UNITED STATES

NUCLEAR REGULATORY COMMISSION

OFFICE OF NUCLEAR REACTOR REGULATION

WASHINGTON, DC 20555-0001

October 15, 2002

NRC INFORMATION NOTICE 2002-29: RECENT DESIGN PROBLEMS IN SAFETY

FUNCTIONS OF PNEUMATIC SYSTEMS

Addressees

All holders of operating licenses or construction permits for nuclear power reactors.

Purpose

The U.S. Nuclear Regulatory Commission (NRC) is issuing this information notice to inform

addressees of recent occasions when the controls or designs of safety-related systems

incorporating non-safety-related air-operated controls was less than adequate. It is expected

that recipients will review the information for applicability to their facilities and consider actions,

as appropriate, to avoid similar problems. However, suggestions in this information notice are

not NRC requirements; therefore, no specific action or written response is required.

Description of Circumstances

Point Beach

On November 29, 2001, the licensee identified a potential common mode failure of the auxiliary

feedwater (AFW) system upon a loss of instrument air (Event Notification 38525). Specifically,

a loss of instrument air would cause the AFW minimum flow recirculation valves to fail closed. 

At the time, there were no backup air or nitrogen accumulators associated with these specific

valves. If the discharge or flow control valves for the AFW pumps had been throttled or closed

while the minimum flow recirculation valves were also closed, the AFW pumps would have been

placed in a condition of insufficient flow. This could have resulted in pump damage in a short

interval of time (Licensee Event Report 50-266/2001-05). The licensee also identified that early

in the post-reactor trip emergency operating procedures, the operators were directed to control

the AFW system flow without specific written guidance to maintain minimum AFW flow. The

plant operators were directed to control flow to the steam generators to maintain desired level

and to prevent overcooling of the reactor coolant system. The AFW minimum flow recirculation

valves are air-operated. Without the short-term recovery of instrument air (within less than 10

minutes), the AFW minimum flow recirculation valves would fail closed, potentially damaging

the AFW pumps and causing the loss of secondary heat removal capability.

ML022830036
IN 2002-29

Page 2 of 4

There was no indication of recirculation flow available to operators in the control room. Heat

removal capability through primary system feed and bleed would also be adversely affected

since instrument air is required to operate the pressurizer power-operated relief valves and

nitrogen backup was not available. A loss of instrument air would cause a loss of normal

feedwater flow and would initiate a dual-unit reactor trip.

In addition, other initiating events, e.g., fire or loss of off-site power, may produce similar

vulnerabilities. The licensee’s corrective actions included prompt operator training, changes to

the emergency operating procedures, and the addition of back-up pneumatic supplies for the

AFW pump minimum flow recirculation valves. 

On April 3, 2002, the NRC issued Special Inspection Report 50-266/01-17. The agency

determined that the issue has high safety significance because a common-mode failure of the

auxiliary feedwater pumps would result in substantially reduced mitigation capability for safely

shutting down the plant in response to certain transients. The significance was determined to

be high largely due to the relatively high initiating event frequencies associated with the

involved transients and the high likelihood of improper operator actions due to the procedural

inadequacies.

Previous related generic communications that could have provided for earlier identification of

the condition included: Generic Letter 81-14, “Seismic Qualifications for Auxiliary Feedwater

Systems,” and Generic Letter 88-14, “Instrument Air Supply System Problems Affecting SafetyRelated Equipment.” Other opportunities for prior identification of the condition included the

licensees response to the Station Blackout Rule, 10 CFR 50.63, and its evaluation in response

to Generic Letter 88-02, “Individual Plant Examination for Severe Accident Vulnerabilities.”

San Onofre

On May 3, 2000, the San Onofre licensee reported that air trip valves for pneumatic actuators

of saltwater cooling pump discharge valves were leaking a small amount of air. The accident

analyses for both units implicitly assume that essential valves such as these discharge valves

remain in the post-accident open position until intentionally realigned by plant personnel (Event

Notification 36980). The pneumatic actuators receive their air supply from the nonsafety-related instrument air system, which would not be available following a loss of offsite

power. The actuator vendor indicated that under such conditions, the actuator accumulators
IN 2002-29

Page 3 of 4

would gradually lose pressure and would not hold these valves in the safety-related open

positions. The licensee recognized that hydrodynamic forces inside the pipes could cause

these valves to close. Because these valves do not have manual hand wheels and it may take

some time for operators to diagnose this condition, restore instrument air, and reopen the

valves, the licensee declared the valves inoperable until they were blocked open.

A similar condition exists for the pneumatic actuator for the component cooling water outlet

valves for the shutdown cooling heat exchangers. The licensee restored operability to these

valves by engaging manual hand wheels to lock the valves.

Indian Point

On February 4, 2000, the Indian Point licensee questioned the sufficiency of its designed 30-

minute nitrogen backup supply for control of auxiliary feedwater flow control valves, the turbinedriven auxiliary feedwater pump, and the atmospheric steam dump valves (Event Notification

36660). The licensee later concluded that the nitrogen backup system does meet the 30-

minute requirement and retracted its report.

Duane Arnold

On February 14, 2000, the Duane Arnold licensee reported that the air-operated valves for

containment nitrogen makeup for the torus and drywell are not capable of closing during a

design basis accident (Event Notification 36689). The spring closing force may not be large

enough to close any of these valves when containment pressure is maximum. After testing the

valves and reviewing the analytical margins, the licensee concluded that the valves could

perform their containment isolation function and retracted its report.

Discussion

The NRC has had a long-standing concern with the problems discussed here. Failure of a

nonsafety-related pneumatic system can affect one or more safety-related systems, sometimes

in subtle ways. In the cases discussed here, loss of instrument air or nitrogen could lead to loss

of control of valves important to accident recovery, which could in turn result in pump damage,

loss of cooling capability, or loss of environmental control.
IN 2002-29

Page 4 of 4

This information notice requires no specific action or written response. If you have any

questions about the information in this notice, please contact the technical contact listed below

or the appropriate project manager from the NRC’s Office of Nuclear Reactor Regulation

(NRR). 

/RA/

William D. Beckner, Program Director

Operating Reactor Improvements Program

Division of Regulatory Improvement Programs

Office of Nuclear Reactor Regulation

Technical contacts: V. Hodge, NRR

 301-415-1861

 E-mail: cvh@nrc.gov

Attachment: List of Recently Issued NRC Information Notices