Fission Stories #198
The owner of the two reactors at the Calvert Cliffs Nuclear Power Plant near Lusby, Maryland informed the NRC on March 20, 2015, about a maintenance practice that could have prevented emergency systems from fulfilling their safety functions during an accident.
The Design
Each reactor unit has a component cooling water (CCW) system (see Fig. 1). The CCW system is a closed-loop system recirculating water through vital components to cool them. The CCW system has two heat exchangers. Salt water drawn from the Chesapeake Bay by the service water system’s pumps passes through the CCW heat exchangers. As it flows through tubes inside the heat exchanger, the CCW water’s heat is conducted through the metal tube walls and gets carried away by the salt water that is returned to the bay. The cooled CCW water is piped throughout the plant to cool vital components.
Fig. 1 (click to enlarge) (Source: UCS)
(The closed-loop / once-through cooling arrangement serves two roles. First, the CCW system water is as pure as practically achievable. Using “clean” water minimizes rusting and corrosion of piping, valves, and coolers. Second, the CCW system supplies some components that could be radioactively contaminated, especially during an accident. The CCW system heat exchangers are operated with the service water pressure higher than the CCW system pressure. Thus, if a tube inside a CCW heat exchanger leaks, salt water leaks in rather than having radioactively contaminated water leak out into the salt water and thus into the bay.)
The shutdown cooling (SDC) heat exchangers are among the components cooled by the CCW system. The SDC heat exchangers have multiple functions, but the one involved in this issue was the containment cooling function.
When a pipe connecting the reactor vessel to the steam generators and reactor coolant pumps breaks, cooling water drains from the reactor vessel into the containment sump. An array of high-pressure and low-pressure emergency pumps refills the reactor vessel to restore cooling of the reactor core. As water continues to pour from the broken ends of the pipe, it transfers heat from the reactor core to the containment.
To prevent excessive buildup of temperature and pressure inside containment due to this energy transfer, the containment spray pumps are started. They draw water from the containment sump, send it through the SDC heat exchangers where it is cooled by the CCW system, and send it into spray headers mounted near the upper inside surfaces of the containment building. The water sprayed from the headers cools the containment atmosphere. It also helps “scrub” radioactive particles and gases from the atmosphere to reduce the amount of radioactivity leaking from containment. (The containment is designed to have low leakage rates. Its size and the number of penetrations through its walls make it virtually impossible for it to be leak-tight.) The sprayed water drains to the containment sump for re-use.
The makeup water supplied to the reactor vessel cools the reactor core before spilling out onto the floor. The SDC heat exchangers during containment spray mode complements core cooling by removing heat from the containment.
The Maintenance
Workers periodically removed the CCW system from service—one at a time—for routine maintenance. Because the service water system uses water from the Chesapeake Bay, the CCW heat exchangers become fouled with sand, silt, and other debris. The periodic maintenance tasks include cleaning to keep the heat removal capability as effective as possible. The reactor operating licenses permitted one CCW loop to be out of service for up to 72 hours before the reactor had to be shut down. (A “loop” is traditionally considered to be the pairing of a CCW pump and heat exchanger.)
How the Maintenance Undermined the Design
The problem from this well-intended maintenance practice stemmed from the CCW system having two heat exchangers that were cross-tied. In other words, the configuration was not one where a CCW heat exchanger was devoted to a single SDC heat exchanger and the second CCW heat exchanger was devoted to the other SDC heat exchanger. Instead, the cross-ties meant that with one CCW heat exchanger valved out of service for maintenance, flow through the in-service CCW heat exchanger went to both SDC heat exchangers.
Normally, the heat acquired by the CCW system water passing through the two SDC heat exchangers is balanced by the heat taken away by the service water flowing through the two CCW heat exchangers. Removing one CCW heat exchanger affects the see-saw’s balance. The balance can be restored if the service water flowing through a single CCW heat exchanger can carry away double the usual load.
When the temperature of the water drawn from the Chesapeake Bay was less than 60.5°F, the service water flow through a single CCW heat exchanger could adequately remove the heat from both SDC heat exchangers. The temperature of the CCW leaving the CCW heat exchanger remained 120°F or less, the limit assumed in the plant’s safety studies.
But as the bay’s water temperature rose above 60.5°F, the CCW’s temperate leaving the CCW heat exchanger rose above 120°F.
Reactor cores adequately cooled when CCW temperature is 120°F do not automatically melt down when the temperature rises to 121°F. But as the CCW temperature rises above 120°F, the plant enters unanalyzed territory. Components designed to be cooled by CCW at 120°F or less may become unable to perform their safety function at higher temperatures.
The owner informed the NRC that a single CCW heat exchanger had been removed from service ten times on Unit 1 and eight times on Unit 2 in the past three years.
Our Takeaway
How was the potential safety problem associated with this routine maintenance practice identified?
The NRC’s Senior Resident Inspector assigned to Calvert Cliffs questioned how the practice conformed to the safety studies. It was a commendable catch because the problem was subtle. The operating licenses allowed a single CCW loop to be out of service for up to 72 hours and the maintenance never took longer than 52.5 hours during the past three years. But the way in which the maintenance was performed introduced the potential for the second CCW loop becoming inoperable due to high temperatures. The operating licenses only allowed the reactor to operate for six hours with both CCW loops inoperable. The NRC’s Senior Resident Inspector’s probing exposed a safety problem associated with a well-intended maintenance practice.
The NRC’s commendable catch is offset by quite a few misses by plant workers. The CCW system is assigned to an engineer (who may also be assigned other systems but who “owns” the system). System health reports prepared by the system engineer likely credited the periodic maintenance tasks as improving the system’s capabilities, without noting that safety margins were being challenged. The system engineer has little excuse for not catching the fact that maintenance was degrading safety levels. The operations department, specifically its work control group, authorized the CCW heat exchangers to be removed from service for maintenance and restored them to service afterwards—each time being an opportunity to ask the question the NRC’s Senior Resident Inspector asked.
“Fission Stories” is a weekly feature by Dave Lochbaum. For more information on nuclear power safety, see the nuclear safety section of UCS’s website and our interactive map, the Nuclear Power Information Tracker.