At Paks 2 on 10-11 April 2003, severe damage to a batch of 30 fuel assemblies occurred inside a cleaning tank designed, manufactured and operated by Framatome ANP (see NEI May 2003, p2). The fuel assemblies had been successfully cleaned, but due to insufficient cooling the assemblies overheated.
According to a statement released by Framatome ANP on 19 May: "Based upon the investigations conducted so far, it was found that the damage was not caused by the chemical cleaning process but by insufficient cooling after the completion of the cleaning process." The statement continued: "As a result of the insufficient cooling, some of the fuel assemblies overheated. After lifting the lid of the cleaning tank, the overheated fuel assemblies were destroyed due to the backflow of cold water into the tank followed by sudden condensation."
The cleaning of the fuel assemblies was carried out in pool 1 as described in the Panel (opposite page). Once the cleaning process was completed, the fuel assemblies remained in the cleaning tank for several hours since the crane was being used for reactor cleaning operations. The Framatome ANP technicians agreed with the Paks staff on postponing the lid removal the predicted delay was approximately 10 hours. During this time, the Framatome ANP technicians maintained the "B" operational mode. This involved circulating the cooling water using a submersible pump in order to keep the cleaning vessel temperature steady.
After around five hours, the activity monitoring facility of the automated mobile decontamination appliance (AMDA) system began showing elevated activity levels. At the same time, the dosimetric systems mounted in the ventilation stacks indicated a sudden increase in noble gas emission. The engineer on duty ordered the evacuation of the area, and an emergency maintenance working group was convened to determine what steps to take. They decided to open the lid of the cleaning vessel, to visually inspect the vessel, to analyse the water covering the vessel and to attempt to identify which assemblies were leaking.
Upon unlocking the hydraulic locking pins of the cleaning tank lid, a "staggering activity increase" was observed along with a 7cm decrease in the water level of the fuel pond, according to the Paks report on the incident. During lid removal, one of the lifting cables broke so this lifting operation had to be aborted.
At this point, leakage in one or only a few assemblies was assumed, and on this basis the event was given a level 2 rating on the International Nuclear Event Scale (INES). After several attempts, the lid was eventually lifted on 16 April. A video camera inspection showed that all 30 fuel assemblies were damaged, some of which were severely damaged. After studying the pictures the incident was upgraded to INES level 3.
Several investigations were launched into the incident: the Paks plant completed its enquiry in mid-May; the Hungarian Atomic Energy Authority's (HAEA's) independent
investigation was also completed in May; the IAEA accepted a request by the HAEA to carry out an independent review this month; and Framatome ANP is carrying out its own investigation, due to be completed early this month.
Paks investigation
The investigation into the incident by the Paks plant was completed on 11 May and submitted to the HAEA. The full report is published on the Paks website (www.npp.hu).
According to the Paks report: "The results of the camera inspection performed following removal of the tank lid have further confirmed the assumption that the direct reason of the emergency was the insufficient cooling. Prior to the investigation of the potential reasons it is absolutely necessary to evaluate the cooling requirement." The Paks investigation report then went on to describe how insufficient cooling occurred.
Cooling requirements
The total residual thermal power of the fuel assemblies loaded into the cleaning tank was 241kW. The thermal power of the individual fuel assemblies was varying between 6.5kW and 9.6kW. The coolant flow rate and temperature were measured at the cleaning tank outlet. The data recorded between 5:00pm on 10 April and 2:00am on 11 April, by the Framatome ANP personnel responsible for the system in a computer log after reading, is shown in the Figure.
It can be seen that the entire period is characterised by a fluctuation of 10% of the delivered water volume while the temperature of the outlet cooling water was continuously decreasing. The average temperature of the decay pool water was 30ºC during this period. The temperature in the upper half of the shaft from which the pump was taking the water was probably the same. It was concluded from the measurements carried out by Framatome ANP that the amount of heat removed by the coolant was continuously decreasing.
On the basis of the severe degradation signs on the cladding and top-nozzle of the fuel assemblies, it was obvious that the upper part of the fuel assemblies had remained in a 'dry' superheated steam space and became overheated. During opening of the lid-hydraulics, performed at 2:15am, the pressure inside the tank lifted the lid, while the backflow of cold water caused the water-shock of the fuel assembly cladding.
Judging by the fact that the scope of thermal parameters recorded during the "B" mode are very limited compared
to the AMDA process data scope, this indicates that the Framatome ANP operators were more concerned with the chemical aspects, "and did not pay attention to the assurance of cooling under any circumstances."
The Paks report also states that the Framatome ANP staff took little notice of the outlet temperature decrease from 41.2 °C to 37.3°C within 3 hours. Moreover: "They continuously provided wrong information concerning the cooling conditions." The emergency maintenance working group therefore "started from the postulation that the assemblies became leaking upon the effect of the chemical treatment.
"The decisions aimed for mitigation were made accordingly, and actually they were in compliance with the actions to be taken as prescribed in the operational documentation. After this the specialists of Framatome ANP performed unlocking of the lid hydraulics that led to significant radioactive release, and, as it turned out later on, to water-shock of the heated up fuel assemblies. In other words the decisions and the interventions were fundamentally influenced by wrong judgement of the cooling conditions of the tank."
HAEA conclusions
In its report (available on the HAEA website, www.haea.gov.hu), the HAEA pointed out that the Paks investigation into "the responsibilities of the personnel is practically restricted to the staff of Framatome ANP, therefore in this respect the report is somewhat incomplete." The HAEA added: "The discussion in the report is one-sided, there is a lack of self-criticism."
However, the Paks assessment of the technical causes (as opposed to human factors) is in accordance with the HAEA's findings, which are described below.
Technical causes
The overheating of the fuel assemblies was found to be possible if the flow of the cooling water along the fuel stopped and the assemblies were not covered with water. By using thermodynamic and flow dynamics modelling techniques, an effect was revealed as a result of which the flow of the cooling water along the assemblies gradually decreased, while a bypass flow through the small bore holes of the assembly surface proportionately increased. It is obvious that a decrease in the cooling water flow is coupled to an increase in the temperature. The speed of this redistribution process depends on the heat production of the assemblies, on the capacities of the pump and on the number of bore holes.
Using the data from the incident, the modelling showed that boiling of the cooling water commences in 2 hours and 10 minutes. This result coincides with the actual value reconstructed from the experiences of the incident. According to the model, about 1 hour after the start of boiling, a large enough steam area develops for a significant number of the assemblies to be left without direct heating. At that time the temperature of the assemblies increases by about 16°C/min if no heat removal is assumed. In reality, there existed some heat removal, partly via the so-called deaeration tube and partly through the double walls of the cleaning vessel.
The model that was used was unsuitable for determining the resultant maximum temperature. The severe damage to the assemblies was, most probably, caused by the sudden inflow of cold water when the vessel lid was opened and by the explosive production of steam.
Given the pump capacity and the vessel geometry, an increasing bypass flow developed through the bore holes so that heat production caused the fuel assemblies to overheat.
Location of the outlet at the top of the inner vessel would alone have prevented all the subsequent problems. Assuming that the outlet had been located at the top of the inner vessel, it follows that the cooling water is always led out from the hottest point, therefore simple heat balance analyses would have been satisfactory for determining whether there is adequate cooling. Locating the cooling water outlet at the bottom of the cleaning vessel should be considered as the technical root cause of the event leading to severe fuel damage.
Technical non-compliances
The HAEA report said there were the following insufficiencies of planning and preparation:
• The most serious technical error committed by the designers was the omission of any detailed thermohydraulic analysis.
• Following the considerations based on heat balance the designers concentrated almost exclusively on the adequacy of the cleaning process: in other words, the possibility of insufficient cooling stemming from a malfunction and its consequences were neglected in the analysis.
• A false algorithm was used to estimate the number of damaged fuel assemblies, therefore the seriousness of the situation was underestimated.
• The time between the termination of enforced flow and the start of boiling was erroneously determined.
• No bypass flow was taken into account in the thermal safety analysis, though the bore holes on the assemblies caused a significant decrease of cooling efficiency.
• There are basic construction differences between the 7-assembly vessel used earlier and the present one housing 30 assemblies. These differences were analysed only from the viewpoints of the efficiency and criteria of cleaning.
• The loss of chemicals used for cleaning is analysed only for small leaks, the full loss following the emergency opening of the cleaning vessel was not investigated.
• It is erroneously and groundlessly stated that the full loss of electricity supply has no effect on safety.
• The incident management procedure described in the AMDA system operating manual was not achievable.
• The criterion for positioning the assemblies is not unambiguous and not necessarily appropriate.
The non-compliances during operation of the system were:
• Framatome ANP personnel operated the cleaning system, Paks staff acted only as co-ordinators.
• In mode "B", only one pump remained operable, this violates the principle of tolerance to a single failure.
• There were many shortcomings of radiation protection instrumentation.
• There were no instructions nor documents available for handling incidents.
Improving safety
Though there were clear technically-based discrepancies that led to the event, the HAEA was particularly critical of the safety culture at Paks. The report noted that the HAEA had remarked on the plant's safety culture insufficiencies "on several occasions in the past." It goes on to say that there were many instances when the HAEA had "called attention to insufficiencies revealed in the safety directorate of Paks. Applications were received with lack of appropriate quality control, there was a certain lack of expertise, and the activities of the safety department were poorly organised."
The HAEA concluded that the safety culture at Paks contributed to the cause of the incident. It states: "The decision mechanism at Paks that dilutes responsibility but complicates matters is to be mentioned as organisational insufficiency. In the decision-making process technical aspects and points of nuclear safety may become overshadowed.
"Insufficiencies, and a continuous degradation of safety culture can be detected. The attitude to safety is pushed into the background and, together with this, an exaggerated self-confidence in the management and the overwhelming enforcement of the interests of production prevailed.
"Ongoing organisational and operational changes did not strengthen the commitment to nuclear safety."
The HAEA has compiled a list of actions to eliminate the deviations and non-compliances. The six areas covered are:
• Legal deviations.
• Design deviations.
• Deviations related to the operation of the system.
• Decision-making and management at Paks.
• Organisational questions.
• Safety modifications.
In addition, the HAEA said that the report by the plant "should be supplemented and, in several instances, modified in order to comply with the formulated requirements and to fill in the gaps."
Before the HAEA report was completed, Paks had already begun taking measures aimed at "elimination of the consequences of the severe incident in April, for the removal of the damaged fuel assemblies, for restoration of the normal operational conditions on unit 2 and for successful operation of the other units." One of the first gestures of action was to force the resignation of the safety director and former deputy general manager, Gábor Vámos. He is now chief consultant to István Kocsis, head of Paks. There were also demotions of the technical director (who has contested the decision) and the head of the technical department.
As NEI went to press, Framatome ANP was due to have completed its own investigation. However, a spokesman for Framatome ANP told NEI that the company was not planning to make its findings public, though it did intend to submit its information to the IAEA. The spokesman pointed out that the HAEA report criticised the lack of an "unambiguous and reliable communication channel" between the Paks staff and the staff of Framatome ANP. "This confirms our original assessment that assignation of responsibilities is not yet possible," the spokesman added.
