Indian Point O-Rings: Sequel or So What? On January 28, 1986, NASA attempted to blast the space shuttle Challenger and its seven astronauts into space. Instead, they blasted them into smithereens. The shuttle had two cylindrical tanks containing fuel to propel the vehicle into earth orbit. The fuel tanks consisted of metal rings bolted together. Metal-tometal surfaces tend not to form leak-tight connections, so two o-rings were placed in each flanged connection. The softer (compared to metal) material of the o-rings sealed the connection to keep the fuel from leaking out. Only one o-ring was needed to seal each connection—the design featured two o-rings for redundancy. One o-ring could fail and the flange would remain sealed if the other o-ring remained intact. During about nine prior shuttle launches, burning fuel caused the inner o-ring to fail. O-rings were not supposed to fail, yet they repeatedly failed. NASA tolerated this intolerable outcome based on the second o-ring having never failed. Until January 28, 1986 when both failed and the shuttle blew up 73 seconds after launch. O-Rings: Not Just Rocket Science O-rings are used in nuclear power plants, too. Among the places o-rings are used are in the flanged connections where the metal reactor vessel head is bolted atop the reactor vessel. Figure 1

Figure 2

Source: Bob Lochbaum

Source: Bob Lochbaum

Figure 1 looks upward at the reactor vessel head for Watts Bar Unit 1. Some of the holes for the studs used to fasten the head to the reactor vessel appear to the upper left. Portions of the two o-rings used to seal this flanged connected pass through the center of the picture and off its right edge. Figure 2 shows a close-up of the two o-rings used to seal the reactor vessel head on Watts Bar Unit 1 to its reactor vessel. Like the external fuel tanks on the shuttle Challenger, the o-rings are redundant in that only one intact oring is needed to seal the flanged connection. The second o-ring is installed for increased reliability that the sealing function gets performed. Unlike in the original shuttle design, the flanged connections for nuclear plant flanged connections have a leak-off line from the space between the two o-rings. If the inner o-ring fails, water passing through the failed o-ring flows through the leak-off line (a small diameter metal tube). Instrumentation in the leak-off line alerts workers to the failed inner o-ring. If the outer o-ring were to also fail, reactor cooling water would leak through the failed o-rings into the containment building. Instruments are installed in containment to monitor for water leaking from pipes, valves, and many other sources. Figure 3 is a snapshot from the Technical Specifications issued by the Nuclear Regulatory Commission for Indian Point Unit 2. If the instruments monitoring leakage inside containment exceed any of the Technical Specification limits, the reactor must be shut down within a handful of hours. Figure 3

Source: Nuclear Regulatory Commission (ML052720262) Indian Point: Burning Through O-Rings at an Atypical Pace The two reactors at the Indian Point nuclear plant in New York seem to experience reactor vessel o-ring failures at a higher frequency than other reactors (even at other reactors also owned by Entergy). The above average failure rate contributed to NRC inspectors selecting Entergy’s corrective actions for recurring o-ring failures for the annual sample. The NRC’s findings are documented in an inspection report dated October 27, 2017 (ML17303A977). The NRC inspectors noted that recurring o-ring failures prompted a design change in 2003. Since that change to the o-ring design, eight failures have occurred. The NRC inspectors noted that the inner o-rings on Indian Point Units 2 and 3 were failed at the time and the reactors were running with only their outer o-rings intact. The NRC inspectors concluded: “Corrective

December 27, 2017

Page 2

actions to address the various causal factors over the years have not been completely effective at preventing recurrence of the issue.” Indian Point Unit 2 was shut down in early December 2017 so workers could repair leaking seals on a reactor coolant pump. Workers noticed boric acid crystals on the outer surface of the reactor vessel flange area—unambiguous indications that the outer o-ring had also failed and was leaking borated cooling water. The outage was extended to allow workers to replace, once again, the failed o-rings. Browns Ferry Unit 1: O-Ring Prequel The Tennessee Valley Authority shut down all three reactors at the Browns Ferry nuclear plant in Alabama in the mid 1980s due to a myriad of safety problems. TVA spent millions of dollars fixing enough of the safety problems on Units 2 and 3 to allow their restart in the early 1990s, but Unit 1 remained on the sidelines until the 21st century. Circa 2002, TVA began fixing the safety problems on Unit 1 to permit it to be restarted. As part of that recovery efforts, workers initiated a problem report on March 14, 2006, about recurring failures of the o-rings on the Unit 1 reactor vessel flange, including indications that the leakage was damaging the metal surfaces of the reactor vessel and its head. But little was done about this known problem before Unit 1 was restarted on May 21, 2007. As often happens, the uncorrected known problem with the o-rings caused problems during reactor operation. The instruments monitoring for leakage inside containment detected leakage inside containment—elevated temperatures inside containment as well as the measured leak rate increasing from less than 0.1 gallons per minute to over 1.2 gallons per minute. TVA continued to operate Unit 1 until a scheduled refueling outage in October 2008. When workers removed the reactor vessel head on October 28, 2008, they observed that the reactor water leaking through the failed o-rings had damaged the reactor vessel head flange. The reactor cooling water was pressurized to over 1,000 pounds per square inch inside the reactor vessel. As it leaked through the failed o-rings, the water flashed to steam. The high velocity steam jetting by the failed o-rings gouged grooves in the reactor vessel metal. TVA concluded that the reactor vessel metal degradation was caused by “existing damage on the RPV [reactor pressure vessel] flange at the time of U1 restart” that was not repaired. Indian Point O-Rings: Sequel or So What? NASA’s space shuttles experienced recurring failures of the o-rings on their external fuel tanks. The oring failures were tolerated until Challenger exploded shortly after launch due to failure of both o-rings. Then and only then were the external fuel tanks re-designed to eliminate the o-ring vulnerability. TVA’s Browns Ferry Unit 1 had recurring reactor vessel flange o-ring failures known to cause damage to the reactor vessel. The o-ring problems and associated damage were essentially ignored en route to restarting Unit 1 in 2007. The pre-existing problem resulted in more extensive damage that had to be repaired in late 2008. Entergy’s Indian Point nuclear plant experiences recurring reactor vessel flange o-ring failures. A design change installed in 2003 to resolve the o-ring failure problems failed to achieve that outcome, given at least nine o-ring failures since that “fix.” Time will tell whether tolerating the intolerable at Indian Point leads to a sequel to the book by Allan McDonald and James Hansen about the worst o-ring failure catastrophe to date or a sequel to the costly efforts by TVA to belatedly correct known problems.

December 27, 2017

Page 3