Title of document · 2018. 11. 14. · Title of document Template Ref: ONR-DOC-TEMP-004 Revision 7...

Title of document

Template Ref: ONR-DOC-TEMP-004 Revision 7 Page 1 of 35

ASSESSMENT REPORT

Unique Document ID and Revision No:

ONR-CNRP-AR-14-101Revision 0

TRIM Ref: 2015/4575

Project: Boiler Spine Recovery Project

Site: Heysham 1

Title:

Structural Integrity Assessment of the Safety Case for Return to Service of Heysham 1 Reactor 1 at Reduced Temperature Operation on 3 Quadrants following the discovery of a defect on Heysham 1 Reactor 1 Boiler Spine 1D1

Nuclear Site Licence No: 60

Licence Condition(s): LC 22

IIS Rating (Mandatory): (Rating should be based on licensee's original safety case submission)

4

COIN Service Order: SVC4285367

Step-based Document Review

Step Description Role Name Date TRIM Revision*

1 Initial Draft, including identification and mark-up of SNI/CCI

Author 05-01-2015 1

2 Main editorial review Author 06-01-2015 1

3 Peer Review in accordance with AST/005 Rev 3 2015/10267

Peer Reviewer 07-01-2015 1

4 Assessor update / sentencing of comments and return to Peer Reviewer

Author 09-01-2015 5

5 Final editorial / clean draft review Author 09-01-2015 6

6 Acceptance review in accordance with AST/003 Rev 7 2015/10489

AUH 09-01-2015 8

7 Report Sign-off Author / Peer Reviewer / Professional Lead

* TRIM revision to be identified upon completion of activity and incorporation of any changes to document

Report ONR-CNRP-AR-14-101 TRIM Ref: 2015/4575

Office for Nuclear Regulation Page 2 of 35

Document Acceptance

Role Name Position Signature Date

Author Principal Inspector

09.01.2015

Peer Review† Principal Inspector 09.01.2015

Acceptance‡ Superintending Inspector

09.01.2015

Revision History

Revision Date Author(s) Reviewed By Accepted By Description of Change

0 First formal issue

Circulation (latest issue) Organisation Name

ONR

† Where required in accordance with ONR How2 BMS Document AST/005 Revision 3 ‡ Hard-copy of document signed-off, TRIM version updated with authors / approver / acceptor names and dates and record finalised



Civil Nuclear Reactor Programme

Structural Integrity Assessment of the Safety Case for Return to Service of Heysham 1 Reactor 1 at Reduced Temperature Operation on 3 Quadrants following the discovery

of a defect on Heysham 1 Reactor 1 Boiler Spine 1D1

Assessment Report ONR-CNRP-AR-14-101 Revision 0

09 January 2015



© Office for Nuclear Regulation, 2015 If you wish to reuse this information visit www.onr.org.uk/copyright for details. Published January 2015 For published documents, the electronic copy on the ONR website remains the most current publicly available version and copying or printing renders this document uncontrolled.



EXECUTIVE SUMMARY This report presents the findings of my assessment of EDF Energy Nuclear Generation’s (NGL) safety case for the return to service of Heysham 1 reactor 1 on three quadrants at reduced temperature operation following the discovery of a defect on Heysham 1 reactor 1 boiler spine 1D1. The report considers the structural integrity aspects of the safety case. The fault studies and probabilistic safety aspects are addressed in separate assessment reports. My assessment will inform ONR’s decision as to whether to agree under the Licensee’s Licence Condition (LC) 22 arrangements to the return to service of Heysham 1 Reactor 1, as requested by NGL. Heysham 1 Reactor 1 was shut down in June 2014 for a planned outage to investigate suspect investigations in the Weld 12.3 region of the 1D1 boiler spine. These indications were originally identified by guided wave testing performed during the statutory outage in September 2013. A combination of non-destructive testing techniques performed during the 2014 outage revealed significant cracking 450mm in length in the parent material just below Weld 12.3. Following the discovery of this crack, due to the similarity of the reactors, NGL assessed its impact on the nuclear safety of the operating units at Heysham 1 Reactor 2 and Hartlepool and it was decided to shut down the reactors for further inspections. This decision was supported by ONR. Upon completion of these inspections, finding no further defects, NGL presented a safety case for the return to service of Heysham 1 Reactor 2 and Hartlepool reactors 1 and 2, based on operation at reduced temperature. Following assessment of the safety case ONR issued a licence instrument for the return to service of Heysham 1 Reactor 2 and Hartlepool reactors. Following completion of the investigations of 1D1 boiler spine on Heysham 1 reactor 1, NGL has produced a safety case to justify return to service of this reactor on three quadrants and at reduced operating temperature. Operation on three quadrants enables the quadrant containing the defective boiler spine to be isolated. The safety case is time limited and allows operation until 31 August 2015 or 240 days at power, whichever is sooner. The boiler spine is made up of a series of cylinders butt welded together which supports the weight of the boiler. The boiler pods are contained within an individual steel boiler liner and are arranged in four pairs spaced around and separated from the reactor core by a supporting concrete structure. The boilers’ safety function is to provide essential cooling to the reactor core under fault conditions. A metallurgical sample was removed from Weld 12.3 of 1D1 during the investigations, and analysis has concluded that the cracking occurred due to a high temperature related damage mechanism, known as creep, in the lower heat affected zone of the weld. This area was found to have a poor microstructure making it potentially more susceptible to creep damage. NGL judge that the poor microstructure was probably introduced at manufacture by excessive heat inputs during a multi-pass ‘buttering’ operation that had not been identified in the review of spine build records. Return to service is predicated on the reactor operating at a lower temperature to reduce the temperature of Weld 12.3 in the boiler spines by 40ºC in order to reduce the rate of any further creep damage in the spines, and a potentially damaging transient associated with an operation to reconnect a boiler at power has been embargoed. The reactor will be operated with the defective quadrant isolated to prevent on-going degradation in the Weld 12.3 region of 1D1.



I support these changes to the operation of the reactor as being both prudent to reduce the likelihood and rate of any further damage given the uncertainties that still exist in the case, and necessary in order to support claims 1 and 2 of the safety case on the integrity of the spines. My assessment of the structural integrity aspect of the safety case for the return to service concludes that:

I accept on a judgement basis, that the evidence supports a random failure frequency for boiler spine at power of the order of 10-3 pry, which provides support to claim 1. This is made on a judgement basis due to the difficulty in quantifying the failure frequency for a number of reasons explained within the assessment of claim 1.

I do not accept the view of claim 1 that the failure frequency will be on the infrequent side of the 10-3 pry boundary due to the difficulties in quantifying this number. I consider that a cautious approach should be taken and the failure frequency should be considered to be on the frequent side of the boundary.

I can support claim 2 and judge that risks posed following spine failure in 1D1 quadrant with the reactor operating on three quadrants is not significantly changed from the shutdown state.

I can accept the claim 3 argument that there is no significant structural integrity challenge to the reactor internals from the proposed operating configuration.

I am satisfied that the inspections, modifications (in terms of reducing temperature, isolating D1 and fitting the structural restraint system) combined with implementation through the safety case presented are sufficient to allow the return to service. I conclude that returning Heysham 1 reactor 1 to service is ALARP from a structural integrity perspective.

Whilst I agree that the return to service is ALARP from a structural integrity perspective, I recognise that the safety case still includes a number of judgements and assumptions, and there are a total of six commitments made for further work. Whilst these do not undermine my conclusions, these commitments are supported by ONR, and are considered essential for on-going development of the boiler spine case. From a structural integrity perspective, on the basis of the safety case presented, I have no objection to the return to service of Heysham 1 reactor 1 at reduced operating temperature with 1D1 isolated. I recommend that ONR undertake a full review of all structural integrity related components prior to the restart from the next planned shutdown period of Heysham 1 reactor 1 in August 2015.



LIST OF ABBREVIATIONS ALARP As low as is reasonably practicable

BAP Boiler Assessment Panel

BAWG Boiler Assessment Working Group

FwoF Forewarning of Failure

fpd Failure per demand

GWT Guided Wave Testing

HAZ Heat Affected Zone

HYA Heysham 1 Power Station

HRA Hartlepool Power Station

HOW2 (ONR) Business Management System

NGL Nuclear Generation Ltd

ONR Office for Nuclear Regulation

pa per annum

PSA Probabilistic Safety Assessment

pry per reactor year

RTS Return to Service

SAP Safety Assessment Principle(s) (HSE)

SFAIRP So Far As Is Reasonably Practicable

TAG Technical Assessment Guide(s) (ONR)



TABLE OF CONTENTS 1 INTRODUCTION .................................................................................................................. 9

1.1 Background ................................................................................................................. 9 1.2 Standards and Criteria .............................................................................................. 10 1.3 Integration with Other Assessment Topics ................................................................ 10 1.4 Out of Scope Items ................................................................................................... 10

2 LICENSEE’S SAFETY CASE ............................................................................................. 11 2.1 Boiler Spine Description ............................................................................................ 11 2.2 Overview of Consolidated Boiler Spine Safety Case ................................................ 11 2.3 Overview of Recent Boiler Spine Safety Case Change ............................................ 12 2.4 Claim 1 - Integrity of Key Butt Welds on Operating Boilers is Adequate to justify an Infrequent Boiler Spine Failure at a Frequency of 10-3 pry ................................................. 13 2.5 Claim 2 - The risk of Spine Failure in 1D Quadrant with the Reactor Operating on 3 Quadrants is not Significantly Changed from the Shutdown State ...................................... 13 2.6 Claim 3 - Adequate Protection Remains Available to Ensure Consequences from Faults on 3 Quadrants Remains Tolerable .......................................................................... 14 2.7 Claim 4 - The Nuclear Safety Risk associated with Restart of HYA Reactor 1 on 3 Quadrants is ALARP ............................................................................................................ 14 2.8 Commitments ............................................................................................................ 14

3 ONR ASSESSMENT .......................................................................................................... 15 3.1 Scope of Assessment Undertaken ............................................................................ 15 3.2 Use of the SAPs ........................................................................................................ 15 3.3 ONR Interactions with the Licensee .......................................................................... 16 3.4 Assessment ............................................................................................................... 16 3.5 Licensee Commitments ............................................................................................. 26 3.6 IIS Rating .................................................................................................................. 26 3.7 Conclusions ............................................................................................................... 27 3.8 Recommendations .................................................................................................... 28

4 REFERENCES ................................................................................................................... 29 Figures Figure 1: Hartlepool and Heysham 1 Boiler Figure 2: Location of Boiler Spine Welds and materials used for construction Table Table 1: Relevant Safety Assessment Principles Considered During the Assessment Annex Annex 1: EC354024 Commitments



1 INTRODUCTION

1. This report presents the findings of my assessment of the safety case to support the return to service of Heysham 1 Reactor 1 at reduced temperature of operation following the discovery of a defect on Heysham 1 Reactor 1 boiler spine 1D1 (Ref. 1).

2. Assessment was undertaken in accordance with the requirements of the Office for Nuclear Regulation (ONR) How2 Business Management System (BMS) guide NS-PER-GD-014 (Ref. 2). The ONR Safety Assessment Principles (SAP) (Ref. 3), together with supporting Technical Assessment Guides (TAG) (Ref. 4), have been used as the basis for this assessment. The methodology for the assessment follows HOW2 guidance on mechanics of assessment within the Office for Nuclear Regulation (ONR) (Ref. 5).

1.1 Background

3. Heysham 1 Reactor 1 was shut down in June 2014 for a planned outage to investigate suspect indications in the Weld 12.3 region of the 1D1 boiler spine. These indications were originally identified by Guided Wave Testing (GWT) performed during the periodic shutdown in September 2013.

4. A combination of non-destructive testing techniques performed during the June 2014 reactor shutdown revealed significant cracking of 450mm circumferential extent in the heat affected zone of the parent material below Weld 12.3. From a nuclear safety perspective boiler spine failure could result in a drop of the boiler with resultant loading on and potential failure of boiler tubes, the gas circulator and the gas circulator penetration. For an operating boiler unit water ingress into the reactor could occur as a result of boiler tube failures giving rise to pressure and moisture increases within the reactor circuit. This could challenge containment integrity and reactor cooling, and could lead to reactivity excursions.

5. Following the discovery of this defect, the other similar reactors at Heysham 1 (HYA) and Hartlepool (HRA) were shut down as a precautionary measure and inspections conducted on their boiler spines. The inspections were completed and no other defects were identified. Given the potential significance of boiler spine failure NGL produced a Category 1 safety case to support return to service of HYA Reactor 2 and HRA Reactors 1 and 2, Ref. 6. Ref. 6 proposed operating at reduced temperature in order to take into account the increased likelihood for defects to be present in the boiler spines.

6. The current safety case proposes returning HYA Reactor 1 to service at reduced temperature with the affected quadrant isolated and has introduced a structural restraint system (SRS) below the 1D1 boiler. The SRS is intended to decrease the effects of a boiler drop on the gas circulator penetration.



7. ASSESSMENT STRATEGY

8. The intended assessment strategy is set out in this section. This identifies the scope of the assessment and, the standards and criteria that have been applied.

9. The scope of this report covers the structural integrity aspects of Ref. 1 and is described in more detail in Section 3. The Fault Studies and Probabilistic Safety Assessment (PSA) aspects are being addressed separately, Ref. 7 and Ref. 8.

1.2 Standards and Criteria

10. The relevant standards and criteria adopted within this assessment are principally the Safety Assessment Principles (SAP) (Ref. 3), and internal ONR Technical Assessment Guides (TAG) (Ref. 4).

11. The key SAPs applied within the assessment are included within Table 1 of this report.

12. The following Technical Assessment Guide has been used as part of this assessment (Ref. 4):

Integrity of Metal Components and Structures NS-TAST-GD-016 Revision 4. ONR. March 2013.

1.3 Integration with Other Assessment Topics

13. This Structural Integrity assessment will address the validity of the integrity claims that are important to the Fault Studies and PSA assessments, Ref. 7 and Ref. 8. In addition, the consequences of spine failure in 1D1 are intended to be mitigated by the structural restraint system (SRS); the SRS is designed to absorb the impact energy by deformation, but as a consequence will distribute the loading onto the boiler liner and ultimately through to the concrete pressure vessel. On this basis I have asked for a view from a Civil Engineering Assessor which is included in my assessment, see Ref. 9.

14. The validity of both the claimed reductions in temperature on the boiler spines due to operating the reactors at a lower temperature and operating 1D1 in the isolated condition will be important to this assessment, and will be reviewed as part of the Fault Studies assessment.

15. The ALARP justification is mainly addressed within the PSA assessment (Ref. 8), but the overall position with regard to structural integrity will be considered in this assessment.

1.4 Out of Scope Items

16. Certain aspects of this case have been considered in an assessment (Ref. 10) of the Category 1 safety case proposing the return to service of the HYA Reactor 2 (R2) and HRA R1 and R2, Ref. 6. In addition the existing Category 1 consolidated safety case for the boiler spines, Ref. 11, has previously been assessed by ONR, Ref. 12. Any aspects of these cases which have not been challenged or changed as a result of Ref. 10 or 12 have not been re-assessed.



2 LICENSEE’S SAFETY CASE

17. The safety case provided in Ref. 1 is based on 4 claims:

Claim 1 - Integrity of Key Butt Welds on Operating Boilers is Adequate to justify an Infrequent Boiler Spine Failure at a Frequency of 10-3 pry

Claim 2 - The risk of Spine Failure in 1D Quadrant with the Reactor Operating on 3 Quadrants is not Significantly Changed from the Shutdown State

Claim 3 - Adequate Protection Remains Available to Ensure Consequences from Faults on 3 Quadrants Remains Tolerable

Claim 4 - The Nuclear Safety Risk associated with Restart of HYA Reactor 1 on 3 Quadrants is ALARP

Each of these claims is outlined below with a focus on those aspects that relate to my assessment. Before describing each of the claims a brief description of the boiler spine and outline of the existing boiler spine safety case is provided.

18. This section is a description of the Licensee’s case. ONR’s comments and assessment follow in the Section 3.

2.1 Boiler Spine Description

19. The boiler spine is a welded hollow cylinder approximately 21.5m long, with a typical diameter of 541mm and minimum thickness approximately 35mm which is welded to the feed-water header assembly. The top of the spine protrudes from the top of the boiler pod, penetrating a large concrete boiler closure unit and descends down the centre of the boiler structure and contains the tubes that supply cool feed-water to the boilers, see Figure 1.

20. The spines function is to act as the load path for the main boiler tubes, reheater tubes and the boiler casing, supporting them from the top. The spine does not provide a pressure containment function. The dry mass it needs to support is 105 Te, which increases to circa 150 Te with full boiler inventory and to a total effective mass of 190 Te when including a conservative estimate of gas drag forces.

21. The spines are predominantly manufactured from austenitic stainless steels in the hot zone, alloyed ferritic steel in the mid-section and mild steel in the lower cool zones; Figure 2 shows the materials of construction. A proprietary stainless steel developed for power industry boilers, Esshete 1250 is used in the hottest parts of the spine, including in the region of Weld 12.3. (Esshete 1250 is the trade name for Electric Stainless Steel for High Elevated Temperature service at 1250°F (~ 675°C)).

22. This boiler design is specific to the four advanced gas cooled reactors at Heysham Stage 1 and Hartlepool. Each of these reactors has eight boilers, housed in pods, spaced around its periphery contained within the concrete pressure vessel. Two boiler pods make up a boiler quadrant.

2.2 Overview of Consolidated Boiler Spine Safety Case

23. For completeness this section reiterates the position as presented in Ref. 11, whilst the next section presents the recent updated position, Ref. 6.

24. The boiler spine safety case has developed during the operating life of the reactors. The original safety case judged that the spine had no significant active degradation mechanisms and would function safely until the end of station life. Safe operation was therefore justified on the basis of a robust demonstration of initial integrity by showing that the structure was designed, fabricated and inspected to high standards, and was tolerant to defects. However, following discovery of reheat cracking in other high



temperature components the boiler spine was judged to be potentially susceptible to such degradation, and the case evolved over time into the consolidated case presented in Ref. 11.

25. Reheat cracking is a material degradation mechanism associated with welds whereby cracking can occur as a result of exposure to high temperatures. Residual stresses introduced by welding relax as thermally activated plastic deformation occurs, leading to a local exhaustion of the material ductility and the initiation of cracking. Continued exposure to high temperature and sufficiently large system loads can then result in crack extension by a creep mechanism.

26. The consolidated boiler spine safety case presented in Ref. 11 acknowledges that parts of the spine are subject to potentially significant creep damage mechanisms, particularly with respect to the potential for re-heat crack initiation in the welds. Weld 12.3 was identified as bounding due to its high operating temperature, circa 580ºC. The consolidated case reviewed spine integrity against a multi-legged approach in line with the NGL guidance on structural integrity safety cases, Ref. 13. This considers factors such a quality of build, pre-service inspection, code assessment, fracture assessment, assessment of degradation mechanisms and forewarning of failure in coming to a conclusion on the likelihood of failure. The case demonstrated that weld failures would not occur from manufacturing defects or reheat cracking within 300,000 hours of operation. Three hundred thousand hours of operation was the estimated life of the station, with current operation at around 200,000 hours.

27. The consolidated case conceded spine failure at a frequency of less than 10-4 pry, which is in the range classed as an ‘Infrequent Failure’. At this level of claimed integrity, not all potential legs of the structural integrity case need to be populated. Of note is that the consolidated safety case did not include a forewarning of failure argument. This was primarily due the difficulties in obtaining inspection evidence to support such a case, but was considered acceptable as the predicted degradation mechanisms did not suggest failure during the station life.

28. ‘Infrequent Failure’ events require that one line of protection is demonstrable for maintaining the essential functions of trip, shutdown and post trip cooling following an initiating event, and a single line of protection was claimed for each of the essential functions. Ref. 11 demonstrated that one line of protection was available on the basis of a conservative assumption that boiler spine failure would lead to the failure of the 147 superheater tailpipes and considering the water ingress from the failure of 147 tailpipes. The possibility of multiple spine failures was discounted on the basis of it being a low frequency event.

2.3 Overview of Recent Boiler Spine Safety Case Change

29. Following the discovery of a reheat crack near Weld 12.3 of HYA 1D1 boiler spine, a modified safety case was produced, Ref. 6, to support continued operation of HYA R2 and, HRA R1 and R2. The case justified future operation with weld 12.3 operating at a reduced temperature not exceeding 540°C to significantly reduce creep crack growth. The case conceded that the potential for spine failure had increased to a frequency of around 10-3 pry and on this basis a second line of protection required justification to support future operation.

30. The case required inspection of the entire population of weld 12.3s in order to support a forewarning of failure argument based on frequent long range ultrasonic testing (LRUT) also known as guided wave testing (GWT) of the spines. To establish a Forewarning of Failure (FwoF) leg it must be shown that if a structurally significant defect was present it could not grow to a size resulting in guillotine failure of a boiler spine undetected. The key elements in developing such a leg are:



The initial size of a defect found or missed by inspection. The limiting size of defect which could result in failure. In-service defect growth rates.

31. The case presented an improved position with respect to consequential boiler tube failures noting that continuing to concede a very large number of boiler tube failures is unrealistic and inconsistent with the results of more recent tube modelling. Instead the new consequence claim follows a more realistic assessment and only concedes tube failure in the stiffest region of the superheater due to a boiler drop. These are single tubes (‘mono-tubes’) which enter a bifurcation where the second inlet is capped, known as the ‘mono bifurcations’. The case concedes failure of all 9 mono-tubes. This is still considered conservative, as the analysis work does not predict any tube failures, but nevertheless the water ingress consequence case is based on this assumption.

32. The current safety submission, Ref. 1, is a time limited case, looking to support operation of specifically HYA R1 to the 31st August 2015 or 240 days at power (whichever is sooner). I have presented the key structural integrity claims below.

2.4 Claim 1 - Integrity of Key Butt Welds on Operating Boilers is Adequate to justify an Infrequent Boiler Spine Failure at a Frequency of 10-3 pry

33. Claim 1 looks to demonstrate that the evidence supporting Ref. 6 remains applicable to the three operating boilers in HYA R1and in particular that:

On-going metallurgical assessment confirms that the judgements regarding the failure mechanism presented in Ref. 6 remain valid.

The level of inspection coverage on HYA R1 is comparable with the inspection coverage on HYA R2, HRA R1 and HRA R2.

The forewarning of failure case presented for A, B and C quadrants on HYA R1

remains consistent with that provided in Ref. 6.

A target temperature reduction of 40ºC is proposed by this safety case to provide a factor of 10 reduction in creep damage accumulation rate and crack growth rate. This target temperature reduction remains consistent with Ref. 6.

2.5 Claim 2 - The risk of Spine Failure in 1D Quadrant with the Reactor Operating on 3 Quadrants is not Significantly Changed from the Shutdown State

34. This claim is specific to Delta quadrant of HYA R1 (consisting of Pod boilers 1D1 and 1D2) which will be isolated during the next period of operation. When a boiler is isolated the tubes are charged with nitrogen and, the circulators are isolated with the inlet guide vanes almost shut so that no hot CO2 gas can pass over the boiler tubes. The temperature of the structure is maintained at approximately 300ºC (known as T1 conditions). This claim aims to demonstrate that:

operating conditions with 1D boiler quadrant shutdown are understood and can be adequately monitored, and that 1D2 boiler is not considered to be at risk of failure whilst remaining isolated.

further degradation of the defect associated with weld 12.3 in 1D1 will be insignificant at T1 temperatures

in the unlikely event that 1D1 spine fails then the nuclear safety significance

has been minimised



2.6 Claim 3 - Adequate Protection Remains Available to Ensure Consequences from

Faults on 3 Quadrants Remains Tolerable

35. This claim concerns the treatment of potential fault sequences and the availability of post trip cooling under 3 quadrant operation. This claim will be considered predominantly by the fault studies and PSA assessors, however the claim that:

There is no significant challenge to reactor internals from the proposed operating configuration.

will require structural integrity assessment.

2.7 Claim 4 - The Nuclear Safety Risk associated with Restart of HYA Reactor 1 on 3 Quadrants is ALARP

36. The purpose of Claim 4 is to confirm that all other reasonably practicable measures have been implemented to minimise the risk. It focuses on:

effects of reduced power operation on reactor plant

an understanding of the protection against faults

minimisation of station risks under 3 quadrant operation

37. Overall the case concludes that the risks associated with 3 quadrant operation with a defective spine are shown to be tolerable and all reasonably practicable measures are being implemented to minimise the risk for return to service at this point in time.

2.8 Commitments

38. A total of 6 Commitments are raised to further strengthen the claims in the case (see Annex 1). All of these are relevant to structural integrity:

Commitment 1: The condition of the 1D boiler quadrant restrictor tubes will be confirmed. This will be achieved either by fitting a dead-space thermocouple or by measuring restrictor tube wall thickness. This shall be carried out during the next available in air outage.

Commitment 2: Review SRS test reports when available to confirm that the SRS design substantiation requirements have been met and the claims made on the SRS in this case remain valid.

Commitment 3: Undertake a review of the relevant gas circulator penetration ASME and concrete assessments against frequent and infrequent boiler spine failure in support of the next update of the boiler spine safety case

Commitment 4: Review 3 quadrant operation safety case for adequacy if long term 3 quadrant case is needed. Include consideration of wider impacts on potentially impacting plant lifetime (e.g. hotbox dome or CLA)

Commitment 5: If reasonably practicable undertake a remote visual inspection of 1D1 at the next appropriate in-air shutdown opportunity, potentially during the next planned HYA R1 statutory outage in 2016. The implementation of this commitment will be managed by the PSRG.

Commitment 6: Update NSG procedure HYA/SWI/NSG/015 to carry out monthly check of 1D1 strain gauge data to confirm there is no significant change in strain gauge response which could be indicative of spine failure.



3 ONR ASSESSMENT

39. This assessment has been carried out in accordance with HOW2 guide NS-PER-GD-014, “Purpose and Scope of Permissioning” (Ref. 2).

3.1 Scope of Assessment Undertaken

40. The scope of the assessment will cover the structural integrity aspects associated with the case, and in particular those aspects which differ from the consolidated safety case for the boiler spines (Ref. 11) and the recent update (Ref. 6) both of which were previously assessed by ONR in Refs. 10 and 12.

41. My assessment of the claims, arguments and evidence related to the claim that integrity of key butt welds on operating boilers is adequate to justify an infrequent boiler spine failure at a frequency of 10-3 pry (Claim 1) will utilise a similar assessment (Ref. 10) of the recent return to service case of the other 3 affected reactors (Ref. 6). In particular it will consider if the ONR assessment of Ref. 6 is challenged by operation on 3 quadrants. I will not review the structural integrity arguments and evidence related to the consequential boiler tube damage predicted following the failure of an on-load boiler spine and the likelihood of multiple spine failures occurring during a seismic event as I assessed this in Ref. 10.

42. My assessment will also consider the structural integrity arguments used to support the claim that the risk of spine failure in 1D quadrant with the reactor operating on 3 quadrants is not significantly changed from the shutdown state (Claim 2). Considering the bullet points associated with this claim noted in Section 2.5 above, I believe that the intent of Claim 2 is to ensure that the nuclear safety risks resulting from the failure of 1D1 spine are not significantly changed from the shutdown state. This is based on an increased likelihood of failure of 1D1 boiler spine in the isolated condition, but with improved mitigation provided by the SRS. In particular it will consider the arguments justifying operation with a 450mm circumferential extent defect in a 1700mm circumference, 35mm thick structural component.

43. My assessment will consider if there is a significant challenge to reactor internals from the proposed operating configuration (Claim 3). This claim also concerns the treatment of potential fault sequences and the availability of post trip cooling under 3 quadrant operation which will be considered predominantly by the fault studies and PSA assessors.

44. Assessment of the claim that the risk associated with the proposed return to service (RTS) of the three reactors is Tolerable and ALARP (Claim 4) is principally assessed in the PSA assessment (Ref. 8). However, this assessment will take an overall view on the ALARP position with regard to Structural Integrity.

3.2 Use of the SAPs

45. Table 1 of this report includes the key SAPs (Ref. 3) which have been used throughout this assessment in order to come to a judgement on the adequacy of the Claims, Arguments and Evidence provided in the safety case.

46. For example, when judging the risk of spine failure in 1D quadrant with the reactor operating on 3 quadrants is not significantly changed from the shutdown state (Claim 2), particular cognisance was taken of (SAP descriptions précised for the context applied):

EMC.1 - the metal component or structure is tolerant of defects. EAD.2 - Adequate margins should exist to allow for the effects of degradation EMC.5 - Components should be tolerant of defects



EMC.21 - Components should be operated within defined limits consistent with the safe operating envelope defined for the safety case

EMC.32 – Stress analysis should demonstrate that the component has adequate life taking onto account time related degradation mechanisms

47. Claim 2 is based on justifying a failure frequency of 10-2 pry for the 1D1 spine. The SAPs recognise the difficulty in making such claims. The introductory section to the integrity of metal components and structures, Paragraph 284, notes the lack of suitable reliability data to support such claims, and that assessment will be based primarily on engineering practice.

48. Paragraph 299 also notes that the structural integrity claim does not need to be as robust where there are lines of protection against component failure. A failure frequency of 10-3 pry, as claimed for the operating spines (Claim 1), is a relatively modest integrity claim for a metal component or structure. This is sufficient to support the spine safety case due to the lines of protection available to protect against a spine failure (Ref. 7), but it means that the integrity arguments needed to support the 10-3 pry failure frequency can be less robust than if a higher reliability was being claimed. A reliability claim of 10-2 pry for the 1D1 spine implies that the consequence of failure would require further mitigation above and beyond those of the operating spines.

3.3 ONR Interactions with the Licensee

49. ONR has interacted during the development of all aspects of the boilers spine safety case since the presentation of a short term safety case in 1999. More recently, particularly since the detection of the anomaly in HYA 1D1, ONR has held weekly teleconferences and regular Level 4 technical meetings where progress with research supporting safety case development, has been discussed.

50. The safety case was in a relatively advanced position when NGL presented it at a Level 4 technical meeting 9 December 2014, Ref. 13. When the final case was received ONR raised a number of questions of clarification and these were discussed during a number of telephone conferences. The raising of questions is a normal part of the regulatory process. Written responses were provided by NGL to all of the questions and these are stored in a Trim folder 4.4.2.15401. The answers to these are important to aid ONR’s understanding of the case, but in most situations the responses (particularly when raised by a separate discipline area such as fault studies or PSA) are not referred to in this assessment. Where the question is of more significance, particularly those raised by the civil engineering assessor where the response enhances or supplements the case, then the question and its response are referred to in the assessment.

51. ONR has held frequent interactions with Licensee Independent Internal Nuclear Regulator (INA) to understand day to day issues with development of the various aspects of the boiler spine safety case since the discovery of the anomaly in 2013. These interactions enable ONR to establish the level of challenge the internal regulator was posing. INA has employed technical subject experts to assess the capabilities of the inspection techniques and the interpretation of the cracking in Heysham 1 Reactor1 1D1 boiler spine; the reports have been shared with ONR.

3.4 Assessment

52. Claim 1 and Claim 2 both raise a reliance of the quality of build of the boiler spines and the key causal factors leading to the cracking associated with weld 12.3 of 1D1 and the results of inspections on all the spines. On that basis I will discuss the causal factors first, followed by an assessment of the inspection results and a discussion on the potential for further degradation of the defect in 1D1 and the design of the structural restraint system. I will go on to consider the effects of three quadrant operation on the



reactor internals (Claim 3), noting that the fault studies inspector will lead on Claim 3 and lastly will give consideration to ALARP (Claim 4) noting that the PSA assessor will lead on this aspect.

3.4.1 Causal Factors

53. During the inspection outage of HYA R1 in 2014, NGL have performed manned vessel entry to inspect the weld 12.3 region of HYA 1D1 using visual, eddy current, ultrasonic and radiographic non-destructive testing techniques. These identified an almost through thickness crack immediately below the weld in the reheater hub forging. Subsequently a material sample was removed from this region. NGL have analysed this sample and have recently reported the findings in Ref. 14.

54. The report notes that the crack is located within the parent material of the hub forging within specifically the Heat Affected Zone (HAZ) of weld 12.3. The weld has been shown to be made up of a series of three buttering weld runs, laid before machining a weld preparation for weld 12.3 within the buttering. The true weld 12.3 is thus adjacent to and above this weld buttering layer. NGL believe that the metallographic assessment indicates that there has been a significant effect of repeated heating on the microstructure of the parent material thus making it more susceptible to creep/reheat cracking. I accept that the root cause of the cracking is probably associated with presence of poorly controlled weld buttering and that crack extension is by a creep mechanism.

55. The report notes that the crack probably initiated early in life, sub-surface, by a reheat cracking mechanism and propagated stably by a creep-crack growth mechanism. The crack eventually snapping through to the surface of the spine when the remaining ligament was unable to support the system stress, causing the crack to gape at the surface. The crack became of a size sufficient for detection by GWT at some time between the inspections conducted between the 2010 periodic shutdown and when it was first detected during the 2013 periodic shutdown. GWT was developed to detect surface breaking defects at long distances from the input transducers and therefore may only have been capable of detecting the crack when it snapped through to the surface. NGL are currently conducting research to assess the techniques capability for detecting sub-surface defects (this is a commitment to Ref. 6).

56. NGL has produced a summary document outlining the known build history for HYA R1, Ref. 15. The build review did not identify any documentary evidence of weld buttering in 1D1 and the fact that this process is not reflected in the build records obviously casts doubt on the build quality. The build history review however does identify other less significant smaller repairs which have been considered in the previous safety cases and notes a number of other concessions of lesser significance. This leads me to support NGL’s opinion that the presence of buttering or significant weld repairs is unlikely to be widespread, but cannot be entirely discounted. Creep damage accumulation is dependent on the interaction of stress and temperature over time on a susceptible material and thus uncertainty in any of these requires consideration. I believe that NGL have identified the dominant stresses affecting the boiler spine and have considered them in their analysis. The effects of the buttering on weld residual stresses which could contribute to cracking have yet to be established with any certainty. There is also a possibility however that local temperature variation may lead to small local increases in stress. NGL also note that boiler pod 1D1 had a number of excessive temperature excursions during its early operational life, and was the lead in terms of time at highest operating temperature and thus was generally most susceptible to creep.

57. I accept that the cause of the cracking in 1D1 is likely to be dominated by the presence of weld buttering and it is unlikely to be widespread. I acknowledge the fact that as the observed cracking is not within the weld the conclusions of the previous consolidated



safety case (Ref. 11) are not invalidated but identifies a shortfall in its coverage. As I previously stated (Ref. 10) I judge that HYA 1D1 is likely to be the lead in terms of creep damage accumulation, but it is difficult to determine the margin with any certainty.

58. NGL has made a commitment in Ref. 6 to progress root cause investigation work to further improve understanding of the factors which have contributed to the HYA 1D1 cracking. ONR will continue to monitor progress in this area.

59. Following the identification of the crack in HYA 1D1, NGL committed to inspect all the creep susceptible welds on all the boiler spines of the four affected reactors, so far as is reasonably practicable (SFAIRP). I have discussed the techniques and the findings in my previous assessment, Ref. 10, but I will give a brief précis of the techniques applied and an opinion of how representative the results are from HYA R1.

60. All the spines were subjected to a long range ultrasonic inspection using guided waves testing (GWT) utilising a new design of “Teletest” coil specifically designed (known as a Permamount) to correctly couple with the boiler spine. This coil is permanently mounted external to the reactor below the boiler feed water inlet header. When energised, the spine is flooded with ’sound’ energy and an echo would be received from any defect above the detection capability. No responses were received above the detection threshold with the exception of HYA 1D1. The detection capability of GWT varies with respect to weld location; smaller defects can be detected nearer the coil.

61. NGL developed and deployed a visual technique where a 6mm diameter video probe could be deployed down a guide tube inserted in either the instrument or TV penetration available on the top of the BCU. The two access penetrations are on opposing sides of the boiler closure unit and use of appropriate guide tubes gives vertical access at 45 degree intervals around the boiler circumference. Thus the inspection positions are separated by a distance of 213mm and NGL claim that with access at all locations there will be no significant missed regions of coverage. This is on the basis that three probes are deployed at each location: one forward looking and two side looking and thus each position will provide coverage of at least 1/8th of the circumference (an octant).

62. Unfortunately there were a known number of restrictions to test within the spine population; on some boilers the instrument penetration was occupied by cabling rendering 50% of the circumference inaccessible. Further restrictions were also encountered as in other cases where the gap between the reheater shroud and the spine was less than 6mm due to the shroud being mounted eccentrically. There were other construction features present which cause restrictions, such as locating screws.

63. The claimed capability for visual inspections is not definitive. Embedded defects will not be found and part penetrating defects which have limited crack opening might be missed. I note that the fully penetrating defect as seen on HYA boiler pod 1D1 was made up of three separate defects penetrating the outer surface of the spine, each of approximately 150mm surface extent. Two were gaping and one ‘tight’, and all three were visible prior to surface preparation. I judge that this would support the premise that defects circa 150mm long would be seen using similar techniques, particularly if they were gaping.

64. Further inspections were also performed using strip radiography which was deployed on a limited number of boiler spines: two on HYA R1 and nine in total across the four reactors to provide a diverse volumetric inspection of the weld 12.3 region. The technique utilises a radiographic film strip deployed down the annular gap (and thus is susceptible to the same restriction as the visual inspections) and a source deployed down a boiler feed inlet tube. NGL state that radiography is capable of detecting



defects with a through wall extent greater than 15mm, irrespective of where the defect lies through the section. This technique, which only covers part of the circumference, provides diversity; no defects were detected by this method.

65. Of the thirty two spines only six had no restrictions to test and three of these were on HYA R1. I judge that the coverage achieved on HYA R1 was better than the average and that NGL conducted visual inspections SFAIRP with the techniques and access available at the time. Nothing was found which challenges ONR’s assessment of Ref. 6.

3.4.2 Potential for further degradation of the defect in 1D1

66. NGL have performed a similar analysis of the defect in 1D1 to that in the other spines which ONR assessed in Ref 10. The difference is that in the other spines the starting defect size was postulated to be the maximum size potentially missed by the inspection technique, whereas in 1D1 the defect size is known and in the operating boilers crack extension was considered to be by a creep mechanism. In 1D1 only marginal growth is predicted. NGL has produced a report (Ref. 16) which presents critical defect sizes for parent material, HAZ and weld material using both best estimate and bounding material properties, modelling operational stresses (acknowledging the boiler is empty and not subjected to gas drag force) and, both frequent and infrequent seismic loading.

67. The report presents a conservatively calculated critical defect size (using R6 Option 1 (Ref. 22) route following their internal guidance in Ref. 17) of 600mm for the HAZ of a normal Weld 12.3 based on a measured room temperature initiation fracture toughness of 190 MPa √m; this compares to the current extent of the main crack on Heysham 1D1 Weld 12.3 of ~450mm. NGL note that the fracture toughness of the HAZ associated with the weld buttering may be poorer than that of a standard HAZ, but the toughness would need to be less than half for fracture to initiate from the current defect under infrequent loading. The report argues that any defect extension (under fracture) is likely to be confined to the HAZ as this is the location of the current crack. I support this view as the material ahead of the crack tip (in the small intense plastic zone) is likely to be creep damaged promoting a predominant initial fracture path.

68. NGL has conducted similar analyses for the other material regions associated with the weld and I note NGL conceded tearing to show a margin between the current crack and the critical defect size. NGL note that with the boiler isolated, the operating temperature will be restricted to around 300ºC (known as T1 conditions) and hence creep crack growth will be minimised. NGL further state that there are no other active degradation mechanisms.

69. Since the defect is large I asked NGL to provide evidence that the crack could not extend by vibrational fatigue. I received responses stored in Trim File 4.4.2.15401. Based on displacements estimated from the accelerometers mounted on 1D1, a stress intensity factor range <0.5MPa√m was predicted at the crack tip assuming a conservative representation of the cracking as a fully penetrating single defect of length 450mm. This compares to a threshold stress intensity factor range for fatigue crack growth for austenitic stainless steels AISI Type 316, 304 and 321 (Ref. 23) of 2MPa√m. NGL note that data for Esshete 1250 are not available, but they expect the threshold to be similar. I am content that the fatigue properties of Eshette are likely to be similar to those of other similar austenitic stainless steels. I judge this analysis is adequate as the displacements were the maximum obtained with the boiler in operation; the absence of gas flow and circulator vibration is likely to decrease the displacements.



70. NGL has assigned a failure probability of 10-2 pry (a frequent event) to the 1D1 spine following a 10-5 pa infrequent seismic event. Whether the spine would fail during an infrequent seismic event is more difficult to justify as the properties of the HAZ associated with the weld buttering are likely to be inferior to those of a ‘normal’ HAZ. I note however that there are a number of conservatisms within NGL analysis such as failure being conceded when a local region of the crack tip exceeds the fracture toughness of the material, rather than across the entire crack front. The crack is also modelled as a single fully penetrating defect, whereas the degradation in 1D1 is made up of three overlapping defects and does not appear to fully penetrate the thickness.

71. Based on the evidence presented I judge that the defect is unlikely to extend significantly during operation in the isolated condition on the basis that there are no active degradation mechanisms. I noted in the assessment of Ref. 6 that “the net effect (due to uncertainties with the material property input data) is to add additional uncertainty into the limiting defect size predictions as well as the prediction on in-service crack growth”. On this basis there is no change to the judgement in Ref. 10 and hence failure will be in the frequent failure category but nearer the 10-3 infrequent failure boundary for 1D1 in the isolated state.

72. For the spine in 1D2, 100% visual inspections were achieved in and around weld 12.3 and no defects detected. On the basis that the system loads and temperatures will be reduced and the material properties will be superior to those at high temperature then I judge that the failure frequency of this spine will be improved over that of the other operating spines on HYA R1.

3.4.3 Structural Restraint System

73. If aspine should fail under normal operating conditions there is a potential for boiler tubes to fail and water to enter the reactor potentially leading to vessel over pressure and an inability to cool the core. In addition the boiler could drop onto and impact the gas circulator housing potentially compromising a major IoF (incredibility of failure) penetration. With 1D1 operating in isolated mode the former two faults are mitigated but the latter is conceded above as a frequent event. NGL have therefore designed and installed a structural restraint system (SRS) to protect the gas circulator penetration from a direct impact. I have asked Civil Engineering Assessor to provide an input to my assessment (Ref. 19) and I have summarised the response below.

74. The SRS consists of six M64 shear bolts mounted in the lower section of the boiler gas seal outer cylinder whose function is to absorb the impact energy of the boiler and transmit the load through the steel structure into the concrete pressure vessel. The bolts are predicted to have an ultimate shear capacity of 5.82MN. The system is designed to reduce the potential drop height from 241mm to 52.9mm assuming an operating temperature of approximately 300ºC.

75. The scope of the civil engineering assessment was to review Argument 2.3 (function and benefits of the SRS) and in particular to assess how the load from 1D1 boiler drop will be transmitted to the concrete and its effects on the concrete. The assessment of Argument 2.3 and the evidences associated with this argument, especially Evidence 2.3.4 (ASME BPVC Section III Section NB and ACI 349 assessments of 1D1 gas circulator penetration integrity) raised a number of queries that were answered by the Licensee and are in Trim File 4.4.2.15401.

76. The Civil Engineering Assessor (CAE) assessed the documentation supporting Evidence 2.3.4. NGL conducted two analyses: an ASME BPVC Section III Section NB assessment of the loading applied to the gas circulator penetration and an ACI 349-13 assessment of the supporting concrete.



77. The ASME analysis substantiates the gas circulator anchors and the weld in the upper landing ring for an impact drop loading of 7.97 MN. The analysis considers that demonstrating code compliance will imply a failure frequency of 10-5 per reactor year. The CAE notes a number of shortfalls in the analysis but concedes that adequate justification is provided in all cases. The CAE concludes that the loading is conservative, and therefore the bracket will transmit the majority of the loading to the concrete.

78. I have also consulted the NGL Technical verification statement which states that “for the ASME III Level B assessment, suitable reserve factors were calculated with the exception of when the shear capacity of the upper landing ring is not included (reserve factor of 0.6)”. Clarification provided by the assessment authors and input from an independent NGL Energy Structural Integrity SQEP has confirmed that there is no reason that the shear capacity of the upper landing ring should not be included and hence it is considered that the requirements of the code have been satisfied”.

79. On the basis that the CAE and NGL Independent Verification have independently reached the same conclusion I can accept that the Code Limits are satisfied.

80. The CAE has assessed the ACI 349 gas circulator concrete analysis conducted by NGL. This calculation assesses the anchors as bolt anchors subject to a tensile force and calculates the break-out cone, based on an anchor embedment, does not meet the code requirements. The CAE notes that Code is not strictly applicable to this loading arrangement because it does not take account of the pre-stress in the wall and notes that the level of pre-stress in the concrete is substantially higher than the applied load. The CAE considers that the level of pre-stress in the concrete will restrain the concrete break-out cone provided that the level of pre-stress of the G tendon group around 1D1 boiler is maintained. The CAE recommends that a more thorough calculation should be undertaken to establish the level of conservatism. The CAE notes that the Licensee has committed to review their analysis.

81. I have also consulted the statement from the NGL technical verifier who states “For the ACI 349-13, code compliance is not met”. However, the NGL SQEP technical reviewer has determined that the code assessment may not be applicable for this plant (due to the depth at which the circulator liner anchor is embedded in the concrete), nor does the code assessment take into account pre-stress. Accounting for such factors, confidence is provided in the integrity of the supporting concrete structure. This view is supported by the civil specialist assessment of this proposal (and the author of the supporting calculations). However, the clarity of the SRS reliability and the integrity of the gas circulator penetration and supporting concrete structure could be made clearer beyond this return to service case”.

82. In summary the ONR Civil Engineering Assessor and the NGL Technical verifier have independently reached the same view on the ACI 349-13 code analysis.

83. I note that there are two additional conservatisms in the analysis which have not been considered, firstly on failure the boiler is assumed to drop without contacting the boiler liner wall and the drop will not be retarded by the boiler tubes. In my opinion the boiler tubes have the potential to support the mass of a boiler, particularly under the isolated condition.

84. I note NGL intend to substantiate the shear capacity of the bolting arrangement by test, but this work is not yet complete. NGL has raised an interim statement showing that the test results to date support their conclusions (Ref. 24), and I am satisfied there is no reason to suggest that the calculated shear capacity will not be confirmed. NGL has raised a commitment to confirm these values on completion of the tests.



85. I note that NGL has recognised that further work is needed to support their analysis and has raised two commitments to confirm the position:

86. Commitment 2: Review SRS test reports when available to confirm that the SRS design substantiation requirements have been met and the claims made on the SRS in this case remain valid.

87. Commitment 3: Undertake a review of the relevant gas circulator penetration ASME and concrete assessments against frequent and infrequent boiler spine failure in support of the next update of the boiler spine safety case.

88. I support these commitments, but overall I am content that a reliability of 10-5 pa has been be substantiated for the SRS.

89. Argument 2.3 also considers the situation of a spine failure during the shutdown situation where the drop heights are greater due to the lower level of spine expansion. It notes that the SRS cannot be demonstrated as remaining fully functional for the drop height associated with 1D1 in the cold, minimum length, maximum drop height condition. The case argues that this situation is bounded by the case for boilers where there is no SRS in place on a time at risk argument, so there are no additional concerns. It also notes there is a margin against ASME III Level D allowables. ONR finds time at risk arguments difficult to accept, but I recognise that the likelihood of spine failure when cold is much lower than in other circumstances and that there are still margins available when compared with ASME III Level D allowables. I do not therefore consider the potential for spine failure during a shutdown to be of particular concern and the integrity of the gas circulator penetration under these conditions was previously accepted by a Civil Engineering Assessor in Ref. 20.

3.4.4 Challenge to reactor internals from the proposed operating configuration.

90. Operation of the reactor at reduced power will produce the same uncertainties as those considered in the three reactor case, Ref. 6 as previously assessed by ONR in Ref 10. In general all the regions which normally operate under T1 conditions will continue to operate under similar conditions. The exceptions are the two boilers in Delta Quadrant; 1D1 and 1D2.

91. Potentially the low alloy or mild steel sections of the boiler spine will become susceptible to oxidation. This degradation mechanism is particularly active at temperatures in the region of 400ºC. Oxidation in a CO2 atmosphere causes thinning and in particular breakaway oxidation is a relatively rapid process where oxide spalling progressively exposes more reactive virgin material. Maintaining temperature below 380ºC restricts the propensity for mild steel oxidation. NGL have established an operating limit of 350ºC to prevent such degradation although OPEX from 3 quadrant operation suggest that 300ºC is unlikely to be exceeded. On this basis I judge that the spine integrity will not be challenged by oxidation damage.

92. I note that the boiler tubes are made from similar materials and are equally susceptible to oxidation. As the tubes in delta quadrant will be stored dry there will be no threat to nuclear safety during three quadrant operation, however should these boilers be returned to service appropriate inspections will be required to support return to service.

93. It is unlikely that other items of plant will be adversely affected as they were designed to avoid this known issue and the plant is unlikely to be affected due to only approximately 7 months operation on 3 quadrants; however as a prudent measure NGL has raised a commitment:



Commitment 4: Review three quadrant operation safety case for adequacy if long term 3 quadrant case is needed. Include consideration of wider impacts on potentially impacting plant lifetime (e.g. hotbox dome or CLA)

3.4.5 ALARP Improvements

94. NGL have fitted permanent GWT transducers to all the operating spines beneath the feed water inlet header, identical to those on the other three operating reactors. In addition a further coil has been similarly mounted on 1D1. There is some doubt as to whether the transducer will remain operational for a substantial period of time on 1D1 due to the increased operating temperature local to the feed water header; normally the feed water will provide cooling to this area of the spine. The intent is to interrogate the signal on a regular basis to assess the system performance on a known defect and thus provide potential benefits to the operating spines. The system has the potential to detect further degradation on 1D1.

95. There is a strong possibility that failure of any boiler spine may be un-revealed as the boiler tubes are capable of supporting the mass of the boiler structure particularly off-load. As a measure to detect 1D1 failure, header strain gauges have been fitted to boiler pod 1D1 and strain gauge output will be monitored locally during start-up and periodically during operation. NGL have raised a commitment to:


3.4.6 Assessment of Claim 1: Integrity of Key Butt Welds on Operating Boilers is Adequate to justify an Infrequent Boiler Spine Failure at a Frequency of 10-3 pry

96. Claim 1 looks to demonstrate that the evidence supporting a similar claim in Ref. 6 remains applicable to the three operating boilers in HYA R1 and in particular that:

On-going metallurgical assessment confirms that the judgements regarding the failure mechanism presented in Ref. 6 remain valid.

The level of inspection coverage on HYA R1 is comparable with the inspection coverage on HYA R2, HRA R1 and HRA R2.

The forewarning of failure case presented for A, B and C quadrants on HYA R1

remains consistent with that provided in Ref. 6.

A target temperature reduction of 40ºC is proposed by this safety case to provide a factor of 10 reduction in creep damage accumulation rate and crack growth rate. This target temperature reduction remains consistent with Ref. 6.

97. I have considered the more recent findings from the metallurgical examinations in Section 3.4.1 above and judge that the properties of the HAZ could be degraded in the presence of uncontrolled buttering. I agree that buttering is unlikely to be widespread and that further occurrences of uncontrolled buttering similarly so: my judgement remains unchanged that uncontrolled buttering is unlikely to be widespread.

98. I have judged that the level of inspection coverage on HYA R1 is consistent with that of the other spines on the other reactors and thus the size of the defect potentially missed by inspection is consistent with Ref. 6.

99. The forewarning of failure case relies on the size of the largest potential defect missed by inspection, plus an analysis of the growth rates and calculated critical defect size. In the absence of uncontrolled buttering I judge that ONR’s assessment of NGL’s



previous case remains unchanged. If there was uncontrolled buttering present and any cracking associated with it is unrevealed, the defect must be smaller than the size assumed missed by NDT. I have supported the reduction of temperature in ONR’s assessment (Ref. 10) as being both prudent to reduce the likelihood and rate of any further damage given the uncertainties that still exist in the case, and necessary in order to support Claim 1 on the integrity of the operational butt welds in the spines in my assessment of Ref. 6. As creep is a temperature dependent phenomenon this reduction in temperature will also retard the growth of a defect associated with uncontrolled buttering in the HAZ. NGL has produced a more recent summary assessment (Ref. 18) supporting their structural integrity analyses of the frequent and infrequent loading cases with the inclusion of residual stresses to account for the effects of weld repair. This report notes that the weld properties are inferior to and bound those of the HAZ and thus use of the calculated critical defect sizes from the weld would provide additional conservatism. I support this cautious approach and agree that Ref. 6 is not compromised.

100. ONR recognises the difficulty in assigning a failure probability to a structure on the basis that there are so few data available to supply a meaningful population. There is a further difficulty when there are so many uncertainties within the supporting structural integrity calculations.

101. My judgement is unchanged from the previous case where I accepted, on a judgement basis, that the evidence supports a random failure frequency for boiler spine at power that is of the order of 10-3 pry, which provides support to Claim 1. My judgement that the failure frequency will be on the frequent side of the 10-3 pry boundary due to the difficulties in quantifying this number is also unaffected.

102. In conclusion on the basis of the evidence provided in support of Claim 1.

I continue to accept, on a judgement basis, that the evidence supports a random failure frequency for boiler spine at power of the order of 10-3 pry, which provides support to Claim 1. This is made on a judgement basis due to the difficulty in quantifying the failure frequency for a number of reasons explained within the assessment of Claim 1.

I do not accept the view of Claim 1 that the failure frequency will be on the infrequent side of the 10-3 pry boundary due to the difficulties in quantifying this number. I consider that a cautious approach should be taken and the failure frequency should be considered to be on the frequent side of the boundary.

3.4.7 Assessment of Claim 2 - The risk of Spine Failure in 1D Quadrant with the Reactor Operating on 3 Quadrants is not Significantly Changed from the Shutdown State

103. This claim is specific to Delta quadrant of HYA R1 (consisting of Pod boilers 1D1 and 1D2) which will be isolated during the next period of operation. When a boiler is isolated the tubes are charged with nitrogen and, the circulators are isolated with the inlet guide vanes almost shut so that no hot CO2 gas can pass over the boiler tubes, the temperature of the structure is maintained at approximately 300ºC (known as T1 conditions). This claim aims to demonstrate that:

operating conditions with 1D boiler quadrant shutdown are understood and can be adequately monitored, and that 1D2 boiler is not considered to be at risk of failure whilst remaining isolated.

further degradation of the defect associated with weld 12.3 in 1D1 will be insignificant at T1 temperatures

in the unlikely event that D1 spine fails then the nuclear safety significance has been minimised



104. I believe that the intent of Claim 2 is to ensure that the nuclear safety risks resulting from the failure of 1D1 spine are not significantly changed from the shutdown state. I have considered each bullet in turn.

105. For the spine in 1D2, 100% visual inspections were achieved on weld 12.3 and no defects detected. I believe that isolating Delta Quadrant is a further prudent measure in that the loading on the defective spine is reduced from the absence of a full boiler inventory and gas drag forces. Isolation also reduces the temperature further to approximately 300ºC, which will make further creep crack growth unlikely. As spine 1D2 is also bounded by the operating spines across the 4 reactors I judge that the likelihood of 1D2 boiler spine failing is minimised in the isolated state.

106. In Section 3.4.2 I have considered the potential for further degradation of 1D1 with the boiler isolated and have judged that further degradation is unlikely as there are no active degradation mechanisms. My view is predicated on T1 conditions being maintained. The fault studies assessor has concluded that (Ref. 8); “In relation to Claim 2 and the evidence addressing the operating conditions in the isolated boilers, whilst based on limited thermocouple data, I accept that Weld 12.3 in the isolated boilers will be close to T1 levels (~300ºC) due to the reverse flow of T1 gas flow up through the boilers which is needed to control tubeplate temperatures.” I can therefore conclude that further degradation of the defect associated with weld 12.3 in 1D1 will be insignificant at T1 temperatures.

107. In order to judge that the risks posed by failure of 1D1 in the isolated state is not significantly changed from the shutdown state then from a structural integrity perspective it is necessary to show that the Incredibility of Failure (IoF, 10-7 pry failure rate) claim on the gas circulator penetration is unchanged from its shut-down condition. The Licensee is relying on a combination of a 10-2 pry failure rate on 1D1 boiler spine and a 10-5 pry claim on the SRS. In Section 3.4.2 I have concluded that the probability of 1D1 failing whilst operating in the isolated condition is predicted to be similar to that of the operating spines, thus 10-2 is achieved. In Section 3.4.3 I have formed the view based on the judgements of two ONR Civil Engineering Assessors and the independent technical verification statement provided by the Licensee that the 10-5 pry claim on the SRS is achieved.

108. I therefore accept both failure rate claims cited by the Licensee individually, but I do not consider the Licensee’s approach of combining the failure rate claim for the spine and failure rate claim for the SRS to be suitable for making an IoF demonstration in its own right. I am, however, satisfied that the SRS will be effective in protecting the gas circulator penetration from impact from the boiler in the event of a failure of the 1D1 spine. Given that the SRS is effective, the failure of the 1D1 spine with the SRS fitted would not lead to additional loading on the penetration. As there is no additional loading, there would be no effect on the penetration, and I can accept that the existing IoF demonstration would not be affected. I therefore judge that operating 1D1 in the isolated condition with the structural restraint system fitted will not compromise the existing 10-7pry IoF claim on the gas circulator penetration and will minimise the nuclear safety consequences following the unlikely event of 1D1 failing.

109. I conclude from a structural integrity perspective that I can support Claim 2 and judge that risks posed following spine failure in D1 quadrant with the reactor operating on 3 quadrants is not significantly changed from the shutdown state.

110. I noted in Section 3.4.5 that there is a possibility that failure of any boiler spine may be un-revealed as the boiler tubes are capable of supporting the mass of the boiler structure particularly off-load. For 1D1 the boiler could lower onto the SRS without causing any perturbation to the reactor. Under this condition no further significant damage is likely to result on the reactor structure. As a measure to detect 1D1 failure, header strain gauges have been fitted to boiler pod 1D1 and strain gauge output will



be monitored locally during start-up and periodically during operation. NGL have raised a commitment to:


3.4.8 Assessment of Claim 3 - Adequate Protection Remains Available to Ensure Consequences from Faults on 3 Quadrants Remains Tolerable

111. This claim concerns the treatment of potential fault sequences and the availability of post trip cooling under three quadrant operation. This claim will be considered predominantly by the fault studies and PSA assessors; however I have considered the claim that there is no significant challenge to reactor internals from the proposed operating configuration in Section 3.4.4.

112. I note that maintaining temperature below 380ºC restricts the propensity for mild steel oxidation. I note NGL has established an operating limit of 350ºC to prevent such degradation although OPEX from 3 quadrant operation suggest that 300ºC is unlikely to be exceeded. On this basis I judge that reactor integrity will not be challenged by oxidation damage during 3 quadrant operation and I can accept Argument 3.4: There is no significant challenge to reactor internals from the proposed operating configuration.

3.4.9 Claim 4 - The Nuclear Safety Risk associated with Restart of HYA Reactor 1 on 3 Quadrants is ALARP

113. In terms of the claim that it is ALARP to return the reactor to service (Claim 4), I am satisfied that the inspections, modifications (in terms of reducing temperature of operation, isolating Delta Quadrant and fitting the structural restraint system) combined with implementation through the safety case presented are sufficient to allow the return to service. I conclude that returning Heysham 1 Reactor 1 to service is ALARP from a structural integrity perspective.

3.5 Licensee Commitments

114. The licensee has made a total of 6 commitments in Ref. 1 to undertake further work in support of further developing this safety case, see Annex 1. Five of these have specific relevance to the structural integrity aspects of the case, Commitments 2 to 6.

115. These commitments are supported by ONR, and are considered essential for on-going development of the boiler spine case. There is a specific need to ensure that ONR monitors progress against the structural integrity specific commitments and resolves them prior to the next scheduled restart of Heysham Reactor 1 from its shutdown in August 2015.

3.6 IIS Rating

116. As a result of this assessment several matters have been raised which will require regulatory follow-up as part of the proposed commitments programme. I consider however that the case is adequate to support restart and consequently this safety case has been rated as 4, below standard. Resolution of these matters collectively will be tracked as part of ONR Issue 2714. Notwithstanding this, it is judged that there are no significant issues that would prevent ONR giving Agreement for the return to service of Heysham 1 Reactor 1.



CONCLUSIONS AND RECOMMENDATIONS

3.7 Conclusions

117. This report presents the findings of the ONR assessment of the structural integrity aspects of EDF Nuclear Generation’s (NGL) safety case for the Return to Service of Heysham 1 Reactor 1 at Reduced Temperature Operation on 3 Quadrants following the discovery of a defect on Heysham 1 Reactor 1 Boiler Spine 1D1.

118. To conclude, I am broadly satisfied with the claims, arguments and evidence laid down within the Licensee’s safety case. More specifically I conclude:

In terms of the overall structural integrity claim (Claim 1): I continue to accept, on a judgement basis, that the evidence supports a

random failure frequency for boiler spine at power of the order of 10-3 pry, which provides support to Claim 1. This is made on a judgement basis due to the difficulty in quantifying the failure frequency for a number of reasons explained within the assessment of Claim 1.

I do not accept the view of Claim 1 that the failure frequency will be on the infrequent side of the 10-3 pry boundary due to the difficulties in quantifying this number. I consider that a cautious approach should be taken and the failure frequency should be considered to be on the frequent side of the boundary.

In terms of the structural integrity arguments supporting the assessment of the likelihood of Spine Failure in 1D Quadrant with the Reactor Operating on 3 Quadrants is not Significantly Changed from the Shutdown State (Claim 2):

I conclude from a structural integrity perspective that I can support Claim 2 and judge that risks posed following spine failure in D1 quadrant with the reactor operating on 3 quadrants is not significantly changed from the shutdown state.

In terms of the structural integrity arguments supporting the assessment of the Adequate Protection Remains Available to Ensure Consequences from Faults on 3 Quadrants Remains Tolerable (Claim 3):

I can accept the Argument that there is no significant structural integrity challenge to the reactor internals from the proposed operating configuration.

In terms of the structural integrity arguments support the assessment that the Nuclear Safety Risk associated with Restart of HYA Reactor 1 on 3 Quadrants is ALARP (Claim 4):

I am satisfied that the inspections, modifications (in terms of reducing temperature of operation, isolating Delta Quadrant and fitting the structural restraint system) combined with implementation through the safety case presented are sufficient to allow the return to service. I conclude that returning Heysham 1 Reactor 1 to service is ALARP from a structural integrity perspective.

Whilst I agree that the return to service is ALARP from a structural integrity perspective, I recognise that the safety case still includes a number of judgements and assumptions, and there are a total of 6 Commitments made for further work. Whilst these do not undermine my conclusions, these commitments are supported by ONR, and are considered essential for on-going development of the boiler spine case.



3.8 Recommendations

119. My recommendations are as follows.

Recommendation 1: I have no objection to the return to service of Heysham 1 Reactor 1 at reduced temperature of operation with Delta Quadrant isolated from a structural integrity perspective.

Recommendation 2: I recommend that ONR undertake a full review of all structural integrity related commitments prior to the restart from the next planned shutdown period of HYA Reactor 1 in August 2015.

120. Recommendations 1 and 2 for follow up action are captured under ONR Issue 2714.



4 REFERENCES

1. EC No: 354024 000 Proposal Version 03, Heysham Reactor 1: Interim Safety Case for Return to Service on 3 Quadrants Following Discovery of a Defect in 1D1 Boiler Spine December 2014 (TRIM Ref. 2014/470581)

2. ONR HOW2 Guide NS-PER-GD-014 Revision 4 - Purpose and Scope of Permissioning. July 2014. http://www.onr.org.uk/operational/assessment/index.htm

3. Safety Assessment Principles for Nuclear Facilities. 2014 Edition Revision 0. ONR. December 2014. http://www.onr.org.uk/saps/saps2014.pdf.

4. Integrity of Metal Components and Structures. NS-TAST-GD-016 Revision 4, ONR, March 2013, http://www.onr.org.uk/operational/tech_asst_guides/index.htm

5. Guidance on Mechanics of Assessment within the Office for Nuclear Regulation (ONR) (TRIM Ref. 2013/204124)

6. NP/SC 7717 Version 6. A Safety Case for Return to Service of Heysham 1 Reactor 2, Hartlepool Reactor 1 and Reactor 2 at Reduced Temperature Operation following the discovery of a defect on Heysham 1 Reactor 1 Boiler Spine 1D1. (TRIM Ref. 2014/425760)

7. Fault Studies Title and number ONR-CNRP-AR-14-094 Fault Studies Assessment - Boiler Spine - Return to Service - HYA R1 January 2015. (Trim 2015/341)

8. NGL - Heysham 1 - Assessment report - ONR-CNRP-AR-14-096 - PSA assessment of Heysham 1 reactor 1 RTS safety case on 3 quadrants and at reduced temperature - January 2015. (Trim 2015/733)

9. CNRP NGL Heysham Stage 1 Hartlepool Civil engineering opinion on potential for gas circulator penetration failure following a spine failure (EC351365) December 2013. (Trim 2013/452374)

10. NGL - CNRP - Assessment Report - 14-079 - Structural Integrity Assessment of the Safety Case for Return to Service of Heysham 1 Reactor 2, Hartlepool Reactor 1 and Reactor 2 at Reduced Temperature Operation following the discovery of a - 21 November 2014 (TRIM Ref. 2014/411978)

11. NP/SC 4226 Addendum 4 Hartlepool and Heysham 1 Power Stations. Consolidated Boiler Spine Safety Case. September 2010. (TRIM Ref. 2010/448252)

12. Hartlepool and Heysham1 - AR 11001 - Assessment of Consolidated Boiler Spine Safety Case NP SC 4226 Addendum 4 - Structural Integrity (2011/83112)

13. NGL - CNRP - Contact Record - 14-300 - HYA/HRA Boiler Spine Heysham Reactor 1 Return to Service Safety Case - Level 4 - 9 December Trim (2014/465877)

14. CNRP NGL Heysham Reactor 1 – Metallurgical Examination of the Sample of Cracking Removed from 1D1 Boiler Spine December 2014 E/EAN/BBHB/0334/HYA/14. (Trim 2015/6986)

15. Heysham 1 - Review of Case History in Respect of R1 Quadrants A, B and C Task File Note No E/TSK/HH1/12030/11/09/1 December 2014 (Trim 2015/7033)

16. CNRP NGL E/EAN/BBHB/0338/HYA/14, Heysham 1 Boiler 1D1 spine weld 12.3 defect

tolerance in the isolated condition, December 2014 (Trim 2015/7112)



17. BEG/SPEC/DAO/011 Rev 000 - Guidance on AGR Structural Integrity Related Safety Cases - - October 2009 (Trim 2010/546477)

18. CNRP NGL Hartlepool/Heysham 1 Power Stations. Summary of assessments undertaken for spine weld 12.3 postulated fully penetrating part defects E/EAN/BBHB/0351/HYA/14 December 2014 (Trim 2015/7285)

19. CNRP NGL Civil Engineering View on the Heysham Reactor 1 D1 Spine Structural Restraint System January 2015. (Trim 2015/8712)

20. CNRP NGL Heysham Stage 1 Hartlepool Civil Engineering opinion on potential for gas

circulator penetration failure following a spine failure (EC351365) December 2014. (Trim 2013/452374)

21. CNRP NGL Final Verification Statement 18-12-14 EC354024 Heysham Reactor 1 Interim Safety Case for Return to Service on 3 Quadrants Following Discovery of a Defect in 1D1 Boiler Spine Proposal 03 December 2014 (Trim 2015/750)

22. R6 – Assessment of the Integrity of Structures Containing Defects, Revision 4. EDF Energy Nuclear generation Ltd.

23. (editor), AGR Materials Data Handbook, R66 Revision 009 (2011)

24. CNRP NGL Statement on progress with the structural restraint testing in support of Heysham 1 reactor 1 boiler spine SISB/SAG/TPTS/6521 December 2014 (Trim 201/9304)

25. ONR IIS Rating Guide Table – TRIM Ref. 2014/12522



Figure 1 Hartlepool and Heysham 1 Boiler (Taken from Ref. 1)



Figure 2. Location of Boiler Spine Welds and materials used for construction

(Taken from Ref. 1)



Table 1

Relevant Safety Assessment Principles Considered During the Assessment

SAP No SAP Title Description

EAD.2

Ageing and degradation. Lifetime margins

Adequate margins should exist throughout the life of a facility to allow for the effects of materials ageing and degradation processes on structures, systems and components that are important to safety.

EMC.3

Integrity of metal components and structures: highest reliability components and structures. Evidence

Evidence should be provided to demonstrate that the necessary level of integrity has been achieved for the most demanding situations.

EMC.5 Integrity of metal components and structures: general. Defects

It should be demonstrated that safety-related components and structures are both free from significant defects and are tolerant of defects.

EMC.6 Integrity of metal components and structures: general. Defects

During manufacture and throughout the operational life the existence of defects of concern should be able to be established by appropriate means.

EMC.7

Integrity of metal components and structures: design. Loadings

For safety-related components and structures, the schedule of design loadings (including combinations of loadings), together with conservative estimates of their frequency of occurrence should be used as the basis for design against normal operating, plant transient, testing, fault and internal or external hazard conditions.

EMC.13

Integrity of metal components and structures: manufacture and installation. Materials

Materials employed in manufacture and installation should be shown to be suitable for the purpose of enabling an adequate design to be manufactured, operated, examined and maintained throughout the life of the facility.

EMC.14 Integrity of metal components and structures: manufacture and installation. Materials

Manufacture and installation should use proven techniques and approved procedures to minimise the occurrence of defects that might affect the required integrity of components or structures.

EMC.21

Integrity of metal components and structures: operation. Safe operating envelope

Throughout their operating life, safety-related components and structures should be operated and controlled within defined limits consistent with the safe operating envelope defined in the safety case.

EMC.24

Integrity of metal components and structures: monitoring. Operation

Facility operations should be monitored and recorded to demonstrate compliance with the operating limits and to allow review against the safe operating envelope defined in the safety case.

EMC.26

Integrity of metal components and structures: monitoring. Forewarning of failure

Detailed assessment should be carried out where monitoring is claimed to provide forewarning of significant failure

EMC.27 Integrity of metal components and structures: pre- and in-service examination and Provision should be made for examination that is reliably capable of demonstrating



testing. Examination

that the component or structure is manufactured to the required standard and is fit for purpose at all times during service.

EMC.28

Integrity of metal components and structures: pre- and in-service examination and testing. Margins

An adequate margin should exist between the nature of defects of concern and the capability of the examination to detect and characterise a defect.

EMC.29

Integrity of metal components and structures: pre- and in-service examination and testing. Redundancy and diversity

Examination of components and structures should be sufficiently redundant and diverse.

EMC.30 Integrity of metal components and structures: pre- and in-service examination and testing. Control

Personnel, equipment and procedures should be qualified to an extent consistent with the overall safety case and the contribution of examination to the Structural Integrity aspect of the safety case.

EMC.32

Integrity of metal components and structures: analysis. Stress analysis

Stress analysis (including when displacements are the limiting parameter) should be carried out as necessary to support substantiation of the design and should demonstrate the component has an adequate life, taking into account time-dependent degradation processes.

EMC.33

Integrity of metal components and structures: analysis. Use of data

The data used in analyses and acceptance criteria should be clearly conservative, taking account of uncertainties in the data and the contribution to the safety case.

EMC.34

Integrity of metal components and structures: analysis. Defect sizes

Where high reliability is required for components and structures and where otherwise appropriate, the sizes of crack-like defects of structural concern should be calculated using verified and validated fracture mechanics methods with verified application.



Annex 1

EC 354024 Commitments

Commitment number

Summary of commitment Target Completion date

1 The condition of the 1D boiler quadrant restrictor tubes will be confirmed. This will be achieved either by fitting a dead-space thermocouple or by measuring restrictor tube wall thickness. This shall be carried out during the next available in air outage.

September 2016

2 Review SRS test reports when available to confirm that the SRS design substantiation requirements have been met and the claims made on the SRS in this case remain valid.

12 February 2015

3 Undertake a review of the relevant gas circulator penetration ASME and concrete assessments against frequent and infrequent boiler spine failure in support of the next update of the boiler spine safety case

3 months following return to service.

4 Review 3 quadrant operation safety case for adequacy if long term 3 quadrant case is needed. Include consideration of wider impacts on potentially impacting plant lifetime (e.g. hotbox dome or CLA)

Existing Commitment

5 If reasonably practicable undertake a remote visual inspection of 1D1 at the next appropriate in-air shutdown opportunity, potentially during the next planned HYA R1 statutory outage in 2016. The implementation of this commitment will be managed by the PSRG.

September 2016

6 Update NSG procedure HYA/SWI/NSG/015 to carry out monthly check of 1D1 strain gauge data to confirm there is no significant change in strain gauge response which could be indicative of spine failure.

3 months following return to service.

Date post:	02-May-2021
Category:	Documents
Upload:	others
View:	0 times
Download:	0 times

Title of document · 2018. 11. 14. · Title of document Template Ref: ONR-DOC-TEMP-004 Revision 7...

Documents