TL: Vessel Cracking in Nuclear Reactors (GP) SO: Greenpeace International & GP Sweden DT: March 1993 Keywords: nuclear power europe france reactors safety problems risks greenpeace reports gp / Vessel Head Penetration Cracking in Nuclear Reactors (GP) Part I Nuclear Vessel Head Penetration Cracking in France By Mycle Schneider WISE, Paris, France Part II The International Perspective By Thomas Panten and Helmut Hirsch Gruppe Okologie, Hannover, Germany Norbert Meyer and Detlef Rieck Greifswald Published by Greenpeace International and Greenpeace Sweden March 1993 Part 1: Nuclear Vessel Penetration Cracking in France CONTENTS Part I: Nuclear Vessel Penetration Cracking in France 1.1 Introduction 1.2 The Vessel Head Penetration Cracking Phenomenon 1.2.1 The History of Detection in France 1.2.1.1. THE 900 MW REACTORS 1.2.1.2. THE 1,300 MW REACTORS 1.2.1.2.1 Vessel Head Penetrations 1.2.1.2.2. Pressurizer Instrumentation Nozzles 1.3 Technical description of the Vessel Cracks and their Origin 1.3.1. Vessel Head and Penetration Design 1.3.2. Characteristics and Origin of Identified Cracks 1.4 Safety Implications of the Vessel Head Cracking The French Official Analysis 1.5 Counter-Measures Adopted 1.5.1 Inspection 1.5.2.Leak Detection Systems 1.5.3.Control Rod Anti-Ejection System 1.5.4.Temperature Lowering/Downrating 1.5.5.Penetration Replacement and Repairs 1.5.6 Vessel Head Replacement 1.6 Conclusion Part II: The International Perspective II.1 Intro: French Discovery of Vessel Head Penetration Cracking (VHPC) II.2 Development of The Problem in Other Countries II.2.1. Sweden II.2.2. Switzerland II.2.3. USA II.2.4. Other countries II.2.5. Former VHPC Experience II.3 Description of Vessel Head Penetrations and Their Inspection II.3.1. VHP Design II.3.2. Methods to Detect VHPC II.3.2.1. Leak Detection II.3.2.2. Hydrotests II.3.2.3. Visual inspection, Liquid Penetrant Testing, and Ultrasonic Testing II.3.2.4. Eddy Current Testing II.4 Discussion of Safety Implications II.4.1. Origin and Development of VHPC II.4.1.1. Failure Mechanism of Inconel 600 VHPs II.4.1.2. Other Reactor Designs II.4.1.3. Conclusions on Failure Mechanism and Development II.4.2 Description of possible accident scenarios Il.4.2.1. General aspects II.4.2.2. Leak in the primary circuit II.4.2.3. Impairment of the reactor control system II.4.2.4. Reactor vessel head failure II.4.2.5. Further hazards II.5 Counter-measures Adopted II.5.1. Measures to repair VHPC II.5.2. Measures to prevent VHPC II.6. Conclusion II.7. Figures (omitted here .. unscannable) SUMMARY Part I In September 1991, during routine testing on a French 900 MW nuclear reactor, a leak was detected at the reactor vessel head. The cause was identified as a cracked vessel head penetration. These devices allow the control rods, the crucial device for safely shutting down the reactor, to manoeuvre into the pressure vessel. The rupture of one or several vessel head penetrations could therefore lead not only to a loss of coolant accident but also a severe reduction of reactor control. The phenomenon was immediately taken seriously by the French operator Electricite De France and the safety authorities. Inspections have also been carried out at other reactors, confirming the generic character of the problem. By the end of 1992, it was clear that potentially all 53 operating French pressurized water reactors (PWR) could be affected. Nevertheless, by February 1993, only 10 reactors had all their penetrations inspected and cracking was detected at 8 of them. Of particular significance could be the fact that at least 1 reactor (Gravelines-4) loaded with plutonium-uranium fuel (MOX) is affected. The lack of automatic inspection devices, high doses induced by manual inspection and high dependence on nuclear power in France hindered the safety authorities to impose a stricter inspection schedule. The performance of inspection techniques, leak detection instrumentation and control rod anti-ejection devices remains unclear. The problem has been costly in terms of radiation exposure, and inspection and repair. The most expensive economic burden stems from electricity replacement costs which can be valued at more than 7 billion French francs so far. Part II Reports on vessel head penetration cracking (VHPC) findings have not been confined to France, but further incidences have occurred in Sweden (Rhingals), Switzerland (Beznau) and Belgium (Tihange). Although plant operators and regulatory bodies from other countries have reportedly been following the VHPC issue, no inspection efforts were immediately initiated; on the contrary, the safety implications have been played down and the applicability to reactors outside of France neglected. It is noteworthy that the understanding of the VHPC phenomenon has improved little over the last year, despite the continual increase in number of cases. Following the first instances of cracking, the nuclear analysts hastened to give an answer to why the cracks had developed. This explanation had to be modified step by step according to new evidence showing up in other reactors. This somewhat unorganised approach, however, has not been successful in arriving at a thorough understanding of the penetration cracking phenomenon. With the exclusion of the possibility of circumferential cracking, the risk of serious accidents has deliberately been ruled out, despite reported cracks indicating that such an exclusion is more than doubtful. Apart from the fact that longitudinal cracking also poses the threat of unnoticed advanced corrosion of the VHPs and even the vessel head, a rupture of a VHP initiating from circumferential cracking is possible and will lead to an unisolatable leak in the primary circuit, which could be the precursor to a core-melt accident. There are further possible accidents resulting from VHPC with the potential of large radioactive releases, in contrast to the official statements on the risk of VHPC that suggest the worst potential consequence would be corrosion of the outer surface of the vessel head. The hazard of the potential impairment of the reactor control system has completely been neglected despite its vital importance for the reactor to be controllable. The development of the VHPC issue exhibits a sorry state of awareness of both nuclear operators and regulatory bodies. What should prudently be done from a safety point of view are detailed investigations into the failure causes and kinetics of VHPC to arrive at a thorough understanding of the phenomenon. With immediate and highly reliable inspections at all reactors employing Inconel 600 VHPs, and inclusion of the VHPs into in service inspection programs in all other reactors. Unless these measures have been implemented, no organized and well-founded replacement program can be initiated, which of course has to be based on a thorough knowledge of both failure mode and extent. Reactors in which VHPC has been detected have to remain shutdown for that time. PART I: Nuclear Vessel Head Penetration Cracking in France 1.1. Introduction In March 1991, EDF made the following statement on the "state of health" of their 900 MW reactors: "The results of controls and tests undertaken in the framework of the seven decennial inspections already carried out demonstrate the excellent resistance characteristic of the material used with time".1 1 EDF, Bilan de sante des centrales nucleaires 900 MW. March 28, 1991 Six months later, in September 1991, a routine decennial hydrotest on the primary cooling system of a French 900 MW reactor led to the discovery of what senior EDF technical official Jean-Pierre Mercier called "the most serious" nuclear power plant problem the French operator had yet to face.2 Substantial cracks were discovered in the reactor vessel head penetrations. 2 Nucleonics Week, November 21, 1991 Since then and up until mid-February 1993, other cracks have been detected in at least a dozen more reactors. After steam generator tube cracking, broken control rod guide tube split pins, pressurizer instrumentation penetration cracking, badly installed controlled venting sand filters, faulty control- command cables, main steam line cracking (even in the no-break zone), insufficient maintenance procedures, etc. yet another generic problem troubles the standardized French reactor program. Nucleonics Week has commented: "Ironically, the penetrations bad been identified in a Framatome study of Inconel-600 reactor components as one of the places most susceptible to stress corrosion cracking in EDFs reactors". While EDF was preparing "to take a look" at VHPs during planned outages, "events overtook the utility" when cracks were discovered at Bugey-3.3 EDF states that it was aware of the Inconel-600 problem, but "an analysis of the suspicious parts had led to the vessel heads being not classified as amongst the most sensitive components; this illustrates the technical difficulty of a priority analysis."4 3 Nucleonics Week, January 2, 1992 4 EDF, "Surete Nucleaire 1992", Rapport de l'Inspecteur General pour la Surete Nucleaire (Tanguy Report), January 1993 One year after the first discovery of the vessel head penetration cracking (VHPC) problem only about 450 penetrations had been inspected.5 Only five reactor vessel heads had had all penetrations checked 6 and seven partial inspections had been carried out. At least 24 plants (6 x 900 MW and 18 x 1.300 MW) seemed potentially more threatened than the rest of the plants because of higher temperatures under the vessel head. The fact that some of the 1,300 MW reactors have been put into service fairly recently suggests the likelihood of a lower cracking probability. One second generation CPY 900 MW reactor checked did not present any anomalies. This seemed to confirm the theory that CPY reactors are less susceptible to VHPC because of the lower temperature under the vessel head. 5 according to Jean-Pierre Mercier, EDF, quoted in Nucleonics Week September 24, 1992 6 Bugey-3, -4, and -5, Flamananville-1, Paluel-1 according to Nucleonics week September 24, 1992 Two months later, in November 1992, the bad surprise came with the inspection of the VHPs at Blayais-1, also a CPY reactor. Three of the 65 penetrations were affected. "Cracks have been detected where one did not expect them", wrote EDFs chief safety inspector Pierre Tanguy in his last annual report.7 It is now clear that the phenomenon potentially affects all 53 French operating PWRs. 7 EDF, "Surete nucleaire 1992". Rapport de l'Inspecteur General pour la Surete Nucleaire (Tanguy Report), January 1993 In December 1992 probably the most significant and the worst information concerning safety implications had to be digested by the EDF management. The leaking VHP of Bugey-3 which first drew attention to the cracking problem was extracted and examined in detail. Metallurgists in the laboratory observed "incipient circumferential cracking", contradicting the results of modelling and expert predictions.8 This type of cracking can indeed lead to rupture without any previous leaking and thus without warning. The rupture of a VHP and the subsequent ejection of a control rod drive mechanism (CRDM) would create a breach in the primary cooling system which could eventually trigger a core melt accident. It should be noted that it took 15 months before the circumferential crack indications were identified after the discovery of the liking VHP and they went unnoticed with the current in-service-inspection and non- destructive-examination techniques. 8 DSIN, MAGNUC, February 15 - 21, 1993 By the middle of February 1993, only 20% of EDFs reactors had undergone complete in-service-inspection of their VHPs; eight of these were affected by the cracking phenomenon. Five VHPs were identified cracked in eight partial reactor inspections. By this time vessel head replacement had been decided for at least a dozen reactors. Around 500 million French francs have been spent on the problem during 1992. The different kinds of inspection techniques used for the VHPs of the various reactors have not been specified. It is obvious that visual inspection, for example, is much less reliable than ultrasound or liquid penetrant examination. DSIN refused to transmit the data to the author on the grounds that it would be "clearly within the operator's competence" to supply the information and DSIN s role is to "express its point of view" on the position taken by EDF. DSIN had in fact already asked EDF by the middle of December 1992 to supply the data to the author, but the author has not, so far, had any positive reply from EDF.9 9 Letters to DSIN dated December 12, 1992 and February 24, 1993, personal communication with Michelle Benabes, DSIN, February 25, 1993 and letter from DSIN, dated February 26, 1993. Several requests for information put forward directly to the EDF did not encounter any positive reactions. The difficulty of rapid in depth inspection of all the potentially damaged vessel heads shows just how problematic EDF's very high level of nuclear dependence is. While this is not the only safety related issue, EDF is forced to admit that production capacity replacement is not only costly but sometimes hardly feasible. (see annex 1.1. for a detailed outage estimation) This is all the more dramatic because of widespread electric space heating and extensive electricity exports which correspond today to the production of about 10 reactors. Under these circumstances, who could possibly take the political decision of shutting down more than 20 reactors at the same time in winter? 1.2. THE VESSEL HEAD PENETRATION CRACKING PHENOMENON 1.21. The history of detection in France Between September 1991 and the middle of February 1993, about 5% of the ca. 700 inspected VHPs (20% of the total) were found to be affected by the cracking phenomenon. Inspections were carried out on 18 reactors, a third of the currently operating plants, (six CPO 900 MW reactors, three CPY 900 MW reactors and nine 1,300 MW reactors). Only 10 of the 18 reactors had all their VHPs inspected. (see following table for further details) DSIN is currently examining EDF's proposed inspect ton program for 1993. Table 1.1: Published Inspection Results in French Reactors by March 1st 1993 Reactor Capacity Program Hours Temperature Cracked MW gross life C under VH VHPs 11 time 10 Complete Inspection Bugey-2 957 CPO 75615 315.0 6 Bugey-4 957 CPO 75554 315.0 8 Bugey-3 957 CPO 74330 315.0 2 Gravelines-B4 957 CPY 72698 289.1 5 Blayais-1 957 CPY 70914 289.1 3 Tricastin-4 957 CPY 70400 289.1 1 Paluel-1 1345 P4 46957 313.7 0 Paluel-2 1345 P4 45265 313.7 0 Flamanville-1 1345 P4 38186 313.7 1 St.Alban/St.Maurice-2 1345 P4 30947 313.7 1 Partial Inspection Fessenheim-2 930 CPO 87303 313.4 0 Fessenheim-1 930 CPO 84320 313.4 1 Bugey-5 937 CPO 78548 315.0 2 Paluel-3 1345 P4 43604 313.7 0 Paluel-4 1345 P4 39199 313.7 5 St. Alban/St.Maurice-1 1345 P4 35935 313.7 2 Flamanville-2 1345 P4 35501 313.7 0 Cattenom-1 1345 P4 28975 313.7 1 Sources: CEA, EDF, Nucleonics Week, DSIN 10 Until the end of 1992, according to Nucleonics week, February 11,1993 11 Number of VHPs with identified cracks 1.2.1.1. THE 900 MW REACTORS On September 23, 1991, the primary system of the Bugey-3 reactor, a 900 MW PWR, was subjected to a hydrotest. Such a test is part of the decennial maintenance program for all French PWRs. The test is performed at 207 bars after unloading the fuel elements. The operational design pressure of these reactors is 155 bars. An acoustic system, specially installed during the hydrotest, detected the leak at the Bugey-3 reactor. According to Framatome, after shutdown of the primary pumps at 166 bars, the acoustic sensors produced an increasing noise indicating a pressure increase.12 A leak of about 1 litre per hour was identified on one (n-54 on the periphery of the vessel head) of the 65 Inconel-600 vessel head penetrations. The CRDM and thermocouple conduits enter the core through these penetrations. The Fessenheim and Bugey reactors were the first 900 MW reactors of the so called CPO (Contrat de Programme -0) series of French reactors. 12 Framatome, letter to Framatome Owner Group (FROG) members, dated October 22, 1991 and tables dated November 27, 1991 By the middle of October 1991 investigations had revealed 11 longitudinal cracks of 15 to 73 mm length occurring in two groups on the inner wall of the incriminated VHP of the Bugey-3 reactor. Four external tracks indicated penetrating cracks of which only two were thought to have caused the leak. In addition the tube itself had become somewhat oval. Discussions between EDF and the safety authorities DSIN led to the decision to examine all the other penetrations of the vessel head before the end of 1991. At the same time it was decided to extend the examinations to about 40% to 50% of the VHPs of two other 900 MW reactors which were shut down for refuelling at the same time (Bugey-4 and Fessenheim-1). But according to a Framatome document by the end of November only 12 other VHPs at Bugey-3, 13 at Bugey-4 and 12 at Fessenheim-1 had been examined. 13 DSIN. Note d'Information, Paris, December 2, 1991 Of greater importance, however, was the fact that the VHPs examined those not housing any CRDMs, although the leaking VHP (n-54) at Bugey-3 did in fact house a CRDM. In fact, in the case of the 6 reactors of the CPO series the vessel head has 65 CRDM and thermocouple shafts. There are 48 continuously functioning control rod mechanisms, 5 redundant mechanisms, 8 additional penetrations exist for MOX use but are only equipped when MOX fuel is employed. None of the CP0 reactors are currently loaded with MOX nor will be in the foreseeable future. Up until the end of November 1991, only one more VHP equipped with a CRDM had been examined (n-65 at the edge of the vessel head at Bugey-4). It was also found severely damaged with at least 8 crack indications! The main inspection techniques used were televisual and eddy current measurements; in exceptional cases, the more precise liquid penetrant and ultrasound methods (impracticable in the case of VHPs with thermal sleeves) were used. Televisual observation was the only non manual technique used in these inspections. DSIN stated that "the way in which controls are performed today present serious problems". Certain control practices require the "destructive dismantling of internal mechanisms of the sleeves". And as DSIN points out, "only a limited number of replacement components are currently available". Another significant problem is "the high cost in dose of the examinations".13 Indeed, EDF estimated that the complete inspection of the Bugey-3 vessel head and partial inspections at two other plants would alone cost 1 man-Sv (100 man-rem).14 By the end of 1992, the collective dose resulting from inspection and maintenance associated with the VHPC problem was evaluated to be about 8 man-Sv (800 man rem).15 14 Nucleonics Week, January, 2nd, 1992 15 EDF, "Surete nucleaire 1992" Rapport de l'lnspecteur General pour la Surete Nucleaire (Tanguy Report), January 1993 Automated inspection technology is expected to replace existing technology by and by. (see chapter I.5.1.) New materials and control methods had not been adequately qualified and evaluated by the middle of February 1993. The first follow-up series of examinations revealed more cracks of the same type around another VHP at Bugey-3, around eight others at Bugey-4 and around one at Fessenheim-1. On December 30, 1991, EDF decided to perform external televisual examinations on the three other reactors at Bugey and Fessenheim and to install leak detection systems on all six reactors. A complete examination of the VHPs at Bugey-5 was to be carried out during the planned refuelling outage which began at the end of April 1992. Televisual examination of the VHPs did not reveal any anomalies. However, DSIN requested further investigations. On December 31, 1991, DSIN asked EDF to carry out additional televisual examination on the interior surface of the Bugey-2 vessel head and the two Fessenheim reactors during their planned outage beginning at the end of January 1992. According to EDF these controls did not reveal any anomaly. Other control techniques revealed though six affected VHPs at Bugey-2 after complete inspection and two cracked VHPs at Bugey-5 after partial inspection. As by the middle of February 1993 the two Fessenheim reactors as well as the Bugey-5 reactor were still not completely inspected. By early 1992, the Bugey-3 reactor bad undergone more thorough examinations. The inspection techniques used included: . internal televisual observation of all VHPs; ù internal eddy current inspection of all VHPs; ù internal ultrasound inspection of the outer surfaces of all VHPs; ù liquid penetrant examinations of welds and the inner surface of the incriminated VHP n'S4; ù examination by replica of a liquid penetrant indication on the weld of VHP n- 54; ù general televisual examination of the inside surface of the vessel bead; ù a print was taken on VHPs n-54 and 57. The following statement appears in bold letters in a 45 page report on the VHPC problem 16: "No circumferential crack initiation has been identified on the inner or outer surface". Like several other "facts" presented in this document, this statement had to be corrected later. In December 1992 detailed analysis carried out on the extracted Bugey-3 VHP n- 54 revealed "incipient circumferential cracking in the weld zone on the outside of the penetration". (bold letters from the author). DSIN considers that the cracks are "probably due to the fact that the space between the penetration and the vessel head was maintained in the presence of primary water, following a throughwall longitudinal crack". 17 EDF commented that "if you leave (a longitudinally cracked) penetration in there long enough", it could begin to crack from the outside. 18 Corrosion tracks on the vessel head indicated in fact that the crack had been throughwall and was already leaking before the hydrotest. 16 EDFI "La cuve du readeur", undated 17 DSIN, MAGNUC, February 15 - 21, 1993 18 Nucleonics Week, January 28, 1993 The recent identification of incipient circumferential cracking around the leaking Bugey-3 VHP was also a slap in the face for the reliability of in-service-inspection techniques. In fact, probably no other VHP of the French nuclear program was examined as carefully as n 54 of Bugey-3. In November 1992, other bad news came for the CPY reactors thought to be more corrosion resistant because of lower temperatures under the vessel head. Three of the 65 VHPs of the Blayais-1 reactor were found cracked. The cracks reached a depth of 10 mm. 19 Later on, two more CPY reactors were found affected by VHPC (Tricastin-4 one penetration was cracked; Gravelines-4 five more VHPs were cracked!). 19 DSIN, MAGNUC, December 7 - 13, 1992 The Gravelines-4 case is of particular significance, since it is the first reactor loaded with 30% uranium-plutonium mixed oxide fuel (MOX) where VHPC has been identified. Because of higher residual reactivity, the vessel head is equipped with eight additional CRDMs. The fraction of delayed neutrons is lower for plutonium 239 than for uranium 235. In other words, a MOX loaded reactor reacts faster than a uranium core. This is of particular concern in the case of specific accident scenarios. Whatever the probability assessment might be, it is evident that VHPC increases the risk of CRDM ejection. According to DSIN, in this case "a local increase in power could lead to a primary coolant boiling crisis (la crise d'ebullition) and a significant rise in fuel power output with the risk of cladding and pellet damage". Even if safety limits were not reached "calculations have shown a reduction in the (safety) margins when switching from a uranium to a (plutonium-uranium) mixed core". 20 In other words, it is more difficult to operate a reactor with a MOX than with a uranium core. 20 Ministere de l'Industrie, "Recyclage du plutonium dans les reacteurs a eau sous pression", January 31, 1989 1.2.1.2. THE 1,300 MW REACTORS 1.2.1.2.1. Vessel Head Penetrations In December 1991 DSIN asked EDF to perform the relevant control operations on the first series of 1,300 MW reactors. In February 1992 some of the vessel head penetrations of Paluel-3 were examined. No cracks were identified. Up until the end of October 1992 only two 1,300 MW vessel heads, Flamanville-1 and Paluel-1 had been completely examined. One crack was found at Flamanville-1, none at Paluel-1. Partial examinations were carried out on five other reactors. No cracks have been identified yet at Flamanville-2 and Paluel-3. One penetration was found cracked at Cattenom-1, two at Saint-Alban- 1 and five at Paluel-4. Up until the end of February 1993, only two more 1,300 MW reactors had had all their VHPs inspected (Paluel-2 with no crack indication and Saint-Alban-1 with the two cracked VHPs). Saint-Alban-1 was shut down on May 22, 1992 and was not restarted until December 16, 1992. This was due to an incredible discovery of more than 200 cracks in the four main steam lines of the reactor. DSIN requested repair of at least some of these cracks before it granted the restart licence. 1.2.1.2.2. Pressurizer Instrumentation Nozzles As pointed out earlier, the vessel head penetration problem is not the only one linked to the use of Inconel-600. Even before VHP cracking was discovered, Framatome identified about a dozen places where the material could cause trouble. Steam generator tubes were obviously candidates, but also VHPs. In 1989 another spot proved troublesome: the pressurizer instrumentation nozzles (or connections) of the 1,300 MW reactors. The instrumentation nozzles of the 900 MW reactors are made of stainless steel. Similar to the VHP history, the problem was first identified during 207 bar hydrotests. Problems were identified at Cattenom-2 and Nogent-1 during the first five year inspection hydrotests on these reactors which were put into service in August and September 1987 respectively. The pressurizer possesses 11 instrumentation nozzles with a diameter of 30 mm at the pressurizer (five at the top and six at the bottom). These nozzles allow continuously measurements of temperature, pressure and water level. The connections are expanded and welded onto the stainless steel cladding of the inner side of the pressurizer. At Cattenom-2 a welding defect was identified and at Nogent-1 a longitudinal crack was detected between the weld and the edge of the expanded part as well as an oxidized zone. Stress corrosion cradling was identified as being responsible for the cracking. It was decided to replace the faulty connections. The repair was qualified "delicate" by the safety authorities. The procedures had to be qualified beforehand. It was also decided to carry out visual (external) and liquid penetrant (internal) inspection on other 1,300 MW reactors during their refuelling or other planned outages.21 21 Ministere de l'Industrie, Bulletin sur la Surete des Installations Nucleaires, nø69, covering May/June 1989 The inspections carried out over the following two months revealed longitudinal and circumferential cracks around 40% of the inspected connections. A circumferential crack was, for example, identified at Belleville-1. The safety authorities stated that this crack "confirms the existence of defects which can cause the rupture of the connection".22 Indeed, contrary to the longitudinal cracks, which are considered to leak-before- break, circumferential cracks can lead to the rupture of a tube without any "warning leak". At Saint-Alban-2, cracks were found on five out of the eleven nozzles. 22 Ministere de l'Industrie, Bulletin sur la Surete des Installations Nucleaires, nø70, covering July/August 1989 The inspection program has been extended to all the 1,300 MW reactors in operation and under construction (Golfech). All the incriminated instrumentation nozzles had to be repaired within two years. In the meantime an anti-ejection device will be installed. In the case of the reactors under construction cracked nozzles had to be replaced. 3. TECHNICAL DESCRIPTION OF THE VESSEL HEAD CRACKS AND THEIR ORIGIN. 1.3.1. Vessel Head and Penetration Design The CPO reactor vessel head is made out of ferritic steel (16 MND 5) and has an inner stainless steel cladding. It has 65 VHPs (or adapters). The CRDMs are made of stainless steel (Z2 CN 19.10). The upper part of the VHP is also made of stainless steel which is connected through a bimetallic weld to the lower part made of inconel 600 (NC 15 Fe). The VHPs are shrunk fitted and welded (inconel 182) onto the lower part of the vessel head. Their external diameter is about 100 mm and the wall thickness is about 15 mm. On the inner side they have thermal sleeves. The gap between the VHP and the thermal sleeve is normally about 3mm.23 23 G. Baro and F.D'Annucci, Spezielle Fragestellungen der zfP und ihre Losungen, ABB Reaktor GmbH, presented at the annual conference of the German Atomforum, Konigswinter, September 14/15, 1992 1.3.2. Characteristics and Origin of Identified Cracks The cracks identified until the end of 1992 were all longitudinal ones varying in size and number with the different VHPs. Circumferential cracks, as Framatome points out, "might be more detrimental from a safety point of view".24 They would be definitely more dangerous because they are less likely to leak before rupture. 24 Framatome, letter to Framatome Owner Group (FROG) members, dated October 22, 1991 The most likely mechanism to have caused the phenomenon is intergranular stress corrosion cracking (IGSCC). Framatome suggests that a combination of the following specific conditions could initiate the phenomenon: ù high residual stresses induced by weld shrinkage ovalization ù annealing sensitization of the material ù operating temperatures under the vessel head of above 300 C . VHP n-54 geometry and localization at the edge of the vessel head EDF and DSIN seemed at the time (early 1992) to agree with this analysis and the predominant role of temperatures. The temperature under the CP0 vessel head is 315 C whereas that temperature in the CPY (CPl and CP2) reactors (the 28 other 900 MW reactors in France) is 290 C. The 20 French 1,300 MW reactors and the new 1,400 MW reactors also operate at above 300 C (P4 and P'4 initially functioned at 319 C and then operated at less than 315 C; N4 at 319 C) under the vessel head and are therefore also likely to be subject to accelerated IGSCC. This does not mean that the phenomenon does not occur when temperature under the vessel head is lower, but as Framatome pointed out, "crack initiation times are longer". EDF used to maintain that the 25 C lower temperature of the CPY reactors results in a four fold increase in crack initiation times. After the detection of a large number of VHPCs with CPY reactors, EDF was obliged to reconsider its philosophy on this matter. In addition to high temperatures, the deformation of tubes induced by high stresses due to the geometry and localization of certain penetrations also appears to be of major significance. So far most of the severely cracked VHPs have been identified at the edge of the vessel head. Estimations of the stress on the VHPs have been too low, according to EDF.25 These estimations have considered the stress induced by the welding seams but have not included the deformations produced during the welding itself. 25 EDF, "Surete Nucleaire 1991", Rapport de l'lnspecteur General pour la Surete Nucleaire, january 1992 The 1991 Annual Report of EDFs safety inspectorate gives an overview of the state of analysis of the cracking mechanism by January 1992. Corrosion initiation in inconel-600 materials was thought to be relatively well understood because of EDF's experience with steam generator tubes. EDF uses the following formula to calculate crack initiation times: Tc = FcFm s-4 e -EA/RT ù Fc depends on chemical conditions (pH and hydrogen pressure) and is assumed to vary very little. ù Fm is linked to the structure and composition of the alloy. According to EDF this factor can vary considerably between 2.10-2 and 10-4 and "structural examination is necessary for a more accurate determination". ù s corresponds to the maximum stress on the surface. ù T is the absolute temperature of the component. ù EA is the activation energy, according to EDF "most commonly evaluated to be about 183 kJ/Mole which leads to about a doubling of the initiation time for a decrease in temperature of 10 C". Deformation parameters enabled EDF to calculate the stress at the crack to be 30% to 40% above the conventional elasticity limit. The initiation phase is defined as the time taken for a crack to develop to a point where its rate of further formation can be considered stable. In the present case the depth is considered to be about 100 microns. But EDF also affirms that "the propagation speed of the crack is not accurately known" and that "the effect of temperature on propagation speed could be similar to that on initiation". Laboratory tests have shown this speed to be 1 micron per hour exposure to 315 C and that "corresponds to a through wall penetration of the VHP in about two cycles."26 A large degree of uncertainty subsists, crack propagation speed varies between 0.1 and 4 microns per hour. In other words, the crack could propagate sufficiently fast for a through wall penetration of the VHP in less than six months (obviously depending on the load factor of the reactor). 26 Meant are here two refuelling cycles, thus about two years, That is about 5.5 mm propagation in depth per year EDF also mentions "doubts about the resistance" of inconel-182 and inconel-82 support materials. Laboratory tests have revealed cracking under primary coolant conditions, whereas "this phenomenon has, so far, not been observed in practice". By January 1993, EDF had abandoned the idea of the predominant influence of temperature under the vessel head on crack initiation times. In its report covering the year 1991, EDF's chief inspector for safety published a table of calculated risk factors based on temperature and equivalent operating hours for various French and foreign reactors in comparison with the Bugey-3 reactor. (see table 11.1.1.) EDF's own inspection results over the year 1992 strongly contradict with those assumptions. In the next report, covering the year 1992, the chief inspector admits that, he had assumed that "the stress level and the condition of the material were identical at least for the French reactors. The results of the inspections carried out in 1992 unfortunately show that these last two parameters play a much more determining role in the initiation and progression of the phenomenon than operating time and temperature".27 27 EDF, "Surete nucleaire 1992", Rapport de l'Inspecteur General pour la Surete Nucleaire (Tanguy Report), January 1993 Table 1.1. indeed clearly shows that operating temperature under the vessel head and operating life can hardly be considered to be the major factors triggering the VHPC phenomenon. Nevertheless, EDF considers that "although it is not possible at present to evaluate the time necessary for the onset of a crack, it can be reasonably assumed that the crack propagation speed remains sensibly constant". On this basis, EDF has evaluated, "with a high degree of certainty not to go wrong", the propagation speed of identified cracks (0.3 to 0.5 microns per hour or 2.6 a 4,4 mm per year). Past experience suggests that. this "high degree of certainty" is very open to criticism. A major problem is that manufacturing procedures for VHPs vary considerably. As pointed out in an EDF document: "Attention is drawn especially to the fact that the welding conditions were neither specified nor documented and no special attention was given to the deformation of the adapters".28 It is therefore highly unlikely that any particular aspect of the manufacturing process will ever be able to be linked to the probability of occurrence of a VHPC problem. 28 EDF, "La cuve du reacteur", undated 1.4. SAFETY IMPLICATIONS OF THE VESSEL HEAD CRACKING - THE FRENCH OFFICIAL ANALYSIS When VHPC was first discovered, EDF was not unduly pessimistic. In its December 1991 issue the internal magazine La Vie Electrique declared: "One thing is certain: the cracks do not threaten the safety of the installations". And the top technical manager Jean-Pierre Mercier is quoted as saying: "Since the majority of the cracks is situated at the interior limit of the vessel head and since they are longitudinal, they can never lead to tube rupture. The uncorrected development of circumferential cracks could however lead to rupture".29 Just before Christmas 1991 Mercier told reporters: "We can say in the clearest and firmest way that there is no safety problem".30 29 EDF, La vie Electrique, December 1991 30 Nucleonics Week, January 2, 1992 EDF's chief nuclear safety inspector's annual report 1991 is more prudent in its final paragraph on the topic: "It is too early to conclude on the extent to which the safety of our plants is being affected by what is the most important event of the year 1991 for our reactors". The safety inspector considered that "cracking could eventually result in the ejection of a control rod mechanism. The penetration which is welded onto the cladding, could then become detached from the vessel bead."31 Control rod ejection is obviously considered a very serious risk. 31 EDF, Surete Nucleaire 1991, Rapport de l'lnspecteur General pour la Surete Nucleaire EDF safety analysis is based "on the low probability of dangerous cracking and on early leak detection prior to any adaptor ejection risk. The analysis of the consequences of the ejection of a rod is thus indispensable as long as the anti- ejection devices are not installed on all the reactors presenting a potential risk. This analysis should be terminated in December 1991". Nothing has been published so far on the results obtained. The 1992 annual EDF safety inspectorate report merely states that control rod ejection is a design basis accident. Obviously everything should be done to prevent it. "Accident prevention is essentially based on the understandings of crack propagation speeds." A more rigorous accident prevention strategy is needed. VHP leaks also have other implications. As pointed out by the EDF chief safety inspectorate in last year's annual report, such a leak "can lead to the deposit of concentrated boric acid around the cracked penetration and to the very rapid corrosion of the vessel head steel". In fact, the outer surface of the vessel head is not covered with steel. Tests and empirical data from the American Turkey Point-4 and Salem reactors in 1987 reveal corrosion speeds of between 5 and 12 cm per year! Under these circumstances reliable leak detection systems are obviously absolutely essential. The safety authorities (DSIN) maintain that VHP cracking "does not jeopardize the mechanical resistance of the affected penetrations". DSIN also points out that "even in the hypothetical case of one of the defects leading to a coolant leak in the primary circuit on the outer side of the penetration, the operational procedures would allow operators to detect it and to take counter-measures without the safety of the plant being affected."32 32 DSIN, MAGNUC, 18.11.91 d 28.9.92, as well as updated versions until March 1st 1993. The DSIN 1991 annual report contains hardly more than a page of text on this issue; other than the updating of general information on its Minitel electronic server, little further published information has been made available. 1.5. COUNTER-MEASURES ADOPTED Remedial Measures Currently Taken or Planned in France 1.5.1. Inspection The main elements of the inspection program have already been presented in chapter 2.1. After the detection of VHP cracking in a 1,300 MW reactor it was decided to extend the inspection program to the older 1,300 MW reactors. The surprise discovery of VHPC in a CPY reactor led to a complete revision of the inspection program for 1993, the new program was still being examined by the safety authorities at the end of February 1993. The sudden demand for automatic VHP inspection capacity because of the time consuming and dose costly characteristics of manual inspection procedures, has led to a rush to develop appropriate robot technology. ABB Reaktor GmbH developed in 1992 an inspection robot for the Swiss utility NOK (Nordostschweizerische Kraftwerke AG) which operates the two Beznau reactors. By the middle of September 1992, one year after the detection of the problem at Bugey, ABB had already used the equipment on six French reactors, two Swiss plants, two Ringhals reactors in Sweden and the German Obrigheim PWR. During October 1992, all the VHPs of the Belgian Tihange-1 reactor were inspected. According to the plant management, one peripheral penetration (n-56) had a crack of about 5 mm length and 1 mm deep.33 Another four reactors were inspected by ABB until the end of 1992. (see part II for further details) 33 Personal communication, Tihange power plant directorate, November 24, 1992 According to an overview established by Nucleonics Week, Framatome carried out its first inspection in September 1992 on Bugey-2 with its own robot. EDF used a robot at Bugey-5 developed together with ACB (Ateliers et Chantiers de Bretagne). Westinghouse and Laborelec have just put onto the market a fourth new inspection robot. 1.5.2. Leak Detection Systems In January 1992 a special leak detection system was installed for the first time on the reactor vessel head of Bugey-2 and later on the two Fessenheim reactors. However,subsequent qualification procedures showed that the performance of the system was lower than expected. As a result, DSIN limited the restart and operating permit for Bugey-2 to three months. On May 7, 1992, a new leak detection system was installed. According to DSIN, performance was up to expectation. During the same month the new system was installed on Bugey-3 and later on Bugey-1 and 4, as well as on Fessenheim-2. Fessenheim-1 was to be equipped during shut down in autumn 1992. The reactor was shut down on October 31 for 3 days for an unspecified intervention on the leak detection system. Blayais-1 was equipped with special separate leak detection systems for each of its three cracked VHPs. The reactor actually got its licence to restart and operate for four months with the three cracked VHPs. The same system as in the case of Bugey and Fessenheim is to be installed during refuelling or other planned outages on the 1,300 MW reactors Cattenom-1, Flamanville-1, Paluel-2 and Saint- Alban-2. Another type of leak detection system has been installed at Paluel-1 and 4. Qualification and testing of the system is under way. The new system has also been installed on Saint-Alban-1. 1.5.3. Control Rod Anti-Ejection System The six Bugey and Fessenheim reactors are the only reactors in France which were not originally equipped with a control rod anti-ejection system. According to the DSIN, such systems are now "progressively" being installed on all reactors. This is fun her proof that the risk of control rod ejection is being taken seriously by EDF and the safety authorities.34 The reliability of such systems, installed after the original design stage of the reactors, is questionable. No further information has been available on the technical features and reliability of the systems. 34 DSIN, MAGNUC, September 28, 1992 1.5.4. Temperature Lowering/Downrating The temperature under the vessel head of a about half of the 1,300 MW reactors had been lowered by the middle of September 1992 from 313.7 to 309.4 C. According to EDF, only about two days work is involved.35 The loss in power output is difficult to ascertain, but probably of the order of "a few MW". 35 Nucleonics Week, September 24, 1992 1.5.5. Penetration Replacement and Repairs By early November 1992, the VHP which caused the leak at the Bugey-3 reactor had been replaced. The extraction was qualified by EDF technical staff as "very delicate", because they shrink fitting had been employed and the process had to be reversed to extract the tubes. Also 59 of the 65 VHPs have thermal sleeves which had to be extracted before the penetration itself could be removed. Four VHPs have been repaired at Bugey-4 and one at Paluel-4. EDF has also asked Framatome to replace Inconel-600 penetrations with Inconel-690 ones in the vessel heads under construction for Chooz-B-1 and -B2 "and to bear all the responsibility, including financial".36 36 Nucleonics Week, January 2, 1992 1.5.6. Vessel Head Replacement EDF will be replacing the vessel heads of all six Fessenheim and Bugey reactors within three years. Provisionally the vessel head of Bugey-4 has been replaced with an identical vessel head made for the Spanish Lemoniz reactor which has never been completed. The first new replacement vessel head is to be installed by spring 1994. The old vessel heads are to be stored on site for at least 10 years to cool off, before being "stored in containers" - whatever that means.37 At least another six unspecified reactor vessel heads are to be replaced. EDF has also already placed an order with Framatome for the construction of a 1,300 MW vessel head. 37 EDF, Les Couvercles de Cuves, published in Enerpresse, March 30, 1992 1.6. CONCLUSION In September 1991 the vessel head penetration cracking (VHPC) phenomenon was identified for the first time on a French reactor (Bugey-3). The problem was immediately taken seriously by the operator EDF and the French safety authorities (DSIN). It was clear from the beginning that the rupture of a VHP would lead to a loss of coolant accident, which, even if contained within the design basis of the plants, could have serious consequences for the safety of the reactor. Inspection was soon extended to other reactors of the same type (Fessenheim and Bugey) and later to the 1,300 MW reactors. At first, little attention was paid to the second series of 900 MW reactors (CPY), since they were thought to be less sensitive to the phenomenon because of the lower temperature under the vessel head. By the end of 1992, as a result of severe VHPC on a CPY reactor, it finally became clear that all the French PWRs were potentially affected by the problem. With the recent detection in December 1992 of incipient circumferential cracking on the first incriminated VHP extracted from Bugey-3, it also became clear that the problem is not necessarily limited to longitudinal (or axial) cracks. Circumferential cracking could lead to the sudden rupture of a VHP without prior leaking, whereas longitudinal cracks are easier to identify, since they usually leak before rupture. Analysis of the VHPC phenomenon and the attitude of the operator and the safety authority suggest that: ù EDF and DSIN were unprepared to handle the VHPC problem, in spite of the fact that VHPs had already been identified before by the reactor constructor, Framatome, as one of the places most likely to be affected by stress corrosion cracking. ù The early inspections were limited to easy access VHPs. During the first months following the discovery of VHPC, inspections were limited almost exclusively to VHPs non-equipped with control rods, although the most severely damaged VHPs identified did in fact house control rods. ù Only 10 out of the 53 potentially affected reactors have been subject to complete VHP inspections (almost one and a half years after the first VHPC detection). VHPC was identified on 8 of these reactors. The actual testing techniques employed for each individual reactor are still unclear. ù Incipient circumferential cracking was only identified around one VHP after it had been extracted. Extreme caution should therefore be exercised in interpreting the results of in- service-inspection. ù VHPC has been identified on a reactor (Gravelines-4) loaded with plutonium-uranium mixed oxide fuel (MOX), which is of particular significance, since the safety margins associated with control rod ejection are even narrower than those accepted for uranium fuel cores. ù EDF's crack initiation and propagation analysis proved to be wrong. By the end of 1992, it had become clear that the temperature under the vessel head and the operating life-time are not the most critical factors. Stress and the physical state of the vessel material seem to dominate. The VHPC phenomenon is, as yet, not well understood. ù Performance and reliability of control rod anti-ejection devices and leak detection systems are difficult to evaluate. Vessel head replacement is a lengthy process and it is not known whether VHP repairs are reliable. ù Reactor outages due to VHPC have reached the equivalent of three cumulated reactor operating years (1,209 days of electricity generation). The power replacement costs can be evaluated at more around 8 billion French francs. (see annex I. 1.) In view of the lack of detailed knowledge available on the VHPC phenomenon and the fact that existing inspection and leak detection devices have not been qualified and are of unknown reliability, it is surprising that French safety authorities grant operating licences for reactors for which VHPC has been identified and where incriminated VHPs have not been repaired or vessel heads replaced. French safety authorities have however requested the reactor builder Framatome to replace the Inconel-600 VHPs of reactors under construction with Inconel-690 VHPs. It is now clear that VHPC narrows safety margins to a point which is not considered acceptable for new reactors. Bearing France's increasing dependence on nuclear power for electricity production in mind, one wonders what level of generic safety problem, if any, could lead to the decision shutting down reactors (temporarily) on a large scale? What level of freedom of decision is left to the head of safety authorities in this country? ANNEX 1.1. Table 1.2.: Reactor Outages due to Vessel Head Penetration Cracking in France (by the end of 1992) Reactor dates shut down time (days) Bugey-2 Jan. 4 - Feb. 1, 1992 27 Bugey-3 Aug. 5, 1991 - Aug. 28 1992 (ext.) net 241 Bugey-4 Oct. 5, 1991 - Oct.8, 1992 (ext.) net 305 Bugey-5 Apr. 25 - Sep. 22, 1992 (ext.) net 87 Cattenom-1 Aug. 8 - Nov. 3, 1992 (ext.) net 24 Fessenheim-1 Aug. 2, 1991 - Apr. 11, 1992 (ext.) net 126 Oct. 31 - Nov. 3, 1992 3 Fessenheim-2 Feb. 2 - Mar. 14, 1992 40 Flamanville-1 Aug. 8 - Nov. 25, 1992 (ext.) net 47 Flamanville-2 Apr. 18 -June 29, 1992 (ext.) net 9 Gravelines-B4 Oct. 31, 1992 - ? 7 Paluel-1 June 6 - Aug. 29, 1992 (ext.) net 21 Paluel-2 Sep. 12, 1992 - ? ? Paluel-3 Dec. 21,-1991 - Apr. 4, 1992 net 42 Paluel-4 Mar. 21 - Sep. 6, 1992 (ext.) net 92 Saint-Alban-1 May 22 - Dec. 16, 1992 (ext.) net 145 Saint-Alban-2 Sep. 19, 1992 - ? ? Tricastin-4 Nov. 28, 1992 -? ? Total net>1,209 Notes: ext. stands for extended planned outage; the net figure corresponds to the author's estimation of the net increase in outage time for inspection, repair, replacement work on vessel heads. Calculations are based on the following considerations: Average decennial maintenance operations as estimated by EDF: 21 weeks; Average refuelling and partial inspection: 9 weeks. Assuming power replacement costs of roughly 0.25 French francs per kWh (based on the reference cost calculations of the French Ministry for Industry)38, the total loss due to VHPC related outages until the end of 1992 is already at least around 8 billion French francs. 38 Reference costs for operation and fuel only for a 600 MW coal fired power plant, operating 2,000 hours per year were put at 26.3 to 31.7 centimes per kWh. Ministere de l'Industrie, "Rapport sur les couts de reference de la production d'electricite d'origine thermique", September 1986. PART II: The International Perspective II.1. INTRO: FRENCH DISCOVERY OF VESSEL HEAD PENETRATION CRACKING (VHPC) On September 23, 1991, the French Bugey-3 pressurized water reactor (955 MWe) underwent a hydrotest, a test to be carried out every ten years according to French regulations. With the reactor pressurized to 207 bar, a leakage of about 1 1/hour was detected by acoustic means in the vessel head, and subsequent examination revealed a through-wall crack in one of the vessel head penetrations (VHPs) that allow passage of the control rods into the reactor. Soon after, with the discovery of further cracked VHPs in two other French PWRs (Bugey-4 and Fessenheim-1), utility EDF realized it would have to face another generic problem of serious dimension due to the standardization of its nuclear power plant population. Both EDF and Framatome, the vessel manufacturer, hastened to have their technical teams analyze the problem, and an expensive inspection and repair program was initiated. A detailed description of the development of the vessel head penetration cracking issue in France is given in part I of this report. By the end of 1991, EDF Inspector General for Nuclear Safety Pierre Tanguy presented his annual report on Nuclear Safety for 1991, 1 including a first explanation of the observed crack phenomenon as stress-corrosion cracking (SCC) of Inconel 600, a high-nickel alloy. Also included was the derivation of the relative risk to develop similar VHP cracks for a number of PWRs outside of France, being based solely on operating time and vessel under-head temperature: Table 11.1.1: EDF's 'Risk Analysis' for foreign reactors from late 1991 Plant Equivalent Temp. Temp. Risk Hours C Factor compared to Bugey-3 Yankee Rowe (USA) 189,670 270.4 0.033 0.09 Oconee-1 (USA) 112,800 308 0.63 1.01 Tihange-1 (Belgium) 111,968 312 1.34 Ohi-2 (Japan) 74,800 316 1.06 1.15 North Anna-1 (USA) 73,900 318.3 1.24 1.33 Trojan (USA) 67,890 316 1.06 1.05 Doel-4 (Belgium) 44,856 321.3 1.48 0.97 Tihange-3 (Belgium) 47,089 321.3 1.48 1.02 Although world-wide the number of reactors with VHPs made of Inconel 600 even is far higher, no immediate action outside France was triggered. On the contrary, publication of the EDF results by Nucleonics Week 2 caused consternation among utilities whose plants were named in the EDF report,3 denying the existence of an immediate safety concern. 1. EDF, Surete Nucleaire 1991, Rapport de l'Inspecteur General pour la Surete Nucleaire 2.Nucleonics Week, January 23, 1992 3.Nucleonics Week, January 30, 1992 II.2. DEVELOPMENT OF THE PROBLEM IN OTHER COUNTRIES II.2.1. Sweden In Sweden, three pressurized water reactors are currently in operation at Ringhals, all of which are of 3-loop Westinghouse design, and all of which employ Inconel 600 for the vessel head penetrations. Ringhals-2 (880 MWe) started operation in August 1974, Ringhals-3 (960 MWe) and 4 (960 MWe) in September 1980 and June 1982, respectively. According to the Swedish Nuclear Power Inspectorate (SKI), Ringhals-operator Vattenfall did "intensively study the problems identified in France with cracking in the VHPs".4 Following the French study associating the risk to develop penetration cracking with operating time and under-head temperature of the reactor, the respective data for Ringhals-2 (111,799 hours to July 1991, about 320 C) suggested a high susceptibility to VHPC and it was concluded that cracking could not be excluded. 4 SKI Kvattals Rapport, Forsta kvartalet 1992 VHP inspections, however, were not carried out until the routine outage of Ringhals-2 beginning May 7, 1992. The inspection of twelve unsleeved penetrations out of a total of 65 penetrations revealed four crack indications, "one crack of 16 millimetres in length, one 4 mm deep, and one 2 mm deep. Cracking discovered in a fourth penetration couldn't be properly measured",5 as Nucleonics Week reported. 5 Nucleonics Week, May 21, 1992 SKI's requirement to inspect the sleeved penetrations as well could -due to inadequate inspection equipment - not be satisfied until the beginning of July, the reactor remaining down that time. Finally, on completion of the Ringhals-2 inspection, one further crack indication in a sleeved penetration was detected. Of the five cracks found only two were repaired by erosive removal, the remaining not being considered as safety significant and thus left without further action.6 6 Nuclear News, September 1992 On July 19, 1992, SKI gave permission to restart Ringhals-2. The operator Vattenfall was required to submit a plan for future inspections of penetrations at Ringhals-2, -3 and -4, together with an account of all reactor components employing Inconel 600 and a safety analysis, not later than by 31 December 1992.7 7 SKI Kvattals Rappott, Andra och tredja kvartalet 1992 An inspection of the Ringhals-3 penetrations was scheduled during its routine annual outage from June 5 - July 11. Only one crack indication was found, which was no longer detectable after polishing down 0.3 millimetres. Ringhals spokesman Goesta Larsson was quoted by Nucleonics Week to comment "they believe now there was no crack, that it was something else".8 8 Nucleonics Week, June 25, 1992 The inspection of Ringhals-4 vessel head penetrations was not carried out until its planned routine annual maintenance outage from September 3 to September 30. Two crack indications were detected; both, however, were localized at a distance below the weld joining the penetrations to the vessel head and SKI accepted these to be left without further measures until next year's inspection.9 9 SKI Kvartals Rapport, Andra och tredja kvartalet 1992 By February 1993, the Vattenfall report on the Ringhals findings was submitted,10 stating that there had been four cracked penetrations left in Ringhals-2 and two in Ringhals-4 with the biggest crack (in penetration no 68 of Ringhals-2) having a crack length of 21 mm and a depth of 10.5 mm. Based on so-called conservative assumptions regarding crack growth it was concluded that intervention would not be necessary before 1994 at two of the cracked penetrations of Ringhals-2, and 4 respectively. Why these assumptions cannot reasonably be called conservative is included in chapter II.4.1.1. 10 Vattenfall: "Ringhals 2 och 4 - Reaktortankar Spricktillvaxt i Styrstavsgenomforingar", GEK 4/93. 02/02/93 11.2.2. Switzerland Of the three pressurized water reactors currently in operation in Switzerland, the two 2-loop units Beznau-1 (364 MWe) and Beznau-2 (364 MWe) were built by Westinghouse as main contractor, and both have their control rod vessel penetrations made from Inconel 600. They went into operation in July 1969 and October 1971, respectively. In February 1992, utility Nordostschweizerische Kraftwerke (NOK) asked ABB Reaktor from Germany to develop an automated inspection strategy for the Beznau vessel heads.11 On June 1, Beznau director Hans Wenger announced that "we found no abnormalities" after inspections on the Beznau-2 vessel head had been carried out. Only 75% of all penetrations had been inspected, including the unsleeved and peripheral positions, according to Nucleonics Week.12 However, no safety significance was recognised by HSK, the Swiss Nuclear Safety Inspectorate, and permission given to restart the reactor after its planned outage time. 11 Baro G, d'Annuci F: Speziclle Fragestellungen der zfP und ihre Losungen; Herbsttagung Dt. Atomfarum, Konigswinter, 14J15. September 1992 12 Nucleonics Week, June 4, 1992 Inspection of the Beznau-1 vessel head took place during its annual revision from July 3 to September 1. The automated eddy- current test (see chapter 3.2.4) revealed two cracks: "one measuring 28 millimetres long and 1 mm deep, the other 3 mm long and less than 1 mm deep, near the weld of the penetration".13 These cracks were reportedly repaired (probably by erosive removal) and the unit went back into operation on September 1. 13 Nucleonics Week, October 8, 1992 When questioned on the findings in the Beznau-1 vessel penetrations in October 1992, HSK officials stated that further analysis of the problem was necessary and anticipated, but at the same time no immediate safety implications could be identified.14 14 Personal communication, Peter Metzinger, GP Switzerland 11.2.3. USA It is of particular interest that up to now (Jan. 1993) no inspections for VHPC have been reported from the USA, although the majority of PWRs likely to develop VHPC according to the current state of knowledge is U.S.-based and as early as 1989 Inconel 600 pressurizer nozzles in US-PWRs had been found to exhibit stress corrosion cracking. Nucleonics Week reported in September 1989: "BG&E's Don Graf, project leader on the pressurizer issue, said some Inconel-600 penetrations, such as in-core instrumentation penetrations and control rod drive penetrations have diameters of four- to six-inches or larger. Circumferential breaks of the Inconel-600 penetrations in those "big holes" would indeed lead to leaks that would be beyond the make-up capacity of the charging pumps, Graf said".15 15 Nucleonics Week, September 28, 1989; BG&E is Baltimore Gas & Electric Co. Following the first reports on VHPC in France, "for the most part, U.S. reaction to the preliminary information on the French development has been muted"16. The U.S. nuclear regulatory commission (NRC) took a similar stance, stressing its belief that the cracking was not only dependent on operating hours and under-head temperature, but also on other parameters like stress, material conditions, and manufacturing processes, so that the French risk comparison in EDFs 1991 annual report was not directly applicable. Furthermore, NRC's Thomas Morley said that "a double-ended failure leading to an unisolable loss-of- coolant is unlikely".17 The possibility of cracks in the VHPs going unnoticed during a hydrotest according to ASME specifications (which only require a 110% over pressure, unlike the 125% in France) was acknowledged, but no safety concern seen. 16. Nucleonics Week, November 21, 1992 17. Nucleonics Week, January 30, 1992 Even after further discoveries of cracked penetrations in European PWRs, no concern was expressed by U.S. utilities, these following the problem via the Westinghouse Owners Group (WOG). However, by May Westinghouse analysts had found out that "we do have similar materials and similar operating conditions, but there are a lot of parameters".18 18. Nucleonics Week, May 28, 1992 In September 1992, Nucleonics Week reported that the NRC had finally come to the conclusion that the cracking could occur in the U.S. plants, but at the same time the NRC considered the problem of low safety significance, because . "of the fact that no U.S.-plants have reported cracks or leakage; . no leakage was found during the operation of foreign plants; if cracking has occurred here it is probably axial and not the more serious circumferential; . leaks would probably be detected before a large failure of a penetration (and finally, that) . even if a failure occurred, the small break loss-of coolant accident that would result is within the design basis capability of the plants."19 19. Nucleonics Week, September 24, 1992 A discussion on the appropriateness of these assumptions is included in chapter 4: Discussion of Safety Implications. U.S. vendors expect the NRC to require utilities to inspect their plants for VHPC in the future and thus are busy to have equipment available. Babcock & Wilcox Nuclear Services (BWNS) manager George Beam expects first inspections in "one or two lead plants" to be carried out in spring 1993. 20. Nucleonics Week, October 8, 1992 11.2.4. Other countries Given a high susceptibility of Inconel 600 to corrosion cracking as the root cause of the problems with cracked VHPs, a vast number of PWRs world-wide would appear to be at high risk. However, reaction of the international nuclear community has generally been little more than showing interest. On October 22, 1991, an information note on the VHPC at Bugey-3, France, was circulated within the Framatome Owners Group (FROG)21 to Belgian Electrabel, South African ESKOM, Chinese GNPJVC and Japanese KEPCO. Up to now, no information has been made available on whether inspections or any other action have been carried out or are being planned at the South African Koeberg-1 and -2, the Chinese Guangdong-1 and -2 (under construction) or the Korean Ulchin-1 and -2 units (which were also addressed in the information note). 21 Framatome: Framatome Owners Group - Information on Bugey-3 Incident, October 22, 1991 Out of the Belgian PWR population, units Tihange-3 and Doel-4 were mentioned, both of which have been in operation for relatively little time (since June 1985 and April 1985, respectively), but are running with high vessel under head temperatures (the outlet temperature is 330.3 C for both units). In EDF's "risk analysis" for French and some foreign units as well (see introduction), PWR Tihange-1 was listed as having a risk of developing VHPC higher than Bugey-3 by a factor of 1.34. Inspections, however, were not scheduled before the end of October 1992, and according to plant management one crack of 1 mm depth and 5 mm length in a peripheral penetration could be identified.22 Inspections of another four Belgian plants' vessel head penetrations were said to be planned before the end of 1992 (in Belgium a total of seven PWRs of Westinghouse design are in operation). 22 Personal communication, Mycle Schneider, Paris Inclusion of the Japanese Ohi-2 unit in the EDF list of reactors at risk did not trigger inspection efforts at this unit; rather, a spokesman of Japan's KEPCO was quoted in Nucleonics Week as saying "we have no plan to launch additional investigations".23 In September 1992, however, an ABB official reported that "the company has also sold a complete set of CRDM inspection equipment to a Japanese firm, which has since used it to examine penetrations on a Japanese PWR".24 The specific site was not disclosed. 23 Nucleonics Week, January 30, 1992 24 Nucleonics Week, September 24, 1992 Six of the seven Spanish PWRs are of Westinghouse make (Almarez- 1, first power. 5/81; Almarez-2, 10/83; Asco-1, 8/83; Asco-2, 10/85; Jose Cabrera, 7/68; Vandellos-2, 87). A limited inspection at the Asco-2 and inspections at the Asco-1 and Almarez-1 units appear to be scheduled for their routine outages in February, June and September 1993, respectively; depending on the results of these examinations, inspections at the other units are said to be considered as well.25 An official of the Spanish safety authority (CSN) was quoted saying "We don't see any reason to advance NRC on this item"26 in January 1993, with regard to VHPC. 25 Enerpresse No 5763, 16.2.93 26 Nucleonics Week, January 28, 1993 In Germany, Inconel 600 is employed for the VHPs in two PWRs at Obrigheim (357 MWe; start of operation in October 1968) and Mulheim-Karlich (1302 MWe, March 1986), with the latter currently being shut-down due to licensing deficiencies. By January 1993 it was reported that two German reactors had been inspected for VHPC;27 the results, however, were not made public. Past experience with VHPC in Germany is described below (chapter 2.5.). 27 Baro G, D'Annucci F, Ryiander L: Meeting the upper-vessel- head challenge with eddy currents and UT; Nucl Eng Int, January 1993 Britain has no PWR in operation, but Sizewell 'B' (1258 MWe) is under construction and expected to deliver first power in 1994. The reactor vessel has been manufactured between August 1982 and December 1990 by Framatome in its Chalon shop, the shop that made the reactor vessels for the French nuclear programme as well. Although incorporation of steam generator tubes made from Inconel-690 instead of -600 was reported for Sizewell 'B',28 it appears likely that the VHPs have been manufactured from Inconel 600, as an EDF official in January 1992 was quoted saying that qualification of welds between penetrations of Inconel-690 and vessel heads had not yet been carried out. Considering that a high reactor outlet temperature of 324.8 C is planned for Sizewell 'B' operation, this reactor might be at high risk of developing VHPC as well. 28. The British PWR, Nuclear Engineering International Special Publications The following table gives an account of the occurrences of VHPC that have been detected and made publicly available. It must be expected to further increase over the following months and years, as inspection schemes evolve and data from reactors outside of Europe will probably also become available. First power Net output outlet Number of VHPs (MWe) temp. with cracks detected Sweden: Ringhals-2 5/1975 860 320 4(+1) Ringhals-3 9/1981 915 (1) Ringhals-4 11/1983 015 2 Belgium: Tihange-1 3/1975 870 312 1 Switzerland: Beznau-1 7/1969 350 2 (for details on French VHPC occurrences, see table 1.1) 11.2.5. Former VHPC Experience The French hypothesis that employment of Inconel 600, together with a high under-vessel temperature, is the main cause of VHPC is not consistent with the experience that has been made with VHPC in the seventies with other reactors. VHPC has been found, among others, in the Soviet VVER reactor design, e.g. in 1975 and 1984 VHPC was observed in the VVER-2 reactor at Rheinsberg, former GDR, with some cracks being through-wall.The damaged material was not Inconel 600 but included weld and base material of austenitic stainless steels (OX18H22B2T2 and OX18H9, Soviet nomenclature). It was not systematic non-destructive in-service inspection but rather an increase of radioactivity above the reactor vessel during operation that indicated the damage.29 Similar cracks had been observed before 1972 at the two VVER units Novovoronezh-1 and -2,30 and the problems of VHPC in other reactors of VVER type were subject of extensive investigations in the former Soviet Union and Finland.31 In the experimental boiling water reactor at Kahl, Germany (first power in 1961), a leak in the primary circuit was found during operation that could be traced back to a through-wall circumferential crack in a control rod penetration. The inspections of all 21 penetrations took several months and revealed indications of 27 axial and 2 circumferential cracks.32 29. Muller F (1976): Schndensbericht SUS-Standrohre WWER-2. KKWR-WFC 22J76; NPP Rhansberg 30. ibid. 31. Temperahturny rezim i dolgovecnost dementov privoda SUS blokov VVER (Temperature regime and operating life of the elements of VHPs of VVER units); Trudy ZK-r (1977) vyp. IS3 32. Eltener, Kison (1973): Reparatur nn den Steuerstabdurchf hrungen des Realctordruckgefafies im Versuchsatomkraftwerk Kahl; Reaktortagung 1973 II.3. DESCRIPTION OF VESSEL HEAD PENETRATIONS AND THEIR INSPECTION II.3.1. VHP Design In a pressurised water reactor (PWR), the chain reaction taking place in the core is both moderated and cooled by water. This is pressurized so that it is not boiling although temperatures are typically around 300 C. Therefore, the core has to be placed into a pressure vessel. At the same time, the chain reaction needs to be controllable, which is accomplished by so-called control rods that can be inserted into the core. They are of vital importance for a safe operation of the nuclear reactor. Vessel head penetrations (VHPs), also called adaptors or control rod drive mechanism (CRDM) nozzles, are fitted into the reactor pressure vessel head to allow insertion and withdrawal of the control rods. Figure II.1 shows the basic configuration of a penetration through the vessel head. The wall thickness of a PWR's vessel head typically is on the order of around 200 mm and made from ferritic steel, of which the surfaces in contact with the coolant are cladded with stainless steel to better withstand corrosion. The penetrations typically have an outer diameter of about 100 mm and their wall thickness is about 15 mm, in most PWRs they are made from Inconel 600,33 a high-nickel-alloy with around 75% nickel content. These are shrunk-fit into the vessel head and then manually welded to the bottom side of the head. This weld bears all horizontal and axial loads. The lower end of the pressure housing of a CRDM is threaded and seal-welded onto the upper end of a VHP, from the lower weld upwards the VHPs thus form part of the reactor coolant pressure boundary. 33. German reactor vendor KWU choose - with the exception of the Obrigbeim reactor - to have penetrations made from ferritic steel which are protected by an inner stainless steel tube and screwed into the reactor vessel head As the nozzle-to-vessel head weld has to follow the curvature of the vessel head, these exhibit an eccentricity, the degree of which being dependent on location and the weld seam inclination relative to the nozzle axis being greatest for the nozzles farthest off-center. "The weld produces uneven stresses on these outer nozzles, bending them slightly and deforming them to a slightly oval shape".34 34. Selby SP, Brooks WE: CRDM Nozzle Inspection; Nuclear Plant Journal, November-December 1992 Most penetrations have thermal sleeves made from stainless steel to reduce the thermal stresses that would be imposed on the penetrations by fast thermal transients. The sleeves are fixed to the CRDM housings and do not bear the primary circuit pressure: The radial gap between penetration and thermal sleeve is about 3 mm; this width, however, can vary as much as + 30% due to the ovality of the penetrations.35 Furthermore, some sleeves are off-centered due to the slight bend below the weld. The fact that most penetrations hold thermal sleeves has significant influence on the penetrations' inspectability (see next chapter). 35. ibid. II.3.2. Methods to Detect VHPC II.3.2.1. Leak Detection Clearly, from a safety point of view, leak detection systems on their own are not sufficient to tackle the VHPC problem. For leak detection systems to be effective in guaranteeing that no instantaneous failure can occur, the leak-before-break (LBB) concept would have to be valid under all possible circumstances, and this is not the case with VHPs, as further detailed in chapter 4.1.1.. Furthermore, assurance would be needed that leakages could not damage other components before being stopped, and no other hazardous contamination being caused. The strategy of relying solely on defective penetrations showing up with leaks before rupturing has also been rejected by nuclear industry officials, though not admitting the safety risk, as "industrially unacceptable because of both the uncertainty involved and the long outage times it would imply" 36 (i.e. replacing the flawed penetrations). 36. Nucleonics Week, November 21, 1991 Nevertheless, leak detection devices should in any case be installed as a complementary safety measure. After first attempts of EDF to install leak detection systems in their older reactors failed due to non approval by DSIN, EDF developed a new system based on analyzing the nitrogen-13 content in the atmosphere around the reactor vessel bead that was accepted by French regulators. In September 1992, it was reported that EDF was planning to have 22 of these units installed within a year, but only "at 85% of its 900- and 1300 MW PWR units susceptible to the penetration cracking problem".37 It was not disclosed why and which 15% are left without these leak detection systems. 37. Nucleonics Week, September 17, 1992 II.3.2.2. Hydrotests As mentioned earlier, the crack detected in a VHP at Bugey-3, France, was detected during a hydrotest. French hydrotests are carried out at about 125% over pressure, whereas the ASME (American Society of Mechanical Engineers) code only requires 110% over pressure, a code applied to most of the Westinghouse design reactor pressure vessels. It has been argued that the leak detected at Bugey-3 could only develop because of the overpressure causing a probably small crack grow to through-wall dimension, and that French overpressure requirements should therefore be relaxed. Such proposals, however, have been put off by the French safety authorities. It is likely that VHPC might then go unnoticed and thus an "important indication of primary circuit integrity"38 be given up. In any case having a leak develop during a hydrotest under controlled conditions is preferable to the potentially disastrous consequences of such a thing happening in operation. 38. Nucleonics Week, February 20, 1992 While it is true that hydrotests may reveal some flawed components in the primary circuit, and a higher overpressure will be more successful in doing so, passing a hydrotest does by no means give assurance of the integrity of the primary circuit. A Swiss expert group assessed the ability of hydrotests, complemented by techniques to analyze acoustic emissions from cracks under stress, as "significantly worse" than other inspection techniques in detecting flaws.39 39. Prantl G: Wiederholte Druckprrufung und Schallemissionsprrufung -Bericht einer schweizerischen Expertengruppe; DGZfP, DACH-Jahrestagung 6.-8. Mai 1991, Luzern II.3.2.3. Visual inspection, Liquid Penetrant Testing, and Ultrasonic Testing Visual inspection of the reactor vessel head during refuelling is common practice. This, however, does not mean that visual inspection is a technique suitable for crack detection; rather, it is used because of its simplicity (and low price). Direct visual inspection of the inner surface of the vessel head penetrations is obviously impossible, and automatic inspection with TV camera suffers from the resolution of these devices being too poor to identify surface cracks, their openings are in the range of Um. Tubing surfaces of the primary circuit, including the VHPs, are all too often covered with deposits concealing potential cracks. Furthermore, detection of cracks on a video screen is an extraordinarily difficult task, putting highest demands both on inspector vigilance and experience. All this adds up to the assessment that "it cannot be assumed that visual inspection is suitable to detect cracks."40 40. Oppermann W, Kunkel G: Anpassung und Erprobung cincs Rohrinnenprofsystems filr den regelfahigen Einsatz bei Rohrsystemen in kerntechnischen Systemen; BMU- 1990-257 Under in-service inspection conditions, it is also of limited use to apply liquid penetrant testing, where a chemical is applied onto the inspected surface and expected to accumulate in surface cracks. After washing, surface cracks would then be enhanced for visual inspection. A precondition of this technique to be effective, however, is that the area under investigation generally has to be prepared in advance, ie. surface deposits be removed. Experience shows that chemical removal of deposits often fails due to their strong adherence,41 and mechanical removal appears to be impractical for inspecting long or many pipes, the latter being the case with VHPs. As measurements on the primary circuit have to be fully automated and remotely- controlled, few systems have been developed. 41. ibid. The standard volumetric in-service inspection technique of primary circuit components, ultrasonic testing, could principally be used on the VHPs as well; however, ultrasonic inspection of the VHPs from the outer surface would - especially in the weld regions and above - be geometrically very difficult, and inspection from the inner surface is made impossible by the thermal sleeve. The latter of course also applies to penetrant testing. Whereas both penetrant and ultrasonic techniques thus cannot be used for screening all VHPs of the vessel (unless all thermal sleeves would be removed), they can be of some use complementary to some detection technique in analyzing a flaw once it has been detected and localized. Preparations like removing thermal sleeves and probably some surface treatment as well would be necessary. In Sweden, a remotely controlled fluorescent penetrant system was used in such a manner to verify the crack findings of eddy current tests in the Ringhals-2 penetrations.42 Their results (see chapter 4.1.) are clearly of better quality than the eddy current results of the same crack: whereas the eddy current tests merely showed one indication, the liquid penetrant inspection could identify this as a crack field, resolving the single cracks. 42. Remote fluorescent penetrant system sheds new light on cracking; Nucl Eng Int, Jan 1993 Ultrasound has been used in several plants to analyze VHPC findings as well, in particular to determine crack depths. However, establishing crack depths from ultrasonic measurements is known to be inaccurate and difficult, with errors up to more than 100% even for more "sophisticated" techniques, e.g. TOFD- (time-of-flight diffraction-) techniques.43 Unfortunately, it is the best technique available for volumetric crack evaluation. 43 e.g. Willitts AJ, Ammirato FV, Kietzman EK: Accuracy of Ultrasonic Flaw Sizing Techniques for Reactor Pressure Vessels; EPRINP 6273, March 1989 II.3.2.4. Eddy Current Testing. The eddy current method 44 appears to become the technique most widely adopted for VHP inspection, as by now equipment has been developed that allows inspection of the inner surface of the penetration with eddy currents without the need to remove the thermal sleeves. 44 essentially, the eddy current method is based on recording the response of the specimen under investigation when "questioned" by an alternating magnetic field emitted from a coil. Due to the variety of parameters (permeability, conductivity, distance, frequency,..) flaw detection in a specimen strongly depends on calibration of the technique at completely identical but flawless mock-ups When attention was directed to VHP inspection by the crack findings at Bugey-3, no appropriate in-service inspection methods were available. There are two specifics that complicate the "upper-vessel-head challenge":45 first, the high radiation levels require a remotely controlled technique to be chosen, and it turns out to be difficult to apply robotic equipment to the VHP's geometry; and second, most of the penetrations are fitted with thermal sleeves, thus making the inner penetration surface inaccessible to most of the standard surface inspection techniques (e.g. liquid penetrant testing). 45. Baro G, D'Annucci F, Rylander L: Meeting the upper-vessel- head challenge with eddy currents and UT; Nucl Ens Int, January 1993 However, by June it was reported that at Beznau-2, Switzerland, for the first time a remote inspection of VHPs had been successfully completed (although only 75% of the penetrations had been inspected)46, and the same equipment of ABB Reaktor was soon after used to inspect the sleeved positions at Ringhals-2, where a system jointly developed by Westinghouse, Laborelec and Jeumont-Schneider, as well as equipment developed by Babcock & Wilcox Nuclear Service (BWNS), failed to work properly. 46 Nucleonics Week, June 4, 1992 By September, ABB officials reported that they had inspected VHPs in six French, two Swedish, two Swiss and one German plant;47 in January 1993 these numbers had reportedly grown to twelve French, three Swedish, two Swiss, two German and one Belgian.48 47. Baro G, d'Annuci F: Spezielle Fragestellungen der zfP und ihre Losungen; Herbsttagung Dt. Atom forum, Konigswinter, 14./15. September 1992 48. Baro G, D'Annucci F, Rylander L: Meeting the upper-vessel- head challenge with eddy currents and UT; Nucl Ens Int, January 1993 The ABB robotic equipment can be fitted with two kinds of inspection probes: a rotating probe, which fits into the sleeved or unsleeved penetrations and scans the inner surface by a combination of rotation and vertical movement, and a so-called "gap-scanner", which fits into the gap between thermal sleeve and penetration. The rotating probe is equipped with an eddy current probe designed to be sensitive to both axial and circumferential crack orientations, with an ultrasonic longitudinal-wave probe, and with an ultrasonic probe with normal incident waves, this latter merely to determine the probe position by detecting the weld seam. The ultrasonic probes are to be applied on unsleeved penetrations only, hence they are of use only for defect evaluation if a flaw has been detected beforehand. The eddy current probe is said to allow inspection of the penetration's inner surface through the sleeve. This, however, necessitates the use of low frequencies to have the magnetic field penetrate through the stainless steel sleeve and the sleeve-penetration gap, with a corresponding loss in sensitivity. Furthermore, off-centered or aged sleeves further complicate the inspection. Therefore a gap scanner was developed, equipped with an eddy current probe measuring only 1.5 mm in width to fit into the sleeve-penetration gap. Manipulation into this gap is accomplished-by fixing the probe to the end of a flexible stainless steel strip. This allows bending around the conical guide fixed to the lower end of,the thermal sleeve (see chapter 3.1, figure II.l) and thus manipulation of the probe in the vertical direction. Circumferential movement is simply made possible by mounting the linear drive for the metal strip onto a rotating table. As gap scanner manipulation is "such that the gap probe is inserted along the sleeve into the gap",49 it is improbable that this system reliably circumvents the problems stemming from variations in sleeve-penetration gap width due to nozzle ovality, to some sleeves being off-center, and to operational degradation. After Westinghouse's failure to perform inspections on the Ringhals-2 VHPs, a Ringhals spokesman was quoted saying: "The penetrations at Ringhals-2 are slightly deformed after all the years of operation. The measurements don't match what's in the laboratory".50 Another inspection team recently reported that "Nozzle eccentricity and bending may create gap restrictions that prevent blade probe inspections of some penetrations, so alternative inspection techniques are necessary."51 (a blade probe is a gap probe). 49. ibid. 50. Nucleonics Week, June 4, 1992 51. Selby SP, Brooks WE: CRDM Nozzle Inspection; Nuclear Plant Journal, November-December 1992 As mentioned above, most of the VHP inspections so far have been carried out with the ABB system, and as reactors have gone back into operation it is highly important to know the flaw-detection reliability of the system. ABB officials report that with the rotating probe, laboratory tests "showed that axial as well as circumferential inner defects with crack depths of about 3 mm on the inside of the nozzle were detectable through the thermal sleeve. In the absence of a thermal sleeve, defects with a depth size less than 1 mm were detectable at the inside surface. Outer defects were detectable if they were over 50% wall degradation, dependent on the wall thickness (For the penetrations this corresponds to a crack depth of about 8 mm). The crack width was insignificant. The gap-scanner probe revealed indications of artificial defects in standard test blocks with even smaller crack depths".52 Investigations were also conducted on a few real penetrations and defects to further qualify the technique. 52 Baro G, D'Annucci F, Rylander L: Meeting the upper-vessel- head challenge with eddy currents and UT; Nucl Eng Int, January 1993 However, the important question from the safety point-of-view is not: "How small a crack is detectable?", but rather "How large a crack can go undetected?" This is a question of probabilities, and it is unlikely that so-called POD- (probability-of- detection-) curves have been determined for this eddy current technique. It is well-known that cracks substantially deeper than those established as detectable cracks during qualification of an inspection technique can quite easily be missed.53 Further taking into account that not all vessel heads have undergone a complete VHP inspection (e.g. 75% at Beznau-2), that it is unclear to what extent the gap scanner is actually in use and inspection not only performed with the less sensitive rotating probe, and that "with the gap scanner a nozzle is scanned within the relevant area of the weld seam"54 only, although defects could occur over the whole of the penetration (defects were reported to be well below the weld seam in Ringhals-4), there can be no guarantee that those reactors that have been inspected already do not have VHPs containing cracks of considerable dimension. 53 This was one of the results of the long-lasting international PISC (Programme for the Inspection of Steel Components) efforts, phases I and II; eddy current testing of steam generator tubing has been included into its soon to be finished phase III 54 Biro G, D'Annucci F, Rylander L: Meeting the upper-vessel- head challenge with eddy currents and UT; Nucl Eng Int, January 1993 II.4. DISCUSSION OF SAFETY IMPLICATIONS II.4.1. Origin and Development of VHPC II.4.1.1. Failure Mechanism of Inconel 600 VHPs An analysis of the failure mechanism of VHPC necessitates extensive examinations of the flawed parts of the component. In addition to a detailed description of the finding special material investigation techniques have to be employed, like macro- and micro-fractography, metallography, and microanalysis of corrosion products at the crack front. Detailed results of such investigations have not yet been made available; therefore, the following discussion is based on the hypothesis of inter granular stress corrosion cracking (IGSCC) of Inconel 600, as adopted by EDF.55 55 Surete Nucleaire 1991, Rapport de l'Inspecteur General pour la Suete Nucleaire Damage to Inconel 600 in the case of stress corrosion cracking and low-cycle fatigue is almost exclusively intercrystalline, in contrast to austenitic steels, and the susceptibility of Inconel 600 to IGSCC is known from the findings in steam generator (SG) tubing. The IGSCC-hypothesis, however, does not cover all aspects of VHPC. Besides the general susceptibility of the material, several other conditions must be fulfilled to cause IGSCC, including: 1. Accumulation of impurities at the surface (and later at the crack tip) 2. Tensile stresses over the whole crack region. Furthermore, additional sensitization is caused in some cases by overheating during the welding process. In the SG tubes, heat transfer conditions prevail that lead to an accumulation of impurities on the sur&ce or at the crack tip, similar impurity accumulation is also found in crevices in other locations. Although the VHP geometry exhibits a gap between VHP and thermal sleeve, this is open at its lower end and thus does not lead to deposits. An accumulation due to boiling processes is improbable, as special heat transfer effects like those in SG tubing do not occur. Sensitization as a result of the welding process that could possibly lead to IGSCC under average conditions of the primary circuit's water chemistry might be expected over the whole circumference above and below the weld. The fact that only certain regions of the welds are affected (0 - and 180--regions in figure II.2) does not support this explanation, in particular because the residual stresses from the welding process are present over the entire circumference. These are generally higher than operating stresses, in the range of 0.5-1.0 times the yield stress (i.e. that stress that can be tolerated by the material without irreversible strain). Crack location and crack orientation are inconsistent with the hypothesis of IGSCC caused by residual weld stresses or material sensitization. In figure II.2, damage is shown in the 180- position that lies completely outside the weld region. As the residual weld stresses cannot be the cause of VHPC, other loads have to be considered. No interior pressure can lead to tensile stresses in the affected regions, as in the lower part of the VHPs the primary circuit pressure is present both in and outside the penetrations. Strain in the upper part of the penetrations is restricted by the vessel head. Residual stresses caused by ovalisation of the penetrations as a result of the construction and welding process have been assumed to be a contributor to VHPC as well. The tables of crack findings established by Framatome,56 however, do not exhibit a systematic link between ovalisation and damage location. 56. Framatome: Framatome Owners Group - Information on Bugey-3 Incident, October 22, 1991 It can be concluded that though there is some probability of IGSCC being a failure mechanism of VHPC, this can only be shown conclusively by intensive investigations and simulation experiments. Further synergistic effects also have to be taken into account in this respect. The descriptions of findings are not consistent in the available sources. In a Framatome source,57 groups of single cracks of 15-75 mm length are mentioned. The schematic figures in that report show clearly confined and isolated, strictly vertical cracks, some of them through-wall. The number and extent of the cracks indicates a high degree of damage, and thus the danger of penetration instabilities. 57. ibid. The description and the results of a liquid penetrant examination performed on VHPs at Ringhals-2 show a completely different appearance:58 the damaged area on the inner surface is characterized by a field of mainly vertically oriented cracks. The closely spaced axial cracks are connected by cracks running at tilt angles of up to 45 degrees. From these figures an intensive damage of the material over a wide area has to be assumed. Damage appears to be far advanced. Additionally, it can be concluded that a circumferential rupture along the cracks of the field that are tilted to the vertical direction is possible. 58. Remote fluorescent penetrant system sheds new light on cracking; Nucl Eng Int, Jan 1993 EDFs J.-P. Mercier describes the development of VHPC as follows: "The cracks that have been found are all longitudinal, starting from the inner diameter of the lower part of the adaptor, under the weld, and propagating upwards towards the external part of the penetrations".59 In December 1992, however, the beginning of circumferential cracking, was observed when investigating the through-wall crack of the damaged penetration at Bugey-3.60 59. Mercier JP (1992): How EDF has coped with vessel head penetration cracking; Atom, May/June 1992 60. Magnuc, Jan 28, 1993 In figure II.2, the longitudinal cracks do initiate in a region where there is no difference between outer and inner pressure in the penetration. This region is about 100 mm above the lower end of the penetration, but still under the weld. There are two regions of damage, the bigger one at the 180--position, and a smaller one at the 0 -position. The 0 -region is closer to the weld, where cracks developing upwards are reaching the primary circuit's pressure boundary. A through-wall crack above this weld constitutes a leak of the primary circuit, although the leaking medium first has to penetrate the gap of about 200 mm length between the VHP and the vessel head perforation. A deformation of the VHP is impossible under normal conditions: either the damage occurs in the lower part of the penetration without pressure, or - in the upper part - the vessel head restricts strain in the radial direction and thus a considerable crack opening according to plastic collapse of longitudinal cracks is not conceivable. This situation, however, implies that intensive damage must have developed before it is detectable from outside the reactor. A local loss of stability that leads to a constriction of the penetration, or a lateral bend, can lead to malfunctioning of the control rods. Due to the axial cracks possibly growing together in the circumferential direction, rupture of a VHP cannot be excluded. It is particularly serious that the leaking medium is trapped in the narrow gap of about 200 mm length between VHP and vessel head perforation. Due to primary water relaxation all its solved ingredients (especially boric acid) crystallize, and the following failure mechanisms, possibly in combination, can evolve: 1. By crystallization of the ingredients and formation of corrosion products, an ovalisation of the VHP is possible. 2. The crystallized ingredients and the corrosion products are temporarily closing the leak, thus concealing the progressing damage. 3. The highly aggressive medium forming in the gap preferably attacks the ferritic steel of the vessel head, in the neighbourhood of the VHP an intensive damage due to contact corrosion in an aggressive medium has to be expected. Even under normal water chemistry conditions without impurity accumulation high velocities of contact corrosion have been observed (3-10 mm per load cycle). The cracks penetrate the wall right above the weld in the 0 -position (see figure II.2): here, the load- bearing interface between VHP and vessel head is attacked, posing the threat of loss of stability at this location of the VHP as well. The damage to the vessel head has to be considered more critical than that to the VHP, from a safety viewpoint. Strong and uncontrolled corrosion of the vessel head can put the stability of the vessel head in the penetration regions at risk. An estimate of the failure kinetics is very difficult. EDF has tried to derive such an estimate for different reactors 61 from formulas that describe the crack incubation period for IGSCC of Inconel 600. In this comparison, the discussion of the influence of under-head temperature leads to the result that higher temperatures are increasing the risk. This, however, is based on the hypothesis that IGSCC is the predominant failure mechanism. The parameter stress is not included in the analysis, and no explanation for the assumption of higher susceptibility of the peripheral VHPs is given. Finally, a derivation of the risk to develop VHPC is given, relative to the Bugey-3 reactor (see table in chapter 1). For a number of reasons these estimates should not be adopted uncritically: 61 Surete Nucleaire 1991, Rapport de l'Inspecteur General pour la Surety Nucleaire 1. The failure mode has not been clarified unambiguously. 2. Even if IGSCC is assumed, important parameters like stress or primary water chemistry are not discussed. 3. The failure development does not necessarily lead to a detectable leak. The occurrence and detectability of a leak is subject to a number of eventualities (crack position in height and circumference, weld seam geometry, temporary closure of the leak by compressive stress and deposits). Thus, relating the risk to Bugey-3 is problematic, and more severe damage is possible in VHPs where no leaks have been detected. A detailed analysis of the failure kinetics is very difficult and would require a thorough examination of a large number of findings and sufficient statistics. French and Swedish analyses of early 1993 62 do not include new assumptions or considerations on the VHPC causes and mechanisms. After more thorough examinations of the cracked VHPs of Bugey-3 and 4, in France the hypothesis of stress corrosion cracking under high residual stresses, stemming from manufacture, as the cause of cracking is still adapted. The discussion above thus remains valid. 62. EDF: "La Cuve du Reacteur", undated; Vattenfall: "Ringhals 2 och 4 -Reaktortankar Spricktillvaxt i Styrstavsgenomforingar" GEK 4/93, 02/02/93) The establishment of crack growth rates eg "0.3-0.5 microns/hour at 315 C 63 in the Annual Report on Nuclear Safety for 1992 seriously suffers from the still not known exact failure mechanisms (the non-correlation between penetration ovalisation and crack findings eg remains to be explained). 63. EDF: "Surete Nucleaire 1992" Rapport de l'Inspecteur General pour la Surete Nucleaire, January 1993. The same holds true for the results Vattenfall obtained with regard to the cracks at the Ringhals units, 64 the calculated crack growths have been derived from data on steam generator tubing failure mechanisms, where different parameters apply. The French VHPC findings at considerably lower temperatures were not taken into account in these calculations. 64. Vattenfalls: "Ringhals 2 och 4 - Reaktorankar Spricktillvaxi i Styrstavsgenomforingar" GEK 4/93, 02/02/93. Currently, elasto-plastic stress analyses are carried out in France for the VHPs, with modelling both the manufacturing process and operational loads. In part, results for these calculations remain open, after simpler linear-elastic calculations were not successful. These recent analyses essentially give fracture-mechanical estimates of the residual life times of cracked VHPs. The analysis of the findings at the Ringhals reactors is done for axial cracks only, although the development of circumferential cracks from the closely spaced axial cracks is possible. The calculations do not include any correction of the stress intensity factors to account for the influence of adjacent cracks, leading to an overestimation of the VHP's resistance against crack propagation. Only stress corrosion cracking is assumed as the cause of crack growth, the possible combination with low cycle fatigue processes is not taken into account. Despite these overestimations a residual life time of only about 15,000 hours until a critical crack length would be reached (ie until possible rupture) was calculated for the 10.5 mm crack in VHP no 68 of Ringhals-2. This corresponds to about two years of operation and thus is shorter than typical inspection cycles, so that this calculated residual lifetime would not allow further operation of the plant according to conventional regulations. Therefore, for this finding a "realistic, best estimate" - analysis with a crack propagation speed lowered by a factor of 2.3 was carried out, leading to a calculated residual life time of 35,000 hours. The critical crack lengths obtained in France (eg 350 mm for axial cracks) and the derived residual life times appear to be too high and not conservative, also in comparison with the Swedish results. Therefore, a detailed analysis of the failure kinetics is not given here, as it would require a thorough examination of a large number of findings and sufficient statistics. II.4.1.2. Other Reactor Designs The damage already mentioned above in the VHPs of the VVER-2 at Rheinsberg - through-wall axial and far advanced circumferential cracks - at first sight also exhibited the characteristics of stress corrosion cracking (transcrystalline, branched cracks, 'fish eyes' in the microfractographic image).65 65. Muller F (1976): Schadensbericht SUS-Standrohre WWER-2, KKWR-WFC 22r76; NPP Rheinsberg It is noteworthy that the Rheinsberg VHPs are not made of Inconel 600 but of a Soviet austenitic stainless steel with different toughness-and corrosion-characteristics (a high alloy austenitic Cr-Ni-steel with addition of W and Ti), and that the outlet temperature of this PWR, which has been shut-down by now, was well below 300 C (261 C). Further damage analysis led to the hypothesis of low-cycle fatigue, coupled with accelerated crack growth due to the primary water chemistry conditions. The cyclic load of the weld was caused by thermopulsations and heat stresses.66 66. Energiewerke Nord; Kernkraftwerk Rheinsberg, Ruckblick auf 23 Jahre Betlieb; Informationsbroschure 5/91, 1991 First occurrences of VHPC were found in 1974/1975, initiating an inspection of all VHPs and replacement of those with indications. Furthermore, technological measures thought to counteract VHPC were introduced; in particular, injection conditions at the VHP that caused thermopulsations were changed and the VHP welds were replaced by flanges to reduce stresses. However, in 1984 VHPC occurred again, which was detected as a leak during operation, although the VHPs bad been annually inspected by eddy-current techniques until 1981. Again only the cracked VHPs were replaced, until in 1986/1987 all VHPs were exchanged with reusage of the upper and lower flanges.67 67. Giesler R (1990): 24 Jahre Kernkraftwerk Rheinsberg - Betrachtungen zum Anlagenzustand; Kernenergie 33 (1990) 3 VHPC at the units Novovoronezh-1 and -2 in the former Soviet Union was also attributed to thermopulsations due to injection of additional cold feed water. In contrast to current PWR designs, both reactors were not equipped with a spherical reactor vessel head but with a plain upper reactor plate with holes for the VHPs. Thus, asymmetric stresses in the welds of the VHPs that lead to VHP ovalisation were not present. VHPC at the experimental reactor at Kahl, FRG, (which is a boiling water reactor, in contrast to all other reactors considered here so far) occurred in most cases in the peripheral VHPs. Both stress corrosion cracking and stress oscillations due to temperature variations were considered as causes of cracking. Both mechanisms were not sufficient to explain the damage extent, and residual stresses probably present were also taken into consideration.68 68. Eltener, Rison (1973): Reparatur an den Steuerstabdurchfuhrungen des ReaktordruckgefaBes im Versuchsatomkraftwerk Kahl; Reaktortagung ù1973 Muller F (1976): Schadensbericht SUS-Standrohre WWER-2, RRWR-WFC 22/76; NPP Rheinsberg II.4.1.3. Conclusions on Failure Mechanism and Development The following conclusions may be drawn from the currently available data, which mainly refer to the VHP design of Westinghouse reactors but also explain the similarities with the above mentioned occurrences at other reactors: ù The failure mechanism currently cannot be considered as being conclusively analyzed. Intensive damage in defined regions of the VHPs is occurring. This damage does not necessarily lead to a leak that is detectable from outside the reactor, before.break occurs. If it does, it will be at its final stage of development only. ù Both axial and circumferential cracking is possible. Cracks may be isolated or part of a crack field, the latter being an indication of complex load structures. ù A description of the failure kinetics and a discussion of failure growth rates and failure probability is impossible due to the insufficient knowledge of the failure mechanism. ù A loss of stability can occur both as impairment of the guidance of reactor control rods (constriction, bending of VHP) and as rupture of the VHP (circumferential cracks developing between axial cracks, corrosive damage to the connecting weld). ù A loss of strength of the reactor vessel head cannot be excluded in the case of extensive uncontrolled corrosion Startling in the gap between VHP and vessel head. ù Due to the lack of knowledge on the causes of VHPC, its avoidance by constructive and/or technological measures cannot be guaranteed. II.4.2. Description of possible accident scenarios II.4.2.1. General aspects The damage mechanisms described above will now be discussed according to possible reactor safety consequences. The causes and the development of VHPC, and thus also the possible extent it can reach, have not yet been clarified in detail. Therefore, only qualitative considerations regarding accident scenarios are possible. Electricite de France officially considers two severe consequences resulting from a VHP leak as possible: ù corrosion of the exterior surface of the vessel head, which has no cladding, due to leakage of primary coolant containing boric acid. ù ejection of a control rod drive mechanism (CRDM).69 69. Mercier JP (1992): How EDF has coped with vessel head penetration cracking; Atom, May/June 1992 CRDM ejection is regarded as a possible consequence of a VHP break due to sudden growth of a circumferential crack. However, "it is thought that the absence of circumferential cracking can be explained by the orientation of the stresses in the crack region". Therefore, "CRDM ejection is considered to be impossible".70 This premature exclusion of the possibility of circumferential cracking has already been discussed in the previous chapter. 70 ibid. Generally, longitudinal cracks are regarded to be of little concern from a safety viewpoint. 71 As will be shown in the following, this evaluation, too, is not correct. 71. Mercier JP (1992): How EDF has coped with vessel head penetration cracking; Atom, May/June 1992 Penetration cracking found at Ringhals 2; Atom May/June 1992 Vessel head cracks at Paluel 4 .., Nuclear Engineering International, July 1992 Plant operators have not discussed the possible consequences of a failure of one or more CRDM because of VHP cracks and/or ovalisation of VHP tubes. Furthermore, the formation of a small leak in the primary circuit due to one or more breaks of VHPs can lead to a severe accident. This applies even if there is no CRDM ejection. In practice, it has to be assumed that several of the possible consequences mentioned will occur, which can be causally combined. It is conceivable that break of a VHP tube leads to failure of the CRDM arrest system. Ejection of the CRDM which is pushed upwards by the primary pressure in the reactor vessel may be hindered by additional systems now being installed in the latest French reactors. Nevertheless, a leak at the VHP will occur and CRDM operability will at least be seriously reduced. II.4.2.2. Leak in the primary circuit A leak can occur due to the formation of a through-wall crack in the VHP above the weld linking it to the vessel head. This was the case, for example, when the VHP crack was detected at the French NPP Bugey-3 (the leakage there was observed during pressure tests, and not during operation). Cracks through the VHP wall may not only occur during pressure tests, but also because of variations in primary pressure during operation. Crack growth generally proceeds in three phases: Crack initiation, stable crack growth, and instable crack propagation (break). The first two phases can occur during longer periods of time and remain local phenomena, affecting the immediate neighbourhood of the crack only. In the third phase, however, the crack propagates approximately with the speed of sound and penetrates the wall of the component. To trigger this phase, a short stress peak exceeding a critical value is sufficient. This critical value depends on shape and size of the crack. In the case of circumferential cracks, the tube then usually breaks into two parts. Longitudinal cracks can tear open over longer distances. In any case, the break can be accompanied by considerable plastic deformations (buckling of the tube). Fulfilment of the leak-before-break (LBB-) criterion implies that the second phase of crack propagation continues until the crack has penetrated the tube wall completely, without occurrence of a break, i.e., without the third, unstable phase being initiated. The leak thus generated will very likely be significantly smaller than the opening created by a break which can be as large as the cross section of the tube. It is assumed that these small leaks will be timely detected by leak detection systems and do not lead to severe accidents. Plastic deformations of the tube accompanying the propagation of a crack right through the wall increase the size of the leak. Furthermore, the leak will remain open even after primary pressure has been reduced. They can also impair the operability of the monitoring tube or CRDM in the VHP. In the case of VHPC, NPP operators assume that there are no circumferential cracks, and that the leak-before-break principle is definitely fulfilled. Both assumptions are not conservative and have already been discussed in the previous sections. Therefore, a conservative assumption of the leak size in case of a VHP break would be the size of the interior VHP cross section (nominal width 70 mm). Leaks of this or even considerably smaller size (from a width of about 15 mm upwards) in the primary circuit can lead to severe accidents. Furthermore, the same stress peak which causes failure of one VHP can also initiate unstable crack growth in other VHPs, leading to a leak size corresponding to several VHP cross sections. The occurrence of one (or several) VHP leaks during reactor operation corresponds to the accident categories small or intermediate leak in the primary circuit. Although these accidents are design basis accidents, due to unforeseen but not ignorable malfunction of safety systems or further component failures the possibility of a subsequent core melt does exist. The course of events following a small or intermediate primary circuit leak is complex, depends on many parameters and can vary from plant to plant. Therefore, it will be discussed in a short and summary fashion only. Increasing radioactivity outside the primary circuit and/or decreasing pressure in the primary circuit will signal that a leakage of primary coolant has occurred. The reactor will be scrammed, followed by activation of the emergency core cooling systems which serve to remove the decay heat being produced even after the chain reaction has stopped. The sudden ingress of large amounts of cold water (with temperatures below 60 C) into the reactor pressure vessel containing hot water (above 250 C) at high pressure results in an unstable regime with steam and water in the primary circuit. Depending on leak size, primary pressure may remain high for a longer period of time (HP-path), or may decrease rapidly (LP- path). The walls of the primary circuit, particularly the reactor pressure vessel wall, are subject to loads generated by internal pressure as well as by temperature gradients (thermal stress). These loads can lead to failure of further primary circuit components, followed by huge radioactive releases from the primary circuit and core melt. It has been attempted to determine the probabilities of primary circuit leaks as well as the conditional probabilities of a subsequent core melt with the aid of probabilistic risk analyses (PRAs) for nuclear power plants. Such PRAs have been performed in several countries in the last two decades. The results of an American, a French and a German 72 risk study, performed 1989/90, have been discussed and compared by Werner. 73 Reference plant for the French study 74 was a 900 MWe 2nd generation unit (series CP2). 72. Deutsche Risikostudie Kernkraftwerke Phase B; GRS-A- 1600; Gesellschaft fur Reaktorsicherheit; Koln; Juni 1989 73. Werner W (1991): Aktuelle Ergebnisse zu probabilistischen Sicherheitsanlysen; GRS-Fachgesprach 1990, atw, Marz 1991 74. Etude Probabiliste de Surete des Reacteurs a Eau sous Pression du Palier 900 MWe, Rapport de Synthese, lPSN April 1990 An investigation of the merits and shortcomings of probabilistic risk analyses lies outside the scope of the present study,75 as does a comparison of the design of the various reference plants. In what follows, results concerning primary circuit leakages only will be referred to and discussed. Core melt accidents following the LP-path can lead to late failure of the containment and comparatively low releases to the environment. Mechanisms leading to earlier containment failure and higher releases (for example, hydrogen explosion), however, cannot be excluded. The HP-path occurs if the size of the primary leak is not sufficient to reduce pressure. HP core melt will probably lead to early containment failure and rapid, high releases of radioactivity to the environment. Thus, the hazards associated with a primary circuit leak do not decrease with decreasing leak size. Measures of accident management (i.e. intervention of operating personnel into the course of the accident) are planned to prevent core melt or, if this is not possible, to at least transform HP sequences into sequences with low primary pressure. Those core melt sequences have been designated LP* 76. 76. Deutsche Risikostudie Kernkraftwerke Phase B; GRS-A-1600; Gesellschaft fur Reaktorsicherheit; Koln; Juni 1989 Regarding the transformation of HP- into LP*-sequences, it is assumed that the probability of correct intervention by the operating personnel (ie. all necessary measures, and no wrong measures are taken) is as high as 99%. (In some special cases, probabilities of 90 to 97% are assumed.) Because of the lack of detailed investigations, however, those probabilities are based on preliminary, rough considerations. Timely intervention in case of primary circuit leaks in most cases necessitates intervention within 30 to 135 minutes after occurrence of the leak. Cause and likely development of the accident have to be analysed within this short period of time, and the intervention strategy has to be selected and planned. Generally, human error is a risk factor not adequately taken into account in PRAs. The three risk studies analysed in Werner's contribution 77 in most cases include errors of omission only when estimating accident probabilities; errors of commission are usually not taken into account. "Analyses of incidents in the last years regarding the influence of human errors indicate, however, that wrong decisions of a serious nature in the control room, which can get the plant into a dangerous state, can have a probability of occurrence comparable to the probability of initiators of serious technical failures".78 The PRAs mentioned above therefore may significantly underestimate accident probabilities. 77. Werner W (1991): Akuelle Ergebnisse zu probabilistischen Sicherheitsanalysen; GRS-Fnchgesprach 1990, atw, Marz 1991 78. ibid. According to the German Risk Study, Phase B, 79 the overall core melt probability is 2.9 x 10-5 per reactor year. Without accident management, the fraction of the HP-path is 97%. If accident management is included un the study, as outlined above, overall core melt probability is reduced to 3.6 x 10-6 per reactor year, with HP-sequences accounting for only 12.5% of all core melt accidents. 79. Deutsche Risikostudie Kernkraftwerke Phase B; GRS-A-1600; Gesellschaft fur Reaktorsicherheit; Koln; Juni 1989 The French PRA 80 shows an overall core melt probability - for operation, and including accident management - of 3.2 x 10-5 per reactor year, the fraction of the HP-path being 18%. Without accident management, core melt probability is higher by a factor of 18, 81 and thus exceeds the limit of 104 proposed by IAEA for current reactors. 80. Etude Probabiliste de Surete des Reacteurs a Eau sous Pression du Palier 900 MWe, Rapport de Synthese, IPSN April 1990 81. ibid. Small and intermediate-size leaks in the primary circuit (excluding pressurizer and steam generator leakages) according to the German risk study 82 contribute 16% to the expected core melt frequency (without accident management). If accident management is included, this fraction is increased to about 45% - accordingly, almost half of all core melts to be expected would be initiated by such a primary circuit leak. 82. Deutsche Risilostudie Kernkraftwerke Phase B; GRS-A-1600; Gesellschaft fur Reaktorsicherheit; Koln; Juni 1989 According to the French study, 83 28% of all core melt events are initiated by small leaks in the primary circuit (including accident management). 83. Etude Probabiliste de Surete des Reacteurs a Eau sous Pression du Palier 900 MWc, Rapport de Synthese, IPSN April 1990 The probability estimates given here are beset with many uncertainties and are of very limited relevance. The interesting point, however, lies in the fact that although accident management is claimed to reduce overall core melt probabilities, the probability of a core melt due to a primary circuit leak is not reduced to the same extent. The chance to control primary circuit leaks through accident management is thus smaller than in the case of other accident categories; "the effectiveness of the measures is lower in the case of loss-of-coolant accidents...".84 84. Werner W (1991): Aktuelle Ergebnissc zu probabilistischen Sichcrneitsanalyscn; GRS-Fachgesprach 1990, atw, Marz 1991 II.4.2.3. Impairment of the reactor control system The consequences of a VHP leak can be enhanced if monitoring tubes or CRDM in the VHP tubes are impaired (common-cause failure). The control rods are the central part of the reactor protection system. In most pressurized water reactors, a rapid power decrease or scram can be achieved only by introduction of the control rods into the reactor core. The function of the CRDM is imperative in case of an accident. If it is impaired, new, unexpected accident sequences will develop. Heat production in the core can be higher than expected, and the possibilities for intervention of the operating personnel will be further reduced. This is of particular relevance for those reactors having a high proportion of MOX fuel (i.e. mixed oxide fuel containing both plutonium and uranium), because such a core leaves only restricted margins for reactor control anyway. A reduction of the ability to regulate the control rods, and thus reactor power, can also result from local deformation of VHPs by corrosion products between vessel head and VHP, as described above. This will not necessarily be accompanied by a primary circuit leakage, but can, however, lead to a severe reduction of the mobility of the control rod. It is possible that this impairment of reactor control will at first go unnoticed by the reactor operators, and will become apparent only as soon as changes in the reactor's operating regime become necessary (for example during ordinary start-up or shut-down procedures, or when reactor scram is initiated for some reason which may have nothing to do with primary coolant leakage). It is possible that a hidden CRDM failure will then have catastrophic consequences for the further course of events. Concerning reactor scram, all that is said in the German risk study 85 is: "The effects of reactor scram failure have not been investigated ... Such sequences are, from the viewpoint of their frequency, insignificant, they are pessimistically treated as core melt cases." 85 Deutsche Risikostudie Kernkraftwerke Phase B; GRS-A-1600; Gesellschafl fur Reaktorsicherheit; Koln; Juni 1989 II.4.2.4. Reactor vessel head failure As already discussed in the section on origin and development of VHPC, there may be corrosion of the ferritic vessel head material in the vicinity of one or several VHPs with through- going cracks without detect don by the leakage location systems. The resulting loss of strength of the material can proceed until the stability of the VHP mounting (weld plus squeezing of the VHP into the vessel head) is endangered. At the same time, ovalisation of VHPs above the weld can occur, leading to a local widening of the VHPs. Because of the weakened mounting and the deformations of VHPs, ejection of a CRDM cannot be excluded even in case of longitudinal cracks, particularly since plastic collapse of longitudinal cracks can lead to further VHP deformation. Since it is possible that several VHPs will have through-wall cracks, corrosion of the vessel head will not necessarily be limited to the vicinity of a single VHP. Simultaneous ejection of several CRDM, followed by global failure of the vessel head, has to be considered as the possible worst case. It has to be kept in mind that the perforations of the vessel head and the squeezing-in of the VHPs cause a very complex load structure in the vessel head material. II.4.2.5. Further hazards It is possible that parts of broken VHPs will fall into the reactor vessel, damaging the fuel elements in the core area and thus the integrity of the first protective barrier, the fuel rod cladding. This can lead to an uncontrolled, significant release of radioactivity from the fuel rods into the primary circuit. Falling down of lower VHP parts is also possible in case of a break below the weld - a region where cracks have already been found in. Such breaks do not constitute leaks of the primary circuit. Apart from the possible increase of radioactivity in the primary circuit, however, they could certainly lead to impairment of CRDM. It cannot be excluded that VHP break with a primary circuit leak is coupled with falling of VHP parts into the core. In this case, the first protective barrier (fuel element cladding) and the second protective barrier (envelope of the primary circuit) fail simultaneously. The last remaining barrier against radioactive releases into the environment would then be the containment. In order to counteract CRDM ejection, additional support systems are at present being installed in French reactors. It is not clear, however, if such systems are also planned in all potentially endangered reactors in other countries. Regarding the VVER-plants in Eastern Europe, Finland and the former Soviet Union, and the Westinghouse plant in Krsko, Slovenia, for example, no information bas yet been published on the plans of installing additional CRDM support systems. CRDM ejection after VHP break or failure of vessel head stability cannot be completely excluded. This accident sequence would combine all worst case assumptions discussed so far. Furthermore, if the ejected CRDM is not reliably held back by the anti-missile barrier which many plants have installed, it may damage the containment by its dynamic impact, thus impairing the integrity of the last protective barrier right at the beginning of the accident sequence. II.5. COUNTER-MEASURES ADOPTED II.5.1. Measures to repair VHPC One of the repair methods adopted so far has been localized erosive removal of the crack-affected material, as reported for Ringhals-2, Ringhals-3, Beznau-1. Due to the high worker doses that result from manual repair, several vendors have stated that they are developing remotely controlled repair equipment that could deliver repair tooling to the crack locations. Erosive removal, however, is always decreasing the wall thickness of the material, thus weakening strength reserves in the case of repairing small defects and being impossible for larger ones. Repair welding of VHPC has not been reported, this would probably lead to further weld residual stresses of uncontrollable patterns introduced into the VHPs. Replacing of penetrations that have been identified as being flawed does not solve the problem either. Extraction of a penetration out of its vessel head fixture is "a very delicate task, partly because the cylinders were originally shrunk-fit into place before welding, and the process must be reversed to remove them. Moreover, 59 of the 65 penetrations have thermal sleeves, which must be removed before the penetrations themselves can be extracted" 86 (quotation concerns Bugey-3, France). 86. Nucleonics Week, November 21, 1991 The situation again is further complicated by the high radiation doses involved in manual work on the vessel head, and also by the problem of insertion and welding in of a new penetration. Dissimilar welding (i.e. welding of two different materials) of a penetration to the aged and possibly corroded vessel head perforation is a "delicate task" as well, in particular because using Inconel 600 penetrations again would make little sense (a defective penetration at Bugey-3 was reported to have been replaced by a new one, 87 most probably made from Inconel 600). 87. Nucleonics Week, September 10, 1992 Consequently, EDF has announced it is planning to replace ali the reactor vessel heads of its older 6 CPO reactors and at least seven more, which appears to be the only option, especially in the light of the above measures being based on the questionable assumption that all cracks of concern are detected during inspection. The penetrations are to be made from Inconel 690 which is believed to be less susceptible to stress- corrosion-cracking (SCC). As long as the VHPC failure mechanism is not better understood, however, these costly replacements with Inconel 690 may turn out to be a mistake. II.5.2. Measures to prevent VHPC Measures to prevent VHPCs have been derived from the parameters that are thought to contribute to the formation of VHPC. One measure that has actually been implemented in some of the French 1300 MWe-PWRs and which was discussed at some stage in Sweden as well 88 is to lower the under-head temperature in the reactor vessel. According to a formula the French analysis came up with, crack propagation speed would increase fourfold with each 10 C rise in temperature. 89 By diverting a part of the cold leg inlet coolant into the upper reactor, it is possible to increase the temperature difference between out leg and underhead and thereby reduce the underhead temperature by 25 C in the French 1300 MWe-reactors (i.e. from 315 C down to 290 C). This, however, is accompanied by downrating the unit, according to an EDF official, "by a few megawatts".90 Lowering the under-head temperature, which involves only two days modification work for the French plants, has so far not been reported from other countries than France. 88. Nuclear News, September 1992 89. Nucleonics Week, January 23, 1992 90. Nucleonics Week, January 2, 1992 Another parameter thought to have played a role in the development of VHPC are stresses introduced into the penetrations by the welding process and the oval geometry of the weld seam. Reducing these stresses by shot-peening the penetrations would principally be possible and the same technique has been used already on steam generator tubes.91 However, robotic equipment would have to be developed for this technique to be applied under the vessel head due to the high radiation level, and the extent to which stresses are affected are unknown for the penetrations. So far shot-peening does not appear to have been applied in any plant. 91. ibid. For both temperature lowering and stress relieving measures it must be emphasized that the detailed failure mechanisms of VHPC have not yet been established sufficiently, and thus it does not follow that their implementation would necessarily prevent VHPC. Eg. the findings at the French Blayais reactor indicate that temperature lowering is probably not a suitable countermeasure. As it is commonly assumed that the susceptibility of Inconel-600 to VHPC (be it stress corrosion cracking, some other aging effect, or a combination) is a main cause of the problems with VHPC, measures like plating the Inconel 600 penetrations (e.g. with copper) 92 or sleeving them have been proposed to separate Inconel 600 from the primary coolant. This, however, would require extensive qualification and installation work if it were to be exercised on all Inconel 600 VHP to tackle the VHPC problem, and again the uncertainties due to lack of failure understanding would remain. 92. Nucleonics Week May 7, 1992 According to current knowledge of the problem; the most prudent way to encounter the VHPC problem therefore appears to be replacing of the vessel heads employing Inconel 600 penetrations by heads that have their penetrations made from a presumably more resistant material. A precondition to do so, however, would be the clarification of the VHPC failure mode to establish and qualify such a material. II.6. CONCLUSION When first reports on the occurrence of VHPC at the Bugey-3 reactor were circulated in late 1991, the international nuclear community disapproved of any safety implications for their reactors, and only when it became apparent after further findings that another generic flaw of a PWR design had been detected by chance did the problem raise concern in other countries. The findings at the French Blayais-1 unit in late 1992 dramatically enhanced the VHPC problem, as they give clear evidence that up to now the underlying failure mechanisms of VHPC have not been understood, and further incidences are likely to occur. Although all findings reported in the wake of the Bugey-3 incident have so far be restricted to those reactor designs employing Inconel 600 as the VHP base material and this material appears to be highly susceptible to VHPC, problems with other materials and reactor designs have occurred in the past and due to the lack of knowledge of the failure mechanism cannot categorically be ruled out. A number of highly necessary measures must be derived from the evidence gathered so far on VHPC and its safety implications: 1. Detailed examinations of the flawed components, analyses of loads, operating and residual stresseS and simulation experiments have to be carried out to arrive at an understanding of failure causes and kinetics of VHPC. 2. Non-destructive testing of all VHPs and the vessel heads of all reactors with penetrations made from Inconel 600 has to be performed immediately, using highly reliable evaluation techniques (e.g. a further developed and automated liquid penetrant test adapted to the penetration design). 3. In-service inspection of VHPs has to be regularly performed in all other reactor designs as well and thus included into their ISI programs. As long as these measures have not been implemented and a thorough analysis of the failure mode been established, measures like vessel head replacement material substitution or temperature lowering by down-rating cannot solve the problem and guarantee safe operation. This also means that the reactors at risk have to be shut down until measures based on an understanding of the failure mechanism have been derived. Consequently, the French approach to tackle the problem of VHPC by replacing the vessel heads at their older units may well turn out to be too short-sighted. Immense maintenance costs have been estimated for these measures, and with the daily cost of an unplanned outage being 100 to 200 million Frances to EDF, it is clear why EDF "is no longer trying to understand the (penetration cracking) phenomenon in detail" 93 and prefers to put its efforts into estimating crack propagation times to have reactors run even with proven VHPC. This approach has also been followed by Swedish Ringhals-operator Vattenfall, and there can be little doubt that similar stances will be adopted in other countries when the problem has been realized more widely. 93. Ibid. VHPC is another example of the growing plethora of material problems that the nuclear industry has been and still is facing, e.g. steam generator problems and replacements, massive boiling water reactor IGSCC, and also most recently intensive cracking in stabilized austenitic stainless steel tubing in German reactors. None of these hazardous problems were foreseen but rather ruled out, which not only shows that material and component characteristics for nuclear power plant applications have been grossly overestimated, but also reveals the highly dangerous state of health the nuclear reactor population has reached.