ML20134G985
| ML20134G985 | |
| Person / Time | |
|---|---|
| Site: | 07001113 |
| Issue date: | 01/28/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML20134G929 | List: |
| References | |
| 70-1113-96-12, NUDOCS 9702110108 | |
| Download: ML20134G985 (24) | |
Text
.
U. S. NUCLEAR REGULATORY COMMISSION REGION II Docket No.:
70 1113 License No.:
SNM 1097 Report No.:
70-1113/96 12 Licensee:
General Electric Company Facility:
Nuclear Energy Production Location:
Wilmington, North Carolina Dates:
December 4 8, 1996-Inspectors:
E. McAlpine. Team Leader D. Ayres, Senior Radiation Specialist D. Stout, Chemical Engineer G. Smith, Chemical Engineer C. Tripp, Nuclear Criticality Safety Engineer Approved by:
Bruce S. Mallett, Director Division of Nuclea:' Materials Safety Enclosure 9702117108 970128 PDR e* DOCK 07001113 C
PDR l
e TABLE OF CONTENTS 1~
1 j
I. EXECUTIVE
SUMMARY
1 i
i l
II. REPORT DETAILS 3
l i
1.
Purpose and Charter of the Special Inspection Team 3
1 4
2.
System Description and Process History 3
3.
Event Summary and Sequence of Events 5
4.
Precursor Events 5
)
5.
Analysis of the As-Found Condition 7
6.
Potential for Greater Accumulation 8
7.
Worst Case Safety Margin.....................
10 j
8.
Root Cause Investigation.....................
12 9.
Adequacy of Safety Control s....................
14 10.
Licensee Response to the Event 17 III. EXIT MEETING............................
22
..=
o j
l J
I. EXECUTIVE
SUMMARY
On November 30, 1996, the failure of the Line 3 calciner tube caused the shutdown of uranium powder production at the General Electric Nuclear Energy
]
Production facility. The affected equipment was cooled for disassembly in i
preparation for repairs to begin. When disassembly began on December 3,1996, an accumulation of special nuclear material was discovered outside its favorable geometry containment. The quantity of material found was in excess of the amount used in the analyzed criticality safety basis of the operation.
The NRC special inspection team concluded that precursors to the event could have alerted the licensee to the deteriorating condition of the calciner tube.
)
Levels of air activity from the calciner exhaust system were above action levels weeks before the total failure of the tube occurred. The licensee's stack sampling program was to have caused the notification of responsible personnel if stack samples exceeded these action levels, but no such notification took place.
The criticality controls in place for the calciner process included the geometry of the calciner tube, and the control of mass in the annular space outside the calciner tube. Both of these controls were defeated with a single event. The fracture of the tube itself is considered a loss of geometry i
control. The accumulation of material in the annulus in excess of the analyzed amount in the criticality safety basis is considered a loss of the combined mass / geometry control for the annular space in the calciner.
4 The NRC team concluded that the root cause for the loss of the geometry control (i.e. the calciner tube fracture itself) was primarily due to the lack of a formal preventive maintenance program for rolled Inconel tubes. The team e
concluded that the root causes for the loss of the combined geometry / mass control failure are the inadequate design of the Active Engineered Control, and the inadequate analysis and control of the design changes made to the system.
Although both criticality controls were defeated with this single event, the calculations performed by the licensee and the NRC inspection team show that i
there was a wide margin of safety in the as found condition, provided that internal moderation is minimal. However, the criticality controls credited to the system in the analyzed criticality safety basis were not the reasons why the system remained subcritical.
The system remained subcritical due to the limited total amount of material involved (in the tube and the annulus) and the lack of neutron moderators in and around the system.
Upon further review, the inspection team concluded that the potential existed for the accumulation of material quantities of up to about 6 times the as-found condition.
The licensee's responsiveness in reporting and reacting to the event was adequate for the scope of the problem. The operators within the control room and on the production floor responded quickly and appropriately based on the information available to them.
2 The set of short term corrective actions developed by the licensee adequately addressed the causal factors of the event by improving the monitoring, control, and robustness of the calcining operation. The long term corrective actions (once fully implemented) were adequate to provide improved reliability of the criticality safety program for the calciner systems.
3 II. REPORT DETAILS 1.
Purpose and Charter of the Special Inspection Team This special team inspection was conducted to evaluate the safety significance of an event which resulted in the loss of certain criticality safety controls in the uranium powder product line on November 30, 1996. The NRC was notified of the event on December 3, 1996, when an accumulation of material in excess of the analyzed nuclear t
criticality safety basis was discovered outside of the favorable geometry process equipment. The special inspection team was established on December 4, 1996. The team was chartered to gather information and make appropriate findings and conclusions by focusing on the following j
areas.
Determining the safety margin remaining in the as-found condition.
Evaluating the potential for the accumulation of U-235 material in I
excess of the as found condition.
Determining the adequacy of the criticality controls in place for i
the affected process line and the generic implications for the other processing lines with similar equipment and engineered j
safety controls, l
l Determining the root causes for the loss of safety controls, and j
Evaluating the adequacy of the licensee's response.
2.
System Descriotion and Process History The General Electric Nuclear Energy Production facility uses six (6) rotary calciners as part of its operation to produce uranium oxide powder. The calciners consist of a rotating nickel alloy tube inside a cylindrical, refractory lined heating chamber. The calciner tubes have a nominal inside diameter of 10 inches and are 26 feet long. A 7 inch thick annular space exists inside each calciner between the tube and the heating chamber. A set of agitator flight inserts are placed in each calciner tube to assist the flow of product through the system.
Five of the calciners in this product line can convert ammonium diuranate (ADU) to uranium oxide by heating it to about 750 C (1382 F).
The ADU is injected as a paste through a wand inserted 3 feet into one end of the tube.
Conversion to uranium oxide occurs as the material moves down the inside of the rotating, heated tube while reacting with steam and hydrogen from dissociated ammonia. The sixth calciner only processes recycled uranium oxide powders.
I 4
The annular space outside the tube is heated to the process temperature via combustion of natural gas. The natural gas combustion products are exhausted through a ventilation duct to an outdoor stack that is sampled i
for radioactivity. Calciner units 1 through 4 have their own exhaust stacks, while units 5 and 6 share a stack.
The operational history of the calciners is such that failures of calciner tubes occasionally occur.
These failures involve the L
circumferential fracturing of the tube at the )oint where ADU paste is injected, presumably due to stresses created w1en the cool paste contacted the heated tube. The fractures were normally smooth, complete breaks such that the discharge (non drive) end of the tube would stop rotating even though the feed (drive) end of the tube continued turning.
Based on this failure mechanism, a switch was placed on the discharge end of the tube to detect the stoppage of rotation, and thus a possible tube failure.
Over time, failures were frequent enough that the licensee developed an informal tube replacement schedule based on the total amount of ADU it had processed. The failure rate for the original tubes were established i
such that they were " flip)ed" after approximately 340,000 kilograms (kg) of accumulated ADU throug1put in order to inject the feed into the end of the tube that had not experienced the thermal stresses. Once a
" flipped" tube had reached the prescribed accumulated throughput, it was I
removed from service and replaced with a new tube.
The licensee also contemplated improving the strength of the tubes.
Records of the manufacture of the calciner tubes showed that the original design specified the construction material to be casted T 63 alloy (35% Ni, 35% Fe, 27% Cr, 0.5% C).
In 1987 a design specification change was investigated by installing a prototype tube made from rolled and welded Inconel 600 (75% Ni, 9% Fe,16% Cr, 0.07% C).
In order to relieve stresses in the rolled tube created during fabrication, the manufacturer suggested a final annealing step at an elevated temperature which was subsequently performed. The prototype tube was used in the line 3 calciner for five years without failure or "fli) ping" with an accumulated ADV throughput of more than 922,000 kg. T1e prototype tube was removed from service for further evaluation, but it had performed so well that several more rolled and welded Inconel tubes were purchased for use in the calciners. However, the original fabricator's suggestion concerning a final annealing step was disregarded for these additional rolled tubes.
The non annealed rolled tubes were gradually placed in calciner units 3 (1992), 5 (1994), and 1 (1996). Although no re31acement schedule had been determined for rolled tubes, the rolled tu>e in unit 3 was replaced with another rolled tube in 1994 after an accumulated ADU throughput of 541,000 kg. The original prototype was returned to service in calciner unit 4 in 1995.
5 3.
Event Summary and Seauence of Events At approximately 11:50 a.m. on November 30, 1996, the calciner Wet End (feed end) Operator notified the ADU control room o)erator that smoke was filling the calciner area and had the smell of aurning grease. The operator at the discharge end of the calciner noticed an unusual, erratic tube rotation. At 12:00 noon, the ADU feed tube was removed from the Line 3 calciner to stop the introduction of uranium into the system. At 1:00 p.m., the Line 3 calciner was shut down and began cooling.
At 9:00 a.m. on December 3,1996, the calciner had cooled enough to remove the top of its refractory-lined shell. A significant accumulation was observed within the annular space between the calciner tube and the bottom refractory. The material was collected and found to be 38.77 kg of uranium oxide enriched to 4.9% uranium 235. The material was removed and placed into criticality safe storage containers. The licensee subsequently reported to the NRC Operations Center within four hours and by 5:45 p.m., all ADU lines were shutdown pending a system-wide investigation.
The tube failure on November 30, 1996, in calciner unit 3 occurred after an accumulated throughput of 569,000 kg ADU. This was the first failure experienced with a rolled Inconel tube.
i 4.
Precursor Events a.
Inspection Scope The NRC inspection team assembled at the licensee's plant site on December 5, 1997.
In order to understand the conditions at the facility, the team reviewed the secuence of events, including the available precursory indicators anc the licensee's responses to them.
b.
Observations and Findings l
According to the licensee's records, the initial indicator that suggested a breach of the calciner tube integrity was the occurrence of elevated and gradually increasing radioactivity measured in the ventilation exhaust for the Line 3 calciner. The calciner ventilation exhaust is sampigd weekly and has a concentration action limit of 3 x 10 C1/cc. These measurements were originally intended solely for emissions reporting and have not normally been used to detect calciner tube failures. The radioactivity in the Line 3 calciner exhaust exceeded the licensee's action limit based on samples taken as early as November 14, 1996.
Samples taken the following two weeks continued to exceed the action limit and the radioactivity concentration approximately doubled in magnitude with each sample.
The licensee's own 3rocedures require that an Action Level Investigation form 3e completed upon discovery of an elevated
j i
6 calciner exhaust stack sam)le. However, no such forms were initiated for any of the t1ree elevated weekly results associated with this event until it was reported to the NRC Operations Center on December 3, 1996.
The next potential indicator of a tube breakage was the presence of a small (approx, 1/2") piece of metal lodged in the Line 3 calciner product discharge rotary valve. This was discovered on November 20, 1996. The calciner was shut down in order to remove the lodged metal. The discharge end of the calciner was disassembled to visually inspect the internal structure of the i
calciner tube.
No damage to the internal structure of the tube was apparent from the discharge end of the calciner, and the decision was made to restart the calciner on November 22, 1996.
No obvious slip) age of the tube was visible during the restart of l
the calciner, t1us a broken tube was not evident.
c.
Conclusions The precursors to the event could have alerted the licensee to the deteriorating condition of the calciner tube. The licensee's documented stack sampling program and license SNM 1097 both state that personnel responsible for the operation of the exhaust system 3 x 10'jfied if a weekly stack sample exceeds a value of are not pC1/cc. The failure to issue an Action Level Investigation Form upon the discovery of an elevated calciner i
exhaust stack sample violated the licensee's Environmental Protection Instruction No. 0-f,.0 and is a violation of the i
requirements of Chapter 5. Section 5.1, subsection 5.1.1.
Paragraph 5.1.1.2 of the SNM 1097 license application.
- However, this violation will not be subject to enforcement action because the licensee's efforts in identifying and correcting the violation meet the criteria specified in Section VII.B of the NRC Enforcement Policy. This problem is thus noted as a Non Cited Violation (NCV).
5.
Analysis of the As Found Condition a.
Scope The criticality safety margin of the as found condition of the material in calciner 3 was to be determined by the inspection team. This margin was defined in the team charter as the difference between the actual conditions and the condition necessary to reach criticality. This determination involved review of licensee's calculations and NRC inspection team members independently >erforming criticality safety calculations. This provided a metlod to verify that the geometry and material compositions in the calculations were correct and that the results were reproducible.
9 7
b.
Observations and Findings The licensee's nuclear criticality safety staff ran a number of i
Keno calculations immediately after the tube rupture to determine the margin of safety. The licensee's model assumed that the calciner tube and firebox were concentric cylin<iers composed of Inconel-600 and Oak Ridge concrete respectiv'.,,.
For conservatism i
in the Keno calculations, the calciner tube was assumed to be half filled with U 0 along its entire length, and the annulus between the calciner, tube and firebox was half filled with Up 3
powder. Calculations were performed such that the material in annulus was assumed to either run the entire length of the calciner or occupy a section four feet in length. The dimensions used in the calculations were found to correspond to the drawing dimensions for the calciner tube and firebox, with some increase for dimensional tolerances and an allowance for corrosion.
Several models were run corresponding to different degrees of moderator in the two regions and different reflection conditions.
The geometry and material compositions used in the model were verified by the inspection team.
The calculations in which the deposit ran the whole 24' length of the firebox resulted in only a slightly greater k,{ as the y
calculations where the deposit occupied a four-foo length. The as-found condition was modelled as U 0 with 5% moisture in the
~
calciner tube and dry U 0, the full len,gth of the firebox, with 3
I 3
vacuum boundary conditions. This resulted in a L,, of 0.66.
It should be noted this model represents an extremely conservative l
calculation of the as-found geometry: the calciner tube is normally filled to a depth of 12" and the half-filled firebox represents a maximum credible accumulation. The as found depth of material in the firebox was approximately to the bottom of the 4
calciner tube, i
The NRC inspection team also performed independent Keno calculations to verify the results of the licensee's calculations.
This independent calculation included constructing a more detailed geometrical model of the calciner and firebox as well as a less a
conservative and more realistic configuration of fissile material.
i A geometrical model which explicitly showed the internal structure
~
of the calciner/ firebox assembly was constructed for the independent verification, to determine whether the licensee's calculation was conservative. This more detailed model added an Inconel flange on either side of the calciner tube and included the two internal firebox baffles, or collars of smaller radius that separate the firebox into three sections. These additional
=-
il 8
features were found to have negligible effect on the results. The
'naximum credible accumulation was assumed in this model to involve filling the annulus to the half way point in the first of three sections, between the aperture to the firebox and the first baffle.
The inspection team attempted to model the as found condition as realistically as possible. The assumed composition was U 0 with 3
5%moistureinsidethecalcinertube(correspondingto50,000 ppm i
as an upper bound on the as found moisture content) and dry U 0 outside the tube. Thecalcinertubewasfilledtoadepthofd" 3
and the annulus filled to a depth of 6%" so that the uranium just reached the bottom of the calciner tube, along the length of the first firebox section. This resulted in a L of 0.50. This lower value is indicative of the conservatism found in the licensee's calculations.
i c.
Conclusions The calculations wrformed by the licensee and the NRC inspection team shows that t1ere is a wide margin of safety in the as found condition. The geometry used by the licensee was found to be j
correct, reproducible, and the model conservative.
1 6.
Potential for Greater Accumulation a.
Scope i
The inspection team reviewed licensee equipment drawings and process parameter specifications to evaluate the potential for accumulation of material in excess of the as found condition. The inspection team also estimated the maximum possible accumulation of material in the unfavorable geometry configuration.
b.
Observations and Findings In order to evaluate the potential for an accumulation of U 235 material in excess of the as found condition and to estimate the maximum accumulation of material possible within the calciner shell, the NRC inspection team reviewed operating procedures, equi ment specifications, and drawings. The internal dimensions of tie calciner refractory lined shell was found to be a 24" diameter cylinder, 20 feet long, installed at a slope of 1.5 from horizontal. The licensee indicated that the approximate bulk density of the discharged product from the calciner is 2 g/cc.
Since air activity data was not used by the licensee to determine a breach in tube integrity, elevated air activity was not considered in determining a maximum accumulation potential for past events. Also, since the tube began leaking material 2 3 weeks before its catastrophic failure, yet held together enough to continue to operate the tube rotation switch, the Active
9 Engineered Control was found to be unreliable and was not used by the inspection team in determining the maximum accumulation potential.
c.
Conclusions Based on the event sequence, the process operating procedures and Active Engineered Controls in place at the time of the event, the process equipment configuration, and the product material properties, it can be concluded that the potential existed for the accumulation of U 235 in excess of the as found condition.
As an extreme case, material could have continued to slowly accumulate in the annulus until the fracture in the tube was effectively blocked by the accumulation.
The fracture could not be totally blocked until the annulus was nearly full of material, corresponding to an accumulation of over 1500 kg of material.
However, abnormal operating conditions (pressures and temperatures) within the calciner, product quality fluctuations, and deviations in material balances would likely be evident long before such an accumulation would occur.
A more reasonable scenario would involve an accumulation in the annulus underneath and u) to the bottom of the calciner tube and axially extending from t1e ADV injection point to the first baffle in the refractory. This would correspond to an accumulation amount of 230 kg of material, or about six times the amount in the as-found condition.
7.
Wy st Case Safety Marain a.
Scope Once the potential for a larger accumulation of material was deemed plausible, the inspection team focused on the criticality safety margin associated with a worst case scenario. This included reviewing calculations performed by the licensee's staff for a worst case scenario, verifying that the results used by the licensee's staff were reproducible, and that the models were conservative.
The inspection team performed several different independent calculations to verify the conservatism of the licensee's calculations. This review involved performing calculations while varying the moisture content, geometry, reflection conditions, material compositions (of both the calciner/ firebox and the uranium deposit). The results of these independent NRC calculations were compared to the results of the licensee's calculatior,s for the most reactive credible configuration.
10 b.
Observations and Findings The licensee attempted to model the worst case condition by assuming optimal moderation inside the calciner tube (assumed to be 25 w/o moisture) and 5 w/o moisture outside. When the licensee assumed that a four foot section of the firebox was filled with U 0,2.and vacuum boundary conditions existed, k,, was found to be 30.9 When the entire length of the firebox was assumed to be filled, k, was 0.96. When a four-foot section was assumed to be filled and the system assumed to be under full water reflection, k,, was found to be 0.94.
Full water reflection was imposed to ensure the calculational model accounted for all reflective and moderating materials outside the firebox.
The inspection team's calculations assumed the same geometry as was used for its as found condition calculations. The composition of the fissile material was assumed }o be a homogeneous mixture of water and U 0 with a 5% U 5 enrichment.
38 The density of the material was calculated assuming the theoretical densities of water and U 0. The ammonium diuranate a bu,lk d,)ensity of 2.5 g/cm.2) feed material was assumed lo (U0(NH Several iterations were performed with various moisture contents and geometrical configurations.
During normal operating conditions, where the moisture content is essentially zero and there is no tube breakage. the value for k,,
was found to be less than 0.27.
Since the calciner operates at 750 C and the ADU feed rate is 60 kg/hr, the ammonium diuranate dries almost instantaneously, reacts to form U 0,, and then 3
reduces to U0. The calciner takes several days to cool to 2
sufficient temperature to remove the top of the firebox, so that significant loss of moderation control is nearly incredible. When only geometry control is lost, the system was still found to have a value for &, filling both the calciner tube and the firebox assumptions o/ of less than 0.6, despite the conservative hal fway. Thus the system has a wide margin of safety when the moderation is minimal.
The inspection team modelled the effect of moderation by continuously varying the moisture content of the system. The licensee's assumption of optimum moderation at 25 w/o moisture was found to be valid. At optimally moderated conditions, ~k,, for a fora half-filled calciner tube was found to be 0.60 and k,ius was completely filled tube was found to be 0.90. The annu assumed to have a moisture content of only 5 w/o in these models.
The occurrence of this amount of moderator is unlikely; a U 0 H 0 38 2 mixture that contains 5% moisture by weight would equate to an accumulation of water of over 71 liters. The system was found to exceed a k,, value of 0.90 only when the moisture content of the systemisbetween10w/oand55w/o. This stresses that system
~
reactivity is sensitive to moisture content.
Clearly, in the high temperature environment of an operating calciner, this amount of i
11 moisture is unlikely. However, a calciner that has been shut down J
and cooled with its shell removed may be susceptible to higher moisture levels.
It should also be noted that the area external
]
to the firebox is maintained as a moderation control area.
In addition to testing the sensitivity of moisture content of the system to criticality safety, the composition of various fissile and structural materials were varied to determine the conservatism of the materials used in the calculations.
Various different l
Inconel compounds were substituted for Inconel 600 from the SCALE standard materials library, which differed primarily in the amount of nickel, iron, and chromium they contained. This made a difference in the results of no more than 2 percent. Several i
different standard concrete compositions were substituted for the Oak Ridge concrete and a similar dependence was found. The 4
difference between filling the calciner tube and annulus with U 0, i
3 was negligible.
If the calciner tube is assumed to be or U0,d with ammonium diuranate, the results are larger to the fille order of several percent; however, the normal high temwrature i
environment precludes the existence of ADU except at t1e extreme feed end.
Finally, the variations in the internal agitator flights and the feed tube assemblies were modelled by replacing them with cylinders composed of Inconel-600 and stainless steel, respectively, of equivalent masses. This was found to result in a slight overall reduction in k,, upon displacement of the fissile material. Thegeometricmodle was thus found to be conservative and the addition of structural material inside the tube is not expected to increase the overall A,,.
c.
Conclusions The licensee's calculations were verified independently by modelling the same composition of uranium and moderator mixture as the licensee. The geometry and material compositions of uranium and structural materials used in the problem were found to be conservative, with a wide margin of safety provided that internal moderation is minimal. The licensee's assumption of optimal moderation was found to be valid and conservative.
8.
Root Cause Investiaation a.
Scope The NRC inspection team investigated the root causes for the loss of criticality safety controls. The team observed equipment damage resulting from the tube failure. The team reviewed licensee policies for change control. The team discussed with the licensee the formulation of the calculated criticality safety
^
e.
12 basis for the calcicer operations.
The team also reviewed the licensee's Taproot investigation of the causal factors of the event.
b.
Observations and Findings The team observed the tube which had been removed from calciner unit 3 and found the break to be an irregular, jagged, cog like fracture.
The team also observed photogra)hs and reviewed written descriptions of prior fractures of cast tu ms. These suggested that a much smoother break was associated with the failure of cast tubes. The team consulted with an NRC metallurgist and found that these two types of failures are consistent with the differences in properties of the cast and rolled tubes due to alloy composition and methods of fabrication. The lack of stress relief on the rolled Inconel tube purchased after the prototype was also found to be a likely contributing factor to the failure in unit 3.
Although the calciner rotational drive mechanism was at the feed end of the tube, the cog like " teeth" associated with the fracture of the rolled Inconel tube helped enable the discharge end of the tube to continue to rotate after the breakage occurred. This, in turn, helped to defeat the Active Engineered Control which was dependent upon the rotational switch at the discharge end of the calciner. This situation was not considered when the change in tube fabrication was evaluated.
The team observed an agitator flight which spans the length of each tube. These inserts are fabricated in sections which have structural support rings at each end. The inserts are normally installed by tack welding the sections together as they are being placed inside the tube. The agitator flight insert sections for the tube which fractured in calciner unit 3 were found to have been welded together with a continuous bead instead of tack welded. This made the structure of the tube inserts stronger than normal. The stronger internal structure of the tube could have helped the discharge end of the calciner tube to continue rotating after the breakage occurred. The licensee's Taproot investigation states that this welding technique had not been evaluated for its impact on equipment reliability.
c.
Conclusions The cause of the material accumulation in the annulus was the circumferent.al failure of the calciner tube at the point where relatively cool ADU paste is injected into the heated tube. The failure created a 3/8-1/2" wide gap in the tube wall around its entire circumference through which the spillage occurred.
13 The root causes for the loss of criticality safety controls stem from the tube failure itself and the material accumulation being greater than the analyzed criticality safety basis. The licensee's Taproot investigation listed three causal factors for the reported event.
1.
Failure of active engineered control to prevent accumulation of material in the annulus due to changes in the tube material and design indirectly impacting the integrity of the AEC.
2.
Inadecuate design control and preventive maintenance for rollec Inconel tubes.
3.
Delayed notification of the Line 3 calciner exhaust ventilation stack results.
Since calciner tubes are now known to break regardless of whether they are fabricated via a cast or rolled process, the loss of the geometry safety control can not be traced back to the tube's material of construction or method of fabrication.
Instead, the cause of the tube break can be derived from the way it was maintained while in use. An informal preventive maintenance program had been successfully implemented for the cast tubes. The i
NRC team concluded that the root cause for the calciner tube 1
fracture itself was primarily due to the lack of a formal preventive maintenance program for rolled Inconel tubes.
The root cause for the accumulation of material in excess of the analyzed safety basis is more complex. One cause of this safety system failure is due to the way the tube failure occurred. The unexpected mode of fracture and the strengthened tube inserts kept the discharge end of the tube rotating, even after the catastrophic failure of the tube. Thus, one root cause for this 4
failure is concluded to be the inadequate analysis and control of the design changes made to the system.
However, the loss of this second criticality control could have been prevented if the control had been better designed. The control in place relied upon the total breakage of the tube and the stoppage of its rotation at the discharge end. The tube rotation switch by itself did not and could not ensure that the material accumulation within the annulus of the calciner was limited to less than the analyzed safety basis. Chapter 4, Section 4.2, subsection 4.2.11 of the license application requires that, " Engineered controls detect an undesired situation and implement corrective action without requiring human intervention.
Engineered controls must be...ca)able of performing the criticality safety purpose for w1ich they are specified." Despite
.o 14 the above requirement, the engineered control did not detect the undesired situation and was not ca)able of performing its criticality safety purpose under t1e event scenario, and is thus a violation of the requirements of license SNM 1097.
9.
Adeauacy of Safety Controls a.
Inspection Scope The inspection team reviewed the criticality controls in place for the Line 3 calciner process to deduce their adequacy and the i
generic implications of this event for the otMr processing lines.
b.
Observations and Findings In addition to the calculated calciner criticality safety basis, the team reviewed the licensee's criticality design specifications and criticality safety requirements for operation. The team observed the o>eration of the Active Engineered Control (tube rotation switc1) on an empty calciner and observed the passive engineered control (tube geometry) for a typical calciner. The team also used the results of their review on the history of the manufacture and maintenance of calciner tubes to assess the adequacy of the licensee's criticality controls, and reviewed the licensee's evaluations performed as a result of previous tube fractures.
i The dual criticality controls for the calciner operation consisted of geometry control (based on the dimensions and integrity of the i
tubes) and a geometry / mass combination control based on limiting i
the amount of material in the annular space between the calciner tube and the refractory-lined shell.
At the time of the event, the operational and automatic engineered criticality safety requirements included the following:
material enrichment limits (5.00% on lines 3, 5, and 6:
4.025% on lines 1, 2, and 4);
termination of the uranium and steam inputs to the calciner upon tube rotation stoppage, low calciner temperature, or pluggage of the discharge end for over 90 minutes:
the control system was to automatically stop the steam flow if tube rotation stopped or if a low calciner temperature occurred (lines 3, 5, and 6 only), and automatically stop hydrolyzed uranyl fluoride (HUF) flow to the precipitation tank (line 3 only);
the calciner tube rotation timer switch was set to indicate tube rotation stoppage if the switch was not actuated at least once per 30 seconds.
1
i 15 The Active Engineered Control was observed to be mounted on the discharge end of the calciner adjacent to a rotating portion of the tube. A cam was observed to be welded on the rotating equipment such that when a revolution of the discharge end of the tube was completed, a rocker arm on the switch was actuated by the cam. The licensee informed the team that the actuation of the switch would reset the system's 30 second timer. The passive engineered control (tube geometry) was observed by inspection of l
new and used calciner tubes, with all tubes being of smooth bore and consistent diameter.
c.
Conclusions The criticality controls in place for the calciner process included the geometry of the calciner tube, and the control of mass in the annular space outside the calciner tube.
Both of i
these controls were defeated with a single event. The fracture of the tube itself is considered a loss of geometry control. The accumulation of material in the annulus in excess of the 25 kg (as analyzed in the criticality safety basis) is considered a loss of the combined mass / geometry control for the annular space in the calciner.
Even though both criticality controls were defeated with this single event, the safety margin in the as-found condition was adequate to ensure the system remained well into the subcritical range. However, the criticality controls credited to the system in the analyzed criticality safety basis are not the reasons why the system remained subcritical. The system remained subcritical due to the limited total amount of material involved (in the tube and the annulus) and the lack of neutron moderators in and around the system. This causes the following concerns to surface relating to the overall philosophy used to assure nuclear criticality safety:
The criticality safety basis was based on two controls that could be defeated by a single event.
The ahilosophy of double contingency requires at least two unli ceiv. independent, and concurrent changes in process conditions to occur before a criticality accident is possible. The history of tube failures in the calciners is such that this loss of geometry contn1 may not be unlikely, and thus may not be able to be credited toward the double contingency standard.
Chapter 4, Section 4.2, subsection 4.2.4. Paragraph 4.2.4.3 i
l of the license application states that, "Whenever l
criticality control is directly dependent on the integrity i
of a structure used to retain the geometric form of a
}
fissile material accumulation...the structure shall be designed with an adequate strength factor to assure against
< e.
j 16 failure under foreseeable loads or accident conditions."
The design of the calciner tubes was adequate to assure against failure in some cases until they have been used for a certain length of time or for a certain amount of throughput.
In the case of the rolled tubes, however, the i
design was not adequate to assure against failure.
For example, the design did not include formal provisions in place to assure against failures. Since a failure could occur and was known to occur under foreseeable loads or accident conditions, and no formal provisions were in place f
to detect and prevent such failures, this is a violation of License SNM 1097, Chapter 4, Section 4.2, subsection 4.2.4, Paragraph 4.2.4.3 of the license application, 1
The control system (tube rotation switch) was designed to automatically stop hydrolyzed uranyl fluoride (HUF) flow to l
the precipitation tank for the Line 3 calciner upon loss of tube rotation or low calciner temwrature.
However, the output from the precipitation tanc consisted of the ADU l
which was fed into the calciner, and there were no automatic shut offs for this flow.
In order to limit the amount of l
material present in the calciner during a tube breakage, an
~
administrative control was implemented which involved an operator removing the ADU feed tube from the calciner.
Since this is an administrative control of mass in support of nuclear criticality safety, the provisions of license SNM 1097, Section 4.2.5 apply.
In particular, Paragraph 4.2.5.1 of license SNM 1097 states, "Wherecontrolofmassisusedtoprovidecriticality safety, the mass of uranium (or U ' or U 38) is 2
administratively controlled based on measurement by one or more of the following techniques:
e The mass of uranium (or U or U28) is 25 determined as }he product of the volume and the uranium (or U or U238) concentration as 23 measured by qualified counting methods.
35 238 e
The mass of uranium (or U or U ) is determined by qualified counting methods.
e The total mass or change in mass of a system is composition."
Since the mass within the calciner was under administrative control within the calciner, and mass control was one of the parameters used in the criticality safety basis, the mass within the calciner was subject to the requirements of
4 m
e l
17 1
License SNM 1097, Paragraph 4.2.5.1.
The required measurements were not being performed and this is a violation of Chapter 4 Section 4.2. subsection 4.2.5, Paragraph 4.2.5.1 of License SNM 1097.
10.
Licensee Response to the Event a.
Scope The inspection team evaluated the adequacy of the licensee's actions during and following the event, including their response to the event and corrective actions implemented. The team reviewed the information available to the licensee to use as future indicators of a tube failure, the timeliness of reporting to the NRC, and the licensee's response to criticality and radiological safety issues.
b.
Observations and Findings The team reviewed documentation of the event and found that the licensee notified NRC within the four hour time limit after discovery of the reportable condition and clearly stated the facts of the situation. The inspection team also found that the licensee clearly understood the magnitude of the situation and responded with the proper amount of management involvement.
Team members interviewed the control room operators that were on 1
duty at the time of the event and found that operations personnel reacted quickly to the report of smoke in the area, found the problem unit, and shut it down.
It was also found that the licensee assembled investigatory teams promptly with a mixture of technical expertise in order to fully analyze the event.
The team was )rovided with a set of licensee corrective actions in response to t1e event. The team thoroughly discussed the short term and long term corrective actions with licensee management.
The short term corrective actions identified were:
Tighten the tolerance of the timing on the calciner tube rotation indicator switch. The timer setting at the time of the event was nearly twice the tube rotation time. The tightening of the timer tolerance would effectively shut down the calciner if the tube rotation time was more than 2 seconds beyond the normal value. This would help limit the accumulation of material in the annulus in situations where the discharge end of a broken tube continues to turn erratically due to support from the tube's agitator flight.
Automate the valving of the ADU paste feed pum) so that the 1
administrative control of removing the feed tu>e is not necessary for stopping ADU feed into the calciner. This 3-way valve was manually operated to either allow ADU paste
e..
18 flow to the calciner or to recirculate the ADU paste in the ADU feed ho>per. Automating the valve would cause it to switch to t1e recirculation mode upon indication of tube rotation stoppage.
Implement a control system program change to correct weaknesses in the calciner stack monitoring and reporting system. This would include a arogram change that requires calciner stack information to >e input within a certain time frame.
If stack results were not entered into the system at a prascribed frequency, the calciners would be automatically shut down.
If stack results were above a prescribed limit, an Action Level Investigation would be automatically produced. These programming changes would require this readily available indicator to be used to detect calciner tubes in the process of failing.
Evaluate and formalize a Preventive Maintenance program for cast and rolled calciner tubes. This program would formalize an accumulated throughput level at which a calciner tube would be " flipped" or replaced.
The long term corrective actions that were proposed by the licensee were also reviewed by the inspection team and discussed with licensee management. They included:
Revising the Criticality Safety Analysis for the calciner operation in order to improve on the existing neutronic model of the postulated " tube break" accident condition.
This corrective action would analyze the accident condition beyond the 25 kilogram accumulation postulated in the previous analysis. This corrective action would also evaluate adding a new, independent mass / moderation parameter control to the existing basis for safety.
Revising the vendor specification for Inconel-600 rolled alloy calciner tubes to include annealing (stress relieving) of rolled and welded tube. This would likely improve the strength and lengthen the service life of calciner tubes.
Revising the licensee's change control process to emphasize the impacts of material property changes of process equipment. This would be followed by sensitivity training to all fuel manufacturing process engineers.
Evaluating new technology to determine mass accumulation inside the calciner annulus. Gamma scanning techniques are being considered, but their applicability is uncertain.
In order to verify its usefulness as an indicator of material accumulation in the calciner annulus, the inspectors constructed a mathematical model to deduce the mass of material as a function of
t a
19 the calciner stack radioactivity data. This model assumed that t
the measured stack activity was directly 3roportional to the surface area of the uranium deposit and tie total air flow, allowing an extrapolation of mass at the times of the previous stack samples.
l The uranium was assumed to be in the form of UO with a density of 2
2 g/cc. The shape of the uranium deposit was assumed to be a normal distribution in the transverse and axial directions. The standard deviation in the transverse direction was taken as the radius of the calciner tube and the standard deviation in the axial direction was taken as one foot. The uncertainties in the actual density of the U0 and the distribution shape dominated the 2
model systematics.
The surface area of the deposit in the annulus was computed numerically, and the volume was multiplied by the density to obtain the total mass for different sized distributions. This resulted in a surface area vs. mass curve that was related to tne stack emissions by using the surface area corresponding to the as-found mass. The mass corresponding to the previous three stack emissions was estimated using this curve. The results shown below give the extrapolated accumulated mass for each of the three previous weeks.
Sample Stack Activi Surface Estimated (yCi/cc x 10'}y)
Date Area (cm )
Mass (kg) 11/27/96 18.90 4600 38.77 11/21/96 7.40 1801 1.25 11/14/96 3.40 828 0.375 11/7/96 0.43 105 0.1 When the short term corrective actions had been initiated, ins)ection team members observed functional testing of the meclanical and electronic improvements. Team members then observed training of operators on the new procedural requirements stemming from these corrective actions.
c.
Conclusions The licensee's responsiveness in reporting and reacting to the event was adequate for the scope of the problem. The operators within the control room and on the production floor responded quickly and appropriately based on the information available to them.
~ _ _ _
a
~.
20 The set of short term corrective actions adequately addressed the i
causal factors of the event by improving the monitoring, control, and robustness cf the calcining operation. The tighter tolerance on the calciner tube rotational switch would tend to detect nearly any slippage of the tube rotation. The improvements in the calciner exhaust stack monitoring system would help provide early indication of material leakage into the annulus. The areventive i
maintenance should help minimize the occurrences of tu>e i
i fractures.
i The long term corrective actions (once fully implemented) appear adequate to provide improved reliability of the criticality safety program for the calciner systems. The revising of the Criticality i
Safety Analysis should provide a more realistic representation of the actual system parameters in ) lace for preventing a criticality accident. The revising of the c1ange control process would provide more insight into the many faceted considerations which must be reviewed as part of any change to a system with nuclear safety concerns.
I From the air activity vs. material accumulation model, it was concluded that stack sampling data could be used as an early warning of impending tube rupture for this mode of failure.
Based on limited data, such improvements in reaction to air sampling data could result in detection about two weeks prior to complete tube failure.
However the frequency of the stack sampling (weekly) makes it difficult to affirm that a large accumulation would not occur between samples.
a 4
4 21 III. EXIT MEETING The team leader presented the inspection results to licensee representatives by phone on January 24, 1997, and summarized the purpose of the team inspection, the inspection team charter, the inspection findings, and the three violations listed in the NOV.
The licensee had no dissention to the NOV. The licensee did not indicate that the report would be considered proprietary.
r r
6
a...
l i
1 ATTACHMENT 1 PARTIAL LIST OF PERSONS CONTACTED Licensee C. Kipp, General Manager
- J. Kline, Manager, Chemical Product Line
- L. Paulson, Manager, Nuclear Safety i
- S. Murray, Team Leader. Chemical Conversion i
- R. Reda, Manager, Licensing l
- C. Monetta, Manager, Environmental Health and Safety l
T. Hauser, Manager, Quality Assurance l
- Denotes personnel present at the exit briefing conducted by phone on January 24, 1997.
i NRC N. Economos Inspector Division of Reactor Projects, Region II INSPECTION PROCEDURES USED IP 88020 Operations Review l
ITEMS OPENED. CLOSED. AND DISCUSSED t
Opened i
70 1113/9612 01 Violation Failure of an engineered control being capable of performing its specified criticality safety purpose.
70-1113/9612 02 Violation - Failure to provide assurance of the strength of a structure upon which criticality control is directly dependent.
70 1113/9612 03 Violation - Failure to perform required measurement techniques when administratively controlling mass for criticality safety purposes.
LIST OF ACRONYMS USED ADV ammonium diuranate i
AEC Active Engineered Control cm centimeter j
g/cc grams per cubic centimeter l
GE General Electric HUF hydrolyzed uranyl fluoride kg kilograms l
NCV Non-Cited Violation l
NOV Notice of Violation PDR Public Document Room pCi/c:.
microcuries per cubic centimeter
-