The Nuclear Regulatory Commission (NRC) sent a special inspection team to Duane Arnold Energy Center (Palo, Iowa) on October 20, 2014, after workers discovered debris floating on the surface of this boiling water reactor’s torus. They found the coating that had been applied to protect the metal wall of the torus from corrosion was sagging in some places. Deficiencies in the coating could result in the torus wearing out and failing.
The NRC was additionally concerned that debris created by the degraded coating could clog the pipes that emergency pumps use to draw water from the torus and use it to cool the reactor core and containment during an accident. The NRC determined that the increased risk of reactor core meltdown caused by the degraded coating material clogging the emergency pumps warranted a White finding, the third most serious severity level in its Green, White, Yellow, and Red process.
How the Event Unfolded
The Duane Arnold Energy Center near Palo, Iowa features a single boiling water reactor. The Atomic Energy Commission, NRC’s predecessor, issued the owner a 40-year operating license for the plant in January 1971. On October 1, 2008, the owner applied to the NRC for a 20-year extension to the operating license.
In reviewing the license renewal application, the NRC expressed concern about the aging-management program for the torus. The torus is a donut-shaped metal vessel holding nearly 450,000 gallons of water (Fig. 1). It forms part of the primary containment around the reactor pressure vessel holding the nuclear core.
Fig. 1 (Source: NRC)
The torus water performs two key functions in event of an accident: (1) absorbing energy released by the core, and (2) providing a source of water for the emergency pumps supplying makeup cooling water to the reactor pressure vessel and/or spraying cooling water inside the primary containment. The torus water is far from drinking water standards. Consequently, the inside surface of the torus had a protective coating (i.e., a special paint) applied to it to protect the metal from rusting and corrosion degradation.
The NRC was concerned that the protective coating might not be as effective after 40 years in service as it was upon initial application. If not, the metal of the torus might deteriorate and prevent it from performing its post-accident safety functions. For example, if a large pipe connected to the reactor vessel broke inside the drywell, the steam jetting from the broken ends would quickly fill the drywell and flow through the eight vents into the torus. The hydrodynamic forces “jolt” the torus and could cause weakened metal to fail.
Rather than attempt to convince the NRC that the original coating would endure for another 20 years, the owner sent a letter dated March 9, 2010, to the NRC committing to re-coating the torus. Based in part on that commitment, the NRC relicensed Duane Arnold on December 16, 2010, for operation through February 21, 2034.
Per its commitment, the owner hired a contractor to recoat about 13,000 square feet inside the torus in November 2012, during a refueling outage. About 6,000 square feet of that coating layer was found to be too thin, so a second layer was applied. With the minimum coating thickness met, workers restarted the reactor in late November.
On October 4, 2014, the operators shut down the reactor to start another refueling outage. When workers entered the torus on October 9 for a routine inspection, they observed that some of the protective coating had broken loose and was floating on the surface of the water and that the coating was sagging in other areas. On October 20, the NRC dispatched a special inspection team to the site to examine the cause of and evaluate the corrective actions for this problem.
The NRC team concurred with the owner’s determination that the second coating layer had not chemically bonded to the first layer. As a result, the second layer broke free in some places and slid down in others. The NRC team found that the procedure used by the contractor to apply the first coating layer did not clearly specify the minimum acceptable thickness. When the layer was found to be less than the minimum thickness in many areas, a decision was made to apply a second layer. But the material used by the contractor was designed to be applied as a single layer. A procedure existed for applying a second coating of the material, but the conditions used to qualify that process (e.g., the temperature, humidity, and cure time) all varied from the actual conditions inside the torus.
Fig. 2 looks downward at the sixteen bays that comprise the torus and the eight vent pipes connecting the torus with the drywell portion of the primary containment.
Fig. 2 (Source: NRC)
The bays having connections to the Reactor Core Isolation Cooling (RCIC) and Emergency Core Cooling System (ECCS) pumps are also indicated. Normal wear and tear during non-accident conditions between November 2012 and October 2014 resulted in the second coating coming loose in twelve of the torus’ sixteen bays (bays 1, 2, 3, 5, 6, 7, 8, 9, 10, 11, 15, and 16). In addition, workers were able to dislodge the second coating by pressure washing (emulating the forces applied during an accident) in all but one of the sixteen bays.
Workers scraped the coating from about 1,649 square feet of the torus and removed another 3,665 square feet of coating by pressure washing. A different type of coating was then applied to the proper thickness.
The torus coating degradation had two safety implications. First, it meant that the coating thickness in many regions of the torus was less than that needed to protect against degradation of the torus metal. More importantly, the loose and detached coating material became debris that could have collected on the strainers for the RCIC and ECCS pumps. Strainers are metal cylinders or boxes with many small holes covering the opening of pipes going to the pumps. Fig. 3 shows two strainers—the upper one for a small-diameter piping and the lower one for a larger pipe. The holes allow water from the torus to flow through pipes to the pumps, but block debris that could clog the pumps or damage their impellers.
Fig. 3 (Source: NRC)
Duane Arnold was designed and analyzed for a certain amount of debris in the torus water, but the degraded coating constituted considerably more debris than needed to completely block the strainers, preventing adequate supply of water to the safety pumps.
The NRC team concluded that the primary hazard from the degraded coating involved a large pipe connected to the reactor pressure vessel breaking and rapidly draining water from the vessel. For breaks of medium and small pipes, the water inventory lost through the broken pipe ends could be made up by the RCIC and High Pressure Coolant Injection (HPCI) systems. (The HPCI system constitutes one of the Emergency Core Cooling Systems and its supply of water from the torus is indicated by one of the ECCS labels in the figure.) Normally, the RCIC and HPCI systems get their water from the Condensate Storage Tank, a large metal tank located outside of the containment building, and supply it to the reactor pressure vessel. When that tank empties, the RCIC and HPCI systems switch over to get water from the torus.
The RCIC and HPCI systems would get water from the Condensate Storage Tank if a large pipe breaks, but not for long. The RCIC and HPCI pumps are powered by turbines spun by steam generated by water boiling inside the reactor pressure vessel. The loss of water through the broken ends of a large pipe quickly reduces the pressure within the reactor pressure vessel below the point needed to “push” steam through the pipes to the RCIC and HPCI turbines. The remaining ECCS pumps are powered by electric motors. Thus, while these ECCS pumps might remain available, debris collecting on their strainers might keep them from supplying the makeup water needed to cool the reactor core. In this scenario, the reactor core could overheat.
NRC Sanctions
The NRC determined that the increased risk of reactor core meltdown caused by the degraded coating material clogging the RCIC and ECCS pump strainers warranted a White finding, the third most serious severity level in its Green, White, Yellow, and Red process. The degraded coating impaired the plant’s response to a break of a large pipe and prompted a finding other than Green. Because the degraded coating did not significantly impair the plant’s response to a break of a medium or small pipe, a finding of Yellow or Red was not warranted.
UCS Perspective
Like the problems encountered with replacement steam generators at San Onofre in California, this incident demonstrates the bathtub curve in action. The NRC was properly concerned about the original torus coating at Duane Arnold approaching, if not already being within, the right-hand portion of the curve where the chance of failure increases due to wear out and other aging factors. So, the NRC compelled the owner to avoid that increasing risk by replacing the original coating.
Fig. 4 (Source: NRC)
But the new coating resets the clock and flips things back to the left-hand portion of the curve where the chance of failure is initially elevated due to material defects, improper installation, and other infant mortality factors.
At Duane Arnold, an effort to sustain adequate safety margins for 20 more years caused them to be undermined in less than a year. The original steam generators at San Onofre were replaced for the same reason and experienced the same outcome.
Perhaps a lesson for the nuclear industry is to either select the second-lowest bidder more often or expend considerably more effort making sure the cheapest option is still an acceptable option. Otherwise, thwarted safety upgrades that downgrade safety will continue to be fertile ground for Operating Experience, and my blog commentaries.