ML052710123
| ML052710123 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 09/27/2005 |
| From: | Fields M NRC/NRR/DLPM/LPD4 |
| To: | Dan Collins NRC/NRR/DLPM/LPD4 |
| Fields M B ,NRR/DLPM,415-3062 | |
| References | |
| TAC MC2329 | |
| Download: ML052710123 (6) | |
Text
September 27, 2005 MEMORANDUM TO: Daniel S. Collins, Acting Section Chief, Section 2 Project Directorate IV Division of Licensing Project Management Office of Nuclear Reactor Regulation FROM: Mel B. Fields, Senior Project Manager, Section 2 /RA/
Project Directorate IV Division of Licensing Project Management Office of Nuclear Reactor Regulation
SUBJECT:
PRESSURIZER HEATER SLEEVE LEAK RISK-INFORMED DOCUMENTATION FOR PALO VERDE NUCLEAR GENERATING STATION, UNIT 3 (TAC NO. MC2329)
This memorandum documents the Nuclear Regulatory Commission (NRC) staff thought processes that were used to agree with the licensee<s position that it was appropriate to defer the characterization of the degradation in the Palo Verde Unit 3 pressurizer heater sleeve A-3 until the next refueling outage.
On February 29, 2004, Arizona Public Service Company (APS or the licensee) personnel performed a boric acid walkdown of the Palo Verde Nuclear Generating Station (Palo Verde)
Unit 3 primary system during the units forced outage to recover from a turbine generator fault.
Boric acid residue was discovered on the Palo Verde Unit 3 pressurizer heater sleeve A-3 during the walkdown, which APS concluded was evidence of reactor coolant pressure boundary (RCPB) leakage through the pressurizer heater sleeve. APS proposed to address this discovery by installing a mechanical nozzle seal assembly (MNSA) repair on pressurizer heater sleeve A-3 to ensure that structural and leakage integrity of the Palo Verde Unit 3 primary system would be maintained until the units next planned refueling outage (U3R11) in the fall of 2004. During the core offload window in U3R11, APS performed a nondestructive examination (NDE) of the Palo Verde Unit 3 A-3 pressurizer heater sleeve to characterize indications of degradation. In this inspection, APS found multiple axially-oriented indications and one circumferential indication above the elevation of the weld in the A-3 pressurizer heater sleeve.
The NRC has raised the issue of management of primary water stress corrosion cracking (PWSCC) of Alloy 600 pressurizer heater sleeves at Combustion Engineering (CE)-designed units, like Palo Verde Unit 3, with the U.S. nuclear industry on a number of occasions. The NRC staff has consistently noted that it is the NRCs expectation that, when evidence of RCPB leakage from such pressurizer heater sleeves is discovered, licensees will take expeditious action to characterize degradation in the leaking heater sleeve (e.g., Bulletin 2004-01, Inspection of Alloy 82/182/600 Materials Used in the Fabrication of Pressurizer Penetrations and Steam Space Piping Connections at Pressurized-Water Reactors). It is the NRC staffs position that expeditious characterization of such degradation is necessary to identify the potential onset of circumferentially-oriented PWSCC in the pressure boundary portion of the heater sleeves prior to potential gross rupture of pressurizer heater sleeves due to PWSCC flaws.
Under normal circumstances, evidence of RCPB leakage from pressurizer heater sleeves at CE-designed facilities would be expected to be identified during unit refueling outages. In such cases, the NRC staff would expect the affected licensee to perform NDE to characterize the
degradation in the leaking heater sleeve prior to returning the unit to power operation.
However, that was not the case with Palo Verde Unit 3.
By letter dated March 9, 2004 (Agencywide Documents Access and Management System Accession No. ML040780377), APS provided its assessment of why its course of action, which included deferral of the characterization of the degradation in the Palo Verde Unit 3 pressurizer heater sleeve A-3 until the U3R11 refueling outage, was appropriate. The NRC staff reviewed the licensees assessment and accepted APS< determination that deferral of the characterization of the A-3 pressurizer heater sleeve degradation was prudent. Specifically, the NRC staff agreed with APS assessment that the configuration management risk associated with placing Palo Verde Unit 3 into reduced inventory operation in order to breach the pressure boundary, remove the A-3 heater, and perform the NDE necessary to evaluate the condition of the A-3 pressurizer heater sleeve, would not have been offset by the benefit that would have been gained by performing the NDE at the time the leak was discovered. The NRC staff concurred with the licensees conclusion that performing the necessary NDE on the Palo Verde Unit 3 pressurizer heater sleeve A-3 during the core offload window during the U3R11 refueling outage appropriately balanced the need to understand the degradation occurring in the Palo Verde Unit 3 pressurizer heater sleeves and the need to minimize the operational risk associated with performing the NDE necessary to do so. The detailed risk analysis performed to support the staffs decision to concur with the licensees actions is discussed below.
Pressurizer Heater Sleeve Leak Risk Analysis The licensee performed a MNSA repair that will prevent the sleeve from being ejected, even if the sleeve fails below the weld. On that basis, the licensee stated that it would be less risky to perform the inspection of the sleeve at the next refueling outage than during the February 2004 unplanned outage. Its reasoning is that the reactor core will be off-loaded for reduced reactor coolant inventory operations during the refueling outage, but not during the February 2004 unplanned outage. Because the sleeve that leaked has been repaired, it cannot be ejected during the period between the two inspection opportunities. The licensee argues that the overall risk would be lower if the inspection was performed during the fall 2004 refueling outage.
The NRC staff agrees with the licensees risk assessment, but notes that there is the possibility that inspection of the sleeve that leaked would find a condition that would require inspection of the other sleeves, and that inspection of the other sleeves would result in finding another crack in another sleeve that would cause that sleeve to eject before the next refueling outage. That would produce a risk benefit for performing the inspection before restart. The following logic was used to quantify that risk benefit, to the extent possible with existing knowledge.
The licensee had previously performed volumetric inspections on the Palo Verde Unit 2 heater sleeves on a voluntary basis while performing pre-emptive repairs. A total of 12 cracks were found in the 33 sleeves examined. Six were axial and six were circumferential. None of the circumferential cracks were found in the pressure-boundary part of the sleeves. The NRC staff did not require additional inspections at other units because the circumferential cracks were not in the pressure boundary. Therefore, it is assumed that the NRC staff would not require additional sleeves to be inspected at Palo Verde Unit 3 unless inspection of the nozzle that leaked revealed that a circumferential crack exists in the pressure boundary portion. Using the Unit 2 data, a realistic upper bound on the probability of finding such a crack in that one sleeve is approximately (1 ÷ 34 =) 3E-2. Using the same per-sleeve probability, the probability that at
least one additional circumferential crack also exists in the pressure boundary portion of another of the 36 sleeves in Unit 3 is (1 ! {1 ! 3E!2}36 ! 36 x 3E!2 x {1 ! 3E!2}35) = 0.29.
Computing the probability that an inspection of the leaking sleeve would result in detection of at least one other circumferential crack when all of the sleeves are inspected requires consideration of two effects that depend on the total number of circumferential cracks in the sleeves in that pressurizer. One effect is the probability that the initial leaking sleeve inspection will detect a circumferential flaw in the pressure boundary. That is n ÷ 36 for a total of n such circumferential flaws in the pressurizer. The other effect is the probability of n circumferential pressure boundary flaws actually being in that pressurizer, given the probability per sleeve.
That is C(36,n) x (3E-2)n x (1 - 3E-2)(36-n), where C(36,n) is the number of combinations of 36 things taken n at a time. And, when considering the probability for sleeve failure, there is a third effect that depends on the number of circumferential flaws in the pressurizer. For a probability, PE, that a circumferential flaw will result in a loss-of-coolant accident (LOCA) before the next refueling outage, the probability that none of the n circumferential flaws will fail is 1 - (1 - PE)n. So, the computation is unique for each possible number of circumferential flaws.
Because there is no averted risk if there are zero circumferential flaws or only the one circumferential flaw that is detected in the leaking (and repaired) sleeve, the sum of the 35 cases for 2 circumferential flaws through 36 circumferential flaws gives the averted probability for a LOCA. A QuickBasic computer program was written to perform that computation. The results are:
Probability of LOCA Upper Bound for Averted Probability of per Circumferential Flaw LOCA Due to Inspection Leaking Sleeve 1.0 1.9E-2 0.1 2.9E-3 0.01 3.0E-4 0.001 3.0E-5 The SPAR model estimates a value of 7.8E-4 for the conditional core damage probability (CCDP) for a small LOCA in the pressurizer at Palo Verde Unit 3. So, a reasonable upper bound estimate for the chance that the inspection now would prevent a core damage accident would have to be:
Probability of LOCA Upper Bound for Averted Probability of per Circumferential Flaw Core Damage Due to Inspection Leaking Sleeve 1.0 1.5E-5 0.1 2.2E-6 0.01 2.3E-7 0.001 2.4E-8 These results are to be compared to the risk of conducting an inspection during reduced inventory conditions. An estimate of approximately 1E-5 was used as the core damage value for performing the heater sleeve volumetric inspection during the reduced inventory plant state.
On the basis of the available information, the best estimate for the risk that would be incurred by performing the inspection during the reduced inventory plant state exceeds the reasonable upper bound estimate for the risk of waiting until the next refueling outage, unless there is some basis to believe that a circumferential flaw that is in the pressurizer sleeves now would be almost certain to cause a sleeve ejection before the next refueling outage. Therefore, the NRC
staff agrees with the licensees position that the safest course of action was to wait until the next refueling outage to inspect the heater sleeve.
Impact of Inspection Rationale on Risk Analysis The risk analysis presented above is primarily due to the nature of the inspection rationale, rather than knowledge of the condition of the sleeves. Note that, on the basis of the available inspection results, the realistic upper bound for the risk per reactor year can only be limited to (1 ! {1 ! 3E!2}35 =) 0.66 times the CCDP, that is 5.1E-4/year, without knowing that the state of any circumferential cracks is not approaching ejection conditions during the current year. In order to make that a minimally acceptable result with respect to the Regulatory Guide (RG) 1.174 guidelines for acceptable risk increases, it would be necessary to have a conditional probability of ejection without prior detection of leakage that is less than (1E!5 ÷ 5E!4 =) 0.02.
In order to make it a clearly acceptable result, the probability of ejection without detection of leakage would need to be (1E!6 ÷ 5E!4 =) 0.002.
In addition, note that, if all of the 53 sleeve leaks to date were from circumferential cracks (which is not known because they were not inspected for crack orientation), then it would be just barely possible to argue that the leak-before break probability is high enough to make these results acceptable under RG 1.174 guidance. However, that same argument would indicate that, because 53 leaking circumferential cracks have been repaired without inspecting any non-leaking sleeves to preempt ejections, the expectation value for an ejection without prior detection of leakage could be approaching unity for the number of leaks observed so far. This is essentially a circular logic that indicates the NRC staff cannot accumulate sufficient knowledge to assure safety by simply plugging nozzles whenever they leak.
With the current inspection rationale being used by the NRC staff, future leaking sleeves will be inspected for crack orientation and location. This will eventually produce a reasonable probability of detecting a circumferential crack in the pressure boundary, if any actually exist. If detection of any circumferential cracking in the pressure boundary will result in full inspection of all of the sleeves, then there is a reasonable (but unquantifiable) probability that the current inspection approach will eventually lead to full inspections before a sleeve ejects.
However, if further inspections can be dismissed because a circumferential crack that is eventually found in the pressure boundary can be considered too small or too high in the weld to be a precursor to ejection, then the probability of success is reduced. It is highly improbable that a circumferential flaw that is almost ready to eject a sleeve would be found by the current inspection approach, instead of being found due to the ejection event that the design and inspection process is intended to prevent. Therefore, the NRC staffs expectations for inspection of leaking pressure boundary components will substantially influence future risk evaluations on what kind of finding would be necessary to trigger expansion of the inspection sample beyond the one leaking sleeve.
staff agrees with the licensees position that the safest course of action was to wait until the next refueling outage to inspect the heater sleeve.
Impact of Inspection Rationale on Risk Analysis The risk analysis presented above is primarily due to the nature of the inspection rationale, rather than knowledge of the condition of the sleeves. Note that, on the basis of the available inspection results, the realistic upper bound for the risk per reactor year can only be limited to (1 ! {1 ! 3E!2}35 =) 0.66 times the CCDP, that is 5.1E-4/year, without knowing that the state of any circumferential cracks is not approaching ejection conditions during the current year. In order to make that a minimally acceptable result with respect to the Regulatory Guide (RG) 1.174 guidelines for acceptable risk increases, it would be necessary to have a conditional probability of ejection without prior detection of leakage that is less than (1E!5 ÷ 5E!4 =) 0.02.
In order to make it a clearly acceptable result, the probability of ejection without detection of leakage would need to be (1E!6 ÷ 5E!4 =) 0.002.
In addition, note that, if all of the 53 sleeve leaks to date were from circumferential cracks (which is not known because they were not inspected for crack orientation), then it would be just barely possible to argue that the leak-before break probability is high enough to make these results acceptable under RG 1.174 guidance. However, that same argument would indicate that, because 53 leaking circumferential cracks have been repaired without inspecting any non-leaking sleeves to preempt ejections, the expectation value for an ejection without prior detection of leakage could be approaching unity for the number of leaks observed so far. This is essentially a circular logic that indicates the NRC staff cannot accumulate sufficient knowledge to assure safety by simply plugging nozzles whenever they leak.
With the current inspection rationale being used by the NRC staff, future leaking sleeves will be inspected for crack orientation and location. This will eventually produce a reasonable probability of detecting a circumferential crack in the pressure boundary, if any actually exist. If detection of any circumferential cracking in the pressure boundary will result in full inspection of all of the sleeves, then there is a reasonable (but unquantifiable) probability that the current inspection approach will eventually lead to full inspections before a sleeve ejects.
However, if further inspections can be dismissed because a circumferential crack that is eventually found in the pressure boundary can be considered too small or too high in the weld to be a precursor to ejection, then the probability of success is reduced. It is highly improbable that a circumferential flaw that is almost ready to eject a sleeve would be found by the current inspection approach, instead of being found due to the ejection event that the design and inspection process is intended to prevent. Therefore, the NRC staffs expectations for inspection of leaking pressure boundary components will substantially influence future risk evaluations on what kind of finding would be necessary to trigger expansion of the inspection sample beyond the one leaking sleeve.
DISTRIBUTION PUBLIC RidsNrrDlpmDpr PDIV-2 r/f RidsNrrDlpmLpdiv (HBerkow) RidsNrrDlpmLpdiv2 (DCollins) RidsNrrPMMFields RidsNrrLADBaxley MMitchell SLong ACCESSION NO: ML052710123 NRR-106 OFFICE PDIV-2/PM PDIV-1/LA EMCB/SC SPSB PDIV-2/(A)SC NAME MFields DBaxley MMitchell SLong DCollins DATE 9-22-05 9-22-05 09/20/05 09/20/05 9/27/05 OFFICIAL RECORD COPY