NUREG/CR-5419

BNL-NUREG-52212

Aging Assessment of

Instrument Air Systems

in Nuclear Power Plants

Prepared by M. Villaran, R. Fuliwood, M. Subudhi

Brookhaven National Laboratory

Prepared for

U.S. Nuclear Regulatory Commission
AVAILABIUTY NOTICE

Availability of Reference Materials Cited In NRC Publications

Most documents cited In NRC pubilcatlons will be available from one of the following sources:

1. The NRC Public Document Room, 2120 L Street, NW. Lower Level, Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Office., P.O. Box 37082. Washington.

DC 20013-7082

3. The National Technical Information Service, Springfield, VA 22161

Although the listing that follows represents the majority of documents cited In NRC publications, It Is not

Intended to be exhaustive.

Referenced documents available for Inspection and copying for a fee from the NRC Public Document Room

Include NRC correspondence and Intemal NRC memoranda; NRC Office of Inspection and Enforcement

bulletins, circulars, Information notices, Inspection and Investigation notices: Lcensee Event Reports; vendor reports and correspondence: Commisslon papers; and appilcant and licenseo documents and correspondence.

The following documents In theXUREG series are available for purchase from the GPO Sales Program:

formal NRC staff and contrac r reports. NRC-sponsored conference proceedings, and NRC booklets and

brochures. Also available ar Regulatory Guides. NRC regulations In the Code of Federal Regulations, and

Nuclear Regulatory Cor Isslon Issuances.

Documents avallabi om the National Technical Information Service Include NUREG series reports and

technical reports epared by other federal agencies and reports prepared by the Atornlo Energy Comrrisslon, forerunner agency to the Nuclear Regulatory Comrnmisslon.

Documents available from public and special technical librarles Include all open Iterature Items, such as

books. journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the

Office of Information Resources Management, Distribution Section, U.S. Nuclear Regulatory Commisslon,

Washington, DC 20555.

Copies of Industry codes and standards used In a substantive manner In the NRC regulatory process are

maIntained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and re available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the

originating organization or, If they are American National Standards, from the American National Standards

Institute. 1430 Broadway. New York, NY 10018.

DISCLAIMER NOTICE

ihis report was prepared as an account of work sponsored by an agency of the United States Government.

Neither the United States Government nor any agency thereof, orarny dftelr employees, makes any warranty,

expresed or Implied, or assumes any legal liability of responsibility for any third party's use, or the results of

such use, of any information, apparatus, product or process disclosed in this report, or represents that its use

by such third party would not Infringe privately owned rights.
/ 3 c/ S -- 5-

NUREG/CR-5419

BNL-NUREG-52212

RV

Aging Assessment of

Instrument Air Systems

in Nuclear Power Plants

Manuscript Completed: July 1989

Date Published: January 1990

Prepared by

M. Villaran, R. Fullwood, M. Subudhi

S. K. Aggarwal, NRC Program Manager

Brookhaven National Laboratory

Upton, NY 11973

Prepared for

Division of Engineering

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555

NRC FIN A3270
ABSTRACT

NRC Generic Issue 43, "Contamination of Instrument Air Lines," has been unresolved

since 1980. The potential seriousness of this issue was reinforced in a 1987 study by the

Office for Analysis and Evaluation of Operational Data. Aging of components within

compressed air systems, leading to degraded function of the system, is the subject of this

study. This work was performed under the auspices of the NRC's Office of Nuclear

Regulatory Research as part of the Nuclear Plant Aging Research (NPAR) program.

The objective of this study was to identify all the aging modes and their causes, which

should be mitigated to achieve a reliable operation of all safety-related air equipment. Also

included is an interim review of typical maintenance activities for air systems in the nuclear

power industry. The Phase 2 effort of this study will make recommendations for developing

an effective maintenance program industry-wide to counter the effects of aging.

The analysis of operating experience data revealed that aging degradation occurs in the

compressed air system, and becomes a factor as the system ages. Normal wear of the

system and contamination of the air dominate the problems of system failure. Existing

maintenance programs within the industry lack uniformity, and quality assurance is not

rigorous because the system is classified as non-safety.

iii
SUMMARY

As part of ongoing efforts to understand and manage the effects of aging in nuclear

power plants, an aging assessment was performed for the Instrument Air (IA) system, a

system that recently has been the subject of much scrutiny. Despite its non-safety classification, instrument air has been a factor in a number of potentially serious events. This

report presents the results of the assessment and discusses the impact of aging of the

instrument air system on system availability and plant safety. This work was performed for

the U.S. Nuclear Regulatory Commission (NRC) as part of the Nuclear Plant Aging

Research (NPAR) program.

To perform the complex task of analyzing an entire system, the Aging and Life

Extension Assessment Program (ALEAP) System Level Plan was developed by

Brookhaven National Laboratory and applied successfully in previous studies. The work

presented used two parallel work paths, as described in the ALEAP plan. One path used

deterministic techniques to assess the impact of aging on compressed air system performance, while the second path used probabilistic methods. The results from both then were

used to characterize aging in the instrument air system.

The findings from this study formed a technical basis for understanding the effects of

aging in compressed air systems. The major conclusions from this work are highlighted in

the following paragraphs; some have applications beyond the instrument and service air

systems.

* This study identified aging trends in component failure rates, component relative

importances, and system unavailability that could have an increasing impact on system

availability and, consequently, affect plant safety in later years.

* Compressors, air system valves, and air dryers made up the majority of failures. The

increase in failures in passive components such as piping, aftercoolers/moisture separators, and receivers was greater over time, but these still constituted only a small

percentage of overall failures.

* The effectiveness and quantity of preventive maintenance devoted to a component

significantly reduced the number of failures experienced.

* Individual plant maintenance records for instrument and service air systems were found

the most comprehensive source of data for performing aging analyses.

* As a continuously operating system, with minimal control-room instrumentation due to

its non-safety classification, most problems in the air system are detected by local

monitoring and indication, walkdowns and inspection, and preventive maintenance

inspection/surveillance.

* Review of compressed air system designs and studies using a PRA-based system model

revealed that the redundancy of key components (compressors, dryers, IA/SA

crossconnect valve) was an important factor in system availability. Overall design

configuration affected the pervasiveness of air system problems.

v
* Total loss of air events are uncommon. The majority of events resulted in degraded

operation (low IA pressure, IA quality out of limits). Procedures and testing for the

response of personnel and equipment to these conditions should be developed.

* Human error was a significant cause of failures in critical components, such as compressors and dryers, as well as at the system and intersystem level. Training should be

augmented in two key areas: 1) operation and maintenance of critical air system

components, and 2) importance of instrument air to other plant systems, particularly

safety systems.

* The systems outside instrument air that were most often affected by IA problems are

containment isolation, main feedwater/main steam, auxiliary feedwater, and the BWR

scram system. The most commonly affected components were AOV's and SOV's.

* The probabilistic work entailed the development of a computer program (PRAAGE-IA)

using a PRA-based IA system model to perform time-dependent PRA calculations. Timedependent failure rates were developed from the data base and input to the program to

calculate system unavailability and component importances for various ages. The results

showed that when the time-dependent effects of aging for the worst case are accounted

for, there are two significant system effects: 1) system unavailability increases moderately with age, and 2) relative importances of components change with age. During early

operation, leakage in both IA/SA piping and support system piping was the most

important contributor to system unavailability: during later years, aging can cause

compressors and air dryers/filters to become increasingly important.

The findings presented in this report form a sound technical basis for understanding

and managing the effects of aging in IA systems. Future work will include improvements to

current maintenance, monitoring, training, off-normal response procedures, and surveillance practices to mitigate aging degradation.

vi
CONTENTS

A B S T R ............................................ ACR iii

SUMMARY ............................................ v

CONTENTS ............................................ vii

FIGURES ............................................. ix

TABLES ...... , ............................ x

ACKNOWLEDGEMENTS .................................. xi

1. INTRODUCTION ........................................ 1-1

1.1 Background .......................................... 1-1

1.2 Objectives ........................................... 1-4

1.3 System Definition ...................................... 1-4

1.3.1 System Description ................................. 1-4

13.2 System Boundaries .................................. 1-5

1.3.3 Interconnections and Interfaces with Other Systems .... ........ 1-7

1.4 Analysis Methodology ................................... 1-9

2. SYSTEM DESIGN REVIEW ................................ 2-1

2.1 General Description .................................... 2-1

2.1.1 Design Bases ..................................... 2-1

2.1.2 General System Description ............. I .............. 2-3

2.2 System Design Variations ................................. 2-5

3. ENVIRONMENTAL AND OPERATIONAL STRESSES .... .......... 3-1

3.1 Operational Stressors ................................... 3-1

3.2 Environmental Stressors .................................. 3-3

3.3 Maintenance Induced Stressors ............................. 3-4

3A Summary ............................................ 3-4

4. COLLECTION AND ANALYSIS OF FAILURE DATA .... .......... 4-1

4.1 Data Bases .......................................... 4-1

4.1.1 Descriptions ...................................... 4-1

4.1.2 Methods of Analysis ................................ 4-1

4.2 Dominant Failure Trends ................................. 4-2

4.2.lAging Fraction ..................................... 4-2

4.2.2 Detection of Failure ................................ 4-4

4.3 Component Level Failures ................................ 4-5

43.lDistnbution of Failures by Component ..................... 4-6

4.3.2Aging Fraction by Component .......................... 4-7

4.3.3Causes of Failure ................................... 4-9

433.1 Compressed Air Supply Train-Failure Mechanisms .... .... 4-9

43.3.2 Filter/Dryer Train-Failure Causes .................... 4-10

4.3.3.3 Air Distribution System-Failure Causes ................ 4-11

4.3.4 Mechanisms of Failure ................... . . ........... 4-11

43A.1 Compressed Air Supply Train-Failure Mechanisms .... .... 4-12

4.3.4.2 Filter/Dryer Train-Failure Mechanisms .. ............... 4-13

4.3.4.3 Air Distribution System-Failure Mechanisms .... ........ 4-16

4.3.5Modes of Failure and Effects ........................... 4-17

4.3.5.1 Comp Air Supply Train-Failure Modes & Effects .... ..... 4-17

vii
4.4 System Level Effects ..... . . . . . . . ...... . . . . . . . . . . . 4-21

4.4.1 IA/SA System Effects on AOV's and SOV's .... . . . . . . . . . . . 4-24

4.4.2 Major Systems Affected by IA/SA Failures .... . . . . . . . . . . . . 4-24

4.5 Time-Dependent Failure Rates .... . . . . . . ...... . . . . . . . . . 4-25

4.5.1 Air Compressor Failure Rates .... . . . . . . . . . . . . . . . . . . 4-26

4.5.2 Filter/Dryer Train Failure Rates .... . . . . . . . . . . . . . . . . . 4-27

4.5.3 Air System Valves .... . . . . . . . . . . . . . . . . . . . . . . . 4-30

4.6 Summary of Data Analysis Findings .... . . . . ...... . . . . . . . . 4-30

5. SYSTEM UNAVAILABILITY WITH AGE . . ........ . 5-1

5.1 System Description ..... . . . . . . . ....... . . . . . . . . . . . 5-2

5.1.1 Support Requirements .... . . . . . . . . . . . . . . . . . . . . . . 5-4

5.2 Success Criteria ............................... . 5-4

5.3 System Unavailability Analysis .. 5-4

5.3.1 Fault Tree Model ........................... . 5-4

5.4 Development of PRAAGE-IA Model .... . . . . ...... . . . . . . . . 5-6

5.5 IA System Unavailability .... . . . . . . ....... . . . . . . . . . . 5-7

5.5.1 Base Case Analysis .... . . . . . . . . . . . . . . . . . . . . . . . 5-7

5.5.2 System Aging Analysis .... . . . . . . . . . . . . . . . . . . . . . 5-8

5.6 Sensitivity Study ..... . . . . . . . . ...... . . . . . . . . . . . . 5-11

5.6.1 Effect of Component Aging .... . . . . . . . . . . . . . . . . . . . 5-12

5.6.2 Effect of Components ......................... . 5-14

5.7 Conclusions ................................. . 5-15

6. REVIEW OF MAINTENANCE PRACTICES . . ....... . 6-1

6.1 Current Industry Programs .......................... . 6-1

6.2 ANSI/ASME OM-17 Recommendations .... . . . . ..... . . . . . . . . 6-2

6.3 Industry Upgrades .............................. . 6-4

6.3.1 Equipment/Design Criteria .... . . . . . . . . . . . . . . . . . . . . 6-5

6.3.2 MaintenancefTesting Criteria ...................... . 6-6

6.4 Overall Assessment of Maintenance Practices .... . . ..... . . . . . . . 6-7

7. RESULTS AND CONCLUSIONS .... . . . . . . ....... . . . . . . . . . 7-1

7.1 IA/SA System Design Reviews ........................ . 7-1

7.2 Operating Experience Analysis ........................ . 7-2

7.3 Maintenance, Testing, Operation, and Training ................. . 7-3

7.4 PRA-Based Aging Analysis .... . . . . . . . . . . . . . . . . . . . . . . 7-4

7.5 Future Work ..... . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-5

8. REFERENCES .................................. . 8-1

APPENDICES

A. EQUIPMENT AND SYSTEM DESIGN ARRANGEMENTS .... . . . . . . . . . . A-1

B. FAILURE ANALYSIS OF THE STARTING AIR SYSTEM OF EMERGENCY

DIESEL GENERATOR (EDG).. ...................... B-I

viJ4
FIGURES

Figure No.

1-1

1-2

2-1

2-2

2-3

2-4

4-1

4-2

4-3

4-4

4-5

4-6

4-7

4-8

4-9

4-10

4-11

4-12

4-13

4-14

4-15

4-16

4-17

4-18

4-19

4-20

5-1

5-2

5-3

5-4

5-5

5-6

5-7

Title

Boundaries of the Instrument Air System for Aging Studies ....

Boundaries of the Service Air system for Aging Studies ......

Functional Diagram of Compressed Air Supply Train. .......

Functional Diagram of Instrument or Control Air Filter/Dryer Train.

Radial Compressed Air Distribution System ............

Ring Header Compressed Air Distribution System .........

Aging Fraction-Plant "A ". ..................

Aging Fraction-Plant "C ". ..................

Aging Fraction-LER's .....................

Range of Component Failures ..................

Aging Fraction by Component Type-Plant "C" ..........

Aging Fraction by Component Type-Plant "A" .........

Failure

Failure

Failure

Failure

Failure

Failure

Failure

Effects

Failure

Failure

Failure

Failure

Failure

Mechanisms-Reciprocating IA and SA Compressors

Mechanisms-Centrifugal Compressors .......

Mechanisms-Rotary Screw Compressors......

Mechanisms-Instrument Air Dryers ........

Mechanisms-Air System Valves .........

Modes by Compressor Type. ..........

Modes-Air System Instrumentation ........

of Component Failures ..............

Rate-Reciprocating Air Compressors .......

Rate-Instrument Air Compressors .......

Rate-Service Air Compressors ..........

Rate-Filter/Dryer Train .............

Rate-Instrument Air Dryers ...........

1-6

1-8

2-3

2-4

2-6

2-7

4-3

4-3

4-4

4-6

4-8

4-8

4-12

4-14

4-14

4-15

4-16

4-18

4-21

4-22

4-26

4-28

4-28

4-29

4-29

4-30

5-2

5-5

5-9

5-9

5-10

5-12

5-13

: :

IA & SA Distribution System Valves s......

IA System and Backup in PRA Model ......

Top of the IA System Fault Tree. .......

. . . ..

. . . ..

. . . ..

Time-Dependent Failure Rate Curve for Reciprocating Air Compressors

Time-Dependent Failure Rate Curve for Filter/Dryer Trains s.....

System Unavailability for Unit 3 IA Supply............

Component Contributions to IA System Availability .........

System Unavailability with Age-Different Component Aging ....

ix
TABLES

Table No. Title

2-1 Nomenclature of Compressed Air Systems ................. . 2-2

2-2 Types of Air System Supply Configurations at Nuclear Plant Sites ... . . . 2-5

2-3 Independent vs. Shared Compressed Air Systems at Multiple Unit Nuclear

Plant Sites .2-8

3-1 Stress Conditions for IA Components .... . . . . . . . . . . . . . . . . 3-2

4-1 Air System Components Failures and Systems Affected by These Failures . . . 4-23

5-1 Base Case Contribution to System Unavailability .............. . 5-8

5-2 Failure Probabilities for IA Components .................. . 5-10

5-3 Component Sensitivity on System Unavailability Without Time-Dependent

Aging Effects .5-14

6-1 Current Industry Programs ..... . . . . . . . . . . . . . . . . . . . . 6-3

6-2 Typical Testing and Maintenance Activities for Compressed Air Systems. . . . 6-4

6-3 One Licensee's Suggested Maintenance/Testing Criteria ........... . 6-6

x
ACKNOWLEDGEMENTS

The authors wish to thank the NRC Program Manager, Mr. Satish K. Aggarwal for his

comments and guidance in the performance of this work. We would also like to express our

appreciation to various utilities for providing valuable information pertinent to this study.

We would like to express our gratitude to various members of the Engineering

Technology Division of BNL, including Mr. Robert E. Hall, Dr. John Boccio, Dr. See Ming

Wong, Mr. Rudy Hodor, Mr. John Taylor, Mr. Richard Lewis, and Mr. William Gunther for

providing technical assistance, guidance, and the review of this report.

The authors thank the staff of the Nuclear Safety Library at BNL for their efforts and

assistance in support of this work.

We also wish to thank the Word Processing Center for typing this manuscript.

xi
1. INTRODUCTION

Air systems are used in nuclear power plants to actuate or control equipment that is

vital to normal plant operation as well as to shutdown the plant safely during an abnormal

or emergency condition. Gas systems using nitrogen are sometimes preferred over air

systems to prevent the introduction of oxygen into controlled atmospheres (such as inside

the drywell). This air-assisted equipment includes valves (air-operated, solenoid, relief),

dampers, air-operated tools, and instrumentation and control devices. The advantages of

pneumatic systems are: their high efficiency; high reliability (because of fewer moving

parts); compactness; variability of forces, torques and speeds; ease of control and coordination with other component/system functions; low cost; ease of installation and maintenance; and finally, capability of operation during station blackout (for limited periods).

At most nuclear facilities, the air systems are designed by the architect engineers or

the utility, and are classified as non-safety systems. The design philosophy of compressed

air systems normally assumes that air-operated equipment fails in a safe position (i.e.

predictable modes: fails open, fails closed, fails as-is) when the air system becomes

inoperable during transients and accidents. The air-operated equipment that must function

during transients or accidents is provided with a backup air (or nitrogen) supply in the form

of safety-grade accumulators to ensure that they perform their intended function. Therefore,

most designers assume that the air systems will be available for the shutdown of reactors in

nuclear plants. Consequently, utilities have given less attention to these systems and many

plant probabilistic risk assessments (PRAs) do not consider the failure of these systems in

their risk analyses.

1.1 Background

Generic Issue 43, "Contamination of Instrument Air Lines," was issued in response to

the Office for Analysis and Evaluation of Operational Data (AEOD) study in 1981

regarding contamination of instrument air lines. This with desiccant action was prompted

by the slow closure of a containment isolation valve at Rancho Seco and the loss of the salt

water cooling system at San Onofre. Both incidents were attributed to desiccant contaminating the plant's instrument air (IA) system. The principal concern of this issue is that

contamination of air lines resulted in reactor transients and scrams. The sources of these

contaminations include the ambient air, compressors, dryers, and corrosion of internal parts

of various equipment.

Based on an ORNL study in 1982 (NUREG/CR-2796),(1) the NRC recommended

dropping the issue as documented in NUREG-0933.(2) All essential systems requiring air

during or after an accident are self-supporting, and the air system can be reestablished.

Operation of the IA system is not required to initiate operation of engineered safeguards

equipment. However, accident scenarios can be demonstrated where, after the storage

accumulators are exhausted, failure of the IA system can affect the performance of

equipment in the engineered safeguards systems. The probability of such a common-cause

failure happening is considered very low. To maintain clean and dry air in the IA system,

operating plants are required to test the air quality at every refueling outage, or 18 months,

and to perform necessary maintenance on the system.

1-1
Problems associated with air systems continued to surface in later years. Various NRC

investigations identified problems ranging from design deficiencies (such as improper

installation of check valves in the compressor discharge lines in Oyster Creek) to lack of

proper maintenance (which caused ignition of filters at Palisades). A case study (April

1985)(3) on forced plant shutdowns caused by IA system failure suggested that there have

been 78 forced shutdowns at 40 different plants during 1977 to 1984. Although this is less

than 1% of all forced shutdowns and the study found that this does not contribute

significantly to the total core-melt frequency, they definitely introduce transients in the

safety systems. A large percentage of such forced shutdowns may be prevented with

improved maintenance.

NRC information notice 85-23 relates to failures of IA system's check valves intended

to isolate safety-related air accumulators during accidents. Although this notice describes

the event that occurred at the Fort Calhoun Station, Unit 1, the NRC's position was that

failure of air check valves to seat when required to ensure the availability of air from

safety-related accumulators can be a generic problem.

A comprehensive review and evaluation of the potential safety implications associated

with air system problems at commercial reactors was performed by the AEOD, based upon

data from operating experience covering the last decade.(4) The study highlighted over 30

incidents relating to safety systems that demonstrated the safety significance of the

Instrument Air System. Some of the safety systems which were significantly degraded or

failed are necessary for reactor shutdown during an emergency. These included a feedwater

transient caused by water in the IA system, the rupture of a steam generator tube caused by

an improperly installed IA discharge line, a loss of decay-heat removal resulting from an

air system malfunction, a loss of component cooling water caused by desiccant contamination in the air system, a loss of auxiliary feedwater system due to water and dirt particles in

the air system, and the inability to scram the control rods caused by oil in the air system.

The root causes of most of these system failures were identified as contaminated air and

degraded components. The report (NUREG-1275, vol. 2) addresses specific deficiencies

and gives recommendations to mitigate them. This study reopened the Generic Issue 43,

and NRC Information Notice 87-28 was issued to disseminate the results to the nuclear

industry.

In response to the AEOD findings, the NRC's Office of Nuclear Regulatory Research

(RES) performed a risk-based assessment(5) of Instrument Air (IA) System failures under

the Operational Safety and Reliability Research (OSRR) program. The study considered

IA-initiated accident sequences, IA-interactions with frontline systems, and the plant risk

significant to any of IA-related events. Based on fourteen plant PRAs, accident sequence

precursors (ASPs), and consequence estimates from IA-related transients, the study concluded that the total plant risk cannot be significantly reduced by implementing a reliability

program. If the IA system is not available, the ability of most plants to achieve a safe

shutdown condition is not significantly impaired. Safety is ensured by fail-safe positions

for AOVs, redundant systems not dependent upon IA, and safety-grade accumulators for

selected components. The study also identified conditions which might increase the plant

risk due to IA system failures. These conditions include unique or incorrect designs of failsafe valve positions, contamination problems in the air system that significantly increase

1-2
the common-cause failure probabilities of air-operated components, accumulators and associated check valve reliabilites, and dependencies on IA leading to failure of emergency

diesel generators (EDGs) following loss of offsite power (LOOP).

Though there are differences between the AEOD study and the RES study on the

technical aspects of the issue, both agreed that these differences would not result in any

adverse effects, provided the requirements presented in the Generic Letter 88-14 (August 8,

1988) are met. The purpose of this letter was to assure that air systems are adequate to meet

their requirements over a plant's lifetime, and that they do not compromise predicted plant

response to design basis events. Each individual plant verification program is required to

include the following:

1. Verification by test that instrument air quality is consistent with the manufacturer's recommendations for individual components served.

2. Verification that maintenance practices, emergency procedures, and training are

adequate to ensure that safety-related equipment will function as intended on

loss of instrument air.

3. Verification that the design of the entire instrument air system, including air or

other pneumatic accumulators, is in accordance with its intended function,

including verification by test that air-operated safety-related components will

perform as expected in accordance with all design-basis events, including a loss

of the normal instrument air system. This design verification should include an

analysis of current air-operated component failure positions to verify that they

are correct for assuring the required safety functions.

In addition, the utilities are required to discuss their program for maintaining proper

instrument air quality.

NRC Information Notice 89-26 describes several IA inadequacies identified by licensees in response to the above Generic Letter. Pilgrim, Fermi 2 and Vermont Yankee

discovered problems in maintaining the integrities of the secondary and primary containment seals. The Pilgrim plant also found that inadequate accumulator capacity had resulted

in the loss of one of the two containment isolation barriers. Similar problems with the

accumulators were found at several other nuclear stations.

Overpressurization of solenoid valves has also been encountered in IA systems. As

described in NRC Information Notice 88-24, due to misapplication or failure of upstream

pressure regulators, solenoid valves have been exposed to overpressure conditions during

service at several plants. When the supply pressure exceeded the maximum operating

pressure differential (MOPD) of the internal spring in certain designs of solenoid valves,

the solenoid valve core was prevented from blocking the air inlet port after de-energization.

As a result, the flow path to the actuator diaphragm was maintained and, in the case

described in the information notice, the isolation valve failed to close.

1-3
1.2 Objectives

These problems in air systems can be put into three categories: (i) those associated

with components involved in the supply and distribution of compressed air, (ii) those

associated with equipment whose motive power depends on the air supply, and (iii) those

related to the design deficiencies in the system. Many of these problems were attributed to

contamination of air or leakage of air. Although a good maintenance program would

mitigate these problems, and the ASME O&M Committee and certain utilities are developing such a program, the effects of aging of IA components have never been specifically

examined. These maintenance programs are based on recommendations by manufacturers,

and on knowledge gained from operating experience. The verification program described in

Generic Letter 88-14 should identify most design deficiency problems in the IA system.

Also, as in the case of Oconee, plants that have developed a PRA model of their system

should have uncovered most significant inadequacies during the modeling process.

Based on this premise, this study focusses on the effects of aging and service wear of

components and their interaction within the compressed air system per se, and specifically,

on the instrument air system. Our study of this will provide root causes of the most

predominant failure modes and a technical basis for formulating inspection, surveillance,

monitoring, and mainenance programs to alleviate IA problems. Thus, commensurate with

the NRC-NPAR program plan,l ) the primary goals of this study are:

1. To identify and characterize all the effects of aging and service wear (including

those already known) which could cause degradation of components within the

system and, thereby, impair plant safety.

2. To assess the effectiveness of current inspection, surveillance, monitoring, and

maintenance practices for timely detection of significant aging effects before

loss of safety function.

These goals are judged in the light of previous studies on the subject. The evaluation

should identify other IA aging problems, in addition to the contamination problem already

noted. Based on the aging characteristics of various IA components, the future performance

of this system is assessed. The unavailability of the IA system as plants age is characterized, so that its impact on plant risk can be predicted in the future.

1.3 System Definition

1.3.1 System Description

Compressed air systems in nuclear power stations generally consist of two or more

separate systems that are distinguished by the quality of the air which they supply and the

loads supplied. The compressed air system providing the highest quality air is usually

designated as the Instrument Air (IA) system or the Control Air (CA) system. The

instrument air system delivers high-pressure air to all the pneumatic controls, air-operated

valve controllers and positioners, and pneumatic instrumentation in the nuclear power

station. It is also the source of compressed air delivered to and stored in safety-related

accumulators via safety-related check valves. In turn, the charged accumulators serve as

1-4
standby sources of pneumatic motive power to operate critical air-operated valves and

devices required for safe shutdown of the nuclear station. Accordingly, the specifications

for the instrument air system require the supply of dry, filtered, clean, and oil-free air

within a specific operating pressure range and below a given maximum design pressure

dew point. It is essential to maintain the quality of the compressed air delivered by the

instrument air system to critical plant pneumatic devices. Any moisture, oil, desiccant,

particulates, or other contaminants induced into the system, will degrade the performance

of pneumatic devices or cause complete malfunctions, which may seriously compromise

overall safety of the nuclear plant.

The compressed air system with the less restrictive quality requirements is known as

the Service Air (SA) System, Station Air System, or Plant Air (PA) System. The service air

system provides clean, oil-free air, generally at the same pressure as the instrument air

system, to service and maintenance manifold stations in various locations such as the

reactor building, control room building, auxiliary building, intake structure, turbine building, radwaste facility, and containment. Service air may also be used for radwaste

processing, the fire-water system, and the drinking-water system. In nuclear plants with

dedicated service air compressors, the service air system usually is configured to act as a

backup source of compressed air to the instrument air system. Breathing air may also be

supplied by the service air system in nuclear stations that do not use dedicated breathing air

compressor packages or storage bottles.

1.3.2 System Boundaries

For our study, it was necessary to define the boundaries of the system. Figure 1-1 is a

simplified block diagram of a common instrument air system, with an electric motor-driven

compressor and an internally heated regenerative desiccant dryer. The three major sections

of the system: the compressed air supply train, the filter/dryer train, and the distribution

system, are shown. The basic interfaces with the surroundings are also shown.

The dashed boundary line on Figure 1-1 outlines the limits of this study of aging

effects on instrument air systems, which includes the entire compressed air supply train

consisting of the compressor drive motor, the air compressor itself, and the integral

compressor controls, heaters, coolers and other devices. Also in the supply train are the

aftercooler, the moisture separator, and the air receiver tanks. Next is the filter/dryer train

made up of pre- and after-filters, the air dryer, and its associated controls. Finally, the

boundary takes in the air distribution system headers, piping, and supply lines up to the

load device isolation valves or connection flanges. By so bounding the study, causes and

origins of the majority of problems encountered in the supply and distribution of compressed air will be addressed. The individual pneumatic load devices were excluded from

this aging research because of the wide variety of components and designs that would have

to be considered. However, most of the root causes of the problems affecting pneumatic

load devices (e.g. contamination, human error, loss of pressure) can trace their origin back

to some source within the boundaries of this study.

All electrical supplies to the compressor motor, controls, dryer, and heaters are

bounded at the load terminals of the circuit breaker. Cooling water supplies to the various

1-5
Atmosphere

Air In

Unloader

Valve

Exhaust

Dryer

Purge

Exhaust

Control

Valves

Exhaust

Pneumatic

Loads

Cooling Cooling Cooling Drains Drains Drains Drains

Water Water Water

I8C

Exhaust

Figure 1-1 Boundaries of the Instrument Air System for Aging Studies
coolers, aftercoolers, and intercoolers are taken in to account out to their isolation valves.

Oil and water drain lines are limited to the drain valves. The interface with the atmosphere

begins at the filter/silencer, and ends at the various exhaust valve discharge ports. The

boundaries for the aging study of service air systems are shown in Figure 1-2. This block

diagram is similar to that shown for the instrument air system with the exception of the

filter/dryer train portion of the system, which is reduced to a simple service air filter, at

most, for the majority of service air systems. All other boundaries for equipment, and

interfacing systems and media are identical to those defined for the instrument air system.

1.3.3 Interconnections and Interfaces with Other Systems

The instrument air or control air system supplies high quality compressed air to airoperated valves and pneumatic controls in most of the following:

1. Main Steam/MSIVs

2. Main Feedwater System

3. Condensate System

4. Primary Containment Isolation System

5. Containment Atmosphere System

6. Liquid Radioactive Waste Handling System

7. HVAC: EDG rooms, battery rooms, control room, etc.

8. Service Water System

9. Fuel Handling Systems and Refueling Tank

10. Standby Gas Treatment System.

The service air or plant air system provides compressed air for use in nuclear plant

components and systems such as (but not limited to) the following:

1. Liquid Radioactive Waste Handling

2. Solid Radioactive Waste Handling

3. Make-up Water Demineralizers

4. Fuel Pool Demineralizers

S. Condensate Demineralizers

6. Reactor Water Clean-up Demineralizers (PWR)

7. Standby Liquid Control Tank Sparger (BWR)

8. Domestic Water System

9. Fire Water System

10. Maintenance/Service Air Usage

In BWRs, the instrument air system also supplies the Scram System, Automatic

Depressurization System, Reactor Water Cleanup System, Closed Loop Cooling Water

Systems, and Standby Liquid (Boron) Control System. Most of these do not depend on IA

for safe shutdown; however, safety-related accumulators are provided for pneumatically

operated components such as the safety relief valves and the ED& air start system to assure

the availability of compressed air if IA system pressure is lost. In inerted containments,

compressed nitrogen is supplied to pneumatic components from a nitrogen inerting supply

system, nitrogen storage bottles, or dedicated containment instrument gas compressors.

1-7
Unloader

Atmosphere Valve

Air In Exhaust

480 VAC 120 VAC

(I ~~~~(I

_____________ -~_ -iCompressea Filter Distribution _ Pneumatic

i Air By;;1 Supply - Train System Loads ControlsTri

Pumps Unloader

Heaters Valve

Drive ~~Air Afercooler Separator Receiver Filter Srostem Moor S I mn

Cooling Cooling Cooling Drains Drains Drains

Water Water Water

Figure 1-2 Boundaries of the Service Air System for Aging Studies
In PWRs, air-operated valves are found in the Auxiliary Feedwater System, Reactor

Coolant System, Chemical and Volume Control System, Component Cooling Water System, Safety Injection System, High Pressure Injection System, and Shutdown Cooling

Systems. As in the BWR plants, accumulators are provided on critical components such as

pressurizer power operated relief valves (PORVs), atmospheric dump valves, and EDG air

start systems.

1.4 Analysis Methodology

We used a structured system level strategy(7) developed for earlier NPAR system

studiesl '

9 ) to assess the aging effects on nuclear power plant systems during the normal 40-

year life, and for extension of plant operation beyond the original license. The first phase

involves an approach which utilizes operating experience data and design documents to

understand the aging of components. In addition, the data analysis helps in developing

aging rates for components, which, in future work, will be input into a fault-tree system

model to assess the aging effects.

The review of the system design encompassed a large number of operating plants in

the United States. Since this system is part of the balance of plant (BOP), each design is

different from others in design details and overall configurations, as well as in design and

operating philosophy.

The analysis of system operating experience was conducted on failure data obtained

from the Nuclear Plant Reliability Data System (NPRDS), Licensee Event Reports (LER),

and Plant Specific Failure data bases. The NPRDS did not include IA as one of the systems,

hence the data relating to IA were not readily available for direct sorts. Separate sorts for

components within this system were conducted to obtain data on the relevant operating

experience. Since the IA system is not categorized as a safety-related system and is part of

the BOP design, component failure reporting did not include all system failures. This

restriction of available data bases (i.e. NPRDS, LER) caused problems in developing timedependent aging characteristics of components. To mitigate this problem plant specific

data, which suffer the same restrictions to some extent, were used to understand aging in IA

components.

Each data base was analyzed to determine the predominant failure modes, causes, and

mechanisms contributing to system failure. The operational stresses and other parameters

contributing to the aging of components were considered in assessing their functional

characteristics. Other relevant factors such as failure rates, aging fractions, and time-tofailure were extracted for use in the probabilistic models to predict the importance of

particular components and system unavailability with age.

In parallel with the data analysis, a probabilistic analysis on a specific plant Probabilistic Risk Assessment (PRA) model was performed. This assessment determined the

components which have the dominant effect on system availability. Because of the

complexity of the plant and system, it was not feasible to analyse aging or failure mode and

effects for all components and subcomponents. Therefore, we analysed that predominant

components that are vulnerable to degradation with age and important to system operation.

1-9
A plant with a completed PRA was chosen for the analysis. A PRA model and a

computer program (PRAAGE) were developed to reflect the essential features of the IA

system design and its failure rates. The time-dependency of the aging phenomena was

modeled to assign priorities to the possible component failures.

Section 2 of this report describes the design review of the IA system and discusses

various differences in design: Appendix A discusses these differences in detail. The

operational stresses and their correlation with accidents are discussed in Section 3. Section

4 evaluates operating experience data relating to IA systems and the effects of these

failures on plant operation. Appendix B contains an aging analysis of the EDG air start

system which, in many cases, is not part of the IA system. Section 5 analyzes the effect of

time-dependent component failures on the system availability. Section 6 discusses the

inspection, surveillance, monitoring and maintenance methods currently performed in the

nuclear industry. Finally, our results are summarized and recommendations given in

Section 7.

I-to
2. SYSTEM DESIGN REVIEW

This section describes the basic design and configuration of compressed air systems in

nuclear power stations. Appendix A has a brief discussion of each major component of a

compressed air system, covering the general system arrangements encountered. The appendix also includes the results of a review of compressed air systems in 38 nuclear plant sites

which constitute 65 reactor units.

The review quantifies the variations in the designs and specifications of the compressed air systems in the nuclear industry. Although the supply portion of the compressed

air system is basically similar in all plants, there are numerous variations in design and

overall configuration, as well as in design and operating philosophy. The results of the

design review provide insight in analysing failure data, in determining the effects that

variations in design have on availability, and in determining the applicability of the results

on compressed air systems in general. The review also provides the data on the quantities

of components and configurations needed to normalize the failure information for analysis.

The primary source of information for the design review was the Final Safety Analysis

Report (FSAR) for each plant. These reports were supplemented whenever possible by

system descriptions, lesson plans, the NPRDS data base, other instrument/service air study

reports, and by discussions with plant personnel. The design features of each plant's

compressed air system and components were cataloged, and then summary analyses were

performed.

2.1 General Description

The nomenclature used to refer to the various compressed air systems varied from

plant to plant (Table 2-1). Most nuclear plants, both PWR's and BWR's, referred to their

higher-quality compressed air system as the "Instrument Air System." A few used the less

common term "Control Air System." Two plants used the terms "Noninterruptible" or

"Essential Instrument Air" and "Interruptible" or "Non-essential Instrument Air" to distinguish the safety-related portion of their instrument air systems.

The majority of nuclear plants called their lesser-quality maintenance and service

compressed air system the "Service Air System," but we also encountered the terms

"Station Air System," "Plant Air System," and "Compressed Air System."

We will adhere to the nomenclature found most frequently in nuclear power stations

when referring to the various compressed air system, that is, Instrument Air (IA) System,

and Service Air (SA) System. When discussing the overall plant pressurized air systems,

the terms "Instrument & Service Air System" or "Compressed Air System" will be used.

2.1.1 Design Bases

The following are typical design bases specified for compressed air systems in nuclear

power plants.

1. The instrument air system is designed to provide an adequate capacity of clean,

filtered, dry, oil-free compressed air to the plant pneumatic instrumentation, controls, and

2-1
Table 2-1 Nomenclature of Compressed Air Systems

Instrument Air

Interruptible or

Instrument Noninterruptible or Non-Essential Auxiliary

Air Control Air Essential Instr. Air Instr. Air Control Air

BWR 13 1 2 2 0

PWR 22 3 0 0 1

Service Air

Service Air Station Air Plant Air Compressed Air

BWR 15 1 0 0

PWR 16 5 3 1

Overall Compressed Air Systems

Compressed Instrument & Control & Station & Station &

Air Service Air Service Air Instrument Air Control Air Station Air

BWR 2 10 1 0 1 2

PWR 13 8 0 3 0 1

valves. The air shall be supplied at nominal design pressure as specified and a design dew

point at operating pressure as specified.

2. The service air system is designed to deliver an adequate capacity of clean, oil-free

compressed air to the plant maintenance and service air headers. The air shall be supplied

at a nominal design pressure as specified.

3. The air compressors are sized to meet all the normal demands with one or two

compressors running continuously in the load/unload mode. The maximum anticipated

pneumatic demand will be satisfied by cycling the additional compressors into service from

the standby mode, as required.

4. Air receiver tanks and distribution headers are designed to satisfy the continuous

plant pneumatic demand required to shutdown the plant following the loss of electrical

power or compressor failures.

5. Air-operated valves and pneumatic controls are designed to fail to their safe

shutdown position upon loss of pressure in the instrument air system. Whenever pneumatic

components are actively required for safe shutdown, safety-grade accumulators with safetygrade check valves are provided for each of these critical components to assure a continued

supply of pressurized gas if the instrument air system is lost or degraded. At some plants, a

separate dedicated instrument air system or a branch of the normal instrument air system is

designed to safety-grade, seismic Class I standards, with redundancy, to supply those

pneumatic components required for safe shutdown.

2-2
2.1.2 General System Description

A compressed air system is comprised of three subsystems: the compressed air supply

train, a filter/dryer train, and a distribution section. A brief discussion and description of

each portion follows.

The compressed air supply train consists of a string of components as shown in Figure

2-1. The air compressor draws in air from the atmosphere via an intake filter/silencer which

removes dirt and other particles and reduces the noise at the compressor intake. The

compressor itself is usually powered by an electric motor. The compressor discharges to an

aftercooler, a water-cooled heat exchanger, which cools the compressed air. Cooling water

for the aftercooler and any intercoolers for multistage air compressors is usually provided

by the plant component cooling water system. A moisture separator connected directly to

the discharge of the aftercooler as shown in the figure, removes condensation and oil from

the air stream before the air enters the air receivers. The components within the dashed

lines in Figure 2-1, i.e. the intake filter/silencer, the compressor, and the aftercooler/

moisture separator, are typically supplied by a manufacturer as a complete packaged or

skid-mounted unit, often referred to as the "air compressor package."

AtmLiHhef CJ Atuosphrt £ taopre)

4 t~~l~brt f/ H | AdI t - n d § . - _-e 

Ortooler ~Separator To

cam~~~~~~~~~~~~~~~i am: Air

Electric tor

Power 1

Ceoliug Water

Figure 2-1 Functional Diagram of Compressed Air Supply Train

Finally, the air leaving the moisture separator passes into the air receiver usually via a

check valve and an isolation valve. The air receiver acts as a storage tank for the

compressed air and dampens out the pulsations and pressure surges generated by the

compressor.

A pressure relief valve or a safety valve are normally placed at the compressor's

discharge to protect the discharge piping and the aftercooler/moisture separator from

overpressurization. A relief valve is also placed at the air receiver to prevent the tank from

exceeding its pressure limit.

2-3
A filter/dryer train, sometimes known as an air "dryer package," is functionally

represented in Figure 2-2. Its function is to filter and dry compressed air to a quality

suitable for use in an instrument air system. Compressed air enters the filter/dryer train

from the compressed air supply train via one of two parallel prefilters. The parallel filter

arrangement is common, allowing one full-capacity prefilter to be in service while the other

remains in standby. Maintenance can be performed without interrupting the flow of

compressed air through the dryer. The prefilter removes particulates, and oil and water

which could damage the dryer unit. The air stream next passes through the air dryer. The

figure shows a dual-tower-regenerative desiccant type of dryer in which the air stream is

processed through the on-line desiccant tower while the other tower is in the regenerative

portion of its operating cycle. Each tower alternates on-line while the other regenerates.

Vent To Ethoust

Compressed To

Air P |refilters Reg - i- In~sOruCmet

Supply | Atetfilter _ O Conliol AI r ryeSerrice 

Figure 2.2 Functional Diagram of Instrument or Control Air Filter/Dryer Train

Finally, the air stream is directed through the afterfilter, which again, are arranged in a

parallel configuration identical to that of the prefilters. One full-capacity afterfilter is in

service while the other remains in standby. The afterfilters remove any remaining oil and

water, and desiccant particles carried over from the dryer unit.

For most service air system in nuclear stations, a full filter/dryer train, such as the one

described above for an instrument air system, is not required to achieve service-air quality

specifications. The moisture content of the compressed air leaving the aftercooler/moisture

separator is acceptable for most service air systems, so the air is passed directly into the

system without any further conditioning. In some instances, the air stream passes through a

filter before being directed into the service air headers.

The distribution section of a compressed air system consists of the headers, piping, air

connections stations, and hoses that deliver the compressed air to the pneumatic devices.

Two basic distribution configurations are encountered: the radial distribution, and the ring

header distribution. Very often elements of both methods are combined.

2-4
The radial distribution approach uses a single, large air header to transport the

compressed air into the plant, branching off along the way to radial headers in individual

buildings as shown in Figure 2-3. In the figure, the distribution piping to the reactor

building and the turbine building is represented down to individual points of use. The other

buildings would have similar arrangements.

Figure 2-4 is a simplified representation of the ring header arrangement. This systems

allows for greater distribution availability of compressed air, since portions of the system

can be isolated by valves for maintenance or modifications without interrupting service.

2.2 System Design Variations

The design of a compressed air system is one risk sensitive factor which can affect the

safety of a nuclear plant. For example, the OSRR study(5) on the Oconee PRA found that

upon loss of IA, a condensate system valve shifts its fail-safe position (open), thus draining

a great deal of the plant's water inventory to the main condensate hotwell. This design

deficiency was discovered while modeling the plant's response to failure of the IA system.

After modifying the design of the condensate system, the risk was reduced significantly.

Since there are wide variations in the design of the IA system due to its classification as

part of the BOP systems and categorization as non-safety, we conducted a survey on 38

plant sites by reviewing their FSARs; the results are detailed in Appendix A.

The compressed air systems could be grouped into two basic categories based upon the

supply train designations. The Type I supply arrangement consists of two or more IA

compressors supplying both the plant service air header and the IA header via a filter/dryer

train. The Type II is made of one or more IA compressors feeding the IA header, along

with one or more separate service air compressors supplying the service air headers.

Table 2-2 summarizes the distribution of the Type I and Type I compressed air

systems in the sites included in the FSAR review. The categories are grouped by reactor

type and by number of reactors on each site.

Table 2-2 Types of Air System Supply Configurations at Nuclear Plant Sites

Single Unit Nuclear Sites Two Unit Nuclear Sites Three Unit Nuclear Sites

Type I Type II Type I Type II Type I Type II

BWR's 6 1 3 5 1 1

PWR's 3 4 6 7 0 1

Total 9 5 9 12 1 2

Type I configuration consists of two or more IA compressors supplying both the IA & SA systems.

Type 11 configuration consists of one or more IA compressors and one or more SA compressors feeding their

respective air distribution systems.

The design configurations of compressed air systems in a multiple reactor nuclear

stations were also reviewed. One design uses a separate system for each unit, independent

from the other units. Sometimes they are tied together by cross-connect lines via locked

manual valves. The other design provides one large, multiple redundant component system

shared among all the reactor units at a site. Table 2-3 summarizes the distribution of

independent compressed air systems versus shared compressed air systems among the

2-5
Reactor Bldg.

Heater

Bay

A

Heater

Bay

B

Demineralizers

Radwaste

Bldg.

Intake Structure

Fire Water

Pumphouse

Figure 2-3 Radial Compressed Air Distribution System e

2-6
COMPRESSED AIR SOURCE HEADER is.

<~~~~~~-

-tO- OPER FL OPER FL.-0-.'1

TURBINE BUILDING

RING HEADER

-1_-. GRND FL

MEZZ FL

GRND FL -0-0-0-

MEZZ FL

-4 -jb

REACTOR

BLDG

MEZZ FL -0--

-t"'-- GRND FL

UPPER FL

I NTAKE

STRUCTURE

GRND FL -

CONTROL

BLDG

-t01-- MEZZ FL AUX. BUILDING

RING HEADER

UPPER FL -*_1

DEMINS RADWASTE

BLDG

Figure 2.4 Ring Header Compressed Air Distribution System
multiple unit nuclear plant sites in this FSAR study. The totals for BWR's and PWR's are

also shown.

Table 2-3 Independent vs. Shared Compressed Air Systems at Multiple Unit Nuclear Plant Sites

Two Unit Nuclear Sites Three Unit Nuclear Sites

Independent Shared Independent Shared

Compressed Compressed Compressed Compressed

Air Systems Air System Air Systems Air System

BWR's 6 2 1 1

PWR's 6 7 0 1

Total 12 9 1 2

2-8
3. ENVIRONMENTAL AND OPERATIONAL STRESSES

Earlier studies on compressed air systems in nuclear power plants identified aging as

one of the contributing factors to system failures. ANSI/ASME OM-17(10 ) (testing of IA

systems) therefore addressed the possible causes of component failures, which include agerelated deterioration of components. The standard discusses various methods to assure the

operability of these components. Moisture in the air, particulates in the vents, and

hydrocarbon contamination of air systems cause a considerable number of air system

failures. An understanding is essential of the age-related degradation of the system as a

result of these contamination problems, service conditions, testing, and other governing

factors. Since aging degradation changes the physical, chemical, electrical, and mechanical

properties of materials used in component designs, the interaction of the age-sensitive

materials with the operating and environmental stresses must be recognized.

This section discusses the stress parameters relating to the operation, testing, and

maintenance activities and to the environment in typical nuclear power plants. The effect of

accidental or abnormal stresses caused by plant or system transients are also discussed,

including component and system level stresses to which the compressed air system is

exposed.

3.1 Operational Stressors

The compressed air systems are designed to provide a dependable source of compressed and cooled air for station service, breathing, testing, and instrumentation requirements. Sufficient redundancy is provided to give high reliability of air supply at all times.

Sufficient air receiver capacity is provided to meet high air-demand transients. Therefore,

these systems operate continuously.

A loss of instrument air pressure due to a "Blackout" during normal operation causes

all pneumatically operated valves which are essential for safe shutdown to fail in the safe

position. Air accumulators supply air to those pneumatic valves which are required to

operate to achieve plant shutdown. During normal operation, one of the multiple instrument

air-supply trains, including the compressor, is in continuous operation, and is automatically

loaded or unloaded in response to the IA system demand. The other train serves as a

standby. The standby compressor starts automatically if the lead compressor fails, or if

continuous operation of the lead compressor cannot meet the IA system demand.

In most plants, the compressed air systems are not designed as safety-grade or safetyrelated systems. Therefore, a single failure in the electric power system or compressor

cooling water supply system can cause a complete loss of the station's air system. Other

features such as redundant trains, accumulators, and redundant sources of electric power,

often prevent a total loss of air systems. However, because of their non-safety classification, there is less emphasis on operating, maintaining and training for these systems

compared to safety-related systems. This can create operational problems or errors, such as

lack of maintenance, improper installation or replacement of desiccants, and leakage

through the accumulator seals, which eventually can lead to system failures.

Another problem, well described in the AEOD("4 and OSRR(" studies, relates to

deficiencies in the design of the system. These deficiencies include inadequate capacity of

3-1
accumulators, improper component sizing, valves failing to perform their intended functions under slow depressurization of IA system, faulty components, and incorrect selection

of valve fail-safe positions. This inadequacy is further highlighted by the NRC Information

Notice 89-26 which describes some Licensee responses to Generic Letter 88-14. The

Oconee PRA for the auxiliary feedwater system, for example, successfully identified that

upon loss of IA, a condensate system valve shifted incorrectly to a fail-safe position (open),

resulting in drainage of the plant's inventory to the main condenser hotwell. Unfortunately,

not every plant has a systematic PRA, nor do all PRAs include loss of IA as an initiating

event because of its non-safety classification.

Table 3-1 lists all the components within the compressed air system and their

susceptibility to operating stress. Although contamination by water, particulates, and

hydrocarbons dominates the eventual system failures, the operating conditions listed often

lead to these contamination problems. For example, tube leaks inside intercooler allow

moisture to carry over into the supply air, eventually corroding internal valve parts.

Pariculates entering the system through faulty filters or originating within the system (for

example, corrosion from piping) can clog many instrument lines, causing faulty indication

or erroneous control signals. Finally, oil leaks into the oil-less type compressors can

generate hydrocarbon deposits and gummy-like residues in the pneumatic valves causing

Table 3-1 Stress Conditions for IA Components

Stress Conditions

IA Subsystems Components Causing Degradation

Compressor and Receiver Inlet Filter Contaminated Air (dust, radiaAir Compressor Assembly tion, moisture) - Drive Motor Corroded/Eroded Tubes

- Lube Oil Cooler - Water leak into the system

- Inter Cooler - Oil leak into the cylinders

- Controls (Unloading Valve) Insulation Deterioration

- Pumps Bearing Wear/Lack of Lubrica-

- Heaters tion

After Cooler Component Malfunctions

Moisture Separator Improper Draining

Air Receiver (tank) Clogging Filters

Drains

Dryer and Filter Pre Filter Clogging Filters with ContamiAir Dryer nants

- Dryer Corroded Parts

- Controls Improper Draining

- Heaters Saturated or disintegrated desic-

- Desiccants cants

- Refrigerated System

After Filter

Drains

Distribution Network Tubing Corrosion of Tubes and Valve

Valves Internals

Controls Crimping of Tubes

Instrumentation Tube Support Failures

3-2
them to become sluggish or inoperable. Oil also can cause valve seals to become brittle and

to stick to mating surfaces, thereby preventing proper motion.

Rust particles inside the piping and connecting equipment caused by moisture or water

in the air supply sometimes get dislodged during severe vibrations (e.g. flow-induced,

water hammer, equipment-induced), and could adversely affect a large number of airoperated devices. Certain particulates are abrasive (e.g. the air-dryer desiccant) and can

damage solenoid air pilot valve seals (O-rings), preventing air-operated valves from

functioning properly. Hydrocarbons can contribute to tearing apart seals, resulting in loose

particles which can block air-discharge orifices.

In addition to contaminated air, loss of air (or leakage) from the air system is caused

predominantly by lack of proper maintenance of the dryer/filter and distribution network

subsystems. Under normal and/or abnormal operation dirty filters, corroded components,

crimped tubes, and punctured joints often either restrict the flow of air or allow the air to

leak out of the system. Then, the system operates under degraded conditions which

sometimes causes the backup compressor to start to make up the air loss.

Each instrumentation and control unit operates at a particular range of air pressure. In

most cases, the air line pressures are designed according to the instrument's pressure

ratings. In some cases, such as the solenoid valves (NRC Information Notice 88-24), the

equipment does not function when the air supply pressure falls or exceeds the operating

range. Since this is contrary to the design philosophy of fail-safe position, it is critical to

maintain air supply to these equipment at the required pressure.

3.2 Environmental Stressors

Since the compressed air systems receive air from the atmosphere, the quality of air in

the intake chamber is important in their operation. Too much dust, moisture, or othey

contaminants can block, corrode, or degrade inlet filters causing restricted air flow to the

system.

With the exception of the distribution network, the major components within the

compressor and filter/heater subsystems are typically housed in a benign environment.

Therefore, under normal circumstances, temperature, radiation, and other environmental

conditions should have only a minimal effect on the aging of equipment. Polymeric seals

used in accumulators, compressor head gaskets, and pneumatic doors, can degrade with

time, causing leakage of air through them. Since the atmosphere is not controlled, any

anomalously harsh conditions, such as high humidity or high temperature, can contribute to

system aging.

The piping and valves used in the system, specifically in the distribution network

subsystem, are exposed to environmental conditions according to where the air equipment

is located, for example, inside containment, outside containment, or inside other auxiliary

buildings. Degradation of this piping and its supports by corrosion and other mechanisms

can challenge the operability of this air equipment. External events, such as a flood (inside

the plant due to breaks in the pipes or steam lines), fire, and vibration including earthquakes, can degrade the system and cause premature failure.

3-3
3.3 Maintenance Induced Stressors

One of the contributors to compressed air system failures is inadequate maintenance

and testing. These systems typically have instruments to monitor temperature and pressure

at various locations wheret~ wkater is used for cooling the air. The differential pressure is

measured across each filter, dryer, or cooler to detect pressure increases due to clogging or

to flow restrictions. Drain lines are provided for removing condensed water, and flow

indicators are installed to monitor the air flow to the distribution network. In a regenerative

desiccant dryer, purge flow is used to monitor its performance; for refrigerant dryers, the

temperature of the heat exchanger is monitored. Before the air flows from the subsystem to

the distribution network, each line is monitored by measuring its dew point, contamination

and hydrocarbon levels. The complete system undergoes a preoperational testing program

(per USNRC Regulating Guide 1.68.3) before it is available for service.

Air systems at most U.S. nuclear power plants are not categorized as safety-systems.

Therefore, most safety analyses assume that air systems fail to maintain operating air

pressure during transients and accidents. The operating and maintenance personnel in the

plant do not have extensive training on air systems, and procedures involving these systems

are not as detailed nor as thoroughly reviewed as for safety-related systems. Consequently,

improper actions such as erroneous line-ups and verifications of valves, improper valving

operations, installing dryer desiccant incorrectly, errors in filter replacement, neglecting

pressure differential change across coolers, failure to replace gaskets and seals on a timely

basis, and errors in instrumentation set point have led to reactor scrams and failures of

safety equipment.

3.4 Summary

Compressed air systems can have operational problems due to contamination in the

intake air such as moisture, particulates, and hydrocarbons. The operating stresses are

generally related to wearing of compressor bearings, corrosion of cooling tubes and air

equipment intemals, and leakage of air through aged polymeric seals. Other forms of stress

generated within the system are due to human errors, lack of proper maintenance, and

factors relating to the non-safety classification of the system components.

3-4
4. COLLECTION AND ANALYSIS OF FAILURE DATA

As part of our aging assessment of compressed air systems in nuclear stations,

information on failure and on operating experience were collected from several sources.

Among these were plant specific data, the Nuclear Plant Reliability Data System (NPRDS),

and Licensee Event Reports (LER's). This section briefly discusses the sources and

presents the results of the analyses.

4.1 Data Bases

4.1.1 Descriptions

Among the sources of data, the plant specific operating and maintenance records for

compressed air systems ultimately proved to be the most comprehensive, and therefore, the

most useful. Such information is the most difficult to obtain, however, due to variations in

the record-keeping format at each plant, the nonsafety-related designation of most instrument air systems, and the proprietary nature of individual plant records. Nevertheless, we

collected records for over 4550 maintenance activities at six nuclear plants. Records for

three of the units covered the entire operating period, from initial service. The other three

plants provided data covering the past few years of compressed air system operation only.

The Nuclear Plant Reliability Data System (NPRDS) was of limited use because it

does not treat the instrument air system as one of the standard reportable systems. At the

component level, which is the key access level for NPRDS, the major instrument air system

components are not reported directly. By a methodical search of the components and

systems that are included in NPRDS and are known to interface with the instrument air

system, some useful information was gleaned. However, NPRDS does cover the Emergency

Diesel Generator (EDG) Starting Air System, which is, essentially, a scaled-down version

of the instrument air system. These data were analyzed to compare with the plant-specific

compressed air system data, and also to present information on this critical system in its

own right; Appendix B contains these results. One interesting result found from the

analysis of failure data on the EDG air start compressor was that the head gaskets had a

finite life cycle of 6-7 years (see Figure B-8).

LER's involving instrument air or plant air as a primary system or interfacing system

were extracted from the LER data base, using the Sequence Coding Search System (SCSS)

for the OSRR instrument air system study (Reference 2). This data base also incorporates

all of the IA incidents referenced in Appendix A of NUREG 1275 Vol. 2 . These data

were extensively analyzed during the OSRR study, so the results were used simply to

verify the findings of the plant-specific failure data. In-Plant Reliability Data System

(IPRDS) data for compressed air systems at one nuclear plant were obtained in computerized form from G. Murphy of Oak Ridge National Laboratory. However, the information on

the instrument air system was too sparse and incomplete to be useable.

4.1.2 Methods of Analysis

As mentioned previously, the information obtained from the plant specific maintenance records was the most extensive, hence, the most of our effort focused on reduction

and analysis of these data. Over 4550 maintenance records from the six plants were

4-1
reviewed and tabulated to permit sorting, counting, plotting, and analysis; over 2100 were

categorized as compressed air system failures.

As part of the review, each failure record was categorized as to whether it was related

to aging. A definition was established of "aging-related" based on the NPAR definition

presented in NUREG-1 144(6) which was applied to each event. The following two criteria

had to be met for a failure to be considered aging-related:

1. The failure must result from cumulative changes with time which, if unchecked, could

result in loss of function and impairment of safety. Factors causing aging can include:

* natural internal chemical or physical processes during operation,

* external stressors (e.g., radiation, humidity) caused by the storage or operating

environment,

* service wear, including changes in dimensions and/or relative positions of individual

parts or sub-assemblies caused by operational cycling,

* excessive testing, and

* improper installation, application, or maintenance.

2. The component must have been in service for at least 6 months before the failure (to

eliminate infant mortality failures).

After all the data were tabulated, the records were checked to verify we also verified

that they were classified correctly and that interpretations were consistent. We also verified

that the components reported were within the boundaries of the compressed air systems

defined in Section 1. When the data base was complete, the failure events were sorted and

plotted in various ways to obtain the information for this analysis.

4.2 Dominant Failure Trends

4.2.1 Aging Fraction

A primary concern of this study was to determine if aging degradation occurs in

compressed air systems and if it contributes to failures. To accomplish this, the failure

records were first reviewed and sorted to identify which were related to aging. The NPAR

definition of aging was used: this is a broad definition including many causes, as discussed

in NUREG-11446) u

The results of this sorting from two typical plants are presented in Figures 4.1 and 4.2.

The Plant "A" failures occurred in the plant air systems during the fourteenth through the

eighteenth years of system operation, whereas the Plant "C" plot depicts air-system failures

from initial service through the eighth year of operation. The aging fractions determined for

these plants were 89% and 68%, respectively, suggesting that aging-related degradation

plays a significant role in the failures of the compressed air system. As expected, the older

plant, Plant "A", shows a proportionately higher percentage of aging-related failures than

the new plant, where the equipment is operating in the early stage of operating life before

wearout and aging effects predominate. Operation and maintenance problems contribute a

4-2
AGING

89%

UNKNOWN

1%

NON-AGING

10%

Figure 4-1 Aging Fraction-Plant "A"

UNKNOWN

8%

NON-AGING

24%

Figure 4-2 Aging Fraction-Plant "C"

4-3
higher percentage early in system life, due to the "learning process" of plant personnel;

also, preventative maintenance procedures have not yet been optimized, further contributing to this category. Equipment "breakin" failures and design/installation problems are

commoner early in the systems's life, thereby, additionally reducing the relative proportion

of aging-related failures in a newer air system.

To verify the above findings, comparison was made to the aging fraction exhibited by

the LER data base from the OSRR study.(5) Figure 4.3 shows that slightly more than half of

the compressed air system LER's are aging-related. Due to the reporting requirements of

10CFR50.73 for Licensee Event Reports, the LER data base is not representative of all of

the LA failures that are occurring: only incidents that result in a reportable event are

included. This results in a larger proportion of events caused by operational/administrative/

maintenance errors; if these are excluded, the fraction of aging-related failures is more than

60% of all the instrument air failures in the LER data base.

Therefore, aging is a concern for compressed air systems. The aging processes should

be identified to determine whether they can effectively be monitored and controlled to

maintain the system's performance, or avoided by improvements of design or operation.

4.2.2 Detection of Failure

In a nuclear power station,

service air system are operating

Neverthless, the actual demand

as at all power plants, the instrument air system and the

continuously, whether the plant is at power or shutdown.

will vary widely, therefore, the number of compressors

AGING

51%

NON-AGING

25%

UNKNOWN

24%

Figure 4-3 Aging Fraction-LER Data (All IA-Related Events)

4-4
required to meet the pneumatic loads of the plant will also vary. At least one compressor

will always be operating under normal circumstances, modulating the unloader valve to

maintain the system at nominal pressure.

Since the compressed air systems are not typically classified as safety-related, there

are fewer associated alarms and surveillance tests. Consequently, the methods of failure

detection are typically visual inspection during operator walkdowns, abnormalities noted

during daily or weekly parameter logging, problems noted by plant personnel using

compressed air or working near air compressing equipment and auxiliary equipment, and

problems revealed during periodic preventative maintenance testing and inspections.

The equipment in the compressed air supply train (compressors, intercoolers,

aftercoolers, moisture separators, receivers) is the most complex and active part of the

system, so it receives the most maintenance and operating attention. The compressor and its

critical support subsystems are usually monitored and alarmed in the control room.

Parameters such as vibration, lube-oil level, lube-oil temperature, discharge pressure,

intercooler inlet/outlet temperatures, aftercooler inlet/outlet temperatures, and compressor

operating status are commonly included. Periodic overhauls and preventative maintenance

inspections and surveillance testing often uncover more clandestine problems.

The dryer is the most active component of the filter/dryer train, therefore it receives

most periodic maintenance and inspection. Many problems are detected by maintenance

and operating personnel during these activities, or from dryer trouble alarms, such as high

exit humidity, low flow, high differential pressure, heater problems, or failure to regenerate. Periodic desiccant changeouts and dryer overhauls often turn up more subtle hidden

failures. Aside from periodic replacement of filter elements, the filters receive little

periodic maintenance or inspection. Most filter problems, such as clogged drain traps,

corrosion, gasket deterioration, and minor leaks are found during element replacement. The

remainder of the system receives minimal inspection, with the exception of the containment

isolation valves. Clogging and contamination typically are detected by low pressure at the

point of use; i.e. these problems in the instrument air system are manifested by malfunctions (usually in air-operated valves and dampers) in other plant systems that use compressed air. Leakage is most often detected either by abnormal operation of pneumatic

devices, by direct observation by plant personnel, or by excessive operation of the

compressor.

4.3 Component Level Failures

Investigation of aging phenomena in the instrument air system was first looked at on

the component level. The plant maintenance records were the most comprehensive source

for this level of analysis, since they are generally entered at the component level. As

mentioned previously, the NPRDS was not useable for the instrument air system component study since IA is not one of its standard reportable systems, even though it is a

component-based data base.

The plant data were for six nuclear units covering over thiry-six years of operation,

and included fourteen instrument air compressors, ten service air compressors, and eleven

heated, regenerative, desiccant air dryer units.

4-5
4.3.1 Distribution of Failures by Component

The data for each plant were sorted to determine the distribution of air system failures

among the various components. The range of the failure percentage of each major

component at the six plants in the study is shown on Figure 4.4. The information makes

several points. The first concerns the ranking of the individual components of the air

system with regard to the relative numbers of failures. Compressors, air system valves

(within the study boundary), dryers, filters, and instrumentation, in that order, account for

the majority of failures, followed by piping (less than 5%), air receivers (less than 1%), and

aftercooler/moisture separator units (less than 1%). This would also be a good starting

point to allocate maintenance resources for the instrument air system, modified by the

individual contributions of each component to the overall system availability.

Compressors and dryers exhibited the widest range in percentage of failures (26% to

49% and 7% to 29%, respectively) among the air system components. These two components are the most active devices, and most critical, in the entire system. The compressor

particularly can be a complex device, consisting of numerous large reciprocating or highspeed rotating parts, and essential support systems (electric power, cooling water, lube oil,

etc.), so the potential for failures is greatest. The wide range shown by the compressor and

the dryer may reflect the relative complexity of the components, or how well they perform

under the differing types and amounts of maintenance at the various plants in the study.

For example, the two plants with the lowest percentage of compressor failures,

ironically had the worst record for dryer failures. These plants were found to place high

Compressors

Valves

Dryers

Filters

Instrumentation

Piping

Receivers

Af tercoolers

'

i i

I F!

L 7i 1

I

t ! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

* , ,~~~~~~~~~~~I

I . I

L.,

I

0 10 20 30 40

Percentage of Failures

50 60

Figure 4.4 Range of Component Failures

4-6
priority on maintaining their compressors as reflected by the PM Effectiveness (PME),*

which was over .72 for IA compressors and over .82 for their SA compressors. Conversely,

the PME for dryers at these same plants was .53 at one plant and only .45 at the other. This

difference suggests that the wide ranges of percent of failures seen in some components in

Figure 4.4 may be due to differences in the periodic maintenance programs at the six plants

studied, and that the availability performance of these components in particular could

benefit from improvements in the maintenance program.

The age of the equipment might account for the wide range observed in the percent of

failures for active components, such as compressors and dryers. A second factor observed

was startup difficulties at the new plants, which, in some cases, resulted in an anomalously

higher quantity of failures during initial operation.

The less complex, passive equipment in the system such as air receivers, air headers,

distribution piping, and aftercooler/moisture separators displayed a narrow distribution

range of percent of failures. In addition, the importance of these components in the overall

number of air system failures was fairly uniform among all the plants. The periodic

maintenance on these components is minimal and straightforward; consequently, the very

small effect of variations in maintenance is clearly seen in Figure 4.4 as a very narrow

range for each of these components.

4.3.2 Aging Fraction by Component

To gain more insight into the component-by-component contribution to air system

aging, we compared the aging fraction by component of the total air systems failures at two

plants, one new and one older unit. The plants selected had the most comprehensive

maintenance data and nearly identical PME, (.80), for their compressed air systems. Figure

4.5 shows the aging fraction percentage at Plant C by component for the compressed air

systems over the cumulative eight-year operating period following initial startup. Figure

4.6 shows the aging fraction distribution by component for Plant A during operations from

age 14 to 18, inclusive.

As expected the fraction of aging failures with respect to overall failures is lower in

the newer air system than in the older system of Plant A. Plant C experienced more nonaging difficulties with air system valves and instrumentation than expected during the early

stages of operation; this can be seen in Figure 4.5 as the relatively large non-aging fractions

for these components. The older plant, Plant A, has only a small number of non-aging

failures for all of the components, except compressors. Presumably this is because break-in

failures, operating and maintenance errors, design and manufacturing defects, maintenance

intervals, and procedures have all been fairly well optimized after 15 years of operating

experience, and, therefore, most of the problems would be due to aging. This phenomenon

also was noted in other system aging studies.(8' 9) For the compressors, useage type failures

did not change as much from the young plant to the old plant, possibly 1) because the

periodic maintenance and the intervals involved were effective for these plants, and 2) due

*PME = PM / (PM + CM) where PM is preventative maintenance and CM is corrective maintenance. Note

that this parameter may not completely represent the effectiveness of the PM activities in a given plant, but

is used to develop a relationship between the failures and the level of maintenance performed on the component.

4-7
Percent of Failures Reported

50

40

3...,...,...... 30

30.3.+..3.5393.3.*33.3.3..l20

10 - . ...............

0

COMPRESSRs VALVES DRYERS INSTR. PIPING FILTERS RCVRs/HXs

| _ AGING m NON-AGING =2UNKNOWN|

Figure 4-5 Aging Fraction by Component Type-Plant "C"

Percent of Failures Reported

50

40- El.................... ............

30 :

20 - . ,3333,3.33

1 0 333 3~~~~.3333.3.33.3... l.333.3.....3,3

0 T z g _ ................ 3 33 33..............

COMPRESSRsVALVES DRYERS INSTR. PIPING FILTERS RCVRs/HXs

|EI AGING M NON-AGING = UNKNOWN

Figure 4-6 Aging Fraction by Component Type-Plant "A"

4-8
to the complexity of compressors, a proportion of non-aging failures may always be

present.

Comparing the two plants, the distribution piping, pre- and after-filters, and the

receivers/aftercoolers, in that order, experienced the greatest increase in both the overall

percentage of failures as well as aging-related failures. As mentioned previously, these

items receive the least periodic maintenance of all the components in the air system, so one

would expect an increase in aging problems. Next, aging-related failures in dryers, valves,

and compressors increased, in that order, when comparing Plant A to Plant C. The increase

for compressors was less than 9% for aging related failures. The overall percentage of

failures actually decreased for valves and instrumentation, possibly due to the startup

failures at Plant C, and more instrumentation and computerized monitoring at the newer

plant.

The behavior of all compressed air systems cannot be generalized from this comparison because only two plants were considered. However, the analysis provides information

about the failures among air system components in new and old systems. The aging trends

observed can help to provide insights into the way components age in service at a nuclear

power station.

4.3.3 Causes of Failure

To identify the reason behind the failures of various instrument and service air systems

failure data from the plants were categorized according to cause for each group of

components. The cause was defined as the general condition or event which resulted in

component failure. The true "root cause" could not be determined in many cases due to a

paucity of detailed information.

The basic causes of component failures are examined for each of the three subsystems

in the compressed air system. The equipment within each subsystem is discussed as to the

causes of the failures in the plant operating experience data base.

4.3.3.1 Compressed Air Supply Train-Failure Causes

Compressors-Failures of the air compressor made up the majority of air system

failures, and aging-related problems dominated these. Failures of the intercoolers, compressor lube oil system, inlet and outlet valves, compressor controls, intake air filters, and

unloader valves are grouped under the category of compressor failures for this analysis.

Tabulation of the causes of compressor failure showed that over 85% are in the

category of normal service, a figure that is consistent with the aging fraction.

The second most common cause of compressor failures was human error, at less than

8%. These errors were in manufacture and design, installation, improper maintenance, and

procedure, and operating error. Operator error may have been under-reported slightly due

to the abbreviated computerized format of the maintenance records from some of the

plants.

The third most common cause was environment or service outside normal limits.

These non-aging failures were more common in new plants, where the systems are

operating in a dirtier, more hazardous construction-type environment compared to an older,

more established plant where construction and clean-up activity would be minimal.

4-9
Aftercoolers/Moisture Separators-Failures of this equipment made up less than 1% of

the total failures reported, so they are not much of a problem. Because of the low incidence

of failures, the data base was small for this component. Of those with identified causes,

virtually all were a result of normal service.

Air Receivers-Air receivers do not constitute any significant problems, either,

representing less than 1% significant problems, either, of the total compressed air system

failures. Over 70% of the problems were caused by normal service, the remainder were a

result of human errors.

4.3.3.2 Filter/Dryer Train-Failure Causes

Air Dryers-The next most critical component in the instrument air system after the

compressors is the dryer. All of the dryers in the six plants were of the externally heated,

dual-tower, regenerative, desiccant type. One of the new plants had 75% of its dryer

failures caused by normal service. Two of the new plants had slightly lower values than

this, but these plants had PME for dryers that were very low. This finding indicated that

they had not established an effective preventative maintenance program for their air dryers,

and were experiencing a larger number of failures than expected. The second most

important cause of dryer failures in a new plant was human error, about 25% of the time.

In established plants, air dryer failures due to normal service occurred slightly more

than 85% of the time. Again, the second most common cause of failure was human error.

However, in older plants, human error accounted for only about 6% of the failure causes.

The cause of the remainder of the dryer failures could not be determined.

Pre-filters-Problems in the pre-filters, the filter units that precede and protect the

instrument air dryers, were caused by normal service in nearly 88% events. The remainder

were caused by harsh environment or service beyond normal limits. In older plants, nearly

all the pre-filter failures were due to normal service. Harsh environment or service outside

normal limits was more of a problem in the newer plants. One of the new plants, Plant "E",

experienced a high incidence of failures, presumably because of too long an interval

between preventative maintenance inspections; the PME for pre-filters at this plant was

very low.

After-filters-Problems with the after-filters, the filter units which follow the instrument air dryers in the filter/dryer train, were the result of normal service in about 67% of

the events reported. Human errors accounted for nearly 22% of the after-filter failures.

Harsh environment or service outside of normal limits was implicated in the remaining

11% of the cases.

In the older plants, normal service was the most common cause in 75% of the afterfilter failures, with improper maintenance (human error) accounting for the remainder of

the cases.

In two of the newer plants, human error accounted for more than half of the after-filter

failures. The third new plant, Plant E, had a larger number of failures than the other plants.

This plant had a high number of pre-filter failures, as discussed in the preceding section.

Again, the most probable cause was an excessively long maintenance interval. In the case

of after-filters, another reason for the more frequent problems can be traced back to

4-10
problems with the air dryers. Since the dryers immediately preceed the after-filters,

problems such as moisture carry-over, desiccant breakdown, or desiccant blowby may

cause problems. Plant E had a PME for the instrument air dryers of about .45 and about .25

for the after-filters. Both of these values are low when compared to other plants.

4.3.3.3 Air Distribution System-Failure Causes

Valves-Problems with compressed air system valves within the boundaries of this

study were caused by normal service in nearly 70% of the failures at newer plants, and over

97% of the failures at the oldest plant reviewed. The other major cause of failures in the

new plants was human error, implicated as the cause of failure in about 25% of the events.

Presumably, once the early service failures have weeded out installation/design/

maintenance errors, manufacturing defects, and application problems, the normal service

failures for this component would then dominate in systems older than 5-10 years of age.

This conclusion is also consistent with the behavior of the age-related fraction for air

system valves as discussed in Section 4.3.2.

Piping-The air system distribution piping, tubing, and headers are passive elements

within the system. Accordingly, the contribution of human error to failures should only be

a factor in the early years of system's life. Since preventative maintenance on these

components is minimal, little direct effect would be noted. However, poor maintenance in

other parts of the system could carry water, oil, and contaminants into the distribution

system, eventually causing failures, but this effect would be difficult to quantify.

As expected, one new plant showed nearly 39% of its piping failures to be caused by

normal service. A quarter of these failures were attributed to corrosion, and another quarter

to accumulation of dirt and sludge; both causes could have resulted from poor performance

and/or maintenance in the compressors or, more likely, in the filter/dryer train equipment.

Human error, including installation and design problems, was a major cause of the 56%

piping failures in the new plant. Harsh environment or service outside limits caused

approximately 5% of the reported failures.

By comparison, nearly 86% of the failures in the oldest plant in the study were caused

by normal service. Human errors made up 7% of the failure causes, as did harsh

environment or service beyond normal limits.

Instrumentation-Instrumentation, monitoring, and control elements are located

throughout the instrument and service air systems; however, they are discussed along with

the distribution subsystem for convenience only. The cause of instrumentation failures was

found to be normal service in just over half of the failures in new plants, and over 80% of

the failures in older plants.

Human error accounted for 27% of failures in new plants, as opposed to less than 1%

of failures in the oldest air system. Service outside limits or harsh environment was the

cause in about 14% of all failures reported, and the remainder were either unknown or

various other causes.

4.3.4 Mechanisms of Failure

A failure mechanism is the physical, chemical, or other process by which a component

degrades or fails. For example, if an intercooler has a tube leak because the tube wall has

4-11
corroded, the failure mechanism would be corrosion. The failure mechanisms observed in

each of the major air system components are discussed in the following sections, grouped

by the three main subsystems.

4.3.4.1 Compressed Air Supply Train-Failure Mechanisms

Compressors-The kinds of failure mechanisms observed in the failure data was partly

a function of the type of compressor being examined. Reciprocating compressors were the

first to be looked at, since they are by far the most commonly used machine. In the FSAR

survey we conducted (Appendix A.2) reciprocating air compressors comprised over 90% of

the instrument air compressors and 52% of the service air compressors in those plants

where the compressor type was identified.

Figure 4.7 compares the instrument air compressor and the service air compressor at

Plant "A". Both of these units are electric-motor driven and of identical capacity, and the

failure mechanisms cover failures in the fourteenth through eighteenth years of operation.

Wear is the dominant failure mechanism in about one third of the cases, followed by

instrument and controls calibration or setpoint drifting problems in about one fifth. The

values for fatigue, contamination, plugging and clogging, and vibration were similar in

both compressors. In this instance, there was little difference in the failure mechanisms

observed with respect to the application (instrument air versus service air) of the compressors, given comparable operating hours and maintenance.

~~~~~~~Unknown 7S

Others 7%

.. Etec Overload 3%

Calibration/Dritt 17% Contamination 3%

Vibration 3%

Calibration/Dtiff 21%

Plugging/0o10ing 7% FatiG

Fatigue 14%

INSTRUMENT AIR

Wear 29%

PiL

g S~~~~~~~~~~~

nknown OS

Contacts Burnae 5%

Contamination 0%

gibration 2 n 3

i9gging/Clogging 3%

)us 3%

Othera 22%

SERVICE AIR

Figure 4.7 Failure Mechanisms for Reciprocating Compressors

4-12
Centrifugal air compressors made up the remainder of the instrument air compressors

in the plant survey, and were used as service air compressors in 20% of the identified

machines. Failure data were available for three, electric-motor-driven centrifugal compressors in an instrument air system for the first eight years of the system's operation. Their

failure mechanisms are provided in Figure 4.8.

Instrumentation and controls problems were responsible for failure in 40% of the

events. This fraction is probably a bit higher than what would actually be realized under

normal, steady operating conditions. Many of these problems were the result of break-in

and start-up failures; the wide variations in pneumatic load during the pre-operational and

start-up testing phase of nuclear plant operation are not conducive to setting-up and finetuning this type of compressor, which is best suited to constant, nearly full-load operation.

Vibration, wear, blocking and clogging, and compressor surge are the next most

dominant failure mechanisms. Finally, corrosion, contamination, deterioration, and electrical overloads constituted the remaining ten percent of the identifiable failure mechanisms.

No data were available for centrifugal compressors in a service air application.

The failure mechanisms of two electric-motor-driven rotary screw compressors in a

service air system during the tenth through the fourteenth years of operation were analyzed.

Rotary screw compressors made up 20% of the population of identified service air

compressor types in the FSAR survey. None were found in use in the instrument air

systems surveyed, most likely because this is not usually an "oil-free" machine.

Figure 4.9 shows that wear is the dominant failure mechanism, followed by vibration,

and deterioration. Wear was found to be a dominant failure mechanism in the reciprocating

compressor, which is also a positive-displacement type compressor. Other failure mechanisms included instrument and controls calibration and setpoint drift, electrical overloads,

burning and deterioration of electrical contacts, fatigue, corrosion, contamination, and

finally, plugging and clogging.

Aftercoolers/Moisture Separators-This equipment has few moving parts and plays a

relatively passive role in the air system. Consequently, the total number of failures

reviewed was small, and there were only three failure mechanisms that came into play.

Corrosion was the dominant one (45%), followed by deterioration (33%), and finally,

plugging and clogging (22%).

Air Receivers-Similarly, air receivers are a passive element in the air system. The

only moveable parts are relief valves, drain traps, vent valves, water level indicators and

control devices, and pressure indicators and transmitters. Therefore, as would be expected,

failure mechanisms such as corrosion (43%) and contamination (14%) are most dominant.

In addition, we noted deterioration (7%), instrumentation or controls calibration or setpoint

drift (7%), and damage due to impact. The remainder of the failure mechanisms could not

be identified or were classified as "other".

4.3.4.2 Filter/Dryer Train-Failure Mechanisms

Air Dryers-As discussed in Section 4.3.3.2, all of the air dryers in use at the six

plants being examined in detail are of the dual-tower, externally heated, regenerative,

desiccant type. The failure mechanisms discussed here are only applicable to this type of

dryer.

4-13
Callbration/Drift 24%

i1C Malfunction 16%

Vibration 15%

Oher 1%

Unknown 8%

Elec Overload 1%

Contamination 2%

Deterioration 3%

Corrosion 4%

Compressor Surge 6%

Blocking/Clogging 7%

Wear 13%

Figure 4.8 Centrifugal Compressors-Failure Mechanisms

Unknown 27%

Wear 21%

Deterioration 8%

Vibration 8%

Calibration/DrIft 6%

Electrical Overload 5%

Other 3%

Contamination 4%

Corrosion 4%

Plugging/Clogging 3%

C atigue 5%

Contacts Burned 5%

Figure 4-9 Rotary Screw Compressors-Failure Mechanisms

4-14
Analysis of the failures yielded the distribution of mechanisms shown in Figure 4.10.

The three dominant mechanisms are blocking and/or clogging (21%), corrosion (17%), and

deterioration (15%). These are the kinds of processes that would be expected in such

equipment. Other significant failure mechanisms were contamination (11%), and instrumentation and controls calibration or setpoint drift (8%). The remainder of the failure

mechanisms for air dryers consisted of electrical overloads, wear, and desiccant breakdown, or could not be definitely identified.

Pre-filters-The function of the pre-filter is to remove moisture, oil, particulates, and

other contaminants from the air stream before they can reach the air dryer. This protects the

dryer, prolongs the life of the desiccant bed, and makes it easier for the dryer to lower the

pressure dew point of the air to the specified limits. In most of the plants reviewed,

corrosion was the dominant failure mechanism in more than 80% of the events, followed by

saturation or wetness of the filter elements in slightly more than 16% of the cases.

As seen in Section 4.3.3.2, one of the plants, Plant E, had experienced an anomalously

high number at pre-filter failures, probably due to a long preventative maintenance interval.

Here, the dominant failure mechanism was blocking and clogging in more than 75% of the

failures, saturation or wetness of the filter elements in 13% of the failures; corrosion

occurred in less than 4% of the cases, compared to other plants where there was corrosion

in over 80% of the pre-filter failures. In addition to the problems with maintenance and

preventative maintenance intervals, other factors which could possibly cause this difference

are poor aftercooler/moisture separator performance, inlet air conditions, poor inlet air

filtration, receiver drain trap or relief valve problems, system configuration, materials

problems, and a host of compressor malfunctions.

Blocking/Cloogglng 21%

_ Other 6%

Unknown 15%

Corrosion 17%

Elec overload 2%

Desiccant Brkdn. 2%

Deterioration 15% CallbratIon/Drift 8%

Contamination 11%

Figure 4.10 Instrument Air Dryers-Failure Mechanisms

4-15
After-filters-The function of the after-filter is to remove any desiccant or other

contaminants in the air carried over from the air dryer. Water and oil vapors should not be a

big factor at this stage of filter/dryer train. Consequently, the identifiable failure mechanisms that dominate in the after-filter are blocking and clogging (38%), wear (8%), and

deterioration (4%).

Again, problems at Plant E affected the failure mechanisms in the after-filters. A large

number of failures was reported at this plant compared to after-filter failures at other plants.

The dominant mechanism was blocking and clogging, but corrosion and saturation or

wetness of filter elements made up over 16% of the total identified. It should be recalled

that there were also dryer problems at this plant initially, as well as a low PME for dryers,

indicating a less than optimal preventative maintenance program for dryers. This lack may

have caused some of the moisture-related mechanisms to occur, as well as producing

additional plugging and clogging.

4.3.4.3 Air Distribution System-Failure Mechanisms

Valves-To better understand the failure mechanisms occurring in the valves of

compressed air distribution systems, the types of valves which are involved must be

considered. Typically, the instrument air distribution system will contain 25% of the total

number of compressed air system valves in the nuclear plant, the remainder being allocated

to the service air distribution network. However, the more complex, power-operated valves

will be found in the instrument air distribution. Therefore, the majority of failures reported

will be associated with instrument air. In one plant, for example, nearly 60% of the

reported system valve failures were in the instrument air system. Of those 33% involved

motor-operated valves (MOV's), 9% were solenoid-operated valves (SOV's), 5% check

valves, and 4% were with pressure-control valves (PCV's).

With this in mind, the failure mechanisms can be examined (Figure 4.11). Wear and

corrosion are the two dominant processes at 29% and 22%, respectively. Contamination at

Other 2%

Wear 299

Unkn

I

al

Fractui

own 25%

Deterioration 2%

Vibration 2%

Elec Overload 4%

DNstortion 2%

lbratlon/Drift 4%

re/Cracking 2%

Corrosion 22% Contaminatl on 6%

Figure 4.11 Air System Valves-Failure Mechanisms

4-16
6%, electrical overloads (4%), and controller calibration or setpoint drift (4%) are also

significant fractions. The rest of the identifiable failure mechanisms included distortion,

fracture, cracking, and vibration. In about 25% of the reported failures, the mechanism

could not be determined.

Piping-The dominant failure processes in the piping and tubing of the compressed air

systems were erosion and corrosion (30%). Blocking and clogging, vibration, and

overstress made up another 27% of the total. Various other failure mechanisms were

involved in 6% of the failures; 38% could not be positively identified from the data.

Instrumentation-There was some difficulty in identifying the failure mechanisms

from the type of maintenance data available. As a result, there is a large unknown category

(40%) for these components.

The dominant failure mechanism observed was instrumentation and controls calibration or setpoint drift in 33%, followed by contamination in 10% of the events. Other

significant failure processes were overheating or burning (10%), vibration (4%), wear (2%),

and plugging or clogging (1%).

4.3.5 Modes of Failure and Effects

A failure mode is defined to be the effect by which a failure is detected. For a pump,

common failure modes include failure to start or failure to run, while for valves they

include failure to open/close or leakage. The failure modes were identified from the data

since they are useful in assessing surveillance and monitoring methods. Each portion of the

system was analyzed to determine the failure modes and how these modes affect the air

system.

4.3.5.1 Compressed Air Supply Train-Failure Modes and Effects

Compressors-Figure 4.12 shows the distribution of the most typical failure modes

encountered during the review of plant maintenance records, separated for each of the

major compressor types. Recall from Section 4.3.4.1 that reciprocating air compressors

were the most common type of machine in both instrument air and service air systems

during the FSAR review, followed by centrifugal compressors. The rotary-screw type

machine was only used in service air applications in the plants reviewed.

The two most common failure modes, failure to load/unload properly and leaks, were

dominant in all three compressor types. This failure mode typically would cause the

immediate loss of a compressor, but would only result in degraded system operation.

System pressure might be too low or too high, possibly requiring relief valves to operate.

Air cooling might be inadequate, resulting in. higher discharge-air temperature and increased moisture content, thereby increasing the functional loads on the aftercooler/

moisture separator and air dryer. Air leaks could degrade system pressure, and, like

loading/unloading problems, often require a second or third compressor to come on-line to

pick up the slack. Lubricating oil leaks might mean inadequate bearing lubrication or an

increase in oil content in the compressed air; filters would then clog more quickly, dryers

could be damaged, with a greater chance of oil carry-over into the distribution system than

exists.

4-17
FAIL TO LOAD/UNLOAD -

LEAKS . .

TRIPPEDEXCESS VIBRATION

INLET VLV PROBLEM

FAIL TO START

EXCESS TEMP.

FAIL TO STOP

OTHER -z

UNKNOWN - _ ,

0 5 10 15 20 25 30 35 40

Percent of Failures Reported

| RECIPROCATING M CENTRIFUGAL

= ROTARY SCREW

Figure 4.12 Failure Modes by Compressor Type

Several of the other common failure modes involve the immediate loss of the

compressor. These modes are automatic trip of the compressor, and failure to start when

required. Depending on the design configuration of the compressed air system, immediate

loss of the compressor requires starting and loading one or more redundant compressors to

pick up the load. In systems with only one IA compressor, service air would be called upon

to back up the instrument air system.

In addition, failure modes such as excess vibration, high temperature, or low lube-oil

pressure will cause the air compressor to automatically trip or lead to required shutdown.

These failure modes can, therefore, produce a loss of compressor redundancy.

Other failure modes such as inlet valve problems, failure to stop when required, or loss

of intercooler cooling water flow are more likely to result in degraded system operation.

The quality of the compressed air produced will be compromised (in pressure, temperature,

moisture content) rather than causing a complete loss of a compressor.

Aftercoolers/Moisture Separators-Only three failure modes were seen among the

failure data: leaking water (45%), leaking air (33%), and loss of function (22%). Air leaks

simply degrade system pressure by varying amounts. Leaking water and loss of function

decrease or lead to a decrease in the quality of the air, i.e. higher temperature and increased

moisture content.

Air-Receivers-The dominant failure modes occurring in air receivers included leaking air (29%), drain valve stuck or clogged (29%), and excessive water buildup (14%).

Leaking of the drain valve only amounted to 7% of the reported problems with the air

receiver. No tank rupture or complete loss of receiver air were noted.

4-18
These kinds of air-receiver failures would affect the system through gradual loss of

pressure (degraded operation), carry-over of moisture to the filter/dryer train or service air

distribution system, gradual loss of air storage capacity, increased compressor operation

required, and increased functional loading of the air drying equipment.

The failure modes observed are in keeping with the finding that the principle failure

processes involved were corrosion and contamination (Section 4.3.4.1). Since moisture

buildup is inevitable when compressing air, and the aftercooler/moisture separator can only

remove a limited amount of moisture, water and other contaminants will always be present

at the receivers. The only way to minimize problems is to perform regular, periodic maintenance on the automatic drain traps, level instrumentation and controls, and relief valves.

4.3.5.2 Filter Dryer Train-Failure Modes and Effects

Air Dryers-The most dominant failure mode in the dual-tower, regenerative desiccant

dryers was degraded function. This category was further broken down to gain a more

precise knowledge of the situation: degraded function consisted of towers would not

alternate for a regenerative cycle (32%), not drying the air to within the humidity specified

for exit air (23%), and a desiccant bed that would not regenerate (11%). Tower "swapover",

and regeneration problems are often related to the control cycle, however, more often than

not, the four-way solenoid valve (valve VI in Figure A-13) was stuck, leaking, corroded, or

contaminated.

Leaking was the failure mode in 9% of the total reported cases, followed by desiccant

carry-over (6%), moisture carry-over (2%), and short-circuited or grounded (2%).

The immediate effect of these failure modes is the delivery of compressed air to the

instrument air with higher pressure dewpoint than allowed by the design specifications. The

regenerative problems might require the removal of the dryer from service; in plants with

only one dryer, this would be a loss of drying capability for the duration of the outage.

The effect of dryer desiccant carry-over and moisture carry-over to contaminate the

instrument air system. This problem is discussed at length in NUREG 1275 Vol. 2,(4) as

well as in this report. The leakage failure mode results in gradual dropping of system

pressure, gradual reduction of compressed air storage capacity, and increased compressor

operation.

One good way to reduce the observed failure rates is by augmented preventative

maintenance on the four-way valve found in the regenerative dryer and the purge air flow

path.

Pre-filters-As was the case for failure causes and mechanisms, the pre-filters failure

modes depended on the amount of the maintenance received. Leaking was dominant at

most plants. At Plant E, which had a very low PME for pre-filters, the dominant failure

modes were loss of, or severely diminished, air flow and high differential pressure across

the unit, both of which are the result of clogged, dirty filter elements.

Assuming that the problem did not originate from adverse inlet air or some other

peculiarity, increased frequency of filter changeout might have avoided some of the

clogging and blocking failures experienced at Plant E.

4-19
After-filters-The dominant failure mode for after-filters was loss of, or severely

diminished, airflow in over 30% of the reported failures. Leaking was the next most

common failure mode, occurring in over 15% of the events. Loss of, or severely diminished, airflow was the dominant failure mode at Plant E in over 65% of the after-filter

problems, probably due to the preventative maintenance problems with the filters and

dryers, as discussed previously.

4.3.5.3 Air Distribution System-Failure Modes and Effects

Valves-The dominant failure mode for air system valve failures was failed to open/

close, in just over 40% of the reported cases. Of these, about 40% involved manually

operated valves, and the rest, power-operated valves. Seat leaking was the next most

common failure mode, observed in over 37% of the events. Leakage from packing, gaskets,

or valve body cracks constituted another 13% of the identifiable failures.

The effect of failure to open/close for an air system valve is most critical in the case of

containment isolation valves. Failure to isolate is a reportable event. The OSRR study(5 )

showed that "islolation valves" or "containment isolation valves" were mentioned in over

30% of the events in their data base, based on IA/SA LER's. Many of these events

however, may have involved human, administrative, and procedural errors.

Another critical valve in the compressed air system is the pressure control valve crosstie between the instrument air and service air systems. In a Type I air system (refer Section

2), this valve isolates the service air system when the instrument air header pressure drops

below a design setpoint due to loss of compressors, catastrophic loss of pressure, or excess

IA demand. In the Type II system, low IA pressure causes the valve to open so that the SA

compressors can backup the IA compressors to maintain system pressure. Failure of the

crosstie valve to operate can seriously effect the ability of the system to supply compressed

air to the IA system. This situation is investigated in more detail in Section 5.

Seat leaking is also a problem for overall system aging. Considering that there can be

over 700 SA valves and 250 IA valves in a typical system, the cumulative effect of just

minor leakage past the seats of an increasing number of these valves can be large. The

reserve capacity of the system, or the time to lose pressure upon loss of air compressors

will be reduced, and degrade further as the air system valves age. The demand on the

compressors will, therefore, increase as the system ages, to offset the air pressure continuously lost through leakage. Since compressors age on an operating time basis, and they also

decrease in efficiency with time, system leakage, if unchecked, will accelerate the aging

process of the compressor as well.

Piping-The dominant failure modes encountered in the review of compressed air

system piping and tubing were plugged lines (25%), piping cracked (22%), and joints

leaking (16%). Other significant failure modes were components missing (19%) and

supports missing (6%).

Cracked piping and leaking joints could affect the system by causing a loss of

compressed air, as discussed in the previous section on valve-seat leaking. Pipe cracking

could also fail more catastrophically, resulting in a rapid loss of pressure in part or all of

the system. Plugged lines can cause a diminished or complete loss of compressed air to

critical air-operated components.

4-20
Instrumentation-The distribution of failure modes for the compressed air system

instrumentation and controls is illustrated in Figure 4.13: the dominant failure modes are

incorrect signal, loss of function, and loss of signal.

The effects of incorrect signal are erroneous indications, alarms or automatic actions.

Some important system parameters which might be affected are system header pressure,

dryer discharge humidity and temperature, compressor discharge temperature, heat exchanger inlet and outlet temperatures, and lubricating oil temperature, level, and pressure.

As discussed in the earlier section on valves, the IA to SA crosstie valve is a critical

component which is controlled by air pressure instrumentation.

4.4 System Level Effects

Failures that occur on the component level can also affect other parts of the system as

well. The loss of one component will rarely result in the loss of the entire air system,

because redundancy is designed into most systems to avoid such an occurrence. The effects

of redundancy are examined in more detail in Section 5.

There were no losses reported of either the entire instrument air system pressure or

service air system pressure in the maintenance records of the six nuclear plants, covering

over 36 years of system operation. A more accurate barometer of system level effects, such

as total loss of system pressure is the data base developed for the OSRR study,(5) since it

covers more plants, for a longer period, and is more system oriented than the plant

maintenance data. For those cases where the system status could be determined as a result

of an event, the OSRR study reported that only about 6% of the total LER's involving

instrument air involved a total loss of system pressure.

When a significant problem occurs in the compressed air system, in most cases, it

manifests itself as some form of degraded operation. In the majority of the failure events

affecting the air system as a whole, this means operation at a pressure below normal in all

Incorrect Signal 41%

Loss of Function 18%

... ~Other 9%

Failed Downscale 1%

Loss of Signal 13% Failed As-is 5%

Failed Upscale 9%

Figure 4-13 Air System Instrumentation-Failure Modes

4-21
or portions of the system. However, there were occasionally problems with components

being exposed to higher than design pressure, such as is described in NRC Information

Notice No. 88-24. A separate study is being conducted to investigate the problems of

overpressure.

The plant maintenance data on instrument and service air were analyzed for effect on

the compressed air system. Figure 4.14 illustrates the breakdown of system effects for the

two most critical components in the system. Loss of compressor, or loss of redundancy of

compressed air source, occurs in about 14% of the failures. (The distribution is nearly

identical for IA or SA compressors.) Degraded air pressure or quality is a significant factor,

resulting from approximately one third of all the air compressor failures. About half of the

compressor failures are classified as incipient failures, that is, no immediate loss of a

compressor or degraded system pressure has occurred; however, if left unchecked, degraded operation or loss of the component could take place.

Nearly half of the failures of dryers resulted in either degradation of instrument air

system pressure or decreased quality of instrument air. Since almost half of the sites

surveyed in the FSAR review had only one dryer or less allocated to each nuclear unit, loss

of a dryer or its malfunctioning can often lead to moisture contaminating an instrument air

system.

The OSRR study(S) also found that degraded system operation was more likely to

occur than a complete loss of pressure. They found that a partial loss of air system pressure

was involved in about 40% of the IA-related LER's. In nearly half of the incidents, IA

system function was maintained. Other factors, such as contamination at the point of use,

apparently were a large part of the problem.

To investigate this factor further, we reviewed the LER events in the OSRR data base

to see which systems supplied by compressed air were affected, and how they were

affected. Systems outside the boundaries of the study were included for completeness. The

results of the review are given in Table 4.1.

LOSS OF

LOSS OF DRYER 11%

COMPRESSOR 14%

DEGRADED

DEGRADED ~~~~~~~~PRESS/QUAL 49%

FAILURES 53% FAILURES 40%

COMPRESSORS AIR DRYERS

Figure 4-14 Effects of Component Failures

4-22
t4~

wh

Table 4-1 Air System Components Failures and Systems Affected by These Failures

(Source: OSRR Study's LER Data Base)

Systems Affected (Number of Events Reported)

Main Rx Cavity RHR Service PORV RCP Seals Fuel

Air System Steam or Auxiliary Containment BWR or SFP or S/D Safety Water or or Rx Cool. Pool

Component IA Feedwater Feedwater Isolation Scram Seal Cooling EDG Injection CCW LTOP ant Level Level Other

Compressor 23 22 0 0 0 0 1 0 0 0 0 0 0 0 0

Dryers 11 10 0 1 0 0 0 0 0 0 0 0 0 0 0

Filters 3 2 0 0 1 0 0 0 0 0 0 0 0 0 0

Check Valves 19 6 0 2 2 0 1 0 0 0 0 0 0 0 8

AOV's 84 14 7 3 37 0 2 4 0 2 1 1 0 0 13

SOV's 30 2 3 1 11 5 0 2 0 0 0 0 0 0 6

Accumulators 14 4 1 1 0 5 0 0 0 2 0 0 0 0 1

Seals 7 1 0 0 0 0 4 0 0 0 1 0 0 0 1

Transmitters 3 0 1 0 0 0 0 0 0 0 0 0 0 0 2

Piping 29 6 0 1 20 0 0 0 1 0 0 0 0 0 1

Others 81 17 8 8 9 0 1 0 6 0 0 0 0 0 32

Total 84 20 17 80 10 9 6 7 4 2 1 0 0 64
4.4.1 IA/SA System Effects on AOV's & SOV's

The table shows that the pneumatic components whose failures have the greatest

impact on systems interfacing with instrument air are: air operated valves, solenoid

operated valves, air system piping, check valves, and accumulators. Since AOV's are the

most troublesome component in the link between IA and outside systems, and pneumatic/

diaphragm valve operators are a reportable component on NPRDS, the failures of this type

of valve operator were examined, even though they lie outside the bounds of this study.

At the time of the investigation (7/11/88) there were 16,152 pneumatic valve operators

in the NPRDS data base, of which 4,595 failures had been reported from I/l/80 through

7/11/88. The failure mechanisms and numbers of each are similar to those found for air

system valves in the plant maintenance data (Figure 4.11). Wear was the dominant

mechanism, cited in about 30% of the cases. Also significant were: mechanical damage/

adjustment problems (30%), aging/cyclic fatigue (14%), contamination (12%), electrical/

overload problems (7%), and setpoint/calibration drift (6%). Corrosion was indicated in

slightly more than 1% of the pneumatic valve operator cases, compared to 22% of the total

failures in the air system valves. NPRDS showed that human errors contributed to about

21% of the failures.

A similar investigation was made for solenoid operated valves on NPRDS. The data

base was searched through 7/14/88 for pilot activated, AC or DC operated, solenoid valve

operators, excluding the emergency diesel generator starting air system. Only 59 failure

events were reported; clearly, this particular search was not comprehensive. Nevertheless,

the data were analyzed to determine whether any of the failures could be traced back to the

IA system. The dominant SOV failure mechanisms were found to be mechanical

adjustment/setpoint drift (19%), wear (17%), electrical/overload/ground problems (15%),

and vibration/cyclic fatigue (12%). In this NPRDS search, SOV failures were due to dirt/

contamination, deterioration, sticking/binding, or blocking/clogging in only 11% of the

cases, and corrosion was cited as the mechanism in only 6% of the cases.

Table 4.1 shows that AOV's and SOV's accounted for over 37% of the LER's

attributed to the IA system. The above NPRDS analyses show that contaminants originating

in LA supply system, the subject of this study, might be responsible for as many as one in

five of the AOV and SOV failures. This conclusion is based on the assumption that failure

mechanisms, such as corrosion, contamination, blocking/clogging, sticking/binding, and

deterioration, are caused by IA contaminants.

4.4.2 Major Systems Affected by IA/SA Failures

Table 4.1 shows that aside from the IA system itself, the major systems/subsystems

affected by IA-related LER events are: containment isolation (26%), main steam and main

feedwater (7%), auxiliary feedwater (6%), and the BWR scram system (3%). A few of the

systems were selected for further investigation via the NPRDS data base.

For example, all pneumatic valve operator failures associated with the main steam

system from 1/1/80 through 7/11/88 were reviewed. Of the 991 failures in this category,

only 45 could definitely be attributed to a cause originating within the IA system

boundaries of this study.

4-24
Emergency Feedwater or Auxiliary Feedwater searches yielded 179 reported events

from 1/1/80 through 7/11/88, of which thirteen were attributable to the IA system. A total

of 595 main feedwater system failure events from 1/1/80 through 7/11/88 were reviewed;

79 of these originated from an IA system problem. Of 603 containment isloation events

reported between 1/1/80 and 5/18/89, 58 were attributable to the IA system. For BWR

RHR/LPCI systems, 5 out of 51 events up through 10/29/87 originated within IA. For PWR

decay-heat removal, safety injection, low pressure safety injection, residual heat removal,

or shutdown cooling systems, 18 events of 127 occurring up through 8/3/88 were attributed

to problems with the IA system.

From this review of affected systems, we conclude that the majority of the pneumatic

valve operator problems do not originate from IA-related problems. While some IA

contamination problems do exist, and do cause problems, most AOV and pilot-activated

SOV failures result from locally generated causes and failure mechanisms.

4.5 Time-Dependent Failure Rates

For comparisons with commonly used values, plots of time-dependent failure rates

were developed for the most critical compressed air components: compressors, air dryers,

and system valves. Ideally, the best way to obtain data for this purpose is by recording in

detail the entire maintenance history of the component from initial service to retirement,

and then amassing such data for as large a population as possible to increase the confidence

value of the results. The component failure rate at each plant may vary significantly

because this parameter is sensitive to so many plant-specific details. The effectiveness of

the preventative maintenance program, for example, will vary from plant to plant, or even

from year to year (that is, affected by a plant's budgets, management, labor situation,

personnel training and experience, and personnel turn-over) at any given plant, thereby

directly effecting failure rate. Design configuration, operating procedure, environment,

status of the plant, and other variables will affect the component failure rate from plant to

plant, and from year to year.

Practically, however, such comprehensive data is unavailable, particularly for

nonsafety systems such as instrument air. As discussed previously, NPRDS, which is a

component-level data base, was of no use for conducting any instrument air studies since it

is not one of the standard reported systems. Again, the most useful source of information

was the maintenance records from the six nuclear units.

The failure data from the plant maintenance records were used, together with actual or

estimated weighted operating hours to calculate failure rates as a function of age for each

of the six plants. It should be recognized that only those failures originating within the air

system, and affecting the air system are reflected in this type of maintenance data. For

example, loss of normal plant AC power would drop those air compressors or dryers

powered from that bus, but this would not show up as a failure of the compressor to

operate. That failure would show up in maintenance records for the normal AC power

system or whatever system in which the failLre originated. Also the variations in individual

plant parameters, might result in some scatter among the failure rates when looking at the

relatively small sample populations.

4-25
4.5.1 Air Compressor Failure Rates

The most commonly used type of air compressor was the reciprocating piston unit

(Section 4.3.4.1). The annual failure rates calculated for the reciprocating air compressors

are plotted on Figure 4.15. This plot contains the failure rates of 18 compressors,

representing over 104 years of service time. Since this is still a small sample size, some

variations were seen as expected.

The young plants (Plants E & F) have a fairly well grouped series of failure rates for

the first several years of service. Both of these plants had high overall PME for their

compressed air systems, but for compressors in particular. Plant E was over 0.76 and Plant

F was over 0.73. These ratios are indicative of a good preventative maintenance program.

There is no noticeable evidence of "break-in" or "learning curve" failures early in the

system life.

Plant D, a slightly older system, shows a higher failure rate. Insufficient information

was available to calculate a PME for this plant, so the effectiveness of preventative

maintenance could not be compared. However, it was noted that this plant has a Type II

compressed air system, with three large capacity IA compressors backed up by three large

capacity SA compressors. With this amount of redundancy, this plant can afford to allocate

their preventative maintenance resources elsewhere, while perhaps experiencing a slightly

higher rate of compressor problems.

In contrast, Plant A, is an older system, with a Type II configuration with only one IA

compressor and only one SA compressor for backup. Consequently, with such a low level

of redundancy, this plant cannot afford to tolerate a large number of compressor failures. In

Failure Rate (xlOE-4) per Hour

40 - ° o

30

20 -a

10 x I - . ...- * .......... ox ~ Xx X X + +

0 x

0

0 5 10 15 20

Age (Years)

I Plant A + Plant B 0 Plant D x Plant E ° Plant F

Figure 4.15 Failure Rates for Reciprocating Air Compressors

4-26
fact, this plant had nearly the highest PME (0.80) for compressed air systems of all the six

plants, indicating that their preventative maintenance program is well matched to the

requirements imposed by the design configuration of the plant's compressed air system.

Figures 4.16 and 4.17, illustrate the failure rates for instrument air compressors and

service air compressors, respectively. All machines are reciprocating compressors except

where otherwise noted; as the figures show, the type of the compressor does not seem to

affect the failure rates found in this six-plant sample. This finding might indicate that the

type of machine has less to do with the failure rate than other factors, such as preventative

maintenance, cumulative operating time, system configuration, or operating procedures.

The plot is based on 14 instrument air compressors covering over 61 years of service.

The plot of service air represents 10 machines with nearly 43 years of service. These

samples are small, representing just six nuclear units, so no definite conclusions can be

arrived at from this information. The order of magnitude of compressor failure rates can be

seen, along with some upper and lower limits on the increase in failure rate as the system

ages.

4.5.2 Filter/Dryer Train Failure Rates

To provide a realistic evaluation of the failure rate of the filter/dryer train as a unit, we

combined the failure data for four plants in which all these components were reported

(Figure 4.18).

The discussions on the effects of component redundancy on the allocation of preventative maintenance resources given in Section 4.5.1 on compressors, are also applicable to

the filter/dryer train. Plant C had a single filter unit with parallel pre- and after-filters.

Some scatter of data occurred due to "break-in" failures, and another group of dryer

maintenance problems which developed during the fifth and sixth years; aside from these,

the equipment exhibited a relatively low failure rate during its first eight years of service.

Among the older plants, all experienced higher failure rates over time. Plant D, which

has four redundant filter/dryer trains, showed the earliest increase. Because of the redundancy, Plant D can tolerate filter/dryer train problems more readily than Plant A, for

example, which has a single train.

Aside from Plants E and F, pre- and after-filters had relatively few failures, and these

were closely tied to intervals between preventative maintenance and to dryer problems. To

isolate the failure rates of the dryers, the data for this component alone were plotted on

Figure 4.19.

The figure shows a high failure rate for dryers at both Plant E and F. As discussed in

Section 4.3, these plants appeared to have less effective preventative maintenance on their

dryers as indicated by PME of .45 and .53, respectively. Preventative maintenance appears

to have a significant effect on availability performance of dryers. However, this is a small

group of plants, so no definite conclusions should be made.

Aside from these two plants, the plot of dryer failure rate derived from the seven

dryers at the remaining four plants seems fairly flat, or linear with a very small positive

slope. This shape is consistent with the dominant mechanisms of dryer failure (Ref. Section

4.3.4.2) that were noted in this study. It should be recalled that all of the dryers in the

4-27
Failure Rate (xlOE-4) per Hour

la( I .

30 - - ------ .- .

20

10

--- *- -- --------

x

0

x *

0

c3

a1

--- --- x........ ..

---- x - - - - - - - - - - -

I 1 ,

0 5 10

Age (Years)

15 20

. Plant A + Plant B * Plant C (Centrif.)

° Plant D x Plant E ° Plant F

Figure 4.16 Failure Rates for Instrument Air Compressors

Failure Rate (xlOE-4) per Hour _ _

,]n _

20

15

10

5

a +

x x o

x o x

0 x + I

o x- . .x .

0, 0

.....

0 I l

0 5 10 15 20

Age (Years)

* Plant A + Plant B D Plant D (Rotry Scrw)

x Plant E 0 Plant F

Figure 4.17 Failure Rates for Service Air Compressors

4-28
Failure Rate (xlOE-4) per Hour

12

10

0 5 10 15

Age (Years)

I Plant A + Plant B * Plant C 3 Plant D

20

Figure 4-18 Failure Rates for Filter/Dryer Train

Failure Rate (xlOE-4) per Hour

25 30~~~

20 _ x

15 _ ____ _ _ x x

10 _ * __ a 

x * 0 * *

6 ---- +

n

0 5 10

Age (Years)

15 20

* Plant A + Plant B * Plant C

3 Plant D x Plant E ° Plant F

Figure 4.19 Failure Rates for Dryers

4-29
group studied in detail were dual-tower desiccant type. No data were available on other

types of dryers.

4.5.3 Air System Valves

The numbers of compressed air system valves were either counted or estimated for

four of the plants for which detailed failure information was available. This information

was then used, along with the valve maintenance records, to plot failures per valve versus

time (Figure 4.20).

A fairly linear grouping of points is shown on Figure 4.20, with a gradual positive

slope over time for the first twelve years. A slightly greater slope seems to occur after that

time, which is consistent with the dominant aging mechanisms for valves discussed in

Section 4.3.4.3. Two outlying points for Plant C in year three and four were investigated to

resolve this anomaly. They may have been the combined result of a physical inspection

program, the initial testing of local leak rates, and an accumulation of moisture and

corrosion products in the lines, as indicated by maintenance records for that period. The

plant now conducts weekly preventative maintenance surveillances to blowdown major

service air headers to remove moisture and other accumulations.

4.6 Summary of Data Analysis Findings

The review and analysis of the past operating experience and failure data for compressed air systems have yielded a great deal of information on the aging of these systems.

The following salient points emerged from our analysis:

5

4

3

2

1

0

Failures Per Valve (xlOE-2)

0 5 10 15 20

Age (Years)

I * Plant A + Plant B * Plant C ° Plant D

Figure 4-20 Failure Rates for IA/SA Distribution System Valves

4-30
* At the system level, aging fractions ranged from 68% for newer plants to 89% for older

units based upon plant maintenance records. This result shows that aging degradation

occurs in the compressed air system, and becomes an increasing factor as the system

ages. This aging fraction is consistent with findings from LER data,(5) and is supported

by the PRA-based analyses discussed in Section 5.

* Since the systems are continuously operating, detection of problems relies on accurate,

timely monitoring of functional indicators. However, as a non-safety system, the control

room indication and annunciation are minimal, so local monitoring and inspections, and

walkdowns of the main components is important for detection of failures.

* The air system components experiencing the largest percentage of total reported failures

for compressed air systems were: compressors, air system valves, dryers, and filters.

Given good preventative maintenance and proper functioning of other components such

as dryers, automatic drain traps, and moisture separators, filters would not be a significant problem, even though the maintenance data suggested they were troublesome.

* The wide ranges seen in the percentage of total failures exhibited by compressors, air

dryers, and filters at the six plants, indicate that effectiveness of a plant's preventative

maintenance practices for any given component will directly effect the number of

failures experienced.

* Compressor failures were caused by normal service 85% of the time, with wear as the

dominant failure mechanism in the positive displacement machines. There were some

variations among the failure mechanisms for different machines and applications. The

most common modes of failure were degraded operation due to failure to load/unload

properly and leakage.

* Failures of dual-tower desiccant-type air dryers resulted from normal service between

75% and 85% of the time, with human error as the second most imporant cause. The

dominant failure mechanisms of blocking/clogging, corrosion, deterioration, and contamination led to degraded function in two-thirds of all reported failures.

* Compressor trips and failures to start only occurred in about 14% of the plant specific

events. The effect on the system was simply a loss of redundancy/degraded capacity.

This feature is investigated further in the PRA-based studies in Section 5.

* Loss of dryer events occurred only 11% of the time. However, this could be a more

serious problem than the loss of a compressor, because about half of the plants included

in the FSAR review had only one air dryer or less allocated to each nuclear unit.

* Outside of the Instrument Air system, the systems most often affected during IA-related

LER events were containment isolation, main feedwater/main steam, auxiliary feedwater

and the BWR scram system. About 10% of the AOV failures on these systems reported

to NPRDS could be attributed to IA system problems.

* The most commonly affected components during IA-related LER events are AOV's and

SOV's. NPRDS also showed failures of these components to be common, and as many as

one in five of the failures might be the result of contaminants in the IA system. This

4-31
finding indicates that improvements to IA quality may reduce problems in systems that

use compressed air for pneumatic valve operators.

* Finally, failure rates were calculated as a function of age for several components. In

general, failure rates increased with component age. This result is significant since it

shows that system unavailability will increase as the plant ages, a fact which is not

modeled by current PRA analyses.

Two models were constructed from the failure-rate curves for use in the PRAAGE

computer code. The results, showing the effect of aging on system unavailability, are

discussed in Section 5 of this report.

4-32
5. SYSTEM UNAVAILABILITY WITH AGE

The purpose of this study was to examine how the time-dependent effects of aging are

reflected in predicting system unavailability and its contributing components. This section

describes the methodology used, the results of some parametric studies on variations in

system design and in component aging rates, and the limitations of this approach. The

model for probabilistic risk analysis (PRA) used for this evaluation was based on one

specific plant model and, therefore, reflects the analytical assumptions made in developing

the event tree /fault tree logics. The results present some insights into the problems

associated with the design of compressed air systems and plant experiences in the operation

of these systems.

Operating experience with compressed air systems revealed that there were very few

events in which a plant had lost its total air supply capability to safety-related instruments

and controls: partial loss of air system and/or degraded system operation were the most

predominant modes. Several cases had led to reactor scrams and some had introduced

transients into the safety systems they serve. They were attributed to loss of air pressure

and flow due to leaks through pipe joints, fittings, seals, gaskets, and also clogging/

blocking of filters. The other dominant mode was the contamination of the air by airborne

dirt and dust, the burning of oil releasing hydrocarbons, high humidity, and the passage of

desiccant, dust, and other particulates through the filters. The PRA model does not consider

these effects explicitly. However, contributing components are included for evaluating their

effects on the overall unavailability of the system.

There is a large variation in the design configurations of compressed air systems.

Although it is difficult to study the effects of all these different designs using one particular

plant-specific PRA model, we attempted to simulate the loss of certain components within

the system to quantify their relative importances in maintaining the system availability to

the safety-related instruments and controls.

Not all nuclear plants have a fully-developed PRA, and those who have completed one

did not necessarily consider compressed air systems. This lack is primarily due to the fact

that the system's failure is assumed not to be one of the initiating events. A nuclear plant

PRA that considered a Type II compressed air system configuration (as defined in Section

2) in its PRA model was selected for IA unavailability parametric studies.

5.1 System Description

The modeled compressed air system is designed to supply high-quality pressurized air

to the air-operated equipment in the turbine and auxiliary buildings. The system is shared

by the three nuclear units and is divided into two subsystems: the instrument air train, and

the service air train. The system basically consists of air compressors to pressurize the air,

receivers to store the air, and dryers and filters to reduce the moisture, oil, and particulate

content. Figure 5-1 is a simplified schematic of the entire compressed air system at the

plant. Functionally, the service air train also serves as the backup to the instrument air

system train.

The system operates at all times and controls numerous air-operated valves, instruments, switches, and positioners. On loss of air pressure, components are designed to fail to

5-1
IINSTRUMENT AIR TRAIN

Air LPSW

cooling

After-

. w cooler 6"

ItA

Figure 5-1 lIstrument Air System and Backup in PRA Model
predetermined states and positions, and the operator initiates a reactor trip manually. With

the components in the failed state, emergency procedures prescribe the actions the operators must take to maintain stable reactor shutdown until air pressure is restored.

Three normally operating IA compressors maintain air pressure at 85 to 100 psig. Two

electric motor-powered compressors operate in the base mode, with periodic cycling, to

regulate the air pressure at 95 psig. The third compressor operates in standby to maintain a

pressure of 90 psig, which is below the normal pressure, so the third compressor does not

normally operate.

The instrument air is supplied by three electric motor-driven compressors (A, B, and

C) through 8-inch lines. The compressors use three air intakes and silencers. Each

compressor motor is powered by a separate 600 volt motor control center which, in turn, is

powered by Unit 1 and 2 electrical power buses. The compressors are cooled by the

recirculating cooling water system, with flow being automatically started by the opening of

a solenoid valve when the compressor is started. Each compressor is rated for 465 scfm @

100 psig with overpressure prevention by a safety valve. The compressors are crossconnected by valves IA-7, 8. The compressors may be isolated by valves IA-4, 5, 6.

Air discharged from the compressors is cooled by two after-coolers with heat being

transferred to the low pressure service water (LPSW). The outlet air flow may be crossconnected through valves IA-18, 19, 20, 25 and 29 to three air receivers, each 302 cu. ft. A

three-inch line carries the air to 4 cross-connected air-dryers located in the turbine

maintenance area. The air is dried by electrically-powered chillers, which may be isolated

by manual valves IA-36, 37; 38, 39; 40, 41; 42, 43. Backpressure regulator valves prevent a

line being used when the pressure drops below 85 psig.

Besides the pressure relief valves connected to the air receivers, redundant controls

consisting of three pressure switches, sense the air pressure at the outlets of air receivers A

and C, and trip between 85 and 95 psig. These switches are part of the compressor controls

which allow the mode selection of the compressor, i.e. base or standby.

The instrument air system, consisting of compressors, air receivers and dryers (essentially the upper half of Figure 5-1), is located in the turbine building basement between

Units 1 and 2.

The IA supply is through three headers (M, H, and D) which are cross-connected in

various places and run the length of all units. Air-operated components in the turbine

building have supply lines that connect to these headers. From the M header, three 2-inch

lines for each unit lead to the auxiliary building header. This feature isolates the supply of

the Unit 3 auxiliary building from other units on this header by closed manual valves, and

from the turbine building header by check valves. A large accumulator is connected to the

Unit 3 portion of the auxiliary building header.

The IA system is backed up by the service air (SA) system which provides compressed

air for miscellaneous uses. The air-operated valve, IA-2324, connects the SA system to the

IA system when the air pressure drops below 87 psig. This valve may be bypassed by valve

IA-2326 or isolated by manual valves IA-2323, 2325. The SA is provided by two electric

motor-powered compressors, each with a capacity of about 1.5 times a single IA compressor. Power for each compressor and its controller is supplied by separate Unit 3, 600 volt

5-3
motor control centers. These compressors are located in the Unit 3 turbine building. An

additional, portable compressor, powered by a diesel engine, is located near the other SA

compressors. It is started by battery, and manually connected by flexible hose to the SA

lines as shown in the figure. It must be started, operated, and connected locally.

5.1.1 Support Requirements

The IA system requires several support systems: recirculating cooling water (RCW),

low-pressure service water (LPSW), and AC electrical power. The RCW cools the three IA

compressors and for the two electric SA compressors. LPSW is required only for the

aftercoolers. Electric power is necessary for all IA, and two of three SA compressors as

well as the IA dryers. Each compressor is connected to a different 600-volt motor control

center. All of the IA compressors receive their power from Unit 1 or 2 buses, but the SA

compressors are powered from Unit 3. Power for IA control is supplied by a separate Unit 1

bus; power for the SA control is from the same source as the power for the compressor. In

accordance with the emergency procedures, on loss of the 230 kV substation and a manual

trip of Unit 3, all IA and SA compressors are shed from the load to be manually restarted

when normal power is restored.

5.2 Success Criteria

In all accident sequences, except those involving loss of instrument air as the initiator,

the compressed air system supports other systems. The criterion of its success is an

adequate supply of compressed air for these functions.

Depending on the cause of loss of IA, there is an interval between the failure and the

time when system pressure falls below adequate levels. In determining failure probabilities,

10 minutes is allowed for human backup actions (backup compressors, valve realignment,

leak isolation). Once adequate air pressure is lost, total loss of system function is assumed.

In cases where loss of IA is the initiating event, the criterion is the same as that for a

loss of the IA system during another accident sequence, i.e. failure of adequate compressed

air for more than 10 minutes.

5.3 System Unavailability Analysis

5.3.1 Fault Tree Model

The fault tree model and quantification data for the modeled IA system is based upon a

complex system of eight distinct fault trees; moreover, fault tree preparation is deceptive in

that these trees contain branch points connecting with additional fault trees. Furthermore,

the evaluation of the fault tree requires branches to the AC and DC electric power- and

service water-fault trees. Figure 5-2 shows the top of the instrument air fault tree from

which the detailed nature of the model may be judged. Because of the extensiveness of the

model, only the top of the fault tree is shown for illustration. For a detailed discussion of its

development, or additional information on the model, recourse must be made to NSAC60,( 1) the source document.

Assumptions made in preparing the fault trees are based on the fact that the compressed air system serves all three nuclear units at the site which have varying demands and

requirements. On the basis of operating experience, these assumptions are:

5-4
AeAft M RIAFOM

tA

AZAPILF R1APILIOF

AIPI4CRWT AIN4MIWT Ton

FSRCPOF ASKM MRCPOH MaSsVVH

Figure 5.2 Top of the Instrument Air System Fault Tree
* All three IA compressors or an equivalent capacity are necessary. Equivalent

combinations are three IA compressors, or any two SA compressors, or two IA

compressors and one SA compressor.

* The operation of the aftercoolers and dryers is not explicitly modeled.

* Contamination by moisture in the system is considered to be a failure mode.

* The check valves between the turbine building headers and the auxiliary building

headers and the air receivers on each auxiliary header are assumed to ineffectively

isolate the auxiliary building supplies.

The fault tree model of the plant instrument air system is given in NSAC-60 along

with the failure rate data base. These were analyzed, using the SETS code (Worrell,

1984).(2) The cutsets from this analysis and the plant failure-rate data for all systems were

used for our study and were processed in the IBM-PC interactive code PRAAGE-IA, which

was adapted specifically for this work from the PRAAGE-1988 set of codes (Lofaro,

1989)(9) used for aging analysis. This latter work provides a base-case, non-aging reliability

analysis of the reference system. Having established the basecase, the aging data from the

plant experience is introduced into PRAAGE-IA to obtain the estimated effects of aging on

the reliability of the instrument air system.

5.4 Development of PRAAGE-lA Model

Using information from the original plant PRA cutsets and data files, the PRAAGE-IA

model was developed, representing the compressed air system for the supply of IA to Unit

3. The model consists of all 604 single-, double-, and triple-order cutsets, involving 57

components. The program has 6 single-, 56 double-, and 542 triple-order cutsets covering

hardware failures, human errors, and maintenance events. It also includes the interfacing

systems such as the recirculating cooling-water (RCW) system, AC electrical power, and

low-pressure service water for the aftercoolers. The two initiating events are loss of IA and

recovery of compressed air systems. In the original PRA, the recovery of air pressure to the

IA system was not considered in the system analysis. Each cutset was evaluated individually to determine whether recovery of air pressure was possible, whether such recovery

would prevent core melt, and what time was available to prevent the melt. The loss of

instrument air as one of the transient initiators was considered for the transient event tree.

For this study, these two single cutsets were set to a low probability (1.0 E-8) since our

purpose is to focus on the effects of hardware degradations.

The other four single cutsets are: RCW pipe rupture, blockage of two or more air

dryers, blockage of one or more air receivers, and IA system contamination. Since the top

level event is "inadequate air pressure for the Unit 3 IA supply," the effects of these single

cutsets are significant in calculating the overall system unavailability. The failure probabilities used in the original PRA analysis were small, except for the inadvertent contamination

of the IA system with condensed water or oil. For electrical power support to compressor

motors, the original PRA failure probabilities were used. Since these did not constitute any

single-order cutset, their effects on the overall system unavailability were considered small.

Since the system is normally running for 24 hours, it is highly reliable. The dominant

cutsets discussed above, inadvertent contamination and the rupture of a major IA pipe that

5-6
cannot be repaired within 10 minutes, contribute to the system unavailability on the order

of 4.0 x 10 4 and 2.0 x 104, respectively. Both of these failure events nullify the

effectiveness of the SA system as a backup source of compressed air.

The unavailability of one air receiver in the IA supply train will be caused by one

isolation valve transferring closed. We assumed that one supply line to the air receiver

could not adequately handle the demands on the system, regardless of the availabilitr of

compressor capacity. The probability of this condition was estimated at 1.1 x 10- .

The last single-event cutset relates to the dryer/filter train. Although there are four

parallel dryer/filter trains in this compressed air design, the PRA model considers that these

trains are very reliable (vanishingly small probability of failure), and also includes them as

a single event if 2 out of 4 air dryer trains are not available (i.e. 2 out of 4 isolation valves

closed). This study avoids the difficulty of assessing the effects of hardware degradation

within the dryer/filter assembly by modelling in the aging effects of this subassembly

directly as system unavailability.

Out of the 56 double-event cutsets, three are related'to manual valves, one to IA leaks,

and the remaining 52 are associated with blockage and leakage of various components

within the system.

5.5 IA System Unavailability

The top event is inadequate air pressure for IA supply, termed as IA system unavailability. Its calculation is based on all the possible events that might cause the system to be

unavailable, as described in the previous subsections. Another calculation prioritizes

primary components based on their contributions to the system unavailability. Since our

prime purpose is to understand the aging effects of various components on the system

performance, the absolute value of the system unavailability is of secondary importance.

Studying the change in this parameter relative to the base case, however, can provide

insights into the effects of component degradation due to age.

5.5.1 Base Case Analysis

In evaluating the base case, the PRAAGE-IA computer program was first run with all

the failure probability values taken from the NSAC-60 for the plant PRA for compressed

air systems. The system unavailability calculated was dominated by the two initiating

events, loss of IA, and recovery of compressed air system. As discussed earlier, these two

initiators were then set to 1.0 E-8 to suppress their effects, and all other failure probability

data for 55 events were used to calculate the base case. The system unavailability for this

case was 7.1 x 10e. Table 5-1 gives the percentage contribution from various contributors.

The two dominant contributors to overall system unavailability are leaks and pipes,

followed by the service water to aftercoolers. Leaks include random failures resulting in air

leaking from the IA piping and fittings, those IA leaks that can not be detected in 10

minutes, and random leakages through the SA piping and fittings. The pipes include the

recirculating cooling water (RCW) supply pipes, blockages in SA pipes and valves, and

inadvertent contamination of the IA system by condensed water or oil. Finally, the low

pressure service water (LPSW) to aftercoolers is the contributing event. Both events

involving cooling water supply (i.e. RCW cooling to compressors and LPSW cooling to

5-7
Table 5-1 Base Case Contribution to System Unavailability

Components I Events Percentage of Contribution

Leaks 43.0

Pipe 38.0

Service Water to Aftercoolers 4.9

SA Compressor-Diesel Driven 2.6

IA Compressors 2.4

Maintenance 2.4

SA Compressors-Motor Driven 1.9

Others (valves, receivers, dryers) 4.8

100.0

aftercoolers) are considered to be support system for the compressed air system and hence,

are not part of the considerations of IA system reliability. The other events relating to

leaks, blocks and contaminations are recognized as the leading causes of IA system

problems, most of which are attributed to the aging of various components within the

system.

Therefore, our remaining studies are devoted to understanding the effects of the two

high probability events: the unavailability of one IA compressor, and the unavailiability of

the entire SA system for backup. The unavailability of an IA compressor would result from

compressor failure, compressor maintenance, loss of electric power, or the failure of a

solenoid valve to provide cooling water. The unavailability of the SA system is dominated

by a major leakage or rupture of the system, and by transfer of valves in the SA system to

block flow to the IA system. However, the failures of the IA compressor are dominated by

mechanical failures. The data on operating experience (see Section 4) was used to develop

the time-dependent failure rates for these compressors, and these values were used to

characterize system unavailability as the plant ages. The unavailability of SA system was

simulated either by the SA compressor failures or by the failure of the IA/SA interconnecting manual valves.

5.5.2 System Aging Analysis

As plants age, the systems subjected to normal and abnormal operational and environmental stresses become vulnerable to higher frequency of failure. This deterioration in the

system availability is typically caused by the aging of components. Hence, a true aging

analysis should consider the time-dependent failure rates for all the components contributing to a system's successful operation. These data were not available for all of the

individual components of the compressed air system because of limitations in sources of

operating experience data discussed in Section 4. The only two components with comprehensive aging data were reciprocating compressors and filter/dryer trains.

Even for compressors and filter/dryer trains more extensive data on operating experience would have been desirable. Ther are no data covering the entre operating life span for

any one particular plant, nor do any of the national data bases (i.e. NPRDS, IPRDS) include

the compressed air system as one of their standard systems. Therefore, the compressor and

filter/dryer train aging data (plotted in Figures 5-3 and 5-4 respectively) come from several

different plants, for the years covered by their computerized maintenance-reporting sys5-8
Failure Rate (xlOE-4) per Hour

40

30

20

10

0

0 5 10 15 20

Age (Years)

I - Plant A + Plant B ° Plant D X Plant E ° Plant F

Figure S53 Failure Rates for Reciprocating Air Compressors

Failure Rate (xlOE-4) per Hour

12

10

8

6

4

2

0

~~~~~~~~~~~~~~~._ ... _... ........ ---- ----- --... ---. ... --- ----------........

X+

*X +

---- .. -- - - - -- - - - - - ....... X. ..._. .. ...

. .

0 5 10 20

Age (Years)

15 2

I Plant A + Plant B * Plant C 0 Plant D

Figure 5-4 Failure Rates for Filter/Dryer Train

5-9
tems. Each datum was normalized and plotted to compile a hypothetical representation of

the component's aging characteristic over its life span.

The solid horizontal lines drawn in Figures 5-3 and 5-4 represent the best estimates of

the random failure zones of a typical bath-tub representation of aging in equipment. The

wearout regions of this are shown by another straight line, starting at a particular year for

each type of component. The wearout starting years are chosen first, based on the

distribution of the data (i.e. departure from the random failure rates) in the later years. The

bounds for the linear aging rates are then chosen to include all the scattered data points.

The infant mortality part of the bath-tub curve is not shown in these plots, since the

emphasis of this study was on aging (i.e. wearout). The age of the component started when

the plant went into operation and presumably, this might have eliminated the infant

mortality data from the plant maintenance records.

It should be noted that these aging representations of failure rates shown in Figures 5-3

and 5-4 are not related to any particular plant. However, they signify the bounds of aging

rates for the plants included in the data analysis. The shapes of these aging rates may be

different industry-wide when all plants are included, because there is a great diversity in

the way the compressed air systems are designed, operated, and maintained. Another

element affecting these characterizations is the reporting method adopted by different

utilities. Some have better reporting systems with fully computerized logging, whereas for

others early records may be inaccessible. Hence, a larger rate does not necessarily mean

that the plant has too many failures, but might only indicate that this plant had a more

thorough reporting system for logging each event associated with the system.

The age-related failure rates for the IA and SA compressors and filter/dryer trains were

introduced into the PRAAGE-IA model to examine the bounding system unavailabilities

due to aging. All other events in the model retained the original PRA failure probabilities.

Table 5-2 summarizes the aging failure probabilities for compressors and dryers and

calculated on 24-hour mission duration. The aging fraction increase per year is defined as

the increase in failure probability with respect to the constant failure probability per year

beyond the age at which the wearout region begins. The original PRA failure probabilities

for IAISA compressors are 7.0 x 10-3 (motor driven) and 1.6 x 10-1 (Diesel driven SA),

and for filter/dryer train is 1.0 x 10 8. Except for the diesel-driven service air compressor,

these values for motor-driven compressors are almost half of the ones found in Table 5-2.

For dryer/filter trains, this failure probability is four orders of magnitude smaller, primarily

Table 5-2 Failure Probabilities for IA Components

Constant Failure Rates Aging Failure Rates

Bounding Aging

Failure Rate Failure Year at Aging Fraction Increase

Component Per Hr Probability Begins Per Year

IA and SA 7 x 104 1.68 x lo-2 8.0 1.0

Compressors

Dryer/Filter Train 3 x l04 3.1 x 104 9.0 0.5

(For 2 or more air

dryer/filter trains)

5-10
because in the PRA modeling of this component, the cause was related to the closures of

isolation valves to the dryer/filter trains. However, the analysis of aging data revealed that

most dryer problems were associated not only with the switching trains through these

valves, but also with other problems such as corrosion, blocking/clogging of filters, leakage

of dryers, and saturation or breakdown of desiccant. Figure 5-5 shows the IA system

unavailability increase with age using the two component aging data given in Table 5-2.

The non-aging portion of the unavailability increased from 7.1 x 10 to 1.0 x 10'; in 20

years this has increased 4.5 times, which is the bounding effect of aging. The corresponding component contributions to these system unavailabilities are shown in Figure 5-6. As

expected with the higher failure rate for dryers, their contributions remain high for all

years. The compressors also become important in latter years, due to aging effects which

make them more vulnerable to failure.

5.6 Sensitivity Study

The sensitivity of component failure probabilities and the aging characteristic changes

were discussed in this study. The PRAAGE-IA computer program was used to determine

the deviation in system unavailability from the base cases discussed in the previous section.

Since the available aging failure rates for reciprocating compressors and the filter/dryer

trains are the only components, this study yielded limited results. The effects of various

aging rates for these two component classes on the system availability were included, and

the results were compared with the aging analysis results presented in the earlier discussion.

SYSTEM UNAVAILABILITY (E-4)

0 5 10 15 20 25

PLANT AGE (YEARS)

- PLANT PRA I AGING EFFECTS

Figure S-5 System Unavailability for Unit 3 IA Supply

5-11
PERCENTAGE OF CONTRIBUTIONS

0' ' I ' 1

0 5 10 15 20 25

PLANT AGE (YEARS)

- LEAKS | PIPES DRYERS

a SW IA COMP ° SA COMP

Figure 5-6 Component Contributions to IA System Availability

Unlike other support systems, such as component cooling water, and service water, the

instrument air system is typically backed by the service air system in many plant design

(Type II configuration discussed in the design review, Section 2). Several other plants have

a single source of compressed air system (Type I configuration discussed in Section 2)

which supplies compressed air to instruments and controls as well as service equipment.

The PRAAGE-IA modelled a Type II compressed air system which is shared among all

three nuclear units at the plant site. A parametric study reflecting the availability of the

backup service air system and various IA system components was performed using higher

failure probabilities (i.e. 1.0 E-1) for components which could exhibit larger failure rates

over the lifetime of the plant.

5.6.1 Effect of Component Aging

Aging failure rates for compressors and filter/dryers, shown in Figures 5-3 and 5-4,

respectively, were considered to be bounding values for this study. Three cases representing 100%, 50%, and 25% of these rates were analyzed. Since each curve corresponds to a

fixed proportional aging rate for both types of components, their effects on system

unavailability are also proportional. It should be noted that compressors and filter/dryers

are the only subsystems which contain several active components that are vulnerable to

aging mechanisms such as wear, plugging/clogging, or corrosion in the cooling systems.

Other components are typically passive, and have slower aging rates. Thus, the increase in

system unavailability with the age of the plant can be 4.5 times over 20-years, based on the

available plant data. One way to mitigate these aging rates would be to augment the

effectiveness of maintenance programs.

5-12
The effects of compressors and filter/dryer trains were analyzed separately, using their

base-case aging rates (i.e. 1.0 aging fraction increase* for compressors, and 0.5 aging

fraction for dryers/filters). Figure 5-7 illustrates three cases representing either of the two

component types, no aging in the IA compressors, and no aging in the SA compressors.

The results are compared with the base case where both component types aged. Surprisingly, for this particular design configuration and the PRA model, the effect of either

component type is the same. The system unavailability increases to 2.8 times the non-aging

value at the end of the 20-year period. Hence, both compressors and filter/dryer trains were

equally important to the system availability, and hence, should be given similar attention to

manage aging.

The other cases investigated involved either IA or SA compressors maintained so that

their aging rates were under control, i.e. increased maintenance in one group of compressors to mitigate any aging in these components. In some plants, the IA compressors are

more rigorously maintained than the SA compressors. However, this study revealed that

since the SA compressors are designed as backup units and the PRA model assumes that

these compressors are available if the IA units are not available, the impact on system

availability by the SA aging of the compressor is marginally higher than that of the IA

compressors. Over 20-years, the system unavailability for no aging in IA compressors is

3.7 x 10-3 as against 3.5 x 103 where the SA compressors are expected to exhibit no

SYSTEM UNAVAILABILITY (E-4) 50

40 --- ------ - - - ----------- --

3 0 _ - _ _ _ _ _ --_ __ -___

20 - - - - - - - - - --.

10 _ _ _ _ - _ - _- _

0

0 5 10 15 20 25

PLANT AGE (YEARS)

Case 1:100 aging -°-- Case 2:Comp. or Dryr

- Case 3:No aging IA -°- Case 4:No aging SA

Figure 5.7 System Unavailability with Age-Different Component Aging

*Aging fraction increase is defined as the ratio of the increase in failure rate per year over the

constant failure rate for early years.

5-13
aging. In summary, we conclude that the importances of both compressors (SA and IA) as

well as the dryer/filter assembly are the same for maintaining the overall performance of

the IA system availability.

5.6.2 Effect of Components

This discussion compares the importance of certain components in IA system unavailability. The input for components failure probability was arbitrarily increased to 1.0 E- 1 for

each group of components, and the system unavailability was calculated to examine the

increase from the base-case value (i.e. 1.0 E-3). Time-dependent aging rates were not used

in this calculation, because of the arbitrary nature of the chosen failure probability (1.0

E-1). As the plant ages, this failure probability increases with time, and hence, the

importance of the subject component or group of components becomes more important for

system availability.

The PRAAGE-IA program included the filter/dryer trains, receiving tanks, IA system

contamination, and 1A system leakages as single cutsets. Any increase in their failure

probabilities would directly affect the IA system unavailability, and hence, these events

were not considered. We considered the IA compressor subsystem which includes the

compressors and heat exchangers, SA compressor trains, and the interconnecting lines/

valves between the LA/SA systems in this parametric evaluation. It should be recognized

that all three IA compressors are necessary for air supply to all three units at this site.

Equivalent combinations are two SA compressors (electrical) or two IA compressors, and

one of the three SA compressors. The results from this study are dependent on the logic

trees and success criteria assumed in the plant PRA model.

Table 5-3 summarizes some combinations of the major component types on the overall

system unavailabilty. The increase in system unavailability is small when either all of the

IA compressors or SA compressors have high failure probabilities. Even the heat exchanger

effects are marginal, because as long as compressors with adequate capacity for air supply

are available, the system is not seriously in danger. On the other hand, when the

interconnects between IA / SA systems have a higher failure probability, the system

unavailability jumps 2.5 times. This increase is due to the assumption that such failure

Table 5-3 Component Sensitivity on System Unavailability Without

Time-Dependent Aging Effects

Component(s) Failure Rate Factor of Increase in System

Increased to Higher Unavailability from the

Probability (1.0 E-1) Base Case (1.0 E-3)

IA Compressors (all) 1.4

Heat Exchangers (both) 1.3

SA Compressors (all) 1.3

SA Compressors (all) Plus

One IA Compressor 1.4

Two IA Compressors 1.5

SA IA Interconnects 2.5

SA / IA Interconnects Plus

One IA Compressor 4.3

Two IA Compressors 6.1

5-14
eliminates the backup capability of the SA system. The probability of IA system unavailability increases without SA backup capability. This even becomes more important when

failure probabilities of any of the IA compressors are increased, together with the SA / IA

interconnects. A factor of 4.3 for one IA compressor, and a factor of 6.1 for two IA

compressors demonstrate the importance of the interconnect assembly between the two

systems.

5.7 Conclusions

The probabilistic analyis of the design configuration of a Type II instrument air system

(two separate instrument air and service air systems, the latter being designed to backup the

former) yields the following findings:

* Assuming the compressors and filters/dryers age as shown in Figures 5-3 and 5-4,

the system unavailability will increase 4.5 times in 20 years. If other components in

the system age at similar rates, then the aging effects on the system can be a

problem unless major steps are taken to manage them.

* Based on the plant PRA model, leaks in the IA / SA piping and degradation in the

piping of support systems, such as RCW piping for cooling the compressors, LPSW

piping for cooling the heat exchangers, are the dominant contributors to system

unavailability at early ages. However, as the plants become older the compressors

and filters/dryers contribute more to the system unavailability. Similar trends may

exist for other components within the system.

* The aging rate of components within the system seems directly proportional to

overall IA system availability and hence can be a common-cause problem to all

similar components.

* Aging in both IA and SA compressors have equal weight on the system unavailability. Hence, if any one set becomes disabled due to aging, the system unavailability

increases at almost a similar rate.

* When the aging of compressors (100% increase/year) was compared with that of

dryers (50% increase/year), this particular model yielded an identical effect on

system unavailability. Qualitatively, both these components serve an important

function in maintaining the IA system availability to air-operated equipment.

* The interconnection between the LA and SA systems seems to be the most important

segment of the compressed air system for maintaining the IA air supply to vital

equipment. Once the backup capability is lost due to some malfunction which

isolates the SA compressors from the IA system, any additional rapid degradation in

IA compressors, filters/dryers, or other important components could significantly

increase the system unavailability.

* There is good agreement between the calculated rates failure and other sources of

data. However, the IA system failure rates used in a typical plant PRA analysis are

lower than those calculated from the data. This discrepancy is partially accounted

for by the time-dependent increases in failure rate, which may have implications for

many PRA studies.

5-15
6. REVIEW OF MAINTENANCE PRACTICES

The NRC standard review plan section 9.3.11,13) on compressed air systems, requires

that the instrument air system supplying air to safety-related equipment must have the

capability (a) to isolate portions or components of the system in case of a component

malfunction, (b) to operate in correct modes (e.g. valve position indication, pressure), (c) to

function during adverse environmental phenomena, abnormal operating conditions, or

accident conditions such as a loss-of-coolant accident (LOCA) or a break in the main steam

line concurrent with loss of off-site power, and (d) to supply clean, dry, oil-free air. This

plan is further augmented by the issuance of the Generic Letter 88-14 which requires that

these capabilities should be maintained for the entire life of the plant. However, based on

the assessment of operating experience and case studies on the system's performance, it is

evident that there is insufficient attention to maintenance and lack of uniformity in

maintenance programs throughout the nuclear industry. This deficit is presumed to be

attributable to the non-safety classification of the air system, and to the system being part

of the balance of plant (BOP), thereby having a wider design variation from plant to plant.

This section discusses current maintenance activities on compressed air systems. The

findings are based on a limited review of maintenance programs in certain plants. Also

included are the reviews of recommendations in the ANSI / ASME OM-17 industry

standard, and a utility's response to the NRC Generic Letter 88-14 on the air system design,

maintenance, testing, emergency response procedures, and training programs. A preliminary assessment of these activities in mitigating age-related degradations in IA system, as

discussed in Section 4, is also included.

6.1 Current Industry Programs

To perform maintenance on any equipment in the plant a maintenance work request

(MWR), work authorization (WA), or work order (WO) is issued describing the type of

activity, the equipment, and the procedures to be followed. A technician or maintenance

engineer carries out the request and finally assesses the overall condition of the equipment.

Maintenance for a safety-system requires strict adherence to specific procedures for review,

testing, inspection, and maintenance activities in conjunction with a rigorous quality

assurance (QA) program. These activities are fully documented to allow present and future

assessments of equipment performance. In contrast, the compressed air system, being

classified as a non-safety system, is subject to far less rigorous procedural and statutory

requirements. Similarly, the training received by plant personnel for the compressed air

systems is less elaborate than for safety systems, and the training and qualifications

required of air system maintenance technicians is less restrictive. Consequently, the overall

review, quality assurance, and procedural controls for maintenance and operation of

compressed air systems are not as rigorous nor closely controlled as for safety systems.

Of the three major subsystems (compressors/receivers, dryers/filters, and distribution

network) making up the compressed air system, the compressor/receiver subsystem contains the most active components such as compressors, aftercoolers, moisture separators,

and loading/unloading valves. These components may be subjected to hostile operating and

environmental stress conditions and have exhibited degradations with age. Review of

industry practice indicates the maintenance of these components is well defined. Periodic

6-1
changing of bearing oil or grease, replacement of the oil filter and intake air filter, and

calibration of control devices are the most common practices. Other activities include

vibration testing of compressor bearings, blow down of drain valves, gasket replacements,

and inspection of the other components. Some plants perform an annual inspection and

some routine preventive maintenance on compressors. Based upon the manufacturer's

recommendations, air compressors receive a periodic overhaul, at which time worn parts

are replaced with new components or refurbished.

The dryer/filter subsystem conditions the compressed air from the compressor/receiver

subsystem. Air leaving this portion of the system must be clean, dry, and cool enough to

use in the air-operated equipment that the IA system serves. Most degradable parts in.this

part of the IA system (note that service air systems do not have this subsystem) are prefilter elements, desiccants in the dryer towers, and after-filter elements. Most of these

filters are regularly replaced as part of the plant maintenance program. Desiccants are also

periodically replaced before they become saturated or breakdown. Periodic maintenance of

refrigerated air drying systems includes activities, such as inspections of the refrigerant

compressor and heat exchanger repair, and overhaul, refrigerant checks, cleaning of

condensate drains and regulators and functional checks.

The last subsystem, the distribution network consisting of piping and valves, usually

requires the least maintenance, unless there is severe blockage or a major air leakage in the

system. Utilities are required by Technical Specifications to perform tests for local leak rate

and integrated leak rate on the valves of the instrument and service air systems which make

up the reactor containment barrier. Motor-operated isolation valves are often subject to

stroke time tests, valve operator calibration, and funtional tests in addition to the leakage

test. Some plants may include periodic blow down of major headers or sections of the air

distribution systems to remove any accumulated moisture, oil, or other debris.

Table 6-1 summarizes the maintenance activities for compressed air systems gleaned

from the analysis of plant maintenance records discussed in Section 4. In addition, routine

activities such as system walk-down inspections, calibration of instrumentation and control

devices, logging of operating parameters are part of the plant maintenance programs for

compressed air systems.

6.2 ANSI/ASME OM-17 Recommendations

This standard is one of several being prepared by the ASME Committee on Operation

and Maintenance, the Subcommittee on Performance Testing, to provide the nuclear

industry with a standard for preoperational, performance, and post-maintenance/

modification inspection and testing of plant systems. The standard provides guidance for

in-service test intervals, parameters to be measured and evaluated, requirements for data

acquisition, acceptance criteria, and corrective actions. Discussions in the standard include

preoperational performance tests and in-service performance tests. Our discussion is limited

to the latter recommendations.

Trending of all data acquired during the performance of the tests outlined in the

standard is recommended for assessing degradation in components. Table 6-2 lists the tests

applicable to the three subsystems of an IA system.

6-2
Table 6-1 Current Industry Programs

Plant Preventive Maintenance Activities

IA I SA Periodic Periodic

Components Inspection Surveillance I Monitoring I Maintenance Remarks

Compressors 6-12 Months None Vibration I/C Calibration

Change Oil

Change Intake e

Oil Filters

Periodic Overhaul

o)r

Receivers

Aftercoolers

Dryers/Filters

(Pre & After)

Instrumentations

& Control

Pipings

Valves (Distribution Only)

None

None

3-12 Months

None

None

None

None

None

None

Functional Check

None

Local/Integrated

Leak Rate

Testing

Stroke Test

(MOV)

Drain Valve

Functions

None

Pressure Drop or

Differential

Exit Air Humidity

None

None

None

None

None

I/C Calibration

Replace Desiccants

Periodic Overhaul

Periodic Filter

Changes

Periodic Calibration

None

None

Diesel-driven

compressors

often require

additional

maintenance.

Some perform

periodic inspection.

Some perform

inspection,

blow down of

flanges and

valve, gasket

replacements

as they need.

For the compressor/receiver subsystem, the standard recommends monitoring and

testing, in addition to those discussed in the previous section, which include compressor

loading/unloading hours, oil sample testing, operation of receiver relief valves, nondestructive tests of the receiver tank against degradation of wall thickness, heat exchanger

approach temperatures, compressor outlet temperature, oil pressure and level, and the

proper function of moisture separators, aftercoolers, and automatic drains.

For the dryer/filter subsystem, the standard calls for close monitoring of the condition

of the air leaving the subsystem, flow measurements, drain operation, and contamination

levels of the exit air for hydrocarbons, moisture content, and desiccant particles. Finally,

for the distribution network, header pressure levels, flow rates, air condition (dew point,

contaminations), and leakage checks should be monitored periodically. Additionally, dedi6-3
Table 6-2 Typical Testing and Maintenance Activities for Compressed Air System

Subsystem Testing & Maintenance Frequency

Compressor and Receiver * Inspection check for visible sign of

degradation (physical damage, corrosion, erosion, loss of integrity)

Refueling outage

* Non-destructive testing at the bottom

of vessel for thickness check (ASME

B&PV code)

* Receiver relief valve functional testing

* Bearing monitoring (vibration)

* Oil sample check

* Inlet filter pressure drop

* Compressor loaded and unloaded hours

* Heat exchanger approach temperature

Compressor outlet temperature

Compressor oil pressure and level

Function of moisture separators and

automatic drains

Refueling outage

Once in 2 years

Quarterly

Quarterly

Monthly

Weekly

Each 8 hour period

Dryer and Filter * Dew point of air dryer

* Pressure drop of filter, coolers

Air flow measurement

* Purge flow for desiccant dryer

* Function of separator automatic drain

for refrigeration dryer

* Function check on prefilter (drainage)

* Cartridge change out in prefilters and

afterfilters

Daily

Weekly

Weekly

Each shift

Each shift

Semiannually

Distribution Network * Flow rate

* System pressure

* Air quality (dew point, contamination,

and operating pressure)

* Leak test on accumulators

Regularly

Quarterly

Semiannually

Refueling outage

cated backup accumulators (safety grade) should be tested for leakage via a pressure decay

test. This test determines the elapsed time of the decay to minimal acceptance pressure as a

baseline, and verifies that the time is within the design acceptance criteria.

6.3 Industry Upgrades

In response to NRC Generic Letter 88-14, each holder of a nuclear plant license is

required to perform a design and operations verification of the instrument air system. This

verification program includes the tests that maintain the quality of the instrument air,

6-4
maintenance practices, emergency procedures, training, and lastly, the design adequacy of

the entire instrument air system including the pneumatic accumulators. The NRC staff

requested the licensees to respond within 180 days after receiving the Generic Letter in

August 1988. The changes proposed by one utility for improving its IA system reliability

are discussed in this section.

In its response, this utility approached the reliability problem of the compressed air

system by examining five areas. These are equipment and design, maintenance and testing,

response procedures for loss of air, training, and simulators. The last three items relate to

preparedness in case of a loss of air, and how to restore the air supply to vital instruments

and equipment. Since the goal of this aging study is to prevent such occurrences rather than

to mitigate their effects, this discussion encompasses the first two areas, specifically, the

changes in system design and maintenance/testing activities.

6.3.1 Equipment/Design Criteria

Separate instrument air and service air trains (Type II) are preferred over one

compressed air system (Type I) for both applications. Each system's compressor train

should have a full-capacity, oil-free compressor. At least one standby compressor should be

included as a full-capacity backup for the IA or SA compressors. All compressors should

be remotely operated and controlled from the control room. A crossover tie between the

two system trains is required and should have an oil separator/filter unit to hold the

hydrocarbon content to below 1 ppm and to remove dust particles 1 micron and over (as

against the 3 microns allowed per ANSI/SA-S7.3-1975 standard). This crossover should

have automatic low-pressure actuation and control from the control room.

The system design should include manual bypass valves around all automatic backupair isolation valves, dryers, filters, and auto-isolation valves at major headers to isolate

low-pressure zones. Monitoring devices downstream of the dryer/filter assembly are required to indicate the dew point (18'F below the minimum local recorded ambient

temperature at the plant site per ANSI/SA-S7.3-1975),(14) flow rate, header pressure, and

hydrocarbon/contamination content. Each filter and dryer unit should have a differential

pressure indication to monitor when changeout is required.

The control room indicators should contain on/off status for all air compressors

(including both IA/SA), instrument header pressure, loop or dead run header pressures, and

pressure downstream from auto-isolation valves. It is also advantageous to locate the

compressor intakes in a low-humidity, low-temperature, and low-dust environment. Check

valves should be installed inbetween the compressor and its receiver, so that the failure of

the compressor does not fail the system by permitting back flow. Since several failures

were caused by condensates accumulating in the system, continuous blow-down orifices

and/or drain traps should be installed (especially in dead-end runs or low-flow portions of

the air system) to reduce buildup of moisture and condensation. All piping and fittings

should be constructed of non-corrosive, non-scaling materials. The complete system should

be designed to seismic category I requirements.

Safety-grade accumulators should have air lines entering at the top and have drain

fittings to blow down condensates.

6-5
6.3.2 Maintenance/Testing Criteria

In comparison to the current maintenance practices in compressed air systems, the

suggested inspection, testing, monitoring, and maintenance activities are extensive. Many

of these recommendations are based on good practices and techniques used to mitigate the

problems associated with compressed air systems in the licensee's nuclear plant. Activities

relating to the dryer/filter and distribution network subsystem are more comprehensive

compared to those relating to the compressor/receiver subsystem. The frequency of these

activities is not substantiated either on any technical grounds or operating basis, and they

vary significantly from those recommended in the ASME O&M committee. Table 6-3

Table 6-3 One Licensee's Suggested Maintenance/Testing Criteria

IA Subsystem Maintenance Activity Suggested Frequency

Compressor/Receiver * Compressor capacity trend to estimate

leakage and margins

* Sequence checking/overall compressor

performance/trending (vibration etc.)

- backup compressors

* Compressor protective device set point

checks (alarms, trips)

* Quarterly

* Quarterly

* Refueling

Dryer/Filter * Outlet Dew Point Verification

* Water inspection/draining of critical

valves (positioner/air bottles)

* Pressure differential check on filters

* Desiccant particulate size check

* Backup cross-tie to station air check

* Verify automatic opening of the crosstie connection

* Weekly

* Depending on rate

of water accumulation

* Based on history

and AP

* Based on history

and AP

* Weekly

* Quarterly

Distribution * Branch line leak tightness check

* Isolation valve operability/stroking/set

point/full closure check

* Piping joints/flanges/couplings

- leakage walkdown & inspection

- water accumulation/blow down I

- Tubing/piping cracks

* Refueling

* Refueling

* Depends on compressor on/off trending

* Depends on water

accumulation

Accumulators

Air-Operated Equipment

(Valves)

* Integrity of pressure holding ability

* Air pressure check & valve response

check for contaminants, deterioration,

water

* Alternate Refueling

* Refueling

6-6
summarizes the activities for the three subsystems in a compressed air-system and those

applicable to safety-grade accumulators and air-operated equipment. Many of these suggested inspections and tests require further explanation, as they are very broad and their

performance frequency depends on the system's characteristics.

6.4 Overall Assessment of Maintenance Practices

The maintenance practices discussed in this section are primarily based on the expert

consensus and industry experience. Some are taken from the viewpoint of the recommendations of the equipment manufacturer, statutory requirements, and cost/benefit considerations. Although implementation of these recommendations would enhance the system

performance and, thus, ensure better plant safety, they do not address the mitigation of agerelated degradation identified in our data analysis. Also, human reliability is not addressed.

In any maintenance, humans have a major interaction with the equipment. For compressed

air systems, these human factors have significantly affected the system performance,

primarily because of the system's non-safety classification and the lower level of review,

quality assurance, and training on these activities as opposed to a safety system. Finally,

the impact of IA system failure on other frontline systems supplied by the IA system is

often not competely understood by the plant engineers who may be working on these

systems. These deficiencies are evidenced by the feedback report by AEOD on operating

experience with instrument air systems.

In the compressor/receiver subsystem loading/unloading valves, leakage of oil from oil

reservoirs or bearings, water from the coolers, air from seals, and excessive vibrations

dominate the failures in addition to starting problems. Most of the failures are attributed to

instrumentation/control problems (i.e. set point drift, calibration), wear of non-metallic

components (e.g. seals, gaskets) and drainage of condensate problems. High AP across the

intake air filter indicates clogging with dust, water, and other atmospheric contaminants.

Problems associated with loading/unloading valves, problems with aftercooler or moisture

separator corrosion/water leak, and those associated with drainage of condensate are not

addressed in the suggested maintenance programs.

Although plants regularly change pre- and after-filters, drain excess condensate from

the dryers, and periodically replace desiccant, the operation of the dryer/filter subsystem

exhibits higher numbers of failures than might be expected. Some plants have experienced

more problems than usual with their regenerative desiccant dryers, particularly in their

early years of operation. The recommended practices previously discussed do not provide

activities to mitigate the problems of dryer-tower swapping, one of the most frequent

problems observed in the operating experience data. Corrosion has been detected in the

internal parts of certain components. Since this subsystem is maintained more frequently, it

tends to suffer the effects of human errors.

Additional monitoring of the air condition and line pressure in the distribution network

subsystem is desirable. Operating data reveal more on-line problems with valves than with

the pipe fittings, headers, or piping itself. These problems include valve stem and seal

leakages, broken valve ports, valve control problems, and other typical valve problems.

Corrosion and wear of internal parts dominate among all the aging mechanisms.

6-7
Other recurrent problems that have shown up in the review of operating data are leaks

in dedicated safety-grade accumulators, degradation of internal parts of air-operated equipment, malfunction of regulators, problems associated with check valve closing/opening,

range limitations on operating pressure for solenoid valves, and gradual loss of system air

pressure. Most of these problems are not adequately addressed in existing plant maintenance programs. The potential for increases in system performance and reliability, and

interfacing system performance and reliability, is significant if specific maintenance

activities are adopted. Phase 2 study on the IA system would provide the detailed

recommendations on maintenance activities for mitigating aging effects.

6-8
7. RESULTS AND CONCLUSIONS

To start this study, we reviewed the designs of instrument air systems in nuclear power

plants based primarily upon information contained in their FSAR's. Armed with this

knowledge, comprehensive maintenance and operating records were obtained from six

plants for periods ranging from three to nine years and analyzed to determine the operating

experiences actually realized in compressed air systems. The findings were compared to the

results of previous NRC studies by AEOD(1) and OSRR( 2 and the recommendations of

Generic Letter 88-14. Based on the above, the environmental stressors affecting the IA

system were defined and quantified to determine whether the maintenance practices being

followed by the industry and the recommendations of the NRC in its Generic Letter 88-14,

NUREG 1275 Vol. 2, the OSRR study, and SRP 9.3.1, the ANSI/ASME OM-17 committee,

and the ANSI/ISA S7.3 Quality Standard for IA adequately address the problem areas.

Finally, a limited PRA study was performed using one plant's compressed air system

model. An appendix giving the details of the FSAR design review of compressed air

systems and descriptions of the most commonly found types of compressed air components

is included, along with an appendix detailing a brief NPRDS based study on the Emergency

Diesel Generator Starting Air System.

7.1 IA/SA System Design Reviews

The IA/SA system design reviews based on FSAR descriptions showed the following

information.

* The compressed air systems at nuclear power stations fall into two basic supply

arrangements, based upon the supply train designations. The Type I arrangement consists

of two or more IA compressors supplying both the plant SA system and the IA system.

The Type 1I arrangement is made up of one or more IA compressors feeding the IA

system along with one or more SA compressors supplying the SA system and serving as

a backup to the IA header. In most systems an automatic pressure controlled valve

separates IA from SA to protect the IA system pressure.

* There are two basic approaches to the design of compressed air systems at multi-unit

sites: (a) individual air systems for each nuclear unit, or, (b) one large compressed air

system shared by two or more units.

* The IA system generally is not considered a safety system. Where compressed air is

required for a safety-function, safety-grade accumulators or special purpose, redundant,

seismic Category I, safety-grade air systems such as the EDG Starting Air System or

Containment Instrument Gas System are provided.

* Most plants have two or more air compressors (IA, or IA and SA) available per nuclear

unit, or, in the case of some shared air system multi-unit sites, at least one compressor

and one shared backup compressor.

* Almost half of the plants surveyed have designs which allocate one instrument air dryer

or less per nuclear unit.

7-1
Conclusions

* Redundancy of air compressors is important in assuring the availability of a supply of

compressed air. This choice should consider redundancy not only for the compressors

themselves, but also in power supplies, control power, cooling water supply, and valve

motive power.

* Redundancy of instrument air dryers must be given important consideration to assure

uninterrupted availability of clean, dry air. Most plants can bypass filter/dryer trains or

supply unconditioned service air into the instrument air system when dryers are not

available. As pointed out in NUREG 1275 Vol. 2 as well as in this study, once

contaminants are introduced into an IA system, they may cause problems for quite some

time. Parallel filters and parallel dryers for each unit would be the preferable configuration.

* The IA/SA crossconnect valve is a critical component to protect IA supply pressure in

cases of excess IA demand, and in Type II compressed air systems, as the active

component which connects backup SA compressors to the IA system. Status indication

should be considered, as well as manual bypass or override capability.

* Shared compressed air systems at multiple unit sites are less desireable than individual

systems per each unit, because of the potential to involve multiple reactors when there is

a problem in the air system. This factor is even more critical in BWRs because of the

direct involvement of IA with the scram system.

* Arrangements of the ring header distribution provide greater flexibility to the compressed air system in cases of maintenance or repair, and could improve the availability

of compressed air to the plant.

7.2 Operating Experience Analysis

The operating/maintenance performance of the compressed air system was examined

by analysing maintenance records from six nuclear plants. Since NPRDS does not cover

this system, the plant data was the most comprehensive source of instrument air system

performance available. However, the NPRDS was searched for AOV and SOV failure

counts. Some of the findings are listed below.

* Aging degradation occurs in the compressed air system, and becomes an increasing

factor as the system ages.

* The control room indication and annunciation are minimal on these continuouslyoperated, non-safety systems, therefore frequent local monitoring, inspections, and

walkdowns of the main components are important means of detecting failure.

* The components experiencing the largest percentage of the total failures reported for

compressed air systems were: compressors, air system valves, dryers, and filters.

* Compressor failures were caused by normal service 85% of the time, wear being the

dominant mechanism in the positive displacement machines. The most common modes

of failure were degraded operation due to failure to load/unload properly, and leakage.

7-2
* Failures in dual-tower desiccant-type air dryers resulted from normal service between

75% and 85% of the time, with human error as the second most important cause. The

dominant failure mechanisms were blocking/clogging, corrosion, deterioration, and contamination.

* The external systems most often affected during IA-related LER events are containment

isolation, main feedwater/main steam, auxiliary feedwater and the BWR scram system.

About 10% of the AOV failures on these systems reported to NPRDS could be attributed

to problems in the 1A system.

* The most commonly affected components during IA-related LER events are AOV's and

SOV's. NPRDS data also showed failures of these components was a common occurrence and as many as one in five of the failures might be the result of IA system

contaminants.

Conclusions

* Since aging processes affect the compressed air system and its components, an aggressive preventative maintenance program should be followed to mitigate these effects.

* The compressors, distribution system valves, instrument air dryers, and filters should

receive the majority of maintenance allocated to the compressed air system.

* Frequent monitoring of the system, walkdowns, and inspections should be part of the

maintenance program to detect problems earlier. The frequency of inspections and

walkdowns on air receivers, piping, aftercoolers, and valves should be increased as the

system ages.

7.3 Maintenance, Testing, Operation, Training

We reviewed current nuclear industry practices in the maintenance testing, operation,

and training associated with compressed air systems, and compared them to the recommendations of NRC Standard Review Plan 9.3.1, NUREG 1275 Vol. 2, the OSRR Study,

Generic Letter 88-14, the ANSI/ASME OM-17 committee, and ANSI/ISA S7.3-1975. The

practices and recommendations were also compared to the failure data obtained from the

study of operating/maintenance experience described in Section 4. Some findings are listed

below.

* Compressor maintenance, inspection, and testing programs stay fairly close to the

manufacturer's recommendations. Failure data indicate that the most common mechanisms are loading/unloading problems which are a result of wear, calibration/setpoint

drift, and vibration, and leaking which results from wear, vibration, and corrosion.

Maintenance activities to mitigate the effects of these processes will have the greatest

impact in reducing failures.

* Failures of the dryer are the second most common problem in the components of

compressed air systems. Moreover, the failure of the dryer can lead to failures directly or

indirectly throughout the IA system. The mechanisms most often encountered (blocking/

clogging, corrosion, deterioration, contamination) can be countered by more frequent

maintenance intervals on the air dryers, as well as on prefilters, aftercooler/moisture

separators, and upstream automatic drain traps.

7-3
* Most plants have little or no testing or regular maintenance of air system valves other

than containment isolation valves.

Conclusions

* An aggressive maintenance program similar to that shown in Table 6-2 should be

adopted incorporating the ANSI/ASME OM-17 recommendations.

* More training on the instrument air system is needed in two major areas. First, the

maintenance and operating personnel must be made more knowledgeable about the air

system equipment, particularly compressors and dryers, this will address human errors,

which are the second most common cause of failures on these components. Second,

personnel must have a better understanding of the importance of IA to other critical plant

systems, both safety and non-safety.

* More concise procedures concerning air system maintenance and operation would reduce

the incidence of human errors.

* Air quality should be monitored periodically for adherence to design specifications or

ANSI/ISA S7.3-1975, whichever is better to prevent contamination.

* Degraded pressure operation is the most common failure mode seen in failure of the air

system. Emergency procedures for response to and recovery from degraded air system

events should be developed, along with procedures for the response/recovery to complete

loss of air.

* Related to the above, periodic testing for gradual loss of pressure should be performed to

test the performance of safety-grade accumulators, check valves, and isolation valves

under these conditions.

* Air system valves should receive more maintenance, particularly TA/SA crossconnection

valves, or low pressure auto-isolation valves.

7.4 PRA-Based Aging Analysis

We made a limited study based upon the compressed air system model used in the

Oconee-3 PRA. The effects on system availability were investigated as various parameters

in the model were varied. Our results showed the following points:

* Using time-dependent aging models for air compressors and filter/dryer trains, IA system

unavailability increased by 4.5 times over 20 years.

* During the first years of operation, IA/SA piping leaks and degradation of support

system piping account for most IA system unavailability. Compressors and filter/dryer

trains contribute increasingly as the systems age.

* Both the IA/SA have equal weight with respect to system availability, provided the

interconnection valve between SA/IA opens as required. This valve emerges as the most

critical component in the compressed air system.

7-4
Conclusions

* The results of the time-dependent aging study indicate that compressors become important in later years.

* The importance of the IA/SA interconnection valve was verified with the PRA model.

* Time-dependent effects indicate maintenance/surveillance priorities should be changed

as the plant ages.

7.5 Future Work

Since the compressed air system operates continuously, exposure to operating stresses

contribute most of the aging degradation. The non-safety and non-seismic classification of

the system, and its design philosophy are responsible for not having an industry-wide

maintenance program to manage the system. Therefore, future work should determine if the

practices which detect and mitigate aging degradation in the compressed air system can be

identified and implemented.

Using the aging characteristics identified in this study, the following specific tasks

will be performed in subsequent studies:

* We will make an in-depth review of current plant maintenance, monitoring and inspection practices, which will include the recommended programs developed by the utilities

in response to the NRC Generic Letter 88-14, ANSI/ASME O&M committee, draft

regulatory guide DG-1001, and other studies sponsored by both the utility and the

regulating agency.

* Recommendations will be made regarding specific maintenance and monitoring activities

on components, training, and awareness of the system's importance in achieving safe

shutdown of the reactor, and emergency preparedness.

* Assessment of the effectiveness of inspection, surveillance, monitoring and maintenance

practices for the timely detection of significant aging efforts prior to loss or major

degradation of system function.

7-5
8. REFERENCES

1. Hagen, E. W., "Compressed-Air and Backup Nitrogen Systems in Nuclear Power

Plants," NUREG/CR-2796, ORNL/NSIC-206, July 1982.

2. Emrit, R., et al., "A Prioritization of Generic Safety Issues," NUREG-0933,

December 1983.

3. NRC Memorandum: Singh, R. to Rossi, C. E., "Forced Shutdowns Induced by

Instrument Air Failures," April 1985.

4. Ornstein, H. L., "Operating Experience Feedback Report-Air Systems Problems," NUREG-1275, Vol. 2, USNRC, December 1987.

5. DeMoss, G. M., et al., "A Risk-Based Review of Instrument Air Systems at

Nuclear Power Plants," BNL Technical Report No. A-3968-6-23-88, June 1988.

6. Vora, J. P., "Nuclear Plant Aging Research (NPAR) Program Plan," NUREG1144, Rev. 1, September 1987.

7. Fullwood, R., et al., "Aging and Life Extension Assessment Program (ALEAP)-

Systems Level Plan," BNL Report A-3270-12-86, December 1986.

8. Higgins, J., et al., "Operating Experience and Aging Assessment of Component

Cooling Water Systems in Pressurized Water Reactors," NUREG/CR-5052, July

1988.

9. Lofaro, R., et al., "Aging Study of Boiling Water Reactor Residual Heat Removal

Systems," NUREG/CR-5268, BNL-NUREG-52177, June 1989.

10. "Performance Testing of Nuclear Power Plant Instrument Air Systems," an American National Standard, ANSI/ASME OM-17 (Draft), December 1987.

11. "Oconee PRA-A Probabilistic Risk Assessment of Oconee Unit 3," NSAC/60,

June 1984. Nuclear Safety Analysis Center, EPRI and Duke Power Co.

12. "Full Scale Plant Safety and Availability Assessment-A Demonstration of GO

system Analysis Methodology," EPRI-NP-4128, Vol. 2, 7/85.

13. USNRC Standard Review Plan, Section 9.3.1 on "Compressed Air System,"

NUREG-0800, Rev. 1, July 1981.

14. American National Standard on "Quality Standard for Instrument Air," ANSI/ISAS7.3-1975 (R1981).

15. Subudhi, M., Burns, E. L., Taylor J. H., "Operating Experience and AgingSeismic Assessment of Electric Motors," NUREG/CR-4156, June 1985.

16. Subudhi, M., et al., "Improving Motor Reliability in Nuclear Power Plants,"

NUREG/CR-4939, November 1987.

8-1
APPENDIX A

Equipment and System Design Arrangements
APPENDIX A. EQUIPMENT AND SYSTEM DESIGN ARRANGEMENTS

A.1 Major Equipment Descriptions

The following sections briefly discuss each of the components in the compressed air

supply train. Figure 2-1 shows the location of the component with respect to the other

equipment.

Intake Filter/Silencer. The cleanliness of the air entering a compressor is extremely

important in reducing wear to internals, extending the working life of the equipment, and

maintaining the compressor's efficiency. Therefore, all pneumatic systems should use

intake filtering appropriate for the environmental conditions that will be encountered

during service. Each compressor in the compressed air system of a nuclear power plant is

fitted with its own intake filter/silencer to remove dirt, dust, and particulates entering the

unit. As the name implies, most of these devices incorporate a silencer or noise baffle to

reduce the noise of air being drawn into the compressor.

Figure A-1 depicts a dual element filter/silencer unit typical of those on instrument

and service air compressors. Air enters via a protective inlet air duct or hood passing first

through a conditioning prefilter, and then a second, high-efficiency final filter. The filtered

air then flows through a silencer/baffle to reduce noise.

To maintain proper efficiency, the filter elements must be cleaned or replaced at a

regular interval, depending on ambient conditions. Some units may incorporate monitors

for pressure drops to alert operators when clogging reaches a specified differential pressure

setpoint.

Air Compressors. Compressors used in instrument and service air systems in nuclear

power plants are either positive displacement or nonpositive displacement types, called

HIGH EFFICIENCY

PARTICULATE AIR (HEPA)

FI LTER

FILTERED AIR

PREFILTER OUTLET FLOW

SILENCER

DUCT BAFFLE

INTAKE

AIR FLOW

Figure A-1 Inlet Air Filter/Silencer

A-1
continuous flow and dynamic compressors. The reciprocating-piston compressor is the

most common positive displacement type because of its high-pressure capability, ability to

dissipate the heat of compression, and versatility. Figure A-2 shows the basic operation of

this machine. Air is compressed by the alternate filling and compression of a cylinder by

the reciprocating motion of a piston. The rotary motion of the crankshaft, driven by an

electric motor, diesel, or some other prime mover, is translated via the connecting rod into

the reciprocating motion of the piston within the cylinder. On the intake stroke (Step 1 of

Figure A-2), the piston moving downward in the cylinder creates a negative pressure across

the spring-loaded intake valve causing it to open. Intake air is drawn through the filter/

silencer into the cylinder. When the piston reaches the bottom of its stroke (Step 2), the

differential pressure across the intake valve is less than the spring force pushing to close

the valve. Therefore, the intake valve closes and the compression portion of the cycle

begins. As the piston moves upward into the cylinder bore, reducing the volume as it

travels, air pressure and temperature increase. When the pressure differential across the

discharge valve exceeds the spring pressure holding it closed, the valve opens (Step 3 of

Figure A-2). The volume of hot compressed air is then driven into the system via the

discharge manifold as the piston continues to the top of its stroke. Once the piston reaches

the top of its stroke (Figure A-2, Step 4), the differential pressure across the discharge

valve drops below the closing force of the spring. and the valve closes, completing the

cycle.

The reciprocating compressor, as a positive displacement pump, can supply high

pressures. Since the pressure against which the compressor works continues to rise as long

as pumping continues, an unloading device, relief valve, or pressure-operated controller is

needed to limit system pressure. As pressure increases, the rate of free air delivery

decreases in this type of compressor, and temperature rises accordingly. To ease these

disadvantages and improve efficiency, compression may often be accomplished in multiple

stages, as shown in Figure A-3. Here, an intercooler between the first and second

compressor stages cools the pressurized air before it is further compressed in the secondstage cylinder. This lowers the temperature of the compressed air, as well as the temperature of the equipment.

The most frequently encountered non-positive displacement or dynamic compressor is

the centrifugal compressor. As shown in Figure A-4, it consists of a high-speed rotating

impeller pulling air in through a centrally located inlet, and accelerating it outward into the

surrounding static diffuser section. The diffuser slows the air stream, converting some of its

kinetic energy to pressure. The scroll-shaped collector further slows the air stream and

increases its pressure as it directs the flow to the discharge outlet. By using multiple

centrifugal compressors in stages, higher pressures may be achieved with the added

advantage of intercooling (as was done in the multistage reciprocating compressor). The

continuous, pulsation-free delivery of air at a relatively constant pressure is another

advantage of this type of compressor. Disadvantages are the high speeds required (often in

excess of 50000 RPM) and the tendency of the centrifugal compressor to surge or

experience reversal of flow when the system's backpressure becomes greater than the

delivery pressure and a no-flow condition results. A surging compressor experiences high

vibration, unstable flow, and high differential pressures across compressor stage that may

cause rotor-to-casing contact, severely damaging the compressor. Anti-surge relaying is

A-2
DISCHARGE

PORT

DISCHARGE

I

INTAKE STROKE

2

COMPRESSION BEGINS

DISCHARGE

PORT

DISCHARGE

PORT

3

DISCHARGE COMPRESSED

AIR BEGINS

4

DISCHARGE COMPLETE

Figure A-2 Simplified Reciprocating Piston Compressor Cycle

A-3
INTAKE PR

F1LTER/ LOW

SILENCER PRESSURE PRESSURE

CYOINDER A CYUNprR

, ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ t r 

FiueA3BscOeaio of a w tg/w yindrArCmrso

DIFFUSER1

AIR

IMPELLER

COLLECTOR

Figure A-4 Typical Centrifugal Compressor

A-4
usually provided to fully open the unloading pressure control valve whenever a surge is

sensed.

The motive force used to drive air compressors in nuclear plants is almost exclusively

the three-phase squirrel-cage-type induction motor. These machines, in ratings ranging

from 50hp to 1000hp, most often are powered from the normal 480 volt station distribution

bus. Some plants have one compressor powered from an emergency 480 volt bus and the

others from the normal bus, or make provisions to allow manual realignment of compressors to the emergency power bus. Diesel-engine-powered compressors are occasionally

encountered (such as at Duke Power's Oconee plant), but as an alternate source when the

electric-motor-driven units are not available.

Large compressors in a nuclear plant are usually operated continuously, with starting

and stopping being limited to compensate for only extreme changes in demand and system

pressure. In order to match the output of a compressor to small variations in demand, a

compressor is operated, unloaded or loaded as required. The method of unloading will

depend upon the type of machine, and the design preference of the manufacturer.

For example, in a single-acting reciprocating compressor, the compressor inlet valve

might be held open as a means of unloading. The air drawn in during the suction stroke is

discharged fully or partially back to the atmosphere on the return stroke. Another method,

found typically in double-acting reciprocating machines, is the use of clearance chambers

associated with each cylinder. On the compression stroke, instead of discharging fully into

the discharge line, the charge is compressed into the clearance chambers. The air in the

clearance chamber then expands back into the cylinder on the succeeding suction stroke

limiting the volume of free air drawn in. Varying the volume of the clearance chambers, or

completely closing them off, will serve to regulate the amount of free air drawn in, thereby

unloading or loading the operating compressor to meet demand.

Another means of loading/unloading a compressor is to allow the discharge air to

bypass to the atmosphere. Due to the special operating characteristics of dynamic compressors, unloading via the bypass method is often well suited to these machines. A centrigual

compressor may be fitted with modulating inlet and discharge valves, such as those

illustrated in Figures A-5 and A-6. The discharge pressure control valve, or unloading

control valve, is modulated to vent all or part of the compressor discharge to atmosphere to

keep the discharge pressure and flow at optimum levels for the given conditions. The inlet

valve controller senses inlet air temperature and pressure, and adjusts the inlet control

valve position accordingly. Together they can keep the centrifugal compressor within a

stable operating flow region throughout a wide range of output, without experiencing

compressor surge.

As discussed earlier, intercoolers are heat exchangers that cool compressed air as it

flows from one stage to the next of a multistage compressor; they are simply tube-and-shell

type heat exchangers. The tube side contains cooling water flow from the plant's component cooling water system or other closed-loop cooling water system. The intercooler shell

directs interstage compressed air flow around the bundles of cooling water tube, cooling

the air as it passes by. The intercooler must have provisions to drain off moisture which

will condense as the compressed air is cooled.

A-5
FROM INLET

AIR FILTER

TRANSITION

PIECE

EXPANSION

JOINT

BUTTERFLY

VALVE TO

POWER

POSITIONER

1 ST

STAGE

COMPRESSOR

INLET

Figure A-S Compressor Inlet Control Valve

ANCHOR

TO AIR

SYSTEM

SPRING

HANGERS

TO UNLOADING X / MUTE

EXPANSION LIMITER BOLT

EXPANSION 

JOINT EXPANSION

LMTRBL

COMPRESSOR EXSOINT DISCHARGE 

JOXPNIONT

UNLOADNG

VALVE

Figure A-6 Compressor Discharge Pressure Control Valve (unloading control valve)

A-6
Another critical support system for the compressor is the lubricating oil system. Figure

A-7 is a simplified schematic of a lube-oil system for rotary compressors, consisting of an

oil reservoir, oil heaters, auxiliary lube-oil pumps, main lube-oil pumps, and water-cooled

lube-oil coolers. The majority of compressors used in the instrument and service air

systems at nuclear stations are of the "oil-free" type, that is, the air-compressing portions of

the machine have dry, self-lubricating materials such as graphite. Even the slightest amount

of oil vapors can contaminate a compressed air system, cause sludge and dirt buildup,

deterioration of parts, and formation of varnishes. Petroleum-based oils, greases, and

lubricants therefore are restricted to the bearings and other mechanical portions of the

compressors, using seals and seal-air arrangements. Oil is thereby eliminated from the

compressed air stream discharged into the instrument and service air systems.

Aftercoolers. Air leaving a compressor is at a high temperature, often above 4000 F for

compressors in nuclear plants. Each compressor directs its discharge through an aftercooler

to lower this temperature. The aftercooler is simply a tube-and-shell heat exchanger, very

similar in principle to the intercoolers found in multistage compressors. Air entering the

shell side of the aftercooler at anywhere from 3000 F to 4000 F will be directed through

tube bundles circulating cooling water from the plant's component cooling water system or

other closed loop cooling water system. Heat will be transferred from the compressed air to

the cooling water, cooling the airstream to within a few degrees of the cooling water

temperature, typically from 1000 F to 1250 F.

Moisture Separators. During compression to 100 psi, the moisture contained in a given

volume of free air is now confined to a volume of approximately one seventh of its original

size. The compressed volume of air thus contains 100% saturated air plus some additional

amount of water. If we take, for example, a typical compressor found in a nuclear station:

125 HP with a 600 CFM capacity. Operating for one day at ambient conditions of 800 F

and 50% relative humidity, the compressor will produce over eighty gallons of water. The

compressor's aftercooler will condense out a large percentage of the captive moisture

depending upon the outlet conditions. A moisture separator is connected directly to the

aftercooler outlet to remove this condensation from the air stream. Figure A-8 shows a

typical combination of aftercooler and moisture separator. The moisture separator usually is

a vertical tank with a series of internal baffles which deflect the airstream, separating out

any free moisture. Another type of separator may use plates and baffles to spin the air into

a vortex, throwing off free moisture. A third method takes the incoming air into the tanks

tangentially, again spinning the flow to throw out free water radially. Water separated out

collects in a sump at the bottom of the moisture separator where an automatic drain trap

discharges the collected water when it reaches a design level with minimal pressure loss.

Figure A-9 illustrates the basic operation of the most common moisture separators.

Air Receivers. The air receivers are simply compressed air storage tanks. In a nuclear

plant, the total capacity of the receiver tanks and header is designed to meet all the normal

pneumatic demands required to achieve shutdown following loss of power or compressor

failure. Use of a receiver tank allows the compressors to be sized to meet average

pneumatic demand when the baseload compressor(s) are operating in the load/unload mode.

Any short duration sudden or anomalous increases in the demand air system can be readily

accommodated by the reserve of compressed air in the receiver. The air receiver also

dampens out pulsation in the air stream that may result from reciprocating-type

A-7
- o - - --n~10

I

I

+ m ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

LUBE OIL FILTER' s Ii 

T t z + X 1 * t

AIR VNT I@0

OIL MIST AUXILIARY s iELIMINATOR QILPUMPANO

I ~~~~~0DRIVER

OIL RESERVOIR

LEVEL

ALARM

SWITCH AND

INDICATOR

Figure A.7 Compressor Lube Oil System
I.

t'

Figure A-8 Typical Water-Cooled AftercoolerlMoisture Separator

0'9

BAFFLE VORTEX CENTRIFUGAL

Figure A-9 Basic Moisture Separator Types

A-9
compressors. The receiver also allows the compressed air to cool further, condensing out

additional moisture and draining it off before it is carried out into the service air

distribution system. This also reduces the moisture that would have to be removed by the

filter/dryer train before the air is delivered to the instrument air system.

Figure A-10 shows a typical air receiver tank. Overpressure protection is provided by a

pressure relief valve. There is also a local pressure indicator. An automatic drain trap at the

bottom of the tank draws off water accumulated in the bottom of the receiver from moisture

condensing out of the compressed air as it cools. A manual vent-valve may often be

included.

The following sections contain a brief description of the major components in the

filter/dryer train. Figure 2-2 shows the location of each component within the filter/dryer

train.

Prefilters. A prefilter at the inlet of an airdryer protects the dryer from particulates,

moisture, and oil. This is especially important in desiccant-type dryers, where contamination by free water or oil can damage the desiccant beds, and particulates could clog the

beds so reducing efficiency. Prefiltering helps to extend the life of desiccant and assures

that the dryer will operate at top efficiency.

Prefilters are usually coalescing type filters, capable of removing particulates down to

a specified micron size by passing air through a filter medium which also removes oil and

water. Figure A-11 gives a cutaway view of typical mechanical coalescing filter. Air enters

the center of the filter cartridge and passes outward through the filter medium. Particulates

are filtered out in the medium, along with oil and water droplets which collect in the

bottom of the filter enclosure. An automatic drain trap is normally provided to draw off the

collected liquid. Differential pressure monitoring is usually provided across the filter

medium to monitor when it requires replacement.

PRESSURE

RELIEF

VALVE

PRESSURE

OUTLET ~~~~~GAUGE

b;:l e ~INLET

AUTOMATIC

DRAIN

TRAP

Figure A-10 Air Receiver

A-10
Figure A-1l Coalescing Filter

Air Dryers. After passing through an aftercooler and a moisture separator, and having

been cooled further in an air receiver, most of the free moisture in the compressed air

stream has been removed. However, the compressed air still may be 100% saturated. If the

air enters the air system, condensation will occur through the system, resulting in water

contamination and its associated problems. Therefore, the pressure dewpoint, (the temperature at which moisture vapors will condense out at a specified pressure), of the compressed

air must be reduced using an air dryer.

In nuclear plants, two basic types of air dryers used: regenerative or desiccant type

dryers, and refrigerated dryers. The regenerative dryer uses a column of desiccant (silica

gel, activated alumina, or other hygroscopic substance) which adsorbs moisture from the

compressed air as it passes through. Regenerative dryers use a double-chamber (dual tower)

arrangement, so that when air is being dried in one tower, the other may be regenerated by

dry air or heated air flowing through the desiccant. Refrigerated dryers use a standard

refrigeration cycle to physically reduce the dewpoint of the air.

Typical regenerative desiccant dryers are illustrated in Figure A-12. The apparatus on

the left uses a heaterless regeneration cycle, that is, dry or ambient air is forced through the

desiccant bed during regeneration, to carry moisture away. The internally heated unit on

the right, heats the air before it passes through the desiccant, thereby enhancing regeneration. These dryers can achieve pressure dewpoints of -40' F.

Figure A-13 shows the basic flow of air through a dual-tower, internally heated dryer.

The left chamber is in the drying cycle, with compressed air entering the desiccant stack

via the four-way solenoid valve. After leaving the tower, the dry air passes through two

A-l1
0-'

Heaterless type with Prefilter, Afterfilter and filter bypasses installed.

Electric Heated Type Desiccant Dryer with Prefilter,

Afterfilter, and filter by-passes installed.

Figure A-12 Regenerative Desiccant Air Dryers
WET I

BAS * m

INLET

AS SHOWN FLOW DIRECTION IS:

_ LEFT CHAMBER DRYING

ME== RIGHT CHAMBER REGENERATING

SOL. VALVE "'B" DE-ENERIGIZED

SOL. VALVES "A"end "C ENERGIZED

LEGEND

I INLET SWITCHING VALVE

2 INLET SWITCHING VALVE OPERATOR

3 PURGE FLOW CHECK VALVE

4 DESICCANT FILL NOZZLE

5 DESICCANT CHAMBER

6 CHAMBER RELIEF VALVE

7 CHAMBER THERMOMETER

B CHAMBER PRESSURE GAUGE

9 DESICCANT DRAIN NOZZLE

10 DESICCANT SUPPORT

II CLEANABLE OUTLET FILTER

12 PURGE EXHAUST VALVE

13 ELECTRIC HEATER

14 PURGE FLOW ORIFICE

15PURGE INDICATOR

16 PURGE THROTTLING VALVE

I7OUTLET CHECK VALVE

IS PILOT AIRFILTER

19 VISUAL MOISTURE INDICATOR

20 PURGE EXHAUST MUFFLER

21 SERVICE VALVES

22 PREFILTER

23 AUTOMATIC DRAIN VALVE

24 BLOCK AND BYPASS VALVES

25 AFTERFILTER

26 HUMIDITY SENSING ELEMENT

27TEMPERATURE SWITCH

Figure A.13 Operation of a Dual Tower Regenerative Air Dryer with Internal Heater

A-13
parallel after-filters before being delivered to the instrument air system. Simultaneously, a

small portion of the dried air is drawn off via the purge-throttling valve V6, and directed

upward through the internal heater in the right chamber. The hot, dry, purge gas then passes

downward through the right desiccant bed, regenerating the desiccant by carrying away

moisture with it before being vented to the atmosphere. The heater is shut down at the end

of the cycle, while the flow continues a little longer to cool the desiccant.

Refrigerated air dryers depend on physical cooling of the compressed air by a

refrigeration cycle. Examples of two commonly used processes are shown schematically in

Figure A-14. The direct expansion cycle employs a refrigerant-to-air cooling process to

depress dewpoints down to 350 F. The refrigeration condenser may be either air or water

cooled. The second type is the water-chiller process using refrigerant vapor-to-water-to-air

cooling. The water-chiller is a heat exchanger which cools a mass of water via a

refrigeration process. The compressed air is, in turn, cooled in another heat exchanger to

dewpoints of approximately 500 F.

Instrumentation and Controls. For the most part the instrumentation and controls for

the instrument air system and service air system are situated locally at the components.

Although some plants can control compressors from the main control room, most are

locally controlled. Selection of "lead," "backup," and "standby" function in typical automatic control schemes allows the machines to come on automatically in response to system

demand. Compressors may have to be stopped manually, however.

Typical control room instrumentation will include compressor motor ammeters, IA

header pressure, SA header pressure, compressor status (running, stopped, tripped), and IAto-SA crosstie valve status. Control rooms may have alarms for the following parameters:

compressor trouble, dryer trouble, startup of backup or standby compressor, and low IA

header pressure.

Local compressor controls include manual/auto start controls, "lead," "backup,"

standby selector switches, lubricating oil pump and heater controls, main power switch, trip

reset, and alarm resets. Local compressor indicators typically include compressor status

lights, lube-oil pump and heater status lights, and power on.

Parameters such as high intercooler temperature, vibration, surge condition (centrifugal compressors), low lubricating oil pressure, high bearing- or lube-oil-temperature, drive

motor protective relaying overload devices, low cooling water flow, high discharge

WET AIR IN- -DRY AIR oIur

REFRIGERANT TO AIR PRECOOLER/REHEATER

EXCHANGER WET AIR IN

SEPARATOR

A~jO 0 a l e WHEAtI 

-~~~ k DRAIN WTRT I

COMPRESSOR CONDENSER COMPRESSOR

Figure A-14 Typical Refrigerated Dryer Processes

A-14
temperature, and low bus voltage are usually monitored to trip and alarm in the control

room. The control of auxiliary lube-oil pumps is based on oil pressure and heater status

(and seal-air pressure for centrifugal compressors). Lube-oil heaters are controlled by

temperature and oil level. Problems in the lube oil system are usually designed to

annunciate a "compressor trouble" alarm.

Automatic drain traps are provided on intercoolers air receivers, aftercooler/moisture

separators, pre-filters, and wherever accumulations of condensed moisture and oil might

occur. These traps may be solenoid valves controlled by level, or mechanical float

arrangements.

Air dryers, like compressors, typically are controlled locally, rather than from the main

control room. These units generally have only status indication in the control room, along

with a general "dryer trouble" annunciator. Local controls include the main power switch,

and manual/auto selection of regeneration cycle. High discharge humidity, regeneration

switching failure, desiccant over-temperature, high differential pressure or low flow parameters are monitored and will annunciate a 'dryer trouble" condition in the control room.

Differential pressure is monitored locally for inlet air filters, pre- and after-filters, and

desiccant chambers; this will monitor dirty filter elements or other clogging or blockage of

flow.

The SA-to-IA crossconnect valve in most nuclear plants is an automatic valve

controlled by system header pressure. In the Type I air system, (Figure A-16), low IA

header pressure causes the valve to close, isolating service air loads and reserving all

compressed air for instrument air loads. In the Type II system (Figure A-17), low IA header

pressure causes the valve to open, connecting the capacity of the service air compressors to

the IA system to serve as a backup. A second, lower, pressure setpoint may then cause

closure of another automatic pressure-controlled valve to isolate the service air system if IA

pressure continues to drop.

A.2 FSAR Survey of Compressed Air Systems

Due to the wide variations in the design of compressed air system from one nuclear

plant to the next, and the importance of design in the performance of the system, we

performed a detailed design review for compressed air systems in a sample of nuclear

stations.

This review was important to the NPAR study, because it allowed BNL to understand

the characteristics of instrument and service air systems, aided in analysing system failures,

and provided the population data necessary for normalizing the failure data. It also

provided valuable insights into design. Therefore, we first established the basic information

needed and then developed a form to be completed for each plant reviewed.

The reviews were generally made using the plant's Final Safety Analysis Report

(FSAR), in most of which, the compressed air systems are treated as an auxiliary system.

The importance of instrument and control air to nuclear plant safety varies from plant to

plant because of the differences in individual design of power station. Therefore, the level

of detail and content of FSAR sections describing compressed air systems are varied. Some

provide very precise, detailed system descriptions of all plant compressed air systems,

A-15
including instrument air, service air, breathing air, and any other miscellaneous compressed

air systems, along with comprehensive safety evaluations and outlines of test programs.

Some stations do not have any description of their compressed air systems. Most power

stations have sections covering their air systems that fall somewhere between these two

extremes, depending upon the importance of the compressed air systems to that plant's

safety.

Whenever possible, the FSAR descriptions were supplemented by other information

sources. Some of these included system descriptions, lesson plans, the Nuclear Plan

Reliability Data System, other reports and studies on instrument and service air systems,

and discussions with plant personnel.

A.2.1 Summary of Design Review

The survey forms for each plant in the review were completed using the information

found in the FSARs and other documentation. Figure A-15 shows a completed survey form

for the Shorehamn Nuclear Power Station, a single-unit BWR. After the reviews were

completed, they were summarized into two groups: PWR's and BWR's. Table A-1 shows

the summary for PWR's and Table A-2 the summary of the BWR plants.

The variations in the nomenclature describing the instrument and service air systems at

different nuclear plants was discussed in Table 2-1.

A.2.2 Arrangements of the Compressed Air Supply

The compressed air systems in nuclear power stations can be grouped into two basic

categories, based upon the supply-train designations. The Type I arrangement consists of

twc or more instrument air compressors supplying both the plant service air header and the

instrument air header via a filter/dryer train. The Type II supply arrangement is made up of

one or more instrument air compressors feeding the instrument air header, along with one

or more separate service air compressors supplying the service air headers.

Figure A-16 depicts a simplified schematic of the Type I supply configuration,

consisting of at least two 100%-capacity instrument air compressors sucking air from the

atmosphere via an intake air filter/silencer. One compressor runs continuously in the load/

unload mode, with the second on automatic standby should instrument air header pressure

drop to a preset level. Additional compressors act as automatic standby units in case the

system header pressure drops further, or as manually controlled backup units. Each

compressor discharges through its own aftercooler and moisture separator, and then

through a check valve into an air receiver tank. There may be one air receiver per

compressor, with the discharge from each tank feeding a common air header as shown in

Figure A-16, or all of the compressors may discharge directly to a single manifold, to

which one or more receiver tanks are connected. At least one branch leaving the air

receiver header passes through one or more parallel filter/dryer trains to remove moisture,

oil, and particles from the air stream. This clean, dry, filtered, oil-free air is routed to the

instrument air distribution system for pneumatic control and instrumentation usage. One or

more additional branches feeding from the air receiver header is routed directly to the

service air distribution system to supply maintenance service, and process pneumatic loads.

In some plants, the service air may be passed through a filter before entering the

distribution system.

A-16
Plant ...... Shoreham

No. of Units ...... 1

Unit .. 1 Type ...... BWR (GE)

No. Air Systems per Unit ........ 1 IA, 1 SA

Source ..... FSAR 9.3.1

NE ..... S & W

Compressors: # Press Capacity HP # Stages Cooling Oil Free Mfg. Power Configuration

Centrifugal LA Turb. Bldg. yes I~~~~~~~~~~~ Contin, Centrifugal IA 3 125 1353 450 3 Turb. Bldg. Yes Elliot Norm 1 Auto B/U

1 Secndry Bl/U

Receivers:

IAJ

SA| 3

Size

400 ft3

Capacity on Loss of Compressors

Sufficient for Safe S/D upon Loss Air

Dryers: No. 1 Dual Tower

Mfg. Pall Trinity Micro Corp.

Type Dual Tower, Desiccant. Electric Heat Regenerated

Dew Pt. Spec. - 40*F @ 100 psig

Filters: Size 100% @ 3 jum, 98% @ 1.5 lrm

CrossConnects:

Loads:

No. parallel pre-filters, parallel

after-filters

Mfg. Pall Trinity Micro Corp.

(both pre & after)

Unit N/A IA/SA Yes

IA

SA

AOV's & Pneumatic Instr. & Controls

RBSVS/CRAC Chilled Water Head Tanks, Main Chiller Head Tank, MJV & Cond.

Demins., RW Processing Tanks, RW Filters, RW Cement Silo Eqpt., Prim. Cont. Atmospheric Purge, Fuel Prep. Machines, General Maintenance & Service Useage

Notes: IA compressors located in turb. bldg. N2 used in compressed air system piping within inerted

containment. MSIV's, Main Steam Relief Valves, Scram Valves, Scram Volume Vent. & Drain

Valves required for safe shutdown. IA to primary containment isolates on CS initiation. Instrument & Service Air System: Instr. Air Sys. & Svc. Air Sys.

Instrumentation: Indication

Compressor Amps

Compr. Air Header Press

Instr. Air Header Press

Compr. Status Lites

Alarms

Air System Pressure Lo

Stdby. Compr. Auto Start

Excess Vibration @ Comprs.

Interlocks

SA isolates upon lo

press. <95 psig

rwice Air

(SA)

Protfl eln

Figure A-IS Compressed Air System Summary

A-17
Table A-1 Compressed Air System Summaries-Pressurized Water Reactors

Reactor Compressors Receivers Filter/Dryer

Plant A/E Supplier IA SA Misc EDG IA SA Trains

Arkansas Nuclear

One-I

Arkansas Nuclear

One-2

Callaway

Calvert Cliffs-I

Calvert Cliffs-2

Bechtel

Bechtel

Bechtel

Bechtel

Bechtel

B&W 3 2 2-1/2 3 1

CE

W

CE

CE

2 1 2-1/2 4 2 1

3

2

0

1

4

2

3

2

0

1

SA backs up IA via check

valve

Dedicated Breathing Air;

Air Pallet Compr shared

1 SA crossconnect to Unit 1;

Breathing Air backs up IA;

Air Pallet Compr shared w/

Unit 1 for RW/SA

1

1 NC manual crossconnect of

Plant Air

1 NC manual crossconnect of

Plant Air

2 SA backs up IA via oil removal filters

2 SA backs up IA via oil removal filters

1

2 1 1 2 1

00

Catawba- I

Catawba-2

Crystal River

Davis-Besse

D.C. Cook-I

D.C. Cook-2

Diablo Canyon-i

Diablo Canyon-2

Farley- 1

Farley-2

Ft. Calhoun

Ginna

Maine Yankee

Duke Pwr.

Duke Pwr.

Gilbert

Bechtel

AEPSC

AEPSC

PG&E Co.

PG&E Co.

SCSI/Bechtel

SCSI/Bechtel

G&H

Gilbert

S&W

W 1-1/2 1 1 5 1-1/2 1

W 1-1/2 1 1 6 1-1/2 1

B&W

B&W

W

2

1

1

2

2

I

2

7

2

1

2

2

W 1 I

W 2 0

W 2 0

6 1 1 1 PA shared; CA N.C.

crossconnect

4 1 1 1 PA shared; CA N.C.

crossconnect

6 1 1 1/2 SA isolates upon low IA

pressure

4 1 1 1/2 SA isolates upon low IA

pressure

I NC SA crossconnect

1 NC SA crossconnect

W

W

CE

W

CE

4

4

3

3

3

0

0

0

1

0

8 4

2 4

5 1

3

2 2 2

0

0

1

1

0

1

2

2

SA backs up IA

Separate Containment IA

System & EFCV Air
Table A-1 Compressed Air System Summaries-Pressurized Water Reactors (Continued)

Reactor Compressors Receivers Filter/Dryer

Plant A/E Supplier IA SA Misc EDG IA SA Trains

'0

McGuire-1

McGuire-2

Oconee-l

Oconee-2

Oconee-3

Prairie Island-l

Prairie Island-2

Salem-1

Salem-2

Sequoyah-1

Sequoyah-2

Surry-I

Surry-2

Turkey Pt.-3

Turkey Pt.-4

Waterford-3

Zion-l

Zion-2

Duke Pwr.

Duke Pwr.

Duke/Bechtel

Duke/Bechtel

Duke/Bechtel

Fluor

Floor

PSE&G

PSE&G

TVA

TVA

S&W

S&W

Bechtel

Bechtel

Ebasco

S&L

S&L

W

W

B&W

B&W

B&W

W

W

W

1-1/2

1-1/2

1

1

1

1-1/2

1-1/2

1-1/2

1

1

1

1

1

0

0

1

1

4

2

1-1/2 1 2 SA backs up IA via filters;

Shared IA/SA; HPSA

1-1/2 1 2 SA backs up IA via filters;

Shared IA/SA; HPSA

1 1/3 1-1/3 Shared IA/SA; SA backs up

IA;

1 1/3 1-1/3 Shared IA/SA; SA backs up

IA;

1 1/3 1-1/3 Shared IA/SA; SA backs up

IA; Diesel SA Con

1-1/2 0 Shared IA/SA

1-1/2 0 Shared IA/SA

3(4) 1 1(1) Separate Control Air Sys;

SA & CA crossconnects to

Unit 2

3(4) 1 1(1) Separate Control Air Sys;

SA & CA crossconnects to

Unit I

1(1) 1/2 2-1/2 Separate Aux CA Sys;

Shared IA/SA

1(1) 1/2 2-1/2 Separate Aux CA Sys;

Shared IA/SA

1 1-1/2 1(1) Separate Containment IA

Sys; Shared SA

1 1-1/2 1(1) Separate Containment IA

Sys; Shared SA

W 1-1/2

W

W

W

W

W

W

CE

W

W

2

2

1

1

2

2

2

1-1/2

1-1/2

0

0

1-1/2

1-1/2

1

1

2

2

6

8

4

2

2

4

6

2

1-1/2

1-1/2

1

1

1-1/2

1-1/2

1

1

1

1

1

1-1/2

1-1/2

Shared SAIA

Shared SA/IA
Table A-2 Compressed Air System Summaries-Boiling Water Reactors

Reactor Compressors Receivers Filter/Dryer

Plant IA SA Misc EDG IA SA Trains Comments

Arnold

Brown's Ferry-I

Brown's Ferry-2

Brown's Ferry-3

Brunswick- I

Brunswick-2

Cooper

Dresden- I

Dresden-2

Dresden-3

Fermi-2

Fitzpatrick

Grand Gulf-I

Grand Gulf-2

Hatch- I

Hatch-2

A/E

Bechtel

TVA

TVA

TVA

UE&C

UE&C

Burns & Roe

Bechtel

S&L

S&L

Detroit Ed. Co.

S&W

Bechtel

Bechtel

SS/Bechtel

SS/Bechtel

Supplier

GE

GE

GE

GE

GE

GE

GE

GE

GE

GE

GE

GE

GE

GE

GE

GE

3

1-1/3

1-1/3

1-1/3

3

3

3

t0

2

2

2

3

1

1

3

3

2/3

2/3

2/3

i

1

0

1

1

3

0

1/2

1/2

2

1

2-1/2

2-1/2

3

2

2

2

2

2-1/2

2-1/2

4

9

2

1-1/3 2/3

1-1/3 2/3

1-1/3 2/3

3 1

3 1

2 0

1

1-1/3

1-1/3

1-1/3

2

2

1

2

2

2

1

1

1

2

2

2

2

2

3

1

I

3

3

1-1/2

1-1/2

2

0

i

1

2

Compressed Nitrogen System for containment

Shared IA & SA; separate

Drywell CA System

Shared IA & SA; separate

Drywell CA System

Shared IA & SA; separate

Drywell CA System

Crossconnect to other unit

at receiver manifold

Crossconnect to other unit

at receiver manifold

SA crossconnects to other

units

SA crossconnects to other

units

SA crossconnects to other

units

Redundant noninterruptible

CA

N2 supplied to drywell via

IA system

Shared SA; 2 booster compressors for ADS

Shared SA; 2 booster compressors for ADS

Lo Press. Blwr, SA

crossconnect to Unit 2

2 Lo Press. Blwrs; SA

crossconnect to Unit I

4

LaSalle- I S&L GE 3 0 2 7 2-1/2 1 1-1/2 SA crossconnect to Unit 2;

Separate Drywell IA system
Table A-2 Compressed Air System Summaries-Boiling Water Reactors (Continued)

Reactor Compressors Receivers Filter/Dryer

Plant A/E Supplier IA SA Misc EDG IA SA Trains Comments

LaSalle-2

Limerick-l

Limerick-2

Millstone-i

S&L

Bechtel

Bechtel

Ebasco

GE

GE

GE

GE

3 0 2 4 2-1/2 1 1-1/2 SA crossconnect to Unit 1;

Separate Drywell IA system

2 1 1 8 2 1 2 SA crossconnect to Unit 2;

Separate Drywell IA system

2 1 1 2 1 2 SA crossconnect to Unit 1;

Separate Drywell IA system

1 1 2 3 1 1 1 2 Sparging Air Blwrs for

Rad waste

4

t%)

Nine Mile Pt.-I

Nine Mile Pt.-2

Peach Bottom-2

Peach Bottom-3

Shoreham

Susquehanna-1

Susquehanna-2

Niagara Mohawk

S&W

Bechtel

Bechtel

S&W

Bechtel

Bechtel

GE

GE

GE

GE

GE

GE

3

3

0

1/2

5

1 4

1

4

3

1-1/2

3 1/2 1 4 1-1/2

I Separate RW Sys.; Shared

B/U SA Compr, IA/SA

crossconnects

1 Separate RW Sys.; Shared

B/U SA Compr, IA/SA

crossconnects

I

GE

3

2

0

2

0

2,1,1/2

6 3 0

2 2 2,1,1/2

2 2 2(2) IA/SA crossconnects to Unit

2; RW Lo Pres Air, Intake

Structure CA; Cont. Instr

Gas Sys

2 2 2(2) IA/SA crossconnects to Unit

1; RW Lo Pres Air, Intake

Structure CA; Cont. Instr

Gas Sys

Vermont Yankee Ebasco GE 3 0 22 2(1) 2(1) R Bldg I&SA System
Figure A-16 Simplified Schematic of Compressed Air System with Multiple IA Compressors with

Tap Off to Service Air System

The Type II general configuration consists of one or more instrument air compressors

supplying the control and instrument air system, together with one or more service air

compressors feeding a separate service air system. Both types of compressors draw air in

from the atmosphere through an inlet filter/silencer, pass the discharge air through an

aftercooler/moisture separator, and send the compressed air via a check valve into one or

more air receivers. As shown in Figure A-17, the Type II configuration compressors may

feed directly into an air receiver for each unit or feed a common header to which one or

more air receivers are connected. As discussed in the previous section, the air to be sent

through the instrument air system must first be conditioned and cleaned by passage through

a filter/dryer train. The service air passes directly to the service air system from the service

air receiver/header. In some plants, the service air is filtered before distribution to remove

particulate and moisture/oil contaminants (Figure A-17).

In the Type I configuration, the service air system is supplied from the instrument air

compressors. The instrument air loads are more critical to plant operation and safety than

the service air loads. Therefore, when high demand, other excessive use, compressor

failures, or leakage of instrument air cause the instrument air header pressure to drop below

a critical design setpoint pressure, the isolation valve feeding the service air supply system

closes automatically, so conserving the supply of compressed air to feed the pneumatic

controls and instrumentation essential to plant operation.

In the Type II configuration, the service air system and the instrument air system have

their own dedicated compressors as their source of compressed air, (Figure A-17). In this

compressed air system, the service air compressors serve as a backup source for the

A-22
Figure A.17 Simplified Schematic of Compressed Air System with Separate IA Compressors and

Plant Air (Service Air) Compressors

instrument air system. The piping is arranged so that upon low instrument air header

pressure, the intertie valve between the service and instrument air systems will automatically open. Service air will then be supplied via a checkvalve (to prevent loss of air out of

the instrument air system) to the instrument air header upstream from the filter/dryer train.

In the example shown in Figure A-17, notice that the service air filters are so arranged that

only prefiltered service air is permitted to enter the instrument air portion of the system.

Another feature of the illustrated configuration is the automatic service air isolation valve

which isolates the service air system should pressure continue to drop in the instrument air

header. Then both instrument air compressors and the service air compressor would all be

aligned to serve the instrument air system only.

A desireable feature in the instrument air system of Figure A-17, is the parallel prefilter and after-filter set up. This allows one filter to be maintained while the other remains

in service without interrupting the air supply. A weak point in this design is the use of a

single air dryer unit. The design in Figure A-16 uses parallel filter/dryer trains rather than

parallel filters only, providing a redundant dual-tower dryer; however, the entire train must

be taken out of service during maintenance outages for any component in the train. Another

undesireable feature in this design (Figure A-16) is the automatic bypass line around the

filter/dryer trains, which allows unconditioned air to be supplied directly to the instrument

air system if that no filter/dryer trains are in service. Unfortunately, once the contaminants

which are inevitably present in unconditioned air have been introduced into the instrument

air system, they will cause problems for some time to come.

A-23
A.2.3 Compressed Air Systems at Multiple Unit Nuclear Sites

Most of the multiple-unit nuclear plants in the FSAR review had compressed air

systems made up from the basic configuration types discussed in the previous section. We

encountered two approaches to providing compressed air to multiple reactor nuclear

stations. The first design uses a separate compressed air system for each unit, independent

from the other units, save for a cross-connect valve (usually a locked-closed manual valve)

between service air systems. The second approach has one large, multiple redundant

component compressed air system shared among all the reactor units at a site.

In the first method, with independent air systems, each individual unit's compressors

and associated equipment usually have with sufficient capacity to handle the demand for

compressed air for normal shutdown of both units. The cross-connect valve between the

service air systems of each unit air would only be opened when one unit's compressed air

system was out of service or unable to meet its pneumatic demand. The instrument air

systems in the units reviewed very rarely provided any direct cross-unit interties in their

design. The instrument air supply to essential pneumatic controls and instrumentation is too

critical to risk jeopardizing adequate capacity to both units should an intertie be erroneously opened. Examples of independent systems with service air cross-connect valves to

other units are shown in Figures A-16 and A-17.

Multiple reactor plants with shared compressed air systems typically employ multiple

redundant compressors and supply trains, and multiple redundant filter/dryer trains to

assure high availability. The distribution arrangements are normally designed to allow

individual sections to be isolated for maintenance without affecting the supply of air to

other portions of the system. Ring header arrangements are frequently used to provide

better availability of the compressed air supply. The multiple compressors are usually

powered from the electrical systems of different units providing greater assurance that one

compressor source will always operate.

A potential drawback of the concept of a single compressed air system shared among

multiple units is that a major failure in the compressed air system would possibly cause the

loss of pressure to all units. This event would be especially troublesome in BWRs where

loss of air pressure allows the scram pilot valves to open, causing a reactor scram. For this

reason most multiple reactor BWR's do not use the shared compressed air system design.

Interestingly, of the three shared air system BWR sites in this FSAR review (Browns Ferry,

Grand Gulf, and La Salle), all were mentioned in H.L. Ornstein's NUREG 1275 as having

experienced air system malfunctions that resulted in multi-unit reactor scrams.

A.3 Special Purpose and Auxiliary Compressed Air Systems at Nuclear Plants

At many nuclear power stations, there are additional special purpose or auxiliary

compressed air systems independent of the main station instrument and service air systems.

These systems may be high-quality, high-pressure, specific-use systems, such as emergency

diesel generator starting air or primary containment instrument gas. Others may be lower

quality, low-pressure, high-volume systems, such as radwaste compressed air designed

specifically for radwaste processing. Some systems for pneumatic supply are remotely

located, point-of-use systems. Some have specific uses, independent of the main compressed air systems, to avoid the possibility of contamination or water being introduced

A-24
back into the main system. Several of the most common auxiliary air systems encountered

in the design review are discussed in the following sections.

A.3.l Emergency Diesel Generator Starting Air

Each emergency diesel generator has its own separate air starting system designed to

start the diesel engine without external power, while meeting the single-failure design

criterion. (Diesel-driven ECCS pumps such as the HPCS at River Bend Nuclear Station will

have similar safety-related diesel air-start systems.) A typical flow diagram is shown in

Figure A-18. There are two separate trains for each diesel engine complete with compressors, aftercooler/moisture separators, dryers, two receiver tanks per train, and associated

injection lines, valves, and cranking devices. The air receivers and the piping and valves

from the tanks to the air start distributors are normally considered safety-related components, and are designed to ASME Boiler and Pressure Vessel Code, Section III, Code Class

3. The air receiver is usually sized to permit five starts and acceleration-to-load within 10

seconds. All other parts of the system are typically designed to the manufacturer's

standards and Seismic Category I requirements.

A schematic of the diesel air start system in Figure A-19 illustrates the pneumatic

supply for starting. Air from the receivers is admitted to the system through quick-acting

solenoid valves. Pilot air opens the main starting control valve, thereby pressurizing the

main starting air manifold to all cylinder air-start check-valves. A second pilot air-line to

the air-start distributor is pressurized. The air distributor admits pilot air to the air-start

check-valves in firing-order-sequence to open the valves during part of the power stroke for

each cylinder, admitting compressed air from the main air-start manifold to the cylinder at

Figure A-18 Flow Diagram of Diesel Generator Engine Starting Air System

A-25
OIL FROM

OVERSPEED GOVERNOR

3-WAY

SOLENOID

STOP VALVE

CONTROL

k AIR

Figure A-19 Air Start System

A-26
the proper time to rotate the engine. The air-start check-valves function as pilot-actuated

admission valves until the cylinder begins firing, then they remain closed.

The compressed air supply train in a diesel air-start system is simply a scaled-down

version of the supply train for the plant main instrument and service air systems.

A.3.2 Containment or Drywell Instrument Air

Containment or drywell instrument air systems are often included in nuclear plant

designs to provide a separate, highly reliable source of compressed gas to pneumatic loads

within the containment. These systems usually are located in the reactor building and take

suction from the containment atmosphere via a containment penetration, and return the

compressed gas to the containment instrument air headers through another penetration.

Figure A-20 shows a containment instrument gas system that is commonly used. There

are two completely redundant trains, powered from separate electrical buses. The system

takes its suction through an inlet screen from the containment's atmosphere, which, in the

case of BWR's, is usually nitrogen. This gas is then compressed, cooled, dried, and filtered

before being fed back into the containment control air headers. This closed-cycle arrangement effectively eliminates the buildup of containment pressure from the operation of

pneumatic equipment inside the drywell, and prevents dilution of the inerted nitrogen

atmosphere. Air receivers are usually sized to provide sufficient instrument gas pressure to

control and operate pneumatic devices in the containment. Each of the redundant trains will

supply compressed gas to its respective redundant gas header. The system is often provided

with a backup source of compressed air in the form of intertie connections to the plant

instrument air system.

Pneumatically operated valves which have a safety-related function are either designed

to fail in the safe position upon loss of pressure, or are provided with local seismic

Category I air accumulators. In BWR's this provision applies to the ADS valves. When

pressure in the containment gas system is low, backup gas bottles are provided for ADS.

All penetrations of the gas system into the containment have isolation valves, which

may be check valves, air-operated valves, or motor-operated valves. The operation of the

isolation valves on receiving a signal to isolate the containment varies slightly from plant

to plant. The valves may close initially and then be opened manually later on when

accumulators require recharging. Another approach is to isolate all instrument gas lines

into the containment except for the seismic Category I air supply isolation valves so long as

the supply pressure from outside the containment exceeds atmosphere pressure inside the

containment.

Some of the nuclear plants which use a separate containment instrument gas system

are La Salle, Browns Ferry, Limerick, Surry, V.C. Summer, Dresden Units 2 and 3,

Vermont Yankee, and Sequoyah.

A.3.3 Essential or Noninterruptible Instrument Air Systems

Nuclear plant designs which incorporate pneumatic components and devices that must

be operated to achieve a safe shutdown provide accumulators at each required device.

A-27
t%) 00

To

Instrument Gos

Compressor

Train 'B"

Figure A.20 Containment Instrument Gas Simplified Diagram
Often they also may have a distinct safety-related, noninterruptible instrument air system to

assure a continued supply of compressed air to essential shutdown components.

In some cases, this may consist of providing separate redundant power supplies to

existing instrument air supply trains. The portions of the system designated as essential or

noninterruptible are upgraded to seismic Category I quality: redundant distribution piping,

receivers, and valves may be included. Upon decreasing air pressure, service air will be

shed first, followed by the isolation of the non-essential or interruptible portions of the

instrument air system if pressure continues to drop. Some plants use the nitrogen inerting

system as a further backup source of pressurized gas. The Hatch Nuclear Plant and the J.M.

Parley Nuclear Plant have designs with designated non-interruptible sections.

Other designs provide additional separate, redundant compressed air supply trains to

assure a non-interruptible pneumatic supply. These compressors and associated equipment

may supply only a specific system, such as the ADS supply headers and accumulators, the

MSIV's and their accumulators, or the Control Room Air Conditioning equipment. In this

case, the compressed air supply train would be of relatively low capacity. Some noninterruptible instrument air supply trains feed large portions of the instrument air system

both inside and outside the containment. These designs incorporate compressed air supply

trains of relatively high capacity. Sequoyah, Salem, Brunswick, Hatch 2, Fermi, Browns

Perry, Nine Mile Point and Peach Bottom are nuclear plants which have separate noninterruptible compressed air supply trains.

A.3.4 Radwaste Compressed Air Systems

Many nuclear plant designs have a separate compressed air system for radwaste

processing. Radwaste processing requires large volumes of low pressure air for tank

sparging, filter backwashing, transport of substances, filter/demineralizer operation and

backwashing, hydropneumatic pressure, and operation of control valves. The air quality for

most radwaste processing functions is much less restrictive than for areas of the plant

which require instrument air.

Use of a separate compressed air system for the liquid radwaste processing systems

ensures that liquid from the radwaste processes will not be introduced back into the plant

instrument or service air systems. It is also more economical to provide high volume, lowpressure centrifugal compressors or blowers to supply the radwaste pneumatic requirements, rather than meet them with the high pressure, high quality plant instrument and

service air supply trains.

Some plants, such as Peach Bottom Atomic Power Station have a completely separate

radwaste compressed air system with its own compressors and associated aftercoolers,

moisture separators, receivers, and conditioning equipment to feed all or a majority of their

entire radwaste system. Figure A-21 illustrates such a typical system.

Other plants supply the bulk of their compressed air requirements for radwaste processing from the plant service air system, but include a separate low-pressure, high-volume

compressed air blower to feed their equipment with high air consumption, such as the filter/

demineralizers. Pilgrim Nuclear Power Station and Hatch Nuclear Plant use this approach.

The Peach Bottom Atomic Power Station has both a separate radwaste compressed air

supply system and a low pressure blower for the filter demineralizer: Figure A-22

A-29
) w I OF ltr I

T:. ~Fir =Dr Iller Air pertter

To Other RW Proesses At OOESt St

.. l 0, IltS P ........ T I~~~~~~~~~0,6 lwa fb U:: 

Separ~etr

ORI DRI DRW DRW DRW

Figure A-21 Radwaste Compressed Air System
Figure A-22 Low Pressure Air System

depicts a simplified low-pressure blower used in nuclear power plants to supply portions of

the radwaste processing facilities.

A.3.5 Breathing Air Systems

Many plants supply their breathing air systems directly from the plant service air

system, or occasionally from the instrument air system. This air may be further filtered and

conditioned before introducing it into the breathing air distribution system; alternatively,

the final filtering/conditioning may occur locally at individual breathing air stations.

Monitoring of carbon monoxide and supply pressure is provided, with control-room alarms.

The applicable standards for breathing air quality, such as NUREG-0041, regulatory guide

8.15, 10 CFR Part 20, and 30 CFR Part 11 must be satisfied.

Several nuclear plants, such as Arkansas Nuclear One Units 1 and 2, Duane Arnold,

Catawba, McGuire, River Bend, Fitzpatrick, and Sequoyah have a separate, designated,

compressed air system to supply breathing air. Figure A-23 is a typical schematic of a

breathing-air supply system.

These systems are usually redundant compressors with associated conditioning and

filtering equipment. The air provided meets the applicable industry breathing air standards

for quality. The systems are sized to handle some average number of individual breathing

air masks.

A-31
Ak ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~~~~~~~~tqA

C-010O DESK OMan

Figure A-23 Flow Diagram of Breathing Air System

REFERENCES

A.1. "Vacuum and Pressure Systems Handbook," revised edition, Gast Manufacturing

Corporation, 1986.

A.2. "Compressed Air Data Handbook," 15th revised edition, Zurn Industries, Inc., 1985.

A.3. "Plant Air Systems," Limerick Generating Station System Descriptions, Chapter 28,

Philadelphia Electric Co.

A.4. "Instrument and Service Air System," Shoreham Nuclear Power Station System

Description 1020.117, Rev. 3, 7/27/82, Long Island Lighting Co.

A.5. "Water-cooled Aftercoolers, Centrifugal Separators, and Drain Traps," Form 1806-A,

Ingersoll Rand Air Compressors, 1987.

A-32
APPENDIX B

Failure Analysis of The Starting Air Systems of Emergency Diesel Generator

(EDG)
APPENDIX B. FAILURE ANALYSIS OF EDG STARTING AIR SYSTEM

B.I Introduction

The starting air system of diesel generators was analyzed as it is similar to the

instrument air system discussed earlier. The same methods were used as for the instrument

air system, except that this analysis was done at the component level as data was not

available as a system. However, data was available for all major components such as

compressors, filters, air dryers, accumulators and aftercoolers. The only missing data

concerned a few valves and connecting lines. The data source for this analysis was NPRDS.

B.2 Data Analysis

The data was first analyzed for a distribution of component failure. This analysis

showed that of the 655 failure events, 557 were compressor failures and 67 were due to

failure of the air dryer. As the compressors were responsible for more than 85% of the

failures, a separate aging analysis was conducted for them; we found that 71% of the

failures were related to aging while only 15% were non-aging related.

To further investigate the failures, the compressor was analyzed for failures of the subcomponents. The study showed that 41% of the failures were valve-related, and 38% were

due to the compressor's head gasket. These components along with the other subcomponents, are shown in Figure B-1. The large number of compressor failures is not

unusual as the compressor is the only active component in the starting-air system, and is

VALVES

UNLOADER ASSEMBLY

PISTON RINGS

HEAD GASKETS

BELTS

OTHERS

0 50 100 150 200 250

NUMBER OF FAILURES REPORTED

Figure B-1 EDG Starting Air System Compressor Subcomponent Failure -NPRDS

B-l
constantly loading and unloading at high pressure. This constant high pressure may be

responsible for the large number of failures of the head gaskets.

To investigate the reason for the large number of compressor valves and head gasket

failures further, a failure cause analysis was done. The results show that 87% of the failures

occurred as a result of normal service, while only 8% was due to human error.

As the normal service category accounted for 87% of the failures, it was further

broken down to determine the mechanisms involved: we showed that 67% were due to wear

while 1% was due to contamination and calibration drift. The distribution of failure

mechanisms for the entire system is illustrated in Figure B-2.

These failure mechanisms are not unusual as they are common valves and seals which,

in this case, are responsible for the majority of the failed components in the system. Wear,

contamination, and calibration drift were the dominant failure mechanisms for the air

dryers. These results are shown in Figure B-3. A separate failure mechanism analysis was

conducted for the compressor; the results are shown in Figure B4.

A failure-mode analysis was also made for the diesel-generator starting-air system as

was done for the instrument air system. Leakage accounted for 53% of the modes, a finding

that is consistent with the large number of valve and head gasket failures. Loss of function

contributed 12%, while running continuously contributed 8%. These modes are largely due

to compressor cycling and failure to load as a result of relief-valve failures (Figure B-5).

WEAR 60%

M CALIBRATION DRIFT 3%

STICKING/BINDING 4%

VIBRATION 2% N OVERSTRESS/BROKEN 8%

CONTAMINATION 8%

OTHERS 16%

Figure B.2 EDG Starting Air System Failure Mechanisms-NPRDS

B-2
WEAR

CONTAMI NATION

CALIBRATION DRIFT

OVERSTRESS/BROKEN

STICKING/BINDING

OTHERS

0 5 10 1. 20 25

0 5 10 15 20 25

NUMBER OF FAILURES REPORTED

Figure B-3 EDG Air Dryer Failure Mechanisms-NPRDS

30

LEAKAGE

RUNS CONSTANTLY

LOSS OF FUNCTION

DOES NOT START

EXCESS VIBRATION

OTHERS

0 50 100 150 200 250 300 350

NUMBER OF FAILURES REPORTED

Figure 13-4 EDG Compressor Failure Modes-NPRDS

B-3
LEAKAGE I I

WEEMEMMEMIME

RUNS CONSTANTLY

LOSS OF FUNCTION

RUPTURE

EXCESS VIBRATION

DOES NOT START

OTHERS

UNKNOWN

0 50 100 150 200 250 300 350 400

NUMBER OF FAILURES REPORTED

Figure B-5 EDG Failure Modes-NPRDS

Next, a separate analysis was done for the compressors and air dryers which showed

that 47% of the failures were due to leakage, 11% due to loss of function, and 8% to the

compressor running continuously. Figure B-6 shows the failure mode distribution for air

dryers.

The above analysis shows that the compressor is the most outstanding problem with

the diesel-generator starting-air system. Our further analysis showed that the valve and

head gasket are the dominant failure components within the compressors. Among the valve

failures, the compressor relief valves are the most common.

B.3 Failure Rate Analysis

The previous sections presented a qualitative analysis of the failure data which

provided insights into the effect of aging on the various components. This section presents

the results on a quantitative analysis to identify aging effects on failure rates. Our objective

was to determine the effects of aging on component failure rates, and then use these rates to

quantitatively evaluate the aging effect on the instrument air and the diesel generator

starting air system. However, we had insufficient data from the instrument air system so

only the diesel generator starting air system was analyzed.

The objective also was to conduct a failure rate analysis for each component of the

starting air system. As compressor failures accounted for 562 of the 664 system failures the

data for the other components was inadequate for a quantitative analysis. A detailed

analysis was performed to determine the time-dependent failure rates for the compressors.

B-4
LEAKAGE

PLUGGED/CLOGGED

LOSS OF FUNCTION

OVERLOAD TRIP

RUNS CONSTANTLY

UNKNOWN

0 5 10 15 20 25

NUMBER OF FAILURES REPORTED

Figure B-6 EDG Air Dryer Failure Modes-NPRDS

B.3.1 Calculations of Failure Rate

To determine the time-dependent failure rates, we first sorted the data into the number

of failures by age, from 1 to 14 years. This data was then normalized by determining the

compressor population for each plant contributing to the data. The diesel generator

population for each plant was taken from NUREG/CR-2989. We estimated that each diesel

generator had two starting air compressors. Then, assuming the diesel generator population

remained constant over the years, we determine the starting air compressor population for

each plant. The population information, along with the dates each plant started reporting to

the NPRDS, was used to calculate the total number of compressors contributing to the

failure data each year. Assuming these compressors are operating continuously, the failure

rates were calculated from the equation:

li = ni Tj

where,

l= failure rate in time interval i (failure/hr)

n= number of failures in time interval i

T= number of component operating hours in time interval i

i = one year time intervals

It should be noted that the failures rates calculated in this manner are only estimates which

were obtained for the purpose of identifying trends with component age. Figure B-7 shows

the results of the failure rate calculations.

B-5
8

7

6

5

4

3

2

1

0

FAILURE RATE PER HOUR(E-5)

-------------

----- - -------------

- ------------- - - ------------------- - - --------- - -------- - ---------- ---

-------------------------------

1 2 3 4 5 6 7 8 9 10 11

PLANT AGE (YEARS)

12 13 14 15

Figure B-7 EDG Compressor Failure Rate-NPRDS

The failure rate calculated for the first year was unusually high, due to the large

number of head gasket and valve failures in this period. We note that 4 of the 49 plants

were responsible for 67% of the head gasket failures in year 1. Even though the causes of

these head gasket failures were not specified, we presume they were due to installation and

design errors or manufacture defects. It also should be noted that 70% of these head gaskets

came from one manufacturer. The valve failures in the first year were evenly distributed

among the plants and manufacturers. On the other hand, the causes of these failures were

not specified in most cases. We presume that failures also were due to human error.

The graph, with the exception of the seventh year, shows an increase in failure rates

between the third and fourteenth year.

To further investigate the failure rates for diesel generator, failure-rate curves for the

valves and gaskets were drawn to determine their impact on the total failure-rate curves.

These failure rates are shown in Figures B-8 and B-9. Both curves show high rates in the

first year as discussed before.

Even though both curves show a large drop in failure rates in the seventh year, the

drop in head-gasket failures is largely responsible for the decline, as none were reported in

the seventh year.

The head-gasket curve shows a great increase in failure rates between the eighth and

tenth years, then slowly declines for the next three years. This finding could imply that the

compressor head gaskets have a life expectancy of five to six years.

B-6
FAILURE RATE PER HOUR (E-5)

1 .

8

4

2

0

5

2

5

1

i

-I -... -- - - - --_---- -_----

--- ---- I - --- -I

1 2 3 4 5 6 7 8 9 10 11 12 1<

PLANT AGE (YEARS)

Figure B-8 EDG Compressor Gasket Failure Rates-NPRDS

FAILURE RATE PER HOUR (E-6)

3 14

L

1 2 3 4 5 6 7 8 9 10 11

PLANT AGE (YEARS)

Figure B-9 EDG Compressor Valve Failure Rates-NPRDS

12 13

B-7
Although valve failures increase after the seventh year, the entire graph shows no

definite pattern of an increase in failure rates: it varies evenly about the average over the

13-year period.

From the two graphs, we see that compressor head gasket failures are largely

responsible for the increase in compressor failure rates. However, if the head gaskets were

changed every 5 to 6 years, the compressor failure rates could be greatly reduced.

B-8
NRC FORM 335 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER 12-891 fAtlend by NRC Add Vol. Supp. R.v. NRCM iIO2. 8~~~~~~~~~~~~~~~~~~~~~~~~~~~~~nd Addendum Number.. ifen.jt

NRC301.32, BIBLIOGRAPHIC DATA SHEET NUREG/CR-5419

{See instructions on the reverse) BNL-NUREG-52212

2. TITLE AND SUBTITLE

Aging Assessment of Instrument Air Systems in

Nuclear Power Plants 3. DATE REPORT PUBLISHED

MONTH i YEAR

January 1jgs

4. FIN OR GRANT NUMBER

A3270

5. AUTHORIS) 6. TYPE OF REPORT

M. Villaran, R. Fullwood, M. Subudhi

7. PERIOD COVERED Inasior Dates)

U. I~1In MIIn~s UIUNt~~~7TR IU I - I'JIA /IdSC A l U ft A_ NrirtLe o ar~t:__PSI Us.nob_ as eS................. J...:_.-BS_ _C_.... aoV Iswerlg m ,W S. __..asso aoo.................. :a _.___ for __nra ra.

8. PEFt: H1VMINGU UKRGANIZA I IOUN- NAMIZ AND LIAULF JR,:: {I"cpof ACor~vieivislon, ufwrwri Ror Kro, US~ Nxiclar negulory Commission &Mon momailngdress,. II contractor, prol'so.

name end mailing address.)

Brookhaven National Laboratory

Upton, NY 11973

9. SPONSORING ORGANIZATION -NAME AND ADDRESS (I fIVRC. tpe 'One as anove if contractor provide NRC Divition. Office or egion. U.S NuclearRegultoryvCommiw-on.

and mailing address.)

Division of Engineering

Office of Nuclear Regulatory Research

U. S. Nuclear Regulatory Commission

Washington, DC 20555

10. SUPPLEMENTARY NOTES

I11. ABSTRACT (200 words or less)

NRC Generic Issue 43, "Contamination of Instrument Air Lines", has been unresolved since

1980. The potential seriousness of this issue was reinforced in a 1987 study by the Office

for Analysis and Evaluation of Operational Data. Aging of components within compressed air

systems, leading to degraded function of the system, is the subject of this study. This

work was performed under the auspices of the NRC's Office of Nuclear Regulatory Research

as part of the Nuclear Plant Aging Research (NPAR) Program. The objective of this study

was to identify all the aging modes and their causes, which should be mitigated to achieve

a reliable operation of all safety-related air equipment. Also included is an interim

review of typical maintenance activities for air systems in the nuclear power industry.

The Phase 2 effort of this study will make recommendations for developing an effective

maintenance program industry-wide to counter the effects of aging. The analysis of

operating experience data revealed that aging degradation occurs in the compressed air

system, and becomes a factor as the system ages. Normal wear of the system and contamination of the air dominate the problems of system failure. Existing maintenance programs

within the industry lack uniformity, and quality assurance is not rigorous because the

system is classified as non-safety.

12. KEY WORDS/DESCRIPTORS (List words or phrases that will assist researchers In locating the repot.-) 13. AVAILABILITY STATEMENT

unlimited

reactor components air flow 14. SECURITY CLASSIFICATION

aging compressed air (This Pae)

failures risk assessment unclassified

reliability nuclear power plants (Thi Reporn

system failure analysis reactor protection systems unclassified

failure mode analysis water cooled reactors 1S. NUMBER OF PAGES

reactor maintenance water moderated reactors

reactor operation reactor instrumentation 16.PRICE

NRC FORM 335 (2491
UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555

OFFICIAL BUSINESS

PENALTY FOR PRIVATE USE, $300

SPECIAL FOURTH-CLASS RATE POSTAGE & FEES PAID USNRC

PERMIT No. G-6