Resolution of Generic Safety Issues: Item A-37: Turbine Missiles ( NUREG-0933, Main Report with Supplements 1–34 2)
The staff has long recognized that the steam turbine, part of the turbinegenerator set, has the potential to generate massive, energetic missiles if a turbine disc were to fail catastrophically. The turbine disc is postulated to fail in two modes: normal operating speed failure and destructive overspeed failure. Turbines fabricated without shrunk-on discs, such as Brown-Boveri units, are thought to have a significantly lower potential for missile generation and, thus, are not included in this generic issue.
In the first failure mode, a disc was postulated to fail due to fatigue crack growth. In the second failure mode, the disc was postulated to fail when the applied loads exceeded the ultimate tensile strength of the disc material. This failure mode will occur when, upon sudden unloading of the generator, the turbine overspeed protection system and/or the turbine stop and control valves fail causing the turbine to reach the destructive overspeed. In plant safety analyses, it is assumed that the largest (most energetic) disc would fail.
More recently, the staff has discovered that, for Westinghouse-designed turbines, at normal operating speed the more likely failure mechanism is that of corrosion assisted crack growth. Although this failure mechanism would lead to an increase in the historically observed frequency of disc cracks, the imposition of a periodic ultrasonic inspection should leave the historically observed failure/missile frequency unchanged. This item is documented in NUREG-03712 and its evaluation includes the consideration of Item A-32.
If a turbine disc were to fail and if a large portion of the disc, possibly weighing a few thousand pounds, were to be ejected from the turbine casing, it would be possible for the turbine missile to strike and cause damage to components or systems that might possibly result in the release of radioactivity to the environment.
The original task action plan was set up as a confirmatory research program, i.e., the results would be compared to the existing very conservative licensing acceptance criteria to demonstrate analytically the adequacy of the criteria. When the problem of corrosion cracking became known, the staff instituted an investigation into its cause, safety significance, and effect on current licensing criteria. Although the action plan was never completed, the staff did investigate the corrosion cracking phenomenon thoroughly.
On plants with a construction permit submitted after November 15, 1976, NUREG-080011 requires that turbines be favorably placed to reduce to a minimum the probability of low trajectory turbine missile strikes. Where site restraints make this placement impossible, target size, shielding, or redundancy may be employed so as to reduce the combined probability of missile strike and damage of safety-related targets to less than 10-3. Therefore, this issue only applies to backfitting current plants.
(1) The historical failure rate of turbines15 is applicable. This failure rate is based on non-nuclear steam turbines; however, statistically, there are not yet enough operating years in nuclear applications to refute this assumption.
(2) The probability of a missile penetrating a barrier is 1.
(3) The probability of a missile causing unacceptable damage and subsequent radioactive release after the missile has struck a safety-related target is 1.
(1) Historical failure rate and rate of missile ejection from the turbine is 10-4/turbine-year.15
(2) Probability of safety-related target being in the target zone is 10-1; this probability is turbine orientation dependent. The value of 10-1 is the upper bound, the median value would be about 10-2.
(3) Probability of unacceptable damage and radioactive release is 1.
Thus, total frequency is (10-4)(10-1)(1)/turbine-year or 10-5/turbine-year.
A realistic estimate of a radioactive release to the environment would not be from a core-melt but rather from a gap release. The probability of 10-1 is much too high to assume that a turbine missile destroyed enough safety-related systems or components to cause a core-melt. The probability of the missile piercing the containment and causing a LOCA would be on the order of 10-5 not (10-1)(1) as previously assumed.
The consequences of the most likely release would then be on the order of 75,000 man-rem for a PWR-8 release category and 20 man-rem for a BWR-5 release category (based on WASH-140016).
If the total frequency is greater than 10-6/turbine-year, the staff solution was to try to better estimate the frequency/probability, that is, to determine what the realistic values of frequency are by taking into account improved disc materials, actual ejection probabilities and energies, actual likelihood of damage, effect of routine inservice inspection, etc. About half of the plants (30 PWRs and 20 BWRs) have turbine orientations where the total frequency is greater than 10-6/turbine-year. The cost to the NRC of the generic and plant-specific study would be about $80,000. The cost to industry is assumed to be at least double the NRC cost. The cost of the routine inservice inspection is about $250,000/plant.
Another possible solution would be to build missile barriers around the turbine with a cost to industry of at least $1M/plant.
The value/impact score is based upon 22.5 man-rem public risk exposure for the 30 PWRs and 0.04 man-rem public risk exposure for the 20 BWRs, utility costs of $20.5M, and NRC costs of $80,000. Therefore,
The calculated value/impact score is the upper bound value. Using engineering judgment, the total frequency could easily be two orders of magnitude less if more realistic assumptions of the components of frequency are made. The numbers used in the score are those used in historical arguments. Therefore, the score is probably less than 1 with an upper bound of 800.
(1) Although occupational dose incurred as a result of the routine inservice inspection would exist only at BWRs and would be minimal, the estimated dose avoidance would be reduced if both public and occupational exposure are considered. Thus, an even lower value/impact score would be indicated.
(2) Plant safety systems are redundant and should be capable of compensating for one being damaged by a turbine missile.
This issue should be DROPPED from further consideration.