TL: AGEING IN NUCLEAR POWER PLANTS - EXECUTIVE SUMMARY SO: Greenpeace International (GP) DT: April 18, 1996 Keywords: environment nuclear power ukraine republics accidents problems chernobyl / The report has been written by Norbert Meyer, with the assistance of Detlef Rieck and Ilse Tweer, in February 1996. The report is commissioned by Greenpeace Germany, under the supervision of Helmut Hirsch and published as CHERNOBYL PAPER No.5 by Greenpeace International in April 1996. Old - older - out of control? The longer nuclear power plants are in operation, the greater the hazard they pose Contents Foreword Introduction Old - older - out of control? Age and safety in nuclear power plants How old may a nuclear power plant be? Neutron irradiation, a hardness test for all materials Reactor vessel a critical point Complicated monitoring A brittle fracture becomes a nuclear emergency Other countries, other notions of safety Austenitic components no guarantee of safety Vessel closure head a weak point Cracks with disastrous consequences Defective closure heads a problem that already exists Countermeasures no guarantee of safety First the accident and then the discussion? Abridged version of the study, Ageing in Nuclear Power Plants, by Norbert Meyer, made in collaboration with Detlef Rieck and Ilse Tweer (February 1996). Foreword Nuclear power plants are gaining on in years, both in the East and the West. Public discussion since the Chernobyl accident, insofar as it has been conducted at all, has been concerned mainly with the hazards of 'eastern reactors'. World - wide experience has shown that problems and signs of ageing occur not only in reactors in what was the Soviet Union. The plants in industrialised countries in the West - in France, Sweden or Germany, for example - which supposedly having the highest safety standards, are not immune. The authors of this study have experience of both 'western' and 'eastern' reactors. Until 1990 two of them worked on the staff of the Greifswald nuclear power plant in what used to be East Germany. Their study shows that damage through ageing can begin to be hazardous long prior to the often cited forty years life of the reactors. The critical stage can be assumed to be reached, at the latest, after some 20 years of operation. But there is no guarantee that problems of ageing will not arise earlier. The study deals with selected problems with materials - the embrittlement of reactor pressure vessels, damage to austenitic pipes, and cracks in control rod penetrations in the pressure vessel head. In what is otherwise a very wide range of problems, the study thereby covers aspects of ageing of especial importance and current concern. Its deliberations here are anything but abstract. At Obrigheim and Stade, for example, the two oldest German nuclear power plants still in operation, there has for years been a risk of the reactor vessel splitting. If this happened there would be an uncontrollable accident with a large scale release of radioactivity. These plants can no longer be certified safe. But they remain on the grid. This shows both how unscrupulous nuclear power plant operators are, and how unprepared the supervisory authorities are to act to deal with problems of ageing. The problems of ageing are in part very complex and not easily apparent. But this does not make them any less dire. They demand action be urgently taken. If nuclear programmes go ahead according to plan, by the turn of the century about 200 nuclear power plants will have been in operation, worldwide, longer than 20 years. That is roughly half the world's nuclear power plants. The dangers from the ageing processes in nuclear power stations are such that the use of nuclear energy must be rapidly phased out. The old plants in the East and West, which are becoming more and more dangerous, must be shut down first. Helmut Hirsch Greenpeace April 1996. Introduction Old - older - out of control? The number of aged nuclear power plants will increase considerably in the near future. Worldwide, some 200 reactors with an operational life of over 20 years will be connected to the grid by the turn of the century. Half of these will be at least 25 years old. Some reactors have already operated for 30 years. Most of these are in Britain; one such being the reactor plant at Bradwell, fifty miles from London. The safety problems arising from the ageing of these power plants are today very much underestimated. Given the enormous risk posed by nuclear reactors, which, as could be seen with Chernobyl, is unlike that from plants using other technologies, great attention ought to be devoted to the ageing process. Unfortunately, the opposite is true, as instead of placing more stringent requirements on older nuclear power plants, safety is often cut back in order to enable operation to continue. Age and safety in nuclear power plants During its operation any industrial plant has to withstand strain and demands on it which can cause wear and tear. This process is barely often discernible externally, because changes first occur microscopically, inside a material's atomic lattice. The frequency of failure through defects in manufacturing, construction or design can be very high, especially in new plants. But these problems are usually brought under control by special checks and cautious operation in the initial phase of operation. The manufacturer, in addition accords the operator guarantee and warranty claims. Once the early phase has passed, the interval between inspections as a rule grows. The life of an industrial plant depends on many different factors, and cannot be predicted. Statistically speaking, the probability that parts of the plant fail increases in the late phase of operation. This can be averted by repairs or replacement of components. However it becomes problematic when a strictly inadmissible failure caused by ageing occurs. It would be logical for plants to be tested and examined morey often as they got older, but this is exactly what is not done. If the operator asserts his warranty claims in the initial phase he then has to pay for additional inspections in the late phase himself - and put up with the loss of profit during a shutdown. This of course runs counter to his economic interests. The above approach applies in the case of nuclear plants too, even though they could hardly be more complex or demanding. Enormous amounts of energy are released in the smallest of spaces. The materials in a reactor have to withstand an enormous temperature difference between the start-up and shutdown of a plant, as well as rapid changes in temperature in the event of a breakdown or accident. Internal pressure, dead weight, and processes of regulation and control cause high mechanical stress. In addition radioactivity interacts with the plant's materials, and the coolant has a corrosive effect. If several demands are made on a material at the same time (for example high mechanical stress on components damaged by radiation), it often reaches the limits of the stress it can bear very quickly, and cracks or fractures occur. How old may a nuclear power plant be? There are a number of different evaluations for how long an operating life of a reactor is. In some cases, even as long as 40 years has been suggested. This time-span is based on experience with technology for energy in general, not on specific technical aspects or grounds of safety. The USA, for example, assumes a life of 40 years, this being the typical amortisation period for conventional power stations. The desired life-span in France envisages some reactors being shutdown after 30 years and others after about 50 years. In Germany, no figure is officially laid down. If licensing requirements are made stricter as a result of new knowledge on points of safety, exceptions are generally made for nuclear power plants already in operation. What 'replacement measures' should apply to older reactors is not precisely stipulated, leaving scope for interpretation and differing policies. This leads to retrogressive steps in thinking on safety. Defects in reactor components, especially cracks, used to be frowned upon. Now economic constraints have been submitted to, and the 'leak-before-break' criterion introduced. In this philosophy it is no longer that important that a component has no cracks. What matters is the mathematical calculation proving that a crack can lead only to a leak and not to a total break and thus all the energy stored escaping - a very risky approach. National regulations on regular inspections of nuclear power plants also leave much to be desired. Efforts are made to ensure quality at the start-up of operation, with warm and cold tests and short monitoring cycles being carried out. Later, tours of inspection are made every four to six years. This rhythm is maintained until the end of the reactor's life, although the extent to which materials become damaged, and thus the likelihood of a failure of components, increases with age. Neutron irradiation, a hardness test for all materials In the years in which the use of nuclear energy was still becoming established, the consequences of the bombardment of materials by radiation was largely ignored. The physicist Eugen P. Wigner was in 1942 alone in pointing to possible damage from radiation by neutron flux. Neutron irradiation can create confusion in the well- ordered structure of materials. During a controlled nuclear chain reaction fast neutrons (electronically neutral elementary particles) are continually bombarding atoms ordered in the lattice structure. If a neutron hits the nucleus of an atom, it can be torn away from its position in the lattice, leaving an empty space behind. If the neutron possesses a lot of energy, it can transfer this to the atom which has been pulled away, and the latter then tears through the lattice at high speed, dragging other atoms with it. Depending on the temperature of the radiation, the defects caused can recombine (i.e. the original state be reconstituted), move about and/or accumulate to produce larger defects. New, undesirable substances can be produced by nuclear reactions, with energy becoming stored in the material and suddenly released. This can have disastrous consequences. Some specific effects of radiation on materials are: (a) Neutron hardening and embrittlement Defect groupings occur in the lattice of ferrite steels (a specific kind of steel used in making reactors) as a result of neutron bombardment. Impurities in the steel, such as copper or phosphorus, help destabilise these defects. The defects occurring in the lattice make the material less tough. The latter is hardened and more prone to permanent deformations (neutron hardening) and brittle fractures. These otherwise occur only at lower temperatures and not at normal operating temperatures. In the worst case the reactor pressure vessel can split as a result of neutron embrittlement and a devastating, uncontrollable accident ensues. The extent to which neutrons cause embrittlement is in part dependent on the chemical composition of the steel used. Neutron hardening and embrittlement can be removed by heating ('annealing out') the material at over 450 degrees Celsius. (b) High temperature embrittlement This kind of embrittlement occurs with another kind of steel, austenitic steel. This is exposed to a high neutron density and temperatures of over 500 degrees Celsius. - in fast breeders, high temperature reactors and fusion plants. Here helium particles are produced, which become trapped in the lattice or form tiny pores. Brittleness occurring at high temperature cannot be reversed by annealing out. (c) Irradiation creep Ionising radiation accelerates what are normally very slow processes of deformation and fracture, particularly in austenitic materials. (d) Radiation growth Uranium, zirconium and graphite, materials which are often used in nuclear technology, can undergo unexpected changes in form while being irradiated. In some cases uranium rods grow twice or three times in size. This phenomenon is caused by the fact that some crystals are asymmetrical, i.e. more solid lengthways than across. The 'creeping' deformations caused by radiation described above then proceed mainly or wholly in one particular direction. (e) Swelling through formation of pores The build-up of empty spaces left behind by atoms catapulted out of the metal lattice causes pores forming in great quantities in austenitic steel in fast breeders or fusion plants. These in turn create atoms between lattices, causing the volume of the components involved to increase. This swelling can produce strain and in the end make components defective. Whereas defective parts can be repaired in conventional plants, this is by and large not possible with the radioactively contaminated components of nuclear reactors. A fuel rod for a pressurised water reactor normally has a life of just three years, or four or five in exceptional cases. After this time the rod has to be completely replaced, with only a fraction of the energy in the fuel rod having been used. Matters are much more complicated in fusion plants. Where in the process the first walling in the inside of the reactor has to be changed after only a week, and replacing it takes much longer than a week. Quite apart from the economic aspects involved, it is doubtful if such plants will be able to supply energy continuously. ((((Diagram of construction and interior of a pressurised water reactor to be inserted here))) Reactor vessel a critical point As one of a nuclear power plant's most important protective barriers, the reactor pressure vessel must remain intact in all circumstances. If it fails, the reactor's radioactive inventory is released. The industry has claimed that such measures as filtration systems and secondary containment will decrease any release to insignificant levels. This has been shown to be not the case. Failure of filtration systems, overloading and venting of large amounts nuclides through the intact filters has been shown to be not unlikely in case of a large scale accident, such as one involving a breakage of the pressure vessel. Not even the containment can prevent such an escape if the reactor vessel splits. In the event of a fracture under fullpressure the upper part of the vessel would certainly lift off, and the containment would likewise be damaged. But it is precisely this, the reactor pressure vessel, which is continually exposed to intensive neutron bombardment. The reactor pressure vessel is not equally strong with all models of reactor. The most common light water reactors are pressurised and boiling water reactors. The column of water between the active core and the radioactive vessel wall, which slows down the neutrons, is narrower with pressurised water reactors than with the boiling water type. In VVER reactors of Soviet design the column of water is even narrowerthan in comparable western reactors (with a similar output), making the pressure vessel in this type of reactor especially at risk from radiation. The welding joints in first generation VVER reactors moreover have a high copper content. This is a further weakness, because copper impurities in the steel cause greater embrittlement. In an extreme situation fractures can occur during operation; while the reactor is being started up or shut down, or when rapid changes in temperature occur in accidents where coolant is lost. First generation reactor pressure vessels in the USA and Germany also use steel containing copper. The concentration of copper in welding joints with copper-coated welding wire is particularly problematic. And it are older plants - the most hazardous of all - that always have a welding joint in the active core area, where neutron flux density is at its highest. The cores of the aged reactors at Obrigheim and Stade in Germany, for example, have joints high in copper content. Complicated monitoring Materials are usually controlled by taking 'surveillance data specimen', which are irradiated closer to the core - and so with a higher neutron flux density - than the vessel itself. These samples are then analysed in order to assess the behaviour of the material in advance. Monitoring the effect of radiation on the material of the pressure vessel is difficult, however. With older plants, especially, data on the actual copper content of welding joints, and other data on the original state of the materials before they became irradiated, is often lacking. These data are however essential if comparisons are to be made. Only recently has the 'flux-density' effect been discovered. It is now known that, for the same total neutron dose, the embrittlement effect is greater with longer radiation and a lower neutron flux density than with shorter radiation at a higher flux density. If this is applied to the radiation results for the samples on the wall of the reactor vessel, the embrittlement anticipated has been underestimated. This means that older pressure vessels in boiling water reactors with high proportions of impurities can also display embrittlement. Until now it had been thought that this would not happen with reactors of this type on account of their lower neutron flux density. Errors in monitoring programmes, it is internationally agreed, are in any case unavoidable. The neutron dose and temperature differences at the sampling point and vessel wall are difficult to assess; nor is it yet possible to determine the flux-density effect quantitatively today. Safety margins are therefore prescribed in the USA - unlike in Germany, where optimalised steels are relied on not to become more than slightly embrittled. A brittle fracture becomes a nuclear emergency For there to be a brittle fracture small cracks first have to be present in a component. This can occur where there are welding joints, or defects in the joints themselves. Stress in a tough material can be absorbed by local reshaping, whereas, it cannot in a brittle one. If a crack runs from abrittle area of a material into a tough one, a fracturing process can come to a halt at that point. This process is called crack arrest. With steel becoming increasingly tough as temperature increases, there is a danger at lower temperatures. Optimalised steels are as a rule tough at operating temperature, but, as was seen above, this can change as a result of neutron irradiation. While Soviet-Russian regulations forbid any spontaneous cracking, or 'crack initiation' in a material, in the West regulations in part permit it. It is allowed given proof that crack arrest has occurred only to 75 per cent of a wall's thickness. The remaining, intact quarter of the wall is supposed to guarantee the vessel's integrity. A reactor's start-up and shutdown are procedures which weaken safeguards against brittle fracture in normal operation. These procedures are marked by low temperatures, high internal pressure, and thermal stress in the pressure vessel wall. In the event of accident the situation becomes critical because the thermoshock is triggered off by a loss of coolant in the primary circuit. If a leak in the primary circuit occurs during operation, water from the emergency cooling system is supposed to prevent the core overheating. This water, which has a maximum temperature of 70 degrees Celsius, contacts the inside surface of the pressure vessel wall, the temperature of which is much higher. The risk of a brittle fracture thereby rises. The emergency cooling water does not necessarily mix straight away with the water already there; it can flow down the vessel wall in cold streaks or lines, cooling asymmetrically. The high tension, which is also in the outer wall, will make a crack arrest much less likely than when cooling is symmetrical. Reactor pressure vessels are normally checked for cracks, particularly at welding joints and other areas under stress, every three years; normally by using ultrasound. It is however disputed whether cracks below a certain size can be detected in this way at all, and if this is an appropriate test against brittle fracture. Other countries, other notions of safety Reactions to the problem of possible brittle fractures in pressurevessels differ from country to country. In 1990, the Nuclear Regulatory Commission, NRC, which is the highest agency for nuclear control in the United States, ordered Yankee Row, the USA's oldest commercial reactor, to be shut down until it was certified safe against brittle fractures. In 1992 the plant had to be shut down permanently, since it was not economic to attempt to prove its safety case. The NRC is considering increasing margins in determining current brittleness so as to ensure the safety of older plants. The samples taken for monitoring purposes must be representative, particularly with old plants. As far as is known, material with a high copper content has not been used in France or Japan. Therefore, the risk posed by this particular type of embrittlement seems to be less in these countries. Eastern European VVER reactors were made with steels which have not only a high copper content but also high phosphorus impurity. In these countries, monitoring programmes were not planned, therefore the extent of embrittlement had to be calculated. Almost all the pressure vessels in this design now undergo annealing processes to increase the toughness of particularly embrittled welding joints. Regulations do not permit crack initiation. In Germany, the rate of neutrons striking the pressure vessel wall in the reactors at Obrigheim and Stade was reduced by reconstructing the arrangement of their cores. At Stade the high-pressure emergency cooling feed was also changed, so that in the event of an accident cold water will now no longer be able to come directly into contact with an embrittled welding joint. By the new draft regulations for nuclear installations crack initiation is permitted provided crack arrest can be proven. As a consequence, measures designed to improve safety are being reduced. Austenitic components no guarantee of safety Austenitic steel (austenite) is a special alloy with a lattice structure different from that of ferrite steel. It is not magnetic, is less solid and so tougher and at the same time resistant to surface corrosion. Austenite is resistant to acids and alkalis and can therefore come into direct contact with the primary circuit cooling water, and the various chemical elements added to it. Austenite is also extremely suitable as a material for steam generators. But austenite also has a number of weaknesses: Its lower hardness means that components have to be thick-walled. This has been a source of headaches to manufacturers, at least in the nineteen sixties and seventies. The quality and interior structure of austenite are also highly variable. This aggravates the mechanical stability of components and makes them difficult to monitor. To begin with no suitable welding technologies were available. In all older reactors joints were welded in exaggerated fashion, making ultrasound inspections and the detection of cracks difficult. Especially so where welding makes a transition from austenite to ferrite. 'Underclad crackings', as they are called, are thus often found under austenitic plating on ferrite components. Austenite has nickel as part of its alloy, it can also contain high cobalt impurities. Neutron irradiation produces a kind of cobalt which is more strongly irradiated and has a longer half-life, creating problems with the handling and waste disposal of components. While it is true that austenitic steels are resistant to general corrosion, they are prone to localised corrosive attack, which can produce stress corrosion cracking. Such attacks are particularly liable to occur at load changes or plant shutdowns. They will be aggrevated by the presence of pollutants, e.g. chlorine or sulphur in concentrated amounts in the coolant circuit. Stress corrosion cracking cannot usually be repaired, and the component involved must as a rule be replaced. Furthermore such damage is generally not discovered until it is too late. The formation of cracks is encouraged by material fatigue as a result of changes in stress, and crack growth is accelerated by the chemicals used in the cooling process. At the same time the extent of a crack on the inner surface - as in a pipe, for example - often cannot be detected from outside. Steam generators had a variety of problems, the capillary tubes of which are made of austenitic materials. These tubes are firstly extremely difficult to inspect, and, secondly, with there being so many of them only a fraction can be checked during a shutdown. If a leak is detected, the capillary tube is simply capped. It is not until there are losses in energy through too many tubes being closed that the steam generator itself is replaced. (((Diagram of reactor pressure vessel (with penetrations and nozzles) here))) Vessel closure head a weak point The vessel head of a reactor pressure vessel is formed by a usually slightly-domed top made, like the reactor vessel itself, of ferrite steel with an austenitic plating. It is removed when inspections are made or fuel rods changed. Vessel heads are typically concentrically designed, with vertical nozzles for taking measurements, monitoring and safety devices. In boiling water reactors the devices are in the lower part of the pressure vessel, but problems with materials and the mechanisms by which damage occurs are nonetheless similar to those in pressurised water reactors. Depending on the reactor type, the nozzles are screwed in, dropped intothe top and welded inside or from without. They are mainly made of austenitic material. The pressure vessel head is a potential weakness on account of its position and construction, for the following reasons: There is a danger of corrosion on the inner wall of the head because of the temperature and humidity conditions prevailing in the upper part of the vessel. Penetrations in the vessel head cause local concentrations of stress which encourage crack growth. These concentrations are increased by nozzles which are pressed into the penetrations (in assembly) and welded on, and through the different temperature expansion in the materials in the head and nozzles. Vessel head penetrations are difficult to inspect on account of their construction and the different materials involved. Cracks with disastrous consequences A number of very critical situations can develop because of cracks in vessel head penetrations. A leak can arise in the primary coolant circuit as a result of a 'through crack' above the welding fixing a nozzle to the reactor head. When the leak is discovered a rapid shutdown is made and the emergency cooling system activated. Losses of coolant on account of small leaks can be overcompensated for by emergency supply pumps over a long period of time. A dangerously high internal pressure can then be produced through the formation of steam. In addition temperature stress occurs, notably on the reactor vessel wall. The monitoring system's functional proficiency can be impaired. A leak in the vessel head penetration can restrict the mobility of the control rods, and these are vital for an emergency shutdown of the reactor. In this event, heat generation in the reactor core would increase, and staff would be less able to intervene. Such restrictions on the possibilities for control can also arise through deformed penetration pipes or corrosion where the reactor vessel head and penetrations join. In this case no leak would be indicated and service personnel might not notice the failure of the control rod drive until there was an emergency. A leak resulting from corrosion can damage closure head material around the penetrations without this being indicated. The reduced stability of the nozzle holders, and widening of the penetrations, would in the worst case result in several control rod drives being ejected. The whole reactor head would then fail. Parts of damaged closure-head nozzles can fall into the core or onto fuel rods in the reactor. Damage to fuel rod cladding, the first protective barrier, would see uncontrolled radioactivity escape into the primary coolant circuit. If a closure head nozzle fractures and a leak occurs, a scenario with worse consequences still can be imagined, with parts falling into the reactor. Radiation would then overcome not only the first barrier but also the second, the reactor vessel. If the containment also then fails, as a result of the explosive upward ejection of the control rod drive, for example, radioactivity can enter the environment. What role specific factors - particularly the coolant - play in the formation of cracks, and how these factors can be calculated in advance, is still very unclear to experts throughout the world. The theoretical analyses made to date and in strict observance of official requirements have been shown to have often underestimated actual crack growth. A leak may not necessarily be detected. At times of high stress (at the start-up or shutdown of the reactor, when disruptions occur) undetected cracks can cause one or more vessel-head nozzles to open up or collapse and thus trigger developments which are potentially very critical. Defective vessel heads a problem that already exists A lot of damage with cracks in vessel head penetrations has occurred in the last few years, and particularly in a number of older pressurised water reactors. These cracks were not initially discovered in inspections but through leaks. This means that they had forced their way completely through the sides of the vessel head penetrations and radioactive water had escaped from the primary circuit. Only then were these leaks detected by monitoring systems. Among the reactors which between 1971 and 1994 had 'through cracks' first discovered as leaks were the Kahl experimental nuclear power plant at Rheinsberg (in former East Germany), Santa Maria de Garona and Jos Cabrera (in Spain), Bugey 3 (France), Ringhals 1, 2 and 3 (Sweden), Tihange 1 (Belgium) and Beznau (Switzerland). Cracks in closure head penetrations have also been observed at the Soviet reactors, Novo Voronezh 1 and 2, and at the Nine Mile Postly, first had to be developed. Asea Brown Boveri company inspection techniques have alone been used, to date, to examine about 2,600 closure head penetrations in some 50 European countries. Countermeasures no guarantee of safety Precautions againsonsible of those concerned, that Mile Point 1 plants, for example, - both built by General Electric - damage varied in the extent of ist severity had by 1993 been found in, respectively, 38 and 27 closure head nozzles for control rod penetration. At the Jos Cabrera plant 27 of the closure head penetrations displayed damage of varying extents. The damage found at Bugey 3 in 1991 resulted in worldwide activities to inspect and confine damage. Suitable inspection procedures and systems, which were very costly, first had to be developed. Asea Brown Boveri company inspection techniques have alone been used, to date, to examine about 2,600 closure head penetrations in some 50 European countries. Countermeasures no guarantee of safety Precautions againsonsible of those concerned, that operators and supervisory authorities in western countries are not interested in any public discussion of the damage to components in nuclear installations or of what to do to combat such damage systematically. Experts called in are always obligated to maintain strict confidence. Discussion of damage has also, with a few exceptions, clearly subsided in the literature on nuclear affairs in the past few decades. Most countries have not taken the problem of ageing in nuclear power plants into account either in their safety philosophy or their legislation, and plant operators have not been prepared to address the problem. Instead a fatal attitude has prevailed in many places. That is, loopholes in proofs of the safety of older reactors do not lead to shutdowns until it is proven without doubt that there is a danger to the population. The best proof of this is evidently actual harm to people and the environment from a nuclear accident. This means that damage caused by ageing can occur long before 40 years of operational life have been attained. The worldwide increase in nuclear power stations over 20 years old means a serious increase in the danger to the world from nuclear energy. ENDS