Information Notice No. 87-34: SINGLE FAILURES IN AUXILIARY FEEDWATER SYSTEMS

                                                SSINS No.: 6835 
                                                  IN 87-34           
                                                                           
                              UNITED STATES                                
                      NUCLEAR REGULATORY COMMISSION                        
                  OFFICE OF NUCLEAR REACTOR REGULATION                     
                         WASHINGTON, D.C.  20555                           
                                                                           
                               July 24, 1987                               
                                                                          

Information Notice No. 87-34: SINGLE FAILURES IN AUXILIARY FEEDWATER  
                                  SYSTEMS                                  
                                                                           
Addressees:                                                               
                                                                          
All holders of an operating license or a construction permit for
pressurized  water reactor facilities                                                                  
Purpose:                                                                  
                                                                           
This information notice is being provided to alert addressees to potential 
single failures of auxiliary feedwater pump start and protective pump trip 
circuitry that could cause partial or complete loss of capability to
supply  auxiliary feedwater (AFW) in conflict with the design basis.  It
is expected  that recipients,will review the information for applicability
to their  facilities and consider actions, if appropriate, to avoid
similar problems.   However, suggestions contained in this information
notice do not constitute  NRC requirements; therefore, no specific action
or written response is  required                                                                  
Description of Circumstances:                                              
                                                                           
On April 30, 1987, the licensee for the Indian Point Unit 2 nuclear power 
plant identified a potential single failure in a portion of the pump start 
circuitry that is common to both motor-driven auxiliary feedwater pumps
and  that could prevent both pumps from starting automatically, in the
event of  either low-low steam generator level or loss of main feedwater. 
Such a single  failure is in conflict with the design basis for the
system                                                            

This problem was discovered in the course of a review of the auxiliary 
feedwater system being conducted by the licensee as followup to a number
of  operational events that occurred in the fall of 1986.

The pump start circuitry at Indian Point Unit 2 was designed so that the
steam  generator level and loss of feedwater start signals were routed
through  contacts of the safety injection inhibit relays.  The purpose of
these relays  is to delay pump starts under safety injection conditions
until the safety  injection sequencer calls for the pumps to start at the
appropriate time.  If  the contacts of either inhibit relay failed in the
open position, neither the  low steam generator level nor the loss of
feedwater start signals would cause  the


.

                                                 IN 87-34 
                                                 July 24, 1987 
                                                 Page 2 of 3               
                                                                           
motor-driven pumps to start automatically.  Both inhibit relays are
normally  deenergized and closed.  Therefore, for the contact to fail in
the open  position, a failure in which the relay remains energized or in
which the relay  sticks open following actuation would have to occur.

Discussion:

When the potential single failure was identified, the licensee entered a
72-hour action statement, as required by the Technical Specification
Limiting  Conditions for Operation.  Within the 72-hour period, the
licensee completed a  design modification to provide independent inhibit
relays for the two motor-driven auxiliary feedwater pumps, which satisfied
the single-failure  criterion.

Subsequent to the design deficiency determination at Unit 2, a review was 
conducted at Indian Point Unit 3.  The licensee at that unit determined
that  although the pump start circuitry at Unit 3 was in fact different
from that of  Unit 2, it also failed to satisfy the single-failure
criterion.  The motor-driven auxiliary feedwater pump start logic
circuitry at Indian Point Unit 3  incorporates a pump start (delay) relay
that responds to either a main  feedwater pump trip or low-low steam
generator level signal.  Processing of  either signal requires the
operability of this relay, which is common to both  motor-driven auxiliary
feedwater pump start logic circuits.  Failure of this  relay could
similarly prevent both pumps from starting automatically.  Unit 3  is
currently shutdown for refueling and corrective actions are still being 
planned.

Previous Similar Occurrence

On March 7, 1985, the licensee for the Salem Generating Station Units 1
and 2  reported (LER 50-272/85-01) to the NRC that the auxiliary feedwater
pump (AFP)  trip circuitry did not meet the single-failure criterion.  The
licensee  discovered this in an ongoing review of design changes in which
the AFP  circuitry was modified to provide protection of all three AFPs in
the event of  a loss of water supply resulting from tornado damage to the
auxiliary  feedwater storage tank.  The licensee's review of this trip
circuitry revealed  several potential single failures that could stem from
a single test switch  circuit, a single suction pressure instrument, and a
single low suction  pressure trip output relay.  Failure of any one of
these protective features  could have resulted in tripping all three AFPs. 
The licensee immediately took  interim corrective actions to eliminate the
potential single failure  vulnerabilities.  Subsequently, the licensee
modified the low suction pressure  pump trip circuitry to provide the
protective feature without the potential  for a single failure causing a
loss of all AFW.

These conditions serve to highlight the potentially generic aspects of
single-  failure vulnerabilities in the automatic start and pump
protection logic  arrangements for auxiliary feedwater pumps                                                                   
   
.
 
                                                       IN 87-34  
                                                       July 24, 1987
                                                       Page 3 of 3        


This information notice requires no specific action or written response. 
If  you have questions about this matter, please contact the Regional 
Administrator of the appropriate NRC regional office or this office  



Charles E. Rossi, Director              
Division of Operational Events Assessment 
Office of Nuclear Reactor Regulation    
                                                                           
    
Technical Contacts:   R. Gallo, RI
                      (215) 337-5225                                       

                      Samuel D. MacKay, NRR 
                      (301) 492-8394                                       
                                                                           
        
Attachment: List of Recently Issued Information Notices                    
                                                                           
       
.