Incident at the Penly NPP in France

  • Thread starter etudiant
  • Start date
In summary: The second and third seals are only intended for emergency situations and can only withstand high pressure for a short time. To prevent uncontrolled release of contaminated water, the pressure is reduced. The staff opens emergency valves, which divert the cooling water into reservoirs inside the reactor building. The situation at Penly worsened because the valves closed due to another malfunction. This threatened to rupture the primary circuit, which contains 100 cubic meters of contaminated water per pump.In summary, according to Handelsblatt, a serious incident occurred at the Penly Nuclear Power Plant on April 5-6. A primary cooling pump leaked oil and caught fire, resulting in an automatic shutdown. Attempts to reduce pressure by venting coolant were hindered by failed
  • #1
etudiant
Gold Member
1,239
128
According to Handelsblatt, the German FT equivalent, EDF has admitted that a serious incident took place April 5-6 at the Penly NPP, near Dieppe.
A primary cooling pump leaked close to 100 gallons of oil, which pooled inside the containment and then caught fire around 7pm on April 5th. This resulted in an automatic reactor shutdown.
A primary cooling circuit pump(one of 4, according to EDF) then blew a seal. As the backup seals are able to withstand the 155 atmosphere pressure only briefly, it became imperative to reduce the pressure by venting some of the coolant into reservoirs inside the containment. The emergency valves for this venting failed, threatening a rupture in the primary cooling circuit.
The situation eased after some substantial leaks, starting at 600 gal/hr, falling to only 15 gal/hr before ending by 4 am April 6.

My question to the nuclear pros on this site:
Is this kind of primary pump failure not something that should be a fairly routine event, given the presence of several such pumps and can emergency valves be tested periodically just to be sure they function properly when they are needed.
 
Engineering news on Phys.org
  • #2
Do you have a link to a report?

That sequence of events just doesn't sound quite right to me.
There were three sets of seals in my plant and i think that French pump is similar.

If i recall , that 600 gal/hr number is not much out of line for failure of single seal. It's only 10 gpm which is easily handled. And it is captured and piped into a tank that's there for that purpose. But you don't want to run very long with that failed seal. The leakage can get worse if seals overheat.

And yes, all emergency equipment is tested periodically for the reason you mentioned. It would be interesting to know which valves failed.
 
  • #3
Some news on Penly

ASN - English
http://www.french-nuclear-safety.fr/index.php/English-version/News-releases/2012/Press-release-3-Information-on-Penly-NPP-event

http://www.french-nuclear-safety.fr/index.php/English-version/News-releases/2012/Press-release-4-Information-on-Penly-NPP-event

http://www.french-nuclear-safety.fr/index.php/English-version/News-releases/2012/Press-release-5-Information-on-Penly-NPP-event

IAEA - http://www-news.iaea.org/ErfView.aspx?mId=6c33ee66-ef46-49ec-b13e-68bbb3af6d8c

Oil fire, reactor pump leak shut down Penly Nuclear Power Plant
http://www.pennenergy.com/index/pow...wer/nuclear/2012/april/oil-fire__reactor.html

http://www.world-nuclear-news.org/RS_Fires_trigger_shutdown_at_Penly_2_0504121.html

From Handelsblatt - Französische Reaktorpanne schwerer als bisher bekannt (Reactor failure worse than previously known)
http://www.handelsblatt.com/politik...anne-schwerer-als-bisher-bekannt/6536034.html
 
  • #4
The general problem with main circulation pump seals is that they are not able to withstand the primary coolant temperature and thus require constant coolant injection in between the seals to keep them cool. Loss of this injection may lead to quite large leak through the seals, if the pump does not have a specific "stand still seal system" which only few plants in the world have.There's at least one NUREG on the generic issue, but I was unable to locate it right away - I will get back once I find it. Meanwhile - a couple of references can be found at the bottom of that page: http://www.nrc.gov/reading-rm/doc-collections/acrs/letters/1999/4661857.html
 
  • #5
Thanks Astro.
Sounds like a bad day over there. An oil leak around noon... The motor being above the pump, an oil leak runs down onto the hot pipes (~540 degF) and smolders or burns.
Then a seal failure at 7:30PM...



The general problem with main circulation pump seals is that they are not able to withstand the primary coolant temperature and thus require constant coolant injection in between the seals to keep them cool. Loss of this injection may lead to quite large leak through the seals, if the pump does not have a specific "stand still seal system" which only few plants in the world have.

Indeed loss of cooling wrecks them.

Our seal failures were almost always preceded by a period of unusual sensitivity of seal leakoff flow, normally something like 0.1gpm, to the temperature of that "constant coolant injection" .

So to OP - i wouldn't call seal failures "routine" . But they are not un-anticipated or particularly challenging when caught early.
They are however a real nuisance because it requires cold shutdown to repair meaning a week or two offline.
The seals themselves are rather marvels of mechanical engineering.
Their 'Achilles Heel' is dual - loss of cooling or microscopic particles in the coolant (dirt).
 
  • #6
There's one EPRI report containing a systematic study of MCP shaft seal failures at the US plants: http://www.osti.gov/etde/servlets/purl/6675354-E73r8O/6675354.pdf

The one report I referred to earlier ( and still haven't been able to found) went one step further in assessing ways to do away with the problem - including replacement of pumps with ones that have a mechanical (metal on metal) stand still seal, or even going the same route that BWR designers took in the late 70's by introducing wet motors in the main circulation pumps, thus completely eliminating the penetrations that require soft seals.
 
  • #7
jim hardy said:
And yes, all emergency equipment is tested periodically for the reason you mentioned. It would be interesting to know which valves failed.

I am more surprised by this part:

"The emergency valves for this venting failed, threatening a rupture in the primary cooling circuit."

Valves? Plural? *All of them failed at once*?
Obviously, thy weren't properly tested for quite some time. How come?
 
  • #9
nikkkom said:
"The emergency valves for this venting failed, threatening a rupture in the primary cooling circuit."

Valves? Plural? *All of them failed at once*?

Yeah, apparently all at once. But they only wrote that there's a failure which prevented the valves of being opened. Not of one or more valves itself failing. Perhaps the failure wasn't at valve level, but at control level?
Similar to Fukushima Unit 1, where the IC-valves didn't fail - but the programming which controlled them.

By Handelsblatt:

Der Zwischenfall eskalierte, als gegen 19h eine Dichtung der Pumpe platzte. [...] Die zweite und dritte Dichtung sind aber nur für den Notfall vorgesehen und können dem hohen Druck nur kurzfristig standhalten. Um ein unkontrolliertes Austreten des verseuchten Wassers zu verhindern, wird der Druck heruntergefahren. Dafür öffnet das Personal Notventile, die das Kühlwasser in Reservoirs I am Reaktorgebäude ableiten. Die Lage in Penly verschärfte sich, weil die Ventile sich aufgrund einer weiteren Störung schlossen. Damit drohte ein Platzen des Primärkreislaufes, der je Pumpe 100 Kubikmeter verstrahlten Wassers enthält.

The incident escalated when a pump seal ruptured at 7 pm. The second and third seal [out of three] are only provided for cases of emergency and can only withstand the pressure for a short amount of time. To prevent uncontrolled release of contaminated water, the pressure is lowered. To do this, the staff's opening emergency valves which will rerout the water into reservoirs inside the reactor building. The situation in Penly exacerbated because another failure closed the valves. This led to the threat of a rupture of the primary coolant circuit which holds 100 cubic meters of contaminated water per pump.

The translation probably sounds very stiff to native speakers. That's deliberate, I wanted to make it as accurate as possible.
 
  • #10
Astronuc said:
http://www.osti.gov/bridge/servlets/purl/10191677-Lzyqbh/native/10191677.pdf

Thanks - that's the report I talked about but couldn't find.
 
  • #11
I may be wrong on this, but I have a vague recollection there has previously been an incident at another French plant, where they had a problem running the plant to a cold shutdown state because the letdown line had failed close, and it was therefore difficult to get borated water in. I seem to have a recollection that the letdown function might not be fully safety classified according to the French regulations.

But as I said, I may be very wrong on this, so please correct me if you have more accurate information.
 
  • #12
There are other ways to lower PWR pressure, such as cold spray in pressurizer. Why those weren't used or did not work?
 
  • #13
introducing wet motors in the main circulation pumps, thus completely eliminating the penetrations that require soft seals.

To my understanding that's how Navy plants are built. Early PWR's (eg Yankee Rowe) had same design, and probably the same pumps. It was called "canned pumps" But those six-thousand horsepower monsters on my plant would have been tough to can.

"The emergency valves for this venting failed, threatening a rupture in the primary cooling circuit."

Valves? Plural? *All of them failed at once*?
Obviously, thy weren't properly tested for quite some time. How come?

I am having a hard time thinking just what 'emergency' valves one would use in that scenario.
Pressurizer sprays are the usual method of depressurization. It is conceivable that with seal failure they shut down the affected pump. With one main coolant pump shut down and both spray valves open you may not get spray flow , but that situation has to be recognized and the spray valve that comes from the idle loop closed from the control room. That's because there are scoops in two of the pump discharge lines so that velocity head pushes water up to top of pressurizer where the sprays are. On my plant the two lines shared a common showerhead inside the pressurizer. With an idle pump you can have 10% or so reverse flow, so the loop with reverse flow steals spray flow from the other one. It can steal all of it.

But spray valves are not 'emergency' equipment since they are useless without main coolant pumps runing..
Pressurizer Relief valves are last ditch depressurization method but since TMI there is reluctance to use them. We had to report every actuation of them to NRC.

That account of events, emergency equipment failing, is just not making sense to me . I suspect [STRIKE]exaggeration[/STRIKE] there is some detail lacking and therefore await further reports.

old jim
 
Last edited:
  • #14
The report as written up in the Handelsblatt was clearly not the product of someone familiar with the specifics of a nuclear plant, so it may be incomplete, even misleading, simply because the writer did not understand what was important.
That said, the most recent update on Penly in Le Figaro, the leading French economic paper, is not very illuminating, with the CLIN, the semigovernmental broad based group of committees for local nuclear information, also complaining about being kept in the dark as to the accident specifics. The Handelsblatt sources may therefore be partially unofficial, which would further increase the chance of some technical misunderstanding.
 
  • #15
The report as written up in the Handelsblatt was clearly not the product of someone familiar with the specifics of a nuclear plant, so it may be incomplete, even misleading, simply because the writer did not understand what was important.

In fairness to the reporter and the newspaper, utility press releases are not usually written by technical people. The writer may have had not-very-clear material to work from.

I need to be more careful in my wording too. see change above.

old jim
 
  • #16
http://www.asn.fr/index.php/content/download/33597/248217/file/INSSN-CAE-2012-0776.pdf ASN's April 11 letter to EDF after the ASN's onsite inspection on April 6.

From 11:52, a series of alarms showed up in the control room about "oil box low level" of motor pump 2 RCP 051 PO, about "bearing max temperature" of pump shaft, and for "outbreaks of fire". The overheating of the pump bearing triggered the automatic shutdown of the electric motor and, as a result of a low flow rate in primary loop No. 1 following the pump shutdown, the automatic reactor shutdown at 12:12.

During their visit to the pump room in the reactor building, the inspectors noticed the presence of oil on various equipments (heat insulating material, piping, etc.), floor and metallic frame. This supports the hypothesis that the cause of the events is a major oil loss from the motor pump lubrication system of primary pump No. 1.

At 18:00, as part of the implementation of procedure I RCP 2 related to malfunction of primary pumps, the operator team opened valve 2 RCV 111 VP in order to reduce stress on the pump's No. 2 seal, and to restore a normal "controled leak" level on seal No. 1.

This action unexpectedly led to its automatic closure and to the closure of valve 2 RCP 395 VN for cooling of the pumps's thermal barrier. So, seal No. 2 took on the role of barrier against primary circuit coolant leaks and achieved avoidance of a leak outside of the pump.

Primary coolant was collected at that seal via the RPE (purges and nuclear vents) system, which is designed for that purpose. The collected water was then treated in the plant's facilities, in the TEP (treatment of primary effluents) and REA (boron and water make-up) circuits.

At present, the motor is not serviceable, seal No. 1 is in degraded condition, and the thermal barrier must be investigated.

(...)

I request that you provide :

(...)

e) the results of the analysis of the events that led, by implementing procedure I RCP 2, to the successive closure of the two valves 2 RCV 111 VP and 2 RCP 395 VN, and as a consequence, to the loss of thermal barrier. You shall communicate the lessons you have learned from this and the resulting countermeasures.
 
Last edited:
  • #17
It is with trepidation i make this speculation. But it's not completely baseless.

It seems the valves that closed were likely the cooling water to thermal barrier.
What thermal barrier is - it's a cooling coil just below the pump seal that lowers the temperature of any reactor water flowing up the pump shaft toward seals so seals won't get overheated should injection flow be lost. (Whew - that's a sentence long enough for Melville - please parse it it does make sense)

You see, in normal operation injection pushes cool filtered water down the shaft away from seal. That keeps reactor water well below seal and away from it.
Thermal barrier is there in case injection is lost and flow reverses allowing hot reactor water to flow up the shaft toward seal instead. Thermal barrier cools it on its way.

Inordinately high flow out of thermal barrier cooling water line is assumed to be a leak of reactor water into thermal barrier's coling coil and its valves shut automatically to isolate that leak. You don't want reactor water getting into your cooling water system.

But - an inordinately high heat load on thermal barrier, as by inordinately high flow of hot water up the shaft and through thermal barrier toward seal(as in seal failure), can boil the water in the cooling coils.
That boiling makes the lines sputter and instruments interpret that sputtering as high flow so they obediently shut the valves thinking it's a leak not just a thermal overload..

I don't know the valve numbers at that plant so i can't say for sure that's what happened
but do not be surprised if this turns out to be the scenario.

Perhaps somebody has a drawing of the pump seals and thermal barrier ? They're not so complex as it sounds.


my best guess at this time.
If overly speculative - somebody please delete or report or pm me and i'll remove.

old jim
 
  • #18
The pump seal system for the new EPR reactor is presented in this document, on pages 16-17. The reactors at Penly are of the 1300 MWe type, i.e. third-latest of the French reactor generations, and have a somewhat different pump design. The basic principles are however more orless similar, with the exception of the SSSS which does not exist in the older designs.
 
  • #19
What is the next countermeasure one takes if all the seals go wrong ? Are there no valves that can be closed to close the loop and isolate the pump ?
 
  • #20
The leakage return lines between each seal can be closed, but of course there is always the top seal, above which the water will escape. The purpose of the stand still seal system in the new plants is to make the top seal mechanically tight and able to withstand harsh conditions (metal on metal). In those plants where all seals are soft (most PWRs currently in operation), the primary pressure must be lowered in order to make the leak stop if all seals have failed.

EDIT: Regarding the possibility to isolate the pumps from the loops, the VVER-440 plants (with 6 loops and a small power) have isolation valves in the loops, but they are mainly meant to enable maintenance operations, and are not qualified to function as safety devices. As far as I know, any other modern PWR does not have such isolation valves in the primary loops.
 
Last edited:
  • #21
rmattila said:
the primary pressure must be lowered in order to make the leak stop if all seals have failed.

It was reported that they did just that (1). And that, as a consequence, the leakage rate declined from 2300 litres per hour to 66 litres per hour (2), and the quantity of leaked water that was collected in a dedicated circuit was around 1 m³ (3). But I don't remember reading how they did that. Any idea ? Did they do anything special beyond cooling the reactor the usual way for a shutdown ?

Business daily Les Échos (3) calls the loss of more than one seal a "black scenario", where "the pump breaks up and thousands of litres of radioactive water are released into the building".

Then they say:

"This black scenario did not happen, but everything did not go as expected. This is problem number 4 [they listed the oil leak as problem No. 1, the oil fire as problem No. 2, the seal failure as problem No. 3]: two valves that were supposed to channel the primary coolant leak were unexpectedly closed. "If it had lasted longer, there would probably have been difficulties", Simon Huffeteau [the head of the ASN bureau in Caen] recognises".

Perhaps the above can help figure out which valves are those valves that went wrong.

Would the "black scenario" require radioactive releases into the environment ? Or is it "black" only because of the money it would cost ?

(1) 6 April 04:00 AM "Its [EDF's] teams managed to control it [the leak] by reducing pressure and temperature" http://www.lemonde.fr/planete/artic...asse-a-la-centrale-de-penly_1681749_3244.html
(2) Interview with ASN's Director General http://www.lemonde.fr/planete/artic...asse-a-la-centrale-de-penly_1681749_3244.html
(3) http://www.lesechos.fr/entreprises-secteurs/energie-environnement/actu/0202020010365-nucleaire-edf-sous-pression-apres-l-incident-inedit-de-penly-314665.php
 
  • #22
here's another introductory document. Around paged 19-25 is description of how the seals work.
http://www.google.com/url?sa=t&rct=...efwk0Fp2ifLkoT8BA&sig2=0sNDnHtJxHWGAmEJSLNH2A

If the number' 1 seal fails,'it passes water at greater flow rates. The increased flow is sensed by leakoff flow detectors which indicate and alarm in the control room. The operator should then shut the number 1 seal leakoff flow control valve. This action directs all number 1 seal leakage through the number 2 seal, placing it into service as the primary seal. The plant should then be shut down using normal procedures to replace the failed seal. Normal leakage through the number 2 seal (number 1 seal not failed) is three gph.
two valves that were supposed to channel the primary coolant leak were unexpectedly closed.
fig 4.3.2 on page 26 shows the arrangement of seals , injection flow and thermal barrier at bottom.
i don't know which valves might have been closed or if they're even shown on that training drawing.
 

1. What exactly happened during the incident at the Penly NPP in France?

On January 5, 2012, an explosion occurred in the turbine hall of the Penly nuclear power plant in France. The explosion was caused by a malfunction in the steam turbine, resulting in a fire. The reactor itself was not affected and there was no release of radiation.

2. Were there any casualties or injuries as a result of the incident?

No, there were no injuries or fatalities reported as a result of the incident. The plant was quickly evacuated and all employees were accounted for.

3. What safety precautions were in place at the Penly NPP to prevent such incidents?

The Penly NPP, like all nuclear power plants in France, is subject to strict safety regulations and regular inspections by the Nuclear Safety Authority (ASN). The plant also has multiple safety systems in place, such as redundant cooling systems and emergency shutdown procedures, to prevent accidents from occurring.

4. Has the incident at the Penly NPP had any environmental impact?

No, there was no release of radiation or other hazardous materials during the incident. The ASN conducted an environmental assessment and found that there was no impact on the environment surrounding the plant.

5. What measures have been taken to prevent similar incidents from happening in the future?

Following the incident, the ASN conducted a thorough investigation and identified several safety improvements that needed to be implemented at the Penly NPP. These improvements have since been made, including upgrades to the plant's cooling systems and procedures for responding to emergencies.

Back
Top