ML19008A369
| ML19008A369 | |
| Person / Time | |
|---|---|
| Site: | Holtec |
| Issue date: | 01/08/2019 |
| From: | Holtec |
| To: | Tomeka Terry NRC/NMSS/DSFM/IOB |
| Terry T | |
| References | |
| Download: ML19008A369 (37) | |
Text
www.holtec.com Holtecs Input to the PEC Proceedings on NRCs Inspection Report
- 07201014/2018-201 Presented by:
Dr. Kris Singh, Chief Technology Officer Dr. Stefan Anton, Vice President-Engineering Kim Manzione, Licensing Manager Robert Tindal, Senior Director, NPD Chuck Bullard, Director, Engineering Mechanics USNRC, White Flint, MD 9 January 2019
www.holtec.com l Page 2 Agenda Purpose of the Presentation Summary of Apparent Violations Basket Shim Details Summary of What Happened MPC Status and Inspection Results Safety Evaluation of the MPCs Containing SSOs Corrective Actions Summary
www.holtec.com l Page 3 Purpose of this Presentation To provide additional information which shows :
That the entire population of SSOs plays no role in the safety function of any of the MPCs loaded across the Country.
Stated differently, the loaded MPCs would fulfill their intended function without exceeding any regulatory limits under all applicable conditions of storage and transport even if they had no SSOs.
Because the SSOs play no role in the safety performance of the loaded MPCs,they can be correctly characterized as a Not-Important-to-Safety (NITS) item in the Basket Shim Assembly.
Thus, while we accept the cited violations, their safety significance is minor.
That, learning from this episode, Holtec has performed a stem-to-stern re-appraisal of its processes and operating procedures and made numerous improvements to prevent damage to equipment during handling in manufacturing and transport to the site and other similar activities outside the scope of the normal safety analyses.
www.holtec.com l Page 4 Additional Purpose of this Presentation Provide additional facts and insights to clarify and further inform NRCs findings summarized in the inspection report.
To provide information on the safety analyses of a loaded MPC under the hypothetical assumption that no SSO was installed :
Thermal analysis demonstrates all regulatory limits are met Structural analyses demonstrate that the integrity of the stored fuel and the Fuel Basket is fully preserved under bounding seismic loads.
The violations occurred because of inadequate consideration of manufacturing challenges in the design and human performance error during manufacturing.
Provide a summary of the numerous improvements, after the discovery of a damaged SSO, made in the concept-to-commissioning life cycle of Companys SSCs so that all conceivable avenues for future failure are blocked.
www.holtec.com l Page 5 Two Apparent Violations Cited by the NRC Both pertain to the basket shim stand-offs Apparent Violation A Holtec failed to establish adequate design control measures as part of the selection and review of suitability of application of alternate four inch shim standoff pins Apparent Violation B Holtec failed to perform a written evaluation to demonstrate that a design change for multi-purpose canister stainless steel standoff pin did not require a CoC Amendment.
www.holtec.com l Page 6 Basket Shims Occupy the circumferential space between the Basket and the MPC Shell Discrete Basket Shim Assemblies surround the periphery of the Fuel Basket as shown in the illustration below for MPC-37
www.holtec.com l Page 7 What are the SSOs?
What is Their Performance Mission?
The Basket Shim Assembly consists of shim stand-offs (SSOs) made of stainless steel end-threaded bars, typically three in number, fastened to the bottom of the Basket Shim.
The SSOs were designed to improve fabricability and evaluated under the 72.48 process and to boost the native heat rejection capacity of the MPCs with the intent to seek a higher heat load rating through a future LAR The SSOs, shown below, increase the open helium flow area in the MPCs down-comer space to enhance heat rejection
www.holtec.com l Page 8 SSOs are a Part of the Basket Shim Assembly MPC Type Number of Basket Shim Columns per MPC Total Number of SSOs per MPC MPC-37 (PWR) 32 88 MPC-68M (BWR) 28 76 The SSOs consist of multiple stainless steel bars tapped into the bottom face of each shim column to elevate them above the MPC Baseplate to further promote natural convection of helium inside the MPC Each MPC type has multiple Basket Shim Assemblies, and each Shim has multiple SSOs (for redundancy).
www.holtec.com l Page 9 What Happened?
The SSOs were introduced via the ECO and 72.48 process which involved performing qualifying safety analyses; the analyses showed acceptable safety margins.
During a manufacturing involving repeated rolling the MPC shell, a small number of the SSOs were bent, a few even broke off. The damage to the SSOs remained undetected until the MPCs site inspection occurred.
The incidence of SSO damage correlates well with the extent of rolling (Peened MPCs (used at SONGS only) exhibited proportionally greater SSO damage rate than the un-peened ones).
The SSOs, robust under design basis loadings for the MPCs (which are diametrical) proved vulnerable to damage under circumferential forces applied to them during rolling operations. A few instances of observed bending of the SSOs is also traced to the error in their installation process in the shop.
www.holtec.com l Page 10 Why is the Basket Shim Assembly Classified as an ITS Class C Part?
The Basket Shim Assembly serves to position the Fuel Basket inside the MPC; its safety function is rather minor; viz.:
It plays no role in reactivity control (criticality safety).
Its contribution to radiation blockage (shielding) is negligible.
Its assistance in heat rejection is rather minor (increased conduction by the shims metal mass is offset by the reduction in heat transport by the thermosiphon action).
Interposed between the MPC Shell and the Fuel Basket, it serves to provide a conformal contact interface with both.
The Basket Shim Assembly is ITS-C because it plays no safety role in preventing criticality or a radiation release event.
www.holtec.com l Page 11 The SSOs in the LOADED MPCs merit being classified as NITS Every SSO for a Basket Shim is secured to it through a threaded connection. Multiple SSOs support each Basket Shim. SSOs are determined to have no safety impact on the performance of the MPCs in which they are deployed, because:
They dont provide any meaningful radiation shielding or criticality control As discussed later, the results of the FSAR-compliant thermal and seismic analyses on the loaded MPCs provide definitive evidence that the SSOs lack a safety function In short, every loaded MPC meets the entire set of regulatory safety criteria if all of its SSOs were absent altogether
www.holtec.com l Page 12 Events Following the Discovery of a Broken SSO in an MPC by Holtecs Site Services Team at SONGS Year-End 2017 - The introduction of the SSO design to MPC-37 and MPC-68M through Engineering Change Order (ECO) completed and processed under 72.48 February 2018 - During Site Inspection of MPC delivered to SONGS, a broken SSO was discovered inside MPC-37 by Holtec personnel March 2018 Holtec asked all clients to perform focused inspection of every SSO-bearing MPC to ensure that all SSOs are intact prior to loading the canister Holtec made NRC headquarters aware of the SSO issue, provided regular updates and copies of all safety evaluations, and answered questions from NRC staff.
www.holtec.com l Page 13 Events Following the Discovery of a Broken SSO in an MPC by Holtecs Site Services Team at SONGS (contd)
A Root Cause Evaluation (RCE) was instituted immediately which included factory and site inspections and data collection, establishing the statistical probability of SSO failure during manufacturing evolutions, safety analyses to assess the consequence of assuming a bounding assumption of failed SSOs, and a comprehensive re-appraisal of the procedures and practices. Numerous areas of improvement identified.
A detailed RCE report containing the self-identified weaknesses in design process was presented to the visiting NRC inspection team in May 2018.
Additional corrective actions (guided by NRC IN-96-28) defined in pursuit of operational excellence, subsequent to NRCs visit, have been fully implemented across the Companys dry storage program.
www.holtec.com l Page 14 Statistics on the SSO-Equipped MPCs Only MPC-37 and MPC-68M models were affected.
At the time of self-identified issue with the broken SSOs, 121 MPCs were equipped with SSOs; the table below shows their status in three discrete categories: 1. Loaded 2. At Holtecs Fabrication Facility; and 3. Delivered to Sites but not loaded.
MPC Type Loaded At Holtecs Fabrication Facility Delivered but not Loaded MPC-68M (BWR) 22 9
28 MPC-37 (PWR) 4 26 32 Total 26 35 60
www.holtec.com l Page 15 SSO Inspection Census Over 50% of all SSOs (4,200) were visually inspected and their condition documented (the rest inspected and replaced as needed but not documented):
0.12% found broken; every broken SSO was in the MPCs that were peened (SONGS-specific) 1.22% found to have a slight bend; found in both peened and un-peened MPCs.
Conclusions based on as-found conditions:
None of the Basket Shims had suffered failure of all of its SSOs The very small percentage of broken SSOs is well below the redundancy provided in the design (out of three SSOs in each shim, one is redundant)
Furthermore, the evaluation of the presence of broken SSOs in the MPC indicated that they had no safety impact.
www.holtec.com l Page 16 Safety Evaluation of the MPCs Containing SSOs The Immediate Operability Review concluded that all 26 loaded systems were safe and would continue to render their intended function without exceeding any regulatory limits under all applicable conditions of storage and transport.
The thermal safety evaluations for the immediate operability review were based on the MPCs as-loaded heat loads under the overarching assumption that every SSO has failed and become inoperative.
Seismic Analyses using a bounding earthquake that bounded the DBE of the plants which were executing loadings showed that if only one SSO remained functional in each shim, the system will successfully withstand the seismic event.
Based on the inspection results, all plants except SONGS (whose DBE exceeds the bounding earthquake) resumed loading.
www.holtec.com l Page 17 SONGS MPCs Four loaded MPCs at SONGS were re-confirmed to meet all applicable regulatory criteria for on-site storage and transport under the assumption that one SSO has been damaged in every Basket Shim (which vastly exceeds the observed rate of failure).
The not-yet loaded SSO-bearing MPCs for SONGS, subject to the Most Severe Earthquake assumption, were returned to the manufacturing plant and modified to replace the SSOs, even though a focused inspection and surgical SSO replacements would have sufficed.
At present, all of the MPCs ready for loading at SONGS have no SSOs
www.holtec.com l Page 18 Supplemental Seismic Analysis to answer NRC Inspection Teams query At the request of the NRC inspection team, a supplemental seismic analysis was performed with a bounding Reg Guide 1.60 DBE (1.0g in two horizontal and 0.75g in the vertical direction) and assuming only two operative SSOs (one has failed) supporting each shim assembly and that they were both bent.
This analysis showed that the MPC will meet all applicable regulatory criteria In summary, by May 2018, the integrity of SSO-equipped MPCs had been established by analysis of various scenarios requested by the Holtec User Group members and the NRC.
www.holtec.com l Page 19 Quantifying the Effect of Assumed SSO Failure on the Thermal Safety Performance of Affected MPC Models Thermal analyses were performed under the non-credible, conservative assumption that every SSO has vanished (non-mechanistically) causing every Basket Shim to drop down and block the down-comer to bottom plenum flow.
The thermal model used emulates the licensing basis model documented in the system FSAR.
MPC-68M in HI-STORM 100 The absence of the SSOs does not impair the ability of the MPC to meet the regulatory limit under the full licensed design basis heat load of 36.9 kW Regulatory limits on the peak cladding temperature (PCT) are satisfied with robust margins. Additionally, the MPC cavity pressure remains below its design limit set forth in the FSAR.
www.holtec.com l Page 20 Quantifying the Effect of Assumed SSO Failure on the Thermal Safety Performance of Affected MPC Models (Contd)
MPC-37 in HI-STORM UMAX Regulatory limits on the peak cladding temperature (PCT) are satisfied with robust margins for canister total decay heat of 37.6 kW (Holtec Report HI-2188123).
MPC heat load adopted for safety evaluations is higher than that allowed in the HI-STORM UMAX CoC (37.06 kW, Appendix B, Table 2.3-1)
Computed margins to the limit are greater than those in the approved FSAR MPC cavity pressure remains below FSAR design limit.
www.holtec.com l Page 21 Summary of Thermal Safety Analysis of MPCs with Failed SSOs Even though the inspections did not indicate even one basket shim to have dropped down to the baseplate because of failed SSOs supporting it, the thermal analysis was carried out assuming that every SSO in every shim has failed causing every shim to drop down to the baseplate, blocking the flow from the down-comer to the inlet plenum.
Even under this counter-factual assumption of every SSO failed, the peak fuel cladding temperature under the CoC-limited heat load remains below the ISG-11 Rev 3 limit for MPC-68M in HI-STORM 100 and MPC-37 in HI-STORM UMAX In summary, the SSOs are irrelevant to the regulatory thermal compliance of the MPCs in HI-STORM 100 and HI-STORM UMAX.
www.holtec.com l Page 22 SSOs Serve No Role in Structural Compliance of the MPCs The SSOs do not contribute to the structural strength of the MPC in any manner whatsoever. Their sole function is to enhance the MPCs heat rejection rate.
As observed in the preceding, the MPCs meet the permissible heat load assuming that no SSO is present.
Therefore, the SSOs are entirely superfluous for the safety compliance of the loaded MPCs.
To complete the technical evaluations, several seismic analyses were nevertheless performed to explore the MPCs structural performance with partially damaged population of SSOs, reported on the next slide.
www.holtec.com l Page 23 Structural Evaluation of the SSOs under Seismic loadings By design, the SSOs contribute no structural strength to the MPC or the Fuel Basket. The seismic analysis, therefore, was devoted to checking the structural integrity of the SSOs under assumed SSO failures.
Seismic analysis of the MPCs assuming two out of three SSOs are unavailable for supporting every shim in the MPC showed that the MPC will withstand a bounding Reg. Guide 1.60 earthquake pegged to 0.35g in two horizontal directions and 0.3g vertical direction (which bounded the DBE of every actively loading US site ) without failure of the remaining SSOs.
Even SCEs Most Severe Earthquake (MSE) (Reg. Guide 1.60 spectra with unprecedented ZPAs of 1.5g in each of the two orthogonal horizontal and 1.0g in the vertical direction) does not precipitate SSO failure if the shim is supported by only two (out of three) SSOs.
Separately, analysis of the SSOs during the hypothetical cask drops pursuant to 10CFR71 regulations also demonstrated that the SSOs remain structurally intact and fully functional
==
Conclusion:==
No MPC equipped with SSOs needed to be modified to meet any hosts sites design basis seismic loads.
www.holtec.com l Page 24 Risk Informed Remedial Measures 16 additional MPCs were loaded after a comprehensive inspection to confirm that no SSO was damaged.
All loaded MPCs fully satisfy their respective CoC requirement.
Table below lists the total count of MPCs bearing SSOs loaded in the industry.
MPC Number Loaded prior to Discovery Number Loaded after Completing Focused SSO Inspections MPC-68M 22 16 MPC-37 4
0
www.holtec.com l Page 25 Assay of Apparent Violation A Violation A citation, Holtec failed to establish adequate design control measures as part of the selection and review of suitability of application of alternate four inch Shim Standoff pins.
Root Cause Determined to be a deficiency in the design change process which did not ensure manufacturing operations were considered and evaluated.
Holtecs input:
Holtec accepts the violation of 72.146(a) (design control) but posits that, for the aforementioned reasons, this should be considered a minor violation.
The life cycle of new design implementation (from design to manufacturing to on site implementation) has three major barriers which are:
Design Review Process Factor Acceptance Tests / Examinations (FATE)
Site Acceptance Tests / Examinations (SATE)
While the first two barriers failed, the third (SATE) did not: The SSO failure was detected during the SATE process by Holtec personnel.
www.holtec.com l Page 26 Summary of Immediate Corrective Actions While the operating procedures and practices succeeded in flagging the SSO anomaly indicating that the QA program worked as a whole, the RCE indicated a pressing need to implement definitive corrective measures to preclude recurrence. The following activities were completed as a part of the corrective action:
Performed safety analysis (thermal and structural) of loaded units to ensure their safety Completed all applicable analysis packages for archival reference Inspected all non-loaded units and identified necessary actions on case-by-case basis Replaced SSOs with monolithic shim design in all applicable MPCs licensing and fabrication drawings, reconcile all analysis packages with the modified design.
www.holtec.com l Page 27 Strategy to Preclude Recurrence To preclude recurrence, the entire edifice of the product design development, manufacturing, and site implementation process (not just Design Change control) has been subjected to a crucial appraisal, which means leveraging the large body of Condition Reports (CRs),
Non-conformance Reports (NCRs), and Field Condition Reports (FCRs) accumulated over the past 32 years of nuclear QA operations at the Company to improve the operating processes across the board.
Using the wisdom gained from past operations as well as fresh thinking from the Companys thought leaders and consultants, the design development procedures were upgraded to include in-depth consideration of manufacturing and site operations.
Separate the design developers (Red Team) from the design critics (Blue Team). Include manufacturing and site services experts in each.
Emphasize cross-discipline training and solicit feedback from people in the trenches
www.holtec.com l Page 28 Major Actions Complete to Prevent Recurrence Upgraded the Companys design development procedure to include initial CTO approval of conceptual design, in-process peer reviews by red team, and final critique by a blue team of previously uninvolved independent experts.
Strengthened the initial design assessment, Engineering Change Order (ECO) and drawing review questionnaires to probe adequacy of the design embodiment to withstand fabrication operations.
Drawing on the lessons learned database, developed new questionnaires to query the potential of new issues that may arise during site implementation.
Develop a formal protocol to quantify risks associated with design or process changes.
Upgrade OJT of technical personnel to include training in manufacturing and site operation procedures Embed manufacturing and site services experts in the Red Team to facilitate discussion of manufacturing subtleties and practical challenges in site implementation.
www.holtec.com l Page 29 Assay of Apparent Violation B Apparent Violation B Holtec failed to perform a written evaluation to demonstrate that a design change for multi-purpose canister stainless steel standoff pin did not require a CoC Amendment.
Specifically, for the 72.48s addressing the site discoveries, Screenings were performed instead of a Full Evaluation Holtecs input Holtec accepts the violation of 72.48(d)(1) (design control);
however, we submit that, for the reasons discussed in the context of Violation A, this should be considered a minor violation.
www.holtec.com l Page 30 Corrective Actions and Actions to Prevent Recurrence for Apparent Violation B Revised 72.48s #1319 and #1321 to be full evaluations versus screenings. The conclusions derived from screening remain unchanged.
Remedial training on the 72.48 process implementation provided to personnel. Also reinforced expectation to err on the side of conservatism when determining whether a 72.48 evaluation is needed (versus screening only).
www.holtec.com l Page 31 Assessment of the Safety Significance of Apparent Violation B The stated violation is found to have no Safety Significance 72.48 full evaluation confirmed the conclusion reached by the prior screening.
Technical justification remained unchanged.
Administrative change to licensing paperwork only.
This was an isolated incident, since a review of Holtecs past 72.48s going back three years identified no other such case.
www.holtec.com l Page 32 Synopsis of Lessons Learned from the SSO Episode Make an intensive corporate effort to include nuances of manufacturing and site services in the SSCs design development effort.
Intensify training the Company personnel on the symbiotic relationship between design and manufacturing. Personnel must be give deep immersion in real life manufacturing.
Broaden the ECO/72.48 processes to include in-depth consideration of manufacturing and site operations.
Increase in process review and critique of evolving design decisions (CTO, Red Team, and Blue Team reviews).
When in doubt, do a full 72.48 evaluation.
Continuously upgrade the procedures using lessons learned from continuing operations - complacency is the enemy of quality.
www.holtec.com l Page 33 Summary As we have discussed in detail, our analysis show that, assuming all SSOs fail and become inoperative, the loaded MPCs fulfill their intended function without exceeding any regulatory limits under all applicable conditions of storage and transport.
Hence, the SSOs play no role in the safety performance of the loaded MPCs and can be correctly characterized as a Not-Important-to-Safety (NITS) item in the Basket Shim Assembly.
Therefore, while we accept the violations we believe they entailed minor safety significance.
To prevent recurrence, Holtec has performed a stem-to-stern re-appraisal of its processes and operating procedures and made numerous improvements to prevent damage to equipment during handling in manufacturing and transport to the site and other similar activities outside the scope of the normal safety analyses.
www.holtec.com l Page 34 Summary (Contd)
NRC Enforcement Manual specifies the following conditions under which NRC will most likely not consider escalated enforcement actions. They are: 1) safety significance of the issue being minor; 2) issue is self-identified by the licensee and promptly placed in the licensees Corrective Action Program; 3) licensee promptly completes Root Cause Analysis Report; 4) promptly completes all required corrective actions; and 5) issue was not caused by any willful actions.
As the supplemental information provided in this presentation indicates, we fully meet every one of the above criteria in the NRCs Enforcement Manual.
www.holtec.com l Page 35 Digging Deeper into the Root Cause and Devising Remedial Measures Our assessment of the supervening root cause behind the SSO malfunction is a pervasive lack of knowledge in the industry regarding the many collateral effects of manufacturing process on the hardwares performance.
In NRCs regulatory literature, NEIs guidance, and Holtecs own internal controls, the attention paid to the complex role played by the fabrication processes has been inadequate. This calls for a fundamental change in the way design/change development work is conducted.
The first step is educating both the design developers and the manufacturing personnel into the focused symbiotic relationship between their disciplines.
(Towards this end, a personnel training program is being implemented at Holtec)
Next, expand the design change execution and 72.48 screening processes to integrate considerations of design, manufacturing, and site operations and their effect on each other (A major upgrade of the ECO and 72.48 questionnaires has been carried out)
Third, increase technical personnels exposure to manufacturing. (Establishing the manufacturing plant adjacent to the engineering offices is a key step in this direction).
www.holtec.com l Page 36 Concluding Remarks All loaded canisters with SSOs fully meet their CoC specifications.
The SSOs in the loaded MPCs can be characterized as NITS. Their sole function is to add margin by enhancing the MPCs heat rejection rate.
HOLTEC accepts the violation of 72.146 (a) (design control) but our assessment shows that the safety significance is minor.
HOLTEC accepts the violation of 72.48(d)(1) (records of changes), but our full 72.48 evaluation did not screen to a higher significance.
Holtec has revamped and upgraded the entire array of processes and procedures including those pertaining to project planning, design control, 72.48 screening &
evaluation, fabricability review, site operation procedures, personnel training regimen, and risk-informed decision making.
www.holtec.com l Page 37 Concluding Remarks (Contd)
Information to Clarify NRC Inspection Report Discussion of Violation A. states that SSOs support the Fuel Basket. However, the design of the SSOs is such that they do not, and are not required to, support the Fuel Basket., Section 3.4.2: stated that HOLTEC informed licensees to limit the heat load below NRC approved limits. There was no need for such a notification and HOLTEC did not make this notification.
Information to Clarify NRC Inspection Report Discussion of Violation B. states that for the design change for the SSOs, Holtec completed a 72.48 screening and incorrectly determined that a written evaluation was not needed. Note that the 72.48 for the design change (1212) was a full evaluation.
The loaded Canisters do not and never have posed any risk to public health and safety, as incorrectly and continuously alleged by certain activists in the social media. We regret their canards.