One hole down, one to go -- Ohio Citizen Action

The small black arrow points to a crack in the protective layer of stainless steel near the nozzle recess, left, of the Davis-Besse nuclear reactor head (Nuclear Regulatory Commission photo printed in the Toledo Blade).

On March 5, 2002, workers discovered a gaping hole in the reactor vessel head at the Davis-Besse nuclear power plant in Ohio. Although they may not have realized it at the time, they also found an even larger hole in the safety net presumed to protect public health. The damaged reactor head is being replaced. Adequate protection of public health demands that the damaged safety net be repaired as well. It would be irresponsible for the Nuclear Regulatory Commission (NRC) to permit Davis-Besse to restart without all of the holes being plugged.

The reactor vessel head is a removable part of the metal pot containing the nuclear core. Workers unbolt and remove the head to gain access to the core during refueling outages.

The carbon steel reactor head at Davis-Besse has nearly 70 four-inch holes that permit the control rods within the nuclear core to be connected to their drive motors outside of the reactor vessel. Each of these holes is sleeved with a stainless steel Control Rod Drive Mechanism (CRDM) nozzle. Because the water inside the reactor vessel has boric acid dissolved in it that is highly corrosive to carbon steel, the inner surface of the reactor vessel head is coated with a thin layer of protective stainless steel.

Workers identified flaws in some of the CRDM nozzles at Davis-Besse during the plant’s refueling outage earlier this year. As they repaired one nozzle, it slumped over to the side. That unexpected movement led the workers to find a large cavity next to the nozzle. Boric acid had eaten away the six-inch thick carbon steel reactor vessel clear down to the stainless steel cladding. This stainless steel cladding, about ¼-inch thick, luckily kept the cooling water for the nuclear core inside the reactor vessel where it belongs.

A team investigating the near-miss concluded the CRDM nozzle began leaking borated water sometime between 1994 and 1996. The water evaporated, leaving behind boric acid that ate its way through the vulnerable carbon steel. Workers inspected the reactor vessel head during refueling outages in 1996, 1998, and 2000 without noticing the ever-widening hole.

Borated water leaking through a cracked CRDM nozzle seriously damaged the reactor vessel head at Davis-Besse. According to the company’s root cause investigation team:

"The evidence places the through-wall leak initiation in the approximate 1994-1996 timeframe."

Assuming the team is right, it means that the nozzle leaked for six to eight years before it was finally detected. This represents a huge hole in the safety net because safety regulations and the plant’s operating license only allow six hours of such leakage. The safety net is supposed to ensure that nuclear plants conform with safety regulations and its license. Yet Davis-Besse operated day after day, week after week, month after month, year after year outside those bounds.

The CRDM nozzles form part of the reactor coolant pressure boundary. At Davis-Besse, the reactor coolant pressure boundary consists of the reactor vessel, its head (including the CRDM nozzles), the once-through steam generators (OTSG), the reactor coolant pumps, the pressurizer, and the connecting piping. With the exception of the steam space above the normal water level line inside the pressurizer, the reactor coolant system is filled with water.

There are four different limits governing leakage from the reactor coolant system at Davis-Besse:

"If any pressure boundary LEAKAGE exists or if unidentified, identified, or primary to secondary LEAKAGE cannot be reduced to within limits within 4 hours, the reactor must be brought to lower pressure conditions in order to reduce the severity of the LEAKAGE and its potential consequences. The reactor must be brought to MODE 3[reactor shut down with its water temperature greater than 212°F] within 6 hours and MODE 5[reactor shut down with its water temperature less than 212°] within 36 hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary. The Completion Times allowed are reasonable, based on operating experience, to reach the required conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the pressure stresses acting on the RCPB are much lower and further degradation is much less likely."

Did plant workers and NRC inspectors know that Davis-Besse was operating with reactor coolant boundary leakage or did the plant operate that way without their knowledge? The answer is "both." The plant operated for a long time with its reactor coolant pressure boundary leaking before they became aware of it. As suggested by the three-year window estimate by the company, the moment the leak sprouted cannot be determined. For example, the operators’ log book does not contain the following endries:

Nevertheless, the company and the NRC shared very strong suspicions that the reactor coolant pressure boundary was leaking in violation of safety regulations and the operating license:

"[FirstEnergy Vice President Guy Campbell] also pressured me [NRC manager Jack Strosnider] to better understand why Davis Besse wasn’t good to operate until April. I told him that based on the operating experience there is a high likelihood that they have leaks – he agreed. I told him that reactor coolant pressure boundary leakage would not satisfy the regs [federal safety regulations] or tech specs [technical specifications portion of operating license], that it would eliminate fail to maintain defense in depth and margins, and there could be crack large enough to cause them problems before April."

By November 8, 2001, senior officials at Davis-Besse and the NRC mutually agreed there was a high likelihood the plant violated federal safety regulations. They mutually agreed there was a high likelihood the plant violated its operating license. They mutually agreed there was a high likelihood that the plant was in a condition requiring it to be shut down right away. Yet no one took the actions required by federal safety regulations or the plant’s operating license. No one. No actions.

Plant workers confirmed in March of this year what the senior officials strongly suspected last fall the plant had been operating with reactor coolant pressure boundary leakage. But as bad as those decisions, or non-decisions, were last fall, they are water under the bridge, so to speak. The hole in the safety net that allowed Davis-Besse to violate federal safety regulations for six to eight years must be repaired before the plant restarts. It happened once, it must not happen again.

The hole in the safety net is having a safety regulation and operating license condition that are not enforced. Reactor coolant pressure boundary leakage is not allowed. But up to one gallon per minute of "unidentified leakage" is allowed. If a leak rate of 0.5 gallons per minute is detected, does anyone know if it is reactor coolant pressure boundary leakage or not? The answer is "no." The sad truth is that everyone, including the NRC, just assumes it is not reactor coolant pressure boundary leakage.

What is "unidentified leakage" anyway? It is leakage that can be measured but which comes from an unknown source. "Identified leakage" can be measured as coming from a known source. For example, the pressurizer relief tank collects the discharge from the power-operated relief valve (PORV) on the pressurizer. The only source of water into the tank is via piping connected to the PORV. Thus, if the water inventory inside the pressurizer relief tank is increasing at a rate of 2.4 gallons per minute, it has to be leakage past the PORV.

If, on the other hand, a tank collects water from many places, perhaps including floor drains, the source of the leakage is unknown. Using the figure on page 2, consider a monitoring system for water collecting in the pit around the reactor vessel. That monitoring system reports leakage of 0.5 gallons per minute. Isn’t all of that leakage from the reactor coolant pressure boundary? If not, where could it be coming from?

The answer is that all, some, or none of the water could be leaking from the reactor coolant system pressure boundary. The figure shows the reactor coolant system, but it does not show other water-bearing components in the area. For example, there are pipes carrying sealing water to the reactor coolant pumps, pipes carrying cooling water to the air conditioning units, and pipes carrying water to and steam from the steam generators. Water collecting in the reactor vessel pit means that something somewhere is leaking. It might be reactor coolant pressure boundary leakage. It might not.

The cracked CRDM nozzle at Davis-Besse is believed to have started leaking in the 1994 to 1996 time frame. In the ensuing period, workers at the plant routinely monitored "unidentified" leakage of 0.1 to 0.2 gallons per minute, spiking to 0.8 gallons per minute in the late 1990s. In hindsight, it is apparent some of the leakage came through the cracked CRDM nozzle. Hence, it was reactor coolant pressure boundary leakage:

"No pressure boundary LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE. Violation of this LCO [limiting condition for operation] could result in continued degradation of the RCPB."

Unacceptable leakage was in fact accepted for many years. As feared, it resulted in continued degradation of the reactor coolant pressure boundary; namely, the reactor vessel head. Safety regulations and the plant’s operating license prohibit continued operation with reactor coolant pressure boundary leakage, yet the plant operated in that prohibited condition for many years. Why?

The reason is simple: plant workers and NRC inspectors always assume that "unidentified" leakage comes from anyplace other than the reactor coolant pressure boundary. Thus, as "unidentified" leak rates of 0.1, 0.2, and up to 0.8 gallons per minute were dutifully recorded on a hourly basis after the cracked CRDM nozzle began leaking sometime between 1994 and 1996, no one presumed that even a single drop could be coming from the reactor coolant pressure boundary. No one. Not a single drop.

The way plant workers and NRC inspectors play the game, "unidentified" leakage does not come from the reactor coolant pressure boundary unless it is specifically identified as coming from there. That practice might be suitable if another federal safety requirement were satisfied:

Workers at Davis-Besse certainly detected almost constant leakage. But they failed to identify the reactor coolant pressure boundary as the source of this leakage. Could they practically identify CRDM nozzle leakage in the future? Yes!

How they choose to comply with federal safety regulations matters little to UCS. What matters a whole lot to UCS is that chronic non-compliance with federal safety regulations must stop. The only thing worse than it having happen in the first place would be for it to happen again.

After initially contemplating an unprecedented patch to the damaged reactor vessel head, the company decided to replace the damaged head with an unused head purchased from the owner of a nuclear power plant cancelled during its construction. The head 'transplant' may solve the hole in the head problem, but it does not solve the hole in the safety net problem.

The old head was damaged when a CRDM nozzle cracked and leaked after 17 to 19 years of operation. Does that mean the new head will be damage-proof for about 15 years? No. The new head moves Davis-Besse from Region C or the right side of Region B to the left side of Region A on the "bathtub" curve of failure rate. Instead of facing "wear-out" problems, the plant faces "break-in" problems. A CRDM nozzle could as easily crack and leak in Region A as it did in Regions B and C.

If just one of the nearly 70 CRDM nozzles in the replacement head at Davis-Besse has a manufacturing defect or material flaw, it could crack soon after the plant restarts. According to the NRC:

Thus, the rate at which minor cracks in the CRDM nozzle propagate through-wall to allow leakage is currently unknown. What else isn’t known?

"The causative conditions surrounding the degradation of the RPV head at Davis-Besse have not been definitively determined. The staff is unaware of any data applicable to the geometries of interest that support accurate predictions of corrosion mechanisms and rates."

Thus, the rate at which leaks through CRDM nozzles damage the reactor vessel head is currently unknown. Is anything currently known?

"The leakage from the reactor coolant pressure boundary must be zero gallons per minute."

Replacing the reactor head repairs the damage caused by failing to comply with this operating license requirement in the past. It does nothing to protect the reactor vessel head from future non-compliance. Nothing.

Before Davis-Besse restarts, the NRC must provide reasonable assurance to the people of Ohio that the plant will never again operate day after day after day with reactor coolant pressure boundary leakage.

It could take installing cameras to continuously monitor the reactor vessel head.

It could take installing the equipment used at French nuclear power plants to detect CRDM nozzle leaks.

It could take assuming that any "unidentified" leakage comes from the reactor coolant pressure boundary.

Whatever it takes, the NRC must enforce federal safety regulations. That’s its job. It must do it. Now.