ML20127N856
| ML20127N856 | |
| Person / Time | |
|---|---|
| Site: | Trojan File:Portland General Electric icon.png |
| Issue date: | 01/18/1993 |
| From: | Hanauer S TECHNICAL ANALYSIS CORP. |
| To: | |
| Shared Package | |
| ML20127N849 | List: |
| References | |
| NUDOCS 9302010100 | |
| Download: ML20127N856 (18) | |
Text
=
- z. .
g, q
%d 7:(
J i
'I q
(. .
- i SAFETY REVIEW 0F TI.OJAN PLANT RESTART:
-Steam Generr. tor Deterioration-and Interim Plugging Criteria Stephen H. Hanauer - .,
9 January 18,1993'-
+
a
- Technical Analysis Corporation
_ 6723 Whittier Avenue, Suite 202 :
'McLean, Virginia 22101:
- G03) 883-3700' c
~9302010100'930119- e PDR-::ADOCK OS000044i PDR .
1 J __ _ _ _ _ . _ _ - .___ 1. _ _ _ _ : . . J . _ __ __ . _ . .s _ . _ . _ _ . _ _ _ _ _ _ _ _ z M,
TABLE OF CONTENTS Section East 1 Introdueden and Summmv ...................................... 2 1.1 Scope of thlt Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 I 1.2 Incomplete Nature of this Reoort . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 13 Su m m a rv . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 8 2 Me t h od o f An ni vsi s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 3 St e am Gen erator Tube Brnh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 3.1 Ini t i a t in g Es e nt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 3.2 Significant Fune'dDns. Required to Keep the Core from Melting . . . . . . . . 7 33 Event Sc outates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 3.4 Hel;ase of Radioattive Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 4 M a ln Str Am.fipt BII&k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 4.1 Initiating Event ......................................... 9 R. 4.2 4.3 4.4 Significant Ft.se.tlons Requhed to Keep the Core from Melting . . . . . . . .
Event Ssquinqcs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9 10 hbe Leakage Rate ..................................... 11 I 4.4.1 .Qjicria Before 1991 ...............................
4.4.2 Additional Degadation Discovered in 1991. . . . . . . . . . . . . . . . . 12 4.4.3 Additional insoections in late 1992 . . . . . . . . . . . . . . . . . . . . . . . 14 11 4.5 Release of Radioactive Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 4.5.1 CoIe Melt Accidenti . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 4.5.2 Events that do not Melt the Core . . . . . . . . . . . . . . . . . . . . . . . . 16 I 5 llacert aintics_and M arcini . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ,. . . . . . . . 17 4
.x 11 4 .
4 g r 4
SAFLTY REVIEW OF TROJAN PLANT RESTART:
Steam Generator Deterioration And Interim Pluccino Criteria Stephen H. Hanauer h
y Technical Analysis Corporation knuary 18,1993 1 Introduction and Summarv 1.1 Scope of this Rcylts in the 1991 outage at Trojan, the usual steam generator tube inspections were supplemented with a more sensitive motorized rotating pancake coil cddy current inspection probe. These
. supplementary inspections identified several hundred tubes with cracks. The results of an extensive program of additional inspections were combined with data from other plants and industry programs. Additional data were obtained from both in-plant and laboratory examinations of tubes removed from Trojan steam generators. Portland General Fjectric (PGE),
h the utility operator of the Trojan plant, proposed, and the NRC accepted in February 1992, a Y _
revised interim tube repair criterion that leaves unrepaired several hundred known cracks that may be deeper than the previous limit of 40% of the tube wall thickness.
The plant was restarted but shut down on November 9,1992, to repair a leak caused by inadequate stress relief rJter a sleeving repair during the 1991 outage. During the outage that began in late 1992, additional steam generator tube inspections were performegl,
- whose results raised additional concerns.
Starting in December 1991, Dr. Joram Hopenfeld,and Mr. Joseph Muscara, NRC Staff technologists, questioned the validity of the NRC-apti toved February 1992 repair criterion and its basis in data and analysis. On January 5 and January 15,1993, the NRC issued documents setting forth a technical resolution of the concems expressed by these NRC Staff members.
The ongon Department of Energy engaged me to advise whether, in my opinion, Trojan is safe to restart after the currett outage that began in November 1992. At the time of this engagement, .
the apparent issue was the questions raised by Dr. Hopenfeld and Mr. Muscara. An additional-I issue, questions raised by the additional deterioration detected in the late 1992 inspections at Trojan, is also discussed in this report.
1 9 _ o
l
- 1.2 Inomplete Nature of tW Rcpm1 I The announcement on January 4,1993, by Portland General Electric that operation of Trojan was being terminated came while the review described in this report was in progress. The technical work by PGE and its contractors to support restart safety review was terminated, so we will not obtain, on this Trojan review at least, the technical information that was still to come on January
- 4. Therefore, our conclus!ons and recommendations are necessarily based on less information--
in particular, less documented information--than we would need for a true restart safety evaluation. This report is to be viewed as an interim evaluation that will not be completed.
Since PGE has decided that restart will not occur, even if it were decided that Trojan is safe to restart, my conclusion and recommendations have no practical significance for Trojan operation.
This report provides a record for the Oregon Energy Facility Siting Council and the Oregon Department of Energy.
1.3 Summarv 1 conclude that Trojan is safe to restart. More precisely, I conclude that, if the g PGE/ Westinghouse analysis underway on January 4,1993, had been completed and documented, p and had confirmed what we were told in conference calls with PGE, Westinghouse, the NRC and Oregon representatives, Trojan would have been safe to restart. I also recommend that the safety g of Trojan be augmented, for restart, by decreasing the operating limit on radioactivity allowable P in the primary coolant and by developing plans to replenish the supply of borated water in the refueling water storage tank,if needed during an accident.
My evaluation included the effect of Trojan steam generator tube destadation on the probabilities and consequences of possib!c accidents in which the degradation might play a significant role.
l Such accidents could be initiated by rupture of one or more steam generator tubes during operation, or by a break in one of the main steam pipes, in which possible tube leakage would
~
influence the outcome.
For possible accidents whose initiating event is rupture of one or more steam gene. . tor tubes, neither the frequencies of such initiating events nor their consequences is significantly influenced by the Trojan tube degradation. Several such events have actually occurred, but the causes have been unrelated to rube deterioration such as that at Trojan. Similarly, the courses and g consequences of possible tube rupture accident event sequences would not be significantly R affected by the Trojan tube deterioration. The actual events have been controlled without significant releases of radioactisity. -
Another class of possible accidents begins with an initiating event of a break in a main steam pipe, or the sticking open of one of the large safety and milef valves connected to these pipes.
Any significant leaks in the degraded Trojan steam generator tubes during such an event could let the radioactive primary cooling water into the secondary system and out the break (or the 2
i k
w ,, _ l
~ ~ ~
l
r I
stuck-open vrJve) in the steam pipe, which is outside the reactor containment. This would conttitute a release of radioactivity, and also a loss of water available to cool the reactor core and keep it from melting.
A recent NRC analysis shows that the Trojan tube degradation would likely lead to increased tube leakage in such an event, with a leakage rate predicted to be about 1000 times larSer than PGFJWestinghouse's prediction. I recommend that the NRC leakage rate prediction be used in analyzing these possible accidents, and that the leakage rate be assumed to be as large as rupture of a single tube, which is about 600 gallons per minute, ne supply of borated water availab!c to septentsh the primary coolant includes the 400,000 I gallons in the refueling water storage tank, and about an equal amount available from other sources. Operator actions can reduce the leakage rate, conserve the available water supply, and tning the sequence to successful termination.
Greater attention shou!d be paid, in my opinion, and plans developed, for ways to replenish the g refueling water storage tank if it tums out to be needed. Dere is plenty of time and plenty of F water; what is needed is a source of boric acid, a place to mix it, and a way to get the solution into the tan!.. This does not seem too difficult to me.
I conclude that in spite of the tube degradation, the core melt probability for main steam pipe break accidents, estimated by the NRC at one in 1,000,000, is satisfactorily low.
For main steam pipe break event sequences that do not involve core melt, the calculated ndioactivity release is proportional to the assumed tube leakage rate- Using the Westinghouse g calculation, but the NRC leakage rate prediction, and my recommended assumption of en assumed leakage rate for one tube rupturing, the calculated radiation dose at the site boundary is unacceptably high. However, the calculated dose can be reduced by c modest lowering of the l allowable operating limit on radioactivity in the primary cooling water during normal operation.
I recommend that this be done.-
2 hic 1 hod _of Analnis :
Safety evaluation involves analysis of postulated requences of events that could threaten the defense in depth pmvided for safety assurance. Rather than use the NRC design basis accidents, B- I have based this analysis on the methods of probabilistic safety analysis, in which both the probabilities and the consequences of the events are talen into account, 'she intent is to use g realistic values of parameters and probabilities.
All nuclear plant accidents that can hurt people offsite or impact the cavironment begin with an g inhiating event, which can be an operating mistake, a pl..a of equipment breating, a fire or 3
8 p _. - . _ . __
sevele storm or c.rtrthquake, a disturl>tnce on the power grid away from the plant, or some other occurrence.
The initiating event, wbstever it is, creates a disturban:e in the plant, whose temperatures, pressures, flows, etc., go awry. A Equalc.of events ensues. He plant trips off--or fails to
$. trip when it should. He operators and the automatic controls ne used to bring the plant into a safe, quiescent state--or fall to do so. He outcome is described as the phnt state. .
In any real accident sequence, the outcome depends on not only the type and severity of the initiating event, and the characteristles of the plant, but also the successes and failures of the operators and the systerns as they attempt to manage the course of events. De outcome thus depends on the capabil! ties of the systems called on to function and whether these systems work I when they ne called on, and on the actions of the operators and the automatic controls to call ou safety functions and systems.
Similarly, for the plant states that involve the release of radioactive materials out of the nuclear ;
reactor primary system (or from other sources, such as spent fuel), the characteristics of the '
release, tbc response of the containment, the actions of the operaton and the functioning of systems (such as contabunent isolation valves, containment cooling and containment spray) 8 deterrnine the extent to which the radioactive materials are controlled or released to the envbonment.
Possible outcomes of different sequences of events include:
a.
ne potential accide.ut is anested witbort plant damage (investment protected) and witbout release of radioactive materials (public bealth and safety and environment protected). Almost ali inJtlating events actually experienced have had this outcorne, b.
De plant is damaged (investment not protected) but releases are prevented or limited to insipificant amounts (public health and safety and environment R protected). De Browns Ferry fire and the nree Mile Island accident are in this class.
- c. He plant is damr;ed (investruent not pmtected) and radioactive materials are irleased (envimcment not protected; public health and safety may not be protected). De Chernobyl accident is in this class.
g We can't know in advance what, specifically, will happen. We can't predict which initiating 2 event will occur, or when. We can't predict,if an initiating event occurs, what the operators will do and whether the systems will function. We do know which initiating events the p!r.nt is designed for, what the operators are supposed to do, and how the systems are desiped to g function. De NRC safety rtquhrments are framed in terms of plant design basis (events to provide for), system design basis (performance analysis, high quality, rrdundant components, 4
4 y -- . __
{
4 qualification of equipment, to enhance reliability of function) and operator qualiGeation and training (to enhance likellbood of correct action). But events will occur how and when they happen, operators can perfonn well or poorly, equipment un function or fail, in order to analyze plant safety and public or environmental risk in tbc face of all this uncertainty, the problem can be approached using pmbabilities. We don't know what will happen or when, but we can predict the frequency of events of different severity, the probability of the operators acting correctly or making mistakes, and the probabliities of systems functioning adequately or inadequately. These probabilities, plus some complex calculations, yield the calculated probabilities of arriving at the various outcomes; that is, of pmtecting the public health and safety, the environment and the in* vestment in the plant.
Steam generator tube integrity or leakage is significant in several possible accident scenarios--
event sequences. Some amount of tube leakage is often experienced during operation. le.akage is monitored during operation and if it exceeds Technical Specification operating limits, the plant must be shut down. Tubes must be inspected regularly or when the leakage rate gets too high, and repaired as needed. By itself, tube leakage within the operating limits has little safety significance.
For less probable events such as steam generator tube ruptures and main steam pipe breaks, estimates of the frequencies of occurrence are derived from experience and analysis. Estimates obtained from different sources are not always equal, thowing the approxhnate nature of estimating infrequent and hypothetical events.
' 3 Steam knerator Tube Bre2h I Inidaling Event 3.1 .
On several occasions worldwide, tubes have broken during operation, with leakage rates of several hundred gallons per minute, far larger than the operating limits. While e.aeh such event has been analyzed for its root cause, none of the actual ocburtences was apparently ' caused" by any operating event that happened at the time.
]
A 1988 NRC study gives the average frequency of steam generator tube ruptures during normal-operation as one in 67 years for one tube ruptured, one in 1250 years for 2-10 tubes ruptured, J .
D
- s f
w
1
- I and one in 50,000 years for more than 10 tubes ruptured.' Another recent (1989) NRC study gives the frequency of 1-tube ruptures during normal operation as one in 100 years.'
nese tube rupture frequency estimates are much higher than the estimates reviewed in section 4.4.2 of this report for tube rupture in steam pipe break events. The actual tube rupture events experienced in other plants have been caused by things that are unrelated to the Trojan tube degradation that is the subject of this repon. Even though the degradation obrerved at Trojan has been going on for years, at several plants, it has not caused any tube ruptures. Derefore, I believe that the contribution of tbc recently discovered 'frojan tube degradation should not l significantly change tbc estimated frequency of tube rupture initiating events.
1 3.2 Sicnificant Functions Paquired to Keep the Core from Melting De following are the safety functions required after a tube rupture or a steam pipe break, to keep the reactor core from rnelting.
o Shut off the neutron chain reaction by inserting the control rods, stopping almost all reactor core power generation, leaving only (unavoidable) decay beat.
o Reduce primary pressure as fast as allowable (keeping pressure high enough to provide core cooling and also avoiding reactor vessel overcooling) to prevent steam generator tube leaks from developing or increasing in size, and to decrease
{ the flow rate through any leaks that do occur or were already present. For the tube break initiating event, the purpose is to minimize the flow rate through the breal in the tube, l
o Replenish primary cooling water lost through leakage.
I o Maintain core subcritical, inhibiting neutron chain reaction and core power I;eneration, by keeping the control rods inserted and the cooling water adequately borated. .
o Re nove beat from primary system 1
J l
8 NRC, NUREG-0844, September 1988, pages 3-19 through 3-21, 2
NRC, NUREG/CR-4550, Vo!ume 7, Revision 1, September 1989, page 4-5.
6 I
he .
I 3.3 Event Sequences I ne following descriptions bric0y outline the sequences of events that would ensue following this initiating event. Only the most significant sequences me described; there are many other possibilities, wherein the equipment or the operating team is unsuccessful in accomplishing one l or more of the essential safety functions. In general, the probabliities of these failurt paths are low.
l De event sequence begins with the initiating event: One or more tubes break, with a spectrum of break sizes from small leaks (which have little safety significance), to luge leaks, to complete rupture of one tube (such that primary water can flow unimpeded out of both ends of the broken I tube), to rupture of multiple tubes.
ne operations team must cool and depressurize the primuy system to decrease the Dow of I primary fluid out the leak or rupture. The sequence is terruinated when the primary systern coolar.t has been depressurized, cooled, and its level lowered tnlow the tube kA, so the leakage Dow stops. De secondary system holds the leakage Guld and pmvides containment, at least for I a while. If the primuy cooling and depressurization is successful soon enough, the leakage Guld is contained indefinitely; otherwise, some primary Duld eventually overflows the steam generator and goes to the condenser or out the steam relief valve.
I, 3.4 Release of Rad!oactive Materials g
For event sequences that do not result in core melt, the release of radioactivity s negligibly g small. This has been true of the tube rupture events that have aerually occurred.
Some core melt requences would be predicted to result in substantial radioactivity releases.
l However, the pmbability of occurrence of such releases is estimated to be very low. Two 1989 NRC risk studies give core damage probabilities for esent sequences that begin with str.am generator tube rupture as one in 500,000 years' and one in one in 800,000 years.' Core l damage" in these risk studies is not necessarily core melt, and not all core melt events result in large releases.
In any case, since the tube rupture initiatint event frequency is not significantly affected by the present state of the Trojan tubes, and the event sequences are also not affected, I conclude that the risk from steam generator tube break events is oct affected by the tube degradation I experienced at Trojan.
I 8
NRC, NUREG-1150, Second Draft, June 1989, page 3-5.
- NRC, NUREG/CR-4550, Volume 7 Revision 1, September 1989, page 4-69.
l 7 I
I
________._____-_-_m____
4 l 4 I
( ,
4 hithLSicam Pioe Break 4.1 Initiating Eveni >
In addition to a ' spontaneous
- tube break, a break or large leak in a main steam pipe is a possible initiating event where tube leakage would have a significant influence on the outcome of an event sequence. Such a large steam pipe leak could be the resut of either an actual break in one of the 4 large steam pipes or the sticking open of one of the main steam safety valves or relief valves. Only the portions of the pipes that ars outside the containment, but before the main steam isolation valves, are important to steam generator tube leakage, for reasons discussed in section 4.3. ne stearn safety and relief valves are connected to this safety-significant portion of the steam pipes.
'nis region of tbc rnain steam pipes is designed and inspected as "superpipe", just because a break here could bypass containment. At least three breaks have been experienced in steam pipes: Relief valve beaders failed at H. B. Robinson Unit 2 and one of the Turkey Point units; I the bypass steam pipe failed at Fermi Unit 2. All three failures were caused by design errors; all three occurred early in plant life. Trojan has operated for over 15 years; there is no reason to believe tha. the Trojan design has any p oblem.
NRC studies give estimates of the frequency of breaks plus stuck-open valves in the safety-significant portion of one of the 4 Trojan main steam pipes occurring during nornn.1 operation i as one in 1000 years and one in 500 years.8 De very recent NRC re-evaluation gives one in y 700 years.' This evaluation points out that a precursor of this event occurred at Trojan in 1984; a steam safety valve opened in a plant transient, stuck open for a while, and then closed.
4.2 Signifinnt FuncilenLRtquirtd_toleco the Core from Melting I The required functions are essentially the same as for the steam Senerator tube break, see section l 3.2. The event sequences are somewhat different, as can be seen in the aext section.
.1 p'
L 8
l 1000 years: NRC, NUREG-0844, Section 3.4,1988; 500 years: NRC, NUREG/CR-4550, Volume 7, Revision 1, September 1989, page 4-5.
NRC memo, E. S. Beckjord to T. E. Murley, January 15, 1993, Enclosure 2, (un-numbered) page 2.
8
=
E 4.3 Event Sequegu The event sequence begins with the initiatir.g event: A main steam pipe breaks in the region l outside containment but inside its main stearn isolation valve, or one or more of the large safety ano relief valves connect-d to the pipe sticks open. Because the break or leak is ahead of the isolation valve, closing the isolation valve doesn't stop the flow of steam out of the system, l
ne pressure in the secondary system decreases as the steam escapes. For a large pipe break, the seccadary system pressure falls fred about 1000 pounds per square inch to below 200 pounds l per square inch in a few minutes. De primary system pressure, imtially 2200 pounds per r,quare inch, decreases almost as quickly, initially, as a result of cooling via the steam generators and g
also by loss of water through any tube leak. However, the primary system pressure rises again
{ because the emergency core cooling systems replenish the primary coolant. If nothing intervenes,
- the pressure that the steam generator tubes experience (equal to the primary coolant pressure
- inside the tubes minus the steam pressure outside the tubes) therefore doubles its noimal operating value after about 1/2 hour.'
If the steam generator tubes leak significantly as a result of this increase in effective pressure, the leakage fluid flows from the primary system to the secondary system and out the steam pipe break, which is outside containment. The fluid so lost can constitute a re! case of radioactivity, and also cannot be recirculated to replenish the primary fluid needed to cool the reactor core.
The propensity of the tubes to leak will be decreased, and the flow rate through any leak that develops will be decreased, by lowering the primary system pressure as much and as fast as allowable. De pressure must be maintained high enough to cool the reactor core, and the rate cf decrease must be limited to avoid thermal shock to the reactor vessel. Tbc recent NRC calculations show that the effective pressure difference seen by the tube start., at the normal operating value of about 1300 pounds per squi.re inch, and that the eventual maximum pressure can be reduced from 2600 to about 1800 rounds per square inch by operator action, without l jeopardizing the core or the reactor vessel.'
%e primary sy stem pressure must alra be tnaintained higher than the secondary system pressure I if 'here is any steam generator tube leakage, as long as there is any unborated secondary system water in the steam generator above the leak. Such unbqrated water must be prevented from being g injected into the primary system. De primary system water must be borated to keep the reactor suberitical when it cools down, even with the control rods h.serted.
4
.l Eventually, if significan'. tube leakage continues, the source of borated water for replenishing the
~
primary system cocleat-the refueling water storage tank--will become depleted, and core 1
7 NRC memo, E. S. Beckjord to T. E. Murley, January 15,1993, Enclosure 3, Figure 4.
s NRC memo, E. S. Beckjord to T. E. Murley, January 15,1993, Enclosure 3, page 2.
9
s 1
4 . cooling water injection will stop unless another source of borated water has been pmvide.d in the meantime.
I If the supply of borated water runs out and core cooling is interrupted for too long, the core will melt. A leakage path for adioactivity will exist from the core, via the primary system piping, through the leaks in the steam generator tubes and out the broken steam pipe, bypassing l containment.
The operator can influence bow long the supply of borated water will lut, by (1) cooling the l primary system using the undamaged steam generators, with injection of auxiliary feedwater and opening the steam relief valves in the undamaged main steam pipes; (2) controlling and limiting the pressure of the injected borated water to limit the pressure seen by the tubes, and so limit any tube leakage, and (3) conserving borated water by controlling the flow of borated water being injected into the primary system to just the amount needed to cover the reactor core and maintain cooling.
The sequence can be terminated by switching the core and primary system cooling function to the residual beat removal system, which can function with the primary system water level lowered below the level of the tube leak (s). In order to accomplish this, the primary system temperature and pressure must be reduerd, by cooling the system, to allow the switchover in cooling, and then the water lev:1 must be lowered. ' Ibis takes time, and cannot be speeded up too much without overheating the core or overcooling the reactor vessel.
Clearly, the parameters that control whether the core melts are the steam generator tube leakage rate, as compared to the available supply of borated water, and the time required to reduce the primary system temperature and pressure, switch cooling modes, and lower the primary system water level.
Radioactive materials that escape from the broken steam pipe (or stuck-open valve) are released outside the containment and constitute a potential hazard to the plant staff and the public.
4.4 Tube Leakage Rate This is the core of the controversy.
4.4.1 Criteria Before 1991 As a result of much experience, testing and research, the nuclear industry and the NRC developed l
I inspection methods for steam generator tubes and criteria to determine when tube repair is required. In general, degradation that results in an effective tube thickness less than 60% of the L
original thickness (such as a crack deeper than 40%) requires repair, usually plugging or sleeving.
I 10
~
- i!-
1 One of the NRC studies previously cited gives probabilities for tube rupture as a consequence of a steam pipe btrak event as one in 40 (for 1-10 tubes ruptured), and one in 2000 (for more than 10 tubes ruptured).' nese probability estimates were based on the strength, leakage and rupture properties of steam generator tubes as perceived when the report was developed in 1988.
1 4.4.2 Additional Degradation Discovered in 1991 The corrosion that was discovered in the Tn,jan steam generator tubes in 1991 occurs on the outer tube surfaces, at locations where the tube is inside the holes in the tube support plates.
Each steam generator tube is U-shaped, with the bend on top and the ends of the "anns" anchored in the tubesheet, which is a thick piece of metal with holes in it for the tube ends. He tube arms also pass through holes in 7 horizontal tube support plates spaced over the length of the tubes.
De region between the outside of the tube and the inside of the suppon plate hole is a crevice, open at the top and bottom. Impurities in the secondary system water tend to concentrate in these crevices, sometimes a million times more, compared to their concentrations in the water outside the crevices. Some of these concentrated impurities are believed to cause the Trojan corrosion.
The corrosion process results in two different crack patterns: (1) Many small " axial" parallel cracks oriented vertically, aleng the axis of the tubes; and (2) a pattern of cracks that looks (under a microscope) like an irregular mosaic. Sorne corroded areas look like one pattern or the other; some look like a mixture of the two.
It is believed that this corrosion process star:ed before 1986. De cracks grow slowly with time, and are inspected periodically. The growth rate has been estimated from in-plant inspection data and the results of laboratory examinations. Larger cracks are detectable with conventional eddy j current inspection probes. ne new rotating pancake coil eddy current probe found many cracks that the conventional probe is unable to detect, thus cracks are detected by the rotating pancake coil probe at an earlier stage of the corrosion process.80 l-ne existing, 40C _iterion for tube repair was judged not to be applicable to the newly discovered cracks Newly developed " interim plugging criteria" were approved in early 1992.
I De NRC safety evaluation associated with approval of the new criteria states that 428 Trojan g
tubes have known Daws left unrepaired at the end of the 1991 outage, and that these may have 3 maximum depths exceeding the old 40% limit."
NRC, NUREG-0344, pages 3-21 and 3-22, September 1938.
'3 Westinghouse Trojan Tube Repair Criteria, Report WCAP-13129, Rev 1, pages 5-11/12.
I- " NRC Safety Evaluation, pages 5 and 11, Febmary 5,1992.
11 1
<1 ,
[. .
, Westinghouse states that,in spite of the known degradation of the Trojan steam generator tubes
' ( beyond what was known in 1988, a steam pipe break event would result in very small tube leakage, less than 1 gallon per minute, and that the probability of tube rupture in a steam pipe event is less than one in 30,000." It is obvious that the current Westinghouse siew is that the tubes are stronger today-much less likely to rupture in a steam pipe break event-than the NRC estimated in 1988. De Westinghouse estimates use contlations based on data on the measured burst strength and leakage of tubes removed from Trojan end other plants, degraded as they are today, plus laboratory tests on artificially degraded specimens.
Dr. Hopenfeld and Mr. Muscara say that the probability of significant tube leakage following a p steam pipe break is higher for Trojan tubes with known through-wall cracks and other cracks i deeper than 40% than the earlier estimates for tubes without these defects. Rey state that this leakage will shorten the available time the operators have to control the plant and organize an e.dditional source of borated water. De shorter available time will increase the chance of operating errors and failure to make more borated water available in time, and thus increase the probability of core melt in steam pipe break event sequences.
The NRC Staff based its early 1992 acceptance of Trojan operation, for Cycle 14 only, with the presently known degradation and allowance for growth during this cycle, on detectability of large cracks, margin in tube repair criteria, high measured strength of degraded tubes, and tightened operating leak rate limits." A later memo from the NRC Office of Research, Dhision of Engineering, reaches conclusions similar to those in the NRC Staff Safety Evaluation, based on similar reasoning, with the added basis of the low probability of a steam pipe break."
Two very recent (January 1993) NRC Office of Research memos reiterate their earlier evaluation, give the technical bases for their evaluation, and respond specifically to Dr. Hopenfeld's
- f. arguments."
The recent NRC memos contain estimates of steam generator tube leakage rate following a main steam pipe break. The leak rate estimate for Trojan "D" steam generator is somewhere between u Westinghouse, WCAP-13129, Revision 1, pages 50-11 and 10-14, December 1991.
, " NRC, Safety Evaluation Related to Amendment No.178 to Facility Operating License No. NPF-1, February 5,1992.
) " NRC Memorandum, L C. Shao to E. S. Beckjord, " Interim Plugging Criteria for Trojan J Nuclear P; ant," December 9,1992.
" NRC memos, E. S. Beckjord to T. E. Murley, " Interim Plugging Criteria for Trojan Nuclear Plant, January 5 and 15,1993. Enclosure 3 to the January 5 memo is " Division of Engineering [ Office of Research] Responses to Comments of J. Hopenfeld."
12 s
- * * ====*==4. 'm.- .g ..u .w , ., ., . . ,
w
b .
33 and 1350 gallons per minute, with a "best estimate
- value of 145 gallons per minute. The evaluation is for the full effective tube pressure of 2600 pounds per squate inch, with no credit for operator action to reduce the pressure. Any one of the four steam generaton would give I approximately the same results", ne main steam pipe break or stuck-open valve is assumed to involve only one steam generator.
De NRC "best estimate
- leakage rate is almost 1000 times higher than the Westinghouse estimate, and seems to me to more reasonably represent the probabilities and uncertainties than g the Westinghouse value. In fact, I suggest that 600 gallons per minute, the leakage flow rate for one tube rupturing as a result of a main steam pipe break, should also be considered in evaluating the safety of Trojan restart, as well as the NRC "best estimate value of 145 gallons per minute.
I ne NRC Office of Research memos cited just above also contain a calculated core melt probability of one in 1,000,000 [' cars, for all event sequences initiated by steam pipe breaks or I stuck-open steam safety valves. ne sequences included in this estimate include the various possible failure paths, with their probabilities. Bis core melt probability is satisfactorily low, in my opinion.
I 4.4.3 Additional inspections in late 1992 Du;ing the forced Trojan outage to repair the leaking sleeve that began November 9,1992, PGE g performed additional inspections of some tubes in the steam generator that had to be opened to 4 repair the leak. Inspections included the other sleeves; to confirm the adequacy of the 1991 repairs, and some tubes. Additional tube inspections suggested that a different pattern of corrosion might be present. Still more inspections were performed, including ultrasonic probes g as well as cddy current probes.
l Westinghouse reponed that the patterns of corrosion were not new, but resembled tubes pulled earlier from otber plants, with acceptable measured burst strength. nis information was reported in a series of telephone calle from PGE and its contractors to the NRC and State of Oregon l representatives, ne data and analysis were to be documented in a submittal from PGE to the NRC scheduled for January 8, but the January 4 PGE announcement terminating Trojan operation forestalled this. Derefore, we have only the information transmitted in the phone calls.
I 8' NRC memo, E. S. B:ckjord to T. E. Murley, January 15,1993, Enclosure 1, section 6 (no h
page numbers).
" Ibid., section 2.
h
" NRC memo, E. S. Beckjord to T. E. Murley, January 15,1993, Enclosure 2, page 3 q
5 (unnumbered). The January 5,1993, memo gave a slightly higher core melt pmbability estimate, one in 700,000 years, 13 h
1
-2 2 -_._ _
l
-If the documentation had confirmed the analysis transmitted orally in the phone calls, I would I
have recommended that the additional information on 'liojan steam generator tube degradation g- does not denote significant additional deterioration. Herefore, the 1992 steam generator tube data do not indicate that restart is unsafe.
I 4.5 Release of Radioactive Materials l Of course, the reason that reactor accidents are of concern is the possibility of releasing radioactive materials out of the plant; to the potential detriment to the health and safety of the public and to the environment. For steam generator tube degradation, the potentialimpact arises from any increases in either the amount of adjonctivity predicted to be released or the probability of significant releases. Two sets of accident sequences were analyzed: (1) Core melt accidents; (2) steam pipe break events where the core doesui melt.
4.5.1 Core Melt Accidents l De principal risk to the public from reactor accidents arises from those event sequertra where 9 the reactor core is predicted to melt. For core melt sequences, the resulting hazard depends on -
the hmetioning of the containment and the systems provided to cool and control the fluids in the containment space.
1 Not all core melt accident sequences create actualpublic bazards. We now know that about 407o of the reactor core at Three Mile Island was melted during the accident in 1979, but the radiation hazard to the public from that accident was negligibly small, ne successful functioning of the containment and the resumption of cooling after 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> kept the radioactivity released from f harming the public and the emironment, ne effect of the degradation of the steam generator tubes at Trojan on the probability and consequenecs of core melt events is small. Any effect would be on the probability of tube rupture or leakage, either as an initiating event or as a possible consequence of a steam pipe j break sequence. In section 4.4.2, above, I rtcommend using a tube leakage rate based on the-
] NRC analysis,'which is much larger than the Westingbouse value, for evaluating steam pipe break events. However, the calculated core melt pmbability for such events is satisfactorily low, in my opinion. .
For main steam pipe break event sequences involving high tube leakage rates, the ability of the . ,
operating staff to replenish the refueling water storage tank if needed might be critical to I preventing core melt. PGE procedures identify some other potential on-site sources of borated water that roughly double the 400,000 gallon capacity of the refueling water storage tank.
l l
L h
Greater attention should be paid, in my opinion, and plans developed, for ways to replenish the I refueling water storage tank if it tums out to be needed. There is plenty of time a.nd plenty of
- water; what is needed is a source of boric a
- Id, a place to mix it, and a way to get the solution I into the tank. His does not seem too difficult to me.
I 4.5.2 Events that do not Melt tht,Qgg i Event sequences that do not melt the reactor core can still result in the release of radioactive mr.terials. The potential sources of sbch releases are: (1) ne water and steam initially in the secondary system, some fraction of'which escapes immediately. His fluid has very small l radioactivity content. (2) The primary cooling water, flowing through the tube leak into the steam generator and thence out the steam brtak. His fluid has a larger radioactivity content during normal operation. (3) If the core melts, a much larger amount of radioactivity is released
- l. into the primary system, from where it can leak into the secondary system and escape out the steam break. The radioactivity released depends on how much fluid is released and how large its radioactivity content is. The hazard depends on how much is released, the pathways to people l and the environment, and the protective steps taken.
g For steam pipe break event sequences that do not involve core melting, any significant p
- radioactivity release will originate in the release of primary system coolant through any tube leakage path into the secondary system and out the break or stuck-open steam safety valve.
g Westinghouse gives an analysis of the relationship between the tube leakage rate in a steam pipe B break event and the calculated radiation dose to a person located at the plant site boundary. The Westinghouse calculation is reported to give 30 rem to such a person's thyroid for a leakage rate g of 100 gallons per minute." My evaluation in section 4.4.2 concludes that analysis of steam pipe break accidents should make allowance for tube leakage or rupture much larger than the Westinghouse analysis. Tbc NRC "best estimate" leakage rate is 145 gallons per minute; I g recommend also considering 600 gallons per minute, which is typical of one tube rupturing. For.
my suggested assumed leakage rate of 600 gallons per minute, the applying the Westinghouse calculation would give 180 rem.
I I recommend that the operating limit on allowable radioactivity in the primary cooling water be lowered accordingly, to limit the calculated dose for such an event. In plants where the primary coolant radioactivity is high during operation, its principal cource is minute failures in the metal l cladding on the fuel, allowing the radioactive gases generated in the fuel during op: ration to leak into the cooling water. The fuel in Trojan the past few years has had little such leakage. I f believe that the tighter limit I am proposing would not limit Trojan operation significantly.
I " Westinghouse, WCAP-13129, Revision 1, December 1991, page 9-7.
15
g ,
5 UncertMnties and Marrim~
I n
Dere are many uncertainties in any analysis ofimprobable accidents, such as the ones discussed in this report. %e use of available data, often sparse, and calculated plant responses and even pmbabilities results in known and unknown enors in ibe calculated results. Applying such results to safety analysis should include allowance for such uncertainties.
Both PGE (with Westinghouse) and the NRC have added margins for uncertainties in, for example, the Interim Plugging Criteria and the assumed tube leakage rate in steam pipe o ' reak events.
18 I have recommended an additional margin in the assumed leakage rate, leading to a reduced allowable primary coolant radioactivity during operation. In addition, I have recommended an additional " margin" of a different kind in recommending development of provisions for replenishing the supply of borated water, if it were ever to be'needed.
4 In addition to the uncertainties in all accident analysis, there are substantial uncertainties in the j detection, measurement and prediction of flaws in steam g':nerator tubes like the ones found at i g
Trojan. The birtory of the discovery, measurement and analysis of the actual flaws at Trojan 5 and how our present understanding developed with time, illustrates my point. Te Westinghouse l
analysis shows a wide scatter of the available data." These uncertainties appear to be a good '
part of the basis of Dr. Hopenfeld's and Mr. Muscara's difficulties with the present NRC position.
I believe that the Trojan flaws are not very wc!! characterized, and that there are substantial uncertainties in the current Westinghouse analysis. To this extent, I agree with Dr. Hopenfeld and Mr. Muscara. However, PGE and the NRC have recognized this, and have provided large margins, particulatly in the flaw size for which repair-plugging or sleeving the tube--is required. The high burst strengths measured in corroded tubes removed from Trojan are a principal source of the margin provided in the Trojan interim plugging criteria. My recommended " margins" in assumed leakage rate, operating limit on prirnary coolant radioactivity, and provisions for replenishing the refueling water storage tank, are in addition to PGE's and the NRCs margins.,
I f
I i
2 hI Westingbouse, WCAP-13129, Revision 1, December 1991, Figures 5-2,5-11, and 6-7; other examples are proprietary.
h 16 I
'