on Nuclear Safety and Radiation Protection - Energie EDF

More documents

Recommendations

Info

THE INSPECTOR GENERAL’S REPORT ON NUCLEAR SAFETY AND RADIATION PROTECTION temperature measuring probes during the outage was managed by the plant instrumentation and control department, • the job was out-sourced to a prime contractor (this was a Case 1 Situation where the service provider had its own quality assurance system and working procedures). Replacement of the probes necessitates changing the adapters. When the adapter is seized, it needs to be drilled out to extract it. This was the case with ten of the eleven adapters. • the prime contractor entrusted the work to a subcontractor: the instrumentation and control department put the valves and metal fabrications department in charge of technical surveillance of the drilling. • the procedure calls for drilling a 20 mm blind hole and vacuuming up the cuttings. If it proves impossible to unscrew the adapter after making a first hole, a 22 mm diameter through-hole can be made on the condition that the cuttings are vacuumed up and an endoscopic examination of the header is performed with a flexible probe that is at least one metre long, • the sub-contractor took the initiative of making a through-hole straight away, using a 20 mm diameter drill, without following the procedure and without informing either the prime contractor or EDF. This was done with the eleven adapters in succession. • the endoscopic examinations were carried out by the sub-contractor with an unsuitable endoscope (too short and rigid) which failed to detect the presence of cuttings in the header, • the EDF inspector replicated the check by the subcontractor, with the same result, • two months after the job, when restarting the nuclear unit, an insufficient flow in the Loop 4 temperature bypass was detected. An inspection of the loop orifice plate was decided upon and scheduled for handling with the unit at shutdown state with the steam generators in service, • two days later, inspection of Loop 4 indicated the presence of cuttings in the header. The raising of the primary system temperature and pressure continued without the two other loops being inspected (although similar drilling operations had been performed), • a week later, it was decided to inspect the two other loops. The nuclear unit was in hot shutdown mode. After the inspection of Loop 2, the event occurred when the bypass line was put into service. 74 NOTEWORTHY OPERATING EVENTS My analysis I have picked this event as it illustrates some of the current maintenance difficulties with their actual and potential consequences. In the case of the probe replacement work, however, I do not see what are usually the causes of sub-standard quality: the need to change probes is not a new one, the maintenance instructions date back a number of years, the unit outage spanned a number of months and there was no urgency about the job, the main contractor was properly qualified (Level 1) by the Central Technical Support Department and had previously carried out this work, as had the sub-contractor. This being the case, I am struck by the succession of cases of sub-standard work of all types and the weakness in the lines of defence, which failed to perform their roles. I am left wondering about the deliberate and repeated disregard for a procedure important to nuclear safety. I consider that the sub-contractor demonstrated a real lack of nuclear safety culture, compounded by lack of staff training. The question must be raised as to the reliability of Case 1 qualification of a contractor as a line of defence when its checking and surveillance systems can let such discrepancies through. Nowhere in the reports about the event is there any mention of the risks for the ALARA approach, the importance of which I would like to underline for the operatives and inspectors. Neither was EDF surveillance of the work a sufficiently strong line of defence. This was done by each profession without considering the wider implications of the work. In multi-speciality services such as this, it is desirable to have a single inspector watching the contractor. Finally, after first discovering cuttings in the Loop 4 line, I am surprised that a week went by before inspecting the two other loops. In conclusion, it is to be borne in mind that this event had no consequences on the environment or on the operators and that incident was properly managed. What needs to be remembered is that we need to question the confidence we place in certain lines of defence which may not be as strong as we imagine. It is there to remind us, once again, that analysis of the risks and checking and inspection in the field are necessary for obtaining proper quality and dependable nuclear safety.
A DIAGNOSIS ERROR DURING START-UP The facts The annual outage for maintenance and refuelling was coming to a close and start-up was beginning. The reactor pressure vessel was closed, the core was still sub-critical, the pressure in the reactor coolant system was 3 bar, the primary coolant pumps were stopped and venting of the reactor coolant system was in progress. At the end of the afternoon shift at around 20:00, the control room operators noticed a drop in the level of the chemical and volume control tank for the reactor coolant system, which they interpreted as being due to a primary coolant outflow and estimated it at 5 m3/h. Actually, the venting operations performed that afternoon had destabilised the pressure regulation action of the chemical and volume control valve of the reactor coolant system, a phenomenon of which the operators were unaware. They saw neither a change in the levels of the reactor building sumps, nor in the charging and letdown flows. Unable to explain the chemical and volume control tank level change after analysis, it was considered that one of the nuclear steam supply system parameters was not under control, indicating the need to operate the reactor in accordance with an incident situation procedure using what is termed as a symptom-based approach. The operations team applied the procedure and alerted both the safety engineer and the duty Emergency Controller (known as PCD1 in France). Between 20:00 and 21:00, the control room shift changed. In accordance with the procedures, the operators manually started the low-pressure safety injection pumps to compensate for the loss of primary coolant. The automatic protection function isolated the containment, resulting in isolation of the main reactor coolant system makeup lines. As a result of the absence of an actual outflow from the nuclear steam supply system and the starting of the low-pressure safety injection, the pressure in the reactor coolant system rose to around 10 bar as injections at the reactor coolant pumps seals were maintained. The incoming operations shift manager then decided to stop injection at the reactor coolant pump seals so the decay heat removal system safety valves would not open. Meanwhile, the PCD1 decided to muster the plant emergency response team capable of dealing with such a case. In the control room, the outgoing team stayed to support the incoming team, and the two operating shift managers were present at the same time. At 21:10, application of the symptom-based approach resulted in opening the zero-flow valves of the lowpressure safety injection pumps to the safety injection NOTEWORTHY OPERATING EVENTS THE INSPECTOR GENERAL’S REPORT ON NUCLEAR SAFETY AND RADIATION PROTECTION sumps inside the reactor building. Five minutes later, the operators in the control room observed that the level in the reactor coolant tank (PTR) was dropping and the levels in the reactor building sumps were correspondingly rising. This valve opening led to an outflow of some 120 m3 into the sumps. Around 21:40, the operations shift manager decided to send a team into the reactor building to identify the reason for the flow of coolant into the sumps, and it was soon determined that it was the safety injection systems sump levels that were affected. The PCD1, in the control room around 22:00, assessed the situation with the two operating shift managers present. He confirmed that the incoming operating shift manager was the one in charge of operations. The latter suggested closing the zero-flow lines valves of the low-pressure safety injection pumps. The strategy was adopted and the level in the reactor coolant system tank rapidly stabilised. At 22:30, the parameters had stabilised and the integrity of the reactor coolant system was confirmed. The lowpressure safety injection pumps were stopped. The operating team exited the incident. procedure in the middle of the night shift as the primary coolant balance had returned to conformity with the technical specifications for operation. My analysis • An error of diagnosis The decision to operate the reactor using incident and accident situation procedures resulted in an error of diagnosis by the operations teams, who mistakenly believed that there was a primary coolant leak. I would like to point out that the team, in difficult circumstances, re-established functioning in accordance with the technical specifications for operation, adapting the incident situation procedures to the events as they occurred. • Lack of mastery of physical phenomena I observe that the physical phenomena involved in this event are rarely encountered in operations and the operating staff and their technical advisers found it hard to handle them although they were all experienced. It would also appear that too much confidence is being placed in leak balance calculations carried out under abnormal thermal-hydraulic conditions and there is insufficient awareness of the uncertainty of the calculations for such situations. Also, the procedure contained no warnings about the risk of making too much of a somewhat unreliable result. 75
Page 1:
The Inspector General’s report on
Page 5:
CONTENTS CONTENTS THE INSPECTOR GEN
Page 8 and 9:
THE INSPECTOR GENERAL’S REPORT ON
Page 10 and 11:
Page 12 and 13:
Page 14 and 15:
Page 16 and 17:
Page 18 and 19:
Page 20 and 21:
Page 22 and 23:
Page 24 and 25:
Page 26 and 27: THE INSPECTOR GENERAL’S REPORT ON
Page 41 and 42: MAINTENANCE, A STRATEGIC DOMAIN THE
Page 43 and 44: Despite this, the plants are contin
Page 45 and 46: I met the staff of the AMELIE spare
Page 47 and 48: NUCLEAR TECHNICAL INFORMATION SYSTE
Page 49 and 50: NUCLEAR TECHNICAL INFORMATION SYSTE
Page 51 and 52: ATTENTION TO CHEMISTRY NEEDED IN OP
Page 53 and 54: ATTENTION TO CHEMISTRY NEEDED IN OP
Page 55 and 56: A NEW IMPETUS FOR THE EPR-TYPE REAC
Page 61 and 62: PLANT LIFE EXTENSION IS CONDITIONED
Page 63 and 64: PLANT LIFE EXTENSION IS CONDITIONED
Page 65: MY RECOMMENDATIONS PLANT LIFE EXTEN
Page 96: E.D.F. Présidence IGSN 21, avenue
show all

on Nuclear Safety and Radiation Protection - Energie EDF

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?