Resolution of Generic Safety Issues: Issue 195: Hydrogen Combustion in BWR Piping ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
The issue of potential hazards from combustible gases was raised1822 after two events involving hydrogen combustion occurred within 2 months in late-2001 at two foreign BWRs. Both these events involved sudden rupture of the pipe segments of the RCS by detonation of radiolytic hydrogen. The first event occurred on November 7, 2001, at Hamaoka Unit 1 (BWR-4) and involved rupture of the RHR steam condensing line during a routine surveillance testing of the HPCI system. In the second event on December 14, 2001, at Brunsbuttel, a segment of the head spray line was destroyed. The two reactors were designed by NSSS vendors other than GE. Both these events were reportedly caused by ignition of combustible H2-O2 mixture generated by radiolysis of steam/water.
In the past 2 decades, additional events involving hydrogen combustion have occurred at other foreign BWRs. Furthermore, there have been relevant events at foreign non-LWRs. Some of these events also involved personnel injury.
A few hydrogen combustion events associated with the primary reactor coolant system have also been reported at US LWRs; however, there were no significant consequences because of the plant conditions and/or timely counteractions. Some events at US reactors ranged from small hydrogen fires, with no personnel injury, to spillage of primary reactor coolant. In a handful of events, personnel escaped without significant injury and/or contamination. For instance, an event at a US PWR involved hydrogen ignition in the high pressure injection line on the cold leg of the RCS due to welding activities in the vicinity. The plant licensee promptly reported this occurrence to another plant licensee where similar piping weld repairs were being performed, thus preventing a similar occurrence. In another event, personnel error caused hydrogen seepage into a plant's air system while the plant was in a refueling outage. This condition persisted for a couple of hours before the plant personnel realized their error.
Over the years, several fires involving generator hydrogen and the hydrogen storage systems have been reported at US and foreign reactors. In the early 1990s, the NRC had reviewed such events while studying GSI-106, "Piping and the Use of Highly Combustible Gases in Vital Areas." The scope of GSI-106 included evaluation of risk from: (1) the storage and distribution of hydrogen for the volume control tank (VCT) in the PWRs and the main electric generator in the BWRs and the PWRs; (2) other sources of hydrogen such as battery rooms, the waste gas system in PWRs and the Off-gas system in BWRs; and (3) small portable bottles of combustible gases used in maintenance, testing, and calibration. The risk from large storage facilities outside the reactor, auxiliary, and turbine buildings was addressed separately and was not within the scope of GSI-106. In the evaluation of GSI-195, it was presumed that, since the VCT and the generator are not located near the reactor and primary coolant system piping, the risk from hydrogen fires or explosions would not lead to pipe breaks resulting in the LOCAs, ATWS, and steam generator tube ruptures. Additionally, that scoping analysis did not consider the effect of hydrogen explosions on barrier walls and penetrations, such as doors between the turbine building and the adjoining reactor, control, and auxiliary buildings for the two BWR-3 and four BWR-4 considered therein.
On October 25, 1993, the NRC issued Generic Letter 93-06 1547 to inform US licensees of the technical findings from the NRC's resolution of GSI-106, with the expectation that the recipients would review the information for applicability to their facilities and consider actions.
An exhaustive review of foreign and US reactor operational experience review revealed a number of significant events as precursors with potential consequences on plant safety. These events affected both BWRs and PWRs.
The regulators of the two countries where the 2001 hydrogen explosion events occurred released reports which apprised other regulators of their event investigation, analyses, and lessons learned. Follow-up actions taken by the foreign regulatory agencies, the NRC, and the industry are summarized below.
NRC Generic Communications: After the two most recent foreign events, the NRC issued two Information Notices1823 to inform the US licensees of the events and the associated safety concerns. Prior to this, the NRC had issued IE Bulletin No. 78-03121 and Information Notice No. 89-441552 on the potential hazards of combustible gases. The issue of air/steam/gas-binding of pumps in safety systems has been examined in detail by the NRC and documented in the following AEOD reports: C404637; E2181817; E325636; E9101830; T5151831; and T9271832. Via the NRC communications, US licensees were notified of the potential hazards of entrapped gases in safety system piping and other components. The licensees were cautioned against accumulation of combustible gases to explosive levels, and were advised that should there be a possibility of the presence of a combustible mixture to take the necessary precautions to prevent hydrogen ignition, especially when conducting maintenance activities. Some of the US events and/or generic safety studies were also the subjects of the Nuclear Energy Agency/International Atomic Energy Agency Incident Reporting System (IRS) to share the safety concerns and potential risk with the worldwide nuclear community (e.g., IRS 0001023).
GE Nuclear Energy (GE-NE) Initiatives: On November 20, 2001, GE-NE issued Rapid Information Communication Service Information Letter (RICSIL) No. 85, "HPCI/RHR Steam Supply Line Rupture," to advise the GE BWR owners of the Hamaoka-1 event. This RICSIL contained a brief event description and the information publicly available at the time. It identified the piping systems susceptible to accumulation of non-condensible gases and recommended necessary actions. The RICSIL indicated that, in April 2002, the Hamaoka plants staff had established the cause of the pipe rupture as a result of the accumulation and ensuing detonation of radiolytic gases. This communique briefly discussed similarities between the two events and, based on its assessments of the available information, agreed with the parent utilities' determination of the root cause of the events being hydrogen explosion, as also confirmed by the estimates of the energy releases associated with the event that detonation of a stoichiometric mixture is the most plausible cause. On June 14, 2002, GE-NE issued Services Information Letter No. 643, "Potential for Radiolytic Gas Detonation." In addition to Hamaoka, this SIL advised the GE BWR and ABWR owners about the December 2001 event at Brunsbüttel.
A GE Pipe Rupture Task Force evaluated the two foreign events and concluded that probability of similar events in GE BWRs, while small, cannot be completely precluded. No plant design deficiencies were identified. GE-NE recommended that the GE BWR and ABWR owners consider the following: (1) review piping systems to identify any potential vulnerabilities for accumulation of radiolytic gases; (2) assess detonation potential of vulnerable piping; (3) consider design or system operation modification(s); and consider the potential for accumulation and detonation of radiolytic gases.
The Task Force concluded that there are no design deficiencies in the GE BWRs or ABWRs. GE-NE identified the susceptible piping configurations as those which: (1) are stagnant during normal plant operation; (2) are not continuously or periodically vented or purged; (3) are connected to the steam-filled areas of the NSSS; (4) are lines isolated from higher pressure systems by a potentially leaky valve; (5) can allow accumulation of non-condensible gases; and (6) have continuous steam condensation and drainage. For the combustible gases to detonate, the hydrogen content has to be greater than 15 v/o, with fluid temperature greater than 500oF.
GE-NE also evaluated consequences of potential hydrogen fires and subsequent pipe ruptures. In June 2002, it presented its findings to the staff. GE had estimated that the detonation over-pressure (i.e., the pressure developed during detonation) is dependent on the piping geometry, and from1000 psi can increase locally by a factor of 17 to170. GE also performed a risk assessment by considering H2-O2 detonation as the initiator of a small- to medium-break LOCA, and concluded that the incremental CDF for the GE BWRs is 10-6, the base CDF being 2 x 10-5.
BWR Owners' Group (BWROG) Initiatives: In 2002, the BWROG formed the Hydrogen Accumulation Committee to provide detailed guidance to BWR utilities for identification, disposition, and mitigation of potential radiolytic H2-O2 accumulation in plant piping and equipment. In November 2002, the BWROG provided the Committee's guidance document, "BWR Piping and Component Susceptibility to Hydrogen Detonation," (GE-NE-0000-0007-4008-01, Revision 0, Class I) to US utilities and the NRC. This communication indicated that one risk-significant characteristic - the presence of RHR steam condensing mode valves and piping - was not present at many US BWRs, and many had eliminated that feature. RHR steam isolation valve leakage either had not been a problem or had been corrected or mitigated. The Hydrogen Accumulation Committee sought input from GE and the foreign utilities, and provided detailed guidance to the BWR utilities for identification, disposition, and mitigation of potential radiolytic H2-O2 in plant piping and equipment. The BWROG surveyed the US utilities for the vulnerabilities, including those similar to the two foreign BWRs, and issued an interim status report on the licensees' responses.1829 The Committee identified the significant plant equipment that was vulnerable to H2-O2 accumulation; surveyed its members to identify the plant areas with the greatest potential for H2-O2 accumulation, and actions taken to address this configuration; reviewed the recommendations in Generic Letter 91-181828 (including Revision 1) to ensure that operability with respect to hydrogen accumulations is properly addressed; and developed the guidance document (GE-NE-0000-0007-4008-01, Revision 0, Class I) for identifying equipment subject to hydrogen accumulation and potential rupture, as well as short- and long-term mitigation strategies. This guidance was endorsed by BWROG members.
The conclusions based on evaluation of hydrogen build-up rates and survivability of components and piping, as documented in GE-NE-0000-0007-4008-01, were as follows:
when non-condensibles accumulate, the pipe temperature decreases to the saturation temperature of the steam partial pressure, which decreases with time;
larger diameter pipes take longer for radiolytic gases to accumulate;
condensate pots with piping configurations that result in temperature below 467oF need further analysis;
carbon steel piping and higher operating temperatures and pressures are more susceptible than stainless steel piping or lower operating temperature and pressures; and
larger diameter piping will generally fail from detonation when operating near reactor temperature pressure and temperature.
Subsequently, the BWROG conducted a survey of all the utilities regarding the action taken at each of the operating 34 BWRs to address the hydrogen accumulation and potential pipe rupture situations. On August 4, 2003, the BWROG forwarded the survey results to the NRC highlighting the following findings: (1) all had reviewed the available literature; (2) half had evaluated the susceptible piping; (3) some had completed and others were continuing risk assessment of plant equipment; (4) less than half the plants had performed physical walk-downs; (5) 20% had reviewed the plant drawings; and (6) half had identified potentially vulnerable equipment and are pursuing solutions to address them.
Safety Significance
Under some circumstances, an hydrogen explosion in the primary system piping and equipment could lead to an "unisolatable" LOCA. The effect on BWR plant safety of a hydrogen detonation, such as those discussed above, is to either cause a pipe break or damage an SRV. In either case, the effect is to cause a loss of coolant from the primary system, but the mechanistic effects are somewhat different, and the two effects will be treated separately. Additionally, there have been some instances of personnel injury and fatalities stemming from hydrogen explosions. These, however, have not posed significant risk to the public, but instead are of significance for occupational safety and health.
Regarding detonations which rupture pipes, all of the events which have happened thus far have been in locations where the break was isolated, thus limiting the loss of coolant inventory. However, a break in a location which cannot be isolated, or a failure to isolate, would result in a LOCA.
Based on the actual events, such a loss of coolant accident is not likely to be a large design-basis LOCA, since the stagnant "dead end" locations where the combustible gases can accumulate are not large pipes. However, it is quite conceivable that such a detonation-induced pipe break could result in an intermediate-break "S1" LOCA. In reality, of course, a smaller break would be expected to be more likely than a larger break, but for generic issue screening purposes, it will be assumed that a detonation-induced pipe break, if not isolated, will result in an intermediate-break LOCA.
Regarding detonations which occur in SRVs, the effect has been to damage the valve such that the valve opens and remains open, blowing down the primary system into the suppression pool. (In addition to the SRVs in the main steam system, there are safety or relief valves in the liquid-filled systems, such as LPCI and LPCS as well. Failure of these valves may also have potential for coolant loss. However, these valves are separated from the primary system by isolation valves, and failures of these valves will be included as part of the pipe burst accident sequences.) The inadvertent opening of an SRV (IORV) is normally treated as an anticipated transient, since this is not a rare event.
ANALYSIS
Frequency Estimate
The history of these hydrogen detonations suggest two slightly different initiating events. The first is a detonation which causes a pipe to burst. If the resulting leak is not isolated, this will cause a LOCA, as described above. The second initiating event is a detonation within an SRV or its associated inlet piping, which causes the valve to jam open. The resulting loss of coolant will not be isolatable. Initiating event frequencies will be estimated for both of these events.
Pipe Breaks: The severity of combustible gas detonations is likely to vary widely, from mild "pops" to events sufficiently violent to cause damage. The milder events may well not be detected, or may be attributed to other possible causes such as loose parts or water hammer. Thus, the frequency of detonations is difficult to estimate. However, the frequency of those events sufficiently severe to cause pipes to burst can be estimated more directly, since these events are not likely to be missed. Thus, the frequency of a detonation-induced pipe break can be estimated directly from the actual experience.
Based on a private communication with the IAEA, the overall BWR operating experience (as of mid-2003), foreign plus domestic, was 27,900 reactor-months, or 2,325 BWR-years. The event descriptions in the various databases were sometimes somewhat ambiguous, but there were two events which definitely caused pipes to burst, plus one more that may have done so. It will be assumed that three "pipe burst" events had taken place in 2325 RY, so the frequency of detonation-induced pipe breaks will be assumed to be approximately 1.3 x 10-3 event/RY. (This estimate was given to two significant figures only to aid in following the calculations. It was not intended to imply that the frequency is known to such accuracy, as will be shown below.)
For an uncertainty estimate, standard "counting" statistics will be used. The standard deviation of such an estimate is just the square root of the number of events, or 1.7 in 2325 RY.
SRV Failures: Again, there is some ambiguity in the event descriptions, but there was definitely one event where a detonation apparently caused an SRV to fail open and cause a system blowdown. There was a second event where a detonation appeared to have caused an SRV to fail open, plus at least one more event where a detonation apparently caused a blowdown in conjunction with ADS testing. Thus, it was assumed that three events have taken place. Such an event results directly in an intermediate-break "S1" LOCA, as described above. Again, three events in 2325 RY implied an initiating event frequency of 1.3 x 10-3 event/RY. However, because of the ambiguity in the number of events, a standard deviation of 2.7 was used this time to account for both the statistical uncertainty and the uncertainty in the number of events.
Failure to Isolate: The likelihood of the coolant leak not being isolated, either because of a location which has no isolation valve, or because of damage to or failure to close an isolation valve, is more problematic. In all of the known events, the leak was isolated. (This does not apply to the SRV failures.)
The isolation valves in question are generally check valves or motor-operated gate valves, and there are usually two in every fluid-carrying line that penetrates the primary system. Normally, the likelihood of isolation failure would be quite low. However, an examination of piping and instrumentation diagrams for some plants has shown that some locations do exist where a break could not be isolated, e.g., lengths of pipe on the primary system side of isolation valves. Moreover, there is also some possibility that the detonation itself could damage the isolation valves. Thus, it is known that this likelihood is not zero.
The fact that a number of events have happened with no instances of non-isolation, does allow some inferences to be drawn. Obviously, as the number of events with successful isolation goes up, the more confidence there is that the fraction of non-isolatable events is small. This can actually be quantified. For a confidence interval of 95%, if the number of events is n, and the fraction of events where isolation is not possible is x, then
That is, for n events with successful isolation, to 95% confidence, the likelihood of non-isolation is less than the limit given by this equation. For three pipe burst events, this works out to an upper limit of about 63%.
This is, of course, just an estimate of a high percentile, not an estimate of the actual likelihood of non-isolation. Given that all events were in isolatable locations, the data would give a "best" estimate of zero for this likelihood. However, an examination of some plant drawings has shown that there are locations where there is either no isolation valve or both isolation valves are normally left open or have leaked. Thus, from engineering knowledge, it is known that this likelihood is greater than zero.
Given the lack of any further information, it will be assumed that the likelihood of non-isolation is described by an exponential distribution. The equation for this distribution is:
The standard deviation will be chosen such that the integral of this distribution from zero to x = 0.63 is equal to 95%:
A value of = 4.76 will set this integral equal to the desired 95% at x = 0.63, to match the 95th percentile point estimated from the data. This is, of course, a great deal of mathematical inference to be based on a rather meager three data points, and a "sanity check" is very much in order. For an exponential distribution such as this, the mean is just the reciprocal of the parameter :
Thus, the distribution has a maximum value at zero (i.e., zero non-isolatable piping), a mean of 21%, and a tail such that the 95th percentile is reached at a fraction of non-isolatable piping of 63%. This is, of course, an educated guess, not a rigorous inference from experimental data. These numbers will be used because, after an examination of some piping diagrams, they appear reasonable, particularly the 21% mean fraction of piping that is not isolatable. (The numbers are given to two significant figures for the benefit of those who wish to follow the calculation, and are not intended to imply any degree of accuracy.)
Core Damage Frequency: To estimate the core damage frequency associated with pipe breaks associated with these hydrogen detonations, the NUREG-11501081 PRA for the Peach Bottom plant was chosen, primarily because of its availability in the SAPHIRE code package. Two separate calculations were done, one for the SRV blowdown and one for a burst pipe that is not isolatable.
SRV Blowdown: The uncontrolled blowdown of the primary system through an SRV that has failed open is an anticipated transient, and has resulted from causes other than a hydrogen detonation. In terms of a standard probabilistic risk analysis, this scenario affects the safety profile of the plant in three different ways. First, as is the case for any transient, there is always some probability of severe core damage if enough systems fail. Second, an SRV blowdown is an intermediate-break LOCA. Third, the IORV event is a classic ATWS scenario.
The NUREG-11501081 Peach Bottom PRA "T3C" event tree is initiated by an IORV event, and is linked to subtrees for transient, LOCA, and ATWS scenarios. The SRV blowdown scenario for this generic issue was analyzed by setting the initiating event frequency to 1.3 x 10-3 event/RY, as discussed above, and calculating the various end state frequencies. The calculations were done using 10,000 samples and standard Monte Carlo uncertainty analysis techniques, and a truncation level of 10-10 event/RY.
Although the event trees contain sequences that end in plant damage states PDS-6 and PDS-7, which would involve large early releases, none of these sequences passed the 10-10 truncation threshold, and thus are not counted. The remainder of the sequences that led to core damage were as follows:
| SRV Blowdown Scenario | |||||
|---|---|---|---|---|---|
| Sequence | Point Estimate | Mean | 5th percentile | Median | 95th percentile |
| All core damage sequences (CDF) | 1.1 x 10-7 | 1.5 x 10-7 | 7.6 x 10-9 | 7.3 x 10-8 | 4.8 x 10-7 |
There is no one highly-dominant sequence, but the majority of the dominant sequences involve the LOCA event trees. The low result is not surprising in that these detonation-induced SRV blowdowns are an increase of less than 1% to the IORV initiating event tree frequency (0.19/RY) already assumed in this PRA.
Burst Pipe: BWRs are generally well defended against LOCAs. Again, for this size LOCA, the coolant inventory loss is more than can be supplied by the RCIC system, but will be within the capacity of the HPCI system. However, after a few hours, the coolant leak (and the steam supply used to power HPCI) will depressurize the reactor, and the low-pressure systems will be needed to keep the reactor core covered.
This scenario was analyzed by constructing a new event tree. This new event tree was a simple copy of the existing event tree for the intermediate break "S1" LOCA, but the initiating event at the beginning of the tree was replaced by two top events: the detonation-induced pipe-break frequency followed by the probability of not isolating the break, as described above. The remainder of the event tree is exactly the same as that for the "S1" LOCA.
As in the original "S1" LOCA event tree, the principal contributor to the CDF was a sequence where all the low pressure injection systems fail. This is also the only sequence which results in a large early release of radioactivity; in the other sequences that lead to severe core damage, containment failure is avoided by containment venting. This sequence leads to Plant Damage State 1 (PDS-1). (The end state nomenclature is S1-V2V3V4NU11.)
The calculations were done using 10,000 samples and standard Monte Carlo uncertainty analysis techniques, with a truncation level of 10-10. The results are as follows:
| Burst Pipe Scenario | |||||
|---|---|---|---|---|---|
| Sequence | Point Estimate | Mean | 5th percentile | Median | 95th percentile |
| PDS-1 Sequences (Possible LERF) | 1.5 x 10-7 | 1.6 x 10-7 | 1.0 x 10-9 | 3.4 x 10-8 | 6.7 x 10-7 |
| All other core damage sequences (CDF) | 7.1 x 10-8 | 7.1 x 10-8 | 1.3 x 10-9 | 2.9 x 10-8 | 2.6 x 10-7 |
| Total: | 2.1 x 10-7 | 2.1 x 10-7 | 3.0 x 10-9 | 7.2 x 10-8 | 7.8 x 10-7 |
Again, as the table parameters themselves illustrate, the number of significant figures does not imply accuracy to this degree, but instead are provided as an aid in following the calculation. The most dominant sequence is a sequence in which a mis-calibration of the pressure sensors in the drywell defeats all of the low pressure ECCS systems, which may be somewhat plant-specific. If this sequence were not present, the PDS-1 end state frequency would drop by roughly a factor of 30, and the CDF would be reduced by about half.
The initiating event frequency for this "pipe burst" scenario is significant - addition of this sequence approximately doubles the "S1" intermediate LOCA frequency for the plant (normally 3 x 10-4/RY). However, the LOCA sequences are relatively minor contributors to the overall CDF of the plant, because BWRs are so well-defended against loss of coolant events.
Large Early Release Frequency (LERF): The LERF is estimated based on the frequency of the sequence leading to PDS-1. All the other sequences result in core damage, but the containment integrity is preserved and the release of radioactivity to the environment is limited by venting of the containment from the wetwell airspace, which "scrubs" the release through the suppression pool.
PDS-1 can result in a spectrum of accident progression bins and source term groups. Some of these accident progression bins involve large early containment failure. To quote the description in the PRA, "There are no high RPV vessel breach scenarios because of the LOCA depressurizing the vessel. Since the drywell is flooded by water from the vessel, drywell melt-through is less likely in this case (only 0.36). There is some probability of overpressure failure or venting; but, the availability of containment heat removal in this sequence results in a high probability of no containment failure at all (0.536)."
The estimated frequency for PDS-1 for this issue is 1.6 x 10-7/RY. If the mean probability of no containment failure is 0.536 for a PDS-1 event, then the probability of a large release is one minus this, or 0.464. Multiplying this by the estimated PDS-1 frequency, the product is an overall large early release frequency (LERF) of 7 x 10-8 large early releases per reactor-year.
Consequence Estimate
A rough estimate of the consequences was made, using the CRIC-ET Code1795 and the Peach Bottom site. The results for a PDS-1 frequency of 1.6 x 10-7/RY was on the order of 3 person-rem/ year. A calculation based on a generic site population density might be higher than this, but this is well below the 100 person-rem/year cutoff in the MD 6.4 Handbook. Thus, this parameter is unlikely to be limiting.
Cost Estimate
Because of the low CDF and risk, a cost estimate would not affect the conclusions of this analysis. Therefore, no cost analysis was performed.
Other Considerations
The scope of this analysis was restricted to BWRs, based on the identifying document1822 and because of a belief that PWRs would be less susceptible, since PWRs have primary systems that are primarily liquid-filled, and are generally operated with an excess of dissolved hydrogen with the explicit purpose of limiting the amount of radiolysis-generated oxygen. The operational experience review conducted in the course of this evaluation revealed that a significant number of events involving hydrogen detonation/explosion have also occurred at US and other foreign PWRs. It is recognized that near the end of cycle, a certain amount of hydrogen can accumulate in the vapor space of a pressurizer which, in the event of an overpressure and subsequent PORV actuation, can and will build up in the relief tank. The potential for rapid oxidation does exist there, as seen in some of the events reported. Relevant operating experience and practices should be reviewed by the NRC, and the implications of hydrogen explosions in PWR piping and components should be assessed as a possible new GSI.
Although the significance of this issue to the safety of the public is low, a burst pipe or a damaged SRV could cause a plant shutdown and necessitate some cleanup and repair, with a resultant increase in occupational risk exposure. Thus, it may be in the economic interest of licensees to take some preventive measures.
The CDFs associated with this issue are well below the thresholds in NRC Management Directive (MD) 6.4. However, the LERF associated with the pipe burst scenario is less than a factor of two below the MD 6.4 threshold for plants with an existing LERF above 10-5. It is expected that detonations (and some pipe bursts) will continue to occur. However, if more pipe bursts occur such that the estimated frequency is higher than the 1.3 x 10-3 event/RY used in this analysis, or if there is operational experience that the likelihood of non-isolation of the break is higher than that estimated in this analysis, then the analysis should be reevaluated.
There have been a number of hydrogen combustion events during maintenance and/or shutdown operations. These events were not included in the scope of this generic issue because they were thought to be insignificant in terms of the health and safety of the public because the low pressure ECCS is operational during hot shutdown and hot standby, and the pressure is nearly atmospheric while in cold shutdown and refueling. However, such events can be very significant to the occupational safety of plant personnel.
Several events at the foreign BWRs have shown that hydrogen combustion in the valve control lines resulted in excess pressure which, in turn, caused the compression of the central guide pins and damage to the pilot valves. The ensuing deformation of valve internals may cause an impairment of their opening function, and the damage to the pilot valves may lead to failure-to-close of individual safety and relief valves, resulting in a LOCA.
- The industry initiatives reported1829 to the NRC, especially the BWROG efforts to survey the US BWR licensees for the actions taken in response to the pipe rupture events in non-U.S. BWRs, indicated that some of the US BWR licensees had not yet completed their reviews. As of August 2003, the following actions were reported:
-All plants had reviewed the available literature (e.g., RICSIL, SIL, Information Notice, WANO summary, and BWROG guidance document);
-Fifteen of the 16 plants with RHR-SCM piping and 18 of the 19 plants with RHR head spray piping had evaluated that piping. (Survey response answers "NA" are interpreted to mean that the piping is not present or is disconnected.) Remaining plant evaluations were ongoing, but were not complete;
-A risk category assessment of plant equipment had been completed or was in progress at all of the plants.
-Thirteen plants had completed or were performing physical walk-downs of plant equipment;
-Seven plants had reviewed plant drawings. Some of these plants may substitute the drawing reviews for a walk-down, some may conduct a walkdown at a later date.
-17 plants have identified potentially vulnerable equipment and are pursuing appropriate solutions to address these configurations (e.g., procedure notes, procedure changes, equipment temperature monitoring, configuration analysis, and equipment modification, if necessary).
No new information had been received by the time this evaluation was completed in December 2003.
Suggestions
Hydrogen explosions can potentially threaten plant safety by challenging the integrity of the safety systems, components and equipment, and/or endanger plant personnel safety. To avoid these explosions, the best course of action for licensees would be to prevent build-up of combustible levels of H2-O2 mixtures by frequent venting of piping and components that are stagnant and are not normally kept filled.
There are many potential ignition sources at operating plants, and many more exist when routine maintenance activities are conducted during refueling outages. Therefore, it is not practical to eliminate all the likely sources of hydrogen ignition. In fact, the ignition energy for the H2-O2 combustible mixture is so low that the ignition sources become practically irrelevant. Therefore, the most prudent action for licensees to take is to prevent the accumulation of detonatable levels of H2-O2 mixture. As evidenced by reported events, licensees should take sufficient care during maintenance activities to ensure that no stagnant pipes and components with potentially combustible levels of H2-O2 mixtures exist.
GE RTICSIL No. 85 identified and ranked in the reverse order of vulnerability (high-to-low) various piping and components determined to be vulnerable, and recommended certain actions. In "Bin 4-D" of the GE RTICSIL No. 85 table, it was indicated that for safety and relief valves, although hydrogen accumulation is possible, the detonation potential is mitigated by the water vapor content in excess of 5 v/o. Hence, no corrective action is required. However, based on a review of power reactor operational experience, there have been hydrogen explosion events involving rupture of SRVs. In some instances, the presence of a small amount of metal, e.g., inside the valve body, is known to have served as a catalyst and ignited the H2-O2 mixture resulting in valve rupture/leakage. One possible cost-effective fix would be to replace the metal segments with palladium (a hydrogen adsorber) or coat them with platinum as catalyst. This would enable the valve body to serve as a "mini recombiner" and prevent build-up of explosive levels of H2-O2 mixtures, as successfully done at the Finnish plants.
No unmanageable loss of coolant occurred in the reported SRV failure events; however, if the leaky/ruptured valves had not been isolated or the leakage was large enough, the potential for a LOCA would have existed. Hence, a caution to licensees in this regard is warranted. One vehicle to accomplish this would be a generic communication in which staff review of relevant US and foreign operational experience and the associated risk implications of "unisolatable" breaks would be summarized. This generic communication could also be used to reemphasize good maintenance practices.
CONCLUSION
The detonation-induced SRV failure scenario has a mean CDF well below the cutoff in the MD 6.4 Handbook with no significant LERF and was dropped from further consideration. The CDF associated with detonation-induced pipe bursts was also well below the cutoff, and the LERF associated with this scenario was below the 10-7 cutoff. Therefore, it was concluded that there was insufficient justification for this issue to continue to the technical assessment stage. However, it was recommended that the above findings and suggestions be communicated to licensees.1833
REFERENCES
|
