操作监视在德国的核电站

ELSEVIER Nuclear Engineering and Design 159 0995) I--27 Operational monitoring in German nuclear power plants A. Seibold a, j. Bartonicek b H. Kockelmann c a TUV St~dwest. Postfarh 13 80, Filderstadt, D-70774, Germany b GKN Neckarwestheim, lm Steinbruch, Neckarwestheim, D-74382. Germany c Staatliche Materialprt~fungsanstalt (MPA), University of Stuttgart, Stuttgart, Germany Abstract The Atomic Energy Act requires that measures made feasible by state of the art technology be adopted to avoid damage that could be caused as the result of the construction and operation o fa nuclear plant. This stipulation constitute~; the basis for deriving requirements for planning, design, construction, operation and decommissioning. Ensuring the function and integrity of those components and systems that are relevant to plant safety is of major significance with regard to operation of a nuclear power plant. The basis for ensuring these features is laid in planning, design and construction. Important as these foundations may be, it is absolutely essential to monitor the quality originally planned and achieved in an object as undeniably complex as a nuclear power plant. The RSK-Leitlinieu ffir Druckwasserreaktoren (Reactor Safety Commission Guidelines for Pressurized Water Reactors) incorporate fundamental requirements for design, mechanical design, materials, manufacturing, testing and examina- tion, and o meration. Meeting these requirements makes it possible to exclude a catastrophic rupture of the components in the reactor cooling system pressure boundary (primary system), as has been demonstrated in detailed research and development work. The term basic safety was defined for this concept. Basic safety coupled with multiple redundancy suffices to exclude the possibility of large ruptures (rupture preclusion). The principle of plant monitoring and documentation (operational monitoring) implements redundancy in a significant manner within this concept. The monitoring techniques used in Germany have reached an advanced state of development and are still being optimized. Thus, operational monitoring is a major contributory factor in the safety and high availability of nuclear power plants. It also provides a means of expanding our knowledge of life time expectation. 1. Introduction It has long been common practice to check and recheck the quality of machinery and facili- ties such as nuclear power plants, steam-retaining and pressurized systems, aircraft and passenger cars throughout their service lives. This is partic- ularly true whenever safety aspects are touched with regard to human beings and the environ- ment. However, the operators of these facilities are under a certain degree of economic pressure to keep the extent for these tests and exam- inations within reasonable limits. Consequently, there is a constant effort to optimize monitor- ing applying the latest state of the art tech- nology. The examples outlined briefly below by way of introduction will underscore the appli- cability of operational monitoring, even against the background of an advanced state of the art technology. 0029-5493/95/$09.50 © 1995 Elsevier Science S.A. All rights reserved SSDi 0029-5493(95)0 ! 059-9 A. Seibold et al. / Nuclear Engineering an.:l Design 159 (1995) 1-27 It is worth mentioning a few results obtained and traced within the framework of inservice in- spectious, e.g.: • wastage corrosion of steam generator heating tubes made of Incology 800; • stress corrosion cracking of in-core shroud screws made of Inconel X 750; • stress corrosion cracking of fuel assembly align- ment pins made of Inconel X 750. These defects were discovered at an early stage, so suitable measures could be adopted to minimize or eliminate the problems. In other instances, operational monitoring has provided the means of reducing conservative pos- tulations employed in design calculations or de- sign checks, and to pinpoint shortcomings in the methods of calculation used. A number of papers read at the MPA seminar 1992 dealt with these issues at length and how they emerged in the analysis of a surge line. In situ measurements revealed that the material properties law that served as the basis for initial calculation did not approximate with sufficient accuracy to the actual behavior of the material (Hofst6tter, 1992). 2. Imlmrtanee of ol~ratlonal monitoring The Atomic Energy Act (AtG, 1992) requires that measures made feasible by the state of the art technology be adopted to avoid dal,age that could be caused as the result of the construction and operation of a nuclear plant. The stipulation constitutes the basis for deriving requirements for planning, desi~, construction, operation and de- commissioning. Ensuring the functionality and in- tegrity of safety relevant co'aponents and systems is of major significance with regard to operation of a nuclear power plant. The groundwork for ensuring these features is laid in planning, design and construction. Important as these foundations may be, it is absolutely essential to monitor the quality originally planned and achieved in an object as undeniably complex as a nuclear power plant. This aspect was taken fully into account at an early juncture by stipulations incorporated in codes such as the Safety Criteria for Nuclear Power Plants (Sicherheitskriterien f'dr Kernkraft- werke) (BMI~ 1977), the Reactor Safety Com- mission Guidelines for Pressurized Water Reac- tors (RSK~Leitlinien ffir Druckwasserreaktoren) (RSK, 1984) and the KTA Nuclear Safety Standards. Consequently, a number of core stipulations in the safety criteria for nuclear power plants lay down measures for operational monitoring. These measures include: • comprehensive quality assurance throughout manufacturing and operation; • in-service inspections of adequate scope; • dependable monitoring of operating status; • recording, evaluation and safety-related appli- cation of operating experiences; • establishment of systems for operation manage- ment and operational monitoring in order to maintain control of abnormal operating statuses resulting from malfunctions in compo- nents and systems; • monitoring of the quality achieved in design, manufacturing and construction by means of periodic tests and examinations; • facilities for leak monitoring in the reactor coolant system pressure boundary; • installation of monitoring systems and alarms providing at all times under normal operating conditions an adequate overview of the plant's operating status and the status of each individ- ual process. The Reactor Safety Commission Guidelines for Pressurized Water Reactors (RSK, 1984) incorpo- rate fuudamental requirements for design, me- chanical design, materials, manufacturing, testing and examination and operation. By meeting these requirements it is possible to exclude a catastrophic rupture of components in the reactor cooling system pressure boundary (primary sys- tem), as has been demonstrated in detailed re- search and development work. The term basic safety was defined for this concept. Supplemented by multiple redundancy princi- ples the preclusion of large ruptures will be reached (rupture preclusion), Fig. 1. The principle of plant monitoring and docu- mentation (operational monitoring) implements redundancy in a significant manner within this concept. The following codes and guidelines con- .4. Y;eibold et al. / Nuclear Engineering and Design 159 (1995) 1-27 3 I='-I I - " ' l I==l -n ,m~ma .omaem I I I I I Fig. I. The principles of the basic-safety concept and rupture preclusion (Kuflmaul, 1991). cerning the primary system detail the appropriate measures: Reactor Safety Commission Guidelines for Pressurized Water Reactors (RSK, 1984); KTA 3201.4, In-service Inspections and Opera- tional Monitoring (KTA, 1990); KTA 3203, Monitoring Radiation Embrittle- ment of Materials of the Reactor Pressure Ves- sel of Light Water Reactors (KTA, 1984b); KTA 3204, Reactor Pressure Vessel Internals (KTA, 19844=). An overview of the measurements employed for monitoring will serve as an introduction to a detailed discussion of the variables that apply to operational monitoring and a description of the individual monitoring systems (Fig. 2). The various measures employed for monitoring can be assigned to different criteria. As regards the areas in which they are active, the measures can be differentiated by their global or local appli- cability. A given measure may be either employed continuously or activated intermittently (usually during outages). Similarly, some measures make it possible to detect the root causes behind damage mechanisms or uncover the faults and their conse- quences. The boundaries used to draw these dis- Fig. 2. Block diagram showing how measures for operational monitoring can be assigned to different criteria. d. Seibold et al. / Nuclear Engineering and Design 159 (1995) 1-27 tinctions are often fluid, so these models are in- tended more for information. However, the mea- sures that help uncover the causes of damage--and which thus have a prophylactic function--merit special attention. The major function of the other measures adopted for opera- tional monitoring is the detection of incipient or progressive damage. 3. Terms of reference and objectives for operational monitoring As regards safety, operational monitoring aims at ensuring the quality achieved in the design, manufacturing and construction of a plant as the means of maintaining the safe operability of ac- tive components and the integrity of the pressure boundalT, for example that of the primary system (KTA, 1987). This global aim can be expressed in more detailed form as follows: • Ensuring the safe operability and the integrity of the primary system: - - by supervising the load collectives specified for plant design; - -by acquiring further data on insufficiently defined loads, thus providing a means of reducing conservative margins in calcula- tions; - - by detecting unspecified loads; - -by detecting other relevant influences and their effects. Economic considerations, too, are reflected in the aims of operational monitoring. Aspects that deserve mention in this respect are improving reliability and availability or assessing or prolong- ing plant life. Here, too, distinctions can be drawn: • Improving reliability and availability: - - by optimizing the operational mode; - - by detecting damage at an early juncture; - - by avoiding consequential damage. • Assessing and prolonging plant life; - - by acquiring data on real loads, their time histories and frequencies; - - by calculating the cumulative usage factors and residual life time. 4. Monitoring procedures of the various operat iona l in f luences and their e f fec ts KTA 3201.2 (KTA, 1984a) requires the design- ers of safety-relevant components in nuclear power plants to define and take into account all major effects resulting from mechanical and ther- mal loads, corrosion, erosion and irradiation. All such definitions must be translated to design fea- tures implemented on a component-specific basis, using either precise empirical data or conservative estimations, Table 1. Mechanical and thermal loads may act directly on the components. It is important, however, that they can also act through indirect mechanisms, as do temperature transients in the coolant when they cause unstable temperature fields. The removal of material by corrosion or erosion may be local or extensive. Corrosion operating in conjunction with stress may cause cracking. Materials close to the core become progressively more brittle under neutron irradiation. In certain cases, the effects of temper- ature over a prolonged period of time may also cause embrittlement. During the operational life of a nuclear power plant, these effects may produce stresses and strains and changes in the components. This, in turn, requires verification of an adequate safety margin for these components. Verification of this nature is provided within the framework of design and construction in the form of material qualifica- tions, stress and fatigue analyses, quality assur- ance and failure analyses. The possible effects that can occur during oper- ation include: • reduction in wall thickness (corrosion, erosion- corrosion, wear and tear); • cracking, incipient cracking, crack propagation (fatigue, corrosion); • altered material properties (thermal or irradia- tion embrittlement); • functional impairment due to deposits, corro- sion, wear and tear and overload of internals in active components. One aim in monitoring is to maintain a check on the postulations and boundary conditions ap- plied within the framework of plant design. This, in turn, means that the root causes of damage A. Seibold et al. / N::¢lear Engineering and Design 159 (1995) 1-27 5 Table I Factors influencing components and systems, how they are specified at the design stage, and monitored with their effects during operation Nature of influence or effect Specification for design Operational monitoring by means of: Influence Mechanical load Load collective standard instrumentation, Thermal load Load collective special instrumentation, Effect Corrosion Water chemistry Erosion Medium conditions Irradiation Fluence. toughness Reduced wall thickness Cracking/crack propagation Change in material properties Functional impairment due to deposits, corrosion, wear and tear. overload acting on internals of active components vibration instrumentation. fatigue monitoring water chemistry monitoring water chemistry monitoring irradiation monitoring in-service inspections in-service inspections, loose -part monitoring system, leak monitoring, function tests radiation monitoring function tests, maintenance, repair mechanisms can be detected and suitable mea- sures to avoid damage can be implemented (Table l). To this end, means are adopted for monitoring operating data, water chemistry, irradiation em- brittlement, and load data by means of special instrumentation. This load data includes system and component vibration. Other measures are implemented so that damage mechanisms can be detected at a very early stage and adequate coun- ter-measures for damage control initiated. 5. Standard instrumentation KTA 3201.4 (KTA, 1990) requires operational monitoring of the operational data that can be significant as regards the integrity of components in the pressure boundary of the reactor coolant system. These operating parameters must be defined by the plant manufacturer, entered in the plant operational manual and measured and recorded by means of standard instrumentation. Broadly speaking, this amounts to continuous monitoring of operating-status variables such as pressure, temperature, flow, speed, level, activity and the like. These readings are required for process control, but they are also an important source of information that can be applied in conjunction with the data streams from other instrumentation and used for evaluation and analysis. 6. Special instrumentation for load monitoring (Bartonicek, 1991a,b, 1992; Zaiss, 1990) 6.1. Monitoring design boundary conditions Nuclear power plants are designed with a safety margin providing ample reserves against failure under normal operating conditions and in the event of incidents or accidents. The load collec- tives for normal operation are defined on the basis of many years operating experience. Load collec- tives lbr emergency conditions (e.g. component malfunctions, seismic events) and fault conditions (e.g. loss of coolant accidents, aircraft crash, pos- tulated load cases) are specified on a different basis. These specifications are based on postula- tions used for transient analyses in which the corresponding mechanical and thermal loads are defined by magnitude, progress and frequency. In A. SeiboM el al. / Nuclear Engineering and Design 159 0995) 1-27 some cases, this requires sophisticated calculations or even experimentation. ThE loads acting on components and systems of major safety-related importance are defined by comprehensive mea- surements during commissioning, in order to ver- ify the postulated loads and the results of calculations. An analysis of mechanical response is required in order to verify that the components are capable of withstanding all these specified loads, some of which are superimposed in order to arrive at conservative figures. In the case of primary-system components, this process of verification includes a stress and fatigue analysis. Experience to date shows that the loads spe- cified for the major components of the primary system afford conservative coverage of the actual (measured) loads, in most cases. Global monitor- ing with standard instrumentation is usually ade- quate to ensure compliance with these postulated loads. 6.2. Monitoring partially specified and unspecified loads The degree to which the specified loads coincide with those that actually occur depends on the degree of accuracy with which operating experi- ence is translated into the definitions of the spe- cified load cases, plus the extent to which special additional investigations were employed. In isolated cases (e.g. pipes and valves, or com- ponents in the outer systems) the loads that occur are influenced by operational modes and pro- cesses under upset operating conditions (e.g. load switching, misconnections, leaking valves or ther- mal stratification). Events of this nature may lead to the occurrence of local loads that are specified only partially, if at all, within the framework of design. The origin of these loads may be mechan- ical or thermal. Water chemistry, cleansing agents and lubricants, too, may count among the envi- ronmental factors that have to be taken into account. The feedwater nozzles, the surge line, the auxil- iary spray lines in the pressurizing system and the check valves between the hot and cold sides of the medium-retaining systeni are among the compo- nents for which theL~nal loads have no: yet been specified in their entirety. Loads may be due to time-gated changes in temperature (thermal shock) and/or local temperature distributions, such as temperature stratification over the cross- section of a pipe. The stresses and strains occur- ring in these cases depend on many different parameters; so, conservative, simplifying postula- tions produce high stresses and cumulative usage factors. Most failures occurring to date have been traced back to local and time-gated fluctuating stresses and strains which, if allowed to occur frequently enough, led to damage in the form of cracks ~vad leaks. Forced ruptures resulting from inadequate strength to resist primary stresses are virtually unknown in nuclear power plants. It is important to bear in mind, too, that dynamic processes usually become apparent in signs of wear and tear, deformation or movement, and in extreme cases in cracks or leaks. Generally, measuring instrumentation must be installed in situ in order to detect loads of this nature. It is essential that the instrumentation and the monitoring times be chosen to suit the sys- tems, components and areas to be monitored. Long-term monitoring is often needed. This applies particularly when loads occur only under certain operating conditions, when the load rate is high or if a load is of very brief duration. Simi- larly, a period of time may elapse between the occurrence of an event and the discovery of its effects. When this happen