ML023310723
| ML023310723 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 12/06/2002 |
| From: | Marsh L NRC/NRR/DLPM |
| To: | Grobe J NRC/RGN-III |
| Long, Steve NRR/DSSA/SPSB 415-1077 | |
| Shared Package | |
| ml023330284 | List: |
| References | |
| +sispmjr200503, FOIA/PA-2005-0103, FOIA/PA-2005-0261, TIA-02-001 | |
| Download: ML023310723 (31) | |
Text
December 6, 2002 MEMORANDUM TO: John A. Grobe, Chair Davis-Besse Reactor Oversight Panel Region III FROM: Ledyard B. Marsh, Deputy Director /RA/
Division of Licensing and Project Management Office of Nuclear Reactor Regulation
SUBJECT:
RESPONSE TO REQUEST FOR TECHNICAL ASSISTANCE - RISK ASSESSMENT OF DAVIS-BESSE REACTOR HEAD DEGRADATION (TIA 2002-01)
In response to your request dated May 3, 2002, we have performed an assessment of the risk associated with the control rod drive mechanism nozzle leakage and the resulting wastage cavity in the Davis-Besse reactor pressure vessel head. The phenomena that produced the cavity were not expected and are still not completely understood. Our analysis attempts to assemble the available information and quantify the risk associated with the deficiencies in the licensee's performance that allowed these conditions to occur. Where the quantification of some risk elements would be too uncertain, our analysis attempts to explore the implications of the plausible ranges for parameters, rather than to focus on a single value.
As requested in your memorandum, our analysis used insights from ongoing Office of Research (RES) activities to evaluate aspects of the degradation beyond your specific questions related to the as-found condition. These analyses include the possibility of additional wastage creating a larger cavity and the possibility of nozzle ejection due to circumferential cracking. Because the wastage mechanism is not well understood, and because probabilistic risk assessments typically do not address long-term degradation phenomena, we found that the available tools were not sufficient to quantify the risk from additional wastage. The insights we did obtain are included in our response to you because they provide additional perspective beyond what would be reached by focusing solely on the probability of rupture for a cavity. As more information becomes available from ongoing studies, it may be possible to derive additional insights and reach a consensus on the methods best suited to the analysis of the wastage issue. At this time, the results of our analysis of the potential for rupture due to cavity enlargement are too uncertain to be added directly to the other parts of the analysis, but the results of the circumferential cracking analysis are suitable for supporting the Significance Determination Process (SDP).
CONTACT: Steve Long, SPSB/DSSA/NRR 301-425-1077
J. A. Grobe Also, as you requested, we have provided a discussion of the potential for using the principles for integrated, risk-informed decision making (from Regulatory Guide (RG) 1.174) as a basis for augmenting the risk analysis to determine the appropriate agency response. Based on the results of our review, we believe the licensee's performance was inconsistent in some manner with all four principles that are used in conjunction with low risk to find that an action or design change is acceptable.
Since two of the three degradation sequences studied could not be placed unambiguously into a single SDP color range, and since other considerations (such as RG 1.174 safety principles) may be relevant to the SDP and Enforcement Review Panel (SERP) deliberations, we have not provided an overall SDP color for this performance deficiency. The selection of an appropriate SDP color for use with the Action Matrix is a SERP responsibility. We conclude that the attached information should be considered in the SDP color determination.
Our risk assessment and discussion of the use of the other risk-informing principles are provided in Attachments A and B, respectively. Our responses to your specific requests are provided below:
- 1. Develop an estimate of the increase in loss-of-coolant (LOCA) initiating event likelihoods given the as-found condition of the reactor head.
Both the staffs and licensee's analyses for the failure pressure of the as-found cavity resulted in estimates in excess of 7000 psig. Both of the respective uncertainty analyses indicate that the probability for rupture due to pressure transients is very low.
The staffs analysis indicates that this probability is below 7 x 10-8/reactor-year. The licensee's analytical approach, updated by the staff to reflect its latest failure pressure criterion, results in a value below 1 x 10-4/reactor-year. The large numerical difference is an artifact of the different approaches taken for the two analyses. It is inconsequential for purposes of reaching a significance determination. Refer to pages 2 through 6 of Attachment A for the supporting analyses.
It is important to note that these analyses treat the clad material as if it is a plate of uniform thickness with uniform stress-strain properties obtained from small clad samples. The clad was neither designed nor acceptance tested to serve as a structural element of the vessel design, so it may contain structurally significant flaws that are not represented in the analysis. The presence of large flaws could result in rupture at lower pressure and thus increase these probabilities. Alternatively, the presence of small flaws could result in leaks and cavity detection before the exposed area of clad has become large enough to rupture. Therefore, it is not known whether inclusion of pre-existing flaws in the analysis would increase or decrease risk until a quantitative analysis is performed with an appropriate flaw size distribution.
- 2. Estimate the likelihood of an anticipated transient without scram (ATWS) as a consequence of the LOCA, or if engineering review indicated that a reactor vessel head LOCA will not cause an ATWS, then provide a justification for why further evaluation is not warranted.
The RELAP computer code was used to perform integrated thermal-hydraulic and reactivity analysis for a spectrum of LOCA sizes with the break location on the reactor
J. A. Grobe vessel head. The results indicated that, for all LOCA sizes, the void formation due to boiling of the coolant in the reactor would have a sufficient effect on the reactivity to stop the nuclear fission chain reaction. When cool water from the emergency core cooling system is injected into the core and the boiling stopped, the concentration of boron required to be in the injection water is sufficient to maintain the shutdown condition.
- 3. Evaluate the change in core damage frequency (CDF), the conditional core damage probability (CCDP) and the change in large early release frequency (LERF) risk due to the degradation of the vessel head.
The change in core damage frequency is obtained by multiplying the change in the LOCA frequency by the CCDP for the appropriate LOCA size. The licensee provided an evaluation of a medium LOCA CCDP to make it specific to the size of the as-found cavity, with a resulting probability of 2.91 x 10-3. Multiplying the staffs update for the licensee's estimated contribution to the LOCA frequency for the as-found cavity would produce CDF contributions of less than 3 x 10-7/reactor-year. Estimates of CDF based on the staffs results for cavity failure probabilities at various pressures were not calculated because the licensee's approach produced larger results that were still in the lowest risk category for the SDP process. The staffs analysis also considered the results of GSI-191 concerning the potential for emergency core cooling system (ECCS) sump clogging. See pages 12 through 18 in Attachment A for a description of our supporting analyses.
The conditional containment early failure probability for these LOCAs is estimated to be about 0.006. Because the numerical thresholds for the LERF color categories are a factor of 0.1 times the numerical thresholds for the corresponding CDF categories, the LERF increase for this performance deficiency will not be as significant as the CDF increase for purposes of establishing the risk significance.
- 4. Utilize risk insights from ongoing RES activities, which may be evaluating other accident aspects for the reactor head degradation.
The licensee's performance deficiencies resulted in prolonged, undetected leakage of boric acid onto the reactor head through axial cracks in multiple control rod drive mechanism nozzles. This increased the probability for a LOCA by two mechanisms:
a) After they became wet, the external surfaces of the leaking nozzles could develop circumferential cracks which could grow large enough over time that a nozzle could break above the weld and be ejected from the head.
b) A cavity could develop due to corrosion wastage of the low-alloy steel portion of the reactor vessel head and grow large enough over time that the clad exposed beneath the cavity could rupture during normal operation or anticipated pressure transients.
In fact, two nozzles were developing wastage cavities and one of those two nozzles also was found to be developing a circumferential crack. Thus, analyses restricted to the risk associated with the as-found dimensions of one cavity do not necessarily provide an
J. A. Grobe adequate perspective on the risk associated with the licensee's performance deficiencies.
The analyses we provide on pages 6 through12 of Attachment A use results of ongoing RES studies to gain additional insights and useful perspectives on these two sources of risk. Because there is much that is not known about the phenomena and the probabilistic aspects of these two degradation mechanisms, some of our analyses attempt to define logical limits to the possible ranges of results.
The results of our analyses for circumferential cracking indicate that there was sufficient time during the estimated 6-8 years that Nozzle #3 was leaking for a circumferential crack to develop and grow large enough to cause the nozzle to be ejected. We do not know the actual stress levels in Nozzle #3 nor the cracking rate as a function of stress for the material used to fabricate the nozzle. However, because the same material cracked in a greater fraction of the nozzles at Davis-Besse and appears to have leaked earlier in the plant's life than at Oconee 3, we infer that the residual stress levels must be relatively high at Davis-Besse. Because the material has cracked more rapidly than other operating Babcock and Wilcox plants, we also used a range of cracking rates indicative of the worst heat of material in the available laboratory data. These assumptions, are not necessarily bounding. So, the results should be used as an indication of what the risk may be, based on what we know today. The results are about 3 x 10-2/reactor-year for increase in the LOCA frequency and about 8 x 10-5/reactor year for the corresponding increase in CDF. This result alone, puts the CDF increase in the 10-5/RY range, with uncertainty from as high as the low 10-4/RY range to the low 10-5/RY range.
Analysis of the risk associated with the potential growth of wastage cavities beyond the as-found condition is difficult. Typical risk assessment approaches would explore variations in corrosion rates, leak rates, time available, cavity shapes, clad strength, clad flaw densities and size distributions to estimate the change in LOCA frequency associated with the finding of reactor vessel head damage. However, there is little information that can be used to quantify the probability distributions for many of the important variables in this case. Thus, we were unable to reach a consensus for a probabilistic treatment of the time available for wastage to occur. Therefore, even very precise probabilistic analyses of the physical cracking and corrosion phenomena would leave the analysis incomplete. The results of our partial analysis in this area are provided with the recognition that they do not quantify the risk increase due to potential for cavity growth to a different size before discovery. Although the results of this part of the assessment cannot be directly added to the results of the more definitive parts, they do provide additional information that can be used to assess qualitatively the adequacy of the definitive parts for determining the overall risk significance.
The results of our analyses for potential growth of wastage cavities beyond the as-found condition indicate that it was possible. At the most-rapid growth rates indicated to be possible by the results of laboratory experiments involving solid boric acid crystals on wet, heated steel, an additional 1 to 2 years of operation would enlarge the cavity sufficiently to allow rupture, depending on cavity shape. Alternatively, at the average corrosion rate estimated by the licensee, an additional 4 to 7 years of operation would be required. It is also important to note that there are some reasons to suspect
J. A. Grobe that the physical processes that developed the as-found cavity may become self-limiting at some cavity size, so that it may not even be possible to develop a cavity that is large enough to burst with leakage rates limited by the plant's technical specifications.
Alternatively, modest enlargement of the as-found cavity could have completely exposed Nozzle #11, potentially introducing additional failure mechanisms and additional opportunities for discovering the cavity before failure occurred. Thus, this part of the analysis is unusually difficult and the available data provide limited opportunities for quantifying results. However, we believe that the potential for a larger cavity to have formed is an essential consideration for assessing the significance of these findings.
- 5. Evaluate the licensee's deterministic and risk-based assessments to determine if their bases for an increase in CDF of 1 E-5 is valid.
The licensee's risk assessment was based on a deterministic analysis of the failure pressure for the as-found cavity, a choice for a mathematical formula that was assumed to represent the probability distribution for failures at other pressures, and an assessment of the plant's historical frequency of reactor coolant system (RCS) pressure transients. These were mathematically combined to produce an estimated frequency that the RCS would attain a pressure that would have caused the as-found cavity to fail.
We reviewed the licensee's analysis and re-evaluated the results of that approach using newer information and a correction to the calculation process. The licensee's analysis started with an estimated cavity rupture pressure of 5600 psig. This pressure value was developed using a finite element, elastic-plastic numerical model and a criterion for deciding when the results of the model indicated that conditions had been reached that correspond to failure of the physical material. When some physical testing data was used to tune this model, a better estimate of the failure pressure was possible. Based on additional work by the licensee's contractors and RES contractors, we currently estimate the failure pressure to be about 7980 psig. We also reviewed the licensee's estimates for frequencies of RCS pressure transients and found them to be reasonably consistent with expectations and available reports of transient events. In reevaluating the licensee's LOCA frequency calculation using the updated rupture pressure result, we noted that the logic in the licensee's approach represented pressure transients that begin at zero pressure, rather than at normal operating pressure. This "over-counts" the probability that the cavity would fail at normal operating pressure by a factor equal to the sum of the frequencies of the transients in each of the "bins" used to group the pressure transients within pressure ranges. Using the licensee's choice of a log-normal distribution for the failure pressure with the new median failure pressure estimate and the corrected process for combining the failure probabilities with the pressure transient frequencies, the CDF result was greatly reduced to about 3 x 10-7/reactor-year.
Because this was already below the threshold of 10-6/RY, we did not continue to apply corrections that would have the effect of further reducing the result.
Two undermining aspects of this analysis should be considered in any application of this result. First, the analysis does not consider the probability that a structurally significant flaw in the clad material could be present in the exposed clad area. The potential effects of flaws have been discussed in our response to Item 1 and will not be repeated here. Second, the use of a log-normal distribution to represent a probability of failure at pressures around 2200 psig is essentially meaningless for a median pressure as far
J. A. Grobe from that value as the 7980 psig is in this case. The result of this analysis is essentially an artifact of the choice of the log-normal function to represent the probability distribution. To obtain a numerical result that can be reliably related to physical reality, it would be necessary to conduct a better probabilistic analysis that explicitly uses a clad flaw size distribution derived from data on real clad layers.
In conclusion, although the results of our analyses suggest that the risk due to potential rupture of the as-found cavity may be very low (i.e., <10-6/RY), the analysis uncertainty is large, since the analysis used a simplistic model that treated the cladding as a plate and the effects of flaws in the clad material were not considered. We believe that this result alone does not provide an adequate representation of the risk associated with the licensee's performance deficiencies which allowed that cavity to develop. Our analyses of the potential for circumferential cracking and nozzle ejection indicate that the risk from that phenomenon is in the range from 10-5/RY to 10-4/RY. Our analyses of the potential for further cavity growth leading to rupture of the underlying clad were unable to quantify the additional risk. Thus, it is not known whether the total risk attributable to these deficiencies exceeds 10-4/RY. From a public safety standpoint, we believe it is prudent to respond to the broader implications rather than to rely on the low risk level indicated by the narrow perspective of the analysis for the as-found condition, alone.
In addition to the assessment described above and detailed in Attachment A, which evaluated the risk based on available information, NRR also has evaluated its analysis and decision making process used related to the delay in the CRDM inspection at Davis-Besse. This staff evaluation of the Davis-Besse response to NRC Bulletin 2001-01 was forwarded to the licensee by letter dated December 3, 2002, and is in ADAMS at ML023300539. Also, for completeness, a senior staff member provided comments regarding his concurrence on the product provided to the Division of Licensing Project Management. The staff reviewed the staff members comments and have not included them in this transmittal because the comments serve to reinforce the fact made in the analysis that there is considerable uncertainty in the analysis.
Attachments: As stated cc w/atts: W. Lanning, RGN- I C. Casto, RGN-II D. Chamberlain, RGN-IV
J. A. Grobe from that value as the 7980 psig is in this case. The result of this analysis is essentially an artifact of the choice of the log-normal function to represent the probability distribution. To obtain a numerical result that can be reliably related to physical reality, it would be necessary to conduct a better probabilistic analysis that explicitly uses a clad flaw size distribution derived from data on real clad layers.
In conclusion, although the results of our analyses suggest that the risk due to potential rupture of the as-found cavity may be very low (i.e., <10-6/RY), the analysis uncertainty is large, since the analysis used a simplistic model that treated the cladding as a plate and the effects of flaws in the clad material were not considered. We believe that this result alone does not provide an adequate representation of the risk associated with the licensee's performance deficiencies which allowed that cavity to develop. Our analyses of the potential for circumferential cracking and nozzle ejection indicate that the risk from that phenomenon is in the range from 10-5/RY to 10-4/RY. Our analyses of the potential for further cavity growth leading to rupture of the underlying clad were unable to quantify the additional risk. Thus, it is not known whether the total risk attributable to these deficiencies exceeds 10-4/RY. From a public safety standpoint, we believe it is prudent to respond to the broader implications rather than to rely on the low risk level indicated by the narrow perspective of the analysis for the as-found condition, alone.
In addition to the assessment described above and detailed in Attachment A, which evaluated the risk based on available information, NRR also has evaluated its analysis and decision making process used related to the delay in the CRDM inspection at Davis-Besse. This staff evaluation of the Davis-Besse response to NRC Bulletin 2001-01 was forwarded to the licensee by letter dated December 3, 2002, and is in ADAMS at ML023300539. Also, for completeness, a senior staff member provided comments regarding his concurrence on the product provided to the Division of Licensing Project Management. The staff reviewed the staff members comments and have not included them in this transmittal because the comments serve to reinforce the fact made in the analysis that there is considerable uncertainty in the analysis.
Attachments: As stated cc w/atts: W. Lanning, RGN- I C. Casto, RGN-II D. Chamberlain, RGN-IV DISTRIBUTION Non-Public KMcConnell RPulsipher PDIII-2 Reading MJohnson MReinhart SPSB Reading SLong SRichards BSheron RBarrett FCongel JZwolinski/LMarsh JHopkins GHolahan/SBlack THarris
- see previous concurrence in earlier version of this document under Acc.#ML023020366 G:\\spsb\long\TIA resp.wpd Package Acc.#ML023330284 NRR-106 OFFICE SPSB *SC:SPSB BC:SPSB D:DSSA NAME SLong:nyc MReinhart MJohnson GHolahan/SBlack DATE 11/27/02with attached comment 10/29/02 11/29/02 11/29/02 OFFICE *BC:MCEB *D:DE DD:DLPM NAME WBateman RBarrett LMarsh DATE 10/31/02 10/31/02 12/06/02 OFFICIAL RECORD COPY
Predecisional Risk Assessment and Insights in Support of Phase 3 Risk Significance Determination for the Control Rod Drive Mechanism (CRDM)
Nozzle Cracking and Associated Reactor Pressure Vessel (RPV) Head Wastage Event at the Davis-Besse Nuclear Power Station During an inspection of the CRDM nozzles in the spring of 2002, the licensee discovered three nozzles were leaking through axial cracks, and that one of the leaking nozzles had begun to develop a circumferential crack. During repair of another one of the leaking nozzles, it became loose in the RPV head. Subsequent investigation revealed that a cavity had formed around that nozzle in the low-alloy steel portion of the RPV head, leaving only the stainless steel clad material as the reactor coolant pressure boundary over an area of approximately 20 square-inches. In their root cause analysis report, the licensee concluded that the axial crack in the affected nozzle had most probably been leaking for a period of 6 to 8 years before detection. A similar but much smaller cavity was subsequently identified at the location of the leaking crack in another of the degraded nozzles.
The purpose of this analysis is to assess the degree of risk associated with the deficiencies in the licensee's performance which allowed these conditions to occur. The analysis attempts to quantify the risk to the extent practicable with the limited data available and the limited understanding of the phenomena involved. Where a consensus could not be reached on an approach to quantify some risk elements, this analysis attempts to develop a broad perspective and obtain useful insights relevant to the unquantified parts. Those insights are provided to serve as qualifiers to the incomplete risk total developed from those elements that we were able to quantify.
Statement of the licensee performance deficiency :
The licensee failed to properly implement a boric acid wastage prevention program, which allowed reactor coolant system (RCS) pressure boundary leakage to occur undetected for a prolonged period of time. Also, the licensee failed to implement an inspection program for the detection of reactor coolant pressure boundary leakage that adequately addressed RCS degradation mechanisms that industry experience had indicated were applicable to the Davis-Besse plant. In addition, the licensee failed to implement an adequate corrective action program to properly disposition anomalous indications in plant data and correct their causes.
Accident sequences that contribute increased risk:
The licensee's failure to detect the leakage from CRDM nozzles for an extended period of time could have lead to the failure of the reactor coolant pressure boundary by three mechanisms:
- 1. The section of clad that was exposed by wastage of the RPV head could have failed if the cavity had formed at a weaker point in the clad or the reactor had experienced a transient condition that caused the pressure in the RCS to exceed its normal pressure of operation.
Attachment A
Predecisional
- 2. The wastage cavity could have grown larger before discovery, allowing it to fail at a lower RCS pressure, including normal RCS operating pressure.
- 3. The extended period of exposure of the outside of the CRDM nozzles to RCS coolant could have allowed the formation and growth of a circumferential crack sufficiently large to cause the nozzle to fail and be ejected from the RPV head.
In each of these three cases, a loss-of-coolant accident (LOCA) would have resulted from the failure of the RCS pressure boundary. In cases 1 and 3, the LOCA would have been in the "medium" range, requiring both high-and low-pressure emergency core cooling system (ECCS) equipment to prevent reactor core damage. For case 2, the size of an unflawed clad area that must be exposed in order to fail at normal operating pressure creating a LOCA is in the "large" category, but still within the design limits of the ECCS system. LOCAs in the "large" range require operation of core flood tanks and the low pressure ECCS pumps to prevent core damage.
The probability that the ECCS would fail to prevent core damage was calculated previously for both of these LOCA sizes in the Davis-Besse individual plant examination. What remains to be assessed for this analysis is the increase in the LOCA frequencies of medium and large LOCAs that can be attributed to the licensee's performance deficiencies. When combined with the conditional core damage probabilities (CCDPs) for the appropriate size LOCAs, the estimated changes in the frequencies produce estimates for the increase in core damage frequency attributable to the performance deficiency.
Probability of burst during reactor operation for the as-found cavity:
The cavity as found at Davis-Besse did not burst during operation. However, during the period of its exposure, the RCS pressures did not significantly exceed the normal operating pressure of 2185 psig. Operational experience at Davis-Besse and other plants indicates that there is a modest frequency of transient events that cause the RCS pressure to temporarily increase.
Therefore, part of the risk assessment process is to determine the probability that the RCS pressure could have reached a value sufficient to burst the cavity.
The power operated relief valves and safety valves (SVs) located on the pressurizer actuate at high pressure to limit RCS pressure increases. The SVs at Davis-Besse limit RCS pressure to 2550 psig for design-basis accidents. The licensee has provided a table of the number of times the Davis-Besse RCS has reached various pressure levels above its normal operating value.
None of these pressure transients has reached the SV setpoint at Davis-Besse. However, other plants have experienced pressure transients that actuated their pressurizer SVs.
Davis-Besse provided an estimate of the frequency of reaching the SV setpoint, using the number of years of operation and a Bayesian statistical process. That estimate appears to be reasonable and slightly conservative in comparison with the statistics available for the operational transients at other plants.
For the RCS pressure to increase beyond the SV setpoint, an operational event that is more severe than the plant is designed to handle would need to occur. Previous probabilistic
Predecisional analyses have identified an event that has these characteristics, a total loss of feedwater with failure of the control rods to insert and stop the nuclear chain reaction in the reactor core.
These types of events are called anticipated transient without scram (ATWS) events. The frequency estimated for this type of event is less than 1 x 10-5/RY in probabilistic risk assessments (PRAs).
On the basis of these considerations, the frequencies used in this analysis for reaching various pressure levels in the Davis-Besse RCS are listed in Table 1.
Table 1. Frequency of Operation within Specific RCS Pressure Ranges at Davis-Besse RCS Pressure Frequency of Occurrence Frequency of Exceeding Range Base 2185 psig 1.0 [during operation] 1.0 [during operation]
2250-2300 psig 0.254/reactor-year 0.95/reactor-year 2300-2350 psig 0.508/reactor-year 0.698/reactor-year 2350-2400 psig 0.127/reactor-year 0.190/reactor-year 2400-2450 psig 0.0635/reactor-year 0.063/reactor-year 2450-2550 psig 0.0317/reactor-year 0.0317/reactor-year
>2550 psig <0.00001/reactor-year < 0.00001/reactor-year The Oak Ridge National Laboratory (ORNL) has estimated the failure pressure for the as-found cavity to be 7,353 psig (reference 1). This is intended to be a conservative estimate, based on minimum strength properties of the type of material used to form the clad, an intentional over-estimate of the exposed clad area, and a uniform clad thickness that was the minimum value initially reported by the licensee under the cavity, 0.240 inch. (More recent measurements have decreased the minimum thickness to about 0.20 inch, but the average is about 0.25 inch.) The failure pressure was estimated from the results of a nonlinear, finite-strain, elastic-plastic, finite-element model that was tuned to the results of a set of 9 physical burst tests conducted under the sponsorship of the American Society of Mechanical Engineers (ASME) Pressure Vessel Research Committee Subcommittee on Effective Utilization of Yield Strength in 1972 (reference 2). The pressure at which this model reached instability was increased by a factor of 1.1 to estimate the median failure pressure for the cavity.
ORNL also used the variability in the results of those 9 tests to estimate the uncertainty in their estimate of the failure pressure for the physical conditions assumed in their analysis. A cavity clad burst pressure as low as 5900 psig would be within the variability exhibited by the burst tests. However, it is not credible that a reactor could achieve this pressure, because other components are expected to fail at lower pressures and stop the pressure increase at a lower value. Extrapolation of the variability in the burst tests to estimate probabilities of failure at lower RCS pressures depends on the subjective selection of a mathematical relationship.
ORNL evaluated several mathematical functions, and found six that are consistent with the spread in the burst test data. Using all six distributions, the average probability of cavity failure at normal operating pressure is estimated to be 6.9 x 10-8, and the probability at the safety valve setpoint pressure is estimated to be 3.6 x 10-7. As will be shown later in this analysis, probability values that are low, produce core damage frequency contributions (CDFs) that are well below the threshold of 1 x 10-6/RY used in the setdown pool (SDP). Likewise, the
Predecisional frequency of an ATWS event at < x 1 0-5/RY is too low to produce a CDF above that threshold by creating pressures with higher failure probabilities.
Therefore, the ORNL analysis establishes a definitive significance result for the as-found cavity, with one caveat: the effects of defects in the clad material were not considered in the analysis.
The ORNL probabilistic analyses are based on the variability in the results of the ASME tests for 9 disks fabricated from plate material. The floor of the cavity is modeled as a uniformly thick plate of material with uniform properties. However, the remaining clad at the bottom of the cavity in the Davis-Besse RPV head is not plate material; it is a weld overlay that was not fabricated or acceptance tested to serve as a pressure boundary. There is some probability that the clad could be weakened by incomplete fusion between some of the sequentially applied strips of weld metal. From a risk perspective, the potential occurrence of flaws in the cladding does not necessarily increase the risk. If small flaws are more prevalent than large flaws, then it is conceivable that they could enhance the probability that the initial failure is a detectable leak, rather than a gross rupture of the exposed clad material. That effect would reduce the probability of burst and lower the risk. Alternatively, if large flaws are more prevalent, they could increase the probability of rupture at realistic RCS pressures and thus increase the risk above the values estimated for failure of the as-found cavity in this analysis. Some data have been produced on the frequency of occurrence and size distribution of flaws RPV clad.
Application of that data would be the logical next step if there is a need to improve this analysis.
The licensee submitted a risk analysis (references 3,4,5) based on the average thickness of the clad under the cavity (0.297 inch) and an estimated exposed clad area of 20.5 square inches.
The numerical model reached instability at a pressure of 7219 psig. Using the ORNL relationship between the pressure of numerical instability and the physical failure pressure, the projected median failure pressure would be 7982 psig.
The licensee's analysis used a log-normal distribution for the probability of failure as a function of pressure:
f = { ln(P/Pm) / C} where: f = probability that failure occurs at pressure P(psig)
PM= median pressure capability (psig)
P = pressure capability variable (psig)
C = composite logarithmic standard deviation for randomness
= gaussian cumulative distribution function The licensee chose a value of 0.33 for c from references 6 and 7. This is composed of coefficients of variation as follows:
0.1 for the coefficient of variation for plastic collapse for semi-ellipsoidal heads; 0.29 for the coefficient of variation of the yield strength of stainless steel at 605 oF; 0.11 for the coefficient of variation for buckling capacity developed from the test results.
C is calculated as the square root of the sum of the squares of these constituent values.
Values of C in the cited references ranged from 0.06 to 0.39, so the licensee's choice is near the conservative end of the range.
Predecisional Reproducing the licensee's approach to the uncertainty with the updated estimate of 7941 psig for the median cavity failure pressure (reference 5), the probabilities for rupture at the pressures of interest are given in Table 2.
Table 2. Probability for As-Found Cavity Rupture as a Function of Pressure, Using Licensee's Variability Assumptions RCS Pressure Probability of Failure
< 2185 psig 4.32 x 10-5
< 2250 psig 6.23 x 10-5
< 2275 psig 7.13 x 10-5
< 2325 psig 9.29 x 10-4
< 2375 psig 1.20 x 10-4
< 2425 psig 1.53 x 10-4
< 2475 psig 1.94 x 10-4
< 2525 psig 2.44 x 10-4
< 3000 psig 1.51 x 10-3
< 3500 psig 6.24 x 10-3
< 4000 psig 1.81 x 10-2
< 4500 psig 4.12 x 10-2 A finite probability of failure at 2185 psig, despite the fact that the cavity survived normal operation at that pressure for a significant period, could be attributed conceptually to the probability that the clad material has a small random probability for being substantially weaker at the location of the cavity. However, the extrapolation of the uncertainty in the failure pressure from over 7000 psi to about 2000 psi goes far beyond the range of the data to which these mathematical functions have been fitted. Therefore, it is unrealistic to expect this mathematical function to produce accurate probability estimates in this case.
To probabilistically combine the frequencies of pressures in the RCS with the probabilities for failure at the various pressures, it is necessary to consider that the RCS was maintained at approximately 2185 psig for the entire year of operation, plus it had some probabilities of exceeding that pressure by the specified amounts for a short period at some time during the year. So, the probability for failure at 2185 psig is used directly as part of the failure probability for the as-found cavity, because it is assumed that the cavity experienced that pressure in its as-found condition with a probability of one. For the probability of failure during pressure transients, it is necessary to account for the fact that the cavity did not fail at normal operating pressure, so the probability of failure at 2185 psig is subtracted from the probabilities for failure at the midpoints of the other pressure ranges and the differences are multiplied by the frequencies of pressure transients within those ranges. For pressure transients up to the safety valve setpoints, the result is 9.7 x 10-5/RY. About 45 percent of this value comes from the probability for rupture at normal operating pressure.
As can be seen from the probabilities for cavity rupture at pressures between the safety valve setpoints and 4500 psig, those probabilities would not add significantly to this result when multiplied by the frequencies below 1 x 10-5/RY for ATWS events that would be capable of attaining those pressures.
Predecisional The 55 percent of the rupture probability that comes from pressure transients was calculated as if the cavity existed at its as-found size for a whole year. It would be necessary to reduce that portion of the probability to reflect the fact that the cavity was growing during operation, and thus was stronger for most of the year prior to its discovery. The magnitude of that adjustment depends on the cavity growth rate, which will be addressed in the next section of this analysis.
However, as will be shown in a later section of this analysis, the unadjusted probability estimate, when multiplied by the conditional core damage probability for a LOCA of the size of the exposed clad area, will result in a core damage frequency increase below the 10-6/RY threshold. Therefore, additional probability reduction factors will not be addressed in this analysis.
In summary, the estimated rupture pressure for the as-found cavity exceeds 7000 psig in both the Nuclear Regulatory Commissions (NRC's) and licensee's analyses. The uncertainties considered in these analyses are not large enough to produce a significant probability that the cavity would rupture at RCS pressures below the safety valve setpoints. A potentially significant unanalyzed factor is the probability for flaws in the clad to produce failure at lower pressures. It is not known whether this factor would increase or decrease the overall risk.
Probability that the cavity could grow large enough to burst before discovery:
For the cavity to have grown to a different size by the time it was discovered, one or more things would have had to occur differently from what actually did occur in the past, which caused the cavity to reach a particular size and to be discovered on a particular date. Risk assessment techniques are intended to explore the effects of plausible variations in what did happen to understand what might have happened and what the probabilities were for different outcomes. Typical risk assessment approaches would explore variations in corrosion rates, leak rates, time available, cavity shapes, clad strength, and flaw sizes and densities in clad material to estimate the change in LOCA fervency associated with the finding of reactor vessel head damage.
However, this case is somewhat atypical and more complicated to analyze. It was the initial discovery of a different phenomenon (circumferential cracks in CRDM nozzles) at a different plant (Oconee unit 3) that caused the inspection at Davis-Besse which led to discovery of the cavity that is the subject of this analysis. Thus, this case involves the actions of other licensees and the NRC staff to limit the period in which degradation was allowed to occur, whereas a more typical significance determination would only need to assess the potential for variations in the actions of the licensee that is the subject of the finding.
Complete assessment of all potential variables would be required to establish the precise level of risk increase. However, it typically is infeasible to produce a complete risk analysis.
Typically, analysts attempt to identify the parameters that have the most substantial effects on the results and evaluate those, while simply showing the others to be unimportant to the results.
An analysis that fails to evaluate a parameter that can substantially alter the results is too incomplete to be used as a basis for a regulatory decision. When limitations in available information and/or analytical capabilities make it infeasible to produce an analysis complete enough to support its purpose, it is the responsibility of the analyst to make that clear.
Predecisional Unfortunately in this case, there is little information that can be used to quantify the probabilities for many of the important variables. The timing of the formation of the cavity actually found at Davis-Besse is not definitively established by the available information. The actual rate of reactor coolant leakage into the cavity is not known as a function of time. The corrosion phenomena that produced the cavity are not understood well enough to specify the rates of corrosion or the shapes that could have occurred, or even whether there is dependence on leak rate or a limit on the size of the cavity that can result. In addition, because the crack growth appears to depend on the time that the plant was running at power, and the cavity growth appears to require the reactor coolant system to be pressurized and hot, the size of the cavity eventually discovered appears to depend on the operating history of the plant at times even before the licensee's performance deficiency occurred. Thus, the risk is sensitive to the relationship between the plant's total operating history and the timing of the cavity discovery.
That relationship introduces some possibilities that are particularly difficult to analyze in this case. What if the discovery of circumferential nozzle cracks at Oconee unit 3 had occurred at a later date? What if the history of operation of Davis-Besse had provided more opportunity for crack and cavity growth before February 2002? We were unable to reach a consensus with our NRC colleagues on a relevant and appropriate probabilistic approach for addressing the time parameter intrinsic to these questions. However, the relative timing of the discovery in the context of the unmonitored progression of the plant's degradation appears to have the potential to substantially affect the results of the analysis. Therefore, even very precise probabilistic analyses of the physical cracking and corrosion phenomena would leave the risk analysis incomplete.
The following analysis is provided with the recognition that it cannot be complete enough to quantify the risk increase definitively due to potential for cavity growth to the point that the underlying clad material ruptures. It attempts to identify the important parameters and to provide information that plausibly limits the applicable range of variation for their values in this case. It does not attempt to estimate the range of risk results that those variations could produce. Although the results of this part of the assessment cannot be directly added to the quantitative risk results from the other parts, they do provide additional information that can be used to qualitatively assess the adequacy of the quantified parts for determining the overall risk significance. As more information becomes available from ongoing studies, it may be possible to derive additional insights and reach consensus on methods to assess this contribution to the risk.
Cavity size needed to fail during normal operation:
Based on the analyses provided by the Office of Nuclear Regulatory Research (reference 9), a cavity would have to grow to cover an area of approximately 330 square-inches in order to rupture at normal operating pressures, assuming a shape similar to that of the as-found cavity.
This would require growth by about 15 inches in the longest cavity dimension. If the cavity grew into a more rounded shape, it might fail under normal operating pressures with an area of about 250 square inches. That shape would require approximately 7 inches of additional cavity growth, assuming growth occurred uniformly in the down-hill and side-hill directions, but not the up-hill direction.
Predecisional Because none of the corrosion experiments in the literature formed large cavities, there is some potential for unknown factors to limit the corrosion process such that cavity growth stops at some maximum size. If such a size limit exists, then the probability that the cavity could rupture may be substantially reduced. However, there currently is no data useful for quantifying that potential so that it can be included in this analysis.
Cavity growth rate :
Based primarily on the observed levels of boric acid particles in the containment atmosphere, the licensee's Root Cause Analysis Report speculates that the cavity found in the RPV head grew at an average rate of 2-inches/year over the 4-year period of the last two operating cycles.
This appears to be a reasonable interpretation, but the available evidence is certainly not conclusive, and other interpretations are also reasonable. The licensee's report also states that, by making a "bounding assumption" that there was a linear rate of increase over time for the cavity growth rate, "the maximum corrosion rate near the end of cycle 13 would be about 4.0 inches/year." However, no basis is provided to support the assertion that a linear increase with time is physically bounding or otherwise supported by the available information.
There are multiple reasons to suspect that the cavity growth rate did not increase at a linear rate (or less) for a period of 4 years. From basic principles, if an axial crack grew at a constant rate over those 4 years, the leak rate would have increased exponentially because leak rate has been shown to be an exponential function of crack length. If the crack tip had reached a region of low residual stress in the nozzle material, it is possible that the crack growth rate would have substantially decreased. However, complete arrest of the crack growth appears unlikely given the stress levels created at the tip of the crack by internal pressure forces and the high crack growth rate exhibited by this nozzle material. Also, the rate at which air filters inside containment needed to be changed over the 4-year period indicates that a substantial increase in the amount of airborne boric acid occurred during the period. Although the rate of increase appears to be more exponential than linear, it is not feasible to quantify the erosion rate based on the available air filter data.
The physical shapes of the cavities at Nozzles 2 and 3 also suggest that the cavity at Nozzle 3 grew in multiple phases. The cavity at Nozzle 2 followed the nozzle contour over a small fraction of its circumference and spanned the annulus length from near the J-groove weld to the top of the RPV head. This suggests that the leakage was directed upward onto the upper surface of the head, probably in the form of steam for low rates of leakage. The upper portion of the cavity around Nozzle 3 is dish-shaped, suggesting that the leak rate eventually increased to the point that a liquid puddle formed on the head surface and was corroding the head in a downward direction. Below the dish-shaped portion of the cavity is another shaped like a football with its nose pointing away from the nozzle in the direction that the axial crack was focusing the leakage.
This section is not smooth, as would be expected if the cavity were excavated by erosion from an escaping jet of steam or water. Its surface is pocked, suggesting corrosion by a liquid pool or slurry. The licensee's root cause report proposes that the pool was either an aqueous solution of boric acid, or a pool of molten orthoboric acid crystals continuously hydrated with water from the nozzle leak.
Predecisional Corrosion rates for aqueous boric acid solutions in a variety of physical situations are provided in the Electric Power Research Institute Boric Acid Corrosion Guidebook (reference 8). Typically, the rates are below 2-inches/year for most physical situations. However, there are no physical test results available for a situation like the postulated pool of molten orthoboric acid hydrated by a low rate of water leakage into the pool. The closest situation covered by the Guidebook appears to be the tests where an aqueous solution of boric acid flowed across a low-alloy steel surface that was heated to 600 oF. In the central portions of the surfaces wetted by the aqueous solutions, the corrosion rates were similar to that observed for steel immersed in a boric acid solution. However, at the edges of the wetted surfaces where the boric acid solution became saturated and solid crystals were formed with continuing hydration from the wetted areas, local corrosion rates as high as 7-inches/year were reported. Therefore, it seems prudent to consider the possibility that the last stages of cavity growth on the Davis-Besse RPV head may have experienced corrosion rates on the order of 7-inches/year. At that rate, the football-shaped portion of the cavity could have begun developing in the latter half of the last operating cycle and reached its observed size by February 2002, when the cavity was discovered. An interesting coincidence is that there was an abrupt decrease in the necessary rate for CAC cleaning in May of 2001, suggesting that something about the leakage path had changed at that time. The change may have been only in the path past the insulation that the airborne particles followed to reach the containment atmosphere, or it may signify that the leakage had been directed into the pool in the cavity at that time, starting the formation of the footbal-shaped portion. The containment radiation monitors showed continuing increases in the RCS leak rate until about December 2001.
Because the observed size of the cavity is over 6 inches in depth and about 6 inches radially from the leaking crack, average corrosion rates less than 1.5 to 2 inches/year would be inconsistent with the licensee's proposed time-line for cavity formation. Maximum rates as high as 7-inches/year would be consistent with the experimental results in aqueous boric acid solutions where solid boric acid crystals are on a heated, wetted steel surface.
For purposes of this analysis, two plausible cases are considered. One uses 2 inches/year as a lower bound for the maximum growth rate. The other addresses the implications of the rapid corrosion rates up to 7 inches/year associated with the hydrated boric acid crystals. It is not known at this time which case or what intermediate value is more likely.
Time for cavity growth:
In order to evaluate the range of sizes that the cavity might have reached before discovery, it is necessary to consider the potential variability of the corrosion rate in the context of the potential for variation in the amount of time available for the corrosion to occur before discovery. For corrosion to occur, first an axial crack had to initiate and grow large enough to penetrate the nozzle and leak coolant onto the low-alloy steel that is exposed on the outside surfaces of the reactor head. Both the cracking process and the corrosion process appear to occur when the reactor is operating, but not when it is shut down. So, the amount of reactor operation that occurred prior to discovery of the cavity appears to be the relevant time parameter for determining the final size of the cavity.
Predecisional That is not a typical circumstance for risk assessments and significance determinations. Usually, it is the duration of the performance deficiency that is the relevant factor limiting the risk. In this case, there are a large number of historical factors that, acting together, limited the risk by resulting in the development and discovery of two large circumferential cracks at Oconee unit 3, causing the subsequent inspections and repairs that ultimately revealed the occurrence of the wastage phenomenon at Davis-Besse. The complexity of this case introduces factors that are not addressed by available PRA tools. We were unable to reach a consensus with our NRC colleagues on a relevant and appropriate approach, supported by data, for quantifying this part of the risk assessment. Therefore, this part of the analysis does not produce a numerical result that can be combined with the results of the other parts, which makes the total incomplete by an amount that may or may not be substantial.
Available insights on the potential for wastage to the point of cavity rupture:
Combining the two corrosion rate cases and the amounts of growth needed to reach the point of rupture for different shaped cavities produces a range of estimates for the amount of additional operating time that the cavity would need to grow large enough to rupture at normal operating pressure. For corrosion rates on the order of 2 inches per year, it would require the cavity to grow for 7 years in a shape similar to what was found or another 4 years into a more rounded shape before rupture is predicted. For the higher corrosion rate case of about 7 inches/year, only another 1 to 2 years of operation could be sufficient to produce a rupture, depending on the shape the cavity took.
However, it must be recognized that the failure pressure analyses used to make these estimates do not include some factors that may change both the size that the cavity would attain before failure and the manner in which failure would occur. The potential importance of flaws in the clad layer was discussed in the section of this assessment that addresses the as-found cavity. In addition, all the enlarged cavity shapes would completely engulf Nozzle 11. Nozzle 11 and its attached J-groove weld would create a circular area in the exposed clad material that would not stretch and is constrained against tilting after small amounts of deflection. It is apparently free to rise and fall in the vertical direction. Adding these constraints to the clad material stress-strain calculations may have some reinforcing effects on the clad. However, the long, free-standing CRDM nozzle and housing assembly may also experience significant vibrations during operation, once wastage of the head material frees the nozzle from constraint within the head. It is conceivable that vibrations might fatigue the clad metal at the edge of the J-groove weld and cause a failure that would eject the nozzle and weld, together, resulting in a medium instead of a large LOCA from an enlarged cavity. Alternatively, the vibrations conceivably might result in anomalous instrument readings in the control room, leading to investigation that results in the discovery of the loose nozzle and cavity before a rupture occurs. Similarly, unusual displacement or looseness of the CRDM on Nozzle 11 might be noticed during an outage for cases where corrosion rates are slow enough to incur an outage at an opportune time. Similarly, a small amount of additional wastage in the uphill direction could have created the same conditions for Nozzle 3. Any or none of these considerations could substantially change the risk calculations if their effects could be quantified.
Predecisional Probability that a circumferential crack could grow large enough to eject a CRDM nozzle:
Four nozzles in the center of the RPV head do not have demonstrable annular gaps at operating conditions. For this reason, there was a concern that leakage from a nozzle crack deep in the annulus would not reach the top of the reactor head to leave visible deposits. Therefore, visual inspection was not a qualified technique for detecting leakage through axial cracks in these nozzles. The licensees Risk Assessment of CRDM Nozzle Cracks (reference 10), submitted on November 1, 2001, excluded these four nozzles from the analysis on the basis that they were not prone to circumferential cracking due to the residual stress fields associated with their location in the center of the RPV head, and they therefore were not risk significant. Within two weeks of that submittal, the fall inspection at Oconee Unit 3 revealed circumferential cracking in a central nozzle (No. 2). Also, the fall inspection at Oconee Unit 3, reinforced the finding from the spring 2001 inspection at the same unit, which revealed that the heat of material used to fabricate the nozzles for that unit was exhibiting an unusually high incidence of cracking and leakage. The five central nozzles at Davis-Besse are fabricated from the same material. Subsequent inspection of the central nozzles at Davis-Besse in the spring of 2002, revealed that four of those five nozzles had developed axial cracks, three were leaking and one of the leaking nozzles (No. 2) had developed a circumferential crack. The size of the circumferential crack, as determined by ultrasonic testing (UT), was approximately 30°. However, this size characterization is considered to be highly uncertain on the basis of comparisons between UT sizing and physical examination of the two circumferential cracks that were first found at Oconee Unit 3 in the spring of 2001. For those 2 cracks, both of which were physically measured to extend about 165°, UT did not detect one and sized the other as 60°. Therefore, the best evidence is that the central nozzles are subject to circumferential cracking with a probability similar to other nozzle locations. The available physical evidence is not adequate to demonstrate that circumferential cracking is less rapid in the central nozzles than it is elsewhere on the head.
The licensees root cause report provides estimates that Nozzle 3 had been leaking since 1996 or 1994. Thus, the Nozzle 3 annulus was potentially subject to circumferential crack development and growth for a period of 6 to 8 years. The fact that Nozzle 3 began leaking so early in plant life is another indication of the highly susceptible nature of the material used to fabricate the nozzle.
Monte Carlo analyses provided by Argonne National Laboratory (ANL) were used to estimate the risk of nozzle failure for the 5 central nozzles (references 11 and 12). These analyses assumed that the material used for the nozzles at Davis-Besse is similar to the worst heat of material for which laboratory cracking test results are available. This assumption is likely but not guaranteed to be conservative. It will be checked by planned analyses of the Nozzle #3 material from Davis-Besse. The stress assumptions are based on the high-stress solution for center nozzles provided by Engineering Mechanics Corporation of Columbus (reference 13). The high stress solution was picked in recognition of the higher prevalence of cracking in this material at Davis-Besse (60 percent) than was observed at Oconee Unit 3 (20 percent). A probability of 0.22 was used for initiation of a circumferential crack in an annulus wetted by reactor coolant leakage when an axial crack grows through a nozzle. This value was derived from the available inspection results.
Circumferential crack sizes of 20° and 60° were considered at crack initiation, to account for potential initiation at multiple sites along the highest stress region.
Predecisional The ANL results indicate a probability range of 1.1 x 10!2 to 2.2 x 10!2 (for 20° and 60° initiation, respectively) that one of the five nozzles would fail within Davis-Besses 16 years of operation without effective inspection for crack development or leakage. For a single nozzle, the probability is 2.3 x 10!3 to 4.5 x 10!3. An alternative perspective is that, given that one nozzle is considered to have started leaking early in plant life, the probability that a circumferential crack will form and grow to the point of nozzle failure is about 2.6 to 5.6 x 10!2 within 6 years of leak initiation and about 4.9 to 8.7 x 10!2 within 8 years.
The perspective that uses knowledge of an early onset of leakage indicates higher risk than the calculation that statistically predicts both beginning of leakage and the time of nozzle ejection.
This occurs because that calculation uses a probability of 1.0 for the onset of leakage by the date assumed in the licensees root cause analysis. In contrast, the ANL calculations that probabilistically predict the date of first leakage from one of five nozzles produce a probability of only about 0.25 that the date will be as early as the licensee has speculated actually occurred.
The results based on knowledge of early leakage are used in this assessment as being most representative of the situation at the Davis-Besse plant.
For SDP analyses, the increase in the core damage frequency or large early release frequency during the last year of operation is the metric that is used to quantify risk significance. The probability of nozzle failure during the last year is the difference between the cumulative probability for failure by the end of the last year and the probability for failure by the end of the year before, adjusted for the probability that no failure had occurred by the end of the next-to-last year. For the 6th year of operation with a wetted annulus, the estimated probability of failure is 1.15 to 1.99 x 10!2, for the 7th year it is 1.28 to 1.80 x 10-2, and for the 8th year, it is 1.37 to 2.14 x 10-2. For the purposes of this analysis, the average value of 1.6 x 10-2 will be used for Nozzle 3 to fail in the last year of operation. The range of results for the various wetted times and circumferential flaw initiation sizes is only about 30 percent, which is not significant compared to other sources of modeling uncertainty such as the susceptibility of the material to cracking.
Estimates of the additional contributions from Nozzles 2 and 5 depend upon the time the outer surfaces of these nozzles were wetted by leaking axial cracks. Those times were not estimated in the root cause report. Based on the lesser degrees of cavity formation in Nozzles 2 and 5, it is reasonable to assume those nozzles were wet for shorter periods than was Nozzle 3, but that is not certain. For purposes of illustrating plausible levels of effect on the results of this analysis, a value of 4 wetted years is assumed for Nozzle 2 and 2 years for Nozzle 5. This results in values of 0.57 to 1.52 x 10!2 for nozzle 2 and essentially zero to 1.45 x 10!3 for nozzle 5. So, Nozzle 2 would increase the failure probability by about 64 percent and Nozzle 5 by about 4 percent, giving a total nozzle failure probability of 2.7 x 10!2 using these assumptions. If all 3 nozzles were assumed to be wetted for the same period, the total failure probability estimate would increase to 4.9 x 10!2, which is a factor of 1.8 times the value that will be used in this analysis.
Conditional Core Damage Frequency for Loss-of-Coolant Accidents:
The probability that a LOCA will cause core damage is calculated for large, medium and small LOCAs in all PRAs for pressurized water type power reactors. In the Davis-Besse individual plant examination (IPE), the CCDPs are 6.87 x 10-3 for medium LOCAs and 1.08 x 10-2 for large LOCAs. Because the medium LOCA size range is large and the worst case parameters from
Predecisional both ends of the range were combined in a conservative manner for the IPE analysis, the licensee recalculated the CCDP for a rupture the size of the exposed clad area under the as-found cavity. That value is 2.91 x 10-3 with a 95 percent confidence bound of 6.07 x 10-3 and a 5 percent confidence bound of 1.29 x 10-3. These values are consistent with the values obtained in other IPEs and in PRAs sponsored by the NRC. Therefore, they will be used in this SDP analysis without further review.
Potential for Failure of Control Rods Due to Damage from Ruptured Cavity or Ejected Nozzle:
Both the licensee and the NRC have evaluated the potential for consequential damage to multiple control rod drives to prevent shutting down the chain reaction in the reactor core after failure of a nozzle or exposed clad (references 3 and 14). The NRC analysis concluded that the chain reaction would be successfully terminated without producing a pressure pulse in the RCS.
The reason for this result is that the design requirements for the reactor core have been established to make the nuclear fission chain reaction stop when bubbles form in coolant and the fuel rods overheat. In the event of a LOCA, the depressurization of the RCS allows some boiling to occur in the reactor core, and this is sufficient to stop the chain reaction without insertion of any of the control rods. When cold ECCS water fills the reactor and stops the boiling, the high concentration of boron in that water is sufficient to maintain the shutdown condition, even without the control rods.
Therefore, no modifications are required to the reactivity control top events in typical PRA LOCA analyses to make them applicable to LOCAs on top of the RPV head.
Implications of GSI-191, Containment Sump Blockage:
Recently, the NRC's Office of Regulatory Research identified a potential vulnerability associated with the assumptions used in the licensing of pressurized-water reactors (PWRs). Specifically, the concern is that debris from the containment could wash to the screen that surrounds the sump in the containment building and block the water flow through it sufficiently to fail the ECCS when it switches to recirculation mode and draws water from that sump. This issue is not unique to Davis-Besse. This issue has been designated as a generic safety issue, GSI-191, and is applicable to all PWRs, including Davis-Besse.
A Los Alamos National Laboratory (LANL) report documents the results of a research effort that was focused on determining whether sump blockage due to debris posed a credible concern.
This LANL study used a number of assumptions in debris generation, transport, and accident sequence modeling, data from one volunteer plant, and limited data from other plants. The study concluded that debris poses a credible concern. However, with respect to the plant-specific results in the report, the LANL report concluded that the tabulated results and the supporting parametric study are inadequate to draw conclusions about the susceptibility of specific plants to sump clogging. This is due to lack of plant-specific data and the degree to which a number of assumptions were employed in the development of the tabulated results.
Predecisional On that basis, it would be inappropriate to incorporate the results for Davis-Besse from the LANL study in the base estimate for the CDF in this risk analysis. However, it is appropriate to include a sensitivity study case for the effect of the LANL results, so that a measure can be obtained for the level of uncertainty that the outstanding issue represents.
The LANL results for the parameter evaluation study case that used available Davis-Besse parameters assigned unlikely ratings for sump blockage during small and medium LOCAs and a likely rating for large LOCAs. An unlikely rating is qualitatively defined as indicating that sump blockage is not a concern. A likely rating was given a nominal quantification with a probability of 0.6. Therefore, the sensitivity case has no effect on the CCDPs for the nozzle ejection event or the rupture of the clad under the as-found cavity, which are medium LOCAs. However, rupture of the clad under a cavity that had grown large enough to be susceptible to normal RCS operating pressure would constitute a large LOCA, and, although no quantification was achieved for that contribution to the CDF, that contribution would be increased by a factor of about 56 for the sensitivity case.
The LANL study definition of a large LOCA spans a wide range of rupture sizes, from one hole 6-inches in diameter to two holes 36-inches in diameter, and it did not consider ruptures located on the reactor pressure vessel. For this reason, the assumptions for a hole approximately 20 inches in diameter located on the reactor vessel head should be reconsidered with the LANL parameter study methodology before drawing any conclusions with respect to the affect of sump blockage on the risk due to head wastage. Additional plant-specific information that indicates the risk effect may be less than indicated are (1) there is no fibrous insulation material inside the reactor cavity at Davis-Besse and (2) the bottom of the reactor cavity does not have a direct path to the containment sump.
Implications of Fuel Assembly Spacer Collapse:
In a letter dated May 24, 1996, Framatome Technologies informed the NRC of a Potential Safety Concern related to the performance of its fuel assemblies under physical loads resulting from a design-basis large LOCA (reference 15). Specifically, the loads associated with the double-ended break of the largest cooling water pipe, combined with the design-basis seismic loads, were calculated to deform the zirconium alloy spacer grids and compact the fuel pins into a less easily cooled configuration in the interior of the core as well as at the core periphery. The calculations used to demonstrate compliance of the ECCS with 10 CFR 50.46 had addressed deformation of peripheral assemblies, but not interior assemblies. The solution requested was to allow credit for leak-before-break behavior of the largest RCS pipes so that the consequential damage to the fuel assembly grids could be excluded from the design-basis analysis. An NRC staff member raised this issue as having potential relevance to this SDP analysis, because leak-before-break credit cannot be applied to the exposed clad material under a large cavity in the low-alloy steel pressure boundary. For a cavity large enough to fail at normal operating pressure, the resulting LOCA would be larger than the 10.5-inch diameter core flood tank pipe that is the most limiting break when leak-before-break credit is applied.
Review of the material supplied by Framatome indicates that this issue should not affect the conclusions of this analysis for several reasons. Foremost is the location of the break. Fuel assembly grid deformation is caused by horizontal depressurization loads that are greatest for
Predecisional break locations to one side of the core, such as in one of the large coolant loop pipes. For failure of a nozzle in the center of the head, horizontal loads are expected to be substantially less.
Also, the Framatome analyses indicate that loads up to one-third those calculated for the largest break would not produce plastic deformation in the core interior assemblies. For the sequence involving failure of the clad under an enlarged cavity, the equivalent diameter of the failed area would be about 18-to-20 inches. This is about one-quarter to one-third of the cross sectional area of the largest pipe. For design-basis accidents, the pipe break is assumed to discharge reactor coolant from both ends. So, the LOCA postulated for rupture of an enlarged cavity should be within the LOCA size range that Framatome indicates would not produce an unanalyzed degree of plastic deformation in the fuel spacers.
Finally, the Framatome analyses indicate that the fuel geometry would remain coolable following the plastic deformation from a larger LOCA, although the heat transfer capability would be reduced enough to cause the fuel temperature to exceed the ECCS acceptance criterion of 2200
°F. With respect to the risk analysis, the significant question for a larger LOCA is whether the change in coolability would change the number of trains of ECCS equipment needed to prevent the core from melting, which would change the CCDP for the LOCA. Based on the information submitted by Framatome, the size LOCA contemplated for cavity failure in the RPV head would not be expected to deform the fuel enough to change the amount of ECCS equipment needed to prevent core damage.
On that basis, this issue does not affect the analyses for mitigation of the potential LOCAs associated with the Davis-Besse head degradation mechanisms.
Increase in Core Damage Frequency (CDF):
Normally, the total risk increase would be computed by simple multiplication of the frequency for each type of pressure boundary failure by the CCDP appropriate for the LOCA size and summation of the products. However, in this case, the frequency estimates for two of the three types of pressure boundary failures are not complete enough to be treated in the normal manner.
Each is discussed separately, below.
Rupture of the as-found cavity Engineering evaluations of the as-found cavity predict a very high failure pressure, but do not include the potential effects of flaws in the clad material that could be exposed by the cavity.
Without consideration of clad flaws, rupture of the as-found cavity during a transient RCS pressure increase does not appear to make a significant contribution to the core damage frequency. Frequency estimates for the as-found cavity to burst due to pressure transients are on the order of 10-4 to 10-7/RY.
Consideration of the size distribution of flaws and the probability of one occurring in an area of exposed clad could change this result, but without doing that analysis in a quantitative manner, it is not possible to conclude whether a predominance of large flaws would increase the risk by lowering burst pressures of small cavities or a predominance of small flaws would decrease the overall risk by introducing a substantial probability that the cavity floor failure would be a leak
Predecisional before the exposed area became large enough to rupture. In the limited consideration of cavities no larger than the one found at Davis-Besse, the occurrence of flaws is most likely to increase the contribution to the overall risk. Therefore, the risk contribution from this part of the analysis is considered to be potentially greater than indicated by the product of the calculated LOCA frequencies and the CCDP for the Medium LOCA.
Rupture LOCA Type Size Frequency CCDP CDF as-found medium $ 10-4/RY
- 2.91 x 10-3 $ 3 x 10-7/RY
- cavity or or
$ 10-7/RY * $ 3 x 10-10/RY *
- Does not account for effects of flaws in clad Both alternative estimates produce numerical results that are in the lowest SDP significance range for CDF values. However, without an analysis for the effects of flaws in the clad material, it is not possible to use this result to assign a color to the as-found condition, because the true value may be substantially higher. Engineering evaluations of the effects of flaws on clad strength are in-progress, but are not available in time for this preliminary risk assessment.
Rupture of an enlarged cavity Additional enlargement of the cavity to the point of rupture appears to have the potential to dominate the risk associated with this performance deficiency. This is due to the relatively short times, 1 to 2 years, that would be required for the cavity to grow from the as-found size to a size that would rupture, if the rate of corrosion during the additional period is as high as some laboratory experiments have found to be possible. However, it is not known whether the conditions on the Davis-Besse head were capable of producing such high rates of corrosion or sustaining those rates when the cavity size became much larger. So, there is also a potential that the cavity would not be able to grow large enough to rupture.
Because we were unable to reach a consensus within the NRC staff on a relevant and appropriate approach, with supporting data for treating the cavity size in a probabilistic manner, it is not feasible to quantify the risk contribution from the cavity growth potential. It is important to recognize that this unquantified contribution exists, and may or may not increase the total CDF substantially above the total produced from the quantifiable parts of this analysis.
Nozzle ejection due to circumferential cracking The estimate for the frequency of nozzle ejection is based on 1) knowledge that three of the center nozzles appear to have been leaking for extended periods, 2) that they are made of a heat of Alloy 600 material that has been found to be relatively susceptible to cracking in two plants and
- 3) that this material has behaved worse at Davis-Besse than at the other plants. The evaluation of circumferential cracking is based on models that draw on substantial laboratory data. This provides a greater degree of confidence that the appropriate phenomena have been identified and some confidence that the quantification process has produced results in an appropriate
Predecisional range. Still, this assessment required the selection of some plausible values from the range of laboratory data, based on inferences from the circumstances of this inspection finding. Until laboratory analyses are completed on the nozzle material that was taken from the Davis-Besse reactor, there will be significant uncertainty in the appropriateness of the values chosen. But, for this portion of the assessment, the analysis is adequately complete and the level of uncertainty not outside customary levels for significance determination.
Rupture LOCA Type Size Frequency CCDP CDF nozzle medium 2.7 x 10-2/RY 2.91 x 10-3/RY 8.0 x 10-5/RY ejection The CDF increase is in the high end of the 10-5/RY range and plausibly in the low end of the 10-4/RY range if leakage from all nozzles is considered.
Conclusions about total CDF increase Due to the substantially different nature of the results from the three parts of this risk assessment, it is difficult to draw conclusions about the overall risk significance. The estimate of the risk due to the potential for circumferential cracking is sufficient to put the total in the high 10-5/RY range. The unquantified risk due to additional cavity growth modifies the overall conclusion to be at least in the 10-5/RY range.
Contrast with Conditional Core Damage Probability:
From the standpoint of the level of risk that actually existed at the Davis-Besse site in February 2002, neither the size of the as-found cavity around Nozzle 3, nor the indicated size of the circumferential flaw that was detected in Nozzle 2 suggest that the plant was in imminent danger of experiencing a LOCA. However, until the effects of flaws in the clad material are analyzed for their effects on the probabilities of rupture and leak before rupture, it is not possible to conclude what level of risk was created by the as-found cavity.
It is important to recognize that the CDF estimate for the performance deficiency at Davis-Besse differs from a risk assessment of the as-found condition. In addition to the as-found condition, it considers what other outcomes could have occurred, given the lack of preventive capabilities inherent in the performance deficiency. This provides an instructive insight for focusing NRC inspection efforts on the deficiencies that have high risk significance, even when the specific manifestation that first reveals a deficiency does not constitute an immediate hazard to the public safety.
Sensitivity to Sump Blockage:
The GSI-191 parameter study report assigns a significant sump blockage probability to Davis-Besse for large LOCAs only. Thus, for this risk assessment, only the unquantified risk contribution from rupture of a substantially enlarged cavity would be affected by this issue. The GSI-191 report assigns a nominal value of 0.6 to the cases it terms likely to experience sump
Predecisional blockage. If the CCDP for a large LOCA is increased to 0.6, the unquantified contribution due to cavity growth would be increased by a factor of 56. That would make it more likely to make a substantial increase in the total CDF, but that is not certain until the contribution due to cavity growth can be quantified. Therefore, consideration of the sump blockage issue cannot substantially alter the risk perspective achieved with this assessment.
Increase in Large Early Release Frequency (LERF):
Davis-Besse has a large dry type containment. This containment type typically has a relatively small probability for early failure following a core damage accident caused by a LOCA. The Davis-Besse IPE estimates the conditional containment failure probability as 0.006. Values less than 0.1 will not affect the color assignment in an SDP analysis, because the color thresholds for increases in LERF are a factor of 0.1 times the thresholds for the increases in CDF.
Sensitivity to Davis-Besse Containment Corrosion Concern:
To date, no information has been reported that indicates the Davis-Besse containment is degraded to the point that its probability for early failure following a medium or large LOCA is significantly increased. If the significance determination for the nozzle leaks is based only on the risk associated with nozzle ejection due to circumferential cracking, then an increase in containment failure probability to a value of at least 0.13 would be needed to increase the significance from greater than 8x10-5/RY based on CDF to greater than 1x10-5/RY based on LERF. The value of 0.13 represents an increase by about a factor of 20 over the value derived in the Davis-Besse IPE.
Any containment degradation finding would receive a separate risk assessment and a separate color assignment, and the ROP action matrix would be applied to determine the appropriate regulatory response for the combination of the two findings.
Predecisional
References:
- 1. Stochastic Failure Model for the Davis-Besse RPV Head, ORNL/NRC/LTR, P.T. Williams and B. R. Bass, Oak Ridge National Laboratory, August 23, 2002.
- 2. Elasto-Plastic Analysis of Constrained Disk Burst Tests, ASME 72-PVP-12, P. C. Riccardella, American Society of Mechanical Engineers, 1972.
- 3. Letter serial number 1-1268 from FirstEnergy Nuclear Operating Company to U. S. Nuclear Regulatory Commission dated April 8, 2002, transmitting Safety Significance Assessment of the Davis-Besse Nuclear Power Station (DBNPS) Reactor Pressure Vessel head.
- 4. Letter serial number 1-1277 from FirstEnergy Nuclear Operating Company to U. S. Nuclear Regulatory Commission dated June 12, 2002, subject Confirmatory Action Letter: Response to Request for Additional Information Related to the Davis-Besse Nuclear Power Station Safety Significance Assessment.
- 5. E-mail from Dale Wuokko, FirstEnergy Nuclear Operating Company to Jon Hopkins, U. S.
Nuclear Regulatory Commission dated August 27, 2002, 9:11 am, subject Instability for Failure Pressure.
- 6. Pressure-Dependent Fragilities for Piping Components, NUREG/CR-5603, October 1990.
- 7. Assessment of ISLOCA Risk-Methodology and Application to a Babcock and Wilcox Nuclear Power Plant, NUREG/CR-5604, April 1992.
- 8. Boric Acid Corrosion Guidebook, Revision 1, Electric power Research Institute, November 2001. [Licensed Proprietary Material]
- 9. Analysis of the Davis-Besse RPV Head wastage Area and Cavity, ORNL/NRC/LTR, P.T.
Williams and B. R. Bass, Oak Ridge National Laboratory, September 2002.
- 10. Letter serial number 2745 from FirstEnergy Nuclear Operating Company to U. S. Nuclear Regulatory Commission dated November 1, 2001, subject Transmittal of Davis-Besse Nuclear Power Station Risk Assessment of Control Rod Drive Mechanism Nozzle Cracks.
- 11. Memorandum from W. J. Shack, Argonne National Laboratory to W. H. Cullen, Jr., U. S.
Nuclear Regulatory Commission, subject Updated Calculations for Probability of Failure of CRDM Nozzles, July 31, 2002.
- 12. E-mail from W. J. Shack, Argonne National Laboratory to W. H. Cullen, Jr., U. S. Nuclear Regulatory Commission, subject Update on Probability of Cracking, July 31, 2002, 5:42 pm.
- 13. Summary of On-Going NRC Efforts to Define Circumferential-Crack-Driving-Force Solutions for CRDM Nozzles, G. Wilkowski, Z. Feng, D. Rudland, Y.-Y. Wang, R. Wolterman, and W.
Norris, Transactions of the 2002 Nuclear Safety Research Conference, NUREG/CP-0178, October 2002.
Predecisional
- 14. Memorandum from Walton Jensen, U. S. Nuclear Regulatory Commission to Gary Holahan, U.S. Nuclear Regulatory Commission, subject Sensitivity Study of PWR Reactor Vessel Breaks, May 10, 2002. ADAMS Accession Number ML021340306.
- 15. Letter from Framatome ANP to U. S. Nuclear Regulatory Commission, subject Interim Report of Potential Safety Concern on Mark-B Grid Deformation, Framatome Technologies PSC 21-96-5, May 24, 1996.
Predecisional Application of the Principles of Risk-Informed Decision-Making to the Phase 3 Significance Determination for Cavity in Davis Besse Reactor Pressure Vessel Head The phenomena that produced the cavity were not expected and are still not adequately understood. In addition, it is not clear how to construct the appropriate logic for estimating the probability that a similar cavity would be discovered before it ruptures during operation. The cavity at Davis-Besse was discovered because of actions taken by the NRC in response to discoveries of a different degradation phenomenon (circumferential cracking of CRDM nozzles) at a different plant a year before the discovery at Davis-Besse. Therefore, properly understanding the probability of discovery before rupture involves understanding the probabilities for two different, (though perhaps linked) degradation phenomena at multiple plants.
In addition to the problems with obtaining a realistic risk estimate for the Davis-Besse cavity creation process and circumstances, it is arguable that the risk value alone does not fully represent the significance of this licensees performance deficiency. For example, even if the clad is found to be uniformly strong and the cavity is found to be growing slowly enough to allow many more years of operation before rupture would occur, it was still only a matter of good fortune, rather than good design or good planning, that the clad successfully served as the pressure boundary. The structural element that was designed to provide the pressure boundary had been completely corroded away.
Because the staff recognizes substantial vulnerabilities in purely risk-based decision processes, Regulatory Guide (RG) 1.174 was developed to provide a risk-informed decision-making process that integrates numerical risk estimates with other deterministic information. Consideration of the other key principles enumerated in RG 1.174 provides additional insights that may be useful for reaching a risk-informed decision regarding appropriate agency actions in response to the performance deficiency.
Principle 1 - Regulations are met: In this case, regulations were not met in more than one respect. Clearly, pressure boundary leakage* occurred, although none is permitted by technical specifications, but, pressure boundary leakage occurs occasionally in plants without unacceptably poor licensee performance. The highly significant aspect of this leakage at Davis-Besse was the extended period over which it was allowed to persist, and the extent of the damage that it created to a safety-significant structure. That damage is contrary to the general design criteria (GDC) requirements in the regulations, in particular, the requirement that the RCS be inspected and Pressure boundary leakage is defined in Technical Specifications to be leakage through a nonisolatable flaw in a reactor coolant system component body, pipe wall or vessel wall (except flaws in steam generator tubes, where leakage is limited by separate specifications). It does not include leakage through bolted connections or valves.
Attachment B
maintained in a condition that has an extremely low probability of abnormal leakage or gross failure.
Principle 2 - Defense-in-depth is maintained: In this case, no physical barrier was breached, although one physical barrier was nearly eliminated. The physical effect on the part of that barrier that is credited in the plants design-basis appears to be more appropriately addressed in the next principle with respect to safety margins. However, the defense-in-depth principle applies to processes as well as barriers. The processes of design, fabrication, pre-service testing, operation within limits, maintenance and in-service inspection are intended to provide assurance through redundancy of the adequacy of the RCS pressure boundary for the life of the plant. In that context, failures of the maintenance and inspection aspects of the licensees performance were sufficient to defeat the design feature. Based on the licensees analysis of the root cause, if the head had been maintained in a clean state or the inspections had been performed for leaking nozzles in a complete manner, the cavity would have been discovered before it reached a threatening size. This is a performance deficiency that degraded the level of defense in depth.
Principle 3 - Sufficient safety margins are maintained: In this case, the design margin for the strength of reactor pressure vessel head is provided solely by the carbon steel forging; the strength of the clad material was not credited in the design process. Therefore, safety margins were not maintained during this degradation event.
Principle 4 - The risk is low: This principle is addressed in Attachment A (Risk Assessment and Insights report).
Principle 5 - The impact of the situation was monitored with strategies sufficient to assure adequate performance: In this case, the licensee was unaware of the leaks in the CRDM nozzles and of the possibility for corrosion of the low alloy steel during operation. In addition, dispositions of several noted abnormal conditions were inappropriately based on false assumptions about the locations of leaks and the possibilities of nozzle cracking and head wastage. The licensees performance provided no basis for assuring that the degradation would be adequately managed or even discovered prior to pressure boundary rupture.
In summary, the licensees performance was inconsistent in some manner with all four of the principles that are used in conjunction with low risk to find that an action or design change is acceptable. These additional insights could be used to support a deviation from the agency response specified by the Action Matrix if portions of the numerical risk assessment are considered too speculative to be the basis for a significance determination, and the remaining quantifiable aspects do not appear to adequately capture the risk significance.