ML030560426
| ML030560426 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 02/25/2003 |
| From: | Dyer J Division of Nuclear Materials Safety III |
| To: | Myers L FirstEnergy Nuclear Operating Co |
| References | |
| EA-03-025, FOIA/PA-2005-0261 IR-02-008 | |
| Download: ML030560426 (46) | |
See also: IR 05000346/2002008
Text
February 25, 2003
Mr. Lew Myers
Chief Operating Officer
FirstEnergy Nuclear Operating Company
Davis-Besse Nuclear Power Station
5501 North State Route 2
Oak Harbor, OH 43449-9760
SUBJECT: DAVIS-BESSE CONTROL ROD DRIVE MECHANISM PENETRATION
CRACKING AND REACTOR PRESSURE VESSEL HEAD DEGRADATION
PRELIMINARY SIGNIFICANCE ASSESSMENT
(REPORT NO. 50-346/2002-08(DRS))
Dear Mr. Myers:
On February 16, 2002, the Davis-Besse Nuclear Power Station was shut down for refueling and
inspection of control rod drive mechanism reactor pressure vessel head penetration nozzles.
Your staff discovered that Nozzles Nos. 1, 2, and 3 were leaking through axial cracks, and
discovered that Nozzle No. 2 had begun to develop a circumferential crack. During repair of
Nozzle No. 3 on March 5 and 6, 2002, it became loose in the reactor pressure vessel head.
Subsequent investigation revealed that a cavity had formed adjacent to Nozzle No. 3 in the
thick low-alloy steel portion of the reactor pressure vessel head, leaving only a thin stainless
steel clad material as the reactor coolant pressure boundary over an area of approximately
20 square-inches. A similar but much smaller cavity was subsequently identified at the location
of the leaking crack in Nozzle No. 2. Your staffs root cause analysis report concluded that the
axial crack in Nozzle No. 3 had likely been leaking for a period of six to eight years.
On March 12, 2002, the NRC dispatched an Augmented Inspection Team (AIT) to the
Davis-Besse site in accordance with NRC Management Directive 8.3, NRC Incident
Investigation Program. The AIT was chartered to determine the facts and circumstances
related to the significant degradation of the reactor pressure vessel head discovered by your
staff. The AIT results were summarized for you and your staff during a public exit meeting on
April 5, 2002, and the AIT report was issued on May 3, 2002. Subsequently, on May 15, 2002,
the NRC began a special AIT Follow-up inspection focused on the results documented in the
AIT report. The NRC completed this inspection and summarized the results of the inspection
for you and your staff on August 9, 2002. The AIT Follow-up report was issued on
October 2, 2002.
The performance deficiency associated with the AIT Follow-up inspection findings was your
failure to properly implement the boric acid control and the corrective action programs, which
allowed reactor coolant system (RCS) pressure boundary leakage to occur undetected for a
prolonged period of time resulting in reactor pressure vessel head degradation and control rod
drive nozzle circumferential cracking. This letter presents the results of the NRCs preliminary
significance determination for this performance deficiency.
L. Myers -2-
On March 27, 2002, you provided a schedule for your evaluation of the safety significance of
the reactor pressure vessel head degradation. Your evaluation was completed and submitted
to the NRC on April 8, 2002, and supplemented with additional information on June 12, July 12
and 20, and November 18, 2002. The NRC assessment of the significance of this performance
deficiency considered the information you have provided.
As discussed in detail in the enclosure, the significance of this performance deficiency was
assessed using the NRC Significance Determination Process. The performance deficiency
resulted in an increase in the risk of reactor core damage through a loss of coolant accident
caused by either a rupture in the exposed cladding in the reactor pressure vessel head cavity or
a control rod drive mechanism nozzle ejection due to a circumferential crack. The result of our
significance analysis of the as-found reactor pressure vessel head cavity and potential for larger
cavity growth indicate that the significance is in the Red range (change in core damage
frequency > 10-4 per reactor-year). The result of our significance analysis of the as-found
circumferential crack and potential for crack growth indicate that the significance is in the
Yellow to Red range (change in core damage frequency in the range of low 10-5 to low 10-4 per
reactor-year). Consequently, the NRC has preliminarily determined that the performance
deficiency resulting in the reactor pressure vessel head degradation and control rod drive
mechanism nozzle cracking has high safety significance in the Red range.
Be advised that this significance assessment is preliminary. The final significance assessment
will include consideration of any further information or perspectives you provide that may
warrant reconsideration of the methodology or assumptions used during the preliminary
significance assessment.
Before we make a final decision on the significance of this performance deficiency, we are
providing you another opportunity to present to the NRC any further perspectives on the facts
and assumptions used by the NRC to arrive at its preliminary significance determination at a
Regulatory Conference or by a written submittal. Any perspectives you provide should be
limited to the significance assessment, and should not discuss the apparent violations, their root
causes or your corrective actions.
If you choose to request a Regulatory Conference, it should be held within 30 days of the
receipt of this letter and we encourage you to submit supporting documentation at least one
week prior to the conference in an effort to make the conference more efficient and effective. If
a Regulatory Conference is held, it will be open for public observation. If you decide to submit a
written response, such submittal should be sent to the NRC within 30 days of the receipt of this
letter.
Please contact Christine Lipa at 630-829-9619 within 10 business days of your receipt of this
letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will
finalize our significance determination and you will be advised by separate correspondence of
the results of our deliberations on this matter.
Completing the significance determination for this performance deficiency is one input into the
NRCs final decision on enforcement action. Another critical input will be the results of the
ongoing investigation by the NRCs Office of Investigations.
L. Myers -3-
In accordance with 10 CFR 2.790 of the NRCs Rules of Practice, a copy of this letter
and its enclosures will be available electronically for public inspection in the NRC Public
Document Room or from the Publicly Available Records (PARS) component of NRCs
document system (ADAMS). ADAMS is accessible from the NRC Web site at
http://www.nrc.gov/reading-rm/adams.html.
Sincerely,
/RA/
J. E. Dyer
Regional Administrator
Enclosure: Significance Determination Process and
Enforcement Review Panel Worksheet for SDP-Related
Findings: Davis-Besse Degraded Reactor Head
Docket No. 50-346
License No. NPF-3
See attached distribution list
cc w/encl:
Plant Manager
Manager - Regulatory Affairs
M. OReilly, FirstEnergy
State Liaison Officer, State of Ohio
R. Owen, Ohio Department of Health
Ohio Public Utilities Commission
C. Emahiser, Ottawa County Sheriff
J. P. Greer, Director, Emergency
Management Agency
S. Isenberg, President, Lucas County
Board of Commissioners
J. Telb, Lucas County Sheriff
B. Halsey, Director, Emergency
Management Agency
G. Adams, Village Administrator, Genoa
The Honorable Robert Purney
The Honorable Lowell C. Krumnow
The Honorable Joseph Verkin
The Honorable Thomas Leaser
The Honorable Jack Ford
The Honorable Thomas Brown
The Honorable Joe Ihnat
President, Ottawa County Board of Commissioners
D. Lochbaum, Union of Concerned Scientists
Distribution w/encl:
W. Kane, DEDR
J. Craig, OEDO
J. Dyer, RIII
S. Collins, NRR
G. Caputo, OI
H. Bell, OIG
F. Congel, OE
J. Grobe, RIII
R. Paul, OI:RIII
L. Chandler, OGC
W. Dean, NRR
J. Luehman, OE
D. Dambly, OGC
C. Lipa, RIII
H. Nieh, OEDO
J. Ulie, OI:RIII
C. Weil, RIII
D. Nelson, OE
L. Dudes, NRR
L. Myers -3-
In accordance with 10 CFR 2.790 of the NRCs Rules of Practice, a copy of this letter
and its enclosures will be available electronically for public inspection in the NRC Public
Document Room or from the Publicly Available Records (PARS) component of NRCs
document system (ADAMS). ADAMS is accessible from the NRC Web site at
http://www.nrc.gov/reading-rm/adams.html.
Sincerely,
J. E. Dyer
Regional Administrator
Enclosure: Significance Determination Process and
Enforcement Review Panel Worksheet for SDP-Related
Findings: Davis-Besse Degraded Reactor Head
Docket No. 50-346
License No. NPF-3
See attached distribution list
C:\ORPCheckout\FileNET\ML030560426.wpd
NAME JGrobe:klg DDambly FCongel SCollins JDyer
/RA/ J.Grobe /RA/ J.Grobe /RA/ J.Grobe
per telecon per telecon per telecon
w/Dambly w/Luehman w/Borchardt
DATE 02/20/03 02/20/03 02/20/03 02/20/03 02/24/03
OFFICIAL RECORD COPY
Significance Determination Process (SDP) and Enforcement Review Panel
Worksheet for SDP-Related Findings
Davis-Besse Degraded Reactor Head
Panel Date: February 6, 2003
Cornerstone Affected and Proposed Preliminary Results:
Initiating Events & Barrier Integrity Cornerstones:
- Red Finding
- Specific Violations and Severity Level to be determined following completion of OI
investigation
Licensee: FirstEnergy Nuclear Operating Company
Facility/Location: Davis-Besse Nuclear Power Station / Oak Harbor, OH
Docket No: 05000346
License No: DPR-25
Inspection Report No: 50-346/2002-008
Date of Exit Meeting: August 9, 2002
Issue Sponsor : Jack Grobe
Meeting Members:
Issue Sponsor : Jack Grobe
Technical Spokesperson(s) : Sonia Burgess / Steve Long
Program Spokesperson : Cindy Carpenter / Mike Johnson
OE Representative : Jim Luehman
CONTENTS
A. Brief Description of Issue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
B. Statement of the Performance Deficiencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
C. Significance Determination Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1. Reactor Inspection for IE, MS, BI Cornerstones . . . . . . . . . . . . . . . . . . . . . 2
a. Phase 1 Screening Logic, Results and Assumptions . . . . . . . . . . . 2
b. Phase 2 Risk Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
c. Phase 3 Risk Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Analysis of the RPV Head Cavity . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Analysis of CRDM Circumferential Cracking . . . . . . . . . . . . . . . . . 6
Potential Risk Contribution due to Large Early Release Frequency
(LERF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Potential Risk Contribution due to External Events . . . . . . . . . . . . 7
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2. All Other Inspection Findings (not IE, MS, BI cornerstones) . . . . . . . . . . . 8
D. Proposed Enforcement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
E. Determination of Follow-up Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
SDP Worksheets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Attachment 1 Insights from Regulatory Guide (RG) 1.174 to Confirm Risk Characterization
Attachment 2 TIA 2002-01, Response to Request for Technical Assistance - Risk
Assessment of Davis-Besse Reactor Head Degradation
1
A. Brief Description of Issue
During an inspection of the control rod drive mechanism (CRDM) nozzles in February and
March 2002, the licensee discovered three nozzles (Nos. 1, 2 and 3) which contained through-wall
axial cracks, and that Nozzle No. 2 had developed a small circumferential crack. During repair of
Nozzle No. 3, it became loose in the reactor pressure vessel (RPV) head. Subsequent
investigation revealed that a cavity had formed around Nozzle No. 3 in the 6.63 inch-thick low-alloy
steel portion of the RPV head, leaving only the stainless steel clad material (measuring 0.202 to
0.314 inches-thick) as the reactor coolant pressure boundary over an area of approximately 20
square-inches. A similar but much smaller cavity was subsequently identified at the location of the
through-wall crack in Nozzle No. 2. The licensees root cause analysis report concluded that the
through-wall axial crack in Nozzle No. 3 had most probably been leaking for a period of 6 to 8
years before detection in February 2002.
B. Statement of the Performance Deficiencies
The performance deficiency associated with this finding was the licensees failure to properly
implement the boric acid control and the corrective action programs, which allowed reactor coolant
system (RCS) pressure boundary leakage to occur undetected for a prolonged period of time
resulting in reactor pressure vessel head degradation and CRDM nozzle circumferential cracking.
C. Significance Determination Basis
1. Reactor Inspection for Initiating Event (IE), Mitigating Systems (MS), Barrier
Integrity (BI) Cornerstones
a. Phase 1 Screening Logic, Results and Assumptions
In accordance with Manual Chapter (MC) 0612, the inspectors determined
that the issue was more than minor in safety significance because if left
uncorrected, the circumferential cracking and boric acid corrosion would
become a more significant safety concern. The resulting circumferential
cracking and cavity represent a significant loss of the design basis barrier
integrity and could be reasonably viewed as a precursor to a significant
event.
In accordance with MC 0609, Appendix A, the inspectors conducted a SDP
Phase 1 screening and determined that the finding degraded both the
Initiating Event and Barrier Integrity Cornerstones. The through-wall CRDM
axial cracks and developing circumferential cracks, and the RPV wastage
compromised the reactor coolant pressure boundary and resulted in an
increase in the likelihood of a loss of coolant accident (LOCA).
b. Phase 2 Risk Evaluation
Internal Initiating Events
Assumptions:
During March 2002, the region performed a Phase 2 risk assessment using
the Revision 0 unbenchmarked Davis-Besse SDP worksheets and
determined that the issue could be characterized as a Yellow when
increasing the LOCA initiating event likelihood one order of magnitude, or a
2
Red when increasing the LOCA initiating event likelihood two orders of
magnitude. The regional Senior Reactor Analyst later performed an
evaluation of the issue using the benchmarked Revision 1 SDP worksheets
(issued in February 2003) and determined that the color characterization of
the finding did not change.
SDP Worksheet Results (Initial Results...see Attached Worksheets)
SLOCA -Small LOCA
SLOCA (2 or 1) + EIHP (5) = 7 or 6
SLOCA (2 or 1) + HPR (3) = 5 or 4
SLOCA (2 or 1) + PCS (2) + AFW (5) + EIHP (2) = 11 or 10
SLOCA (2 or 1) + PCS (2) + AFW (2) + FB (2) = 11 or 10
MLOCA - Medium LOCA
MLOCA (3 or 2) + LPR (3) = 6 or 5
MLOCA (3 or 2) + LPI (3) = 6 or 5
MLOCA (3 or 2) + EIHP (3) = 6 or 5
LLOCA - Large LOCA
LLOCA (4 or 3) + LPI (3) = 7 or 6
LLOCA (4 or 3) +LPR (2) = 6 or 5
Based on the Phase 2 SDP results, this issue is considered to be of high
safety significance, potentially RED (change in Core Damage Frequency
( CDF) >10-4 per Reactor Year (RY)), when the LOCA initiating event
frequency is increased two orders of magnitude.
c. Phase 3 Risk Evaluation
The Phase 3 risk evaluation was performed as an outcome risk analysis that
focused on two LOCA initiation scenarios:
- the as-found cavity and the potential for cavity growth, and
- the as-found circumferential crack and the potential for crack growth
Other potential outcomes from the licensees performance deficiency were
not evaluated. What follows are summaries from the Phase 3 analysis
documented in the attached Response to Request for Technical
Assistance-Risk Assessment of Davis-Besse Reactor Head Degradation
(TIA 2002-01) (Attachment B).
In response to TIA 2002-01, NRR performed a Phase 3 assessment of the
risk associated with the CRDM nozzle cracking and the resulting wastage
cavity in the Davis-Besse RPV head. Early in the analysis, it was
determined that a medium or large LOCA would have resulted from the
failure of the reactor coolant system (RCS) pressure boundary; therefore,
attempts were made to determine the increase in the medium and large
LOCA frequencies that could be attributed to the licensees performance
deficiency.
3
Analysis of the RPV Head Cavity
The NRC and the licensee used a traditional material and engineering
modeling approach to evaluate the RPV cavity. Both the staffs and
licensees analyses for the failure pressure of the modeled cavity resulted in
estimates in excess of 7000 psig. Both of the respective uncertainty
analyses indicated that the probability for rupture of the modeled cavity due
to pressure transients was very low (i.e., CDF<10-6/RY).
However, it is important to note that the Phase 3 analyses for this modeling
of the as-found condition highlighted significant unanalyzed parameters for
which we have insufficient knowledge to appropriately apply to the risk
analysis:
- Flaws in clad material. The clad material was treated in the model as
if it was a plate of uniform thickness with uniform stress-strain. The
clad was neither designed nor acceptance tested to serve as a
structural element of the vessel design, so it may contain structurally
significant flaws that are not represented in the analysis.
Consideration of the size distribution of flaws and the probability of
one occurring in an area of exposed clad could change the risk
result, but without doing a flaw analysis in a quantitative manner, it is
not possible to conclude whether there is a predominance of large
flaws which would increase the risk by lowering burst pressures of
small cavities or a predominance of small flaws which would
decrease the overall risk by introducing a substantial probability that
the clad would leak and be detected before the exposed area
became large enough to rupture. In the limited consideration of
cavities no larger than the one found at Davis-Besse, the occurrence
of flaws is most likely to increase the contribution to the overall risk.
Engineering evaluations of the as-found cladding material and the
effects of flaws on clad strength are in progress, but are not available
at this time for this SDP preliminary risk assessment.
- Clad material was weld applied with thickness and material
variations. The corrosion resistant cladding on the interior of the
head was applied by a combination of an automatic and manual
welding process. The welding process results in a somewhat
non-uniform layer of clad as evidenced by clad thickness
measurements in the degraded area ranging from 0.202 inches to
0.314 inches. While the clad thickness is not uniform,
measurements indicate that the nominal design thickness of 0.187
inches was achieved. Weld material by its nature may also contain
small discontinuities and inclusions resulting in localized variations in
mechanical properties. These variations in thickness and
mechanical properties challenge the ability to precisely predict the
point at which the clad would have failed.
- Crack in clad material. An additional challenge to predicting cladding
failure is the identification of a slight distortion or bulging of the
as-found cladding material and the development of a series of small
cracks on the outer surface of the clad in the distorted area.
4
Engineering evaluations of the cracks are in progress, but are not
available at this time for this SDP preliminary risk assessment.
- Corrosion mechanism not clearly understood. The corrosion
phenomena that produced the cavity are not understood well enough
to specify the rates of corrosion or the cavity shapes that could have
occurred, or whether there is corrosion rate dependence on leak rate
or a limit on the size of the cavity that can result.
- Corrosion rates not known. Based primarily on the observed levels
of boric acid particles in the containment atmosphere, the licensees
root cause analysis report speculates that the cavity found in the
RPV head grew at an average rate of 2-inches/year over the 4-year
period of the last two operating cycles. The available evidence to
support this is certainly not conclusive, and other interpretations are
also reasonable. Corrosion rates for aqueous boric acid solutions in
a variety of physical situations are provided in the Electric Power
Research Institute Boric Acid Corrosion Guidebook. The closest
situation covered by the Guidebook appears to be the tests where an
aqueous solution of boric acid flowed across a low-alloy steel surface
that was heated to 600°F, which resulted in corrosion rates as high
as 7-inches/year. It seems reasonable to consider the possibility that
the last stages of cavity growth on the Davis-Besse RPV head may
have experienced a 7-inch/year corrosion rate. It is not known at this
time which case or what intermediate corrosion rate value is more
likely.
- The possibility of additional wastage creating a larger cavity. This
analysis is the most difficult to perform since the available data
provided limited opportunities for quantifying results. However, the
results of the analyses that were performed indicated that the
potential growth of wastage cavities beyond the as-found condition
was possible. At the most-rapid growth rates, an additional 1 to 2
years of operation would enlarge the cavity sufficiently to allow
rupture at expected pressures, depending on cavity shape.
Alternatively, at the average corrosion rate estimated by the licensee,
an additional 4 to 7 years of operation would be required. It is also
important to note that there are some reasons to suspect that the
physical processes that developed the as-found cavity may become
self-limiting at some cavity size, so that it may not even be possible
to develop a cavity that is large enough to burst at expected
pressures with leakage rates limited by the plant's technical
specifications. Alternatively, modest enlargement of the as-found
cavity could have completely exposed Nozzle No. 11, potentially
introducing additional failure mechanisms and additional
opportunities for discovering the cavity before failure occurred.
In conclusion, although the results of the initial Phase 3 modeling of the
as-found cavity suggest that the risk due to potential rupture may be low
(i.e., CDF<10-6/RY), there exists significant unanalyzed parameters in
which we have insufficient knowledge at this time to evaluate and quantify
the risk. However, given the breadth and amount of unanalyzed
parameters, there is great potential for the risk to be substantially higher
5
than that quantified for the modeled cavity. Therefore, it is not prudent for
the significance determination to disregard this potential due to the staffs
inability to quantify it with existing knowledge in a Phase 3 analysis. For that
reason, the results of the Phase 2 analysis are used for this part of the
significance assessment.
The Phase 2 process calls for the use of either one or two orders of
magnitude increase in the LOCA frequency. Increasing the MLOCA and
LLOCA frequency by two orders of magnitude would produce a Red
significance level, through the SDP counting rule, and was determined to be
appropriate given the significant unanalyzed parameters. Therefore, using
the insights of the Phase 3 assessment and the results of the Phase 2
worksheets, a reasonable characterization of the RPV head cavity risk is in
the RED range ( CDF>10-4/RY).
Analysis of CRDM Circumferential Cracking
The Possibility of Nozzle Ejection due to Circumferential Cracking
The licensee's performance deficiency resulted in prolonged, undetected
leakage of boric acid onto the reactor head through axial cracks in several
control rod drive mechanism nozzles. This increased the probability for a
LOCA because the external surfaces of the leaking nozzles could develop
circumferential cracks which could grow large enough over time that a
nozzle could break above the weld and be ejected from the head.
In fact, two nozzles were developing wastage cavities and one of those two
nozzles also was developing a circumferential crack. Thus, analyses
restricted to the risk associated with the as-found dimensions of one cavity
do not necessarily provide a full perspective on the risk associated with the
licensee's performance deficiencies.
The circumferential cracking analysis indicated that there was sufficient time
during the estimated 6 to 8 years that Nozzle No. 3 was leaking for a
circumferential crack to develop and grow large enough to cause the nozzle
to be ejected. Neither the actual stress levels in Nozzle No. 3 nor the
cracking rate as a function of stress for the material used to fabricate the
nozzle is known; however, because the same material cracked in a greater
fraction of the nozzles at Davis-Besse and appears to have leaked earlier in
the plant's life than at Oconee 3, it is inferred that the residual stress levels
must be relatively high at Davis-Besse. Because the material has cracked
more rapidly than other operating Babcock and Wilcox plants, the analysis
also used a range of cracking rates indicative of the worst heat of material in
the available laboratory data. While conservative, these assumptions are
not necessarily bounding, so the results should be used as an indication of
what the risk may be, based on what we know today. The results are about
3 x 10-2/RY for the increase in the LOCA frequency and about 8 x 10-5/RY for
the corresponding increase in CDF with a range from low 10-5/RY to low
10-4/RY .
6
Potential Risk Contribution due to Large Early Release Frequency (LERF)
Davis-Besse has a large dry type containment. This containment type
typically has a relatively small probability for early failure following a core
damage accident caused by a LOCA. The Davis-Besse Individual Plant
Evaluation estimates the conditional containment failure probability as 0.006.
Values less than 0.1 will not affect the color assignment in an SDP analysis,
because the color thresholds for increases in LERF are a factor of 0.1 times
the thresholds for the increases in CDF.
To date, no information has been reported that indicates the Davis-Besse
containment is degraded to the point that its probability for early failure
following a medium or large LOCA is significantly increased. If the
significance determination for the nozzle leaks is based only on the risk
associated with nozzle ejection due to circumferential cracking, then an
increase in containment failure probability to a value of at least 0.13 would
be needed to increase the significance from greater than 8x10-5/RY based
on CDF to greater than 1x10-4/RY based on LERF. The value of 0.13
represents an increase by about a factor of 20 over the value derived in the
Davis-Besse Individual Plant Examination.
Potential Risk Contribution due to External Events
Further expenditure of resources to analyze the external event contribution
was not warranted since the internal risk contribution alone was
characterized as RED.
Conclusion
In summary, the risk assessment indicates that there are several combinations of
factors that plausibly represent conditions resulting from the performance deficiency
at Davis-Besse and lead to CDF>10-4/RY (RED range).
- The results of the initial Phase 3 modeling of the as-found cavity suggest
that the risk due to potential rupture may be low (i.e., CDF<10-6/RY);
however, there exist significant unanalyzed parameters where we have
insufficient knowledge at this time to evaluate and quantify the risk. Given
the breadth and amount of unanalyzed parameters, the risk is clearly higher
than that quantified for the modeled cavity and justifies increasing the
initiating event frequency of MLOCA and LLOCA two orders of magnitude in
the SDP Phase 2 worksheets to properly characterize the significance of this
issue. Using the insights of the Phase 3 risk assessment and the results of
the Phase 2 SDP worksheets, a reasonable significance characterization of
the cavity is in the RED range using the counting rule for the MLOCA and
LLOCA accident sequences.
- Circumferential cracking analysis indicated that there was sufficient time
during the estimated 6 to 8 years that Nozzle No. 3 was leaking for a
circumferential crack to develop and grow large enough to cause the nozzle
to be ejected. The CDF due to the increase LOCA frequency is in the
range of 10-5/RY to 10-4/RY, YELLOW to RED.
7
In addition to these risk insights, additional perspective on the RPV head
degradation can be gained from reviewing the key principles enumerated in
Regulatory Guide 1.174. It is included as Attachment A to further demonstrate the
high significance of this performance deficiency and can be used as a confirmation
of the risk characterization outcome.
2. All Other Inspection Findings (not IE, MS, BI Cornerstones)
No other inspection findings were identified.
D. Proposed Enforcement.
a. Regulatory requirement not met.
NRC Inspection Report No. 50-346/02-08(DRS) contains several unresolved
items that remain under consideration for enforcement action.
b. Proposed citation.
Enforcement is pending contingent on the results of the ongoing OI
investigation into these matters.
c. Historical precedent.
None.
E. Determination of Follow-up Review
It is proposed that NRR, OE and OGC review final determination letter before
issuance.
8
Table 3.3 SDP Worksheet for Davis-Besse Nuclear Power Station, Unit 1 Small LOCA (SLOCA)
Estimated Frequency (Table 1 Row) III Exposure Time >30 days Table 1 Result (circle): C- B or A
when increasing IE frequency
Safety Functions Needed: Full Creditable Mitigation Capability for Each Safety Function:
Power Conversion System (PCS) 1/2 Feedwater trains with 1/3 condensate trains (operator action = 2) (1)
Secondary Heat Removal (AFW) 1/1 MDAFW trains (1 train) (2) or 1/2 TDAFW train (2 ASD trains) or 1/1 SUFPs (operator
action = 1) (3)
Primary Heat Removal, Feed/Bleed 1/1 PORV or 1/2 PSVs (operator action = 2) (4)
(FB)
High Pressure Injection (EIHP) 1/2 HPI pumps (1 multi-train system) or 2/2 Makeup pump trains requiring operator
action (5) but limited by hardware (1 train)
High Pressure Injection (EIHP2) 2/2 Makeup pump trains requiring operator action (5) but limited by hardware (1 train)
High Pressure Recirculation (HPR) 1/2 HPI trains taking suction from 1/2 LPI trains through LPI HX (operator action = 3) (6)
Circle Affected Functions Recovery Remaining Mitigation Capability Rating for Each Sequence
of Affected Sequence Color
Failed
Train
0 SLOCA (2 or 1) + EIHP (5) = 7 or 6
1 SLOCA - EIHP (3,6)
0 SLOCA (2 or 1) + HPR (3) = 5 or 4
2 SLOCA - HPR (2,5,8)
0 SLOCA (2 or 1) + PCS (2) + AFW (5) + EIHP2 (2) = 11 or 10
3 SLOCA - PCS - AFW - EIHP2 (9)
9
0 SLOCA (2 or 1) + PCS (2) + AFW (5) + FB (2) = 11or 10
Identify any operator recovery actions that are credited to directly restore the degraded equipment or initiating event:
If operator actions are required to credit placing mitigation equipment in service or for recovery actions, such credit should be given only if the following criteria are met: 1) sufficient
time is available to implement these actions, 2) environmental conditions allow access where needed, 3) procedures exist, 4) training is conducted on the existing procedures under
conditions similar to the scenario assumed, and 5) any equipment needed to complete these actions is available and ready for use.
Notes:
- The PCS should initially operate automatically. The operator needs to make sure that PCS continues to operate. This may
include manually taking control of the PCS to prevent over cooling. The IPE does not document how this operator action is
modeled.
- The utility commented that start up feedwater pump should be credited, and provided a HEP of 7.5E-2. (Event FHASUFPE.)
- The human error for initiation of HPI cooling is 1.5E-2. (Event UHAMUHPE.)
- A credit of 3 should be given to the operator action. The HEP for operator failure to align makeup system to full flow is 1.E-3.
(Event UHAMUINE.)
- The HEP for operator failure to establish HPR is 2.9E-3.
10
Table 3.5 SDP Worksheet for Davis-Besse Nuclear Power Station, Unit 1 Medium LOCA (MLOCA)
Estimated Frequency (Table 1 Row) IV Exposure Time >30 days Table 1 Result (circle): D - C or B
when increasing IE frequency
Safety Functions Needed: Full Creditable Mitigation Capability for Each Safety Function:
Early Inventory, HP Injection 1/2 HPI trains (1 multi-train systems)
(EIHP)
Low Pressure Injection (LPI) 1/2 LPI train (1 multi-train system)
Low Pressure Recirculation 1/2 LPI train taking suction from sump (operator action = 3) (1)
(LPR)
Circle Affected Functions Recovery of Remaining Mitigation Capability Rating for Each Affected Sequence
Failed Train Sequence Color
0 MLOCA (3 or 2) + LPR (3) = 6 or 5
1 MLOCA - LPR (2)
0 MLOCA (3 or 2) + LPI (3) = 6 or 5
2 MLOCA - LPI (3)
0 MLOCA (3 or 2) + EIHP (3) = 6 or 5
3. MLOCA - EIHP (4)
Identify any operator recovery actions that are credited to directly restore the degraded equipment or initiating event:
If operator actions are required to credit placing mitigation equipment in service or for recovery actions, such credit should be given only if the following criteria are met: 1) sufficient
time is available to implement these actions, 2) environmental conditions allow access where needed, 3) procedures exist, 4) training is conducted on the existing procedures under
conditions similar to the scenario assumed, and 5) any equipment needed to complete these actions is available and ready for use.
Note:
- The HEP for operator failure to initiate LPR is 3.8E-3. (Event XHALPRME.)
11
Table 3.6 SDP Worksheet for Davis-Besse Nuclear Power Station, Unit 1 Large LOCA (LLOCA)
Estimated Frequency (Table 1 Row) V Exposure Time >30 days Table 1 Result (circle): E- D or C
when increasing IE frequency
Safety Functions Needed: Full Creditable Mitigation Capability for each Safety Function:
Low Pressure Injection (LPI) 1/2 LPI train (1 multi-train system)
Low Pressure Recirculation (LPR) 1/2 LPI train taking suction from sump (operator action = 2) (1)
Circle Affected Functions Recovery of Remaining Mitigation Capability Rating for Each Sequence
Failed Train Affected Sequence Color
0 LLOCA (4 or 3) + LPI (3) = 7 or 6
1 LLOCA - LPI (3)
0 LLOCA (4 or 3) + LPR (2) = 6 or 5
2 LLOCA - LPR (2)
Identify any operator recovery actions that are credited to directly restore the degraded equipment or initiating event:
If operator actions are required to credit placing mitigation equipment in service or for recovery actions, such credit should be given only if the following criteria are met: 1) sufficient
time is available to implement these actions, 2) environmental conditions allow access where needed, 3) procedures exist, 4) training is conducted on the existing procedures under
conditions similar to the scenario assumed, and 5) any equipment needed to complete these actions is available and ready for use.
Note:
- The HEP for operator failure to initiate LPR is 6.3E-3. (Event XHALPRAE.)
12
Davis-Besse SERP Attachment 1
Using the Principles from RG 1.174 to Confirm the High Safety Significance Risk
Characterization
Because the staff recognizes substantial vulnerabilities in purely risk-based decision
processes, Regulatory Guide (RG) 1.174 was developed to provide a risk-informed
decision-making process that integrates numerical risk estimates with other deterministic
information for evaluating permanent changes to the licensing basis for nuclear power
facilities. Consideration of the other key principles enumerated in RG 1.174 provides
additional insights and confirmation that the Davis-Besse RPV head degradation
represents a finding of high safety significance. These are applied with some translation
from a process for prior approval of a regulatory change to the ROP for post-facto
evaluation of an unintended occurrence.
Principle 1 - Regulations are met: In this case, regulations apparently were not met in
more than one respect. Clearly, pressure boundary leakage* occurred, although none is
permitted by technical specifications, but, pressure boundary leakage occurs occasionally
in plants without unacceptably poor licensee performance. The highly significant aspect of
this leakage at Davis-Besse was the extended period over which it was allowed to persist,
and the extent of the damage that it created to a safety-significant structure. That damage
is contrary to the general design criteria (GDC) requirements in the regulations, in
particular, the requirement that the RCS be inspected and maintained in a condition that
has an extremely low probability of abnormal leakage or gross failure.
Principle 2 - Defense-in-depth is maintained: In this case, no physical barrier was
breached, although one physical barrier was nearly eliminated. The physical effect on the
part of the barrier that is credited in the plants design-basis appears to be more
appropriately addressed in the next principle with respect to safety margins. However, the
defense-in-depth principle applies to processes as well as barriers. The processes of
design, fabrication, pre-service testing, operation within limits, maintenance and in-service
inspection are intended to provide assurance through redundancy of the adequacy of the
RCS pressure boundary for the life of the plant. In that context, failures of the maintenance
and inspection aspects of the licensees performance were sufficient to defeat the design
feature. Based on the licensees analysis of the root cause, if the head had been
maintained in a clean state or the inspections had been performed for leaking nozzles in a
complete manner, the cavity would have been discovered before it reached a threatening
size. This is a performance deficiency that degraded the level of defense in depth.
Principle 3 - Sufficient safety margins are maintained: In this case, the design margin
for the strength of the reactor pressure vessel head is provided solely by the carbon steel
forging; the strength of the clad material was not credited in the design process.
Therefore, safety margins were not maintained during this degradation event.
Principle 4 - The risk is low: The results of the initial Phase 3 modeling of the as-found
cavity suggest that the risk due to potential rupture may be low (i.e., <10-6); however, there
Pressure boundary leakage is defined in Technical Specifications to be leakage through
a non-isolatable flaw in a reactor coolant system component body, pipe wall or vessel wall
(except flaws in steam generator tubes, where leakage is limited by separate specifications). It
does not include leakage through bolted connections or valves.
1
exists significant unanalyzed parameters where we have insufficient knowledge at this time
to evaluate and quantify the risk. Given the breadth and amount of unanalyzed
parameters, the risk is clearly higher than that quantified for the modeled cavity. Also, the
circumferential cracking analysis indicated that there was sufficient time during the
estimated 6 to 8 years that nozzle No. 3 was leaking for a circumferential crack to develop
and grow large enough to cause the nozzle to be ejected. The change in CDF due to the
increase LOCA frequency is in the 10-5/RY range.
Principle 5 - The impact of the situation was monitored with strategies sufficient to
assure adequate performance: In this case, the licensee was unaware of the leaks in the
CRDM nozzles and of the possibility for corrosion of the low alloy steel during operation. In
addition, dispositions of several noted abnormal conditions were inappropriately based on
false assumptions about the locations of leaks and the possibilities of nozzle cracking and
head wastage. The licensees performance provided no basis for assuring that the
degradation would be adequately managed or even discovered prior to pressure boundary
rupture.
In summary, the licensees performance was inconsistent in some manner with all of the
principles that are used in conjunction with low risk to find that an action or design change
is acceptable.
2
Davis-Besse SERP Attachment 2
December 6, 2002
MEMORANDUM TO: John A. Grobe, Chair
Davis-Besse Reactor Oversight Panel
Region III
FROM: Ledyard B. Marsh, Deputy Director /RA/
Division of Licensing and Project Management
Office of Nuclear Reactor Regulation
SUBJECT: RESPONSE TO REQUEST FOR TECHNICAL ASSISTANCE - RISK
ASSESSMENT OF DAVIS-BESSE REACTOR HEAD DEGRADATION
In response to your request dated May 3, 2002, we have performed an assessment of the risk
associated with the control rod drive mechanism nozzle leakage and the resulting wastage cavity
in the Davis-Besse reactor pressure vessel head. The phenomena that produced the cavity were
not expected and are still not completely understood. Our analysis attempts to assemble the
available information and quantify the risk associated with the deficiencies in the licensees
performance that allowed these conditions to occur. Where the quantification of some risk
elements would be too uncertain, our analysis attempts to explore the implications of the plausible
ranges for parameters, rather than to focus on a single value.
As requested in your memorandum, our analysis used insights from ongoing Office of Research
(RES) activities to evaluate aspects of the degradation beyond your specific questions related to
the as-found condition. These analyses include the possibility of additional wastage creating a
larger cavity and the possibility of nozzle ejection due to circumferential cracking. Because the
wastage mechanism is not well understood, and because probabilistic risk assessments typically
do not address long-term degradation phenomena, we found that the available tools were not
sufficient to quantify the risk from additional wastage. The insights we did obtain are included in
our response to you because they provide additional perspective beyond what would be reached
by focusing solely on the probability of rupture for a cavity. As more information becomes
available from ongoing studies, it may be possible to derive additional insights and reach a
consensus on the methods best suited to the analysis of the wastage issue. At this time, the
results of our analysis of the potential for rupture due to cavity enlargement are too uncertain to be
added directly to the other parts of the analysis, but the results of the circumferential cracking
analysis are suitable for supporting the Significance Determination Process (SDP).
CONTACT: Steve Long, SPSB/DSSA/NRR
301-425-1077
J. A. Grobe
Also, as you requested, we have provided a discussion of the potential for using the principles for
integrated, risk-informed decision making (from Regulatory Guide (RG) 1.174) as a basis for
augmenting the risk analysis to determine the appropriate agency response. Based on the results
of our review, we believe the licensees performance was inconsistent in some manner with all four
principles that are used in conjunction with low risk to find that an action or design change is
acceptable.
Since two of the three degradation sequences studied could not be placed unambiguously into a
single SDP color range, and since other considerations (such as RG 1.174 safety principles) may
be relevant to the SDP and Enforcement Review Panel (SERP) deliberations, we have not
provided an overall SDP color for this performance deficiency. The selection of an appropriate
SDP color for use with the Action Matrix is a SERP responsibility. We conclude that the attached
information should be considered in the SDP color determination.
Our risk assessment and discussion of the use of the other risk-informing principles are provided
in Attachments A and B, respectively. Our responses to your specific requests are provided
below:
1. Develop an estimate of the increase in loss-of-coolant (LOCA) initiating event likelihoods
given the as-found condition of the reactor head.
Both the staffs and licensee's analyses for the failure pressure of the as-found cavity
resulted in estimates in excess of 7000 psig. Both of the respective uncertainty analyses
indicate that the probability for rupture due to pressure transients is very low. The staffs
analysis indicates that this probability is below 7 x 10-8/reactor-year. The licensee's
analytical approach, updated by the staff to reflect its latest failure pressure criterion,
results in a value below 1 x 10-4/reactor-year. The large numerical difference is an artifact
of the different approaches taken for the two analyses. It is inconsequential for purposes
of reaching a significance determination. Refer to pages 2 through 6 of Attachment A for
the supporting analyses.
It is important to note that these analyses treat the clad material as if it is a plate of uniform
thickness with uniform stress-strain properties obtained from small clad samples. The clad
was neither designed nor acceptance tested to serve as a structural element of the vessel
design, so it may contain structurally significant flaws that are not represented in the
analysis. The presence of large flaws could result in rupture at lower pressure and thus
increase these probabilities. Alternatively, the presence of small flaws could result in leaks
and cavity detection before the exposed area of clad has become large enough to rupture.
Therefore, it is not known whether inclusion of pre-existing flaws in the analysis would
increase or decrease risk until a quantitative analysis is performed with an appropriate flaw
size distribution.
2. Estimate the likelihood of an anticipated transient without scram (ATWS) as a
consequence of the LOCA, or if engineering review indicated that a reactor vessel head
LOCA will not cause an ATWS, then provide a justification for why further evaluation is not
warranted.
2
J. A. Grobe
The RELAP computer code was used to perform integrated thermal-hydraulic and reactivity
analysis for a spectrum of LOCA sizes with the break location on the reactor vessel head.
The results indicated that, for all LOCA sizes, the void formation due to boiling of the
coolant in the reactor would have a sufficient effect on the reactivity to stop the nuclear
fission chain reaction. When cool water from the emergency core cooling system is
injected into the core and the boiling stopped, the concentration of boron required to be in
the injection water is sufficient to maintain the shutdown condition.
3. Evaluate the change in core damage frequency ( CDF), the conditional core damage
probability (CCDP) and the change in large early release frequency (LERF) risk due to the
degradation of the vessel head.
The change in core damage frequency is obtained by multiplying the change in the LOCA
frequency by the CCDP for the appropriate LOCA size. The licensee provided an
evaluation of a medium LOCA CCDP to make it specific to the size of the as-found cavity,
with a resulting probability of 2.91 x 10-3. Multiplying the staffs update for the licensee's
estimated contribution to the LOCA frequency for the as-found cavity would produce CDF
contributions of less than 3 x 10-7/reactor-year. Estimates of CDF based on the staffs
results for cavity failure probabilities at various pressures were not calculated because the
licensee's approach produced larger results that were still in the lowest risk category for the
SDP process. The staffs analysis also considered the results of GSI-191 concerning the
potential for emergency core cooling system (ECCS) sump clogging. See pages 12
through 18 in Attachment A for a description of our supporting analyses.
The conditional containment early failure probability for these LOCAs is estimated to be
about 0.006. Because the numerical thresholds for the LERF color categories are a factor
of 0.1 times the numerical thresholds for the corresponding CDF categories, the LERF
increase for this performance deficiency will not be as significant as the CDF increase for
purposes of establishing the risk significance.
4. Utilize risk insights from ongoing RES activities, which may be evaluating other accident
aspects for the reactor head degradation.
The licensee's performance deficiencies resulted in prolonged, undetected leakage of boric
acid onto the reactor head through axial cracks in multiple control rod drive mechanism
nozzles. This increased the probability for a LOCA by two mechanisms:
a) After they became wet, the external surfaces of the leaking nozzles could develop
circumferential cracks which could grow large enough over time that a nozzle could
break above the weld and be ejected from the head.
b) A cavity could develop due to corrosion wastage of the low-alloy steel portion of the
reactor vessel head and grow large enough over time that the clad exposed
beneath the cavity could rupture during normal operation or anticipated pressure
3
J. A. Grobe
In fact, two nozzles were developing wastage cavities and one of those two nozzles also
was found to be developing a circumferential crack. Thus, analyses restricted to the risk
associated with the as-found dimensions of one cavity do not necessarily provide an
adequate perspective on the risk associated with the licensees performance deficiencies.
The analyses we provide on pages 6 through12 of Attachment A use results of ongoing
RES studies to gain additional insights and useful perspectives on these two sources of
risk. Because there is much that is not known about the phenomena and the probabilistic
aspects of these two degradation mechanisms, some of our analyses attempt to define
logical limits to the possible ranges of results.
The results of our analyses for circumferential cracking indicate that there was sufficient
time during the estimated 6-8 years that Nozzle #3 was leaking for a circumferential crack
to develop and grow large enough to cause the nozzle to be ejected. We do not know the
actual stress levels in Nozzle #3 nor the cracking rate as a function of stress for the
material used to fabricate the nozzle. However, because the same material cracked in a
greater fraction of the nozzles at Davis-Besse and appears to have leaked earlier in the
plants life than at Oconee 3, we infer that the residual stress levels must be relatively high
at Davis-Besse. Because the material has cracked more rapidly than other operating
Babcock and Wilcox plants, we also used a range of cracking rates indicative of the worst
heat of material in the available laboratory data. These assumptions, are not necessarily
bounding. So, the results should be used as an indication of what the risk may be, based
on what we know today. The results are about 3 x 10-2/reactor-year for increase in the
LOCA frequency and about 8 x 10-5/reactor year for the corresponding increase in CDF.
This result alone, puts the CDF increase in the 10-5/RY range, with uncertainty from as
high as the low 10-4/RY range to the low 10-5/RY range.
Analysis of the risk associated with the potential growth of wastage cavities beyond the
as-found condition is difficult. Typical risk assessment approaches would explore
variations in corrosion rates, leak rates, time available, cavity shapes, clad strength, clad
flaw densities and size distributions to estimate the change in LOCA frequency associated
with the finding of reactor vessel head damage. However, there is little information that
can be used to quantify the probability distributions for many of the important variables in
this case. Thus, we were unable to reach a consensus for a probabilistic treatment of the
time available for wastage to occur. Therefore, even very precise probabilistic analyses of
the physical cracking and corrosion phenomena would leave the analysis incomplete. The
results of our partial analysis in this area are provided with the recognition that they do not
quantify the risk increase due to potential for cavity growth to a different size before
discovery. Although the results of this part of the assessment cannot be directly added to
the results of the more definitive parts, they do provide additional information that can be
used to assess qualitatively the adequacy of the definitive parts for determining the overall
risk significance.
The results of our analyses for potential growth of wastage cavities beyond the as-found
condition indicate that it was possible. At the most-rapid growth rates indicated to be
possible by the results of laboratory experiments involving solid boric acid crystals on wet,
4
J. A. Grobe
heated steel, an additional 1 to 2 years of operation would enlarge the cavity sufficiently to
allow rupture, depending on cavity shape. Alternatively, at the
average corrosion rate estimated by the licensee, an additional 4 to 7 years of operation
would be required. It is also important to note that there are some reasons to suspect that
the physical processes that developed the as-found cavity may become self-limiting at
some cavity size, so that it may not even be possible to develop a cavity that is large
enough to burst with leakage rates limited by the plants technical specifications.
Alternatively, modest enlargement of the as-found cavity could have completely exposed
Nozzle #11, potentially introducing additional failure mechanisms and additional
opportunities for discovering the cavity before failure occurred. Thus, this part of the
analysis is unusually difficult and the available data provide limited opportunities for
quantifying results. However, we believe that the potential for a larger cavity to have
formed is an essential consideration for assessing the significance of these findings.
5. Evaluate the licensees deterministic and risk-based assessments to determine if their
bases for an increase in CDF of 1 E-5 is valid.
The licensees risk assessment was based on a deterministic analysis of the failure
pressure for the as-found cavity, a choice for a mathematical formula that was assumed to
represent the probability distribution for failures at other pressures, and an assessment of
the plants historical frequency of reactor coolant system (RCS) pressure transients. These
were mathematically combined to produce an estimated frequency that the RCS would
attain a pressure that would have caused the as-found cavity to fail.
We reviewed the licensees analysis and re-evaluated the results of that approach using
newer information and a correction to the calculation process. The licensees analysis
started with an estimated cavity rupture pressure of 5600 psig. This pressure value was
developed using a finite element, elastic-plastic numerical model and a criterion for
deciding when the results of the model indicated that conditions had been reached that
correspond to failure of the physical material. When some physical testing data was used
to tune this model, a better estimate of the failure pressure was possible. Based on
additional work by the licensees contractors and RES contractors, we currently estimate
the failure pressure to be about 7980 psig. We also reviewed the licensees estimates for
frequencies of RCS pressure transients and found them to be reasonably consistent with
expectations and available reports of transient events. In reevaluating the licensees LOCA
frequency calculation using the updated rupture pressure result, we noted that the logic in
the licensees approach represented pressure transients that begin at zero pressure, rather
than at normal operating pressure. This "over-counts" the probability that the cavity would
fail at normal operating pressure by a factor equal to the sum of the frequencies of the
transients in each of the "bins" used to group the pressure transients within pressure
ranges. Using the licensees choice of a log-normal distribution for the failure pressure with
the new median failure pressure estimate and the corrected process for combining the
failure probabilities with the pressure transient frequencies, the CDF result was greatly
reduced to about 3 x 10-7/reactor-year. Because this was already below the threshold of
10-6/RY, we did not continue to apply corrections that would have the effect of further
reducing the result.
5
J. A. Grobe
Two undermining aspects of this analysis should be considered in any application of this
result. First, the analysis does not consider the probability that a structurally significant flaw
in the clad material could be present in the exposed clad area. The potential effects of
flaws have been discussed in our response to Item 1 and will not be repeated here.
Second, the use of a log-normal distribution to represent a probability of failure at
pressures around 2200 psig is essentially meaningless for a median pressure as far from
that value as the 7980 psig is in this case. The result of this analysis is essentially an
artifact of the choice of the log-normal function to represent the probability distribution. To
obtain a numerical result that can be reliably related to physical reality, it would be
necessary to conduct a better probabilistic analysis that explicitly uses a clad flaw size
distribution derived from data on real clad layers.
In conclusion, although the results of our analyses suggest that the risk due to potential rupture of
the as-found cavity may be very low (i.e., <10-6/RY), the analysis uncertainty is large, since the
analysis used a simplistic model that treated the cladding as a plate and the effects of flaws in the
clad material were not considered. We believe that this result alone does not provide an adequate
representation of the risk associated with the licensees performance deficiencies which allowed
that cavity to develop. Our analyses of the potential for circumferential cracking and nozzle
ejection indicate that the risk from that phenomenon is in the range from 10-5/RY to 10-4/RY. Our
analyses of the potential for further cavity growth leading to rupture of the underlying clad were
unable to quantify the additional risk. Thus, it is not known whether the total risk attributable to
these deficiencies exceeds 10-4/RY. From a public safety standpoint, we believe it is prudent to
respond to the broader implications rather than to rely on the low risk level indicated by the narrow
perspective of the analysis for the as-found condition, alone.
In addition to the assessment described above and detailed in Attachment A, which evaluated the
risk based on available information, NRR also has evaluated its analysis and decision making
process used related to the delay in the CRDM inspection at Davis-Besse. This staff evaluation of
the Davis-Besse response to NRC Bulletin 2001-01 was forwarded to the licensee by letter dated
December 3, 2002, and is in ADAMS at ML023300539. Also, for completeness, a senior staff
member provided comments regarding his concurrence on the product provided to the Division of
Licensing Project Management. The staff reviewed the staff members comments and have not
included them in this transmittal because the comments serve to reinforce the fact made in the
analysis that there is considerable uncertainty in the analysis.
Attachments: As stated
cc w/atts: W. Lanning, RGN- I
C. Casto, RGN-II
D. Chamberlain, RGN-IV
6
Risk Assessment and Insights in Support of Phase 3 Risk
Significance Determination for the Control Rod Drive Mechanism (CRDM)
Nozzle Cracking and Associated Reactor Pressure Vessel (RPV) Head
Wastage Event at the Davis-Besse Nuclear Power Station
During an inspection of the CRDM nozzles in the spring of 2002, the licensee discovered three
nozzles were leaking through axial cracks, and that one of the leaking nozzles had begun to
develop a circumferential crack. During repair of another one of the leaking nozzles, it became
loose in the RPV head. Subsequent investigation revealed that a cavity had formed around that
nozzle in the low-alloy steel portion of the RPV head, leaving only the stainless steel clad material
as the reactor coolant pressure boundary over an area of approximately 20 square-inches. In their
root cause analysis report, the licensee concluded that the axial crack in the affected nozzle had
most probably been leaking for a period of 6 to 8 years before detection. A similar but much
smaller cavity was subsequently identified at the location of the leaking crack in another of the
degraded nozzles.
The purpose of this analysis is to assess the degree of risk associated with the deficiencies in the
licensees performance which allowed these conditions to occur. The analysis attempts to quantify
the risk to the extent practicable with the limited data available and the limited understanding of the
phenomena involved. Where a consensus could not be reached on an approach to quantify some
risk elements, this analysis attempts to develop a broad perspective and obtain useful insights
relevant to the unquantified parts. Those insights are provided to serve as qualifiers to the
incomplete risk total developed from those elements that we were able to quantify.
Statement of the licensee performance deficiency :
The licensee failed to properly implement a boric acid wastage prevention program, which allowed
reactor coolant system (RCS) pressure boundary leakage to occur undetected for a prolonged
period of time. Also, the licensee failed to implement an inspection program for the detection of
reactor coolant pressure boundary leakage that adequately addressed RCS degradation
mechanisms that industry experience had indicated were applicable to the Davis-Besse plant. In
addition, the licensee failed to implement an adequate corrective action program to properly
disposition anomalous indications in plant data and correct their causes.
Accident sequences that contribute increased risk:
The licensees failure to detect the leakage from CRDM nozzles for an extended period of time
could have lead to the failure of the reactor coolant pressure boundary by three mechanisms:
1. The section of clad that was exposed by wastage of the RPV head could have
failed if the cavity had formed at a weaker point in the clad or the reactor had
experienced a transient condition that caused the pressure in the RCS to exceed its
normal pressure of operation.
Attachment A
1
2. The wastage cavity could have grown larger before discovery, allowing it to fail at a
lower RCS pressure, including normal RCS operating pressure.
3. The extended period of exposure of the outside of the CRDM nozzles to RCS
coolant could have allowed the formation and growth of a circumferential crack
sufficiently large to cause the nozzle to fail and be ejected from the RPV head.
In each of these three cases, a loss-of-coolant accident (LOCA) would have resulted from the
failure of the RCS pressure boundary. In cases 1 and 3, the LOCA would have been in the
"medium" range, requiring both high-and low-pressure emergency core cooling system (ECCS)
equipment to prevent reactor core damage. For case 2, the size of an unflawed clad area that
must be exposed in order to fail at normal operating pressure creating a LOCA is in the "large"
category, but still within the design limits of the ECCS system. LOCAs in the "large" range require
operation of core flood tanks and the low pressure ECCS pumps to prevent core damage.
The probability that the ECCS would fail to prevent core damage was calculated previously for
both of these LOCA sizes in the Davis-Besse individual plant examination. What remains to be
assessed for this analysis is the increase in the LOCA frequencies of medium and large LOCAs
that can be attributed to the licensees performance deficiencies. When combined with the
conditional core damage probabilities (CCDPs) for the appropriate size LOCAs, the estimated
changes in the frequencies produce estimates for the increase in core damage frequency
attributable to the performance deficiency.
Probability of burst during reactor operation for the as-found cavity:
The cavity as found at Davis-Besse did not burst during operation. However, during the period of
its exposure, the RCS pressures did not significantly exceed the normal operating pressure of
2185 psig. Operational experience at Davis-Besse and other plants indicates that there is a
modest frequency of transient events that cause the RCS pressure to temporarily increase.
Therefore, part of the risk assessment process is to determine the probability that the RCS
pressure could have reached a value sufficient to burst the cavity.
The power operated relief valves and safety valves (SVs) located on the pressurizer actuate at
high pressure to limit RCS pressure increases. The SVs at Davis-Besse limit RCS pressure to
2550 psig for design-basis accidents. The licensee has provided a table of the number of times
the Davis-Besse RCS has reached various pressure levels above its normal operating value.
None of these pressure transients has reached the SV setpoint at Davis-Besse. However, other
plants have experienced pressure transients that actuated their pressurizer SVs. Davis-Besse
provided an estimate of the frequency of reaching the SV setpoint, using the number of years of
operation and a Bayesian statistical process. That estimate appears to be reasonable and slightly
conservative in comparison with the statistics available for the operational transients at other
plants.
For the RCS pressure to increase beyond the SV setpoint, an operational event that is more
severe than the plant is designed to handle would need to occur. Previous probabilistic analyses
have identified an event that has these characteristics, a total loss of feedwater with failure of the
control rods to insert and stop the nuclear chain reaction in the reactor core. These types of
2
events are called anticipated transient without scram (ATWS) events. The frequency estimated for
this type of event is less than 1 x 10-5/RY in probabilistic risk assessments (PRAs).
On the basis of these considerations, the frequencies used in this analysis for reaching various
pressure levels in the Davis-Besse RCS are listed in Table 1.
Table 1. Frequency of Operation within Specific RCS Pressure Ranges at Davis-Besse
RCS Pressure Frequency of Occurrence Frequency of Exceeding Range Base
2185 psig 1.0 [during operation] 1.0 [during operation]
2250-2300 psig 0.254/reactor-year 0.95/reactor-year
2300-2350 psig 0.508/reactor-year 0.698/reactor-year
2350-2400 psig 0.127/reactor-year 0.190/reactor-year
2400-2450 psig 0.0635/reactor-year 0.063/reactor-year
2450-2550 psig 0.0317/reactor-year 0.0317/reactor-year
>2550 psig <0.00001/reactor-year < 0.00001/reactor-year
The Oak Ridge National Laboratory (ORNL) has estimated the failure pressure for the as-found
cavity to be 7,353 psig (reference 1). This is intended to be a conservative estimate, based on
minimum strength properties of the type of material used to form the clad, an intentional
over-estimate of the exposed clad area, and a uniform clad thickness that was the minimum value
initially reported by the licensee under the cavity, 0.240 inch. (More recent measurements have
decreased the minimum thickness to about 0.20 inch, but the average is about 0.25 inch.) The
failure pressure was estimated from the results of a nonlinear, finite-strain, elastic-plastic,
finite-element model that was tuned to the results of a set of 9 physical burst tests conducted
under the sponsorship of the American Society of Mechanical Engineers (ASME) Pressure Vessel
Research Committee Subcommittee on Effective Utilization of Yield Strength in 1972 (reference 2).
The pressure at which this model reached instability was increased by a factor of 1.1 to estimate
the median failure pressure for the cavity.
ORNL also used the variability in the results of those 9 tests to estimate the uncertainty in their
estimate of the failure pressure for the physical conditions assumed in their analysis. A cavity clad
burst pressure as low as 5900 psig would be within the variability exhibited by the burst tests.
However, it is not credible that a reactor could achieve this pressure, because other components
are expected to fail at lower pressures and stop the pressure increase at a lower value.
Extrapolation of the variability in the burst tests to estimate probabilities of failure at lower RCS
pressures depends on the subjective selection of a mathematical relationship. ORNL evaluated
several mathematical functions, and found six that are consistent with the spread in the burst test
data. Using all six distributions, the average probability of cavity failure at normal operating
pressure is estimated to be 6.9 x 10-8, and the probability at the safety valve setpoint pressure is
estimated to be 3.6 x 10-7. As will be shown later in this analysis, probability values that are low,
produce core damage frequency contributions ( CDFs) that are well below the threshold of 1 x
10-6/RY used in the setdown pool (SDP). Likewise, the frequency of an ATWS event at < x 1
0-5/RY is too low to produce a CDF above that threshold by creating pressures with higher failure
probabilities.
Therefore, the ORNL analysis establishes a definitive significance result for the as-found cavity,
with one caveat: the effects of defects in the clad material were not considered in the analysis.
3
The ORNL probabilistic analyses are based on the variability in the results of the ASME tests for 9
disks fabricated from plate material. The floor of the cavity is modeled as a uniformly thick plate of
material with uniform properties. However, the remaining clad at the bottom of the cavity in the
Davis-Besse RPV head is not plate material; it is a weld overlay that was not fabricated or
acceptance tested to serve as a pressure boundary. There is some probability that the clad could
be weakened by incomplete fusion between some of the sequentially applied strips of weld metal.
From a risk perspective, the potential occurrence of flaws in the cladding does not necessarily
increase the risk. If small flaws are more prevalent than large flaws, then it is conceivable that
they could enhance the probability that the initial failure is a detectable leak, rather than a gross
rupture of the exposed clad material. That effect would reduce the probability of burst and lower
the risk. Alternatively, if large flaws are more prevalent, they could increase the probability of
rupture at realistic RCS pressures and thus increase the risk above the values estimated for failure
of the as-found cavity in this analysis. Some data have been produced on the frequency of
occurrence and size distribution of flaws RPV clad. Application of that data would be the logical
next step if there is a need to improve this analysis.
The licensee submitted a risk analysis (references 3,4,5) based on the average thickness of the
clad under the cavity (0.297 inch) and an estimated exposed clad area of 20.5 square inches. The
numerical model reached instability at a pressure of 7219 psig. Using the ORNL relationship
between the pressure of numerical instability and the physical failure pressure, the projected
median failure pressure would be 7982 psig.
The licensees analysis used a log-normal distribution for the probability of failure as a function
of pressure:
f = { ln(P/Pm) / C } where: f = probability that failure occurs at pressure P(psig)
PM= median pressure capability (psig)
P = pressure capability variable (psig)
C = composite logarithmic standard deviation for
randomness
= gaussian cumulative distribution function
The licensee chose a value of 0.33 for c from references 6 and 7. This is composed of
coefficients of variation as follows:
0.1 for the coefficient of variation for plastic collapse for semi-ellipsoidal heads;
0.29 for the coefficient of variation of the yield strength of stainless steel at 605 oF;
0.11 for the coefficient of variation for buckling capacity developed from the test results.
C is calculated as the square root of the sum of the squares of these constituent values.
Values of C in the cited references ranged from 0.06 to 0.39, so the licensees choice is near the
conservative end of the range.
Reproducing the licensees approach to the uncertainty with the updated estimate of 7941 psig for
the median cavity failure pressure (reference 5), the probabilities for rupture at the pressures of
interest are given in Table 2.
4
Table 2. Probability for As-Found Cavity Rupture as a Function of Pressure, Using
Licensees Variability Assumptions
RCS Pressure Probability of Failure
< 2185 psig 4.32 x 10-5
< 2250 psig 6.23 x 10-5
< 2275 psig 7.13 x 10-5
< 2325 psig 9.29 x 10-4
< 2375 psig 1.20 x 10-4
< 2425 psig 1.53 x 10-4
< 2475 psig 1.94 x 10-4
< 2525 psig 2.44 x 10-4
< 3000 psig 1.51 x 10-3
< 3500 psig 6.24 x 10-3
< 4000 psig 1.81 x 10-2
< 4500 psig 4.12 x 10-2
A finite probability of failure at 2185 psig, despite the fact that the cavity survived normal operation
at that pressure for a significant period, could be attributed conceptually to the probability that the
clad material has a small random probability for being substantially weaker at the location of the
cavity. However, the extrapolation of the uncertainty in the failure pressure from over 7000 psi to
about 2000 psi goes far beyond the range of the data to which these mathematical functions have
been fitted. Therefore, it is unrealistic to expect this mathematical function to produce accurate
probability estimates in this case.
To probabilistically combine the frequencies of pressures in the RCS with the probabilities for
failure at the various pressures, it is necessary to consider that the RCS was maintained at
approximately 2185 psig for the entire year of operation, plus it had some probabilities of
exceeding that pressure by the specified amounts for a short period at some time during the year.
So, the probability for failure at 2185 psig is used directly as part of the failure probability for the
as-found cavity, because it is assumed that the cavity experienced that pressure in its as-found
condition with a probability of one. For the probability of failure during pressure transients, it is
necessary to account for the fact that the cavity did not fail at normal operating pressure, so the
probability of failure at 2185 psig is subtracted from the probabilities for failure at the midpoints of
the other pressure ranges and the differences are multiplied by the frequencies of pressure
transients within those ranges. For pressure transients up to the safety valve setpoints, the result
is 9.7 x 10-5/RY. About 45 percent of this value comes from the probability for rupture at normal
operating pressure.
As can be seen from the probabilities for cavity rupture at pressures between the safety valve
setpoints and 4500 psig, those probabilities would not add significantly to this result when
multiplied by the frequencies below 1 x 10-5/RY for ATWS events that would be capable of
attaining those pressures.
The 55 percent of the rupture probability that comes from pressure transients was calculated as if
the cavity existed at its as-found size for a whole year. It would be necessary to reduce that
portion of the probability to reflect the fact that the cavity was growing during operation, and thus
5
was stronger for most of the year prior to its discovery. The magnitude of that adjustment
depends on the cavity growth rate, which will be addressed in the next section of this analysis.
However, as will be shown in a later section of this analysis, the unadjusted probability estimate,
when multiplied by the conditional core damage probability for a LOCA of the size of the exposed
clad area, will result in a core damage frequency increase below the 10-6/RY threshold.
Therefore, additional probability reduction factors will not be addressed in this analysis.
In summary, the estimated rupture pressure for the as-found cavity exceeds 7000 psig in both the
Nuclear Regulatory Commissions (NRC's) and licensee's analyses. The uncertainties considered
in these analyses are not large enough to produce a significant probability that the cavity would
rupture at RCS pressures below the safety valve setpoints. A potentially significant unanalyzed
factor is the probability for flaws in the clad to produce failure at lower pressures. It is not known
whether this factor would increase or decrease the overall risk.
Probability that the cavity could grow large enough to burst before discovery:
For the cavity to have grown to a different size by the time it was discovered, one or more things
would have had to occur differently from what actually did occur in the past, which caused the
cavity to reach a particular size and to be discovered on a particular date. Risk assessment
techniques are intended to explore the effects of plausible variations in what did happen to
understand what might have happened and what the probabilities were for different outcomes.
Typical risk assessment approaches would explore variations in corrosion rates, leak rates, time
available, cavity shapes, clad strength, and flaw sizes and densities in clad material to estimate the
change in LOCA fervency associated with the finding of reactor vessel head damage.
However, this case is somewhat atypical and more complicated to analyze. It was the initial
discovery of a different phenomenon (circumferential cracks in CRDM nozzles) at a different plant
(Oconee unit 3) that caused the inspection at Davis-Besse which led to discovery of the cavity that
is the subject of this analysis. Thus, this case involves the actions of other licensees and the NRC
staff to limit the period in which degradation was allowed to occur, whereas a more typical
significance determination would only need to assess the potential for variations in the actions of
the licensee that is the subject of the finding.
Complete assessment of all potential variables would be required to establish the precise level of
risk increase. However, it typically is infeasible to produce a complete risk analysis. Typically,
analysts attempt to identify the parameters that have the most substantial effects on the results
and evaluate those, while simply showing the others to be unimportant to the results. An analysis
that fails to evaluate a parameter that can substantially alter the results is too incomplete to be
used as a basis for a regulatory decision. When limitations in available information and/or
analytical capabilities make it infeasible to produce an analysis complete enough to support its
purpose, it is the responsibility of the analyst to make that clear.
Unfortunately in this case, there is little information that can be used to quantify the probabilities
for many of the important variables. The timing of the formation of the cavity actually found at
Davis-Besse is not definitively established by the available information. The actual rate of reactor
coolant leakage into the cavity is not known as a function of time. The corrosion phenomena that
produced the cavity are not understood well enough to specify the rates of corrosion or the shapes
6
that could have occurred, or even whether there is dependence on leak rate or a limit on the size
of the cavity that can result. In addition, because the crack growth appears to depend on the time
that the plant was running at power, and the cavity growth appears to require the reactor coolant
system to be pressurized and hot, the size of the cavity eventually discovered appears to depend
on the operating history of the plant at times even
before the licensees performance deficiency occurred. Thus, the risk is sensitive to the
relationship between the plants total operating history and the timing of the cavity discovery. That
relationship introduces some possibilities that are particularly difficult to analyze in this case. What
if the discovery of circumferential nozzle cracks at Oconee unit 3 had occurred at a later date?
What if the history of operation of Davis-Besse had provided more opportunity for crack and cavity
growth before February 2002? We were unable to reach a consensus with our NRC colleagues
on a relevant and appropriate probabilistic approach for addressing the time parameter intrinsic to
these questions. However, the relative timing of the discovery in the context of the unmonitored
progression of the plants degradation appears to have the potential to substantially affect the
results of the analysis. Therefore, even very precise probabilistic analyses of the physical cracking
and corrosion phenomena would leave the risk analysis incomplete.
The following analysis is provided with the recognition that it cannot be complete enough to
quantify the risk increase definitively due to potential for cavity growth to the point that the
underlying clad material ruptures. It attempts to identify the important parameters and to provide
information that plausibly limits the applicable range of variation for their values in this case. It
does not attempt to estimate the range of risk results that those variations could produce.
Although the results of this part of the assessment cannot be directly added to the quantitative risk
results from the other parts, they do provide additional information that can be used to qualitatively
assess the adequacy of the quantified parts for determining the overall risk significance. As more
information becomes available from ongoing studies, it may be possible to derive additional
insights and reach consensus on methods to assess this contribution to the risk.
Cavity size needed to fail during normal operation:
Based on the analyses provided by the Office of Nuclear Regulatory Research (reference 9), a
cavity would have to grow to cover an area of approximately 330 square-inches in order to rupture
at normal operating pressures, assuming a shape similar to that of the as-found cavity. This would
require growth by about 15 inches in the longest cavity dimension. If the cavity grew into a more
rounded shape, it might fail under normal operating pressures with an area of about 250 square
inches. That shape would require approximately 7 inches of additional cavity growth, assuming
growth occurred uniformly in the down-hill and side-hill directions, but not the up-hill direction.
Because none of the corrosion experiments in the literature formed large cavities, there is some
potential for unknown factors to limit the corrosion process such that cavity growth stops at some
maximum size. If such a size limit exists, then the probability that the cavity could rupture may be
substantially reduced. However, there currently is no data useful for quantifying that potential so
that it can be included in this analysis.
7
Cavity growth rate :
Based primarily on the observed levels of boric acid particles in the containment atmosphere, the
licensees Root Cause Analysis Report speculates that the cavity found in the RPV head grew at an
average rate of 2-inches/year over the 4-year period of the last two operating cycles.
This appears to be a reasonable interpretation, but the available evidence is certainly not
conclusive, and other interpretations are also reasonable. The licensees report also states that, by
making a "bounding assumption" that there was a linear rate of increase over time for the
cavity growth rate, "the maximum corrosion rate near the end of cycle 13 would be about 4.0
inches/year." However, no basis is provided to support the assertion that a linear increase with
time is physically bounding or otherwise supported by the available information.
There are multiple reasons to suspect that the cavity growth rate did not increase at a linear rate (or
less) for a period of 4 years. From basic principles, if an axial crack grew at a constant rate over
those 4 years, the leak rate would have increased exponentially because leak rate has been shown
to be an exponential function of crack length. If the crack tip had reached a region of low residual
stress in the nozzle material, it is possible that the crack growth rate would have substantially
decreased. However, complete arrest of the crack growth appears unlikely given the stress levels
created at the tip of the crack by internal pressure forces and the high crack growth rate exhibited
by this nozzle material. Also, the rate at which air filters inside containment needed to be changed
over the 4-year period indicates that a substantial increase in the amount of airborne boric acid
occurred during the period. Although the rate of increase appears to be more exponential than
linear, it is not feasible to quantify the erosion rate based on the available air filter data.
The physical shapes of the cavities at Nozzles 2 and 3 also suggest that the cavity at Nozzle 3 grew
in multiple phases. The cavity at Nozzle 2 followed the nozzle contour over a small fraction of its
circumference and spanned the annulus length from near the J-groove weld to the top of the RPV
head. This suggests that the leakage was directed upward onto the upper surface of the head,
probably in the form of steam for low rates of leakage. The upper portion of the cavity around
Nozzle 3 is dish-shaped, suggesting that the leak rate eventually increased to the point that a liquid
puddle formed on the head surface and was corroding the head in a downward direction. Below the
dish-shaped portion of the cavity is another shaped like a football with its nose pointing away from
the nozzle in the direction that the axial crack was focusing the leakage. This section is not smooth,
as would be expected if the cavity were excavated by erosion from an escaping jet of steam or
water. Its surface is pocked, suggesting corrosion by a liquid pool or slurry. The licensees root
cause report proposes that the pool was either an aqueous solution of boric acid, or a pool of molten
orthoboric acid crystals continuously hydrated with water from the nozzle leak.
Corrosion rates for aqueous boric acid solutions in a variety of physical situations are provided in the
Electric Power Research Institute Boric Acid Corrosion Guidebook (reference 8). Typically, the rates
are below 2-inches/year for most physical situations. However, there are no physical test results
available for a situation like the postulated pool of molten orthoboric acid hydrated by a low rate of
water leakage into the pool. The closest situation covered by the Guidebook appears to be the tests
where an aqueous solution of boric acid flowed across a low-alloy steel surface that was heated to
600 oF. In the central portions of the surfaces wetted by the aqueous solutions, the corrosion rates
were similar to that observed for steel immersed in a boric acid solution. However, at the edges of
8
the wetted surfaces where the boric acid solution became saturated and solid crystals were formed
with continuing hydration from the wetted areas, local corrosion rates as high as 7-inches/year were
reported. Therefore, it seems prudent to consider the possibility that the last stages of cavity growth
on the Davis-Besse RPV head may have experienced corrosion rates on the order of 7-inches/year.
At that rate, the football-shaped portion of the cavity could have begun developing in the latter half of
the last operating cycle and reached its observed size by February 2002, when the cavity was
discovered. An interesting coincidence is that there was an abrupt decrease in the necessary rate
for CAC cleaning in May of 2001, suggesting that something about the leakage path had changed at
that time. The change may have been only in the path past the insulation that the airborne particles
followed to reach the containment atmosphere, or it may signify that the leakage had been directed
into the pool in the cavity at that time, starting the formation of the footbal-shaped portion. The
containment radiation monitors showed continuing increases in the RCS leak rate until about
December 2001.
Because the observed size of the cavity is over 6 inches in depth and about 6 inches radially from
the leaking crack, average corrosion rates less than 1.5 to 2 inches/year would be inconsistent with
the licensees proposed time-line for cavity formation. Maximum rates as high as
7-inches/year would be consistent with the experimental results in aqueous boric acid solutions
where solid boric acid crystals are on a heated, wetted steel surface.
For purposes of this analysis, two plausible cases are considered. One uses 2 inches/year as a
lower bound for the maximum growth rate. The other addresses the implications of the rapid
corrosion rates up to 7 inches/year associated with the hydrated boric acid crystals. It is not known
at this time which case or what intermediate value is more likely.
Time for cavity growth:
In order to evaluate the range of sizes that the cavity might have reached before discovery, it is
necessary to consider the potential variability of the corrosion rate in the context of the potential for
variation in the amount of time available for the corrosion to occur before discovery. For corrosion to
occur, first an axial crack had to initiate and grow large enough to penetrate the nozzle and leak
coolant onto the low-alloy steel that is exposed on the outside surfaces of the reactor head. Both
the cracking process and the corrosion process appear to occur when the reactor is operating, but
not when it is shut down. So, the amount of reactor operation that occurred prior to discovery of the
cavity appears to be the relevant time parameter for determining the final size of the cavity.
That is not a typical circumstance for risk assessments and significance determinations. Usually, it
is the duration of the performance deficiency that is the relevant factor limiting the risk. In this case,
there are a large number of historical factors that, acting together, limited the risk by resulting in the
development and discovery of two large circumferential cracks at Oconee unit 3, causing the
subsequent inspections and repairs that ultimately revealed the occurrence of the wastage
phenomenon at Davis-Besse. The complexity of this case introduces factors that are not addressed
by available PRA tools. We were unable to reach a consensus with our NRC colleagues on a
relevant and appropriate approach, supported by data, for quantifying this part of the risk
assessment. Therefore, this part of the analysis does not produce a numerical result that can be
combined with the results of the other parts, which makes the total incomplete by an amount that
may or may not be substantial.
9
Available insights on the potential for wastage to the point of cavity rupture:
Combining the two corrosion rate cases and the amounts of growth needed to reach the point of
rupture for different shaped cavities produces a range of estimates for the amount of additional
operating time that the cavity would need to grow large enough to rupture at normal operating
pressure. For corrosion rates on the order of 2 inches per year, it would require the cavity to grow
for 7 years in a shape similar to what was found or another 4 years into a more rounded shape
before rupture is predicted. For the higher corrosion rate case of about 7 inches/year, only another
1 to 2 years of operation could be sufficient to produce a rupture, depending on the shape the cavity
took.
However, it must be recognized that the failure pressure analyses used to make these estimates do
not include some factors that may change both the size that the cavity would attain before failure
and the manner in which failure would occur. The potential importance of flaws in the clad layer was
discussed in the section of this assessment that addresses the as-found cavity. In addition, all the
enlarged cavity shapes would completely engulf Nozzle 11. Nozzle 11 and its attached J-groove
weld would create a circular area in the exposed clad material that would not stretch and is
constrained against tilting after small amounts of deflection. It is apparently free to rise and fall in
the vertical direction. Adding these constraints to the clad material stress-strain calculations may
have some reinforcing effects on the clad. However, the long, free-standing CRDM nozzle and
housing assembly may also experience significant vibrations during operation, once wastage of the
head material frees the nozzle from constraint within the head. It is conceivable that vibrations might
fatigue the clad metal at the edge of the J-groove weld and cause a failure that would eject the
nozzle and weld, together, resulting in a medium instead of a large LOCA from an enlarged cavity.
Alternatively, the vibrations conceivably might result in anomalous instrument readings in the control
room, leading to investigation that results in the discovery of the loose nozzle and cavity before a
rupture occurs. Similarly, unusual displacement or looseness of the CRDM on Nozzle 11 might be
noticed during an outage for cases where corrosion rates are slow enough to incur an outage at an
opportune time. Similarly, a small amount of additional wastage in the uphill direction could have
created the same conditions for Nozzle 3. Any or none of these considerations could substantially
change the risk calculations if their effects could be quantified.
Probability that a circumferential crack could grow large enough to eject a CRDM nozzle:
Four nozzles in the center of the RPV head do not have demonstrable annular gaps at operating
conditions. For this reason, there was a concern that leakage from a nozzle crack deep in the
annulus would not reach the top of the reactor head to leave visible deposits. Therefore, visual
inspection was not a qualified technique for detecting leakage through axial cracks in these nozzles.
The licensees Risk Assessment of CRDM Nozzle Cracks (reference 10), submitted on November 1,
2001, excluded these four nozzles from the analysis on the basis that they were not prone to
circumferential cracking due to the residual stress fields associated with their location in the center
of the RPV head, and they therefore were not risk significant. Within two weeks of that submittal,
the fall inspection at Oconee Unit 3 revealed circumferential cracking in a central nozzle (No. 2).
Also, the fall inspection at Oconee Unit 3, reinforced the finding from the spring 2001 inspection at
the same unit, which revealed that the heat of material used to fabricate the nozzles for that unit was
exhibiting an unusually high incidence of cracking and leakage. The five central nozzles at Davis-
Besse are fabricated from the same material. Subsequent inspection of the central nozzles at
10
Davis-Besse in the spring of 2002, revealed that four of those five nozzles had developed axial
cracks, three were leaking and one of the leaking nozzles (No. 2) had developed a circumferential
crack. The size of the circumferential crack, as determined by ultrasonic testing (UT), was
approximately 30°. However, this size characterization is considered to be highly uncertain on the
basis of comparisons between UT sizing and physical examination of the two circumferential cracks
that were first found at Oconee Unit 3 in the spring of 2001. For those 2 cracks, both of which were
physically measured to extend about 165°, UT did not detect one and sized the other as 60°.
Therefore, the best evidence is that the central nozzles are subject to circumferential cracking with a
probability similar to other nozzle locations. The available physical evidence is not adequate to
demonstrate that circumferential cracking is less rapid in the central nozzles than it is elsewhere on
the head.
The licensees root cause report provides estimates that Nozzle 3 had been leaking since 1996 or
1994. Thus, the Nozzle 3 annulus was potentially subject to circumferential crack development and
growth for a period of 6 to 8 years. The fact that Nozzle 3 began leaking so early in plant life is
another indication of the highly susceptible nature of the material used to fabricate the nozzle.
Monte Carlo analyses provided by Argonne National Laboratory (ANL) were used to estimate the
risk of nozzle failure for the 5 central nozzles (references 11 and 12). These analyses assumed that
the material used for the nozzles at Davis-Besse is similar to the worst heat of material for which
laboratory cracking test results are available. This assumption is likely but not guaranteed to be
conservative. It will be checked by planned analyses of the Nozzle #3 material from Davis-Besse.
The stress assumptions are based on the high-stress solution for center nozzles provided by
Engineering Mechanics Corporation of Columbus (reference 13). The high stress solution was
picked in recognition of the higher prevalence of cracking in this material at Davis-Besse (60
percent) than was observed at Oconee Unit 3 (20 percent). A probability of 0.22 was used for
initiation of a circumferential crack in an annulus wetted by reactor coolant leakage when an axial
crack grows through a nozzle. This value was derived from the available inspection results.
Circumferential crack sizes of 20° and 60° were considered at crack initiation, to account for
potential initiation at multiple sites along the highest stress region.
The ANL results indicate a probability range of 1.1 x 10!2 to 2.2 x 10!2 (for 20° and 60° initiation,
respectively) that one of the five nozzles would fail within Davis-Besses 16 years of operation
without effective inspection for crack development or leakage. For a single nozzle, the probability is
2.3 x 10!3 to 4.5 x 10!3. An alternative perspective is that, given that one nozzle is considered to
have started leaking early in plant life, the probability that a circumferential crack will form and grow
to the point of nozzle failure is about 2.6 to 5.6 x 10!2 within 6 years of leak initiation and about 4.9 to
8.7 x 10!2 within 8 years.
The perspective that uses knowledge of an early onset of leakage indicates higher risk than the
calculation that statistically predicts both beginning of leakage and the time of nozzle ejection. This
occurs because that calculation uses a probability of 1.0 for the onset of leakage by the date
assumed in the licensees root cause analysis. In contrast, the ANL calculations that probabilistically
predict the date of first leakage from one of five nozzles produce a probability of only about 0.25 that
the date will be as early as the licensee has speculated actually occurred. The results based on
knowledge of early leakage are used in this assessment as being most representative of the
situation at the Davis-Besse plant.
11
For SDP analyses, the increase in the core damage frequency or large early release frequency
during the last year of operation is the metric that is used to quantify risk significance. The
probability of nozzle failure during the last year is the difference between the cumulative probability
for failure by the end of the last year and the probability for failure by the end of the year before,
adjusted for the probability that no failure had occurred by the end of the next-to-last year. For the
6th year of operation with a wetted annulus, the estimated probability of failure is 1.15 to 1.99 x 10!2,
for the 7th year it is 1.28 to 1.80 x 10-2, and for the 8th year, it is 1.37 to 2.14 x 10-2. For the purposes
of this analysis, the average value of 1.6 x 10-2 will be used for Nozzle 3 to fail in the last year of
operation. The range of results for the various wetted times and circumferential flaw initiation sizes
is only about 30 percent, which is not significant compared to other sources of modeling uncertainty
such as the susceptibility of the material to cracking.
Estimates of the additional contributions from Nozzles 2 and 5 depend upon the time the outer
surfaces of these nozzles were wetted by leaking axial cracks. Those times were not estimated in
the root cause report. Based on the lesser degrees of cavity formation in Nozzles 2 and 5, it is
reasonable to assume those nozzles were wet for shorter periods than was Nozzle 3, but that is not
certain. For purposes of illustrating plausible levels of effect on the results of this analysis, a value
of 4 wetted years is assumed for Nozzle 2 and 2 years for Nozzle 5. This results in values of 0.57 to
1.52 x 10!2 for nozzle 2 and essentially zero to 1.45 x 10!3 for nozzle 5. So, Nozzle 2 would increase
the failure probability by about 64 percent and Nozzle 5 by about 4 percent, giving a total nozzle
failure probability of 2.7 x 10!2 using these assumptions. If all 3 nozzles were assumed to be wetted
for the same period, the total failure probability estimate would increase to 4.9 x 10!2, which is a
factor of 1.8 times the value that will be used in this analysis.
Conditional Core Damage Frequency for Loss-of-Coolant Accidents:
The probability that a LOCA will cause core damage is calculated for large, medium and small
LOCAs in all PRAs for pressurized water type power reactors. In the Davis-Besse individual plant
examination (IPE), the CCDPs are 6.87 x 10-3 for medium LOCAs and 1.08 x 10-2 for large LOCAs.
Because the medium LOCA size range is large and the worst case parameters from both ends of
the range were combined in a conservative manner for the IPE analysis, the licensee recalculated
the CCDP for a rupture the size of the exposed clad area under the as-found cavity. That value is
2.91 x 10-3 with a 95 percent confidence bound of 6.07 x 10-3 and a 5 percent confidence bound of
1.29 x 10-3. These values are consistent with the values obtained in other IPEs and in PRAs
sponsored by the NRC. Therefore, they will be used in this SDP analysis without further review.
Potential for Failure of Control Rods Due to Damage from Ruptured Cavity or Ejected Nozzle:
Both the licensee and the NRC have evaluated the potential for consequential damage to multiple
control rod drives to prevent shutting down the chain reaction in the reactor core after failure of a
nozzle or exposed clad (references 3 and 14). The NRC analysis concluded that the chain reaction
would be successfully terminated without producing a pressure pulse in the RCS.
The reason for this result is that the design requirements for the reactor core have been established
to make the nuclear fission chain reaction stop when bubbles form in coolant and the fuel rods
overheat. In the event of a LOCA, the depressurization of the RCS allows some boiling to occur in
the reactor core, and this is sufficient to stop the chain reaction without insertion of any of the control
12
rods. When cold ECCS water fills the reactor and stops the boiling, the high concentration of boron
in that water is sufficient to maintain the shutdown condition, even without the control rods.
Therefore, no modifications are required to the reactivity control top events in typical PRA LOCA
analyses to make them applicable to LOCAs on top of the RPV head.
Implications of GSI-191, Containment Sump Blockage:
Recently, the NRCs Office of Regulatory Research identified a potential vulnerability associated with
the assumptions used in the licensing of pressurized-water reactors (PWRs). Specifically, the
concern is that debris from the containment could wash to the screen that surrounds the sump in the
containment building and block the water flow through it sufficiently to fail the ECCS when it
switches to recirculation mode and draws water from that sump. This issue is not unique to
Davis-Besse. This issue has been designated as a generic safety issue, GSI-191, and is applicable
to all PWRs, including Davis-Besse.
A Los Alamos National Laboratory (LANL) report documents the results of a research effort that was
focused on determining whether sump blockage due to debris posed a credible concern. This LANL
study used a number of assumptions in debris generation, transport, and accident sequence
modeling, data from one volunteer plant, and limited data from other plants. The study concluded
that debris poses a credible concern. However, with respect to the plant-specific results in the
report, the LANL report concluded that the tabulated results and the supporting parametric study are
inadequate to draw conclusions about the susceptibility of specific plants to sump clogging. This is
due to lack of plant-specific data and the degree to which a number of assumptions were employed
in the development of the tabulated results.
On that basis, it would be inappropriate to incorporate the results for Davis-Besse from the LANL
study in the base estimate for the CDF in this risk analysis. However, it is appropriate to include a
sensitivity study case for the effect of the LANL results, so that a measure can be obtained for the
level of uncertainty that the outstanding issue represents.
The LANL results for the parameter evaluation study case that used available Davis-Besse
parameters assigned unlikely ratings for sump blockage during small and medium LOCAs and a
likely rating for large LOCAs. An unlikely rating is qualitatively defined as indicating that sump
blockage is not a concern. A likely rating was given a nominal quantification with a probability of
0.6. Therefore, the sensitivity case has no effect on the CCDPs for the nozzle ejection event or the
rupture of the clad under the as-found cavity, which are medium LOCAs. However, rupture of the
clad under a cavity that had grown large enough to be susceptible to normal RCS operating
pressure would constitute a large LOCA, and, although no quantification was achieved for that
contribution to the CDF, that contribution would be increased by a factor of about 56 for the
sensitivity case.
The LANL study definition of a large LOCA spans a wide range of rupture sizes, from one hole 6-
inches in diameter to two holes 36-inches in diameter, and it did not consider ruptures located on the
reactor pressure vessel. For this reason, the assumptions for a hole approximately 20 inches in
diameter located on the reactor vessel head should be reconsidered with the LANL parameter study
methodology before drawing any conclusions with respect to the affect of sump blockage on the risk
due to head wastage. Additional plant-specific information that indicates the risk effect may be less
13
than indicated are (1) there is no fibrous insulation material inside the reactor cavity at Davis-Besse
and (2) the bottom of the reactor cavity does not have a direct path to the containment sump.
Implications of Fuel Assembly Spacer Collapse:
In a letter dated May 24, 1996, Framatome Technologies informed the NRC of a Potential Safety
Concern related to the performance of its fuel assemblies under physical loads resulting from a
design-basis large LOCA (reference 15). Specifically, the loads associated with the double-ended
break of the largest cooling water pipe, combined with the design-basis seismic loads, were
calculated to deform the zirconium alloy spacer grids and compact the fuel pins into a less easily
cooled configuration in the interior of the core as well as at the core periphery. The calculations
used to demonstrate compliance of the ECCS with 10 CFR 50.46 had addressed deformation of
peripheral assemblies, but not interior assemblies. The solution requested was to allow credit for
leak-before-break behavior of the largest RCS pipes so that the consequential damage to the fuel
assembly grids could be excluded from the design-basis analysis. An NRC staff member raised this
issue as having potential relevance to this SDP analysis, because leak-before-break credit cannot
be applied to the exposed clad material under a large cavity in the low-alloy steel pressure
boundary. For a cavity large enough to fail at normal operating pressure, the resulting LOCA would
be larger than the 10.5-inch diameter core flood tank pipe that is the most limiting break when leak-
before-break credit is applied.
Review of the material supplied by Framatome indicates that this issue should not affect the
conclusions of this analysis for several reasons. Foremost is the location of the break. Fuel
assembly grid deformation is caused by horizontal depressurization loads that are greatest for break
locations to one side of the core, such as in one of the large coolant loop pipes. For failure of a
nozzle in the center of the head, horizontal loads are expected to be substantially less.
Also, the Framatome analyses indicate that loads up to one-third those calculated for the largest
break would not produce plastic deformation in the core interior assemblies. For the sequence
involving failure of the clad under an enlarged cavity, the equivalent diameter of the failed area
would be about 18-to-20 inches. This is about one-quarter to one-third of the cross sectional area of
the largest pipe. For design-basis accidents, the pipe break is assumed to discharge reactor coolant
from both ends. So, the LOCA postulated for rupture of an enlarged cavity should be within the
LOCA size range that Framatome indicates would not produce an unanalyzed degree of plastic
deformation in the fuel spacers.
Finally, the Framatome analyses indicate that the fuel geometry would remain coolable following
the plastic deformation from a larger LOCA, although the heat transfer capability would be reduced
enough to cause the fuel temperature to exceed the ECCS acceptance criterion of 2200 °F. With
respect to the risk analysis, the significant question for a larger LOCA is whether the change in
coolability would change the number of trains of ECCS equipment needed to prevent the core from
melting, which would change the CCDP for the LOCA. Based on the information submitted by
Framatome, the size LOCA contemplated for cavity failure in the RPV head would not be expected
to deform the fuel enough to change the amount of ECCS equipment needed to prevent core
damage.
On that basis, this issue does not affect the analyses for mitigation of the potential LOCAs
associated with the Davis-Besse head degradation mechanisms.
14
Increase in Core Damage Frequency ( CDF):
Normally, the total risk increase would be computed by simple multiplication of the frequency for
each type of pressure boundary failure by the CCDP appropriate for the LOCA size and summation
of the products. However, in this case, the frequency estimates for two of the three types of
pressure boundary failures are not complete enough to be treated in the normal manner. Each is
discussed separately, below.
Rupture of the as-found cavity
Engineering evaluations of the as-found cavity predict a very high failure pressure, but do not
include the potential effects of flaws in the clad material that could be exposed by the cavity.
Without consideration of clad flaws, rupture of the as-found cavity during a transient RCS pressure
increase does not appear to make a significant contribution to the core damage frequency.
Frequency estimates for the as-found cavity to burst due to pressure transients are on the order of
10-4 to 10-7/RY.
Consideration of the size distribution of flaws and the probability of one occurring in an area of
exposed clad could change this result, but without doing that analysis in a quantitative manner, it is
not possible to conclude whether a predominance of large flaws would increase the risk by lowering
burst pressures of small cavities or a predominance of small flaws would decrease the overall risk by
introducing a substantial probability that the cavity floor failure would be a leak before the exposed
area became large enough to rupture. In the limited consideration of cavities no larger than the one
found at Davis-Besse, the occurrence of flaws is most likely to increase the contribution to the
overall risk. Therefore, the risk contribution from this part of the analysis is considered to be
potentially greater than indicated by the product of the calculated LOCA frequencies and the CCDP
for the Medium LOCA.
Rupture LOCA
as-found medium $ 10-4/RY * 2.91 x 10-3 $ 3 x 10-7/RY *
cavity or or
$ 10-7/RY * $ 3 x 10-10/RY *
- Does not account for effects of flaws in clad
Both alternative estimates produce numerical results that are in the lowest SDP significance range
for CDF values. However, without an analysis for the effects of flaws in the clad material, it is not
possible to use this result to assign a color to the as-found condition, because the true value may be
substantially higher. Engineering evaluations of the effects of flaws on clad strength are in-progress,
but are not available in time for this preliminary risk assessment.
Rupture of an enlarged cavity
Additional enlargement of the cavity to the point of rupture appears to have the potential to dominate
the risk associated with this performance deficiency. This is due to the relatively short times, 1 to 2
years, that would be required for the cavity to grow from the as-found size to a size that would
15
rupture, if the rate of corrosion during the additional period is as high as some laboratory
experiments have found to be possible. However, it is not known whether the conditions on the
Davis-Besse head were capable of producing such high rates of corrosion or sustaining those rates
when the cavity size became much larger. So, there is also a potential that the cavity would not be
able to grow large enough to rupture.
Because we were unable to reach a consensus within the NRC staff on a relevant and appropriate
approach, with supporting data for treating the cavity size in a probabilistic manner, it is not feasible
to quantify the risk contribution from the cavity growth potential. It is important to recognize that this
unquantified contribution exists, and may or may not increase the total CDF substantially above the
total produced from the quantifiable parts of this analysis.
Nozzle ejection due to circumferential cracking
The estimate for the frequency of nozzle ejection is based on 1) knowledge that three of the center
nozzles appear to have been leaking for extended periods, 2) that they are made of a heat of Alloy
600 material that has been found to be relatively susceptible to cracking in two plants and 3) that this
material has behaved worse at Davis-Besse than at the other plants. The evaluation of
circumferential cracking is based on models that draw on substantial laboratory data. This provides
a greater degree of confidence that the appropriate phenomena have been identified and some
confidence that the quantification process has produced results in an appropriate range. Still, this
assessment required the selection of some plausible values from the range of laboratory data,
based on inferences from the circumstances of this inspection finding. Until laboratory analyses are
completed on the nozzle material that was taken from the Davis-Besse reactor, there will be
significant uncertainty in the appropriateness of the values chosen. But, for this portion of the
assessment, the analysis is adequately complete and the level of uncertainty not outside customary
levels for significance determination.
Rupture LOCA
nozzle medium 2.7 x 10-2/RY 2.91 x 10-3/RY 8.0 x 10-5/RY
ejection
The CDF increase is in the high end of the 10-5/RY range and plausibly in the low end of the
10-4/RY range if leakage from all nozzles is considered.
Conclusions about total CDF increase
Due to the substantially different nature of the results from the three parts of this risk assessment, it
is difficult to draw conclusions about the overall risk significance. The estimate of the risk due to the
potential for circumferential cracking is sufficient to put the total in the high
10-5/RY range. The unquantified risk due to additional cavity growth modifies the overall conclusion
to be at least in the 10-5/RY range.
Contrast with Conditional Core Damage Probability:
16
From the standpoint of the level of risk that actually existed at the Davis-Besse site in February
2002, neither the size of the as-found cavity around Nozzle 3, nor the indicated size of the
circumferential flaw that was detected in Nozzle 2 suggest that the plant was in imminent danger of
experiencing a LOCA. However, until the effects of flaws in the clad material are analyzed for their
effects on the probabilities of rupture and leak before rupture, it is not possible to conclude what
level of risk was created by the as-found cavity.
It is important to recognize that the CDF estimate for the performance deficiency at
Davis-Besse differs from a risk assessment of the as-found condition. In addition to the as-found
condition, it considers what other outcomes could have occurred, given the lack of preventive
capabilities inherent in the performance deficiency. This provides an instructive insight for focusing
NRC inspection efforts on the deficiencies that have high risk significance, even when the specific
manifestation that first reveals a deficiency does not constitute an immediate hazard to the public
safety.
Sensitivity to Sump Blockage:
The GSI-191 parameter study report assigns a significant sump blockage probability to Davis-Besse
for large LOCAs only. Thus, for this risk assessment, only the unquantified risk contribution from
rupture of a substantially enlarged cavity would be affected by this issue. The GSI-191 report
assigns a nominal value of 0.6 to the cases it terms likely to experience sump blockage. If the
CCDP for a large LOCA is increased to 0.6, the unquantified contribution due to cavity growth would
be increased by a factor of 56. That would make it more likely to make a substantial increase in the
total CDF, but that is not certain until the contribution due to cavity growth can be quantified.
Therefore, consideration of the sump blockage issue cannot substantially alter the risk perspective
achieved with this assessment.
Increase in Large Early Release Frequency ( LERF):
Davis-Besse has a large dry type containment. This containment type typically has a relatively small
probability for early failure following a core damage accident caused by a LOCA. The Davis-Besse
IPE estimates the conditional containment failure probability as 0.006. Values less than 0.1 will not
affect the color assignment in an SDP analysis, because the color thresholds for increases in LERF
are a factor of 0.1 times the thresholds for the increases in CDF.
Sensitivity to Davis-Besse Containment Corrosion Concern:
To date, no information has been reported that indicates the Davis-Besse containment is degraded
to the point that its probability for early failure following a medium or large LOCA is significantly
increased. If the significance determination for the nozzle leaks is based only on the risk associated
with nozzle ejection due to circumferential cracking, then an increase in containment failure
probability to a value of at least 0.13 would be needed to increase the significance from greater than
8x10-5/RY based on CDF to greater than 1x10-5/RY based on LERF. The value of 0.13
represents an increase by about a factor of 20 over the value derived in the Davis-Besse IPE.
Any containment degradation finding would receive a separate risk assessment and a separate color
assignment, and the ROP action matrix would be applied to determine the appropriate regulatory
response for the combination of the two findings.
17
References:
1. Stochastic Failure Model for the Davis-Besse RPV Head, ORNL/NRC/LTR, P.T. Williams and B.
R. Bass, Oak Ridge National Laboratory, August 23, 2002.
2. Elasto-Plastic Analysis of Constrained Disk Burst Tests, ASME 72-PVP-12, P. C. Riccardella,
American Society of Mechanical Engineers, 1972.
3. Letter serial number 1-1268 from FirstEnergy Nuclear Operating Company to U. S. Nuclear
Regulatory Commission dated April 8, 2002, transmitting Safety Significance Assessment of the
Davis-Besse Nuclear Power Station (DBNPS) Reactor Pressure Vessel head.
4. Letter serial number 1-1277 from FirstEnergy Nuclear Operating Company to U. S. Nuclear
Regulatory Commission dated June 12, 2002, subject Confirmatory Action Letter: Response to
Request for Additional Information Related to the Davis-Besse Nuclear Power Station Safety
Significance Assessment.
5. E-mail from Dale Wuokko, FirstEnergy Nuclear Operating Company to Jon Hopkins, U. S.
Nuclear Regulatory Commission dated August 27, 2002, 9:11 am, subject Instability for Failure
Pressure.
6. Pressure-Dependent Fragilities for Piping Components, NUREG/CR-5603, October 1990.
7. Assessment of ISLOCA Risk-Methodology and Application to a Babcock and Wilcox Nuclear
Power Plant, NUREG/CR-5604, April 1992.
8. Boric Acid Corrosion Guidebook, Revision 1, Electric power Research Institute, November
2001. [Licensed Proprietary Material]
9. Analysis of the Davis-Besse RPV Head wastage Area and Cavity, ORNL/NRC/LTR, P.T.
Williams and B. R. Bass, Oak Ridge National Laboratory, September 2002.
10. Letter serial number 2745 from FirstEnergy Nuclear Operating Company to U. S. Nuclear
Regulatory Commission dated November 1, 2001, subject Transmittal of Davis-Besse Nuclear
Power Station Risk Assessment of Control Rod Drive Mechanism Nozzle Cracks.
11. Memorandum from W. J. Shack, Argonne National Laboratory to W. H. Cullen, Jr., U. S.
Nuclear Regulatory Commission, subject Updated Calculations for Probability of Failure of CRDM
Nozzles, July 31, 2002.
12. E-mail from W. J. Shack, Argonne National Laboratory to W. H. Cullen, Jr., U. S. Nuclear
Regulatory Commission, subject Update on Probability of Cracking, July 31, 2002, 5:42 pm.
13. Summary of On-Going NRC Efforts to Define Circumferential-Crack-Driving-Force Solutions for
CRDM Nozzles, G. Wilkowski, Z. Feng, D. Rudland, Y.-Y. Wang, R. Wolterman, and W. Norris,
Transactions of the 2002 Nuclear Safety Research Conference, NUREG/CP-0178, October 2002.
14. Memorandum from Walton Jensen, U. S. Nuclear Regulatory Commission to Gary Holahan,
U.S. Nuclear Regulatory Commission, subject Sensitivity Study of PWR Reactor Vessel Breaks,
May 10, 2002. ADAMS Accession Number ML021340306.
15. Letter from Framatome ANP to U. S. Nuclear Regulatory Commission, subject Interim Report
of Potential Safety Concern on Mark-B Grid Deformation, Framatome Technologies PSC 21-96-5,
May 24, 1996.
-2-
Application of the Principles of Risk-Informed Decision-Making
to the Phase 3 Significance Determination
for Cavity in Davis Besse Reactor Pressure Vessel Head
The phenomena that produced the cavity were not expected and are still not adequately
understood. In addition, it is not clear how to construct the appropriate logic for estimating the
probability that a similar cavity would be discovered before it ruptures during operation. The cavity
at Davis-Besse was discovered because of actions taken by the NRC in response to discoveries of
a different degradation phenomenon (circumferential cracking of CRDM nozzles) at a different
plant a year before the discovery at Davis-Besse. Therefore, properly understanding the
probability of discovery before rupture involves understanding the probabilities for two different,
(though perhaps linked) degradation phenomena at multiple plants.
In addition to the problems with obtaining a realistic risk estimate for the Davis-Besse cavity
creation process and circumstances, it is arguable that the risk value alone does not fully
represent the significance of this licensees performance deficiency. For example, even if the clad
is found to be uniformly strong and the cavity is found to be growing slowly enough to allow many
more years of operation before rupture would occur, it was still only a matter of good fortune,
rather than good design or good planning, that the clad successfully served as the pressure
boundary. The structural element that was designed to provide the pressure boundary had been
completely corroded away.
Because the staff recognizes substantial vulnerabilities in purely risk-based decision processes,
Regulatory Guide (RG) 1.174 was developed to provide a risk-informed decision-making process
that integrates numerical risk estimates with other deterministic information. Consideration of the
other key principles enumerated in RG 1.174 provides additional insights that may be useful for
reaching a risk-informed decision regarding appropriate agency actions in response to the
performance deficiency.
Principle 1 - Regulations are met: In this case, regulations were not met in more than one
respect. Clearly, pressure boundary leakage** occurred, although none is permitted by technical
specifications, but, pressure boundary leakage occurs occasionally in plants without unacceptably
poor licensee performance. The highly significant aspect of this leakage at Davis-Besse was the
extended period over which it was allowed to persist, and the extent of the damage that it created
to a safety-significant structure. That damage is contrary to the general design criteria (GDC)
requirements in the regulations, in particular, the requirement that the RCS be inspected and
maintained in a condition that has an extremely low probability of abnormal leakage or gross
failure.
Pressure boundary leakage is defined in Technical Specifications to be leakage
through a nonisolatable flaw in a reactor coolant system component body, pipe wall or vessel
wall (except flaws in steam generator tubes, where leakage is limited by separate
specifications). It does not include leakage through bolted connections or valves.
Attachment B
-2-
Principle 2 - Defense-in-depth is maintained: In this case, no physical barrier was breached,
although one physical barrier was nearly eliminated. The physical effect on the part of that barrier
that is credited in the plants design-basis appears to be more appropriately addressed in the next
principle with respect to safety margins. However, the defense-in-depth principle applies to
processes as well as barriers. The processes of design, fabrication, pre-service testing, operation
within limits, maintenance and in-service inspection are intended to provide assurance through
redundancy of the adequacy of the RCS pressure boundary for the life of the plant. In that
context, failures of the maintenance and inspection aspects of the licensees performance were
sufficient to defeat the design feature. Based on the licensees analysis of the root cause, if the
head had been maintained in a clean state or the inspections had been performed for leaking
nozzles in a complete manner, the cavity would have been discovered before it reached a
threatening size. This is a performance deficiency that degraded the level of defense in depth.
Principle 3 - Sufficient safety margins are maintained: In this case, the design margin for the
strength of reactor pressure vessel head is provided solely by the carbon steel forging; the
strength of the clad material was not credited in the design process. Therefore, safety margins
were not maintained during this degradation event.
Principle 4 - The risk is low: This principle is addressed in Attachment A (Risk Assessment and
Insights report).
Principle 5 - The impact of the situation was monitored with strategies sufficient to assure
adequate performance: In this case, the licensee was unaware of the leaks in the CRDM
nozzles and of the possibility for corrosion of the low alloy steel during operation. In addition,
dispositions of several noted abnormal conditions were inappropriately based on false
assumptions about the locations of leaks and the possibilities of nozzle cracking and head
wastage. The licensees performance provided no basis for assuring that the degradation would
be adequately managed or even discovered prior to pressure boundary rupture.
In summary, the licensees performance was inconsistent in some manner with all four of the
principles that are used in conjunction with low risk to find that an action or design change is
acceptable. These additional insights could be used to support a deviation from the agency
response specified by the Action Matrix if portions of the numerical risk assessment are
considered too speculative to be the basis for a significance determination, and the remaining
quantifiable aspects do not appear to adequately capture the risk significance.