US Nuclear Safety Regulators Continue to Ignore Lessons of Fukushima for Severe Accident Hydrogen Explosion Risk at US Reactors
Three years after Japan’s nuclear disaster, US reactors remain vulnerable to the threat of runaway hydrogen production and leakage in a severe nuclear accident, with little or no capacity to safely reduce or vent potentially explosive concentrations of this gas, or capture its hazardous radioactive constituents before it explodes and contaminates the surrounding region, as occurred at Fukushima in March 2011. That is the conclusion of a just released NRDC report, Preventing Hydrogen Explosions In Severe Nuclear Accidents: Unresolved Safety Issues Involving Hydrogen Generation And Mitigation.”
The report musters a multitude of technical evidence showing that the US Nuclear Regulatory Commission (NRC) underestimates the rate, extent, and likely impacts of hydrogen production in severe loss-of-coolant accidents, and thus continues to ignore the lessons of Fukushima when it comes to ensuring “defense in depth” against the risks of a hydrogen explosion once a severe accident is in progress. The report urges the NRC to require more frequent and authentic “leak-rate” tests of reactor containments, and to re-benchmark its computational capability for assessing hydrogen production in severe accidents with data obtained from realistic core damage experiments, as two essential predicates for setting new NRC requirements for US nuclear power stations to minimize hydrogen explosion risk.
The aging fleet of U.S. reactors, which will increasingly operate beyond their initial 40-year term license terms, is now facing severe competitive pressures in wholesale competitive power markets, setting up difficult tradeoffs between low-carbon electricity supply, continued commercial viability, and the new investment required to sustain public safety. Many of the oldest nuclear units are General Electric Boiling Water Reactors (BWRs), with undersized Mark 1 and Mark II primary containments that the NRC has known for decades are especially vulnerable to hydrogen leaks under the elevated pressure conditions expected to occur in severe accidents.
Mark Leyse, the principle author of the report and a technical consultant to NRDC, is critical of the NRC’s apparent willingness to accede to recent licensee requests to further relax and defer requirements for periodic containment pressurization and leak rate testing: He notes that “American BWR Mark I and II containments in particular have performed poorly in leak rate tests, yet the NRC is planning to further extend the permitted intervals between these tests, casting a blind eye toward the hydrogen explosions that occurred in three units of this very design at Fukushima.”
As his report explains in detail, hydrogen is produced in severe loss-of-coolant nuclear accidents when the overheated zirconium alloy tubes that surround the uranium fuel pellets chemically react with steam and undergo rapid oxidation, releasing hydrogen. Above about 1832 deg. F this reaction becomes “autocatalytic,” meaning it becomes self-sustaining by virtue of the heat produced by the chemical reaction alone, while the heat from radioactive decay that is responsible for initially heating up the zirconium fuel cladding continues to make a contribution that declines steadily with time from reactor shut-down. When an overheated core reaches this point, it is said to be in a “thermal runaway” condition, capable of producing thousands of kilograms of combustible hydrogen that can leak out and explode.
Leyse’s investigation found that the NRC’s regulatory passivity is grounded in the computer models it relies on to set safety requirements. These models do not accurately predict the onset of rapid hydrogen production, or the rates of hydrogen production shown in severe fuel damage experiments conducted in the 1980's and 1990's. In short, the NRC seems to be operating with an inadequate technical understanding of the nuclear accident risk it is tasked by statute to minimize.
While most Pressurized Water Reactors (PWRs) – those with the large domed reinforced concrete and steel containments familiar to many Americans as the symbol of nuclear power -- can withstand higher containment pressures than BWRs, and have larger volumes in which to disperse hydrogen leaks, thereby potentially avoiding detonable concentrations, the report notes that most US reactors “are not equipped to detect and control dangerous concentrations of hydrogen in all the places where it could migrate and explode in a nuclear power plant.” Nor, Leyse points out, has an analysis ever been done on the damage potential of flying objects generated in an explosion of hydrogen inside a containment. Yet we know from the Fukushima Daiichi accident that debris propelled by hydrogen detonations caused extensive damage to backup emergency power supplies and hoses that were intended to inject seawater into overheated reactors. Some of the debris dispersed around the site by explosions was highly radioactive, exposing personnel to higher dose rates and setting back their efforts to control the accident.
As previously noted by nuclear safety expert David Lochbaum of the Union of Concerned Scientists, poorly mitigated hydrogen explosion risk presents a serious threat to the so-called “FLEX” strategy for severe accident response proposed by the nuclear industry’s lobbying arm, the Nuclear Energy Institute, after Fukushima, and adopted almost verbatim by the NRC. The FLEX response strategy is essentially an array of remotely stored portable equipment that is supposed to be moved into place by workers in the immediate aftermath of a greater-than-expected triggering event, such as an earthquake, tornado, or flood, which severely damages the backup safety systems of the plant or leads to a complete loss of electrical power, temporarily disabling these systems. Inadequate hydrogen control during a severe accident could render key elements of the FLEX strategy ineffective at the very moment they are most needed.
The report also explores the little known fact that when confronted with the quantities of hydrogen produced in severe accidents, current token capabilities for hydrogen control are just as likely to trigger a hydrogen detonation as prevent one. For just this reason, NRDC has joined Riverkeeper in calling for the immediate removal of self-actuating “Passive Autocatalytic Recombiners” (PAR) devices from Indian Point nuclear generating station, located 28 miles north of New York City.
However, knowing when to safely operate electrically-powered versions of these devices, which can be turned on and off, requires knowing the concentration of hydrogen in their immediate vicinity. But in 2003, the report notes, the NRC took the odd step of reclassifying such monitors as “non-safety related equipment,” meaning the equipment no longer needed needed to have redundancy, seismic resistance, or an independent train of onsite standby power. Furthermore, NRDC’s investigation found that GE-BWR Mark I and Mark II designs operate with hydrogen monitors installed only in their nitrogen-filled primary containments, not in their reactor buildings. In the Fukushima Daiichi accident, hydrogen from three Mark I units leaked undetected into these buildings and exploded.
The inability of US nuclear operators to monitor hydrogen concentrations in all plant areas where it could migrate during a severe accident is matched by another critical monitoring deficiency: Operators of PWRs lack a sufficient capability to monitor the onset and progression of the nuclear fuel degradation that leads to runaway hydrogen production in an accident. This deficient capability limits operator knowledge of when to transition from emergency operating procedures (EOPs)—intended to prevent fuel damage—to severe accident management guidelines (SAMGs)—intended to stabilize a damaged reactor core with auxiliary ad-hoc cooling measures while preventing significant off-site releases of radionuclide contamination.
Plant operators are supposed to implement SAMGs before the onset of the rapid zirconium-steam reaction, which leads to thermal runaway in the reactor core. Not knowing which regime one is operating in can have severe consequences. For example, PWR operators could end up re-flooding an overheated core simply because they do not know its actual condition. Unintentionally re-flooding an overheated core could generate hydrogen, at a rate as high as 5,000 grams per second, and the containment could be compromised if large quantities of that hydrogen were to detonate, as occurred at Fukushima.
The report explains that in PWRs, so called “core-exit thermocouples”—temperature measuring devices—are the primary equipment that would be used to detect inadequate core-cooling and signal the point at which operators should transition from EOPs to SAMGs. However, data from experiments demonstrate that core-exit temperature measurements are neither an accurate nor a timely indicator of maximum fuel-cladding temperatures in the core, and hence an unreliable indicator of the likelihood of significant hydrogen production. In the most realistic severe accident experiment ever conducted—in which an actual reactor core was heated with [radioactive] decay heat before melting down—core-exit temperatures were measured at approximately 800°F when maximum in-core fuel-cladding temperatures exceeded 3300°F. Relying on core-exit thermocouple measurements for timely detection of inadequate core cooling or uncovering of the core is neither reliable nor safe.
In the face of the NRC’s inaction on this critical safety matter, the report presents the following six recommendations for actions to reduce the risk of hydrogen explosions in severe nuclear accidents:
A. The NRC should develop and experimentally validate computer safety models that can conservatively predict rates of hydrogen generation in severe accidents.
The NRC needs to acknowledge that its existing computer safety models under-predict the rates of hydrogen generation that occur in severe accidents. The NRC should conduct a series of experiments with multi-rod bundles of zirconium alloy fuel rod simulators and/or actual fuel rods as well as study the full set of existing experimental data. The NRC’s objective in this effort should be to develop models capable of predicting with greater accuracy the rates of hydrogen generation that occur in severe accidents.
B. The safety of existing hydrogen recombiners should be assessed, with the use of Passive Autocatalytic Recombiner (PARs) potentially discontinued until technical improvements are developed and certified.
Experimentation and research should be conducted in order to improve the performance of self-actuating PARs so that they will not malfunction and incur ignitions in the elevated hydrogen concentrations that occur in severe accidents. The NRC and European regulators should perform safety analyses to determine if existing PARs should be removed from plant containments—and, if so, whether they should be replaced with electrically powered thermal hydrogen recombiners that have their own independent train of emergency power. The latter course would require operators to have instrumentation capable of providing timely information on the local hydrogen concentrations throughout the containment, so they could deactivate the thermal recombiners when hydrogen concentrations reached the levels at which the recombiners malfunction and incur ignitions.
C. Existing oxygen and hydrogen monitoring instrumentation should be significantly improved.
In line with the conclusions of the NRC’s own Advisory Committee on Reactor Safeguards (ACRS), the NRC should reclassify oxygen and hydrogen monitors as safety-related equipment which must undergo full qualification (including seismic qualification), must have redundancy, and must have has its own independent train of emergency electrical power.
The current NRC requirement that hydrogen monitors be functional within 90 minutes of emergency cooling water injection into the reactor vessel is clearly inadequate for protecting public and plant worker safety. The NRC should require that, following the onset of an accident, hydrogen monitors be functional within a timeframe that enables immediate detection of quantities of hydrogen indicative of core damage and a potential threat to containment integrity.
As first urged by our colleagues at the Union of Concerned Scientists, the NRC should also require hydrogen monitoring instrumentation to be installed in:
1) BWR Mark I and Mark II secondary containments;
2) fuel-handling buildings of PWRs and BWR Mark IIIs; and
3) any plant structure where it would be possible for hydrogen to enter.
D. Current core diagnostic capabilities require upgrading to provide plant operators a better signal for when to transition from emergency operating procedures to severe accident management guidelines.
The NRC should require plants to use thermocouples placed at different elevations and radial positions throughout the reactor core to enable plant operators to accurately measure a wide range of temperatures inside the core under both typical and accident conditions. In the event of a severe accident, in-core thermocouples would provide plant operators with crucial information to help them track the progression of core damage and manage the accident, indicating, in particular, the correct time to transition from EOPs to implementing SAMGs.
E. The NRC should require all nuclear power plants to control the total quantity of hydrogen that could be generated in a severe accident.
The NRC should require all nuclear power plants to operate with systems for combustible gas control that would effectively and safely control the total quantity of hydrogen that could potentially be generated in different severe accident scenarios; and to have strategies for venting gas from the inerted primary BWR Mark I and Mark II containments without causing significant radiological releases. The NRC should also require nuclear power plants to operate with systems for combustible gas control that are capable of preventing local concentrations of hydrogen in the containment from reaching concentrations that could support explosions powerful enough to breach the containment, or damage other essential accident-mitigating features. Hydrogen explosions are not expected to occur inside the primary BWR Mark I and Mark II containments, which operate with inerted atmospheres, unless somehow oxygen is present.
The NRC should require licensees who operate nuclear power plants with hydrogen igniter systems to perform analyses demonstrating that these systems would effectively and safely mitigate hydrogen in different severe accident scenarios. Licensees unable to do so would be ordered to upgrade their systems to adequate levels of performance.
F. The NRC should require that data from leak rate tests be used to help predict the hydrogen leak rates of the primary containment of each BWR Mark I and Mark II licensed by the NRC in different severe accident scenarios.
The NRC should require that data from overall leak rate tests and local leak rate tests—already required by Appendix J to Part 50 for determining how much radiation would be released from the containment in a design basis accident—also be used to help predict hydrogen leak rates for a range of severe accident scenarios involving the primary containments of each GE-BWR Mark I and Mark II licensed by the NRC. If data from an individual leak rate test were to indicate that dangerous quantities of explosive hydrogen gas would leak from a primary containment in a severe accident, the plant owner should be required to repair the containment.
The rationale for this requirement is obvious: Hydrogen explosions, or hydrogen concentrations in the reactor building that pose a detonation risk, can severely inhibit emergency response actions essential to containing the accident. Or even worse, emergency response actions themselves, such as hooking up portable power equipment, could actually provide the spark for hydrogen explosions in critical areas of the plant.
The NRC should also end its practice of allowing repairs to be made immediately before leak rate tests are conducted to evaluate potential leakage paths, such as containment welds, valves, fittings, and other components that penetrate containment. This “repair before test” practice obviously defeats the nuclear safety objective of providing an accurate statistical sample of actual pre-existing containment leak rates.
Finally, the NRC should reconsider its plan to extend the intervals of overall and local leak rate tests to once every 15 years and 75 months, respectively. The NRC needs to conduct safety analyses that consider BWR Mark I and Mark II primary containments vulnerable to hydrogen leakage. It also seems probable that as old reactors are kept in service beyond their original licensed lifetimes, the intervals between leak rate tests should be shortened rather than extended.