procedure Number of full strokesa Feuency

ST-6 1 Refueling ST-7 1 Refueling ST-8 1 Quarterly ST-10 and -13 1 Quarterly

ST-15 1 Hot standby (_quarterly)b

ST-25 1 Monthly ST-27 1 Refueling

MI-2A and -2B 1 Refueling

MI-3A and -3B 1 Refueling

a Stroking of the valves is only called for in ST-10 and -13 and MI-2A and -B;

however, valve stroking should occur automatically in the other procedures because the

T&T valve will open, but the turbine will not roll.

b It is assumed that this test is performed twice per year.

Total estimated test-related full strokes per year 25

3.2.16.3 Relevant operating instructions

OP-1 is the AFW operating procedure. In the valve checklist portion of the

procedure, the "Required Position" for MOV-1 1 and -12 is listed as "Operable," with a

footnote that states: "If steam supply is aligned from S/G A, MOV-l1 will be open and

MOV-12 will be closed. If steam supply is aligned from S/G D, MOV-12 will be open and

MOV-1 1 will be closed."

The procedure does not provide direction for the steam supply transfer sequence.

The knowledge that both steam supply valves cannot be open simultaneously may be

considered "skill of the craft"; however, it would appear prudent to either include provision for accomplishing the transfer in the procedure or a precaution noting the existence of the

interlock.

3.2.16.4 Comments

The normal AFW operating procedure (OP-1) allows for a normal standby condition

where SG D is the steam supply source to the AFW turbine. If the plant were operated in

this condition, it would be susceptible to credible accident conditions outside of the

analyzed bounds.* An example is a feedline break in SG D with a single failure of loss of

"A" train ac (or loss of dc, which would also cause loss of ac) power. This would result in

only the "B" AFW pump being available for service, and with only one intact SG (SG C)

serviced by the "B" pump. The loss of ac power would prevent the "A" pump from

operating and would also prevent remote switchover from SG D to SG A as the steam

supply for the TDP (steam supply valves are powered from the "A" train).

*This problem was independently identified by utility personnel after the completion

of ORNL's review of procedures. OP-1 now specifies that an LCO must be entered if the

AFW system alignment is configured with SG D as the available steam supply source for

the turbine.
82

There is no testing that demonstrates the automatic steam supply transfer function.

As a result, there are three relays and numerous contacts associated with the automatic

transfer function that are not verified to operate properly. The apparent basis for not testing

the automatic transfer is that it is assumed that operator action switches over to the alternate

supply source. However, there are no specific steps in any normal, abnormal, or

emergency procedure to so direct. It could possibly be argued that this is "skill of the craft"

knowledge. In light of the fact that the interlock preventing both valves from being open

simultaneously is not mentioned in any operating procedure, as well as the fact that the

automatic transfer is not even mentioned in the FSAR, this appears to be a somewhat

debatable proposition. Although not used to demonstrate operability of MOV-11 and -12, ST-1S

demonstrates that each steam supply line provides sufficient steam to the turbine to allow

the TDP to deliver >220 gal/min to each SG (the test is run to prove full-open stroking of

check valves C-28 and C-29). Note that the procedure includes the following directives

relative to transferring the turbine steam supply source from SG A to SG D:

1. Manually close T&T using HS-T&T located on M-3.

2. Close MOV-I 1 and verify MOV-12 automatically opens.

The closure of the T&T valve will most likely prevent the automatic transfer from

occurring (depending on the relationship of discharge pressure and T&T valve position - if

the T&T valve bc contacts close before discharge pressure drops below 100 psia, the

automatic transfer will not occur, alternatively, if discharge pressure drops below 100 psia

before the T&T valve bc contacts close, then the automatic transfer should occur). Note

that the Plant A FSAR does not discuss the automatic steam supply transfer design. The

FSAR does take credit for operator action, in a general sense, in that auxiliary feedwater is

assumed to be initiated 10 min after the trip with the feed rate of 440 gal/min. The specific

operator actions that are required are not identified.

As a general comment on the design configuration, it is noted that this is not a normal

arrangement for AFW turbine steam supply systems. At most plants, either both valves

would be normally open, and the T&T valve shut, or the T&T valve would be open and

both steam supply valves shut. In the latter case, the normal design would call for both

steam supply valves to open on an automatic start signal. There are advantages to each

design. The Plant A design provides protection against blowing down two SGs in the

event of a secondary system pipe or valve failure by ensuring that both AFW turbine steam

supply valves are not open simultaneously. Other designs depend solely on the check

valves that are in series with the isolation valves to provide automatic protection against the

possibility of blowing down two SGs. On the other hand, the Plant A design effectively

lacks redundancy of steam supply sources, since the ability to open MOV-12 depends on

MOV- 11 being closed.

3.2.17 AFW Turbine Steam Supply Isolation Valves: MOV-9 and -10

3.2.17.1 Surveillance and maintenance tests/inspections

ST-10, -11, and -13 are surveillance procedures that implement valve stroke time and

remote position indication requirements of the ASME Section XI Pump and Valve IST

program. Valve stroke times for MOV-9 and -10, based on remote (MCB) indication, are

measured each time the plant is put in cold shutdown. The valves are stroke time tested

from open to closed by turning the valve hand switch to the CLOSE position and holding

the switch in CLOSE until the valve open indicating light is off and the closed indicating

light is on. Note that by keeping the valve hand switches in the CLOSE position until valve

travel is complete, the seal-in features of the valve close coils are not demonstrated. Valve

stroke times, based on local observation of valve stem movement, are checked every 2
83

years and compared with stroke times recorded remotely. Local position is verified to

agree with remote position indication every 2 years. The maximum allowable stroke time

for the SSIVs is 10 s (based on design criteria).

ST-23, which is performed every 18 months, verifies that the thermal overload

heaters are operating properly. The thermal overload trip time at rated full load current is

demonstrated to be greater than twice the maximum allowable stroke time, and the trip time

at locked rotor current is demonstrated to be between 10 and 15 s.

MI-9 is the procedure by which the temperature switches are calibrated. Each switch

is calibrated once per refueling cycle. The calibration only verifies proper setpoints for the

switches (automatic valve closure is not verified).

MI-4 is a procedure that provides instructions on the testing of motor-operated valves

using the MOVATS system, which is used to assess the general mechanical and electrical

control conditions of the valves.

MI-5 is a preventive maintenance procedure for LIMITORQUE actuators and is used

to maintain equipment qualification. It provides for inspection and cleaning of electrical

components; cleaning, inspection, and relubrication of the geared limit switch train;

inspection and replacement (if needed) of gaskets; setting of the limit switch positions, per

MI-6A; measurement of resistance from each phase to ground from the supply breaker,

inspection and replacement (if needed) of the operator lubricant; cleaning and relubrication

of the valve stem; lubrication of the sleeve top bearing (if a grease fitting is provided);

inspection of the shaft seal for excessive leakage; and inspection of the spring pack for

hardened grease.

MI-6A is a corrective maintenance procedure that is used periodically (as invoked by

MI-5) to adjust motor-operated valve limit and torque switch settings. Limit switch

settings, which can be set based either on valve travel measurement or the number of

handwheel turns, are set as follows:

1. Open limit switch: Set to allow valve to open to within 98 to 99% of full travel (the

open limit switch is initially set at -90% of full travel, then the valve is stroked

electrically and valve travel measured, and the open limit switch setting is modified as

necessary to achieve the 98 to 99% travel).

2. Close limit switch: Set to allow valve to close to within 99 to 100% of full travel (but

with the limit switch set to open at no greater than 98% of full travel).

3.2.17.2. Frequency of test-related operation

The SSIVs are stroked according to the following procedures:

Procedure Number of full strokes Frequency

ST-3A and -3B 2 Refueling

ST-6 1 Refueling ST-7 la Refueling

ST-8 1 Quarterly

ST-10 and -13 1 Cold shutdownb

ST-10 and -13 for T&T valve lc Quarterly

ST-14 1 Quarterly

ST-25 1 Monthly

a Only one of the two valves is designated to be stroked.

b It is assumed that this test is performed twice per year.

c Only MOV-9 is designated to be stroked.
84

Total estimated test-related full strokes per year. The above test frequency information

would yield about 25 full strokes per year for MOV-10 and 29 full strokes per year for

MOV-9; however, these valves are likely to be stroked more frequently, since they would

be probable candidates to isolate steam from the AFW turbine for clearance purposes.

3.2.17.3 Relevant operating instructions

OP- 1 and -6 (both procedures specify valve and breaker positions).

3.2.17.4 Comments

The automatic isolation feature associated with these valves is not demonstrated.

Although not used to demonstrate operability of MOV-9 and -10, ST-15 demonstrates

that the steam supply line provides sufficient steam to the turbine to allow the TDP to

deliver >220 gal/min to each SG.

3.3 FAILURE MODES AND FEATURES THAT ARE NOT DETECTABLE

BY CURRENT MONITORING PRACTICES

The review of the cooperating utility's design and the current operation, maintenance,

and surveillance procedures provided the basis for an assessment of the detectability of

potential sources of component and system degradation or failure by current programmatic

monitoring practices.

An assignment of potential failure modes for each of the AFW system components

was made based upon the specific design functions of the component. For each failure

mode, a determination was made of the extent to which the failure would be detectable.

Note that the failure modes assigned are very specific to the system function of each

particular component; thus two physically identical components may have different failure

modes.

Tables 3.1-3.17 summarize the designated failure modes and associated areas of

failure nondetectability.

To gain at least a measure of perspective, the results of the nondetectability review for

Plant A were discussed with individuals from a plant operated by another utility. This plant

will be designated as the "Comparison Plant." Because of design differences between the

two plants, several of the designated failure modes are not applicable at the Comparison

Plant. Conversely, the Comparison Plant would have some failure modes that are not

applicable at Plant A (note that a detailed list of failure modes for the Comparison Plant was

not established). For those failure modes that are applicable to both, it was found that

monitoring practices at the Comparison Plant would detect many of the failure conditions

that are apparently not detectable at Plant A. Two notable areas of nondetectability that are

common to both plants relate to (1) the ability of the AFW pumps to function properly

when either operating simultaneously or when using the alternate source of water and (2)

the ability of the turbine-driven pump to satisfactorily perform under low steam supply

pressure conditions.
Table 3.1. Pump suction check valves (SCV): C-4 (motor-driven pump A), C-3

(motor-driven pump B), and C-5 (turbine-driven pump)

Failure mode Nondetectability

1. The SCV fails closed, preventing flow

from the CST reaching the pump

suction.

2. The SCV fails to open sufficiently to

allow required flow to the pump suction.

None. Failure to open would be observed during any of the TDP or MDP starts.

(a) This should be observed, to an extent, during the full flow testing of the AFW

pumps. It should be noted, however, that degradation could occur without

observation, since neither pump flow nor differential pressure, which would

be rough indicators of the general flow path conditions, are not monitored.

Rather, the only parameters monitored are flows to the SGs, and even that is

not quantified, except that flow to each SG is >220 gpm.

0,

Lfn

(b) The MDP SCVs are not included in the periodic disassembly and inspection

program (ST-28), even though they would be more subject to wear than the

TDP SCV (which is included in ST-28). In this context, it should also be

noted that failure of an MDP SCV to open sufficiently to allow required flow

would result in a degraded suction pressure condition at the pump that would

not be detected by the suction pressure switches, which are located upstream of

the SCVs for the MDPs.

3. The SCV fails to close when the ESW

suction valves open to provide flow to

the pump suction.

Failure to close would be noted during the quarterly testing, which demonstrates

closure. However, gradual degradation of the MDP SCVs might not be noticed,

since they are not included in the periodic disassembly and inspection program

(ST-28).
Table 3.2. Emergency service water (ESW) to motor-driven pumps supply valves

MOV-1, -2, -3, and -4

Failure mode Nondetectability

1. Valve operator fails to open in response

to a low-pressure condition at the pump

suction.

(a) It appears that only one of three possible logic coincidences is verified to result

in an open signal. Also, not all conditions that cause low suction pressure

(such as improperly positioned or broken manual valves and stuck-closed

suction check valves) are detectable by the existing design. It is doubtful that

operator intervention would be rapid enough to avoid pump cavitation and/or

binding, and the potential associated damage, given the existence of only a

single annunciator and no other control room indication.

(b) As noted in the discussion for the SCVs (Sect. 3.3.1), a low-pressure

condition could exist at an MDP suction without being detected by the suction

pressure switches if, for example, the SCV failed to open sufficiently or if the

manual suction isolation valve were improperly positioned.

(c) The upstream valves (MOV- 1 and -3) are not restroked after reconnecting the

control circuit leads following testing of MOV-2 and -4 in ST-6, thereby

creating the potential for improper reconnection going undetected until the next

test.

0

0'

2. With the ESW valves opened,

insufficient flow is available.

3. The opening sequence and associated

response time result in pump damage

and/or turbine overspeed tripping.

There is no test that verifies flow, which would be a direct indication of adequate

valve opening, as well as an indication that the piping is sufficiently clear to allow

the required flow (which is of some concern because the ESW water is lake water,

and the piping is therefore subject to general corrosion, Asiatic Clam buildup, and

the collection of other foreign material). The valve stroking that is done under the

ASME Section XI program does check stroke time from closed to open quarterly

and verifies that remote position indication is consistent with local position

indication every 2 years.

Because a switchover to ESW is never actually tested (with good reason), the

ability of the switchover to occur smoothly is not demonstrated. While this is

probably more a design concern than an aging concern, it would appear to be a

substantial system challenge to complete the transfer under the most severe,

credible circumstances (seismic event) without at least temporary pump loss.
Table 3.3. Emergency service water to turbine-driven pump suction isolation

valves: MOV-5, -6, -7, and -8

Failure mode Nondetectability

1. Valve operator fails to open in response

to a low-pressure condition at the pump

suction.

2. With the ESW valves opened,

insufficient flow is available.

3. MOV-7 and -8 fail to close in response to

an automatic close signal.

4. The opening sequence and response time

result in pump damage and/or turbine

overspeed tripping.

None noted.

There is no test that verifies flow, which would be a direct indication of adequate

valve opening, as well as an indication that the piping is sufficiently clear to allow

the required flow (which is of some concern because the ESW water is lake water,

and the piping is therefore subject to Asiatic clam buildup or the collection of other

foreign material). The valve stroking that is done under the ASME Section XI

program does check stroke time from closed to open quarterly and verifies that

remote position indication is consistent with local position indication every 2 years.

Automatic closure of these valves is not included as an acceptance criterion in any

test. ST-7 does include a note that the valves will close after opening; however, it

is not an acceptance criterion.

Because a switchover to ESW is never actually tested (with good reason), the

ability of the switchover to occur smoothly is not demonstrated. While this is

probably more a design concern than an aging concern, it would appear to be a

substantial system challenge to complete the transfer under the most severe,

credible circumstances (seismic event) without at least temporary pump loss.
Table 3.4. Motor-driven AFW pumps

Failure mode Nondetectability

1. Pump fails to start upon demand.

2. Pump fails to continue to run after

starting.

3. Pump fails to load shed upon demand.

4. Pump fails to deliver required flow to the

SGs.

5. Pump auxiliary contacts fail to provide

required control inputs to other

automatically actuated equipment.

None noted.

The ability of the pumps to continue to operate satisfactorily during and following

transfer of the suction source to ESW is not demonstrated by surveillance testing.

None noted.

There is apparently no testing that verifies that an MDP can deliver the required

flow to its two SGs at the required pressure conditions. ST-15 does verify that

each MDP can deliver >440 gal/min total flow to two SGs, but does not monitor

actual flow, SG pressure, or developed pump head. Also, there is no testing that

verifies proper operation of the AFW pumps when all the pumps are operating

simultaneously. It should also be noted that operating procedure guidance appears

to require that the operators leave the MDPs running on recirculation flow when

not batching the SGs. This practice would result in accumulated pump wear due to

the low flow operation that would not necessarily be detected by the ST-15 testing

because only flow is monitored.

Auxiliary contacts used to provide control signals to the MDP level control valves,

the alternate suction source valves, and SG blowdown valves are apparently not

verified to function properly.
Table 3.5. Turbine-driven AFW pump

Failure mode Nondetectability

1. T&T valve operator fails to open in

response to an automatic AFW turbine

start signal. (Turbine fails to start on

demand.)

2. T&T valve operator fails to complete

the close-open strokes in response to

the automatic steam supply transfer

signal (fails to close or fails to reopen).

3. Valve electronic overspeed trip function fails to trip the valve before

the mechanical overspeed trip occurs,

thereby requiring local resetting (and

preventing automatic restart).

4. Pump fails to develop required flow

5. Valve stem-operated switches fail to

provide input signals to other AFW

related equipment or functions.

(a) The thermal overload switch bypassing, which is designed to occur on all safety

related starts, does not appear to be verified.

(b) The thermal overload settings are apparently not verified.

(c) It is not clear that the station blackout signal-generated start of the TDP is verified.

The extent of testing is to verify that the T&T valve will open when contacts from

one undesignated train are jumpered (as opposed to closing automatically).

(a) The circuit that enables the automatic transfer of steam supply sources does not

appear to be tested at all.

(b) See items a and b under Failure mode 1 above.

(a) The electronic overspeed trip is tested under simulated, rather than actual operating

conditions.

(b) There is no apparent verification of the automatic operation of the T&T valve

closing coil to drive the motor to shut, thereby relatching the motor to the valve,

following an electronic overspeed trip.

(c) The mechanical overspeed trip setpoint is apparently not verified under simulated

or actual conditions.

(a) Full flow developed during ST-15. However, pump condition is not fully

monitored (procedure verifies flow to each SG to be >220 gpm, but does not

monitor other pump parameters).

(b) There is no testing performed to verify the ability of the TDP to deliver required

flow at steam supply pressures <842 psig. In fact, Tech Specs require testing to

be performed with steam pressure >842 psig.

There is apparently no verification of proper operation of the following switches:

(a) The switch that results in automatic closure of SG blowdown isolation valves and

provides the permissive to allow the automatic steam supply transfer to occur.

(b) The switch that causes the T&T valve operator to drive the operator to the shut

position following an electronic overspeed trip.

(c) The switch that starts the TDP room ventilation fan.

c0

%D
Table 3.6. Pump miniflow check valves: C-6, -8, and -10

Failure mode Nondetectability

1. The miniflow check valve (MCV) fails The quarterly pump testing, using ultrasonic flow instrumentation, provides an

closed, or fails to open sufficiently to indication that the MCV is stroking open adequately to allow the designated

allow required recirculation flow. minimum flow. However, the flow rate is so low that the valves would not be

fully stroked. Also, it is questionable whether the flow rates are adequate to

provide pump protection.

%M

Table 3.7. Common miniflow check valves: C-1 and -2

Failure mode Nondetectability

1. A common miniflow check valve The performance testing does not demonstrate that each check valve allows at least

(CMCV) fails closed or fails to open a given amount of flow to pass, rather that several pumps can operate

sufficiently to allow required simultaneously. Verification that the valves open sufficiently to prevent pump

recirculation flow. overheating can only be demonstrated by monitoring flow.

Note that if flow were monitored in ST- 16, some assurance of proper valve

functioning would be provided; however, in light of the low flow conditions

normally experienced by these valves, it would appear that periodic disassembly

and inspection or other monitoring would also be appropriate.
Table 3.8. Pump discharge check valves: C-7, -9, and -11

Failure mode Nondetectability

1. The discharge check valve (DCV) fails

closed or fails to open sufficiently to

allow adequate flow to reach the SGs.

2. The DCV fails to close to prevent

reverse flow.

In all probability, this would be observed during the ST-15 testing. However, as

noted previously, only flow is monitored during the testing. Thus, a DCV could

open sufficiently to allow the required flow at test conditions, but limit flow to less

than required under different pressure conditions.

There is apparently no testing that demonstrates that the DCV keeps reverse flow

below some acceptable value. However, reverse flow protection offered by the

combination of valves in the discharge flow path is verified during normal

operation (by observation of pump casing and discharge piping temperature).

%-
Table 3.9. Motor-driven AFW pump level control valves: LCV-1/1A, -3/3A, -5/5A, and -7/7A

Failure mode Nondetectability

1. The MDP level control valve (MDLCV)

controller fails to automatically control

SG level in response to an MDP start

signal.

2. Valve operator does not open or stay

open in response to a demand from the

controller.

3. Valve fails to open sufficiently to allow

adequate flow.

4. Valves fail to close sufficiently to

prevent excessive flow to a faulted SG

or to prevent feedwater backleakage.

5. Valve cannot be placed in manual control

following an AFW actuation signal.

(a) The deenergization of the AFNV blackout relays is not demonstrated to result in

the energization of relays that must function properly to enable various actions

in the MDLCV control circuits, including transfer of the controllers from

manual to automatic. This is not judged to be a significant concern since the

valve switches are normally maintained in AUTO.

(b) The transfer from MDLCV to BMDLCV control, including the accompanying

closure of the MDLCVs, is apparently not verified by testing. This is primarily

a concern from the standpoint of minimizing flow to a faulted SG until the flow

can be isolated altogether by manual actions. (Note that the ability to transfer

from automatic control to manual control in the presence of an accident signal is

not demonstrated, per item 5 below.) Failure of this transfer to occur should

be noted, however, when the MDPs are used to maintain SG inventory during

plant shutdown and startup conditions.

The deenergization of the MDLCV solenoids (that allows the valves to

open/modulate automatically) following an automatic pump start does not appear to

be demonstrated. All testing is performed with the valve switches in MANUAL

(which itself deenergizes the valve solenoid).

In all probability, this would be observed during the ST-15 testing. However, as

noted previously, only flow is monitored during the testing. Thus, an MDLCV

could open sufficiently to allow the required flow at test conditions, but limit flow

to less than required under different pressure conditions.

There is apparently no testing that is specifically oriented toward detecting seat

leakage. Reverse flow protection offered by the combination of check valves plus

the level control valves is observable during normal operation. It is possible that

excessive MDLCV or BMDLCV seat leakage might be observed during startup and

shutdown evolutions, or possibly during routine pump testing (in recirculation).

The ability to transfer the control of the MDLCVs from automatic to manual in the

presence of an AFW actuation signal does not appear to be demonstrated. Inability

to transfer to manual control would prevent the operators from isolating flow to a

faulted SG except by additional operator intervention or by stopping the associated

pump. The inability to transfer to manual control could also aggravate recovery

efforts in the event that there was an automatic controller failure.
Table 3.10. Turbine-driven pump level control valves: LCV-2, -4, -6, and -8

Failure mode Nondetectability

1. Valve controller fails to automatically

open/close to control SG level in

response to a TDP start signal.

2. Valve operator does not open or stay

open in response to a demand from

the controller.

3. Valve operator does not drive the

valve closed to prevent excessive

flow to a faulted SG.

4. Valve does not close sufficiently to

prevent excessive flow to a faulted

SG or to prevent feedwater

backleakage.

5. Valve fails to open sufficiently to

allow adequate flow.

6. Valve cannot be placed in manual

control following an AFW actuation

signal.

None noted.

(a) The ability of the accumulator to stroke the valve and the proper seating of the

control air check valve for the accumulator are apparently not demonstrated.

(b) The deenergization of the valve solenoids, which allows the turbine-driven pump

level control valves (TDLCVs) to open/modulate, is not demonstrated with the

control switches in AUTO. The solenoids are also deenergized by placing the

control switches in MANUAL, and all test-related deenergization of the solenoids

is demonstrated with the control switches in MANUAL.

There is apparently no testing that demonstrates that the valves are driven shut in

response to a faulted SG condition. In addition, the ability to transfer from AUTO

back to MANUAL in the presence of an accident signal does not appear to be

demonstrated (this ability allows the operator to deal with a faulted SG remotely).

There is apparently no testing that is specifically oriented toward detecting seat leakage.

Reverse flow protection offered by the combination of check valves plus the level

control valves is observable during normal operation. Excessive TDLCV seat leakage

might be observed during startup and shutdown evolutions, or possibly during routine

pump testing (in recirculation) .

In all probability, this would be observed during the ST-15 testing. However, as

noted previously, only flow is monitored during the testing. Thus, a TDLCV could

open sufficiently to allow the required flow at test conditions, but limit flow to less

than required under different pressure conditions.

The ability to transfer the control of the TDLCVs from automatic to manual in the

presence of an AFW actuation signal does not appear to be demonstrated. Inability to

transfer to manual control would prevent operators from remotely isolating flow to a

faulted SG except by stopping the TDP. The inability to transfer to manual control

could also aggravate recovery efforts in the event of automatic controller failure.
Table 3.11. Level control valve check valves: C-12 through -19

Failure mode Nondetectability

1. The level control valve check valve In all probability, this would be observed during the ST-15 testing. However, as

(LCVCV) fails closed or fails to open noted previously, only flow is monitored during the testing. Thus, a LCVCV

sufficiently to allow adequate flow to could open sufficiently to allow the required flow at test conditions, but limit flow

reach the SGs. to less than required under different pressure conditions.

2. The LCVCV fails to close to prevent There is no testing that demonstrates that the LCVCV keeps reverse flow below

reverse flow. some acceptable value. Reverse flow protection offered by the combination of

check valves plus the level control valves is observable during normal operation.

Table 3.12. Steam generator B and C AFW to main feed check valves:

C-21, -22, -24, and -25

Failure mode Nondetectability

1. The main feed check valve (MFCV) fails Degradation of these valves should be observed during the periodic inspection

closed or fails to open sufficiently to performed per ST-28. Also, in all probability, this would be observed during the

allow adequate flow to reach the SGs. ST-15 testing. However, as noted previously, only flow is monitored during the

testing. Thus, an MFCV could open sufficiently to allow the required flow at test

conditions, but limit flow to less than required under different pressure conditions.
Table 3.13. Main feedwater check valves (FWCV): C-20, -23, -26, and -27

Failure mode Nondetectability

1. The main feedwater check valve The periodic disassembly and inspection of these valves provides reasonable

(FWCV) fails to close sufficiently to assurance that the valve internals are in proper operating condition.

ensure that adequate AFW flow is The leak rate testing, however, allows for leakage substantially in excess of the

delivered to the SG. level required to meet AFW system design requirements.

%D

tin

Table 3.14. Feedwater isolation valves: FWIV-1 through -4

Failure mode Nondetectability

1. The feedwater isolation valve (FWIV) None noted. Because manual closure is depended on, from an AFW system

fails to close in response to an automatic perspective, manual closure performed in conjunction with valve in-service testing

or manual closure demand signal. adequately simulates the control aspect of closure.

2. FWIV fails to close sufficiently to There is apparently no testing that checks for FWIV seat leakage. Because the

prevent excessive backleakage from the upstream feedwater control valves and the downstream check valves provide some

SG and/or AFW. redundancy, and the FWIVs are gate valves, this is not viewed as a significant

concern.
Table 3.15. Steam generator blowdown isolation valves (BDIVs):

BDV-1 through -4

Failure mode Nondetectability

1. The SG blowdown isolation valves

(BDIVs) fail to close in response to an

automatic closure signal associated with

start of an AFW pump.

There does not appear to be any testing that verifies that the BDIVs close in

response to any AFW pump start. The start indication of the TDP comes from a

T&T valve stem-mounted limit switch, which also provides a start indication for the

automatic steam supply transfer. Operation of these limit switch contacts does not

appear to be checked. The start indications of the MDPs come from 52S/b contacts.

These contacts are apparently not verified to operate properly. ED

a%

The BDIVs are verified to close in response to a containment Phase A isolation

signal, as well as in response to the control board switch. The only electrical circuit

features not verified by this testing are the relay and contact operations associated

with pump starts. It should be noted that the test conditions are substantially

different from design basis demand conditions, in that the flow rate is relatively

low, and an upstream valve is simultaneously closing to isolate flow.

2. The BDIVs fail to close sufficiently to

isolate blowdown flow.

There is apparently no testing that checks the extent to which blowdown flow is

isolated by the BDIVs. Note that blowdown is normally secured using

downstream, nonsafety-related valves.
Table 3.16. AFW turbine steam supply valves: MOVY-1 and -12

Failure mode Nondetectability

1. The automatic transfer sensing circuit fails to

initiate an automatic steam supply transfer.

2. MOV-1 1 fails to close on demand (from

either the automatic transfer circuit or from

the main control board switch).

3. MOV-12 fails to open on demand (from

either the automatic transfer circuit or from

the main control board switch).

4. MOV-1 1 motor operator contacts fail to

provide proper permissive to MOV-12.

5. MOV-12 motor operator contacts fail to

provide steam supply transfer permissive.

6. Steam supply valves (SSVs) fail to open sufficiently to allow required steam flow.

Other than verifying the setpoint of the TDP discharge pressure switch,

apparently none of the automatic transfer circuit (including various relays and

contacts) is tested.

Energization of the close coil by the automatic transfer logic does not appear to

be verified by testing. However, the ability to close the valve using the control

switch is demonstrated periodically.

Energization of the open coil by the automatic transfer logic is apparently not

verified by testing. However, the ability to open the valve using the control

switch is demonstrated by various periodic testing.

The ability of MOV-12 to be opened (and stay open) in various tests

demonstrates that the MOV-1 1 ac contacts (which are open when MOV-1 1 is

shut) are not causing automatic closure of the valve. There is apparently no

testing, however, that demonstrates that closure of the MOV- 11 ac contacts

causes MOV-12 to close. The MOV-1 1 bc contact (closed when the valve is

shut) portion of the automatic open circuit also does not appear to be

demonstrated by any testing, since all transfers are made manually.

This is apparently not demonstrated because there is no testing that verifies the

automatic transfer sequence.

The ability of each SSV to provide the required steam flow is reasonably well

demonstrated in ST-15. However, because steam flow is partially dictated by

pump power demands, and only pump flow (not differential pressure) is

monitored, the steam flow demanded during testing may be somewhat less than

that required during a demand event. Also, there is no testing at low steam

supply pressures.

It should also be noted that the periodic stroking of the SSVs is performed by

holding the switches in the CLOSE/OPEN positions until the stroke is

completed, thus not demonstrating that the seal-in portion of the MOV-12

opening circuit is functioning.
Table 3.17. AFW turbine steam supply isolation valves: MOV-9 and -10

Failure mode Nondetectability

1. A steam supply isolation valve (SSIV)

closes during a TDP demand condition

without a pipe break existing.

2. SSIV fails to close on demand.

3. SSIV fails to open sufficiently to allow

the required steam flow.

4. SSIV fails to close sufficiently to isolate

a leak/break.

There appears to be no testing that requires an extended run period for the TDP.

Because the automatic isolation is based on ambient temperature, it is not clear that

stable ambient conditions would be reached in the short time required for pump

testing.

There is apparently no testing to verify that automatic closure will occur. Although

the temperature switches are individually calibrated, neither the automatic closure

of the isolation valves nor even continuity in the automatic closure circuit is

verified. It should be noted that failure to close would not constitute an AFW

system failure, but could adversely impact other equipment in the vicinity.

The ability of the SSIVs to allow the required steam flow is reasonably well

demonstrated in ST-15. However, because steam flow is partially dictated by

pump power demands, and only pump flow (not differential pressure) is

monitored, the steam flow demanded during testing may be somewhat less than

that required during a demand event. Also, there is no testing at low steam supply

pressures.

There is apparently no testing to verify the extent to which the SSIVs isolate steam

flow. However, the SSIVs would be used to isolate steam for clearance and test

purposes, and excessive leakage should be detected at that time.
99

REFERENCES

1. Loss of Power and Water Hammer Event at San Onofre, Unit 1, on November 21,

1985, USNRC Report NUREG-1 190, January 1986.*

2. U. S. Nuclear Regulatory Commission, Failure of Check and Stop Check Valves

Subjected to Low Flow Conditions, IE Information Notice No. 86-09, February 1986.+

3. U. S. Nuclear Regulatory Commission, Steam Binding of Auxiliary Feedwater Pumps,

IE Bulletin 85-01, October 1985.+

4. U. S. Nuclear Regulatory Commission, Resolution of Generic Safety Issue 93, "Steam

Binding of Auxiliary Feedwater Pumps" (Generic Letter 88-03), February 1988.+

5. M. L. Adams and E. Makay, Martin Marietta Energy Systems, Inc., Oak Ridge

National Laboratory, Aging and Service Wear of Auxiliary Feedwater Pumps for PWR

Nuclear Power Plants, NUREG/CR-4597, Vol. 1 (ORNL-6282/V 1), July 1986.*

6. U. S. Nuclear Regulatory Commission, Potential Safety-Related Pump Loss, NRC

Bulletin 88-04, May 1988.+

*Available for purchase from National Technical Information Service, Springfield,

Virginia 22161.

+Copies are available from U. S. Government Printing Office, Washington, D. C.

20402.
100

4. AFW SYSTEM FAILURE DATA REVIEW AND ANALYSIS

4.1 INTRODUCTION

To gain some insight into the importance of various AFW system components from a

historical failure perspective, reviews of failure data through 1986 for Westinghouse and

B&W plants from INPO's Nuclear Plant Reliability Data System (NPRDS),* the Nuclear

Operations Analysis Center's Licensee Event Report (LER), and S. M. Stoller's Nuclear

Power Experience (NPE) data bases were conducted. The initial intent of reviewing all

three data bases was to provide an indication of the validity of relying on only the NPRDS

data because it should be theoretically the most comprehensive set of data; in fact, all

failures that would be reported in LERs should also be reported in NPRDS, whereas

NPRDS should also include many failures not reported in LERs. However, it became clear

during the initial review of failure data from these data bases that a significant fraction of

the failure records found in the NPE and LER data bases was not found in NPRDS. As a

result, each record from all three data bases was reviewed and combined to form a single

ORNL data base, thereby avoiding redundant entries while establishing a more thorough

set of failure records.

It was also determined that for meaningful results to be gathered from the data

review, a single, consistent assignment of several parameters for each failure record was

required. This determination was based largely on the fact that the NPRDS failure records,

in particular, (1) assigned the failures to incorrect types of components (e.g., a turbine

speed-control problem that resulted in tripping of the TDP being designated as a pump

failure instead of a turbine/governor failure), (2) attributed single failures to multiple

components (e.g., when a turbine speed-control problem caused the turbine to trip, a

failure record was entered for both the turbine and the TDP), and (3) inconsistently

ascribed various characteristics to the failures.

A third reason for establishing the ORNL data base was to assign the failure records

to a level that was meaningful, from a system perspective, because the component

assignment of failure was not structured to facilitate a system review. This was especially

true for instrumentation and control (I&C) components. The importance of a particular

type of I&C failure, from a system perspective, depends on which other components are

affected; therefore, it was necessary to assign such failures to the component(s) ultimately

affected. An example of such a situation would be the failure of a pressure transmitter.

Depending on the transmitter function, the result of the transmitter loss might range from

simple loss of indication to loss of speed control for the TDP.

Although a greater degree of internal consistency was obtained by the creation of the

ORNL data base than was available in the existing data bases, it is extremely important to

realize that any conclusions drawn from the review of the ORNL data base must be made

with great care. One feature of the failure records that is particularly noteworthy is the

change in reporting requirements and practices that occurred around 1983 to 1984. During

that time, the LER reporting requirements were changed, substantially reducing the number

of failures reportable to the NRC in LERs. At the same time, utility NPRDS reporting

practices began to improve (in part because improved voluntary failure reporting to the

NPRDS was used to justify the relaxation of LER reporting requirements). As a result, the

*Plant-specific information from the NPRDS data base is proprietary. Although

much of the failure data compilation and evaluation depended on plant and component

identification, the results of the study are presented without identification of individual

plants.
101

total failure data available from NPRDS are dominated by the data from 1984 and later.

Almost three-quarters of the NPRDS failure records for the AFW system come from 1984

to 1986, and about one-half of the total failure record data (from all three sources) can be

found in the NPRDS data for those 3 years alone. As a result, information such as failure

rate as a function of plant age for a particular plant, or even for industry as a whole, can be

extremely misleading. Because of this and other complicating factors, any attempt to use

the failure record data results or findings included in this report for any purpose other than

ones that are specifically discussed within the report is strongly discouraged without

consultation with the author.

Another aspect of the failure data base that should be pointed out is that very few, if

any, of the failures are associated with design basis challenges of the AFW system.

Although some failures are classified as demand related, they occurred primarily when an

automatic or manual start of the AFW system occurred during testing or following a

"normal" reactor trip (not, for example, following a design-basis event such as a feedwater

line break). Recognize that the challenges presented to various components may be more

severe under design-basis conditions; therefore, certain types of failure are more likely.

Thus, it would be inappropriate to directly extrapolate the failure data associated with the

normal AFW system and general plant conditions to those that would exist following

design-basis events.

A limitation of the failure data that must be discussed relates to the completeness of

the data. Although a significant number of failure records are in the ORNL failure data

base (1767 total), it clearly does not include a large fraction of known historical failures,

based on a review of some plant-specific failure data that were available for comparison.

However, the three sources of data used to form the ORNL data base are reasonably

accessible and usable, in contrast to plant-specific data (available only from maintenance

work requests that normally contain considerably less information than is available from the

NPRDS, LER, or NPE data bases).

A final observation about the failure data is that even plants that are very thorough in

their reporting practices can only report failures when they are known to exist. As

discussed in Chap. 3, a number of failure types would not be identifiable by current

monitoring practices. For example, the disk for a check valve may have separated and be

lying in the bottom of the valve body. If there are no reverse flow closure challenges to the

valve, either from testing or from operational circumstances, the failure may go undetected

and, hence, unreported for a considerable time. Thus, even full reporting of known failure

data would not necessarily be a perfect representation of the distribution of areas of

concern.

4.2 ORNL DATA BASE FORMATION

Computerized searches of the NPE, LER, and NPRDS data bases were conducted.

Because the failure data available from the NPRDS included failure records from

Westinghouse and B&W plants through most of 1986, the NPE and LER data base search

records for the same time periods were included. The initial review process consisted of

sorting each of the data bases by plant, failure date, and component. At this time, the

ORNL component assignments were made. The three sources of data were then combined

to form a single data base, which was then processed to eliminate multiple entries for the

same failure event. The single set of failure records was then reviewed again to evaluate

and record the method of discovery, the impact on the AFW system, and other pertinent

information.
102

For each component type, the numbers of failure counts in the data base and the effect

upon the system as a whole were tallied. Some explanation of the component categorization

and other aspects and limitations of the data presented are necessary:

1. Five component types are designated. The failures ascribed to particular component

types include not only failures of the component proper, but failures of auxiliary

components or parts that affected the component. For example, the failure of a contact

in the AFW turbine control circuitry that resulted in overspeed tripping of the TDP

would be included under the pump driver category. Table 4.1 provides descriptions of

the component types and their scope. The more important component types were

divided into subgroups for further evaluation. The subgroups will be discussed later.

2. Three parameters are provided for most sortings of the failure data base: failure counts

(FCs) - the number of failure records associated with the described parameter; average

system effect (ASE) - the average fraction of the system degraded per failure; and

relative system degradation (RSD) - a measure of the overall historical system

degradation associated with the described parameter.

3. The ASE was determined for each failure record based on the particular plant design and

the extent to which the system was affected by the component failure. The effect was

measured on a scale from 0 to 1, with 1 representing total system failure and 0

representing no, or insignificant, impact on the system. For example, if one MDP in a

three-pump system would not start because of a faulty circuit breaker, a system effect

of 0.33 would be assigned for that failure (note that this failure would be included in

the pump driver category).

4. The RSD is a normalized measure of the overall contribution of a component type to

total system degradation, taking into account both the number of failures and the

significance of each event. The method used to determine the RSD is as follows:

RSD = FCQ x ASEi / Z(FCi x ASEi)

where

RSD = RSD for a component type,

ASE = ASE for a component type,

FC = FCs for a component type,

i = individual failure record.

This method of assigning the RSD allows the different sources of AFW system

degradation to be compared on an equivalent basis. Where the RSD is used in this

report, keep in mind that the values cited are in the context of the level of review. To

illustrate, pump drivers were found to be responsible for 37% of the RSD for the AFW

system as a whole (see Table 4.2). Of the three types of pump drivers, the turbine

drive was found to be responsible for 73% of the RSD associated with pump drivers.

Thus, failures associated with turbine drives were responsible for 0.73 x 0.37 = 0.27,

or 27% of the overall AFW RSD.

5. The ASE and RSD measures cited above do not include an accounting for recoverability,

that is, the ability to recover the failed piece of equipment within a short time. This is

primarily caused by the difficulty in ascertaining the extent to which operator action

would be able to offset many failures experienced. Thus, two failures of the same

component may be given identical consequence ratings when, in fact, one of the

failures could be overcome fairly easily.

6. Each failure record in the data base is predicated on information from one or more of the

information sources (NPE, LER, and NPRDS). Each "failure" record is not

necessarily a failure that disables the component. For instance, the valve "failure"

records range from packing leaks to broken valve stems. The system effect for these

two failure types would clearly differ, but each would contribute one failure count. It is
Table 4.1. Component categorization

Component type Scope of equipment

Pump drivers

Valve operators

Valves

Pumps

Other

Components included in the pump driver scope are

(1) the pump driver itself, whether turbine, diesel, or motor, including mechanical and

electrical parts of the driver,

(2) the control circuitry for the driver, including breakers, contacts, relays, etc., that are

required to operate properly to start and/or control the pump driver, and

(3) auxiliary components whose function is integral with the pump driver, for example, the

turbine GV is included because it is used to control turbine speed.

Includes the valve operator itself (e.g., the motor), any portion of the operator controls,

including switches, contacts, controllers, etc. Does not include failures of the valve or valve

stem. Valve operators for AFW pump suction, discharge, and turbine SSVs are included.

This category includes failures of all types of valves, including check, gate, globe, butterfly,

etc. Note that the turbine governor and T&T valves are specifically not included. External

leakage, seat leakage, and stem failures are examples of failures included.

Pumps only, regardless of drive type, are addressed by this category. Bearing failures, pump

lube oil problems, air or vapor binding of the pumps, pump suction problems, and pump

overpressurization problems are included.

Includes all components not addressed by the above categories, including pipes, pipe supports,

and noncontrol instrumentation (i.e., instruments used for indication only).

0

Table 4.2. Component failure record summary

Component type FCs ASE RSD

Pump drivers 402 0.36 0.37

Valve operators 534 0.20 0.28

Valves 418 0.16 0.18

Pumps 144 0.33 0.12

Other 269 0.06 0.04

Total 1767 0.22 1.00
104

important, therefore, to realize that the failure count information can be particularly

misleading in terms of relative significance.

A total of 517 reactor years of operating experience for the plants is included in the

ORNL failure record data base. The plants included were Westinghouse and B&W units

that started in or before 1986. These plants have 130 safety-related AFW pumps, including

77 motor-driven, 51 turbine-driven, and 2 diesel-driven pumps. The accumulated pump operating experience for the time period covered by the data base was 808 MDP trainyears, 604 TDP train-years, and 13 DDP train-years.

4.3 ANALYSIS RESULTS

4.3.1 General Summary

A total of 1767 FCs, many of which were reported in more than one of the three data

base sources, were reviewed. As shown in Fig. 4.1 and Table 4.2, valve operator (including air, motor, electrohydraulic, and solenoid valve operators) problems resulted in

the largest number of FCs, contributing 30% of the total (534/1767). Valves and pump

drivers provided 24% and 23% of the total FCs, respectively.

The ASE of failures associated with pump drivers and pumps was found to be 0.36

and 0.33, respectively. In contrast, the average effects associated with the valve operator

and valve categories were 0.20 and 0.16, respectively. The ASE of a pump or pump driver

failure is greater than a valve or valve operator failure because a single failure of a pump or

pump driver causes the loss of an entire train, whereas a valve or valve operator failure

normally results in only partial loss of a train.

As noted previously, failure count comparisons alone can be misleading. To gain a

better perspective on the overall degradation associated with failures of particular

components, the RSD for each was determined. Even though there were fewer associated

FCs for pump drivers than for valve operators or valves, pump drivers were found to be

the leading contributor to AFW RSD, accounting for about 37% of the total, while valve

operators and valve failures accounted for 28% and 18%, respectively. Pump failures

ORNL-DWG 90-3317 ETD

Failure Counts Relative System Degradation

269 4

18%

41

28%

El Pump drivers M Valve operators

E Valves El Pumps a Other

Fig. 4.1. Failure count and relative system degradation distributions.
105

contributed -12% of the historical RSD. The reason that both the pump driver and pump

categories were found to cause a higher fraction of RSD than the associated fraction of FCs

would suggest is that, as noted above, the ASE of a pump or pump driver failure was

substantially greater than that for a failure of a valve or valve operator.

4.3.2 Method of Detection Summary

The method of discovery of each failure record was designated during the review

process. The FCs, ASE, and RSD associated with the component types by the method of

detection are reported in Tables 4.3 to 4.5 and summarized in Fig. 4.2. Three methods of

detection were ascribed as follows:

1. Those failures found by programmatic monitoring methods, such as Technical

Specification Surveillance testing. This would include failures detected during testing,

even if the component that was found to be failed was not specifically being checked by

the test.

2. Those failures found during routine equipment observation, such as by noting valve

stem leakage or by unusual indication or alarm at the main control board.

3. Those failures that were only found during an operational demand, such as failure of a

pump to automatically start following a reactor trip with a legitimate start signal present.

Note that the total FCs included in the three categories are slightly less than the total

FCs identified in Table 4.2 (and in some other tables) because some failure detection means

were either not clear or did not fit any of the categories.

Overall, 230 of the 1767 (13%) FCs and 18% of the RSD were due to failures

detected during demand events. Several features of Fig. 4.2 and Tables 4.3 to 4.5 are

particularly noteworthy:

1. Over one-fourth of the pump driver FCs and pump driver-related RSD were associated

with on-demand failure.

2. The failures detected during demand were, in general, more severe than those detected

otherwise. As an example, the ASE of all demand failures was 0.30 compared with

ORNL-DWG 90-3318 ETD

Failure Counts Average Effect Relative System

0.30 Degradation

13% H0 1.%

0.19

IM Programmatic 0 Routine 0 Demand

Monitoring Observation

Fig. 4.2. Method of detection summary.
Table 4.3. FCs, by discovery method

Component type Programmatic monitoring Routine observation Demand Total

Pump drivers 180 126 95 402

Valve operators 236 223 73 534

Valves 124 269 23 418

Pumps 47 71 26 144

Other 144 108 13 269

Total 731 797 230 1767

Table 4.4. ASE, by discovery method

Component type Programmatic monitoring Routine observation Demand Total

Pump drivers 0.35 0.33 0.39 0.36

Valve operators 0.20 0.20 0.20 0.20

Valves 0.20 0.14 0.27 0.16

Pumps 0.37 0.30 0.33 0.33

Other 0.06 0.04 0.18 0.06

Total 0.22 0.19 0.30 0.22

Table 4.5. RSD, by discovery method

Component type Programmatic monitoring Routine observation Demand Total

Pump drivers 0.17 0.11 0.10 0.37

Valve operators 0.12 0.12 0.04 0.28

Valves 0.06 0.10 0.02 0.18

Pumps 0.05 0.06 0.02 0.12

Other 0.02 0.01 0.01 0.04

Total 0.42 0.39 0.18 1.00

Ca
107

0.22 and 0.19 for all failures detected by programmatic monitoring and routine

observation, respectively.

3. Over one-half of the RSD associated with demand failures was due to pump driver

failures.

4.3.3 Subsystem Review Summary

One of the designators applied to each failure record was the subsystem affected.

Four types of subsystems were designated. Three subsystems are related to the type of

pump driver (i.e., TDP, MDP, and DDP). For failures associated with components

common to two or more trains with different types of pump drivers, the subsystem was

designated as "common." An example of a common subsystem component would be a

flow control or isolation valve located downstream of the junction of TDP and MDP

discharge lines. When the affected subsystem was indeterminate, "unknown" was

assigned.

Figure 4.3 and Tables 4.6 to 4.8 provide failure data sorted by affected subsystem.

Failures within the TDP subsystem were found to have contributed almost half of the total

FCs and over half (58%) of the RSD. MDP subsystem failures were found to account for

about 30% of the FCs and RSD. The significance of the TDP subsystem failure records is

amplified by the fact that there are more MDPs than TDPs (77 MDP subsystems vs 51 TDP

subsystems, with 808 and 604 pump-years cumulative service, respectively, for the units

and operating periods included in the ORNL data base).

ORNL-DWG 90-3319 ETD

Failure Counts Relative System Degradation

TDP 3% 2%

13% 4 | | ^ ta MDP 7 clo

50% 0 Common

| DDP 30% 58%

30%

3 Unknown

Fig. 4.3. Failure by subsystem summary.

4.3.4 Plant Age Review Summary

Failure records were sorted by the age of the plant at the time of component failure

and then divided into 5-year age groups. Because of the diversity of plant ages,

normalization of the data was necessary to account for the fact that there have been more

reactor years of operation in the lower age groups. The results of the the age-related

sorting of the data are presented in Tables 4.9 and 4.10.

Some cautions relative to this particular data sort are extremely important. First,

aging trends that may appear to be extant based on Tables 4.9 and 4.10 may, in fact, not be

present at all. These tables are based on failure records and reactor years of operation for

the life of all plants included in the data base. However, the failure record data base, as

mentioned previously, is heavily influenced by failures reported from 1984 to 1986
Table 4.6. FCs, by subsystem affected

Component type TDP MDP Common DDP Unknown Total

Pump drivers 290 87 0 25 0 402

Valve operators 258 209 51 2 14 534

Valves 210 129 59 1 19 418

Pumps 60 83 0 0 1 144

Other 62 30 112 2 63 269

Total 880 538 222 30 97 1767

Table 4.7. ASE, by subsystem affected

Component type TDP MDP Common DDP Unknown Total

Pump drivers 0.36 0.31 N/A 0.49 N/A 0.35

Valve operators 0.22 0.19 0.20 0.25 0.19 0.20

Valves 0.16 0.17 0.17 0.25 0.10 0.16

Pumps 0.34 0.32 N/A N/A 0.50 0.33

Other 0.09 0.03 0.05 0.00 0.07 0.06

Total 0.25 0.21 0.11 0.43 0.10 0.22

Table 4.8. RSD, by subsystem affected

Component type TDP MDP Common DDP Unknown Total

Pump drivers 0.27 0.07 0.00 0.03 0.00 0.37

Valve operators 0.15 0.10 0.03 0.00 0.01 0.28

Valves 0.09 0.06 0.03 0.00 0.01 0.18

Pumps 0.05 0.07 0.00 0.00 0.00 0.12

Other 0.01 0.00 0.01 0.00 0.01 0.04

Total 0.58 0.30 0.07 0.03 0.02 1.00

0
Table 4.9. FCs per reactor year, by 5-year groups

Component type Years 1-5 Years 6-10 Years 11-15 Years 16-20 Years 1-20

Pump drivers 0.75 0.78 0.84 0.95 0.79

Valve operators 1.06 0.95 1.17 1.00 1.04

Valves 0.66 0.87 1.07 0.77 0.82

Pumps 0.27 0.23 0.44 0.09 0.28

Other 0.48 0.58 0.46 0.68 0.52

Total 3.21 3.42 3.98 3.50 3.44

0l

%D

Table 4.10. RSD, by 5-year groups

(normalized for numbers of reactor years operation)

Component type Years 1-5 Years 6-10 Years 11-15 Years 16-20 Years 1-20

Pump drivers 0.09 0.09 0.08 0.12 0.37

Valve operators 0.07 0.06 0.08 0.08 0.28

Valves 0.04 0.04 0.06 0.04 0.18

Pumps 0.03 0.03 0.05 0.01 0.12

Other 0.01 0.01 0.01 0.02 0.04

Total 0.23 0.23 0.28 0.27 1.00
110

because of improvements in reporting practices (particularly the case for NPRDS) during this time period. For those plants that have operated for some time, therefore, a built-in

bias toward more apparent failures with age exists. Second, the age of the component whose failure is recorded may or may not be the same as the age of the plant. For example,

a particular valve's operator may have been replaced or substantially refurbished several

times before the occurrence of a failure that is recorded in the data base. Third, reporting

practices vary considerably from plant to plant. The reporting practices of older plants, in

particular, can have a substantial impact on the results of sorting of this nature. As a result,

the aging relationship tables (Tables 4.9 and 4.10) should be viewed as informational data

with a great deal of uncertainty.

4.3.5 Component Group Review Summary

A more detailed review and characterization of failure records for the components that

were found to be major contributors to AFW RSD were performed. The component

categories reviewed in more detail were pump drivers (specifically, turbines and motors),

valve operators, valves, and pumps.

4.3.5.1 Pump drivers

Figure 4.4 and Table 4.11 provide a summary of pump driver failure record

information from the ORNL data base. Turbines accumulated the largest number (290) of

FCs of any individual component type, and over one-fourth of overall RSD was due to

turbine-related failures. Almost three-fourths of both the FCs and the RSD for pump

drivers was associated with turbine drives. The recorded failure count rate for the turbine

drives was more than four times that of the motor drives. Although there are only two

DDPs (out of the total of 130 pumps in the data base), failures associated with the diesels

contributed 9% of the pump driver RSD. This is due, in part, to the fact that the ASE at

plants with the DDPs is high (each unit using DDPs has only two AFW pumps; therefore, a

failure of one pump causes a 50% degradation in the system). However, it also appears,

based on the fairly small experience base for the DDPs (13 DDP-years) that the diesel

driver failure rate may be higher than for the other type drivers.

ORNL-DWG 90-3320 ETD

Relative System Degradation Failure Counts per Pump Drive Year

9% 1.92

19%

----------- ---------------- -__

3%

0.48

0.11

E Turbine 0 Motor Eg Diesel

Fig. 4.4. Pump driver summary.
Table 4.11. Pump driver type summary data

Pump driver type FCs FCs per pump-year ASE RSD

Turbine 290 0.48 0.36 0.73

Motor 87 0.11 0.31 0.19

Diesel 25 1.92 0.49 0.09

Total 402 0.28 0.36 1.00

I.-

I.-
112

Turbines

A more detailed review and assignment of the failure sources was undertaken for the

pump drivers. Figure 4.5 and Tables 4.12 to 4.1.4 present analysis results for the turbine

drives, sorted by subcomponent groupings and method of discovery. The six

subcomponents or failure sources designated for the turbine drives and the associated scope

were as follows:

1. I&C / Governor Control

This includes the external control circuitry that would provide start signals to the TDP

(does not include failures of instrumentation used to provide input to safeguards logic

circuitry, such as SG-level instrumentation), as well as the governor speed control

circuit.

2. T&T Valve

Failures of the T&T valve, such as tripping caused by worn linkage, or failure to open

because of a damaged operator were included in this category. Note that T&T valve

and valve operator failures are included here, and not in the valve or valve operator

component groups because the T&T valve is typically a part of the turbine package and

is integral with turbine starting and operation.

3. GV

Failures of the GV, such as the valve plug sticking and external leakage, are included in

this category.

4. Oil/Bearing

Turbine bearing failures and miscellaneous bearing oil related problems are included.

5. Turbine

Failures of the turbine itself, such as blade failure, are included.

6. Other/Unknown

This category includes all other miscellaneous failures and those whose source could

not be determined.

Problems associated with I&C/governor control circuits were the dominant source of

turbine degradation, comprising about one-half the total turbine-related FCs and RSD.

T&T valve problems were responsible for about one-fifth of the RSD.

One particularly noteworthy finding was that almost one-third of the I&C/governor

control failures were detected during demand (see Fig. 4.6). The I&C/governor control

failures were responsible for -70% of the total turbine-related demand failures.

ORNL-DWG 90-3321 ETD

Relative System Degradation

1 8% |EI&C/Govemor control

9 % T&T

GV

10% XE Oil/bearing problems

52% Q] Turbine

20 E2~~~~~~~ Other/unknown

Fig. 4.5. Sources of turbine drive failures.
Table 4.12. Turbine FCs by detection method

Failure source Programmatic monitoring Routine observation Demand Total

I&C/Govemor control 82 24 43 149

T&T 23 29 11 64

GV 15 13 2 30

Oil/bearing 9 10 2 21

Turbine 1 4 0 5

Other/unknown 11 7 3 21

Total 141 87 61 290

Table 4.13. Turbine ASE by detection method

Failure source Programmatic monitoring Routine observation Demand Total

I&C/Govemor control 0.36 0.34 0.40 0.37

T&T 0.32 0.32 0.38 0.33

GV 0.37 0.29 0.42 0.34

Oil/bearing 0.46 0.39 0.42 0.42

Turbine 0.17 0.23 N/A 0.22

Other/unknown 0.41 0.33 0.33 0.37

Total 0.36 0.33 0.39 0.36

Table 4.14. Turbine RSD by detection method

Failure source Programmatic monitoring Routine observation Demand Total

I&C/Govemor control 0.28 0.08 0.17 0.53

T&T 0.07 0.09 0.04 0.20

GV 0.05 0.04 0.01 0.10

Oil/bearing 0.04 0.04 0.01 0.09

Turbine 0.00 0.01 0.00 0.01

Other/unknown 0.04 0.02 0.01 0.08

Total 0.49 0.27 0.23 1.00

IC-.
114

ORNL-DWG 90-3322 ETD

Relative System Degradation

32~

1

10 M Programmatic monitoring

53% e] Routine observation

lE Demand

Fig. 4.6. Turbine I&C/governor failure summary by detection method.

Motors

Figure 4.7 and Tables 4.15 to 4.17 provide information for motor drives. Four

pump motor subcomponent failure sources were designated:

1. I&C

These failures include the controls that are used for automatic and manual starting of

MDPs (does not include failures of instrumentation used to provide input to safeguards

logic circuitry, such as SG-level instrumentation).

2. Breaker

These failures include the breaker itself and breaker auxiliaries.

3. Motor

These failures include all motor parts, except for the motor bearings.

4. Motor bearings

This category is self-explanatory.

As was the case for the turbine drives, I&C-related problems were the principal

source of motor-drive degradation, contributing over 50% of the total motor-drive FCs and

RSD. About one-third of the I&C problems for motor drives were detected during demand

conditions. The I&C failures were responsible for -80% of the total motor-drive-related

demand failures.

ORNL-DWG 90-3323 ETD

Relative System Degradation

4%

12%

I&c

l ll@| ~~~~~~~~~Breaker

QE Motor

27% _ -l | 57% Ea Motor bearings

Fig. 4.7. Sources of pump motor drive failures.
Table 4.15. Pump motor FCs by detection method

Failure source Programmatic monitoring Routine observation Demand Total

I&C 21 14 17 52

Breaker 10 8 4 22

Motor 4 6 0 10

Motor bearings 0 3 0 3

Total 35 31 21 87

Table 4.16. Pump motor ASE by detection method

Failure source Programmatic monitoring Routine observation Demand Total

I&C 0.29 0.26 0.30 0.29

Breaker 0.31 0.37 0.29 0.33

Motor 0.33 0.33 N/A 0.33

Motor bearings N/A 0.33 N/A 0.33

Total 0.30 0.31 0.30 0.30

Table 4.17. Pump motor RSD by detection method

Failure source Programmatic monitoring Routine observation Demand Total

I&C 0.23 0.14 0.19 0.57

Breaker 0.12 0.11 0.04 0.27

Motor 0.05 0.07 0.00 0.12

Motor bearings 0.00 0.04 0.00 0.04

Total 0.40 0.36 0.24 1.00

LI'
116

Diesels

Tables 4.18 to 4.20 provide failure data base information for diesel drives. Three

diesel subcomponent failure sources were designated:

1. I&C

This includes the external control circuitry that would provide start signals to the DDP

(does not include failures of instrumentation used to provide input to safeguards logic circuitry, such as SG-level instrumentation), as well as the diesel governor speed control circuit.

2. Mechanical/Support

This includes the diesel itself and noncontrol diesel supporting auxiliaries, such as fuel

oil piping.

3. Other

This is self explanatory

As was the case for the turbine and motor drivers, I&C problems were the principal

source of diesel-drive degradation, with -80% of the FCs and RSD resulting from I&C

failures. One-half of the I&C failures that were recorded, comprising 40% of the total

diesel failure records, occurred on demand.

4.3.5.2 Valve operators

The valve operator group, which had the highest number of FCs, 534, was found

responsible for 28% of the overall RSD (see Tables 4.3 and 4.5 and Fig. 4.1). Tables

4.21 to 4.23 provide a breakdown of failure statistics of the valve operator types, including air operators (AOV), motor operators (MOV), and electrohydraulic operators (EHOV).

Figure 4.8 indicates the relative proportions of system degradation attributable to the valve

operator types. AOVs and MOVs were found to be roughly equal in terms of both

numbers of failures and RSD. Current monitoring practices appear to be better able to

detect degradation and failure of valve operators than pump drivers in that -13% of the

RSD associated with the valve operator group was found during demand conditions (Table

4.23), compared to >25% of the.pump driver RSD being found during demand.

ORNL-DWG 90-3324 ETD

Relative System Degradation

4%

M AOV

49% El MOV

47%

03 EHOV

Fig. 4.8. Valve operator failure summary.
Table 4.18. Diesel subcomponent FCs by detection method

Failure source Programmatic monitoring Routine observation Demand Total

I&C 4 6 10 20

Mechanical/support 0 2 1 3

Other 0 0 2 2

Total 4 8 13 25

Table 4.19. Diesel subcomponent ASE by detection method

Failure source Programmatic monitoring Routine observation Demand Total

I&C 0.50 0.50 0.50 0.50

Mechanical/support N/A 0.38 0.50 0.42

Other N/A N/A 0.50 0.50

Total 0.50 0.47 0.50 0.49

Table 4.20. Diesel subcomponent RSD by detection method

Failure source Programmatic monitoring Routine observation Demand Total

I&C 0.16 0.24 0.41 0.82

Mechanical/support 0.00 0.06 0.04 0.10

Other 0.00 0.00 0.08 0.08

Total 0.16 0.31 0.53 1.00

I-
Table 4.21. FCs, by valve operator type

Operator type Programmatic monitoring Routine observation Demand Total

AOV 124 130 34 289

MOV 109 84 36 230

EHOV 3 9 3 15

Total 236 223 73 534

Table 4.22. ASE, by valve operator type

Operator type Programmatic monitoring Routine observation Demand Total

AOV 0.17 0.19 0.18 0.18

MOV 0.23 0.21 0.21 0.22

EHOV 0.33 0.31 0.28 0.31

Total 0.20 0.20 0.20 0.20

Table 4.23. RSD, by valve operator type

Operator type Programmatic monitoring Routine observation Demand Total

AOV 0.20 0.23 0.06 0.49

MOV 0.23 0.17 0.07 0.47

EHOV 0.01 0.03 0.01 0.04

Total 0.44 0.42 0.13 1.00

I-
119

Air-operated valve operators

Tables 4.24 to 4.26 provide more detailed information concerning the types of failure

sources for AOVs. Figure 4.9 summarizes the results. Five subcomponents or failure

sources were designated:

1. I&C

This includes the valve controller circuit, as well as items such as relays and contacts

that are external to the controller circuit but that provide signals to the valve controller

circuit.

2. Mechanical

This applies to the valve operator itself, including positioner, limit switches,

diaphragm, connections, and linkage.

3. Instrument Air

This includes failures in which either instrument air supply components, such as

pressure regulators, were involved or where poor instrument air quality was clearly the

cause of failure. Note that some other failures, such as some solenoid failures (below)

may have resulted from poor quality air, but they were not ascribed to instrument air

unless the failure record description so stated.

4. Solenoids

This includes failures of the solenoid plunger or coil.

5. Unknown/Other

This is self-explanatory.

Of the five failure sources for AOVs, I&C problems were the single largest

contributor, both in terms of FCs (131 of 289) and AOV-related RSD. About 12% of the

AOV RSD was detected during demand conditions. One-half of the demand-related AOV

RSD was associated with I&C failures.

ORNL-DWG 90-3325 ETD

Relative System Degradation

13%

7% 3d I&C

A2 Mechanical

1 Instrument air

18% | l 12Solenoid

0 Unknown/other

Fig. 4.9. Sources of air-operated valve operator failures.

Motor-operated valve operators

Tables 4.27 to 4.29 provide more detailed information concerning the types of failure

sources for MOVs. Figure 4.10 summarizes the results. Three subcomponents or failure
Table 4.24. Air-operated valve FCs

Failure source Programmatic monitoring Routine observation Demand Total

I&C 55 60 16 131

Mechanical 24 27 4 56

Instrument air 26 16 5 47

Solenoid 7 12 0 19

Unknown/other 12 15 9 36

Total 124 130 34 289

Table 4.25. Air-operated valve ASE

Failure source Programmatic monitoring Routine observation Demand Total

I&C 0.16 0.18 0.19 0.17

Mechanical 0.19 0.20 0.17 0.19

Instrument air 0.19 0.22 0.20 0.20

Solenoid 0.19 0.18 N/A 0.18

Unknown/other 0.20 0.19 0.17 0.19

Total 0.17 0.19 0.18 0.18

Table 4.26. Air-operated valve RSD

Failure source Programmatic monitoring Routine observation Demand Total

I&C 0.16 0.21 0.06 0.43

Mechanical 0.09 0.10 0.01 0.20

Instrument air 0.09 0.07 0.02 0.18

Solenoid 0.03 0.04 0.00 0.07

Unknown/other 0.04 0.05 0.03 0.13

Total 0.41 0.47 0.12 1.00

0o
Failure source

Motor, switches

I&C

Unknown/other

Total

Table 4.27. Motor-operated valve FCs

Progranunatic monitoring Routine observation

59 37

25 24

25 23

109 84

Demand

13

14

9

36

Total

109

64

57

230

Failure source

Motor, switches

I&C

Unknown/other

Total

Table 4.28. Motor-operated valve ASE

Programmatic monitoring Routine observation

0.23 0.20

0.22 0.23

0.24 0.22

0.23 0.21

Demand

0.22

0.20

0.20

0.21

Total

0.22

0.22

0.22

0.22

I.-

I.-

Failure source

Motor, switches

. I&C

Unknown/other

Total

Table 4.29. Motor-operated valve RSD

Programmatic monitoring Routine observation

0.27 0.15

0.11 0.11

0.12 0.10

0.50 0.36

Demand

0.06

0.06

0.04

0.15

Total

0.47

0.27

0.25

1.00
122

ORNL-DWG 90-3326 ETD

Relative System Degradation

25%

8 .< i | |l |47%

. Motor, switches

El I&C

Unknown/other

27

Fig. 4.10. Sources of motor-operated valve operator failures.

sources were designated:

1. Motor and Switches

This category includes the motor operator itself and all local appurtenances, including

the motor, torque and limit switches, and gearing. 2. I&C

This category includes all remote controls, such as fuses, control relays, and contacts

that operate to control power to the operator motor (primarily located at the MCC).

3. Other/Unknown

This is self explanatory.

Failures associated with the operator motor and switches were responsible for almost

half of the MOV FCs and RSD (limit and torque switch problems were the principal

sources of failure within this subgroup). More than 15% of the MOV FCs and RSD was

associated with demand situations.

4.3.5.3 Valves

Tables 4.30 to 4.32 provide more detailed information concerning the types of failure

sources for the valve group. Valve-related failures included all valve problems that were

not included in the valve operator group. No distinction was made concerning whether

valves had power or manual-only operators. Failures ranged from internal (seat) and

external (packing or bonnet) leakage to separation of the disk from the stem. The valve

group was broken down into the following types:

1. Control valves

This category includes all valves in either the pump suction or discharge piping,

excluding check and relief valves.

2. SSVs

This category includes all valves in the steam supply lines, excluding check and relief

valves.

3. Relief valves

This category includes all relief valves in either the steam supply or pump

suction/discharge piping. This category does not include the main steam safety or

atmospheric dump valves.
Table 4.30. Valve type FCs

Valve type Programmatic monitoring Routine observation Demand Total

Control valves 39 85 14 138

Steam supply valves 16 53 2 71

Relief valves 15 10 1 26

Check valves-suction/discharge 33 97 5 135

Check valves-steam supply 21 24 1 46

Total 124 269 23 416

Table 4.31. Valve type ASE

Valve type Programmatic monitoring Routine observation Demand Total

Control valves 0.17 0.14 0.27 0.16

Steam supply valves 0.22 0.11 0.25 0.14

Relief valves 0.18 0.03 0.33 0.13

Check valves-suction/discharge 0.23 0.16 0.27 0.18

Check valves-steam supply 0.18 0.14 0.33 0.16

Total 0.20 0.14 0.27 0.16

Table 4.32. Valve type RSD

Valve type Programmatic monitoring Routine observation Demand Total

Control valves 0.10 0.17 0.06 0.33

Stearm supply valves 0.05 0.09 0.01 0.15

Relief valves .0.04, 0.01 0.00 0.05

Check v alves-suction/discharge 0.11 0. 23 0.02 0.37

Check valves-steam supply 0.06 0.05 0.00 0.11

Total 0.36 0.55 0.09 1.00

I-.

Li3
124

4. Check valves - Suction/Discharge

This category includes all check valves located in either the pump suction or discharge

lines.

5. Check valves - Steam Supply

This category includes all check valves between the steam supply connections to the

main steam lines and the turbine.

More failures were associated with the pump suction/discharge control and check

valves than SSVs, as would be expected, because of the relative populations. The only

particularly notable feature from the valve group failure data is that <10% of the FCs and

RSD were associated with demand failures, the smallest fraction of any of the major

groups.

4.3.5.4 Pumps

Tables 4.33 to 4.35 provide more detailed information concerning the types of failure

sources for the pump group. Figure 4.11 summarizes the results. Six failure/degradation

sources were designated, as follows:

1. Pump Internals

This category includes failures of any mechanical parts of the pump, with the exception

of pump packing and bearings.

2. Pump OiVBearing

Pump bearing failures and miscellaneous pump bearing-oil-related problems are

included. Note that this does not include pump driver bearing problems.

3. Pump Overpressure

This category includes events in which the pump casing and/or discharge piping

became overpressurized.

4. Pump Packing

This category includes failures of pump packing which resulted in either excessive

leakage or in packing overheating.

ORNL-DWG 90-3327 ETD

Relative System Degradation

11% 10%

Pump internals

19% /Eah 63 Pump oil/bearing

,5 Pump overpressure

0 Pump packing

42% . Pump suction problems

- Pump vapor binding

3%

Fig. 4.11. Sources of pump failures.
Table 4.33. Pump subcomponent FCs

Failure source Programmatic monitoring Routine observation Demand Total

Pump internals 6 3 3 12

Pump oil/bearing 23 29 2 54

Pump overpressure 1 5 0 6

Pump packing 7 21 1 29

Pump suction problems 9 1 19 29

Pump vapor binding 1 12 1 14

Total 47 71 26 144

Table 4.34. Pump subcomponent ASE

Failure source Programmatic monitoring Routine observation Demand Total

Pump internals 0.42 0.39 0.33 0.39

Pump oil/bearing 0.39 0.35 0.42 0.37

Pump overpressure 0.33 0.17 N/A 0.20

Pump packing 0.31 0.22 0.17 0.24

Pump suction problems 0.38 0.33 0.32 0.34

Pump vapor binding 0.33 0.36 0.33 0.35

Total 0.38 0.30 0.33 0.33

Table 4.35. Pump subcomponent RSD

Failure source Programmatic monitoring Routine observation Demand Total

Pump internals 0.05 0.02 0.02 0.10

Pump oil/bearing 0.19 0.21 0.02 0.42

Pump overpressure 0.01 0.02 0.00 0.02

Pump packing 0.05 0.10 0.00 0.15

Pump suction problems 0.07 0.01 0.13 0.21

Pump vapor binding 0.01 0.09 0.01 0.10

Total 0.37 0.45 0.18 1.00
126

5. Pump Suction Problems

This category covers a number of types of problems related to the pump suction,

including clogged suction strainers, foreign material in the suction piping, loss of

adequate suction head, and suction pressure instrumentation problems.

6. Pump Vapor Binding

This category addresses failures in which the pump became vapor bound, usually due

to backleakage from main feedwater or the SGs.

The single largest source of pump FCs (54 out of 142) and RSD (42%) was from

pump bearing and oil problems. Pump suction problems were the second largest contributor (21%) to the pump-related RSD. Of the 18% of RSD associated with demand

failures, 13% came from pump-suction-related problems.

4.3.6 Review by Plant

A comparative review of the reported failures from individual plants was made. This

review was conducted for the purposes of identifying the significance of outliers to the

general failure data trends.

Figure 4.12 provides the results of a check of the total number of failures reported for

the plants in the ORNL data base. As noted, more than half the total reported failures came

from <25% of the plants. At the other extreme, <10% of the reported failures came from

over 30% of the plants.

To provide a better focus, the distribution of the historical system degradation

associated with reported failures for the component types was reviewed. The results,

which are provided in Fig. 4.13, are even more pronounced than the results from the check

of total number of failures. More than 50% of the system degradation associated with each

of the designated component groups came from <20% of the plants, while <10% of the

associated degradation came from almost 50% of the plants.

At least two possible causes of these distributions exist. The first is that the reporting

practices vary considerably from plant to plant. The second is that some plants have

experienced more degradation or failure of certain components than others. In reality, there

is some validity to both conclusions, and the results represent the combination of both

causes.

Figures 4.14 and 4.15 provide perspectives on the failure reporting practices of the

ORNL data base plants, based on analysis of the available failure data. From these figures, it can be seen that a consistent pattern in terms of failure reporting to NPRDS is not evident

from a comparison of total FCs in the ORNL data base to FCs for which there was an

NPRDS entry.

Figure 4.16 provides a comparison of the relative contributions of pump drivers,

valve operators, valves, and pumps to overall system degradation at the five plants for

which the greatest extent of AFW system degradation was reported. The range of

percentages of total degradation for the component types among these five plants is listed

below. It is evident that there is substantial diversity, in terms of the relative significance of

component types to overall AFW system degradation, among the five plants.

Component Range of RSD (%)

Pump drivers 19 to 89

Valve operators 7 to 72

Valves 1 to 35

Pumps 3 to 14
ORNL-DWG 90-3328 ETD

1.00

0.90

0.80

En . wU  z

::) WI w

ft-w

, X U. rl

0 0

z ?;

0 F.. P < H

H

0.70

0.60

0.50

0.40

0.30 .-J

0.20

0 10a v fa i

0.00 - 4v bc1~ 

Cumulative FC fraction

PLANT NUMBER

I Cumulative fraction of all years of reactor operation

Fig. 4.12. FCs and operating experience for plants in the ORNL data base.
ORNL-DWG 90-3329 ETD

30 L 30

25

0

:

:D

z

20

15

10

25

20

15

10

5

0

5

I-.

co3

0

>20% >50% >80% >90%

PERCENTAGE OF COMPONENT RELATED DEGRADATION

L Pump drivers E Valve operators 101 Valves 3 Pumps

Fig. 4.13. Sources of component-related degradation.

The failures reported from 9 of the 49 plants in the data base resulted in >50%

of the degradation related to each component type. Over 90% of the degradation came

from just over 50% of the plants.
ORNL-DWG 90-3330 ETD

22.0 -

20.0 -

18.0 -

16.0 -

14.0 -

V)

12.0

10.0

8.0

6.0

4.0

2.0

0.0

PLANT NUMBER

3 NPRDS FCs per year 3 Total FCs per year

Fig. 4.14. Reported FCs per year, by source.
ORNL-DWG 90-3331 ETD

1.00

0.90

0.80

Cd,

z

z

0

z

0.

0.70

0.60

0.50

0.40

0.30

0.20

ILi

0.10

0.00

0 2 4 6 8 10 12 14 16 18 20 22

FCs PER YEAR

Fig. 4.15. Scatter diagram of the fraction of

average number of FCs per year for all data base

FCs available from

plants.

NPRDS data as a function of the
ORNL-DWG 90-3332 ETD

z

2

CI04

1-4

2:

0

90

85

80

75

70

65

60

55-

50

45

40

35

30

25

20

15

10

5

0

I9-

EL Driver M Valve operator EA Valve U Pump

Fig. 4.16. RSD: component percentage contribution for top five plants.
132

5. AFW SYSTEM CONFIGURATIONS

A review of AFW system configurations was conducted for 61 B&W and

Westinghouse plants that are either now operating or are scheduled for near-term operation.

Only B&W and Westinghouse plants were included because the failure data used in

constructing the ORNL failure data base (Chap. 4) were only available for these types of

plants (note that not all 61 plants are included in the failure data base). Of the plants, 33 are

four-loop units, 14 are three-loop units, and 14 are two-loop units. There are 133 motordriven, 63 turbine-driven, and 5 diesel-driven safety-related AFW pumps at these plants.

Table 5.1 provides general SG/AFW pump configuration information for these

plants. In general, for two- and three-loop plants, each available pump can feed each SG.

For four-loop plants, MDP discharge lines are normally aligned to allow each pump to feed

two SGs, whereas turbine- and diesel-driven pump discharge lines are normally aligned to

feed all four SGs.

Reactor thermal power and AFW pump design values are listed in Table 5.2. Note

that, in general, MDP capacities are typically one-half that of TDPs at the same plant.

Actuation signals for both MDPs and TDPs are provided in Tables 5.3 and 5.4.

Explanations of the designated actuation signals follow.

1. Loss of feedwater (FW) - The methods of detecting loss of normal FW vary. Signals

based on low main FW pump discharge pressure, main feed pump breaker open, or

main feed pump turbine tripped are typical.

2. Loss of emergency or reactor coolant pump (RCP) bus - These signals are typically

based on low bus voltage although some plants use RCP tripping as a signal source.

3. Low level in one SG - This signal source is fairly straightforward and is typically based

on low level detected by 2/3 or 2/4 level channels for a single SG.

4. Low level in two SGs - Same as low level for one SG, except that the 2/3 or 2/4 logic

exists for two SGs.

5. SI - AFW start signal from any SI signal.

6. Other - Includes various other sources of automatic pump starting.

AFW start signals are based on the detection of conditions that, at least usually,

indicate extant or imminent degradation of the ability of the SGs to remove heat from the

RCS.

Both B&W and Westinghouse plants use the loss of normal FW as a common start

source, particularly for MDPs. Note that this start signal is nonsafety-related because the

normal FW pumps and associated instrumentation are not safety-related. AFW pump

starting from loss of normal FW is an anticipatory start in recognition of the fact that loss of

FW would rapidly lead to other automatic starting, such as from low SG level.

Starting of AFW pumps because of emergency bus or RCP bus loss or RCP tripping

is the single most common source of pump starting, considering both MDPs and TDPs.

Because emergency bus undervoltage start signals necessitate that the bus providing power

to the MDPs be reenergized before breaker closure, the MDPs are normally sequenced on,

along with other safety-related loads, in conjunction with and following emergency diesel

generator starting. Because TDPs are typically started by opening valves that are not

dependent on ac power (other than vital ac busses powered off the station batteries through

inverters),~ they are started independently of emergency bus reenergization.

SG low-level starting of AFW pumps is a safety-related start signal that is relied upon

for both MDP and TDP starting. TDP starting normally requires low level in two SGs,

whereas MDPs typically only require low level in one SG.

Depending on individual plant design, SI signals originate from several different

sources, such as low RCS pressure, low PZR level, and high containment pressure.

Signals such as these could originate, in turn, from multiple causes, such as excessive
Table 5.1. General AFW configurations

Number Number Number Number Number Number Number

Unit SGs MDPs SGs/MDP TDPs SGs/TDP DDPs SGs/DDP

Arkansas Nuclear One 1 2 1 2 1 2 0

Crystal River 2 1 2 1 2 0

Davis-Besse 2 0 2 2 0

Oconee 1 2 2 la 1 2 0

Oconee 2 2 2 la 1 2 0

Oconee 3 2 2 la 1 2 0

Rancho Seco 2 1 2 1 2 0

Three Mile Island 1 2 2 2 1 2 0

Beaver Valley 1 3 2 3 1 3 0

Beaver Valley 2 3 2 3 1 3 0

Braidwood 1 4 1 4 0 1 4

Braidwood 2 4 1 4 0 1 4

Byron 1 4 1 4 0 . 1 4

Byron 2 4 1 4 .0 1 4

Callaway 4 2 2a 1 4 0

Catawbal 4 2 2a 1 4 0

Catawba 2 4 2 2a 1 4 0

ComanchePeak 1 4 2 2a 1 4 0

Comanche Peak 2 4 2 2a 1 4 0

DCCook 1 4 2 2 1 4 0

DCCook2 4 2 2 1 4 0

DiabloCanyon 1 4 2 2a 1 4 0

Diablo Canyon 2 4 2 2a 1 4 0

Farley 1 3 2 3 1 3 0

Farley 2 3 2 3 1 3 0

Ginna 2 2 2 1 2 0

Haddam Neck 4 0 2 4- 0

Harris 1 3 2 3 1 3 0

IndianPoint2 4 2 2 1 -4 0

Indian Point 3 4 2 2 1 4 0

Kewaunee 2 2 2 1 2 0

McGuire 1 4 2 2a 1 4 0

McGuire 2 4 2 2a 1 4 0

Millstone 3 4 2 2a 1 4 0
Table 5.1 (continued)

Number Number Number Number Number Number Number

Unit SGs MDPs SGs / MDP TDPs SGs /ITDP DDPs SGs /DDP

NorthAnna 1 3 2 3 1 3 0

North Anna 2 3 2 3 1 3 0

Point Beach lb 2 2 1 1 2 0

Point Beach 2b 2 2 1 1 2 0

Prairie Island lb 2 1 2 1 2 0

Prairie lsland 2b 2 1 2 1 2 0

Robinson 2 3 2 3 1 3 0

Salem I 4 2 4 1 4 0

Salem 2 4 2 4 1 4 0

SanOnofre 1 3 1 3 1 3 0

Seabrook 1 4 1 4 1 4 0

Sequoyahl 4 2 2 1 4 0

Sequoyah 2 4 2 2 1 4 0

SouthTexas 1 4 3 la 1 la 0

South Texas 2 4 3 la 1 la 0

Summer 3 2 3 1 3 0

Surry 1 3 2 3 1 3 0

Surry 2 3 2 3 1 3 0

Trojan 4 0 1 4 1 4

Turkey Point 3b 3 0 3 3 0

Turkey Point 4b 3 0 3 3 0

Vogtle 1 4 2 2a 1 4 0

Vogtle 2 4 2 2a 1 4 0

Wolf Creek 4 2 2a 1 4 0

Yankee Rowe 4 2 4 1 4 0

Zion 1 4 2 4 1 4 0

Zion 2 4 2 4 1 4 0

a Normal alignment. Pump discharge lines can be realigned to feed all SGs.

b Units share one or more AFW pumps. Total of two MDPs, two TDPs at Point Beach and Prarie Island plants; total of

three TDPs at Turkey Point plant.
Table 5.2. B&W and Westinghouse plant thermal and pump design ratings

MDP MDP TDP TDP DDP DDP

MW(t) flow head flow head flow head

Unit rating (gal/min) (psid) (gal/min) (psid) (gal/min) (psid)

Arkansas Nuclear One 1 2568 640 1224 770 1223

Crystal River 2542 740 1300 740 1300

Davis-Besse 2772 1050 1050

Oconee 1 2568

Oconee 2 2568

Oconee 3 2568

RanchoSeco 2772 840 1150a 840 1150a

Three Mile Island 1 2568 460 1170 920 1170

Beaver Valley 1 2660 350 1168 700 1168

Beaver Valley 2 2652 375 1196 750 1196

Braidwood 1 3411 990 1452 990 1452

Braidwood 2 3411 990 1452 990 1452

Byron 1 3411 990 1452 990 1452 .

Byron 2 3411 990 1452 990 1452

Callaway 3425 575 1387 1145 1495

Catawba 1 3411 500 1391 1000 1394

Catawba 2 3411 500 1391 1000 1394

Comanche Peak 1 3425 490 1430 985 1452

Comanche Peak 2 3425 490 1430 985 1452

DC Cook 1 3250 450 1176 900 1176

DC Cook 2 3250 450 1176 900 1176

Diablo Canyon 1 3338 490 1300 930 1300

Diablo Canyon 2 3411 490 1300 930 1300

Farley 1 2652 350 1233 700 1229

Farley 2 2652 350 1233 700 1229

Ginna 1520 200 1235 400 1300

Haddam Neck 1825 450 1075

Harris 1 2775 450 1265 900 1265

Indian Point 2 2758 400 1352 940 1352

Indian Point 3 3025 400 1352 940 1352

Kewaunee 1650 240 1235 240 1235

McGuire 1 3411 450 1387 900 1387

McGuire 2 3411 450 1387 900 1387
Table 5.2 (continued)

MDP MDP TDP TDP DDP DDP

MW(t) flow head flow head flow head

Unit rating (gal/min) (psid) (gal/min) (psid) (gal/min) (psid)

Millstone 3 3411 575 1289 1150 1289

North Anna 1 2775 340 1250 340 1430

North Anna 2 2775 340 1250 340 1430

PointBeach 1 1518 200 400

Point Beach 2 1518 200 400

Prairie Island 1 1721 220 1285 220 1285

Prairie Island 2 1721 220 1285 220 1285

Robinson 2 2300 300 1300 600 1300

Salem 1. 3338 440 1300 980 1550

Salem 2 3411 440 1300 980 1550

San Onofre 1 1347 235 1035 300 1088

Seabrook 1 3411 710 1320 710 1320

Sequoyah 1 3411 465 1257 920 1127

Sequoyah2 3411 465 1257 920 1127

South Texas 1 3800

South Texas 2 3800

Summer 2775 400 1430 900 1473

Surry 1 2546 350 1183 700 1183

Surry 2 2546 350 1183 700 1183

Trojan 3423 960 1473 960 1473

Turkey Point 3 2200 600 1203

Turkey Point 4 2200 600 1203

Vogtle 1 3425 630 1517 1175 1517

Vogtle2 3425 630 1517 1175 1517

Wolf Creek 3411 575 1387 1145 1495

Yankee Rowe 600

Zion 1 3391 495 1343 990 1343

Zion 2 3391 495 1343 990 1343

a Value cited is design discharge pressure, not total developed head.

a-s

0'
Table 5.3. AFW MDP actuation signals for Westinghouse and B&W plants

Loss of Low Low

emergency or level, level,

Unit Loss of FW RCP bus one SG two SGs SI Other

B&W Plants

Arkansas Nuclear One 1 Yes Yes Yes No Yes Yes

Crystal River Yes Yes Yes No Yes Yes

Davis-Besse

Oconee 1 Yes No No No No Yes

Oconee 2 Yes No No No No Yes

Oconee 3 Yes No No No No Yes

Rancho Seco Yes Yes No No Yes No

Three Mile Island 1 Yes Yes No No No No

B&W Total 7 4 2 0 3 5

Westinghouse Plants

Beaver Valley 1 Yes Yes No Yes Yes Yes

Beaver Valley 2 Yes Yes No Yes Yes Yes

Braidwood 1 No Yes Yes No Yes No

Braidwood 2 No Yes Yes No Yes No

Byron I No - Yes Yes No Yes No

Byron 2 No Yes Yes No Yes No

Callaway Yes Yes Yes No Yes No

Catawba 1 Yes Yes Yes No Yes No

Catawba 2 Yes Yes Yes No Yes No

Comanche Peak 1 Yes Yes Yes No Yes No

Comanche Peak 2 Yes Yes Yes No Yes No

DC Cook I Yes Yes Yes No Yes No

DC Cook:2 Yes Yes Yes No Yes No

Diablo Canyon 1 Yes Yes Yes No Yes No

Diablo Canyon 2 Yes Yes Yes No Yes No

Farley 1 Yes Yes Yes No Yes No

Farley 2 Yes Yes Yes No Yes No

Ginna Yes Yes Yes No Yes No

Haddam Neck

Harris 1 Yes Yes Yes No Yes No

Indian Point 2 Yes Yes Yes No Yes No
Table 5.3 (continued)

Loss of Low Low

emergency or level, level,

Unit Loss of FW RCP bus one SG two SGs SI Other

Indian Point 3 Yes Yes Yes No Yes No

Kewaunee Yes Yes Yes No Yes No

McGuire 1 Yes Yes Yes No Yes No

McGuire 2 Yes Yes Yes No Yes No

Millstone 3 No Yes Yes No Yes Yes

North Anna 1 Yes Yes Yes No Yes No

North Anna 2 Yes Yes Yes No Yes No

Point Beach 1 Yes No Yes No Yes No

Point Beach 2 Yes No Yes No Yes No

Prairie Island 1 Yes Yes Yes No Yes No

Prairie Island 2 Yes Yes Yes No Yes No

Robinson 2 Yes Yes Yes No Yes No

Salem 1 Yes Yes Yes No Yes No

Salem 2 Yes Yes Yes No Yes No

San Onofre I No No No Yes No No

Seabrook 1 No Yes Yes No Yes No

Sequoyah 1 Yes Yes Yes No Yes No

Sequoyah 2 Yes Yes Yes No Yes No

South Texas 1 No Yes Yes No Yes No

South Texas 2 No Yes Yes No Yes No

Summer Yes Yes Yes No Yes No

Surry 1 Yes Yes Yes No Yes No

Surry 2 Yes Yes Yes No Yes No

Trojan

Turkey Point 3

Turkey Point 

4

Vogtle 1 Yes Yes Yes No Yes No

Vogtle 2 Yes Yes Yes No Yes No

Wolf Creek Yes Yes Yes No Yes No

Yankee Rowe No No No No No No

Zion 1 No Yes Yes No Yes No

Zion 2 No Yes Yes No Yes No

Westinghouse Total 37 45 45 3 47 

3

I-.
Table 5.4. AFW TDP actuation signals for Westinghouse and B&W plants

Loss of Low Low

emergency or level, level,

Unit Loss of FW RCP bus one SG two SGs SI Other

B&W Plants

Arkansas Nuclear One 1 Yes Yes Yes No Yes Yes

Crystal River Yes Yes Yes No Yes Yes

Davis-Besse Yes Yes Yes No No Yes

Oconee 1 Yes No No No No Yes

Oconee 2 Yes No No No No Yes

Oconee 3 Yes No No No No Yes

Rancho Seco Yes Yes No No Yes No

Three Mile Island 1 Yes Yes No No No No

B&W Total 9 7 6 4 8 12

Westinghouse Plants

Beaver Valley 1 No Yes Yes No No No

Beaver Valley 2 No Yes Yes No No No

Braidwood 1

Braidwood 2

Byron 1

Byron 2

Callaway No Yes No Yes No No

Catawba 1 No Yes No Yes No No

Catawba 2 No Yes No Yes No No

Comanche Peak 1 No Yes No Yes No No

Comanche Peak 2 No Yes No Yes No No

DCCook No Yes Yes No No No

DC Cook 2 No Yes Yes No No No

Diablo Canyon I No Yes No Yes No No

Diablo Canyon 2 No Yes No Yes No No

Farley I No Yes No Yes No No

Farley 2 No Yes No Yes No No

Ginna No Yes No Yes No No

Haddam Neck Yes No Yes No No No

Harris I No Yes No Yes No No

Indian Point 2 No Yes No Yes No No
Table 5.4 (continued)

Loss of Low Low

emergency or level, level,

Unit Loss of FW RCP bus one SG two SGs SI Other

Indian Point 3 No Yes No Yes No No.

Kewaunee No Yes No Yes No No

McGuire I No Yes No Yes No No

McGuire 2 No Yes No Yes No No

Millstone 3 No Yes No Yes No No

North Anna 1 Yes Yes Yes No Yes No

North Anna 2 Yes Yes Yes No Yes No

Point Beach 1 No Yes No Yes No No

Point Beach 2 No Yes No Yes No No

Prairie Island 1 Yes Yes Yes No Yes No

Prairie Island 2 Yes Yes Yes No Yes No

Robinson 2 No Yes No Yes No No

Salem 1 No Yes No Yes No No

Salem 2 No Yes No Yes No No

San Onofre 1 No Yes No Yes No No

Seabrook 1 No Yes Yes No Yes No

Sequoyah 1 Yes Yes No Yes Yes No

Sequoyah 2 Yes Yes No Yes Yes No

South Texas 1 No No Yes No Yes No

South Texas 2 No No Yes No Yes No

Summer No Yes No Yes No No

Surry I No Yes No Yes No No

Surry 2 No Yes No Yes No No

Trojan Yes Yes Yes No Yes No

Turkey Point 3 Yes Yes Yes No Yes No

Turkey Point 4 Yes Yes Yes No Yes No

Vogtle I No Yes No Yes No No

Vogtle 2 No Yes No Yes No No

Wolf Creek No Yes No Yes No No

Yankee Rowe

Zion 1 No Yes No Yes Yes No

Zion 2 No Yes No Yes Yes No

Westinghouse Total 18 50 18 33 17 

6

0
141

cooldown/depressurization of the RCS caused by excessive steam flow, SG tube rupture in

which the loss of RCS inventory exceeds makeup capacity, or a loss-of-coolant accident.

Table 5.5 lists the numbers of and types of valve operators in the AFW system at the

B&W and Westinghouse plants. Some valves with power operators, as well as the AFW

pumps, have automatic actions to perform with AFW system starting. All TDPs depend on

one or more steam supply valves, or the turbine's T&T valve, to open to start the turbine.

Depending on individual plant design, discharge valves (including those in the recirculation

or other alternative flow paths) may be required to open automatically, control pressure or

flow, or close on automatic AFW system actuation. Discharge valves are also required to

isolate flow for certain conditions at some plants (e.g., the detection of a faulted SG).

Pump suction valves at some plants are required to automatically reposition on detection of

low suction pressure to ensure the availability of a source of water for the pumps.

As Table 5.5 shows, the total number of air-operated valves (AOVs) and motoroperated valves (MOVs) in both steam supply and pump discharge piping applications are

almost equal at Westinghouse plants, whereas the B&W plants incorporate more MOVs

than AOVs. A few solenoid-operated valves (SOVs) and electrohydraulic-operated valves

(EHOVs) are in both types of applications. Note that neither T&T valves (normally dc

motor operated) nor GVs (normally with hydraulic actuators) are included in this list.

Pump suction valves with power operators are predominately motor operated.

Note that not all valves with power operators have automatic functions, but rather

may depend on remote operator action. On the other hand, some valves, such as pumpdischarge pressure-control valves, may have an automatic control function, with no

provision for remote operator control.

Table 5.6 provides a breakdown of the operator types and normal standby positions

for discharge flow-control valves and discharge isolation-valves. Note that some plants do

not have power-operated isolation valves other than the flow-control valves.

Table 5.7 includes a designation of the type of minimum flow restriction device used

and identification of the availability of a full ("full flow" meaning design flow) test loop.

Determination of both characteristics was based on FSAR flow diagrams. Note that some

plants for which a full-flow test loop is available may not use the full-flow test loop for

routine pump testing. Furthermore, some plants without full-flow test loops may run their

AFW pumps at full flow periodically (typically at each cold shutdown) in conjunction with

their pump and valve in-service test program.

Devices used for minimum flow restriction are normally orifices and/or control

valves. At some plants, the control valves in the minimum flow lines automatically isolate

or open based on control signals, while at others the valves are set at fixed positions.

Table 5.8 identifies the required inventory of condensate supply and the type of

switchover to the alternate suction source that is provided. Where automatic switch-over is

provided, initiation is normally by low pump suction pressure switches.
Table 5.5. Numbers of B&W and Westinghouse plant valve operator types

Discharge valves Suction valves Steam supply valves

Unit AOV MOV SOV EHOV AOV MOV AOV MOV SOV EHOV

B&W Plants

ArkansasNuclearOne I 1 6 4 0 0 6 0 5 2 0

Crystal River 0 4 4 0 0 4 0 4 0 0

Davis-Besse 0 8 0 0 0 2 0 4 0 0

Oconee 1 4 7 0 0 0 2 2 2 0 0

Oconee 2 4 7 0 0 0 2 2 2 0 0

Oconee 3 4 7 0 0 0 2 2 2 0 0

Rancho Seco 3 6 2 0 0 0 0 3 0 0

Three Mile Island 1 5 2 0 0 0 2 3 4 0 0

B&W Total 21 47 10 0 0 20 9 26 2 0

Westinghouse Plants

Beaver Valley 1 3 9 0 0 0 0 2 1 0 0

Beaver Valley 2 0 0 0 6 0 0 0 0 6 0

Braidwood I 10 8 0 0 0 4 0 0 0 0

Braidwood 2 10 8 0 0 0 4 0 0 0 0

Byron I 10 8 0 0 0 4 0 0 0 0

Byron 2 10 8 0 0 0 4 0 0 0 0

Callaway 4 4 0 0 0 7 2 0 0 0

Catawba 1 6 8 0 0 0 7 2 0 0 0

Catawba 2 6 8 0 0 0 7 2 0 0 0

Comanche Peak I 10 8 0 0 0 2 2 0 4 0

ComanchePeak2 10 8 0 0 0 2 2 0 4 0

DCCook 1 7 8 0 0 0 3 0 2 0 0

DC Cook 2 7 8 0 0 0 3 0 2 0 0

Diablo Canyon I 0 4 0 4 0 2 0 2 0 0

Diablo Canyon 2 0 4 0 4 0 2 0 2 0 0

Farley 1 6 9 0 0 0 5 5 0 0 0

Farley 2 6 9 0 0 0 5 5 0 0 0

Ginna 7 5 0 0 1 3 0 2 0 0

Haddam Neck 4 1 0 0 0 0 2 0 0 0

Harris I 0 8 0 8 0 8 0 2 0 0

Indian Point 2 10 0 0 0 4 0 3 0 0 0

Indian Point 3 10 0 0 0 4 0 3 0 0 0
Table 5.5 (continued)

Discharge valves Suction valves Steam supply valves

Unit AOV MOV SOV EHOV AOV MOV AOV MOV SOV EHOV

Kewaunee 2 2 0 0 0 0 0 2 0 0

McGuire I 11 8 0 0 0 8 2 0 0 0

McGuire 2 11 8 0 0 0 8 2 0 0 0

Millstone 3 2 4 12 0 2 0 3 3 0 0

NorthAnna 1 5 4 0 0 0 0 2 0 0 0

North Anna 2 5 4 0 .0 0 0 2 0 0 0

Point Beach 1 3 4 0 0 0 0 0 2 0 0

Point Beach 2 3 4 0 0 0 0 0 2 0 0

.Prairie Island I 0 *6 0 0 0 4 1 2 0 0

Prairie Island 2 0 6 0 0 0 4 1 2 0 0

Robinson 2 0 8 0 3 0 0 0 3 0 0

Salem I 10 0 0 0 3 0 1 0 0 0

Salem 2 .10 0 0 0 3 0 1 0 0 0

SanOnofre I 4 2 0 0 0 0 2 0 0 0

Seabrook 14 0 .0 0 0 0 0 0 0 2

Sequoyah1 8 0 :0 0 0 8 0 4 0 0

Sequoyah 2 8 0 0 0 0 8 0 4 0 0

SouthTexas 1 4 8 0 0 0 0 0 1 1 0

South Texas 2 4 8 .0 0 0 0 0 1 1 0

Summner 9 0 0 0 0 6 1 2 0 0

Surry1. . 0 6 0 0 0 0 2 0 0 0

Surry 2. 0 6 0 0 0 0 2 0 0 0

Trojan 0 8 0 0 0 2 4 1 0 0

:Turkey Point 3 6 0 0 0 0 0 0 3 0 0

Turkey Point 4 6 0 0 0 0 0 0 3 0 0

,Vogtle 1 0 10 0 0 0 3 0 3 0 0

*Vogde 2 0 10 0 0 0 3 0 3 0 0

Wolf Creek . 4 4 0 0 0 3 2 0 0 0

Yankee Rowe 4 3 0 0 0 0 1 0 0 0

Zion 1 8 8 0 0 0 5 0 2 0 0

Zion2 8 8 0 0 0 5 0 2 0 0

Westinghouse Total 275 272 12 25 17 139 59 58 16 2

l
Table 5.6. Flow control and isolation valve types, normal positionsa

FCV FCV Other isolation valve Isolation valve

Unit operator type normal position operator type normal position

Arkansas Nuclear One 1

Crystal River

Davis-Besse

Oconee 1

Oconee 2

Oconee 3

Rancho Seco

Three Mile Island 1

SOV

MOV

MOV

AOV

AOV

AOV

AOV/SOV

AOV

NO

NO

NO

NC

NC

NC

NO

NO

MOV

SOV

MOV

MOV

MOV

MOV

MOV

MOV

NO

NO

NO/NC

NO

NO

NO

NC

NO

Beaver Valley 1

Beaver Valley 2

Braidwood 1

Braidwood 2

Byron 1

Byron 2

Callaway

Catawba 1

Catawba 2

Comanche Peak 1

Comanche Peak 2

DC Cook 1

DC Cook 2

Diablo Canyon 1

Diablo Canyon 2

Farley 1

Farley 2

Ginna

Haddam Neck

Harris 1

Indian Point 2

Indian Point 3

Kewaunee

McGuire 1

McGuire 2

Millstone 3

North Anna 1

MOV

EHOV

AOV

AOV

AOV

AOV

MOVWAOV

AOV

AOV

AOV

AOV

MOV

MOV

EHOV/MOV

EHOV/MOV

AOV

AOV

MOVDAOV

AOV

EHOV

AOV

AOV

AOV/MOV

AOV

AOV

SOV

AOV/MOV

NO

NO

NO

NO

NO

NO

NO

NO

NO

NO

NO

NO

NO

NO/NC

NO/NC

NC

NC

NO/NC

NC

NO

NO

NO

NO

NO

NO

NO

NO

MOV NO

MOV

MOV

MOV

MOV

NO

NO

NO

NO

MOV

MOV

MOV

MOV

NO/NC

NO/NC

NO

NO

MOV

MOV

NO

NO

MOV NO

MOV

MOV

SOV/MOV

NO

NO

NO
Table 5.6 (continued)

FCV FCV Other isolation valve Isolation valve

Unit operator type normal position operator type normal position

North Anna 2 AOV/MOV NO

Point Beach 1 MOV NO

Point Beach 2 MOV NO

Prairie Island 1 MOV NO MOV NO

Prairie Island 2 MOV NO MOV NO

Robinson 2 EHOV NC MOV NC

Salem 1 AOV NO

Salem 2 AOV NO

San Onofre 1 AOV NO

Seabrook 1 AOV NO

Sequoyah 1 AOV NC

Sequoyah 2 AOV NC

South Texas 1 MOV NO MOV NC

South Texas 2 MOV NO MOV NC

Summer AOV NO AOV NO

Surry 1 MOV NO

Surry 2 MOV NO

Trojan MOV NO

Turkey Point 3 AOV NC

Turkey Point 4 AOV NC

Vogle 1 MOV NO

Vogtle 2 MOV NO

Wolf Creek AOV/MOV NO

Yankee Rowe MOV NO

Zion 1 AOV NO MOV NO

Zion 2 AOV NO MOV NO

a FCV - Flow-control valve

AOV - Air-operated valve

EHOV - Electrohydraulic-operated valve

MOV - Motor-operated valve

SOV - Solenoid-operated valve

NO - Normally open

NC - Normally closed

e-n
Table 5.7. Test loop and recirculation control types

Full flow Miniflow flow

Unit test loop available? restriction type

Arkansas Nuclear One 

1

Crystal River

Davis-Besse

Oconee 1

Oconee 2

Oconee 3

Rancho Seco

Three Mile Island 1

Yes

No

Yes

TDPonly

TDP only

TDP only

Yes

No

Beaver Valley 

1

Beaver Valley,2

Braidwood 

1

Braidwood 2

Byron 1

'Byron 2

Callaway

Catawba 1.

Catawba 2

Comanche Peak 

1

Comanche Peak 2

DC Cook 1

DC Cook 2

Diablo Canyon 

I

Diablo Canyon 

2

Farley 

1

Farley 2

Ginna

Haddam Neck

Harris 1

Indian Point 2

Indian Point 3

Kewaunee

McGuire 

1

McGuire 2

Millstone 

3

Partial

No

No

No

No

No

No

Yes

Yes

Yes

Yes

Yes

Yes

No

No

Yes

Yes

No

No

No

Yes

Yes

No

Yes

Yes

No

Orifice

Line size

Orifice

Orifice/CV

Orifice/CV

Orifice/CV

Orifice

Orifice/line size

Orifice/CV

Orifice

Orifice

Orifice

Orifice

Orifice

Orifice

CV

CV

Orifice

Orifice

CV

CV

Orifice

Orifice

Orifice/CV

Orifice/CV

Orifice/CV

OrificeS

Orifice/CV

Orifice/CV

Orifice/CV

CV

CV

Orifice

a%
Table 5.7 (continued)

Full flow Miniflow flow

Unit test loop available? restriction type

North Anna 1 No Orifice

North Anna 2 No Orifice

Point Beach I No OrificelCV

Point Beach 2 No Orifice/CV

Prairie Island 1 No Orifice

Prairie Island 2 No Orifice

Robinson 2 No Orifice

Salem 1 No Orifice/CV

Salem 2 No Orifice/CV

San Onofre 1 No Orifice

Seabrook I No Orifice

Sequoyah 1 No Orifice

Sequoyah 2 No Orifice

South Texas 1 Yes CV

South Texas 2 Yes CV

Summer No Orifice

Surry 1 No Orifice

Surry 2 No Orifice

Trojan No Orifice

Turkey Point 3 No Orifice

Turkey Point 4 No Orifice

Vogtle I No Orifce/V

Vogtle 2 No Orifice/V

Wolf Creek No Orifice

Yankee Rowe CV

Zion 1 No Orifice

Zion 2 No Orifice
Table 5.8. Normal suction supply quantity and suction switchover method

Technical Specification required Auto or manual

Unit supply (gal x 103) suction switchover

Arkansas Nuclear One I

Crystal River

Davis-Besse

Oconee 1

Oconee 2

Oconee 3

Rancho Seco

Three Mile Island 1

Beaver Valley 1

Beaver Valley 2

Braidwood 1

Braidwood 2

Byron 1

Byron 2

Callaway

Catawba 1

Catawba 2

Comranche Peak 1

Comanche Peak 2

DC Cook 1

DC Cook 2

Diablo Canyon 1

Diablo Canyon 2

Farley 1

Farley 2

Ginna

Haddam Neck

Harris 1

Indian Point 2

Indian Point 3

Kewaunee

McGuire 1

McGuire 2

Millstone 3

North Anna 1

107

150

250

72

72

72

250

150

Manual

Manual

Auto

Manual

Manual

Manual

Manual

Manual

140a

127

200

200

200

200

281

225

225

276a

276a

178

178

150

150

22.5

130

240

360

360

30

297.5 Max a

297.5 Max a

334

110

Manual

Manual

Auto

Auto

Auto

Auto

Auto

Auto

Auto

Manual

Manual

Manual

Manual

Manual

Manual

Manual

Manual

Manual

Manual

Manual

Manual

Manual

Manual

Auto

Auto

Manual

Manual
Table 5.8 (continued)

: . : 'ni Technical Specification required Auto or manual

.Unit . supply (gal x 103) suction switchover

North Anna 2 110 Manual

Point Beach 1 90 Manual

Point Beach 2 90 Manual

Prairie Island 1 100 Manual

Prairie Island 2 100 Manual

Robinson 2 35 Manual

Salem 1 200 Manual

Salern 2 200 Manual

San Onofre 1 190 Manual

Seabro6k 1 212 Manual

Sequoyah 1 190 Auto

Sequoyah 2 190 Auto

South Texas 1 518 Manual

South Texas 2 518 Manual

Summer 173 Auto

Suriy 1 96 Manual

Surry 2 96 Manual

Trojan 450a Manual

Turkey Point 3 185 Manual

Turkey Point 4 185 Manual

Vogte 1 340 Manual

Vogte 2 340 Manual

Wolf Creek 281 Auto

Yankee Rowe

Zion 1 170 Manual

Zion 2 170 Manual

a Value cited is from unit FSAR.
150

6. RESULTS, CONCLUSIONS, AND RECOMMENDATIONS

The Phase I study of the AFW system consisted of three primary parts:

1. A detailed review of the AFW system design and operating/monitoring practices of a

plant owned by a cooperating utility was conducted.

2. Operational failure events for AFW system components from three failure data base

sources were reviewed and analyzed. 3. A summary review and tabulation of AFW system configurations and design

information available from individual plant FSARs and Technical Specifications was

completed.

The detailed results of these three parts are provided in Chaps. 3, 4, and 5. The

combined results of parts 1 and 2 given previously (part 3 was performed primarily for

general information and to support the studies of parts 1 and 2) provide the basis for the

following observations and recommendations.

6.1 RELATIVE SIGNIFICANCE OF AFW COMPONENTS

To gain some perspective concerning the more significant contributors to AFW

system degradation, the historical failure data were relied upon heavily. Although the

available failure data have substantial limitations, even with the uniformity of

characterization afforded by the ORNL compilation, they are useful as a rough indicator of

relative trends.

6.1.1 Results

The review of the failure data indicated that a few types of AFW system components

were responsible for a large fraction of system degradation. Turbine drivers (including the

turbine, its T&T valve, GV, and associated control circuitry), valve air operators, and valve

motor operators accounted for over one-half of the system degradation. Problems with the

turbine drivers alone accounted for 27% of the system degradation. Valve air operators,

motor operators, pumps, and check valves were responsible for 14, 13, 12, and 9% of

system degradation, respectively.

The AFW system degradation associated with turbine drivers is particularly

noteworthy because there is a total population of only 51 TDPs at the plants in the failure

data base, compared with 77 MDPs, 315 AOVs, and 438 MOVs. Of the turbine failures,

only a very small portion (<10%) involved failures or degradation of the turbine itself. The

majority of the failures involved problems with turbine auxiliaries (primarily I&C/governor

control and T&T valve problems). On-demand failures of turbines were responsible for

almost one-fourth of all turbine-related degradation and for over one-third of all on-demand

failure degradation.

6.1.2 Conclusions

The turbine drive is the single component type that stands out in the failure data as the

most significant source of AFW system degradation. It is also, by far, the single largest

source of system degradation associated with on-demand failures. More specifically,

problems associated with the governor and controls for TDPs have been very significant

sources of degradation. The other significant AFW system component types, including pumps, check valves,

and air and motor operators have been or are being reviewed in detail as a part of the NPAR
151

program. Because of the significance of the turbine to historical AFW system degradation,

as well as the fact that the turbines used on AFW pumps are similar to those used on some

safety-related pumps in boiling-water reactor (BWR) plants, further review of turbine

drives in general, and more specifically the turbine controls, appears warranted.

6.2 ADEQUACY OF CURRENT MONITORING PRACTICES

In keeping with the goals of the NPAR Program, one of the driving forces behind the

reviews was an attempt to ascertain the adequacy of current monitoring practices. The

extent to which failure sources could be detected by the surveillance and operating practices

at an individual plant was determined as a part of the Plant A review. The extent to which

actual failure events have been detected by programmatic monitoring practices, through

routine observation, and during demand events was ascertained during the review of

historical failure data. The results from the combined reviews provide important insights

into which types of failures have occurred, how those failures have been detected

historically, and how well failures could be detected by existing monitoring methods.

In conjunction with the review of the Plant A procedures, the frequency of test-related

actuation of AFW system components was estimated. The number of test actuations was

tabulated to give an indication of (1) the likelihood of degradation or failure of a component

being identified (i.e., whether that particular component was being verified operable or

not), and (2) the extent of service wear that may be associated with testing.

The results available from the reviews of: (1) Plant A failure source detectability, (2)

historical failure records, and (3) the frequency of test-related actuation provide a

combination of information that is useful for making a general assessment of monitoring

requirements and implementing program efficiency. By comparing the relative significance

of a particular component, from both a historical failure and identified failure

nondetectability perspective, to the relative attention given the component by the Plant A

monitoring program, a summary indication of the extent of monitoring optimization can be

gathered.

6.2.1 Results

6.2.1.1 Detectability of failure/degradation

The types of failure sources or conditions that were found not to be detectable by

current monitoring or routine operating practices at Plant A largely fall into two categories.

The categories and examples of each follow.

1. A component or group of components is unable to perform as required under design

basis accident or off-normal conditions even though the general performance is

demonstrated under more normal conditions.

Example:

Failure Condition: An MDP is degraded and unable to deliver required flow with

the associated SGs at maximum postaccident/transient pressure.

Nondetectability: The MDPs are verified to be operable by testing under

recirculation flow only (at -10% of design flow). Although check valves in the

discharge flow path are verified operable by delivery of the required flow to the

SGs, there is no requirement for, nor monitoring of, SG, pump suction, and pump

discharge pressure.
152

2. A component or group of components is unable to perform as required because of

failures of related I&C that are not observed during routine testing or operation.

Example:

Failure Condition: The SG BDIVs fail to close following TDP start because of

failure of contacts associated with a stem-operated limit switch for the turbine T&T

valve.

Nondetectability: SG BDIVs are not verified to close in response to starting of the

TDP by any testing.

Note that some of the mentioned nondetectable failure conditions actually apply to

both categories; that is, failures in I&C circuitry that would only be challenged under

design-basis accident or off-normal conditions. For example, there is no verification that

the SSVs can complete the automatic steam supply transfer if the normal steam supply

source (SG A) is not available to drive the TDP (as would be the case following an event in

which SG A was depressurized, such as a FW line break). A number of I&C components

that are not tested (relays, contacts) must operate properly to accomplish the transfer.

6.2.1.2 Failure history

The review of historical failure data provided a broader, but less detailed perspective

of the ability of current monitoring programs and routine observations to detect

degradation/failure of AFW system components. Because design-basis challenges of most

components are extremely rare, the historical failure data, even for demand-related failures,

are not good indicators of the ability of components to perform under design-basis

conditions. Therefore, the data are not particularly useful as a means of confirming the

observations made in the Plant A review relative to the ability of components to perform as

required under design-basis/off-normal conditions (see the discussion under Sect. 6.2.1.1,

category 1, above). The different perspective offered by the failure data review does,

however, complement the observations made as a part of the Reference Plant review

because about one-half of the degradation detected during demand events was caused by

I&C-related failures, whereas, as noted in category 2 of Sect. 6.2.1.1, many of the

nondetectable failure conditions that could exist at Plant A were I&C related.

The failure data review found that about one-fifth of overall AFW system degradation

was detected during demand events. This finding is also complementary to the results of

the Plant A review, in which a significant number of failure conditions were found that

would not be detectable by programmatic monitoring or by routine observations.

6.2.1.3 Test frequency

Table 6.1 provides a summary of estimated test-related actuation frequency for

various AFW system components at the Plant A. Some components were found to be

actuated, for testing purposes, about an order of magnitude more frequently than others.

Note that the number of actuations cited in the table include actuations that result from

two sources: (1) those required in support of testing that demonstrates operability of the

individual component and (2) actuations that occur in conjunction with testing other

components or systems. For the components tested least frequently, the majority or all of

the actuations come from the former, while for many of the components most frequently

actuated, the majority of the actuations come about as a result of the latter.
153

Table 6.1. Estimated test frequency for Plant A

AFW system components

Number of test

Component actuations per yeara

SCVs C-3, -4,

SCV C-S

MOV-1, -2, -3, -4

MOV-5, -6, -7, -8

MDPs

TDP

T&T valve

MCVs C-6, -8

MCV C-10

CMCVs C-1, -2

DCVs C-7, -9

DCVC-1 1

LCV-1, -3, -5, -7

LCV-lA, -3A, -5A, -7A

LCV-2, -4, -6, -8

LCVCVs C-13, -15, -17, -19

LCVCVs C-12, -14, -16, -18

MFCVs C-21, -22, -24, -25

FWCVs C-20, -23, -26, -27

FWIV-1, -2, -3, -4

BDV-1, -2, -3, -4

MOV-i1, -12

MOV-9 /MOV-10

13 Partial, 2 full

11 Partial, 4 full

5 Full

5 Full

12 Recirc 2 full flow

11 Recirc /4 full flow

43 Full

14 Full

15 Full

39 Partial, 1 full

2 Full

4 Full

23 Full

21 Full

26 Full

2 Full

4 Full

6 Full

0 Full

5 Full

29 Full

25 Full

29/25 Full

aAll test actuation frequencies are estimated based on an assumed 18-

month fuel cycle length.
154

6.2.2 Conclusions

The fraction of AFW system degradation that has historically been found during

demand events, as well as the number and types of failure and degradation sources that

were found to not be detectable by the monitoring methods in place at Plant A, indicate the

need for improvement in certain aspects of the current monitoring practices. Although no

guidelines establish an acceptable level of fraction of failures detected during demand, the

rate indicated by the failure data review (-18% of all system degradation was detected

during demand conditions) appears excessive. This is particularly the case for certain

component types and parts (e.g., the pump driver group and TDP I&C/governor controls).

It was also found in the Plant A review that the ability of some components to

function as required under design-basis or off-normal conditions is not verified

periodically. This was found to be the case particularly where multiple component

interaction is involved. Decidedly adverse effects could result from routine testing of some

of these currently nontested areas (such as checking the ability of the AFW pumps to

successfully negotiate the suction transfer from the CST to ESW), whereas other areas

could be checked fairly easily with little additional effort and no adverse consequences

(such as verifying pump capability by monitoring additional parameters during the full

stroking of check valves in the discharge flow path). When the test frequency and the information that can be gathered from the various

test-related actuations of AFW system components are considered in light of historical

failure experience and areas of nondetectability identified by the review of the Plant A

monitoring program, it is apparent that both the test requirements and the actual

implementation of those requirements are not optimized. While an attempt to tabulate areas

of nonoptimization has not been made, the following example is indicative of the lack of

test optimization.

Example

The historical failure data showed that over half of the system degradation

associated with turbine failures was caused by I&C and governor control related

problems. (Remember that turbine-related failures were the single most significant

source of system degradation.) Yet there is no specific Technical Specification

requirement for the calibration of the governor control system. At Plant A, the

governor is calibrated, according to ST-27, on a refueling frequency. However, in

the "Scope" section, the procedure notes that "This instruction does not satisfy any

Technical Specification surveillance requirements" and "This instruction is intended

to be performed during each refueling outage but may be performed in whole or in

part as needed." In the ORNL compilation of nondetectable failure sources, it was

assumed that this procedure was conducted in full each refueling outage. Because

there is no requirement to conduct this testing, the testing may not be conducted for

an indefinite period. Note that some plants do not even designate the governor

calibration procedure as a "Surveillance Procedure." In fact, because Technical

Specifications do not require the calibration, it is to be expected that governor

calibration procedures would normally not be designated as such. As noted in the

discussion for the TDP for Plant A, a number of turbine-related I&C failure sources

(ignoring governor-related areas) are also not detectable by the existing monitoring

program.

Thus, the single largest source of turbine-related problems is monitored directly on a

refueling frequency (roughly every 12 to 18 months) at best.

On the other hand, the T&T valve, which was a less significant source of turbinerelated problems, is estimated to be stroked over 40 times a year in support of testing at
155

Plant A. Ironically, worn linkage was identified as the source of many of the T&T valve

problems in the failure data. Because a substantial portion of T&T valve operation occurs

from testing, testing itself may be a significant source of T&T valve problems. In light of those observations, it appears that enhancements in current monitoring requirements and practices are warranted. Enhancements should focus on

1. optimizing the testing requirements/programs to reduce testing of components that have

historically not been major contributors to system degradation and for which the current

testing provides little useful information, while at the same time focusing more attention

on those components and functional areas that have been more significant historically;

2. specifically improving the monitoring of I&C portions of the AFW system; and

3. better verifying the ability of components to function under design-basis/off-normal

conditions.

6.3 RECOMMENDATIONS

This report concludes with three recommendations:

1. Conduct a Phase II study of the AFW system. The Phase II study should include the

following:

a. the detailed identification of areas of current monitoring/operating practices and

requirements that are not optimal for maintaining the availability and demonstrating

the operability of the AFW system. Based upon the results of the Phase I study, the

areas that appear to be inadequately monitored (e.g., governor controls/I&C for the

turbine), as well as areas in which the level of testing appears excessive (e.g.,

stroking of the T&T valve), should be specifically addressed.

b. the development of recommended changes, based upon the results of item a, to

monitoring/operating practices and requirements to ensure that appropriate attention is

provided to historically significant sources of AFW system degradation, while

minimizing unnecessary testing (and the accompanying test-related wear).

2. Conduct a Phase I study of the AFW turbine drive. Because of the similarity of the

AFW turbines to safety-related turbines used in BWR systems, a review of safetyrelated turbine drives in general should be considered.

3. Because of the significance of turbine governor and I&C related problems found in both

the failure data and the Plant A reviews, consideration should be given to the conduct of

a Phase I study of governors and their controls. Governors used on AFW turbines, as

well as BWR safety-related pump turbines, emergency diesels, and diesel-driven pumps

should be considered for inclusion in this study.
157

APPENDIX A

RELEVANT TECHNICAL SPECIFICATIONS
159

AUXILIARY FEEDWATER SYSTEM

LIMITING CONDITION FOR OPERATION

3.7.1.2 At least three independent steam generator auxiliary feedwater pumps and

associated flow paths shall be OPERABLE with:

a. Two motor-driven auxiliary feedwater pumps, each capable of being powered

from separate shutdown boards, and

b. One turbine-driven auxiliary feedwater pump capable of being powered from an

OPERABLE steam supply system.

APPLICABILITY: MODES 1, 2, and 3.

ACTION:

a. With one auxiliary feedwater pump inoperable, restore the required auxiliary

feedwater pumps to OPERABLE status within 72 hours or be in at least HOT

STANDBY within the next 6 hours and in HOT SHUTDOWN within the

following 6 hours.

b. With two auxiliary feedwater pumps inoperable, be in at least HOT STANDBY

within 6 hours and in HOT SHUTDOWN within the following 6 hours.

c. With three auxiliary feedwater pumps inoperable, immediately initiate corrective

action to restore at least one auxiliary feedwater pump to OPERABLE status as

soon as possible.

SURVEILLANCE REQUIREMENTS

4.7.1.2 In addition to the requirements of Specification 4.0.5 each auxiliary feedwater

pump shall be demonstrated OPERABLE by:

a. Verifying that:

1. each motor-driven pump develops a differential pressure of greater than

or equal to - psid on recirculation flow.

2. the steam-turbine driven pump develops a differential pressure of greater

than or equal to - psid on recirculation flow when the secondary steam

supply pressure is greater than - psig. The provisions of Specification

4.0.4 are not applicable for entry into MODE 3.

3. each automatic control valve in the flow path is OPERABLE whenever

the auxiliary feedwater system is placed in automatic control or when

above 10% of RATED THERMAL POWER.
160

b. At least once per 18 months during shutdown* by:

1. Verifying that each automatic valve in the flow path actuates to its correct

position upon receipt of an auxiliary feedwater actuation test signal and a

low auxiliary feedwater pump suction pressure test signal.

2. Verifying that each auxiliary feedwater pump starts as designed

automatically upon receipt of each auxiliary feedwater actuation test

signal.

c. At least once per 7 days by verifying that each non-automatic valve in the

auxiliary feedwater system flowpath is in its correct position.

*The provisions of Specification 4.0.4 are not applicable for entry into MODE 3 for the

turbine-driven Auxiliary Feedwater Pump.

BASIS

The OPERABILITY of the auxiliary feedwater system ensures that the Reactor Coolant

System can be cooled down to less than 350WF from normal operating conditions in the

event of a total loss of off-site power.

The steam driven auxiliary feedwater pump is capable of delivering - gpm (total feedwater

flow) and each of the electric driven auxiliary feedwater pumps are capable of delivering - gpm (total feedwater flow) to the entrance of the steam generators at steam generator

pressures less than _ psia. At - psia the open steam generator safety valve(s) are capable

of relieving at least _% nominal steam flow. A total feedwater flow of _ gpm at

pressures less than _ psia is sufficient to ensure that adequate feedwater flow is available

to remove decay heat and reduce the Reactor Coolant System temperature to less than

350OF where the Residual Heat Removal System may be placed into operation.

NOTE: Some values are omitted in order to maintain anonymityfor Plant A.
161

CONDENSATE STORAGE TANK

LIMITING CONDITION FOR OPERATION

3.7.1.3 The condensate storage tank system (CST) shall be OPERABLE with a contained

water volume of at least - gallons of water.

APPLICABILITY: MODES 1, 2, and 3.

AMION:

With the condensate storage tank system inoperable, within 4 hours either

a. Restore the CST to OPERABLE status or be in at least HOT STANDBY within

the next 6 hours and in HOT SHUTDOWN within the following 6 hours, or

b. Demonstrate the OPERABILITY of the emergency service water system as a

backup supply to the auxiliary feedwater pumps and restore the condensate

storage tank to OPERABLE status within 7 days or be in at least HOT

STANDBY within the next 6 hours and in HOT SHUTDOWN within the

following 6 hours.

SURVEILLANCE REQUIREMENTS

4.7.1.3.1 The condensate storage tank system shall be demonstrated OPERABLE at least

once per 12 hours by verifying the contained water volume is within its limits when the

system is the supply source for the auxiliary feedwater pumps.

4.7.1.3.2 The emergency service water system shall be demonstrated OPERABLE at least

once per 12 hours by verifying that the emergency service water system is in operation

whenever it is the supply source for the auxiliary feedwater pumps.
162

APPLICABILITY

SURVEILLANCE REQUIREMENTS

4.0.4 Entry into an OPERATION MODE or other specified condition shall not be made

unless the Surveillance Requirement(s) associated with the Limiting Condition for

Operation have been performed within the specified surveillance interval or as otherwise

specified.

4.0.5 Surveillance Requirements for inservice inspection and testing of ASME Code Class

1, 2, and 3 components shall be applicable as follows:

a. Inservice inspection of ASME Code Class 1, 2, and 3 components and inservice

testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with Section XI of the ASME Boiler and Pressure Vessel Code

and applicable Addenda as required by 10 CFR 50, Section 50.55a (g), except where specific written relief has been granted by the Commission pursuant to

10 CFR 50, Section 50.55(g)(6)(i).

b. Surveillance intervals specified in Section XI of the ASME Boiler and Pressure

Vessel Code and applicable Addenda for the inservice inspection and testing

activities required by the ASME Boiler and Pressure Vessel Code and applicable Addenda shall be applicable as follows in these Technical Specifications:

ASME Boiler and Pressure Vessel Code Required frequencies for

and applicable Addenda terminology for performing inservice inspection inservice inspection and testing activities and testing activities

Weekly At least once per 7 days Monthly At least once per 31 days Quarterly or every 3 months At least once per 92 days Semiannually or every 6 months At least once per 184 days

Every 9 months At least once per 276 days

Yearly or annually At least once per 366 days

c. The provisions of Specification 4.0.2 are applicable to the above required frequencies for performing inservice inspection and testing activities.

d. Performance of the above inservice inspection and testing activities shall be in

addition to other specified Surveillance Requirements.

e. Nothing in the ASME Boiler and Pressure Vessel Code shall be construed to

supersede the requirements of any Technical Specification.
163

3/4.3.2 ENGINEERED SAFETY FEATURE ACTUATION SYSTEM

INSTRUMENTATION

LIMITING CONDITION FOR OPERATION

3.3.2 The Engineered Safety Feature Actuation System (ESFAS) instrumentation channels

and interlocks shown in Table 3.3-3 shall be OPERABLE with their trip setpoints set

consistent with the values shown in the Trip Setpoint column of Table 3.3-4 and with

RESPONSE TIMES as shown in Table 3.3-5.

APPLICABILITY: As shown in Table 3.3-3

ACOIQN:

a. With an ESFAS instrumentation channel or interlock trip setpoint less

conservative than the value shown in the Allowable Values column of Table

3.3-4, declare the channel inoperable and apply the applicable ACTION

requirement of Table 3.3-3 until the channel is restored to OPERABLE status

with the trip setpoint adjusted consistent with the Trip Setpoint value.

b. With an ESFAS instrumentation channel or interlock inoperable, take the

ACTION shown in Table 3.3-3.

SURVEILLANCE REQUIREMENTS

4.3.2.1.1 Each ESFAS instrumentation channel and interlock shall be demonstrated

OPERABLE by the performance of the CHANNEL CHECK, CHANNEL

CALIBRATION, and CHANNEL FUNCTIONAL TEST operations for the MODES and

at the frequencies shown in Table 4.3-2.

4.3.2.1.2 The logic for the interlocks shall be demonstrated OPERABLE during the

automatic actuation logic test. The total interlock function shall be demonstrated

OPERABLE at least once per 18 months during CHANNEL CALIBRATION testing of

each channel affected by interlock operation.

4.3.2.1.3 The ENGINEERED SAFETY FEATURES RESPONSE TIME of each ESFAS

function shall be demonstrated to be within the limit at least once per 18 months. Each test

shall include at least one logic train such that both logic trains are tested at least once per 36

months and one channel per function such that all channels are tested at least once per N

times 18 months where N is the total number of redundant channels in a specific ESFAS

function as shown in the "Total No. of Channels" Column of Table 3.3-3.
TECH SPEC TABLE 3.3-3 ENGINEERED SAFETY FEATURE ACTUATION SYSTEM

INSTRUMENTATION (AFW RELATED PORTION ONLY)

FUNCTIONAL UNIT

TOTAL NO.

OF CHANNELS

CHANNELS

TO TRIP

MINIUM

CHANNELS

OPERABLE

APPLICABLE

MODES ACTION

AUXILIARY FEED WATER

a. Manual Initiation

b. Automatic Actuation Logic

2 1 2 1, 2, 3

1,2,3

1

2 1 2 2

c. Main Stm Gen Water Level

Low-Low

i. Start Motor Driven Pumps

ii. Start Turbine Driven Pump

3/stm. gen.

3/stm. gen.

2/stm. gen. any

stm. gen.

2/stm. gen. any 2

stm. gen.

2/stm. gen.

2/stm. gen.

1, 2, 3

1,2,3

3

3 aM~

d. S.I. Start Motor Driven

Pumps and Turbine Driven

Pump

e. Station Blackout Start Motor

Driven Pump associated with

the shutdown board and

Turbine Driven Pump

f. Trip of Main Feedwater

Pumps Start Motor Driven

Pumps and Turbine Driven

Pump

g. Auxiliary Feedwater Suction

Pressure-Low

(References the Safety Injection channel operability requirements)

2/shutdown board 1/shutdown board 2/shutdown board 1, 2, 3

1,2

4

1/pump 1/pump 1/pump 4

3/pump 2/pump 2/pump 1,2,3 4
TECH SPEC TABLE 3.3-4 ENGINEERED SAFETY FEATURE ACTUATION SYSTEM

INSTRUMENTATION TRIP SETPOINTS (AFW RELATED PORTION ONLY)

FUNCTIONAL UNIT TRIP SETPOINT ALLOWABLE VALUES

AUXILIARY FEEDWATER

a. Manual Not Applicable Not Applicable

b. Automatic Actuation Logic Not Applicable Not Applicable

c. Main Stm Gen Water

Level Low-Low

> _% of narrow range instrument

span each SG

I--

as

d. S.I. (References the Safety Injection Setpoints requirements)

e. Station Blackout

f. Trip of Main Feedwater

Pumps

g. Auxiliary Feedwater

Suction Pressure-Low

_ volts with a _ second time delay

Not Applicable

2- psig (motor driven pump)

> - psig (turbine driven pump)

_ volts with a__ second time delay

Not Applicable

- psig (motor driven pump)

_ - psig (turbine driven pump)
166

TECH SPEC TABLE 3.3-5 ENGINEERED SAFETY FEATURES

RESPONSE TIMES (AFW RELATED PORTIONS ONLY)

INITIATING SIGNAL AND FUNCTION RESPONSE TIME IN SECONDS

1. Manual

Auxiliary Feedwater Pumps Not Applicable

2. Containment Pressure-High

Auxiliary Feedwater Pumps < 60

3. Pressurizer Pressure-Low

Auxiliary Feedwater Pumps < 60

4. Differential Pressure Between Steam

Lines-High

Auxiliary Feedwater Pumps < 60

5. Steam Flow in Two Steam Lines - High

Coincident with Tavg - Low-Low

Auxiliary Feedwater Pumps < 60

6. Steam Flow in Two Steam Lines - High

Coincident with Steam Line Pressure-Low

Auxiliary Feedwater Pumps < 60

7. Main Steam Generator Water Level -

Low-Low

a. Motor driven Auxiliary Feedwater < 60

Pumps(l)

b. Turbine driven Auxiliary Feedwater <60

Pump(2 )

8. Station Blackout

Auxiliary Feedwater Pumps < 60

9. Trip of Main Feedwater Pumps

Auxiliary Feedwater Pumps < 60

(1) On 2/3 any Steam Generator

(2) On 2/3 in 2/4 Steam Generator
TECH SPEC TABLE 4.3-2 ENGINEERED SAFETY FEATURE ACTUATION SYSTEM

INSTRUMENTATION SURVEILLANCE REQUIREMENTS (AFW RELATED PORTION ONLY)

CHANNEL

CHECK

CHANNEL

CALIBRATION

CHANNEL

FUNCTIONAL

Tsr

MODES FOR WHICH

SURVEILLANCE IS

FUNCTIONAL UNIT REOUIRED~

AUXILIARY FEED WATER

a. Manual

b. Automatic Actuation

Logic

c. Main Steam Generator

Water Level Low-Low

N.A. N.A.

N.A. N.A. M(1)

1, 2, 3

1,2, 3

0'

S -R 1,2,3

d. 5.1. (References the Safety Injection instrumentation surveillance requirements)

e. Station Blackout

f. Trip of Main Feedwater

Pumps

g. Auxiliary Feedwater

Suction

N. A.

N. A.

N. A.

R N. A.

N. A. R

1,2, 3

1,2

R M 1,2, 3
168

PERTINENT TECH SPEC DEFINITIONS

CHANNEL CALIBRATION

A CHANNEL CALIBRATION shall be the adjustment, as necessary, of the channel output

such that it responds with the necessary range and accuracy to known values of the

parameter which the channel monitors. The CHANNEL CALIBRATION shall encompass

the entire channel including the sensor and alarm and/or trip functions, and shall include the

CHANNEL FUNCTIONAL TEST. The CHANNEL CALIBRATION may be performed

by any series of sequential, overlapping or total channel steps such that the entire channel is

calibrated.

CHANNELCHECK

A CHANNEL CHECK shall be the qualitative assessment of channel behavior during

operation by observation. This determination shall include, where possible, comparison of

the channel indication and/or status with other indications and/or status derived from

independent instrument channels measuring the same parameter.

CHANNEL FUNCT ONAL TEST

A CHANNEL FUNCTIONAL TEST shall be:

a. Analog channels - the injection of a simulated signal into the channel as close to

the sensor as practicable to verify OPERABILITY including alarm and/or trip

functions.

b. Bistable channels - the injection of a simulated signal into the sensor to verify

OPERABILITY including alarm and/or trip functions.

ENGINEERED SAFETY FEATURE RESPONSE TIME

The ENGINEERED SAFETY FEATURE RESPONSE TIME shall be that time interval

from when the monitored parameter exceeds its ESF actuation setpoint at the channel

sensor until the ESF equipment is capable of performing its safety function (i.e., the valves

travel to their required positions, pump discharge pressures reach their required values,

etc.). Times shall include diesel generator starting and sequence loading delays where

applicable.

OPERABLE - OPERABILITY

A system, subsystem, train, component, or device shall be OPERABLE or have

OPERABILITY when it is capable of performing its specified function(s), and when all

necessary attendant instrumentation, controls, electrical power, cooling or seal water,

lubrication or other auxiliary equipment that are required for the system, subsystem, train,

component, or device to perform its function(s) are also capable of performing their related

support function(s).
169

PERTINENT TECH SPEC DEFINITIONS

CHANNEL CALIBRATION

A CHANNEL CALIBRATION shall be the adjustment, as necessary, of the channel output

such that it responds with the necessary range and accuracy to known values of the

parameter which the channel monitors. The CHANNEL CALIBRATION shall encompass

the entire channel including the sensor and alarm and/or trip functions, and shall include the

CHANNEL FUNCTIONAL TEST. The CHANNEL CALIBRATION may be performed by any series of sequential, overlapping or total channel steps such that the entire channel is

calibrated.

CHANNEL CHECK

A CHANNEL CHECK shall be the qualitative assessment of channel behavior during operation by observation. This determination shall include, where possible, comparison of

the channel indication and/or status with other indications and/or status derived from

independent instrument channels measuring the same parameter.

CHANNEL FUNCTIONAL TEST

A CHANNEL FUNCTIONAL TEST shall be:

a. Analog channels - the injection of a simulated signal into the channel as close to

the sensor as practicable to verify OPERABILITY including alarm and/or trip functions.

b. Bistable channels - the injection of a simulated signal into the sensor to verify

OPERABILITY including alarm and/or trip functions.

ENGINEERED SAFETY FEATURE RESPONSE TIME

The ENGINEERED SAFETY FEATURE RESPONSE TIME shall be that time interval

from when the monitored parameter exceeds its ESF actuation setpoint at the channel

sensor until the ESF equipment is capable of performing its safety function (i.e., the valves

travel to their required positions, pump discharge pressures reach their required values,

etc.). Times shall include diesel generator starting and sequence loading delays where

applicable.

OPERABLE - OPERABILITY

A system, subsystem, train, component, or device shall be OPERABLE or have

OPERABILITY when it is capable of performing its specified function(s), and when all

necessary attendant instrumentation, controls, electrical power, cooling or seal water,

lubrication or other auxiliary equipment that are required for the system, subsystem, train,

component, or device to perform its function(s) are also capable of performing their related

support function(s).
170

OPERATIONAL MODES

REACTIVITY

CONDMION,

MODE Key

%RATED

THERMAL

POWER*

AVERAGE

COOLANT

TEMPERATURE

1.

2.

3.

4.

5.

6.

POWER OPERATION

STARTUP

HOT STANDBY

HOT SHUTDOWN

COLD SHUTDOWN

REFUELING

20.99

20.99

<0.99

<0.99

<0.99

<0.95

>5%

<5%

0

0

0

0

> 350 0F

> 350 0F

> 350 0F

3500F>Tavg>200 0F

<140 0F

<1400F

FREQUENCY NOTATION

NOTATION

S

M

Q

R

N.A.

FREOUENCY

At least once per 12 hours

At least once per 31 days

At least once per 92 days

At least once per 18 months

Not applicable
171

NUREG/CR-5404

Volume 1

ORNL-6566/V1

Dist. Category RV

Internal Distribution

1. S. H. Buechler 19. G. A. Murphy

2-11. D. A. Casada 20. C. E. Pugh

12-13. D. M. Eissenberg 21. A. Sozer

14. E. C. Fox 22. ORNL Patent Section

15. W. L. Greenstreet 23. Central Research Library

16. H. D. Haynes 24. Document Reference Section

17. J. E. Jones Jr. 25-26. Laboratory Records Department

18. J. C. Moyers 27. Laboratory Records (RC)

External Distribution

28. B. P. Brooks, Electric Power Research Institute, P.O. Box 10412, Palo Alto,

CA 94303

29. J. W. Tills, Institue for Nuclear Power Operations, 1100 Circle 75 Parkway,

Atlanta, GA 30339-3064

30. J. H. Taylor, Brookhaven National Laboratory, Bldg. 130, Upton, NY 11973

31. A. B. Johnson, Battelle-PNL, MS P8-10, P.O. Box 999, Richland, WA

99352

32. J. P. Vora, U.S. Nuclear Regulatory Commission, Office of Nuclear

Regulatory Research, Electrical and Mechanical Engineering Branch, 5650

Nicholson Lane, Rockville, MD 20852

33. M. Vagins, U.S. Nuclear, Regulatory Commission, Office of Nuclear

Regulatory Research, Chief, Electrical and Mechanical Engineering Branch,

Division of Engineering, 5650 Nicholson Lane, Rockville, MD 20852

34. W. S. Farmer, U.S. Nuclear Regulatory Commission, Office of Nuclear

Regulatory Research, Electrical and Mechanical Engineering Branch, 5650

Nicholson Lane, Rockville, MD 20852

35. M. J. Jacobus, Sandia National Laboratories, P.O. Box 5800, Division 6447,

Albuquerque, NM 87815

36. H. L. Magleby, Idaho National Engineering Laboratory, MS 2406, P.O. Box

1625, Idaho Falls, ID 83415

37. Office of Assistant Manager for Energy Research and Development,

Department of Energy, Oak Ridge Operations Office, Oak Ridge, TN 37831

38-39. Office of Scientific and Technical Information, P.O. Box 62, Oak Ridge, TN

37831

40-369. Given distribution as shown in NRC category RV (10 - NTIS)
NRC FotV 335 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUVElEF Assigned bN NRC. Aod Vol., Sooo.. Rev.,

Nr C1.1. 1 i C2. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Aodendum Numts's. If aiiv.1 'V I C202? BIBLIOGRAPHIC DATA SHEET nR V o.

(See instructions on the reverse;UREG/CR-5404, I Vol. 

2. TIT LE AND SIJETITLE ORNL-6566/Vl Vol. 1

Auxiliary Feedwater System Aging Study 3. DATE REPORT PUBLISHED

March 1990 4. FIN OR GRANT NUMBER

41 80 82 8B I 5. AUTHORIS 6. TYPE OF REPORT

D. A. Casada Technical

7. PERIOD COVERED olnc;,s;ve Catr

r-b.~ Pr'tNU KNMIN ( U U LAN I4A I I UN - NARMt AIND LI ALi i M ZZ it NVHU. Pr0osde Dv ision. urnCeoD' ego~n, L'.Z3 N.Clear- girr LO- ~Isisi fl. ncnim Doors$., coorraclor. ,0rio

Inamre and ma ifing addn~ems

Oak Ridge National Laboratory

P.O. Box 2008

Oak Ridge, TN 37831

9. SPONSOR ING ORGAN I ZAT ION - NAME AND ADD R ESS {if NRC. type -Sanne as aborv': if contiacto,. provide NRC Oivsion. Office or Region. US. Nuclear RegulatorY Con,niio.

avd vMiln of Engineering

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555

10. SUPPLEMENTARY NOTES

II ABSTRACT f200.ordroksol

This report documents the results of a study of the Auxiliary Feedwater (AFW) System that has been

conducted for the U. S. Nuclear Regulatory Commission's Nuclear Plant Aging Research Program.

The study reviews historical failure data available from the Nuclear Plant Reliability Data System,

Licensee Event Report Sequence Coding and Search System, and Nuclear Power Experience data

bases. The failure histories of AFW System components are considered from the perspectives of how

the failures were detected and the significance of the failure. Results of a detailed review of operating

and monitoring practices at a plant owned by a cooperating utility are presented. General system

configurations and pertinent data are provided for Westinghouse and Babcock and Wilcox units.

12. KEY WORDS,'DESCR!PTORS (List uords orphrisni that cin Lessior rmoarcier in locating the repont., 13. AVAILABILITY STATEMENT

I Tnlrn;tePA

auxiliary feedwater, surveillance, monitoring, turbine, governor 14. SECURITY CLASSIFICATION

aging, NPAR, inspection, operating experience, instrumentation and control (rhis Pael

I Tnrggsified (This Repo"t)

1 TnrlncifIend 15. NUMBER OF PAGES

16. PRICE

NRC FORM 335 f24191
-

-

--i

UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D-C. 20556

OFFICIAL BUSINESS

PENALTY FOR PRIVATE USE, $MO

I POSTAGE lk FEES PAID

UUSNRC

1