AECB Staff Annual Assessment of the Point Lepreau Nuclear Generating Station for the Year 1995

INFO 0649

CA9700005

vot

1^1 Atomic Energy Commission de controle • ^B Control Board de I'energie atomique Canada INFO-0649

AECB Staff Annual Assessment of the Point Lepreau Nuclear Generating Station for the Year 1995

Atomic Energy Control Board Ottawa, Canada

June 1996

Atomic Energy Commission de controle l + l Control Board de I'energie atomique Canada © Her Majesty the Queen in Right of Canada, 1996 AECB Catalogue number INFO-0649

Extracts from this document may be reproduced for individual use without permission provided the source is fully acknowledged. However, reproduction in whole or in part for purposes of resale or redistribution requires prior written permission from the Atomic Energy Control Board. Atomic Energy Control Board is the independent federal agency that controls all nuclear activities in Canada. Our mission is to ensure that the use of nuclear energy in Canada does not pose undue risk to health, safety, security and the environment.

A major use of nuclear energy in Canada is electricity production.

We have an office at every nuclear generating station, and we monitor the stations on a day-to-day basis. Specialists in our Ottawa head office work with the on-site staff to accomplish our mission.

We assess every station's performance against legal requirements, including the conditions in the operating licence we issue. To do this, we review all aspects of a station's operation and management, and we inspect each station. TABLE OF CONTENTS

SUMMARY iii INTRODUCTION 1 OPERATIONAL SAFETY 3 Compliance with Regulations made under the Atomic Energy Control Act 3 Compliance with the Operating Licence 3 Events Reported to the AECB 4 Worker Radiation Safety 5 Public Radiation Safety 7 Safety System Performance 8 Operations and Maintenance 10 Station Management 13 Training 14 Emergency Preparedness 14 Safety Analysis 15 Quality Assurance 16 Safeguards 16 CONCLUSIONS 19 GLOSSARY 21 SUMMARY

1 his report is the Atomic level of performance continues contribute to boiler tube Energy Control Board staff unchecked, it might result in corrosion. NB Power fitted new assessmentof safety at Point increased risk from operation divider plates in the boiler Lepreau Generating Station in the future. Human error was heads, which will improve safe- for 1995. Our on-site project an important feature of these ty performance in the event of officers, and Ottawa-based problems. NB Power had a large loss of coolant accident. specialists monitored the already introduced safety station throughout the year. culture training for their staff, Clean up of the debris from but they will need to under- the wooden cover represented Point Lepreau operated safely take further work urgently to a considerable challenge to during 1995, which was an resolve the problems. NB Power staff. We reviewed unusual year for the station. NB Power's clean up activities The station was shut down for a Three of Point Lepreau's very carefully to satisfy our- planned five month outage to special safety systems failed selves that the reactor was allow NB Power to complete to meet their availability safe to operate before we maintenance on the reactor's targets during 1995. However, authorised restart. pressure tubes. In October, except for one problem a wooden cover left in the affecting emergency coolant NB Power's safety analysis heat transport system caused injection, the unavailability program progress slowed dur- the failure of a heat transport occurred during shutdown ing 1995, due to the additional pump, and spread debris through conditions and had minor workload from the outage. The the system. Clean up after this safety significance. Point Lepreau training, quality event extended the outage by assurance and safeguards- two and a half months. During the long outage, related activities continued NB Power successfully to function satisfactorily. The NB Power failed to comply completed the planned pres- station successfully completed with the terms of the sure tube maintenance. The required exercises and drills, Operating Licence we issue pressure tubes will now be and emergency preparedness on fourteen occasions in 1995. able to operate to the end of training. They have assigned In addition, NB Power report- the reactor design life. They additional resources to emer- ed an unusually large number also completed a program of gency preparedness planning, of events. None of the events boiler cleaning, to improve which should enable them to themselves directly affected heat transfer, and to remove take a more pro-active public safety. However, if this deposits which could approach in this area. INTRODUCTION

breakdown of our assessment of nuclear facilities. Our public Joint Lepreau is a single of NB Power's safety perfor- library also contains an impor- reactor nuclear generating mance. Although we use tant collection of documents, station of the CANDU 600 MW similar terms to describe safe- available on request. Apart design. It is located on the ty performance for each of the from the AECB Staff Annual shore of the Bay of Fundy, near nuclear generating stations in Assessment Reports, we pub- Saint John, New Brunswick. Canada, many of them have lish an AECB Annual Report, This report is the Atomic different contexts. Readers research reports, commu- Control toard (AECB) staff should be aware that direct niques, information bulletins, assessment of the safety of the comparison between stations notices and pamphlets. Our operation of the Point Lepreau is difficult, and often not address is 280 Slater Street, Nuclear Generating Station. appropriate. Ottawa, Ontario. It has been compiled by AECB The nuclear industry uses Please mail any written staff at the Point Lepreau site, many technical terms in its requests for information to: and in our head office in day-to-day activities. To help Atomic Energy Control Ottawa. We have based our readers, we have provided Board our review on our own obser- a glossary of the technical Office of Public Information vations, and on information terms used in this report. P.O. Box 1046 submitted to us by New We have also italicised glossary Ottawa, Ontario Brunswick Power (NB Power). terms the first time they K1P5S9 Canada. Throughout this report, we appear in the report. We can also be reached by have included tables with At our head office in Ottawa, telephone at 613-995-5894 or more detailed information the public can consult docu- 1-800-668-5284. on specific topics. These ments relevant to the licensing tables also give a detailed

NEXT PAQE(S) left BLANK OPERATIONAL SAFETY

COMPLIANCE WITH Packaging of Radioactive requested NB Power to deal REGULATIONfMADE Materials Regulations, and the with these matters promptly. UNDER THE^TOMIC / Atomic Energy Control ENERGY CONTROL ACT Regulations. The dose conse- NB Power's security force con- quences of a release of this ducted periodic security drills, We require NB Pqvtfer to oper- material would have been that are of limited scope, in ate Point Lepreau Generating below any level of regulatory 1995. These drills test various Station according to the legal concern. There was no safety operational and technical areas requirements governing the hazard to the public as a result of the station's security systems. nuclear industry in Canada. of this non-compliance. These requirements come COMPLIANCE WITH THE from the Atomic Energy Control The Physical Security OPERATING LICENCE Act and regulations made Regulations define the security under the Act. The regulations measures that NB Power must The Operating Licence we directly applying to Point maintain at Point Lepreau. issue to NB Power contains Lepreau are the Atomic Energy During the past year, NB Power conditions that they must Control Regulations, the Physical improved their efforts to com- observe. There were fourteen Security Regulations, the Trans- ply with the Physical Security instances in 1995 where port Packaging of Radioactive Regulations. NB Power failed to comply Materials Regulations and with these conditions. This is a the Cost Recovery Fees In May and September of 1995, marked increase from previous Regulations. NB Power we conducted assessments of levels. Although this number complied fully with all these NB Power's security arrange- of problems is at least partly regulations, except as noted ments at Point Lepreau. We related to the unusually long in the following paragraphs. found some aspects of the sta- outage in 1995, the level of tion's security to be in need of compliance is not satisfactory. In March, NB Power realised adjustment, and NB Power Individually, the events did that bio-assay samples they took immediate action in not result in safety hazards to were shipping off site for dis- response to our findings. the public. However, NB Power posal contained activity higher However, other items remain must find and correct the than permitted levels. Thus, outstanding from our previous problems which have led to NB Power's shipments did not assessments, and we have non-compliances, to assure comply with the Transport the future safety of the station. Figure 1: COMPLIANCE PROBLEMS (number of non-compliances vs year) safety culture training for their employees. This training has been delivered to key staff, but it is clear that NB Power must make a substantial further effort to improve performance. 9- NB Power management have assured us that they are 6_ taking the compliance failures seriously, and as a first step have reinforced their safety performance expectations to 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 staff. They are studying human performance in recent events to determine what further action may be necessary. Figure I shows the history of The station therefore spent an compliance problems at Point extended period in the shut- Lepreau. down state during the year, EVENTS REPORTED with a great deal of complex, TO THE AECB During 1995, Point Lepreau radiation dose intensive, work underwent an extended main- being completed. At the beginning of 1995, we tenance outage. The major changed the requirements for work during this outage was the A feature of most of the formal reporting of events by correction of pressure tube spacer compliance failures was the nuclear utilities. This change positioning. NB Power also significant contribution of will allow more consistent completed important mainte- human error, primarily as a fail- reporting from the different nance and modifications, such ure to ensure compliance with nuclear stations. NB Power as boiler cleaning, and installa- procedures. We believe that reported thirty-two events to tion of new boiler divider plates. these problems were inadver- us in accordance with these At the end of the outage, a tent, and several resulted requirements during 1995. main heat transport pump was because NB Power staff This total includes fourteen damaged when a wooden encountered non-routine con- failures to comply with cover was left in the system. ditions during the outage. In Operating Licence conditions System clean up and repairs our reports for previous years, noted earlier in this report. extended the outage by a fur- we have described NB Power's Because of the change in ther two and a half months. progress towards providing reporting rules, we are cautious of drawing conclusions about significance, in the appropriate taken to event reporting. the apparent increase in the sections of this report. We continue to believe that number of reportable events NB Power's event analysis from fourteen in 1994. The change in reporting rules process needs further develop- However, the large number of required utilities to adapt ment. We are currently continu- events, and the fact that many their existing event analysis ing discussions with NB Power involved human error as a and reporting processes to on event analysis, and the significant contributing factor, meet the new requirements. assessment of human perfor- indicates that this is a topic NB Power fully met our expec- mance in events. This will which NB Power will need to tations for timeliness of event clearly be an important activity pursue aggressively. We have report preparation, and we in resolving the observed were pleased with the pro- included details of specific human error rate. We will be active approach they have events, and their safety monitoring this situation carefully in the coming year.

Table 1: SUMMARY OF EVENTS 1995 WORKER RADIATION ASSESSMENT SAFETY

Number of events reported to the AECB 32 Needs improvement Worker radiation safety at Point Number of non-compliances with OP&P 14 Needs improvement and licence conditions' Lepreau was satisfactory during Number of fires I Acceptable 1995. NB Power's planning and ' Included in the total number of events reported control processes generally maintained radiation doses as low as reasonably achievable Figure 2: COLLECTIVE STATION RADIATION DOSE (person-mSv vs year) (ALARA). However, radiation dose received by staff as a result of the event where a wooden cover was left in the heat transport system was unnecessary and avoidable.

As shown in Figure 2, the total 1995 dose of 3.7 person-sievert (3657 mSv) received by station staff was considerably higher than in previous years. This increase resulted from the work 1991 1992 1993 1994 1995 carried out on the reactor Table 2: WORKER RADIATION SAFETY estimates, recommended alter- ASSESSMENT natives for dose reduction and

Total whole body dose (person-mSv) 3657 Acceptable facilitated the purchase of the

Number of exposures greater than legal limit 0 Acceptable necessary equipment, for example, remote controlled tooling and decontamination Figure 3: RADIATION DOSE DISTRIBUTION — NB POWER STAFF equipment. The original esti- (number of employees vs dose range (mSv)) mated dose for the scheduled outage activities was 4.5 person-sievert. As a result of the planning efforts, this dose was reduced to 2.5 person-sievert .

The recovery from the incident involving the wooden cover at the end of the planned outage posed a significant radiation control challenge to the station. Because this event 0 0-0.1 0 1-5.0 5.0-10 10-15 15-20 20-25 25-30 was unexpected, NB Power's radiation dose planning was limited during recovery efforts. during its long outage, and does Because work planned for the We verified through routine not represent a long-term trend. 1995 outage involved systems field inspections, and through and equipment where radia- review of the recovery procedures, that NB Power main- Figure 3 shows the distribution tion exposures would be high, tained proper radiation dose of radiation dose received by work planning and optimisa- control during the recovery. station staff. In spite of the tion were important. NB Power Worker dose from the recovery unusual outage conditions, formed a senior management after the 'wooden cover' NB Power were successful in outage practices ALARA review incident was approximately ensuring that the majority of committee. This committee I person-Sv. workers received less than worked to minimise worker 10 millisievert (rnSv). No worker dose by requiring station Dose from tritium remained a received more than our annual engineers to provide accurate significant contributor to work- regulatory limit of 50 mSv. dose estimates for planned er dose, accounting for approx- The highest dose received by outage activities. The commit- imately one-third of the total any individual worker was tee then examined these dose 26.2 mSv. station dose. During 1995, the station commissioned five new much less than the limits we In 1995, NB Power proposed tritium air monitor units, and set, and were similar to release new Derived Emission Limits, NB Power have told us that levels in previous years. based on public dose levels they will be purchasing more which are five times more monitors in the future. These In the following paragraphs, we restrictive than our current units provide a more reliable discuss radiation releases from requirements. We have accept- means of monitoring tritium the station in terms of the ed this proposal and it will levels and alerting staff to Derived Emission Limit or DEL. become our licensing require- the possibility of an accidental The Derived Emission Limit is ment from lanuary 1996. tritium exposure. They also a calculated annual limit that contribute to station safety is specific to each reactor site. Radioactive material in liquid because they provide a very The DEL defines the amount effluents averaged 0.02 percent sensitive means for detecting of radioactive material release of the corresponding DEL heavy water leaks. that could result in a radiation during 1995. The radioactive exposure of five millisievert material released in the In November 1995, ventilation to a member of the public. gaseous effluents averaged airflow in the upgraderarea The station operates to a target 0.03 percent of the DEL. The flowed in the wrong direction of one percent of these limits. total potential dose to the for several hours after ventila- NB Power report liquid public was 0.002 mSv. For tion fans tripped. The station's releases to us on a monthly comparison, the total radiation Operating Policies and Principles basis, with the releases com- exposure to members of the require air flow to be con- pared against a monthly limit public from naturally occurring trolled so that the spread of which is one-twelfth of the sources in the area of the any contamination is minimised. annual DEL. Similarly, airborne station averages about 1.5 mSv NB Power are modifying the releases are compared against per year. fan controls to prevent this a weekly limit. type of problem occurring in the future. Table 3: AIRBORNE RELEASES

ASSESSMENT PUBLIC RADIATION SAFETY Tritium No. weeks > 1% DEL 0 Acceptable average % DEL 0.020 Acceptable The station's control of radioac- Noble gas No. weeks > 1% DEL 0 Acceptable tive material in effluents from average % DEL 0.001 Acceptable the station was satisfactory Iodine 131 No weeks > 1% DEL 0 Acceptable during the year. The amounts of average % DEL 0 Acceptable radioactive materials released Paniculate No. weeks > 1% DEL 0 Acceptable average % DEL 0 Acceptable to the environment were very Table 4: LIQUID RELEASES at least 99.9 percent of the ASSESSMENT time. To meet our requirement,

Tritium No months the time for which a special > 1% DEL 0 Acceptable safety system does not fully average % DEL 0.005 Acceptable meet its performance specifica- Cross beta/gamma No. months > 1% DEL 0 Acceptable tions must be limited to 8.8 average % DEL 0.017 Acceptable hours a year. The total period of time during the year that a system does not fully meet Table 5: PUBLIC EXPOSURE its requirements is called the ASSESSMENT unavailability of the system.

Dose rate to critical group from plant emissions 0.002 mSv/year Acceptable Predictions of future availabili- Average tritium in air at station boundary 1.5 Bq/nV Acceptable ty are important, because they give insights into the reliability with which the systems can be Table 6: SPECIAL SAFETY SYSTEM UNAVAILABILITY1 expected to perform in the future. Predicted future unavail- PREDICTED 1995 FUTURE ASSESSMENT ability is calculated using reliability analysis for the systems. Shutdown system 1 9 6 h 15.9 h Needs improvement

Shutdown system 2 I I.I h 18.0 h Needs improvement In 1992, we noted a significant Containment 7.4 h 42.6 h Needs improvement increase in the number of Emergency coolant 53 0 h 32.3 h Needs improvement jumpers on special safety sys- injection system tems. In our assessment report 'Target unavailability is less than 8.8 hours per year for that year, we identified this level of performance as SAFETY SYSTEM during shutdown conditions, needing improvement. Since PERFORMANCE and were of minor safety then, the number of such significance. Predicted future jumpers has not decreased. Special safety system performance unavailability for all four special Since any jumper on a special still requires improvement at safety systems is higher than safety system requires our Point Lepreau. Of the four the standards we set, indicat- specific approval before instal- special safety systems, only ing that NB Power need to lation, we have verified that containment met our availability complete further work to each does not directly affect requirement in 1995. However, ensure satisfactory perfor- safety. But temporary changes except for one fault affecting mance for these systems. to such important systems are the emergency coolant injection not desirable, and should be system (EG), the special safety We require each of the special resolved without delay. system problems occurred safety systems to be available In 1995, NB Power continued monitoring that the station's monitoring, and reactor work on the review of allow- technical unit engineers had power trip protection, during able operating limits for spe- planned to put in place. extended outages, when reac- cial safety systems, and their tor decay power is very low. environmental qualification review • During the maintenance out- The setting of the other two program. The findings in both age, NB Power temporarily sus- channels was correct, and programs have resulted in pended the reactor guaranteed provided protection. This con- many safety improvements in shutdown state without placing dition lasted for approximately shutdown system two in ser- the station. NB Power also con- eighteen hours. tinued to make progress with vice. The station's Operating special safety system reliability Policies and Principles require • In August, maintenance staff studies. NB Power's reliability both reactor shutdown systems modified drain piping on the analyses are proving very to be available before leaving ECI system without the appro- valuable in finding areas where the guaranteed shutdown vals required by the station's safety system performance can state. This condition existed for Operating Policies and Prin- be improved. The current pre- eleven hours before NB Power ciples. NB Power reviewed the dicted future unavailability for staff recognised the problem work after its completion, and the systems is high because and corrected it. The reactor found the modification met the NB Power have found potential remained in a safe shutdown appropriate requirements. contributions to unreliability state throughout the event. which they had not previously • In December, NB Power recognised. • In June, an electrical main- staff conducted maintenance tainer disconnected wires on on two ECI valves. When the There were six occasions in a moderator temperature sensor maintenance was complete, 1995 when NB Power staff for shutdown system one, instead they test operated the valves failed to observe the require- of a moderator temperature to the open position, which ments applicable to special control sensor, as intended. would be the normal require- safety systems: The sensor wiring was not ade- ment. However, because these quately identified. The other valves were required to remain • In April, maintenance on a two shutdown system one shut to ensure adequate reac- boiler level control transmitter channels were available to pro- tor heat sink, the work plan con- caused another transmitter in vide the required protection. trolling the maintenance had shutdown system two to measure specifically prohibited opening incorrectly. NB Power staff had • Also in )une, an operator the valves. Operators would already recognised the poten- adjusted the trip setpoint of have been able to close the tial for this problem to occur. one channel of the start-up valves manually, if needed. Because of poor coordination instrumentation to an incorrect between staff, technicians car- setting. Start-up instrumenta- The fault that caused the oper- ried out the work without the tion provides reactor power ational unavailability for the Table 7: STATION OPERATION ECI system occurred in ASSESSMENT December. During routine testing, NB Power discovered that Plant capacity factor 28% (not assessed) two valves on the system Number of non-spurious reactor trips 1 Acceptable would not close as required. Number of serious process failures 0 Acceptable

Investigation revealed that Total outstanding call ups (year end) 1452 Needs improvement there was a degradation in the ... on special safety systems only 117 Needs improvement actuator and valve drive mecha- ... on standby safety support systems 140 Needs improvement

nisms caused by insufficient Total number of jumpers in effect (year endl 584 Acceptable

inspection, cleaning and lubri- ... on special safety systems only 29 Needs improvement

cation. This caused an unavail- ... on standby safety support systems 3 Acceptable ability of a part of the ECI system for fifty-three hours. NB Power were able to make Containment unavailability could operate safely to the end the required repairs promptly, during the outage occurred of station life. Other important and they have now revised the when a temporary bung in a activities included cleaning routine maintenance require- main steam line lost air to its for the boilers, and installation ments for these valves. seal. Again, because of the of new divider plates in the plant conditions, there were boilers. NB Power restarted The main cause of shutdown no safety implications. We the reactor in December, after system one unavailability approved a further short a two and a half month delay during the outage was spurious period of containment unavail- needed to complete clean up actuation of the shutdown ability under controlled condi- after a wooden cover was acci- system. The station's Operating tions while the station was dentally left in the heat trans- Policies and Principles require shut down, to allow NB Power port system. No serious process that the sfiutoff rods are poised to work on a containment failures occurred in 1995. while the reactor is in the isolation valve. guaranteed shutdown state. If A notable safety improvement the system actuates spuriously, was the installation of a seismic the rods are not available for OPERATIONS AND monitoring system in the MAINTENANCE shutdown action again until station. There are five seismic operators have reset the sys- detectors located in various The station operated at high tem. This occurred seventeen areas of the station, which power for the first four months times during the outage. automatically detect and of 1995. In April, NB Power The safety significance of this record earthquakes and started a long planned outage. unavailability is minimal, activate alarms in the main The most important outage because of the reactor's guar- control room. work was pressure tube main- anteed shutdown state. tenance, to ensure that they

10 The pressure tube work should remove conditions been left in one of the boilers. involved repositioning of the which had led to pitting corro- Debris from the wooden cover, pressure tube to calandria tube sion attack of the boiler tubes, including wood, screws, and spacers, using a tool known as and correct deteriorating heat hardware such as hinges and SLAR (Spacer Location And transfer in the boilers. handles entered the core and Relocation). Each of the hot NB Power cleaned the primary connected parts of the heat pressure tubes is kept from side of the boiler tubes using transport system. To ensure contact with its cool calandria stainless steel shot, blown the reactor was safe to operate, tube by four such spacers, through the tubes by air blast. NB Power put in place an called garter springs. If these NB Power inspected about a extensive program to remove spacers are not in their design quarter of the tubes in all four debris from the system, and positions, the pressure tubes boilers, and the results were verify that the system was suffi- can sag into contact with the satisfactory. Existing defects ciently clean. To allow access calandria tubes. After a few showed little or no growth, and to the worst affected feeders, years, this contact can weaken NB Power took only one tube NB Power removed the end an affected tube. The SLAR out of service by plugging, as caps from two of the reactor inlet program was successful in a precaution. For comparison, headers. They also developed relocating spacers so that the each of the plant's four boilers a program of back flushing pressure tubes should be able has 3550 tubes. for the feeders to remove to operate for the design life of material. Following this pro- the station. NB Power replaced the boiler gram, NB Power verified correct divider plates to ensure that flows in the reactor fuel channels NB Power undertook cleaning the plates could withstand the using ultrasonic flow measurements. of both the primary and the loads caused by a loss of coolant secondary side of the boilers accident (LOCA). The new all- The replacement of the end during the long outage. welded design will also reduce caps was an extremely impor- Chemical cleaning of the sec- the potential for leakage across tant activity. Due to the piping ondary side was carried out the plates, which can occur configuration, and because of using injections of chemicals with the old bolted design. the irradiated fuel in the core, while the boilers were still hot, We have included information NB Power could not carry out immediately following reactor about the safety impact of the a hydrostatic pressure test of shutdown. This approach was change in the Safety Analysis the new end cap welds. In such very successful in removing section of this report. cases, the piping standards solids deposited in the boilers. require two independent The chemical cleaning was In October, when NB Power means of non-destructive test- followed by water lancing to were preparing the unit for ing of the welds. We reviewed remove deposits on the boiler restart, a heat transport pump this testing carefully, and tube sheets. These activities failed. The failure was caused requested additional testing to by a wooden cover, which had

11 ensure that these welds met power did not exceed a safe that they had confirmed proper the highest standards. The level for these conditions. We flow in each fuel channel New Brunswick Department of reviewed this analysis very before we approved each Labour witnessed and approved carefully, to make sure that the power increase. the non-destructive testing. reactor was properly protected. NB Power will continue to mon- Because NB Power did not It is likely that any screws left itor the reactor for evidence of know exactly the composition in the system after the back adverse effects from any debris of the wooden cover, it could flushing operation would be in or from the recovery activities. not be certain that it had dead spaces where they will They will adapt their fuel removed all the debris. remain without causing further channel maintenance and NB Power's estimates suggest- problems. However, if screws inspection program according ed that less than one kilogram do reach the fuel channels, to any findings. For example, of wood remained in the sys- they can cause mechanical any debris found during fuel tem, and between five and damage to the fuel channels inspections which could have forty-five screws. NB Power or the fuel bundles, or they damaged a pressure tube, or assessed the potential conse- could cause a reduction in flow. any fuel defects that may have quences of restarting with this NB Power had tests conducted been caused by debris, will residual debris in the system. to assess the effect of screws. trigger an inspection of the Using the results of laboratory These tests showed that any associated fuel channel. The tests, NB Power found that damage done by screws would header welds will also be sub- wood would decompose under be within acceptable limits. ject to follow-up inspection. reactor operating conditions. NB Power's analysis of flow The reactor start up therefore reduction caused by screws During the clean-up and reha- included two periods of indicated that the reactor could bilitation program to recover operation at low power to be operated at full power with from the pump failure incident, complete this decomposition. the existing safety systems' there were several events of Inspections of discharged fuel protection. Again, we reviewed note. In one instance, the confirmed that the decom- these assessments carefully. coolant level in a fuel channel position process had been fell below the approved level successful. To ensure proper After confirming that the because a contractor did not protection of the reactor during reactor was safe to operate, we follow an approved work plan this low power operation, approved start up. NB Power correctly. NB Power's assess- NB Power analysed the worst restarted the reactor in late ment showed that the fuel had flow blockage that could be December, and increased been properly cooled during caused by the wood. They power in stages. At each stage, the event. then used a special low power we carefully reviewed reactor trip to ensure that NB Power's data to ensure

12 Figure 4: OPERATING AND MAINTENANCE BUDGET' In another event, NB Power (S million vs fiscal year) staff removed seismic restraints from a header without the proper approvals. NB Power had already shown that removal of the restraints was acceptable for the conditions at that time, and therefore the failure to follow procedures did not have any safety implications. 1990 1991 1992 1993 1994 1995 1996

During operation at low power •IDoes not include taxes, insurance or computer servicesl in December, shutdown system one operated. NB Power staff had failed to follow special Figure 4 shows Point Lepreau's add a sixth shift crew to the temporary operating proce- operating and maintenance operating complement. This dures correctly. The trip had budget history. The apparent change should take place in no safety significance. increase in 1995/1996 projected late 1996, and we expect it to figures result from costs associ- result in reduced levels of STATION MANAGEMENT ated with the long outage in overtime worked. 1995. Budget levels continue NB Power continued to manage to be tight, and we note that NB Power managed to com- the station safely in 1995. NB Power deferred some lower plete work on a reduced num- Station management were priority safety-oriented ber of AECB formal requests actively involved in the safety research funding. However, we for action during the year. culture program presented to found no direct evidence that This was due to the high level staff in late 1994 and early budget levels have affected of support needed for the 1995. However, as detailed in safety in any way. We will con- station's outage activities. the Events Reported to the tinue to monitor station bud- However, NB Power did AECB section of this report, the gets with great care, because respond promptly to new safe- contribution of human error to problems due to restricted ty concerns, for example, follow safety significant events and resources tend to develop in up to the December 1994 loss failures to comply with regula- the medium to long term. A of coolant accident at Pickering tions is a problem which positive development in this Unit 2. At year end, thirty-four requires urgent attention. area is NB Power's intention to formal requests for action

13 Figure 5: AECB REQUESTED ACTIONS COMPLETED (number of actions completed vs year) Since we generally enjoy an open and constructive relationship with NB Power, we discussed this problem with NB Power management. They acted promptly to ensure that we could expect an appropriate level of access to information.

TRAINING 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 Training activities continued satisfactorily in 1995. During the year, we conducted an remain incomplete, which we However, such education evaluation of the station's find acceptable, considering needs to be a continuing maintenance of training the scope and safety signifi- process. It also should be records, and performed an cance of the work involved. supported by appropriate assessment of the station's During 1996, we will be using management leadership, radiation protection training our routine discussions on especially when dealing with program. In both cases, we these actions to check that day-to-day safety, budget and found the station's perfor- progress has returned to an production priorities. We mance to be satisfactory. acceptable level following expect NB Power to continue We also authorized two new completion of Point Lepreau's their analysis of the situation, control room operators, after they major outage. and make further proposals had successfully completed for improvement in 1996. written examinations and The number of station events testing at the station's simulator. involving human error has During 1995, there were a few been significant for several occasions when our on-site years. NB Power's approach to project officers experienced EMERGENCY this problem included a safety difficulty in obtaining informa- PREPAREDNESS culture training course deliv- tion from NB Power staff. We NB Power staff showed ade- ered to key staff. We believe believe this was due to a per- quate capability to respond to this course to be valuable, and ception by some NB Power emergencies in 1995. The shift it appears to have been well employees that they might not crews participated in eighteen received by its audience. be authorised to talk to us. drills that exercised the crews

14 ability to participate in radia- (LOCA). NB Power decided to of a major steam line failure, tion, fire, chemical, medical re-design and replace these limiting any increase in pres- and security incidents. In addi- plates. The new design is sure and thus protecting the tion, there were seven station stronger than the original structure. NB Power also con- alerts that required activation design, and should eliminate tinued their search for a leak of the emergency response the possibility of loose parts detection system, and at the crews. Response to these alerts from the plate during normal or end of the year were ready to was satisfactory. accident conditions. It should test equipment for possible also reduce the potential for installation. NB Power continue to leakage which existed with provide refresher training in the original bolted design. During the outage, NB Power contingency response. All NB Power have not yet com- inspected the welds on the emergency shift crews receive pleted all the analysis needed boiler lateral restraint lugs. requalification training every to determine just how large a The inspection revealed that eighteen months. LOCA plates can survive. We there were small surface cracks approved the installation of on most of the lugs. NB Power the new plates because they completed repairs and per- SAFETY ANALYSIS are a clear safety improvement formed stress and fracture mechanics analysis to show Progress in safety analysis over the old design. We will that the lugs were fit for con- was slow in 1995, because review the final analysis before tinued service. They will NB Power staff were heavily deciding if NB Power will need inspect the lugs again in 1997 involved in outage-related to make further changes. and 1999. activities. In particular, the The protection of the plant recovery from the incident against failures in the steam In February, NB Power report- involving the wooden cover and jeedwater systems is an ed to us that they had used an at the end of the outage result- important topic, which we incorrect value for the flow rate ed in a substantial need for have discussed in several delivered by the moderator support by NB Power analysis assessment reports in the past. pumps in some safety analysis. staff. Nevertheless, work did In 1995, we received further The error affects the analysis continue in several important information in support of of a LOCA combined with a topic areas. NB Power's safety case. An loss of class 4 power and loss of emergency coolant injection. In our report last year, we important analysis concerned NB Power have changed their discussed the possibility that the operational performance emergency operating proce- the divider plates in the boil- requirements of the pressure dures to match the lower flow, ers might be damaged under relief panels installed in the and are currently considering the conditions generated by turbine hall. The panels are whether they should upgrade a large loss of coolant accident designed to open in the case this analysis.

15 In December 1994, Pickering degasser condenser relief The audit noted that the Nuclear Generating Station valves. A similar design feature design change process did Unit 2 suffered a loss of led to bleed condenser relief not provide sufficient coverage coolant accident. The accident valve chatter at Pickering, to meet the requirements of occurred when a heat transport causing the pipe failure. the appropriate standards. system liquid relief valve NB Power have committed NB Power failed to specify in opened, because its actuator to complete the analysis, contracts with external organi- diaphragm failed. As a result, testing and completion of any zations what quality assurance piping connected to a bleed modifications which prove to requirements these external condenser relief valve also failed, be necessary by May 1997. organizations had to meet causing the LOCA. In response We believe this schedule is when they performed design to this event, we asked acceptable, given the low work. NB Power also failed to NB Power to review the safety probability of a demand for keep their design manuals characteristics of the Point these relief valves to operate. adequately up to date. Lepreau design. NB Power NB Power recognize these have made several changes problems in their design change to protect the plant from faults QUALITY ASSURANCE process, and they are actively of this type. NB Power already working on improvements. NB Power continued to had in place a program to maintain their quality assurance replace liquid relief valve program in a generally satisfac- actuator diaphragms. NB Power SAFEGUARDS tory manner. However, we have also reviewed their did find one problem area in During 1995, the station sub- emergency operating proce- NB Power's program. An audit mitted all the required reports dures to make sure that they we completed in May revealed and cooperated fully in the minimise the possibility of the a failure of the quality assur- planning and timely execution degasser condenser relief ance program in the area of of all safeguards-related work. valves operating. Although the design change control. This Point Lepreau design is differ- shortcoming occurred because Canada has signed the Treaty ent from Pickering, the degasser NB Power were continuing to on the Uon-Proliferation o\ Nuclear condenser performs some of the use a design change process Weapons. As required by this functions of the Pickering that dated from before a recent treaty, Canada has signed a bleed condenser, in particular reorganization. The old design safeguards agreement with the accepting the flow from the change process did not account international Atomic Energy Agency heat transport liquid relief for the increased NB Power (IAEA). This agreement pro- valves. We are concerned that responsibility for design vides the IAEA with the right the Point Lepreau design uses control that resulted from and the responsibility to long inlet pipes to the the change. verify that Canada is fulfilling

16 its Non-Proliferation Treaty commitment not to use its peaceful nuclear program to make nuclear weapons or nuclear explosive devices.

We include a requirement for the application of IAEA safeguards in the Point Lepreau Operating Licence. To comply with this, the station must provide access and assistance to IAEA inspectors for verification purposes, and for the installation and maintenance of IAEA equipment. The station must also provide timely reports on the movement and location of all nuclear materials within the station.

17 CONCLUSIONS

NB flower operated the Point systems. Their review of allow- Lepreau reactor safely during able operating limits, their 1995. Work completed during equipment environmental the 1995 outage should signifi- qualification process, and their cantly improve the safety and reliability analyses have all reliability of the station. made important contributions to safety. However, the pre- NB Power's level of compliance dictions of future reliability with Operating Licence condi- performance for the special tions was not satisfactory safety systems indicate that during 1995. A feature of these NB Power will need to operate failures to comply, and of other and maintain these systems significant events, was human with great care. error. NB Power had put in place safety culture training The long outage caused some to address these issues. But station programs, for example, it is clear that they must make safety analysis, to progress an urgent additional effort to very slowly in 1995. NB Power resolve the problems. will need to review such programs to ensure proper NB Power continue to make progress in 1996. good progress in ensuring proper performance of the Point Lepreau special safety

NEXT PAOE(S) left BLANK GLOSSARY

Actuator (Valye actuator) An electrical or pneumatic device which positions a valve in response to a signal from the main control room or from an automatic controller.

As Low As Reasonably The principle, applied internationally, of keeping radiation doses Achievable (ALARA) "as low as reasonably achievable", social and economic factors taken into account.

Annulus Gas System (AGS) A continuously circulating system of carbon dioxide gas in the spaces between the pressure tubes and calandria tubes. It thermally insulates the tubes from each other and permits early detection of tube leaks.

Atomic Energy Control Board A federal departmental corporation established in 1946 by the (AECB) Atomic Energy Control Act. The AECB controls the development, application and use of nuclear energy in Canada and participates for Canada in international measures of control. The AECB reports to Parliament through the Minister of Natural Resources.

Atomic Energy Control Act The federal act that established the Atomic Energy Control Board and allows it to regulate the nuclear industry in Canada.

Atomic Energy Control Regulations made pursuant to the Atomic Energy Control Act by the Regulations Atomic Energy Control Board.

Audit Verification and evaluation of a document, process or work related to station operation.

Authorized Staff Licensee staff who the Atomic Energy Control Board has licensed or approved for specific positions at the station.

Availability The percentage of time a piece of equipment is able to perform its designated function.

21 Bleed Condenser Equipment that reduces pressure and temperature of heavy water before passing it through the ion exchange system to storage.

Boiler A heat exchanger that transfers heat from the heavy water coolant to ordinary water. The ordinary water boils, producing steam to drive the turbine. The boiler tubes separate the reactor coolant from the rest of the power generating systems.

Boiler Tubes The inverted U shaped tubes that contain the heavy water coolant, separating it from the ordinary water outside the tubes which boils to produce steam. Boilers typically contain several thousand tubes.

Calandria A cylindrical stainless steel tank which holds the moderator heavy water. Pressure tubes containing the fuel and the heavy water coolant pass through the calandria.

Calandria Tubes Calandria tubes surround the pressure tubes. The space between the tubes is filled with inert gas that thermally insulates the moderator from the coolant. The annulus gas system monitors the space for leaks.

Canadian Deuterium-Uranium A Canadian designed reactor that is cooled and moderated by Reactor (CANDU) heavy water and fuelled with natural uranium. The name comes from Canada. [Deuterium, Uranium.

Class 4 Power Supply Electrical power supplied to auxiliaries and equipment that can tolerate long duration interruptions without endangering personnel or station equipment.

Containment The building surrounding the reactor. It is designed to contain the effects of any accident involving the reactor, isolating any hazard from the public. The containment has fast acting valves to automatically close ventilation openings in an emergency.

Contamination The presence of radioactive material anywhere it is not wanted, par- ticularly in places where its presence may be harmful.

Control Room Operator A Control Room Operator is responsible for operating the reactor controls. A Control Room Operator needs authorization from the Atomic Energy Control Board before acting in this position.

22 Core The heart of a reactor containing the fuel, the heavy water coolant and the heavy water moderator. It also includes various sensing and control devices.

Degasser Condenser A vessel which receives a bleed flow of primary heat transport system water to allow periodic removal of unwanted gases. It also receives the flow from the primary heat transport system liquid relief valves when they open to reduce pressure in the system.

Derived Emission Limit (DEL) A calculated amount of radioactivity that, if released from the station, would result in a radiation exposure of 5 millisievert (mSv) to a member of the public in the worst possible case. Five mSv is the maximum annual radiation exposure allowed for members of the public by the Atomic Energy Control Regulations. The calculation is done by examining the effect of the radioactivity on a theoretical person who lives full time at the station boundary, eats only food harvested local to the station, and drinks only water from the station's discharges. This theoretical individual is known as the "critical individual".

Divider Plate Plates are situated in the bottom portion of the boilers to keep the primary heat transport system heavy water inlet and outlet areas separate.

Dose Generally, the quantity of radiation energy absorbed by a body.

Emergency Coolant Injection An automatic system that injects cold water into the reactor's fuel System (ECI) channels if there is a problem with the normal heavy water coolant system. It also provides long-term cooling for the fuel by recovering water from the reactor building floor.

End Fittings Attachments to the ends oi pressure tubes that provide entry and exit connection for the heavy water coolant. They provide pressure tight connections for the fuelling machines.

End Plates Two end plates welded to the ends of the elements in a fuel bundle hold the bundle together to form its cylindrical shape. Besides maintaining separation between the elements at the bundle extremities, the end plates have holes in them to allow for coolant flow.

23 Environmental Qualification Safety-related equipment essential to maintain required safety functions must operate when called upon. Some of this equipment may have to operate in the harsh environment that could surround it following accidents. Environmental qualification means ensuring by design assessment and testing that the equipment can operate under the conditions generated by an accident, such as high temperature and humidity, or wetting. Environmental qualification also includes the maintenance practices needed to ensure that equipment protection is maintained when it has been worked on.

Feeder There are 380 fuel channels in the reactor. The feeders are pipes that supply heavy water coolant to each channel and return the hot coolant to the boilers.

Feedwater System The system that returns and processes the condensed steam and water from the turbine to the boilers.

Fuel Bundle A collection of thirty-seven pencil shaped elements containing natural or depleted uranium. End plates hold it together as a cylinder.

Fuel Channel A fuel channel consists of a pressure tube, which contains fuel, end fittings connecting it to the feeders supplying heavy water coolant, and closure plugs that can be removed by the fuelling machines for refuelling. Each pressure tube is located inside a calandria tube, which separates it from the cold moderator heavy water. Carbon dioxide gas between the pressure tube and the calandria tube provides insulation for the hot pressure tube.

Fuel Handling The system that is responsible for fuel changing and storage of new and irradiated fuel.

Fuelling Machine Equipment that fuels the reactor. Two remotely controlled fuelling machines work at opposite ends of the same fuel channel. One machine inserts new fuel and the other removes irradiated fuel while the reactor continues to operate.

Garter Spring A spacer ring that fits between a pressure tube and the calandria tube to ensure that they do not come into contact.

24 Generator Equipment that converts the mechanical power delivered by the turbine into electricity. There is one generator for each reactor.

Grid The provincial electrical distribution system.

Guaranteed Shutdown State A method for ensuring that the reactor is shut down. It includes (GSS) adding poison to the moderator or draining the moderator from the reactor.

Heat Exchanger Equipment that transfers heat between systems.

Heat Sink Any system used to dissipate the heat produced in the fuel. At all times a main heat sink must be in service, and an alternative or back-up heat sink must be available. Failure to dissipate the heat produced in the fuel by means of an adequate heat sink will increase the temperature of the fuel.

Heat Transport system See Primary Heat Transport system.

Heavy Water (D20) Heavy water is a clear, colourless liquid that looks and tastes like ordinary water. It is about 10 percent heavier than ordinary — or 'light' — water. It occurs naturally in the environment. It consists of

deuterium and oxygen (D2O), rather than the hydrogen and oxygen

of ordinary water (H2O). A deuterium atom is a hydrogen atom with an extra neutron in its nucleus. CANDU reactors use heavy water as a moderator and as a coolant.

International Atomic Energy The International Atomic Energy Agency is a United Nations agency. Agency (IAEA) It provides a system of safeguards to make sure that states do not divert nuclear materials to non-peaceful activities. It also provides an international forum for nuclear safety.

Ion Exchanger Equipment that purifies water.

Jumper A means of documenting and authorizing temporary changes to equipment.

Loss of Coolant Accident (LOCA) A failure in the reactor's heavy water coolant system that causes water to be lost faster than the normal heavy water supply can replace it. The emergency coolant injection system provides fuel cooling if this happens.

25 Main Control Room (MCR) A centrally located room that contains a control panel and console for each reactor unit, the fuel handling control panels, the common services control panel and the unit and common electrical control panels.

Millisievert (mSv) A measurement of radiation exposure. One sieverl is the same as 100 rem. One millisievert is one thousandth of a sievert (0.001 Sv).

Moderator The heavy water in the calandria that slows the neutrons released by fission to energies at which they are likely to produce additional fissions. Because the moderator surrounds the fuel channels, it also provides cooling and protection if a major accident were to cause a complete loss of cooling in the fuel channels.

Operating Policies and Principles A licensee document, which we approve, that outlines the safe (OP&P) operating limits for the station. It also defines which staff have the authority to make decisions on safety matters.

Outage The time during which a reactor is not delivering power to the grid. Outages may be forced, by equipment malfunction for example, or planned to carry out routine maintenance.

Physical Security Regulations Regulations issued pursuant to the Atomic Energy Control Act which set out the required security standards at nuclear facilities.

Poison A substance which absorbs neutrons and hence removes them from the fission chain reaction.

Predicted Future Unavailability A measure of how well a special safety system can be expected to perform in the future. A mathematical model of the system and statistics of faults affecting the system are used to derive a theoretical prediction of the expected frequency of system failure.

Pressure Boundary Pressure retaining equipment or components of a system that contain a pressurized material such as heavy water coolant or steam.

Pressure Relief Panels Panels built into the walls of a room or building that open automatically when needed to prevent a build up of pressure.

26 Pressure Tubes Also known loosely as fuel channels. Tubes that pass through the calandria and contain twelve or thirteen fuel bundles. Pressurized heavy water flows through the tubes, cooling the fuel. They form part of the pressure boundary for the primary heat transport system.

Primary Heat Transport System A closed cooling circuit that carries heat produced in the fuel bundles to the boilers. It does this by circulating heavy water at high pressure through the fuel channels and the boiler tubes.

Quality Assurance A formal program of standards, procedures and checks controlling the quality of work on the station.

Reactor Building A reinforced-concrete building which serves as a support and an enclosure for the reactor and some of its associated equipment.

Reactor Inlet Header (RIH) A vessel that distributes the heavy water returned from the boilers to the reactor through the feeders connected to each fuel channel.

Reliability Analysis A formal analysis of the reliability of a system. It uses statistics for the expected failure rates of components or subsystems, and com- bines this information to estimate the overall reliability of a system in achieving its designated function. Reliability analysis is used to study the effects of system changes, of unexpected trends in component failure, or to predict the future reliability of systems.

Safeguards An international program of monitoring and inspection carried out by staff of the International Atomic Energy Agency. Safeguards ensure that nuclear materials in the station are not diverted for non- peaceful uses.

Secondary Systems The collection of non-nuclear systems which pipe steam from the boilers to the turbine and return condensed water to the boilers.

Serious Process Failure A failure in the station's components or systems, which is sufficiently serious that one or more of the special safety systems must operate to prevent reactor damage.

27 Shutdown Systems (SDS) The reactor has two independent shutdown systems. The first shutdown system uses gravity-drop solid shutoff rods. The second injects pressurized liquid poison (gadolinium nitrate) into the moderator.

Shutdown System One (SDS1) Shutdown system one works by dropping neutron absorbing rods into the reactor core if its instruments detect a potentially unsafe condition. It is completely separate and independent from shutdown system two.

Shutdown System Two (SDS2) Shutdown system two automatically shuts down the reactor by injecting a neutron absorbing chemical into the moderator if its sensors detect a potentially unsafe condition. It is completely separate and independent from shutdown system one.

Shutoff Rods Neutron absorbing rods that can be dropped into the reactor under abnormal conditions to shut it down quickly and safely.

Sievert A measurement of radiation exposure. One millisievert is one thousandth of a sievert (0.001 Sv). One microsievert (I fjSv) is one millionth of a sievert.

Simulator The simulator represents the station's main control room in the same way that a flight simulator represents the cockpit of an aircraft. It is used for training and testing staff.

Special Safety Systems There are four independent special safety systems: shutdown system one or shutdown system two shuts down the reactor if a problem occurs, the emergency coolant injection system provides cooling and the containment system contains any radioactivity.

Treaty on the Non-Proliferation An international treaty that came into force in 1970, and to of Nuclear Weapons (NPT) which Canada is a party. Its primary aim is preventing the spread of nuclear weapons.

Trip A protective shutdown of equipment when an abnormal situation occurs. In particular, a reactor trip is a rapid shutdown of the reactor by either of the shutdown systems in response to the detection of certain abnormal and potentially dangerous conditions.

28 Tritium A radioactive isotope of hydrogen that is produced in the reactor's heavy water during operation.

Turbine Equipment comprising several bladed wheels that rotate when steam from the boilers flows through them. The kinetic energy of the steam converts into mechanical energy that turns the rotor of an electrical generator, producing electricity.

Ultrasonic Flow Meter A means of measuring flow in a pipe by using pulses of high frequency sound. It often provides an independent check of the installed flow instruments.

Unavailability The unavailability of a system or component is the fraction of time that it is not available to perform its function if it would be called upon to do so.