Resolution of Generic Safety Issues: Issue 188: Steam Generator Tube Leaks or Ruptures, Concurrent with Containment Bypass from Main Steam Line or Feedwater Line Breaches ( NUREG-0933, Main Report with Supplements 1–34 )
This issue was identified when it was believed1799 that the validity of steam generator (SG) tube leak and rupture analyses could be affected by resonance vibrations in steam generator tubes during steam line break depressurization. The concern is that an unisolable secondary system opening outside containment coupled with multiple steam generator tube leaks or ruptures could result in releases in excess of 10 CFR Part 100. The related technical issues include the ability to correctly predict SG secondary side thermal-hydraulic behavior, physical loadings, component response, resonance vibrations within the tube bundles, eddy current testing, iodine spiking, operator response, and risk. The issue is related to Issue163, “Multiple Steam Generator Tube Leakage.”
The issue raised the following two potentially risk-significant events that are not fully addressed as design basis accidents in FSARs, industry analyses, the SRP,11 or staff reviews:
(1) Operating experience and design information suggested that the potential existed for a line breach to significantly increase SG leakage, because resonant vibration of SG tubes from a secondary side blowdown could cause increased tube leakage.
(2) Significant SG tube leakage could lead to secondary system breaches from a variety of causes. The resulting SG secondary side blowdown could further increase tube leakage due to resonance vibration within the affected SG tube bundle.
Such leakages, concurrent with containment bypass, might cause offsite radiation doses in excess of 10 CFR Part 100.
Main steam line break and steam generator tube rupture (SGTR) are both included as design basis accidents in Chapter 15 of most FSARs and the SRP,11 and are addressed as accident initiators in most plant-specific PRAs. However, these accident initiators are generally assumed to occur independently unless there is severe core damage. Moreover, a SGTR is assumed to occur spontaneously in just one tube. This issue addresses the possibility of a causal relationship: a main steam or feedwater line break in an unisolable portion of the secondary system is postulated to cause a number of SG tubes to leak or rupture. Conversely, significant SG tube leakage or rupture is postulated to cause an unisolable secondary side breach which then may exacerbate the leakage.
Consequences of such an accident scenario are significant because primary coolant could be lost to the environment through the leaking or ruptured SG tubes and out the break in the secondary system. Given that the secondary side opening is outside containment but not isolable, the release of radioactivity could be above 10 CFR Part 100 limits, depending upon the iodine spiking factor and the duration of blowdown. Further, the escaping coolant will not be returned to the containment sump. There is a high probability that the ECCS will successfully mitigate a LOCA during the injection phase. However, when the refueling water storage tank (RWST) is depleted, it may not be possible to use the recirculation mode, possibly resulting in core damage. Because the release path is open to the environment outside of the containment, the release of radioactivity from the postulated core damage event could have significant risk impacts.
The issue also includes the safety concerns of increased risk from degraded operator performance because of environmental conditions that can occur during the event. Eddy current testing and iodine spiking issues were not originally identified but were included in this evaluation to provide more complete bases for understanding the safety concerns.
The accident scenario of concern consists of two events: (1) a non-isolable secondary system break or rupture that is outside containment; and (2) a coupling of this break with the rupture of, or significantly increased leakage from, affected SG tubes.
Non-Isolable Main Steam Line Break Outside Containment: Main steam line breaks (or equivalent ruptures in attached piping or equipment) may be caused by a combination of stresses from restriction of pipe thermal expansion by pipe supports, weld defects, lack of pipe stress relief, age-related erosion/corrosion, vibration-induced cyclic fatigue, or repeated safety valve operation causing fatigue cycles to the piping and tubes and increasing the likelihood of a safety valve sticking open. Relatively large steam line breaks have occurred outside the containment, upstream of the MSIV, during hot functional testing at Robinson 2 and Turkey Point 3. These resulted in collateral valve, piping, and equipment damage; blowdown of the affected SGs; and excessive cooldown of the RCS. In addition, large amplitude vibrations of components and structures, water hammers, and sonic booms that affected operator communication and actions were observed. The Turkey Point 3 event involved SG re-pressurization shortly after the initial blowdown as a result of collateral damage.
Other Secondary System Breaks: It is also possible to initiate the accident scenario of interest with breaks in other parts of the secondary system such as a main feedwater line, steam line supplying steam-driven auxiliary feedwater, or other steam supply lines. These would be considered within the scope of this generic issue. Main and auxiliary feedwater systems generally have check valves located inside containment, which may also fail during the event. Steam supply lines other than main steam will have their own isolation valves, and because of their smaller diameter, rupture of these lines may not cause as severe a blowdown transient. However, a smaller opening may create resonance vibrations in the affected SG that would continue for a longer period of time.
Steam Generator Tube Cracks and Test Data: PWR SG tube cracks are caused by such common-mode failure mechanisms as outside diameter stress corrosion cracking, primary water stress corrosion cracking, fretting and wear, high cycle fatigue cracking, denting, pitting, and wastage. Plant TS require that a 3% sample of SG tubes undergo NDE periodically. The percentage of tubes inspected increases as more indications are found. Existing regulatory guidance would require tubes with greater than 40% through-wall cracks to be repaired or plugged.
Eddy current testing has a variable probability of detection that depends on: the type of probe; crack width, depth, length, and orientation; background interference; and human error. While crack depth and length are the most important factors in determining SG tube integrity, accurate crack sizing by non-destructive means (eddy current, ultrasonics, etc.) remains challenging. Therefore, operation will likely occur with some degree of tube degradation at all times.
The NRC has approved several alternate repair criteria allowing small cracks to remain in service under certain conditions. Under the alternate repair criteria in Generic Letter 95-051804 for outside diameter stress corrosion cracks in intersections between tubes and tube support plates (TSPs), the industry must leak and burst test tube samples. However, the tubes are rigidly held in place during testing to avoid bending that would increase crack size. Tubes are tested under static conditions not subject to vibration and TSP movement that could be encountered during a main steam line break from differential pressure loadings and from vibrations at their lowest natural frequencies. Leak tests are not required to be performed at operating temperatures.
Resonance Vibrations: Resonance vibrations caused by a line break may develop in the SG internals through pressure pulses in the two-phase fluid and from pipe movement. Free span sections of tubes, portions of TSPs, and the U-tube assembly would vibrate from excitation frequencies emanating from the break. The tube/TSP movement from pressure pulses, resonance vibration, and potential steam chugging from possible recriticalities could destroy links between existing micro and macro cracks in SG tubes. Further, there has not been an integrated study of actual damage done to adjacent SG tubes following SGTRs, from steam line breaks, or from SG dry outs.
Neither resonance vibrations nor cross-flow forces can be calculated by the one-dimensional, RELAP thermal-hydraulic code. EPRI has developed multi-dimensional two-phase flow codes that are applicable only to steady-state conditions. The ACRS Ad Hoc DPO Subcommittee on SG integrity issues concluded1800 that:
“... thermal-hydraulic codes usually employed by the staff for safety analyses are poorly suited to address the issues raised by this contention. The Subcommittee urges that investigation of this issue be completed expeditiously.” ( p. 10)
NRR’s reviews in this area were consistent with the ACRS conclusion, since NRR has not relied upon licensee justifications based on such codes for SG secondary side analyses.
Tube Sheet Cladding Separation: Tube sheet cladding separation by the flow divider and cracks in first row tube welds and cladding may have occurred due to excessive primary-to-secondary tube sheet differential pressures during the primary system hydro at Robinson 2. The differential pressure across the tube sheet at Turkey Point 3 during its cold hydro was what could be expected from high head safety injection during main steam line break or stuck-open safety or atmospheric dump valve events, but this also caused cladding separation. Tube, tube sheet, and cladding stresses due to differential primary-to-secondary pressure and vibrations have not been modeled in an integrated risk assessment of a main steam line break.
Analysis and Understanding: The Ad Hoc DPO Subcommittee recommended1800 that:
“Risk analyses that the staff considers need to account for progression of damage to steam generator tubes in a more rigorous way.“ They “... found that the staff did not have a technically defensible understanding of these processes to assess adequately the potential for progression of damage to steam generator tubes. Bending and flexion of the tubes produce conditions regarding crack growth, tube leakage, and tube burst outside the range of analyses and experiments done by the staff.” (p. 46) They concluded that the contention, “Depressurization of the reactor coolant system during a main steam line break will produce shock waves and violent, sympathetic vibrations that will cause cracks to form, to grow and to unplug, leading to much higher leakage from the primary-to-secondary sides of the reactor coolant system than has been considered by the NRC staff... has merit and deserves investigation.” (p. 10) The Subcommittee concluded that “... there is an imperative for the staff to act expeditiously to develop a much better understanding of the dynamic processes associated with depressurization and how the processes could lead to damage progression.” ( p. 46) “Similarly, the Ad Hoc Subcommittee did not feel that the staff had developed an adequate understanding of how movement of the tube support plates during an event could damage the tubes and augment leakage from the primary side to the secondary side of the reactor coolant system. The staff needs to develop an understanding of how tube support plate movement could lead to unplugging of cracks occluded by corrosion products in the annular space between the tube support plate and the tubes.” ( p. 46) Also, “... the Ad Hoc Subcommittee has concluded that the staff has not adopted a technically defensible position on the choice of the iodine spiking factor to be used in the analysis of design basis accidents for compliance with the requirements of 10 CFR Part 100 or General Design Criterion (GDC) 19.” (p. 48)
Operator Actions: The NRC has used estimates as low as 10-3 as the probability of the failure to depressurize and cool down the RCS in risk analyses of these containment bypass scenarios. The human error contribution to the estimated increment to core damage frequencies per year in these scenarios ranged from 29% to 93%. Operators have to identify the ruptured SG in order to isolate it, while primary and secondary temperature and pressure changes mask the diagnostic evidence they need to do so. There have been 10 SGTRs (or significant leaks) in U.S. PWRs from 1975 to 2000. Human performance weaknesses, such as mis-diagnoses, substantial delays in isolating the faulted steam generator, and delayed initiation of the residual heat removal system, have been identified in these events.1801, 1802 The events also involved unnecessary radiation releases, lack of RCS subcooled margin, excessive RCS cooldown rates, and overfilling the SG because of human or procedural problems.
The probability value can be significantly higher than 10-3 when performance shaping factors are incorporated for SGTRs concurrent with containment bypass based on operator performance as well as simulator experience. While one risk analysis that addressed a stuck open relief valve has a success path involving gagging the valve, this may be unrealistic given potential galling of the internals, steam release at the valve location, and the high radiation field at the valve created by a large tube leak. Additional complications would add to operator burdens. These include high noise levels preventing normal communications; RCS cooldown with potential recriticality; actions to recover RWST inventory; many radiation alarms, unexpected high radiation areas in the turbine building, and atmospheric releases; fire alarms and fires from steam and shrapnel from the break; and emergency communications with local, state, and Federal governments diverting operations personnel before the technical support center is manned or additional operations personnel arrive on site. The Halden Control Room Staffing study found poor operator performance in one of two simulations of a SG leak with a failed open SG safety relief valve, as well as simulations where crew size was decreased to attend to other duties.1803 A model exists based on this simulation, but it has not been used in a sensitivity study to more accurately predict a probability of failure to depressurize and cool down the RCS under these circumstances.
The Ad Hoc DPO Subcommittee concluded1800 that:
“... the [human performance] failure probabilities can rise from 10-3 to ~1, depending on the number of failed steam generator tubes.” They also said that “Risk evaluations should also include examination of the mechanisms for damage progression, which has not been observed in steam generator tube rupture accidents to date, but may occur as a result of dynamic processes during main steamline break depressurizations of the reactor coolant system. The effects of the dynamic events on operator performance both with respect to the time available for required responses and the level of operator distraction need to be evaluated.” (p. 20) “In all cases, the staff needs to develop defensible analyses of the uncertainties in its risk assessments, including uncertainties in its assessments of human error probabilities. As the staff develops a better understanding of the dynamic processes associated with depressurization during a main steamline break, it may want to revisit estimates of operator error probability in light of the considerable operator distraction that might occur during such events.” (p. 47)
The staff found that the accident scenarios were credible, and that the issue could not be addressed by the enforcement of existing regulations. Therefore, it was concluded that a technical assessment should be performed on the issue, in accordance with NRC Management Directive 6.4. Following the technical assessment, the issue was closed with no changes to existing regulations or guidance.1870 In a followup review, the ACRS agreed with this conclusion.1871