Fr

JO

a

ARR1AA

1

batfflhnfb(ba

0d

Nuclear Engineering and Design 241 (2011) 644–647

Contents lists available at ScienceDirect

Nuclear Engineering and Design

journa l homepage: www.e lsev ier .com/ locate /nucengdes

itness for service assessment of degraded CANDU feeder piping—Canadianegulatory expectations

ohn C. Jin ∗, Raoul Awadperational Engineering Assessment Div., Canadian Nuclear Safety Commission, Canada

r t i c l e i n f o

rticle history:eceived 30 January 2009eceived in revised form8 December 2009ccepted 19 December 2009vailable online 13 May 2010

a b s t r a c t

Allowance for the continued operation of feeder piping at some Canadian CANDU stations, which is expe-riencing active degradation mechanisms, has been based primarily on augmented inspection practicesand conservative fitness for service assessments. The major degradation mechanisms identified to dateare: pipe wall thinning due to Flow Accelerated Corrosion (FAC) and service induced cracking due toIntergranular Cracking due to Stress Corrosion Cracking (SCC) and potentially Low Temperature CreepCracking (LTCC) mechanisms. Given that currently available industry codes and standards do not providesufficient guidelines/criteria for assessing the degradation of feeder pipes, the Canadian Nuclear SafetyCommission (CNSC) has asked the utilities to establish feeder pipe specific procedures to provide rea-sonable assurance that the risk associated with the feeder degradation is maintained at an acceptablylow level. In response to this requirement, the Canadian CANDU industry has developed and continuedto update feeder fitness for service guidelines to provide evaluation procedures and industry standardacceptance criteria for assessing the structural integrity of the feeder pipes. The scope and frequency ofinspections are determined based on the results of the fitness for service assessments taking into accountthe relative susceptibility of feeder pipes to each specific degradation mechanism. While industry prac-

tices for the management of degraded feeder pipes have, in general, been complied with the regulatoryexpectations, outstanding issues still remain. Major regulatory concerns include uncertainties associatedwith limitations in both the inspection techniques and the mechanistic understanding of the degradationprocesses, which can impede inspection planning and fitness for service assessments.

This paper presents the regulator’s view of the current situation with respect to degradation of feederpiping, its implications for nuclear safety and the regulatory expectations on industry’s management of

mena

the critical ageing pheno

. Degradation mechanisms affecting CANDU feeder pipes

CANDU is a pressurized heavy water reactor utilizing a num-er of fuel channels each containing a series of fuel bundles. Therere 380 fuel channels in the 600 MWe class CANDU-6 plants, whilehe larger 900 MWe class Darlington station type reactors have 480uel channels. Each fuel channel has an inlet and an outlet for theow of reactor coolant (D2O) through the fuel bundles to removeeat generated by the fuel. The inlets/outlets of the fuel chan-els are connected to the inlet/outlet headers by the inlet/outlet

eeder pipes. The feeder pipes are made of SA106 Grade B car-

on steel with the size ranging from 38.1 mm (1.5 in.) to 88.9 mm3.5 in.). Depending on the routing, each feeder pipe has severalends, either long-radius or tight-radius. The operating temper-ture ranges from 295 ◦C (563 ◦F) up to 318 ◦C (604 ◦F) and the

∗ Corresponding author.E-mail address: john.jin@cnsc-ccsn.gc.ca (J.C. Jin).

029-5493/$ – see front matter © 2010 Elsevier B.V. All rights reserved.oi:10.1016/j.nucengdes.2010.04.013

.© 2010 Elsevier B.V. All rights reserved.

pressure ranges from 10.5 MPa (1523 psig) to 12.7 MPa (1842 psig).Reactors operating at higher temperature create the potential fortwo-phase flow passing through the outlet feeders. The feeder pipesconstitute part of the primary pressure boundary and are accord-ingly classified as Nuclear Safety Class 1 piping.

Among various on-going degradation mechanisms, pipe wallthinning due to Flow Accelerated Corrosion (FAC) and crackingdue to Intergranular Stress Corrosion Cracking (IGSCC) and poten-tially Low Temperature Creep Cracking (LTCC) have been identifiedas major degradations that may affect the operating life of thefeeder pipes. Since the mid-1990s, outlet feeder piping in Cana-dian CANDU reactors has experienced greater than anticipated pipewall losses. The current understanding of the underlying degrada-tion mechanisms attributes the excessive wall thinning primarily

to the FAC, which is characterized by the presence of a thin mag-netite film and a scalloped appearance on the inside surface of thepiping. More recently, enhanced and highly-localized thinning wasdiscovered in the vicinity of the welds in the feeder pipes at someplants. Meanwhile, some feeder pipes at some Canadian CANDU

ering a

pgot

1

edbfaabaSMco

CrmtIaopc

1

ecvicetde

cbmaeTadr

1

cCblaCahi

J.C. Jin, R. Awad / Nuclear Engine

lants have experienced IGSCC or LTCC exacerbated by hydrogenenerated in the FAC process. The feeder bends with high levelsf residual stress are considered the most susceptible locations forhis service induced cracking.

.1. Flow Accelerated Corrosion (FAC) wall thinning

Virtually all outlet feeder pipes at all CANDU plants are experi-ncing pipe wall thinning due to the FAC at a rate much higher thanesign allowance. The FAC wall thinning is believed to be influencedy various factors including coolant temperature and velocity andeeder geometries that contribute to flow disturbances. It is gener-lly recognized that degradation due to the FAC is a relatively slownd predictable process: this allows utilities to manage its impacty predicting susceptible locations and monitoring thinning rates,s a basis for predicting the remaining service life. In the wake of theurry-2 accident in the United States (US NRC, 1989) and the recentihama event in Japan (US NRC, 2006), considerable study has been

arried out around the world, improving the level of understandingf the parameters affecting FAC.

To date, there have been no instances of feeder pipe failure inanada due to the FAC wall thinning. Several feeder pipes have beeneplaced when their wall thicknesses fell below pre-establishedinimum thickness criteria. Nevertheless, regulatory staff believes

hat on-power failure of a thinned feeder pipe cannot be ruled out.n particular, the staff’s major concern is that, in the absence of andequate ageing management program, the ultimate failure modef thinned feeder pipe would be sudden rupture without adequaterior warning by leakage, as has been known to occur in real-worldases.

.2. Wall thinning near welds in the Grayloc hub

During the recent post-removal examination of feeder pipesxtracted from the Pickering A stations to address another FAC con-ern, enhanced and highly-localized thinning was discovered in theicinity of the welds. The localized thin spots have been character-zed as blunt-type flaws. While a detailed root cause investigationontinues, the FAC is being considered as a factor which may havexacerbated the phenomenon. Destructive examinations of otherypes of bends suggest that degree of susceptibility to this kind ofegradation depends on the design configuration of the bends orlbows.

Prior to this discovery, it had been believed that the most sus-eptible location to the FAC wall thinning in the feeder pipes woulde the extrados of the tight-radius bends. Accordingly, ageinganagement, including inspection scoping and fitness for service

ssessment, had been focused on this region. In light of the Pick-ring A discovery, the situation has become more complicated.he concerns associated with this form of localized degradationre related to the possible formation of sharp flaw type features,ifficulties in inspecting susceptible locations and the lack of dataequired to assess the rate of degradation.

.3. Cracking in bends and repair welds

Intergranular cracking is an active or at least the pre-requisiteonditions exist in the tight-radius bends of outlet feeders at someANDU plants to support its occurrence. Cracks found in theseends initiated both at the inside and outside surfaces. While we

ack a complete understanding of this cracking, two possible mech-

nisms have been proposed by the industry: (1) Stress Corrosionracking (SCC) caused by exposure to mildly oxidizing hot coolant;nd (2) Low Temperature Creep Cracking (LTCC) exacerbated byydrogen. The latter mechanism has been invoked to explain cracks

nitiating at the outside surface. Since the creep cracking mecha-

nd Design 241 (2011) 644–647 645

nism has not been observed at temperature of outlet feeders, itsproponents assert that cracking is facilitated by a flux of atomichydrogen generated by FAC at the inside surface of affected feeders(Gendron et al., 2007).

Although the root cause analysis of this cracking remains incon-clusive, it is generally accepted that tensile residual stress plays acritical role in initiating and propagating the service induced cracks.Accordingly, cracking should be considered possible at any outletfeeder bends possessing sufficient level of residual tensile stressesto initiate cracking. Tight-radius bends are considered more sus-ceptible to cracking because of the potential for higher residualstress levels. Within tight-radius bends, the extrados region is ofprimary concern in terms of the margin on crack stability becauseof the relatively high likelihood of cracking, the axial extent oftensile residual hoop stress, the reduced fracture toughness, andthe degree of thinning from fabrication and the FAC. Because ofstation-to-station differences in the fabrication process for feederbends and variability with regard to the application of post-bendingstress-relief treatments, susceptibility to feeder cracking likewisevaries across Canadian CANDU plants.

To date, thirteen confirmed cases of feeder cracking haveoccurred in the tight-radius bends of the outlet feeders and all werediscovered at the Point Lepreau Generating Station (PLGS). Of these,two cracks went through-wall resulting in leaks. However, in boththe 1996 and the 2001 events, the reactor at the PLGS was shutdownbefore the cracks reached critical size. Of the remaining observedcracks, all eleven had been detected during in-service inspectionand had not penetrated through-wall.

There has been one instance of a leaking crack at a repairedweld in an outlet feeder pipe at Gentilly-2 station having a similardesign to Point Lepreau. The crack was intergranular and very tight;as a result, the amount of leakage was very small. Follow-up fromthis incident suggested that welds repaired using full-penetrationexcavation and subsequent re-welding should be considered sus-ceptible to the service induced cracking.

1.4. Safety concerns associated with degraded feeder pipes

The potential nuclear safety implications of feeder failure are:(1) the event frequency for small LOCA under normal operatingconditions may increase beyond the value assumed in the SafetyAnalysis; (2) the probability of consequential small LOCA mayincrease under an upset or fault condition; and (3) increased leak-age from the heat transport system (HTS) resulting from feederdamage may occur as a result of upset or fault transient conditions.Industry has evaluated and managed these potential implicationswithin the feeder fitness for service program. The governing princi-ple for a nuclear safety framework for managing feeder degradationis that any increase in risk to the public arising from feeder degrada-tion must be small. The regulatory staff is reviewing the followingproposals developed by the industry in light of the governing prin-ciple: (1) any increase in the frequency of small LOCA, arising fromrupture of a degraded feeder must be small; (2) the frequency ofmulti-feeder ruptures, due to feeder degradation, must remain neg-ligible under normal and elevated stress conditions; and (3) theconsequences of feeder leakage under elevated stress conditionsmust be limited by demonstrating crack stability and no significantincrease in dose to the public.

2. Management practice for degradations

2.1. Augmented inspection scope

As mentioned above, the service life of feeder pipes is being lim-ited by two active degradation mechanisms, intergranular cracking

6 ering a

aorbcutitr

2

gcfottlitbdErtf

2

flp1rIsnlIlfitwsmasSifla

3

3

oCstla

46 J.C. Jin, R. Awad / Nuclear Engine

nd wall thinning. At present, given the limited understandingf these degradation mechanisms and the fact that effective andeliable mitigation methods are not available, the only plausi-le options are to expand the scope of inspections and applyonservative engineering assessments with due consideration ofncertainties. The regulatory staff and industry have acknowledgedhat a statistically-significant number of feeder pipes should benspected and the uncertainties associated with the inspectionechnology should be taken into account in assessing inspectionesults.

.2. Fitness for service assessment

The utilities have developed feeder pipe fitness for serviceuidelines (COG, 2006) which rely on two types of assessment:ondition monitoring assessment (CMA) to assess the past per-ormance and forward-looking operational assessments (OA). Thebjective of the CMA is to demonstrate that, for feeders with iden-ified degradation, acceptance criteria have been satisfied duringhe previous evaluation period. In contrast, the OA assesses theikelihood that entire population of feeders will continue to sat-sfy acceptance criteria over the next operating period. In applyinghis dual-assessment approach, the utilities’ assessments need toe conservative. Otherwise, the regulatory staff will insist that anyeficiencies be resolved as a pre-requisite to re-starting the plant.ven if a conservative assessment requires that feeders had to beeplaced, the costs of such action would be pale beside the produc-ion losses incurred if a regulator were to reject a non-conservativeeeder assessment.

.3. Disposition

During an in-service inspection of feeder pipes, any detectedaw, which fails to meet specified acceptance criteria must be dis-ositioned to the satisfaction of the regulator (CAN/CSA N285.4,994). Service induced cracks detected in the feeder pipe have beeneplaced without dispositioning for operation with detected flaws.n the case of wall thinning, Canadian industry adopts an “allowabletress” methodology to establish the minimum allowable thick-ess, primarily based on linear-elastic stress analysis and stress

imits given by the ASME Boiler and Pressure Vessel Code, SectionII (ASME). Design rules in Section III, Subsection NB-3600 are uti-ized for this purpose with the stress indices determined by detailednite element stress analyses. Different models have been used forhe cross-sectional area of the thinned feeder pipes, depending onhether or not credit is given to the thicker intrados material. If the

implified equations in NB-3600 are not fully satisfied, some ele-ents of design by analysis methodologies given by NB-3200 are

dopted including detailed elastic–plastic analysis. For fitness forervice assessment of possible blunt flaws near a weld, the ASMEection III and a limit load approach are used to assess flaw stabil-ty with fatigue evaluation. The possibility of a sharp radius of theaw increasing the stress concentration is taken into account byssessing a postulated crack.

. Regulatory expectations

.1. General

Although rupture of single feeder pipe falls within the envelopef design basis accidents considered in Safety Analyses for Canadian

ANDU plants, the regulatory staff remains concerned about con-equential multiple feeder failures and the release of radioactivityo the public. Key factors contributing to this concern are currentimitations in both understanding of the degradation mechanismsnd in-service inspection capability. It is the regulator’s view that

nd Design 241 (2011) 644–647

reliable assessment of fitness for service of flawed componentsrequires the integration of different aspects from several disci-plines; for example: a mechanistic understanding of degradation,material behavior, principles of engineering structural evaluation,NDE technology and so on. The limited knowledge regarding thecauses of the degradation may lead to susceptible areas that arenot inspected. Accordingly, regulatory staff has insisted that inspec-tion planning and structural integrity assessments should take intoaccount these limitations in a conservative way. In practical terms,this means that regulatory staff allows a utility to continue operat-ing degraded feeder pipes only when they provide a conservativeengineering evaluation of the observed degradation, and commit toan expanded inspection scope to identify other feeders with similaror potentially more severe degradation.

Considering the large amount of feeder pipes in a CANDU station,it may be impractical to completely inspect each pipe during everyinspection outage. Since feeders are located in high-radiation envi-ronments, the regulatory staff asks that licensees carefully weighthe benefits of inspecting given feeders in terms of reducing therisk posed by unrecognized degradation against the dose penaltypaid by inspectors. As a result, there is a motivation for utili-ties to develop strategies to focus inspection resources on thosefeeders ranked as having higher susceptibility to each degrada-tion mechanism. Canadian regulatory staff has recently considereda probabilistic assessment as an aide in assessing the risk incre-ment associated with specific type of degradation and the effect ofinspection scope and frequency in reducing the risk.

3.2. Service induced cracks

If there is any doubt regarding the manner that a detected cracklike flaw initiated and propagated under the plant’s operating con-ditions, it shall not be evaluated for a disposition for continuedoperation with the detected flaws. For the plants where feederpipe cracking is credible, it is expected that there must be: (a) asufficient level of mechanistic understanding, (b) reliable data onflaw growth rate models supported by relevant tests, (c) a reliablecritical crack size determination supported by a sufficient num-ber of proof tests and (d) quantified inspection capability in termsof detection limit and sizing uncertainties. Probabilistic evaluationmay be required to show that the inspection scope and frequencyis adequate in reducing the risk increment associated with a cred-ible degradation mechanism to an acceptable level. The issue ofthe detection limit and probability of detection of the ISI shall,for example, be addressed by evaluating the structural integrityof feeder pipe with postulated flaws. In that case, the size, shapeand location of the postulated flaws should be included in a con-servative manner.

It has been the regulatory position that management ofdegraded feeder pipes shall be conducted in such a way as toprevent leakage no matter how small the leak may be. The basicphilosophy of licensing has been to detect flaws by in-serviceinspection so that the leakage of coolant does not occur. Consid-eration of the consequence of leakage deviates from the pressureboundary design concept which contends that the pressure bound-ary should be maintained. However, in very limited cases, wherethere can be no assurance that a crack does not exist, it is the regula-tory view that the management of a degradation mechanism couldbe based on the consequences of a leak, but only when there isconcrete evidence demonstrating final failure mode would be a leakbefore break (LBB). In this case, the concept of the LBB shall be appli-

cable for a specified operating period, not as a principal long-termmethod for managing service induced degradation. The Canadianregulatory perspective on the application of the concept of LBB forthe justification of continued operation of degraded components ispresented in Jin et al. (2007).

ering a

3

ctcoGttrnortae

3

puotedobakfta

natidu

(

(

(

approach to managing coolant pipe cracking was needed at Point Lepreau. Nucl.Eng. Int..

J.C. Jin, R. Awad / Nuclear Engine

.3. Blunt flaw

With respect to the assessment of possible blunt flaws, the majoroncern is that it may not be detected by the existing NDE tools, noto mention their insufficient sensitivity to characterize flaw and toonfirm that no micro-cracking is present in the flaw. As this typef flaw was discovered only recently in an unexpected area near therayloc hub weld, there is insufficient data to assess the degrada-

ion rate. A structural integrity evaluation shall be performed withhe consideration of a high local stress concentration which mayesult in crack initiation. Regulatory expectations are: (1) mecha-istic understanding should be improved to permit the predictionf susceptible locations or the susceptibility of different configu-ations of weld geometry, (2) inspection tools should be improvedo enable detailed characterization of the flaw, and (3) if there isccessibility concern, conservative flaws should be postulated inngineering evaluations for the crack stability and fatigue initiation.

.4. Wall thinning

Although it is arguable that degradation due to the FAC isredictable and manageable, there are still concerns caused byncertainties involved in the inspection and evaluation method-logies. Considering the complexity of the mechanistic process ofhe FAC involving fluid and structure interaction, chemical reaction,rosion processes, and so on, it cannot be assumed that methodseveloped to predict susceptible locations and to assess the ratef metal loss are infallible and, therefore, conservatism should note compromised during inspection planning activities. Obtainingccurate thickness measurements using ultrasonic testing (UT) isnown to be highly dependent on the specimen geometry and sur-ace conditions. It is also difficult to ensure that the region of wallhinning has relatively smooth contours without notches that mayct as stress concentrations.

In the procedure for developing acceptable minimum thick-ess criteria, it is generally considered conservative to apply anllowable stress methodology in accordance with the ASME Sec-ion III. However, there are still a number of sources of uncertaintyn the process of engineering evaluation for structural integrity ofegraded pipes, which could erode safety margins. The sources ofncertainties may exist in:

1) Flaw modeling. In-service inspection techniques may not besufficiently sensitive to characterize detected flaws, introduc-ing the possibility of un-conservative modeling results.

2) Load calculation and combination, particularly for dynamicexcitation. Feeder pipes are coupled to each other by spacersand also supported by various types of restraints, resulting invery complex dynamic behavior. Calculating seismic responsesof this complex piping system may lead to un-conservative

results. It can be difficult to quantify the effects of non-designbasis loading, such as vibration, on the structural behavior.

3) Residual stress. Magnitude of residual stress remaining in com-ponents and its effect on the component integrity is difficult toquantify.

nd Design 241 (2011) 644–647 647

(4) Degradation of material properties. It is generally known andalso observed in many actual cases that material properties maydeteriorate due to operating conditions. Dynamic strain ageingeffects on fracture toughness also have been identified by prooftesting particularly for feeder pipe material, carbon steel SA-106, Gr. B. Variations in material properties in the heat affectedzone might be overlooked in the assessment of flaw nearwelds.

(5) Stress classification. Classification of stresses in the flawed pipeinto local/general, primary/secondary may not be straightfor-ward (Jin et al., 2008). Classification into local stress should besupported by flaw characterization based on inspection results.Effect of local overstrain shall be taken into account in feederpipe structural integrity assessment.

Therefore, it is the regulator’s expectation that parameters andmethodologies used in the engineering evaluations for demon-strating fitness for service shall be always performed in aconservative manner considering many different sources of uncer-tainties.

4. Conclusions

With respect to the management of feeder pipe degradationmechanisms, the major regulatory concerns are the limitations inthe mechanistic understanding of the processes involved and theuncertainties in the inspection capabilities and engineering assess-ments. Listed in this paper are the possible sources of uncertaintiesaddressed from a regulator’s point view. It is the regulatory posi-tion in accepting the industry’s request for continued operationof degraded feeder pipes that a sufficient number of feeders mustbe inspected to establish a representative and reliable account ofthe level of degradation and that the uncertainties in the inspec-tion techniques and engineering evaluations shall be taken intoaccount using conservative engineering assessment parametersand methodologies.

References

ASME Boiler and Pressure Vessel Code, Section III, Div 1, Rules for Construction ofNuclear Facility Components.

CANDU Owners Group Inc., 2006. Fitness for Service Team of COG Feeder IntegrityJoint Program. “Fitness-for-Service Guidelines for Feeders in CANDU Reactors”.

CAN/CSA N285.4, 1994. Periodic Inspection of CANDU Nuclear Power Plant Compo-nents. Canadian Standards Association.

Jin, J., Blahoianu, A., Viglasky, T., 2007. Canadian Regulatory Perspective on LBB Appli-cation for CNADU Piping. Structural Mechanics in Reactor Technology (SMiRT),Toronto, Canada.

Jin, J., Eom, S., Awad, R., 2008. Some issues in fitness for service assessment of wallthinned CANDU feeder pipes. In: ASME Pressure Vessel and Piping Conference,PVP2008-61525, Chicago, USA.

Gendron, T., Slade, J., White, G., 2007. Pinpointing cracks—why a probabilistic

U.S. Nuclear Regulatory Commission, 1989. NUREG-1344, “Erosion/Corrosion-Induce Pipe Wall Thinning in U.S. Nuclear Power Plants”.

U.S. Nuclear Regulatory Commission, 2006. Information Notice 2006–2008. “Sec-ondary Piping Rupture at the Mihama Power Station in Japan”.