Nuclear Safety
NEA/CSNI/R(2015)6
March 2015
www.oecd-nea.org

Operating Experience Insights

into Pipe Failures for ElectroHydraulic Control and Instrument
Air Systems in Nuclear Power
PlantsA Topical Report from theComponent Operational Experience,
Degradation and Ageing Programme

NEAUnclassified

NEA/CSNI/R(2015)6

Organisation de Coopération et de Développement Économiques
Organisation for Economic Co-operation and Development

26-Mar-2015________________________________________________________________________________________________________English text only
NUCLEAR ENERGY AGENCYCOMMITTEE ON THE SAFETY OF NUCLEAR INSTALLATIONSNEA/CSNI/R(2015)6
Unclassified
Operating Experience Insights into Pipe Failures for Electro-Hydraulic Control
and Instrument Air Systems in Nuclear Power Plant

A Topical Report from the Component Operational Experience,
Degradation and Ageing Programme

JT03373218

English text only

Complete document available on OLIS in its original format
This document and any map included herein are without prejudice to the status of or sovereignty over any territory, to the delimitation ofinternational frontiers and boundaries and to the name of any territory, city or area.

NEA/CSNI/R(2015)6
ORGANISATION FOR ECONOMIC CO-OPERATION AND DEVELOPMENTThe OECD is a unique forum where the governments of 34 democracies work together to address the economic, socialand environmental challenges of globalisation. The OECD is also at the forefront of efforts to understand and to help
governments respond to new developments and concerns, such as corporate governance, the information economy and thechallenges of an ageing population. The Organisation provides a setting where governments can compare policy
experiences, seek answers to common problems, identify good practice and work to co-ordinate domestic and international
policies.
The OECD member countries are: Australia, Austria, Belgium, Canada, Chile, the Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Israel, Italy, Japan, Luxembourg, Mexico, the Netherlands,
New Zealand, Norway, Poland, Portugal, the Republic of Korea, the Slovak Republic, Slovenia, Spain, Sweden,
Switzerland, Turkey, the United Kingdom and the United States. The European Commission takes part in the work of theOECD.
OECD Publishing disseminates widely the results of the Organisation’s statistics gathering and research on economic,
social and environmental issues, as well as the conventions, guidelines and standards agreed by its members.

NUCLEAR ENERGY AGENCYThe OECD Nuclear Energy Agency (NEA) was established on 1 February 1958. Current NEA membership consists of
31 countries: Australia, Austria, Belgium, Canada, the Czech Republic, Denmark, Finland, France, Germany, Greece,
Hungary, Iceland, Ireland, Italy, Japan, Luxembourg, Mexico, the Netherlands, Norway, Poland, Portugal, the Republic ofKorea, the Russian Federation, the Slovak Republic, Slovenia, Spain, Sweden, Switzerland, Turkey, the United Kingdom
and the United States. The European Commission also takes part in the work of the Agency.
The mission of the NEA is:– to assist its member countries in maintaining and further developing, through international co-operation, thescientific, technological and legal bases required for a safe, environmentally friendly and economical use of
nuclear energy for peaceful purposes;– to provide authoritative assessments and to forge common understandings on key issues, as input to government
decisions on nuclear energy policy and to broader OECD policy analyses in areas such as energy and sustainable
development.
Specific areas of competence of the NEA include the safety and regulation of nuclear activities, radioactive waste
management, radiological protection, nuclear science, economic and technical analyses of the nuclear fuel cycle, nuclear law
and liability, and public information.
The NEA Data Bank provides nuclear data and computer program services for participating countries. In these andrelated tasks, the NEA works in close collaboration with the International Atomic Energy Agency in Vienna, with which it
has a Co-operation Agreement, as well as with other international organisations in the nuclear field.

This document and any map included herein are without prejudice to the status of or sovereignty over any territory, to the delimitation ofinternational frontiers and boundaries and to the name of any territory, city or area.
Corrigenda to OECD publications may be found online at: www.oecd.org/publishing/corrigenda.
© OECD 2015
You can copy, download or print OECD content for your own use, and you can include excerpts from OECD publications, databases and multimedia
products in your own documents, presentations, blogs, websites and teaching materials, provided that suitable acknowledgment of the OECD as source
and copyright owner is given. All requests for public or commercial use and translation rights should be submitted to rights@oecd.org. Requests for
permission to photocopy portions of this material for public or commercial use shall be addressed directly to the Copyright Clearance Center (CCC) at
info@copyright.com or the Centre français d'exploitation du droit de copie (CFC) contact@cfcopies.com.

2

NEA/CSNI/R(2015)6
THE COMMITTEE ON THE SAFETY OF NUCLEAR INSTALLATIONSThe NEA Committee on the Safety of Nuclear Installations (CSNI) is an international committee
made of senior scientists and engineers, with broad responsibilities for safety technology and research
programmes, as well as representatives from regulatory authorities. It was set up in 1973 to develop andco-ordinate the activities of the NEA concerning the technical aspects of the design, construction andoperation of nuclear installations insofar as they affect the safety of such installations.
The committee’s purpose is to foster international co-operation in nuclear safety amongst the NEA
member countries. The CSNI’s main tasks are to exchange technical information and to promotecollaboration between research, development, engineering and regulatory organisations; to review
operating experience and the state of knowledge on selected topics of nuclear safety technology and safetyassessment; to initiate and conduct programmes to overcome discrepancies, develop improvements andresearch consensus on technical issues; and to promote the co-ordination of work that serves to maintaincompetence in nuclear safety matters, including the establishment of joint undertakings.
The clear priority of the committee is on the safety of nuclear installations and the design andconstruction of new reactors and installations. For advanced reactor designs the committee provides aforum for improving safety related knowledge and a vehicle for joint research.
In implementing its programme, the CSNI establishes co-operative mechanisms with the NEA’s
Committee on Nuclear Regulatory Activities (CNRA) which is responsible for the programme of the
Agency concerning the regulation, licensing and inspection of nuclear installations with regard to safety. It
also co-operates with the other NEA’s Standing Committees as well as with key international organisations(e.g. the IAEA) on matters of common interest.

3

NEA/CSNI/R(2015)6

4

NEA/CSNI/R(2015)6

EXECUTIVE SUMMARY

Structural integrity of piping systems is important for plant safety and operability. In recognition ofthis, information on degradation and failure of piping components and systems is collected and evaluatedby regulatory agencies, international organisations (e.g. OECD/NEA and IAEA) and industry organisations
worldwide to provide systematic feedback for example to reactor regulation and research and development
programmes associated with non-destructive examination (NDE) technology, in-service inspection (ISI)
programmes, leak-before-break evaluations, risk-informed ISI, and probabilistic safety assessment (PSA)
applications involving passive component reliability.
Several OECD member countries have agreed to establish the OECD/NEA “Component Operational
Experience, Degradation and Ageing Programme” (CODAP) to encourage multilateral co-operation in thecollection and analysis of data relating to degradation and failure of metallic piping and non-piping
metallic passive components in commercial nuclear power plants. The scope of the data collection includes
service-induced wall thinning, part through-wall cracks, through-wall cracks with and without active
leakage, and instances of significant degradation of metallic passive components, including piping pressure
boundary integrity. The OECD/NEA Committee on the Safety of Nuclear Installations (CSNI) acts as anumbrella committee of the Project.
CODAP is the continuation of the 2002–2011 “OECD/NEA Pipe Failure Data Exchange Project”(OPDE) and the Stress Corrosion Cracking Working Group of the 2006–2010 “OECD/NEA Stress
Corrosion Cracking and Cable Ageing Project” (SCAP). OPDE was formally launched in May 2002. Uponcompletion of the third term (May 2011), the OPDE project was officially closed to be succeeded by
CODAP. SCAP was enabled by a voluntary contribution from Japan. It was formally launched in June
2006 and officially closed with an international workshop held in Tokyo in May 2010. The majority of themember organisations of the two projects were the same, often being represented by the same person. In
May 2011, thirteen countries signed the CODAP 1st Term Agreement (Canada, Chinese Taipei, Czech
Republic, Finland, France, Germany, Japan, Korea (Republic of), Slovak Republic, Spain, Sweden,
Switzerland and the United States). The 1st Term work plan includes the preparation of Topical Reports tofoster technical co-operation and to deepen the understanding of national differences in ageing
management.
The Topical Reports constitute CODAP Event Database and Knowledge Base insights reports and assuch act as portals for future database application projects and in-depth studies of selected degradation
mechanisms. Prepared in 2013 and published as NEA/CSNI/R(2014)6, a first Topical Report addressedflow accelerated corrosion (FAC) of carbon steel and low alloy steel piping. This, the second Topical
Report addresses operating experience with electro-hydraulic control (EHC) and instrument air (IA)system piping.
Degradation and failure of EHC or IA piping can adversely affect plant operability, and under certain
circumstances lead to safety challenges. Both systems consist of significant lengths of small-diameter
piping. The typical EHC system piping material is stainless steel; Type 304 or 316. Plants generally use
carbon steel, copper, stainless steel, galvanised steel or combinations of two or more material types for IA
system piping. The CODAP Topical Report on “EHC and IA Piping Systems” includes a primer on theenvironmental and operational factors affecting the structural integrity of respective system, and evaluates
service experience data as recorded in the CODAP Event Database. Also included in the report aredescriptions of the national EHC and IA ageing management programme approaches and a summary ofother information collected in the CODAP Knowledge Base. The report has been prepared by the CODAP
5NEA/CSNI/R(2015)6
Project Review Group, with support from the CODAP Operating Agent and the CODAP Knowledge Base
Co-ordinator.
There are 215 records on EHC and IA pipe failures in the CODAP Event Database. Over 90% of therecorded EHC pipe failures and almost 50% of the recorded IA pipe failure events have resulted in manualor automatic reactor trip. A pipe failure in EHC and IA piping often results in a reactor trip, therefore, thefollowing actions are recommended for avoiding the trips caused by small diameter piping:Critical parts of small diameter piping should be included into the preventive maintenanceprogram of plant.



Tolerance of shutdown systems against faults of their supporting EHC and IC systems should beanalysed and number of redundant components should be increased, if necessary.

6

NEA/CSNI/R(2015)6

TABLE OF CONTENTS

LIST OF FIGURES .........................................................................................................................................8
LIST OF ABBREVIATIONS AND ACRONYMS ........................................................................................91.

INTRODUCTION .................................................................................................................................11
1.1 Technical Scope of CODAP Topical Report No. 2 ........................................................................11
1.2 Safety Significance of EHC and IA Pipe Failures ..........................................................................11
1.3 Report Structure ..............................................................................................................................13

2.

CODAP OBJECTIVE AND SCOPE .....................................................................................................15
2.1 Project History ................................................................................................................................15
2.2 Data Collection Methodology .........................................................................................................16
2.3 CODAP Knowledge Base ...............................................................................................................17

3.

ELECTRO-HYDRAULIC AND INSTRUMENT AIR SYSTEM DESCRIPTION .............................19
3.1 Electro-Hydraulic Control System ..................................................................................................19
3.2 Instrument Air System ....................................................................................................................20
3.3 Ageing Management Considerations ..............................................................................................22

4.

ELECTRO-HYDRAULIC AND INSTRUMENT AIR PIPING
OPERATING EXPERIENCE INSIGHTS ............................................................................................23
4.1 High-Level Database Summary ......................................................................................................23
4.2 Data Reduction................................................................................................................................24
4.3 Noteworthy Events ..........................................................................................................................26

5.

SUMMARY AND CONCLUSIONS .....................................................................................................29
5.1 Summary .........................................................................................................................................29
5.2 Conclusions .....................................................................................................................................29

6.

REFERENCES .......................................................................................................................................31

APPENDIX A: GLOSSARY OF TECHNICAL TERMS ...........................................................................33

7

NEA/CSNI/R(2015)6

LIST OF FIGURES

Figure 1: Observed Impact of EHC Pipe Failure on Plant Operation .......................................................... 12
Figure 2: Observed Impact of IA Pipe Failure on Plant Operation .............................................................. 12
Figure 3: Hydraulic Portion of a Typical EHC System ................................................................................ 20
Figure 4: Example of IA System Layout ...................................................................................................... 21
Figure 5: EHC AND IA Pipe Failure Event Populations by Calendar Year ................................................ 23
Figure 6: EHC AND IA Pipe Failure Data as a Function of Service Life at the Time of Failure ................ 24
Figure 7: EHC AND IA Pipe Failure Data by Material Type ...................................................................... 25
Figure 8: EHC AND IA Pipe Failure Data by Failure Mode ....................................................................... 25
Figure 9: EHC AND IA Pipe Failure Data by Damage/Degradation Mechanism ....................................... 26

8

NEA/CSNI/R(2015)6

LIST OF ABBREVIATIONS AND ACRONYMS

AMP

Ageing Management Programme

CCI

Common Cause Initiating Event

CCW

Component Cooling Water

CODAP

Component Operational Experience, Degradation and Ageing Programme

EHC

Electro-Hydraulic Control

ESF

Engineered Safeguards Feature

GALL

Generic Ageing Lessons Learned

HF

Human Factor

IA

Instrument Air

KB

Knowledge Base

LCO

Limiting Condition for Operation

MTCS

Main Turbine Control System

NEA

Nuclear Energy Agency

NDE

Non-Destructive Examination

NRC

Nuclear Regulatory Commission

OECD

Organisation for Economic Cooperation and Development

OPDE

OECD Pipe Failure Data Exchange

PSA

Probabilistic Safety Assessment

RC

Reactor Coolant

RPS

Reactor Protection System

RV

Relief Valve

SCAP

Stress Corrosion Cracking and Cable Ageing Project

SCC

Stress Corrosion Cracking

SSC

Structure Sytem and Component

9

NEA/CSNI/R(2015)6

10

NEA/CSNI/R(2015)6

1. INTRODUCTION

This, the second CODAP Topical Report addresses operating experience insights on two types ofpiping systems that have the following features in common: 1) the two systems consist of small-diameter
piping, and 2) a pipe failure anywhere in either of the piping systems can have immediate operational
impact such as an automatic reactor trip. The electro-hydraulic control (EHC)1 and instrument air (IA)systems consist of significant lengths of small-diameter piping. The EHC system is vital for power
generation. The IA system is an important support system for various plant safety functions. This Topical
Report on EHC and IA piping reliability is an information resource developed by the CODAP Project
Review Group. The report summarises an evaluation of the EHC- and IA-specific piping service
experience data included in the CODAP Event Database and information from the CODAP Knowledge
Base.
1.1 Technical Scope of CODAP Topical Report No. 2
This CODAP Topical Report addresses EHC and IA piping systems and their susceptibilities todamage or degradation mechanisms. A failure (minor through-wall flaw to full break) of EHC piping cancause plant transients and consequential manual or automatic reactor trip. A failure of IA piping can resultin a common cause initiating (CCI) event. In addition to requiring reactor shutdown, a CCI could
simultaneously disable one or more of the mitigating systems required to control the plant status following
the shutdown. The available service experience data shows that a break in a small-diameter pipe can have asignificant impact on plant operations. The report summarises basic EHC and IA piping design informationand insights from the review of service experience data as included in the CODAP Event Database. The IAsystem is an important support system for various plant safety functions.
1.2 Safety Significance of EHC and IA Pipe Failures
The EHC system is a non-safety-related system whose failure can cause a reactor trip or actuation of asafety system. Turbine trip and reactor trip following an EHC pipe break are not uncommon occurrences.
Plant-specific probabilistic safety assessment (PSA) models do not usually include an explicit
consideration of EHC component failures, however.
The IA system is an important support system. Loss of IA due to a pipe break could lead to immediate
reactor trip. Plant-specific PSA models include detailed consideration of support system initiating events suchas loss of IA [1]. The US Nuclear Regulatory Commission (NRC) has issued Generic Letter 88-14 [2] andInformation Notices 81-38 [3], 87-28 [4] and 2008-06 [5] to address problems and effects of IA system
failures.
The observed impact of EHC and IA pipe failure on plant operation is illustrated in Figures 1 and 2,
respectively. In the CODAP Event Database the EHC pipe failure population consists of 75 records, 80%of which are US data. Over 90% of the recorded EHC pipe failures have resulted in either automatic ofmanual reactor trip. The IA pipe failure event population consists of 140 records, 70% of which are US
data. Less than 10% of the recorded IA pipe failures have had no direct impact on plant operation.

1. The EHC system is also referred to as Main Turbine Control System (MTCS).

11

NEA/CSNI/R(2015)6
Figure 1: Observed Impact of EHC Pipe Failure on Plant Operation
EHC Piping Service Experience - 75 Failure Records

19%

6%

ESF/RPS Actuation
LCO Entry / None
Manual Shutdown or Power Reduction

75%

Figure 2: Observed Impact of IA Pipe Failure on Plant Operation
IA Piping Service Experience - 140 Failure Records

1%
16%

33%
Dual Unit Shutdown
ESF/RPS Actuation
Expanded Outage Work ScopeLCO Entry / None
Manual Shutdown or Power Reduction

42%

8%

12

NEA/CSNI/R(2015)6
1.3 Report StructureThis report is structured as follows: Section 2 describes the CODAP Event Database and Knowledge
Base. Section 3 includes EHC and IA system descriptions. Section 4 summarises the CODAP EHC and IA
pipe failure event content. Section 5 includes a summary and conclusions. A list of references is included
in Section 6. Appendix A is a glossary of terms.

13

NEA/CSNI/R(2015)6

14

NEA/CSNI/R(2015)6

2. CODAP OBJECTIVE AND SCOPE

CODAP is the continuation of the 2002-2011 “OECD/NEA Pipe Failure Data Exchange Project”(OPDE) and the Stress Corrosion Cracking Working Group of the 2006-2010 “OECD/NEA SCC and
Cable Ageing Project” (SCAP). OPDE was formally launched in May 2002. Upon completion of the 3 rdTerm in May 2011 the OPDE project was officially closed. SCAP was enabled by a voluntary contribution
from Japan. It was formally launched in June 2006 and officially closed with an international workshop
held in Tokyo in May 2010. Most of the members of the two projects were the same, often being
represented by the same person. The scope of the CODAP is based on a combination of the concepts fromthe two projects. Thus it encompasses service experience data on metallic piping and non-piping passive
components as well as a Knowledge base as in SCAP but with the full range of failure mechanisms as in
OPDE.
2.1 Project History
The preparation for the OECD Pipe Failure Data Exchange (OPDE) Project was initiated in 1994 by
the Swedish Nuclear Power Inspectorate (SKI)2. In 1994 SKI launched a 5-year R&D project to explore
the viability of creating an international pipe failure database and a related analytical basis for deriving
reliability parameters for use in PSA. During this period SKI hosted meetings to present results of the
R&D and to discuss the principles of database development and maintenance.3 In September 2000 and,again in April 2001, the OECD/NEA organised preparatory meetings to explore the feasibility and interestin forming an international cooperative effort to systematically collect, evaluate and exchange service
experience data.
Since May 2002, the OECD/NEA has formally operated the project under the coordination of theCommittee on the Safety of Nuclear Installations (CSNI). The starting point for the Project was an in-kind
contribution by SKI in the form of an international pipe failure database in Microsoft ® Access. This
database included pipe failure data for the period 1970 to 1998, and it contained approximately 2,300
records. During the first term of OPDE the emphasis was on validating the content of the SKI in-kind
contribution, improving and streamlining the database structure and data input format, and populating thedatabase with new failure data for the period 1999 to the present, as well as with pre-1998 records. The
data validation benefitted from multi-disciplinary considerations, including material science, structural
integrity and PSA. The first term of the Project covered the years 2002-2005, the second term covered theperiod 2005-2008 [6], and the final term covered the period 2008-2011 [7].
In 2006 the SCC and Cable Ageing Project (SCAP) was established under the auspices of the
OECD/NEA to assess, due to their implication on nuclear safety and their relevance for plant ageing
2. Swedish Radiation Safety Authority (SSM) as of July 1, 2008.
3. In September 1996 SKI organised the “Initial Meeting of the International Cooperative Group on Piping
Performance” with participants from thirteen countries. Again, in September 1997 SKI organised the “Seminar on
Piping Reliability” (SKI Report 97:32); this time with participants from eleven countries. SKI Report 97:32 isavailable on the Internet at www.ssm.se.

15

NEA/CSNI/R(2015)6
management, two subjects: stress corrosion cracking (SCC) and degradation of cable insulation. The
project ran successfully from June 2006 to June 2010 [8].
Following the completion of the SCAP project, SCC Working Group participants were interested insome form of continuation and discussions were initiated to explore possible alternatives. It was recognisedthat there are many aspects very similar to those existing in OPDE and the concept of a new project wasenvisaged to combine the two projects into the “Component Operational Experience, Degradation &Ageing Programme” (CODAP). The objective of CODAP is to collect information on passive metallic
component degradation and failures of the primary system, reactor pressure vessel internals, main process
and standby safety systems, and support systems (i.e., ASME Code Class 1, 2 and 3, or equivalent). It also
covers non safety-related (non-Code) components with significant operational impact. It is intended that
CODAP will also include information on age-related degradation of buried tanks and plastic piping.
In May 2011 the Project Review Group (PRG) approved the transition of OPDE to a new, expanded“OECD-NEA Component Operational Experience, Degradation and Ageing Program (CODAP).” A first
CODAP National Coordinators Meeting was held at NEA Headquarters in November 2011. The CODAP
PRG Membership corresponds to that of the OPDE (eleven member countries), with two additional
member countries (Slovak Republic and Chinese Taipei). The CODAP project builds on the success of
OPDE and a related OECD-NEA data project, the SCAP-SCC Working Group.
During the three OPDE Project Terms (2002-2011), the event database was maintained anddistributed as a Microsoft® Access database. This database was distributed on a CD to the National
Coordinators twice per annum. Towards the end of the first Project Term, a web-based database format
was developed to facilitate data exchange. The web-based OPDE resided on a secure server at the NEA
Headquarters. With the 2011 transition from OPDE to CODAP, a new and enhanced web-based databaseformat was implemented. As of mid-2012, the entire CODAP event database resides on a secure server at
NEA Headquarters. Provisions exist for online database management (e.g. reviews, edits, QA, queries,
validation) as well as downloading selected event records or the entire database to a local computer orcomputer network. The event database structure also includes a provision for uploading of event-specificinformation such as photographs, isometric drawings and root cause analysis reports. In addition to theevent database, CODAP includes a web-based Knowledge Base (KB) that contains relevant national andinternational reference material on passive metallic component damage and degradation mechanisms.
Included in the KB are codes and standards, R&D results, regulatory frameworks, and country-specificageing management programmes. As is the case for the event database, the KB also resides on a secure
server at NEA Headquarters.
2.2 Data Collection Methodology
The CODAP Project exchanges data on passive component degradation and failure, including serviceinduced wall thinning, non-through wall crack, leaking through-wall crack, pinhole leak, leak, rupture andseverance (pipe break caused by external impact). For non-through wall cracks the CODAP scope
encompasses degradation exceeding design code allowable for wall thickness or crack depth as well assuch degradation that could have generic implications regarding the reliability of in-service inspection (ISI)
techniques. The following failure modes are considered:

Non-through wall defects (e.g. cracks, wall thinning) interpreted as structurally significant and/or
exceeding design code allowable;

Loss of fracture toughness of cast austenitic stainless steel piping;16

NEA/CSNI/R(2015)6
Through-wall defects without active leakage (leakage may be detected following a plant
operational mode change involving depressurisation and cool-down, or as part of preparations fornon-destructive examination, NDE);

Small leaks (e.g. pinhole leak, drop leakage) resulting in piping repair or replacement;

Leaks (e.g. leak rates within Technical Specification limits);



Large leaks (e.g. flow rates in excess of Technical Specification limits);

Major structural failure (pressure boundary “breach” or “rupture”).

In other words, the CODAP Event Database collects data on the full range of degraded conditions,from “precursors” to major structural failures. The structural integrity of a pressure boundary is determinedby multiple and interrelated reliability attributes and influence factors. Depending on the conjoint
requirements for damage and degradation, certain combinations of material, operating environment,loading conditions together with applicable design codes and standard, certain passive components aresubstantially more resistant to damage and degradation than others. The types of pipe failure included in
the CODAP Event Database are:

Event-based failures that are attributed to damage mechanisms and local pipe stresses. Examples
include high-cycle vibration fatigue due to failed pipe support, and hydraulic transient (e.g. steam
or water hammer) acting on a weld flaw (e.g. slag inclusion).



Failures caused by environmental degradation such as stress corrosion cracking due to combined
effects of material properties, operating environment (e.g. corrosion potential, irradiation) andloading conditions.

The CODAP Event Database is a web based, relational database consisting of ca. 100 uniquely
defined data fields. It is a mix of free-format fields for detailed narrative information and fields defined bydrop-down menus with key words (or data filters) or related tables. The “related tables” include
information on material, location of damage or degradation, type of damage or degradation, system name,safety class, etc. The event database structure, database field definitions and data input requirements aredefined in a Coding Guideline, which is central to the project, including database maintenance, data
validation and quality control. The database design has benefitted from a multidisciplinary approach
involving chemistry, metallurgy, structural integrity and PSA.
2.3 CODAP Knowledge Base
The CODAP Knowledge Base has been established to reflect basic international technical informationof relevance to the project in a systematic manner. The KB is password protected and resides on a secure
server at NEA Headquarters in Paris, France. The KB is intended to provide a source of information ontechnical issues related to all the failure mechanisms covered by the Event Database. The type of
information collected includes regulations/ codes and standards, inspection/ monitoring/ qualification,
preventive maintenance/ mitigation, repair/ replacement, safety assessment, and R&D. The information isboth of a general nature and also more specific for the different degradation mechanisms. The KB is
intended to provide a source of systematically organised information for members, as well as input to the
topical reports the project is intending to prepare. There is a search function to facilitate retrieval of
information.
The KB is a web-based area of the CODAP project domain. It is organised as a hierarchical system offolders for general information, degradation specific information and a country folder for each project
member. The country folders have two purposes: to upload files for inclusion in the common KB and to17

NEA/CSNI/R(2015)6
provide a means of organising documents of national interest and relevance. In the latter casedocumentation can be in the language of the country, with a title in English. In the common folders all
documents are in English.

18

NEA/CSNI/R(2015)6

3. ELECTRO-HYDRAULIC CONTROLAND INSTRUMENT AIR SYSTEM DESCRIPTION

Failure of the piping of electro-hydraulic control (EHC) and instrument air (IA) system has resulted incommon cause initiating events, plant load reduction and plant trips. This section contains short
descriptions of the main EHC and IA system design features, including piping material selections.
3.1 Electro-Hydraulic Control System
Overviews of EHC system design, maintenance and operating experience insights are documented in
References [9][10][11]. The electro-hydraulic control (EHC) system supplies high-pressure fire resistant
hydraulic fluid to the main turbine instrumentation and control system to serve as the primary hydraulicmedium for operating the main turbine control valves, stop valves, and intercept valves . Figure 3 shows thehydraulic portion of a typical EHC system. Hence, the main function of the EHC system is to regulate
turbine speed, maintain set load, control rate of load increases, and provide protection for the turbine andgenerator. For BWR plants, an additional function is to control reactor pressure. EHC system pressure ismaintained by positive displacement pumps and, depending on the particular system design and mode ofoperation, the system operates at a pressure range of 7 to 15 MPa. The major equipment of the EHC system
is supplied with the main turbine-generator package and it consists of the following five major parts:
1.

Electrical/electronic controls portion

2.

Hydraulic fluid system – the subject of this Topical Report3.

Emergency trip system

4.

Valve controllers

5.

Trip and monitoring system

The EHC system equipment may be required to function during any one of a number of normal andemergency plant operating modes. The EHC system is generally not considered a safety-related system but
it is vital for power generation. A failure of the EHC system can result in turbine/reactor trip or the reactor
unit being prevented from starting up. A main turbine over-speed condition could cause turbine blade
and/or rotor failure and generate missile hazards that could damage nearby safety related systems. The
turbine manufacturers use triaryl phosphate esters as the circulating fluid. These phosphate esters provide
improved fire resistance over hydrocarbon-based fluids, and thereby minimise the risk for a fire due to ahigh pressure EHC line leaking onto a hot surface or other ignition source.
The EHC fluid system consists of numerous runs of small-diameter hydraulic piping and tubing toconvey the EHC hydraulic fluid to the valve actuators where it is needed. The tubing, fitting, and piping
material used in EHC systems is typically type 304 stainless steel for the tubing and piping and type 316
stainless steel for the fittings. These materials were selected because of the hydraulic fluid pressure andtheir suitability for use in high-purity fluid systems.

19

NEA/CSNI/R(2015)6

Figure 3: Hydraulic Portion of a Typical EHC System

3.2 Instrument Air System
Overviews of EHC system design, maintenance and operating experience insights are documented in
References [11][14][15][16][17]. The instrument air (IA) system supplies dry, filtered compressed air forvarious pneumatic controls, air-operated valve controllers and positioners, and pneumatic instrumentation
in a nuclear power plant. It is also the source of compressed air delivered to and stored in safety-related
accumulators via safety-related check valves. In turn, the charged accumulators serve as standby sources ofpneumatic motive power to operate critical air-operated valves and devices required for safe shutdown of
the nuclear station. Accordingly, the specifications for the instrument air system require the supply of dry,filtered, clean, and oil-free air within a specific operating pressure range and below a given maximum
design pressure dew point. It is essential to maintain the quality of the compressed air delivered by the IAsystem to critical plant pneumatic devices. Any moisture, oil, desiccant, particulates, or other contaminantsin the system, will degrade the performance of pneumatic devices or cause complete malfunction, which
may seriously compromise overall safety of the nuclear plant.
An IA system consists of three subsystems: the compressed air supply train, a filter/dryer train, and a
distribution section - which is the focus of this Topical Report. Figure 4 shows a typical IA system layout.
The air compressor draws in air from the atmosphere via an intake filter/silencer which removes dirt andother particles and reduces the noise at the compressor intake. The compressor itself is usually powered byan electric motor. Two types of compressors are used: 1) reciprocating, and 2) screw compressor. The
compressor discharges to an after-cooler, a water-cooled heat exchanger, which cools the compressed air.
Cooling water for the after-cooler and any intercoolers for multi-stage air compressors is usually provided
by the plant component cooling water (CCW) system. A moisture separator connected directly to thedischarge of the after-cooler removes condensation and oil from the air stream before the air enters the air
receivers. The IA systems with reciprocating compressors tend to be more failure prone than those withscrew compressors.
20

NEA/CSNI/R(2015)6
Figure 4: Example of IA System Layout

The air leaving the moisture separator passes into the air receiver usually via a check valve and an
isolation valve. The air receiver acts as a storage tank for the compressed air and dampens out thepulsations and pressure surges generated by the compressor. A pressure relief valve or a safety valve isnormally placed at the compressor's discharge to protect the discharge piping and the after-cooler/moistureseparator from overpressurisation. A relief valve is also placed at the air receiver to prevent the tank fromexceeding its pressure limit. The typical system operating pressure is approximately 0.8 MPa.
In the past, the IA systems were not designed to satisfy the single failure criterion. Therefore, older
systems are susceptible to single failure modes such as a pipe break that can cause a loss of IA pressure ina portion of the system, or in the entire system. This is discussed further in the section on IA piping service
experience. Safety related components are typically designed to fail in a position least hazardous to theplant, or, if they are required to be operable after IA pressure has decreased, they are provided withaccumulators that maintain an air reservoir for subsequent operation. However, operating experience hasrevealed a number of failure modes for safety related components that were not considered during design.
For example, valves with failure modes opposite to that assumed in safety analyses have been installed, air
operated valves have not operated as expected due to reversal of the supply and exhaust lines, and valves
have not repositioned properly on loss of IA.
The IA distribution section of a compressed air system consists of the headers, piping, air connections
stations, and hoses that deliver the compressed air to the pneumatic devices. Two basic distribution
configurations are found: 1) radial distribution, and 2) ring header distribution. Very often elements of bothmethods are combined. The radial distribution approach uses a single, large air header to transport thecompressed air into the plant, branching off along the way to radial headers in individual buildings(e.g. Containment, Reactor Building, Turbine Building).
IA system piping materials vary a great deal between nuclear power plants. Plants generally use
carbon steel, hard copper, stainless steel, galvanised steel or a combination of two or more of these. Copper
piping is in common use at many facilities, but such systems are susceptible to joint failures. In order tostrengthen the joints and lessen the possibility of failures, some plants require that copper piping joints bebrased instead of soldered; others use stainless steel piping. Plants with “clean dry instrument air” have21

NEA/CSNI/R(2015)6
opted to replace their copper lines with carbon steel piping with welded joints. The IA pipe sizes range
from small- (DN20 to DN25) to medium-diameter (e.g. DN75 to DN100 for header pipes).
3.3 Ageing Management Considerations
In Germany the Nuclear Safety Standards Commission (KTA) is responsible for issuing standards forthe operation of commercial nuclear power plants. In-service inspection of EHC and IA systems arecovered in KTA 3211.4, “Pressure and Activity Retaining Components of Systems Outside the Primary
Circuity. Part 4: In-service Inspections and Operational Monitoring.” Ageing management considerations
relative to the two systems are covered in KTA 1403 “Ageing Management in Nuclear Power Plants.”4
In the US the EHC system is not included in the scope of systems reviewed for License Renewal [12].
The EHC system is included in respective plant’s Maintenance Rule Program [13], however. The IAsystem is included in the scope of systems reviewed for License Renewal [12]. Section XI.M24(Compressed Air Monitoring) of NUREG-1801 (the “GALL Report) addresses IA-specific ageing
management programme (AMP) considerations.

4. The German standards are available on the Internet at www.kta-gs.de.r22

NEA/CSNI/R(2015)6

4. EHC AND IA PIPING OPERATING EXPERIENCE INSIGHTSThe EHC and IA piping failure event populations in the CODAP Event Database are summarised inthis chapter. The two event populations include non-through wall defects and through-wall defects. The
first group represents visual inspection or NDE results where the measured wall thickness is below theminimum wall thickness allowed by the acceptance criteria as formulated in Owner-defined reliability andintegrity management programmes.
4.1 High-Level Database Summary
The EHC and IA pipe failure event populations in the CODAP Event Database consist of 75 records
and 140 records, respectively (Figures 5 and 6). The recorded events mainly involve pipe failures that havecaused immediate plant operational impact such as manual or automatic plant shutdown.
Figure 5: EHC & IA Pipe Failure Event Populations by Calendar Year
12

10

6

4

2

0

1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013

No. Failure Records

8

EHC

IA

23

NEA/CSNI/R(2015)6
Figure 6: EHC & IA Pipe Failure Data as a Function of Service Life at the Time of Failure
20

18

16

No. Failure Records

14

12

10

8

6

4

2

0
1

2

3

4

5

6

7

8

9

10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 34 35 36 38 39 40 41

Service Life [Years] at Time of Failure

EHC

IA

4.2 Data Reduction
In this section the EHC and IA pipe failure data is reviewed in more detail by querying the CODAP
Event Database on records by failure mode, material type and damage/degradation mechanisms. Figure 7
is a summary of the database content by system and material type. As previously noted, the EHC piping
material is stainless steel. There is one exception, however according to the CODAP Event Database, one
BWR plant uses a nickel-base alloy for the EHC piping.
Figure 8 is a summary of the database content by failure mode. Of the total event population (EHC
plus IA pipe failures), only 5% of the records are for non-through-wall flaws. This can be explained asfollows (Figure 9). A predominant damage mechanism for both systems is high-cycle vibration fatigue.
The time for a flaw to propagate through-wall from an initiation site to the pipe outside diameter usually isquite short. This means that non-destructive examination (NDE) would not be effective in preventing
failure of the small-diameter piping, and as a result the ratio of recorded non-through-wall to through-wallflaws would be expected to be low.
The database includes two (2) failure records involving stress corrosion cracking (SCC) of IA piping.
In both cases, the SCC is attributed to attack by ammonia on copper alloy C2300, which is composed of
14-16% zinc, 0.05% iron and lead, and the remainder copper. This material is known to be susceptible toSCC. In one instance, SCC caused a major axial split in a DN50 instrument air supply header. The affected
plant was in cold shutdown at the time of the pipe failure. A failure at-power would have resulted in an
automatic reactor trip.

24

NEA/CSNI/R(2015)6
Figure 7: EHC & IA Pipe Failure Data by Material Type

Stainless SteelIA

CopperCarbon SteelPart Through-Wall Flaw
Through-Wall Flaw

Al-Bronze

EHC

Stainless Steel

Cr-Ni Alloy

0

10

20

30

40

50

60

70

80

No. Failure Records

Figure 8: EHC & IA Pipe Failure Data by Failure Mode

34

Rupture13

40

Significant Leak
12

58

Through-Wall Leak48

9

Non-Through-Wall Flaws
2

0

10

20

30

40

No. Failure Records

IA

25

EHC

50

60

70

NEA/CSNI/R(2015)6
Figure 9: EHC & IA Pipe Failure Data by Damage/Degradation Mechanism
Overstressed / Severe Overloading
Low-Cycle Fatigue Pressure Loads
IGSCC

IA

High-Cycle Vibration Fatigue
HF:CONST/INST
Fretting
ErosionPart Through-Wall Flaw
Corrosion-External / Pitting

Through-Wall Flaw
Major Structural Failure

Overstressed / Severe Overloading
Low-Cycle Fatigue Pressure Loads

EHC

High-Cycle Vibration Fatigue
HF:CONST/INST
Fretting

Corrosion-Fatigue
0

10

20

30

40

50

60

70

80

90

100

No. Failure Records

In Figure 7, the term “Overstressed/Severe Overloading” implies that a small-diameter pipe has failed
through external, unexpected loading conditions. A review of the root cause analysis reports point tosituations where plant maintenance personnel inadvertently stepped on piping or used the piping as ahandle bar. The term “HF:CONST/INST” involves inadequate pipe fit-up or connection of pipe to a valve
body.
4.3 Noteworthy Events
Examples of noteworthy EHC and IA pipe failure events include the following:

Plant A (BWR). In September 1991, an EHC Fluid Tank low level alarm activated after all four
Main Turbine Control Valves had been cycled for required monthly Reactor Protection
Surveillances. An EHC hydraulic oil leak was discovered at the #2 Main Turbine Control Valve.
When it became apparent that the leak could not be controlled, a Unit shutdown was initiated.
One leak was found at the ½-inch stainless steel tubing which supplies hydraulic fluid at 11 MPa
to the #2 Control Valve. The cause of the leak has been attributed to broken and damaged piping
supports that allowed the EHC lines to vibrate excessively.

Plant B (PWR). A reactor trip in June 1990 was attributed to an EHC line rupture. The pipe failed
at a support clamp which had been clamped without a rubber or flexible grommet or insulating
material, hard against the pipe, and acted as a stress inducing site.

Plant C (two-unit PWR): In November 1988, a rapid decrease in IA header pressure caused
feedwater regulating valves to close at both units, leading to manual trip of both reactors. The

26

NEA/CSNI/R(2015)6
cause of the IA system failure was attributed to failure of a 4-inch copper line solder joint in an
IA header pipe shared by both units.


Plant D (PHWR). In December 1994, a small primary pressure boundary leakage occurred due toa reactor coolant (RC) relief valve (RV) failure and resulting complications. The sequence of
events leading up to the pressure boundary breach began with the RV opening due to a failed IA
copper supply line. As a consequence of this initial IA line failure and the opening of the RC-RV,
relief valves on the primary heat transport system bleed condenser lifted. After the initial
opening, one of these RVs shut and began to chatter. The valve chattering caused stress in the RV
inlet pipe and eventually led to the development and propagation of cracks in the lower elbow of
the inlet pipe which caused the primary pressure boundary breach.

27

NEA/CSNI/R(2015)628

NEA/CSNI/R(2015)6

5. SUMMARY AND CONCLUSIONS

5.1 Summary
Pipe failure events involving small-diameter EHC and IA piping was selected as the subject of thesecond CODAP Topical Report. Existing service experience data as recorded in the CODAP Event
Database demonstrates that a through-wall defect in these piping systems can have a significant impact onplant operations. The EHC system is vital for power operation. The IA system is an important support
system for various plant safety functions. The 2014 version of the CODAP Event Database includes 215
records on EHC and IA pipe failures. Over 90% of the recorded EHC pipe failures have resulted in manualor automatic reactor trip. Of the recorded IA pipe failure events, almost 50% resulted in manual or
automatic reactor trip.
Recent (2000-2013) operating experience demonstrates that EHC and IA pipe failures continue tocause interruptions of routine plant operation. Steps are taken to improve the routing and support of thesmall-diameter piping systems to mitigate the susceptibility to vibration fatigue damage.
The CODAP Knowledge Base includes documentation on the national regulatory approaches toageing management of small-diameter piping such as the EHC and IA piping.
5.2 Conclusions
The Topical Report on EHC and IA piping operating experience insights address the different damage
and degradation mechanisms that are known to affect the small-diameter piping. The current operating
experience points to examples where a relatively benign through-wall defect in small-diameter piping has
caused significant plant disturbances. As recorded in the CODAP Event Database, a high-level summary isprovided of the international operating experience with EHC and IA piping.
A pipe failure in EHC and IA piping often results in a reactor trip, therefore, the following actions arerecommended for avoiding the trips caused by small diameter piping:Critical parts of small diameter piping should be included into the preventive maintenanceprogram of plant

Tolerance of shutdown systems against faults of their supporting EHC and IC systems should beanalysed and number of redundant components should be increased, if necessary

29

NEA/CSNI/R(2015)630

NEA/CSNI/R(2015)6

6. REFERENCES[1]

Julius, J. and Schroeder, J., Support System Initiating Events: Identification and Quantification
Guidelines, 1016741, Electric Power Research Institute, Palo Alto, Ca. and US Nuclear Regulatory
Commission, Washington, DC, 2008.

[2]

U.S. Nuclear Regulatory Commission, Instrument Air Supply System Problems Affecting
Safety-Related Equipment, Generic Letter No. 88-14, Washington, DC, 1988.

[3]

U.S. Nuclear Regulatory Commission, Potentially Significant Equipment Failures Resulting
from Contamination of Air-Operated Systems, Information Notice 81-38, Washington, DC, 1981.

[4]

U.S. Nuclear Regulatory Commission, Air Systems Problems at U.S. Light Water Reactors,
Information Notice 87-28, 1987.

[5]

U.S. Nuclear Regulatory Commission, Instrument Air System Failure Resulting in Manual Reactor
Trip, Information Notice 2008-06, 2008.

[6]

Nuclear Energy Agency, OECD/NEA Piping Failure Data Exchange Project, 2002-2008 Status
Report, NEA/CSNI/R(2009)19, Issy-les-Moulineaux, France, 2009.

[7]

Nuclear Energy Agency, OECD/NEA Piping Failure Data Exchange Project (OECD/NEA OPDE),
Final Report, NEA/CSNI/R(2012)16, Issy-les-Moulineaux, France, 2012.

[8]

Nuclear Energy Agency, Technical Basis for Commendable Practices on Ageing Management –SCC and Cable Ageing Project (SCAP), NEA/CSNI/R(2010)5, 2010.

[9]

Clay, P., Life Cycle Management Planning Sourcebooks – Volume 9: Main Turbine ElectroHydraulic Controls, TR-1009072, Electric Power Research Institute, Palo Alto, CA, December
2003.

[10]

Harrison, G., Mustian, M.D. and Staniewski, G.J.W., Steam Turbine Hydraulic Control System
Maintenance Guide, TR-107069, Electric Power Research Institute, Palo Alto, CA, December
1996.

[11]

Grunsky, A., EHC Tubing/Fittings and Air Piping Application and Maintenance Guide, TR1000935, Electric Power Research Institute, Palo Alto, October 2000.

[12]

U.S. Nuclear Regulatory Commission, Generic Aging Lessons Learned (GALL) Report, NUREG1801, Revision 2, Washington, DC, 2010.

[13]

Code of Federal Regulations, Title 10, §50.65, Requirements for Monitoring the Effectiveness ofMaintenance at Nuclear Power Plants, July 19, 1999.

[14]

DeMoss, G.M. et al, A Risk-Based Review of Instrument Air Systems at Nuclear Power Plants,
Science Applications International Corporation, June 1988.

[15]

Ornstein, H.L., Operating Experience Feedback Report – Air System Problems, NUREG-1275,
Vol. 2, U.S. Nuclear Regulatory Commission, Washington, DC, December 1987.

31

NEA/CSNI/R(2015)6[16]

Varma, V., Preckwinkle, S. and Webber, K., Instrument Air System: A Guide for Power Plant
Maintenance Personnel, NP-7079, Electric Power Research Institute, Palo Alto, CA, December
1990.

[17]

Villaran, M., Fullwood, R. and Subudhi, M., Aging Assessment of Instrument Air Systems in
Nuclear Power Plants, NUREG/CR-5419, U.S. Nuclear Regulatory Commission, Washington, DC,
January 1990.

32

NEA/CSNI/R(2015)6

APPENDIX AGLOSSARY OF TECHNICAL TERMS

Common Cause Initiating Event: A unique class of initiating events which, in addition to requiring reactor
shutdown, simultaneously disable one or more of the mitigating systems required to control the plant status
following the initiator.
Desiccant: A hygroscopic substance which induces or sustains a state of dryness (desiccation) in its
vicinity. Commonly encountered pre-packaged desiccants are solids that absorb water. Desiccants for
specialised purposes may be in forms other than solid, and may work through other principles, such as
chemical bonding of water molecules. Industrially, desiccants are widely used to control the level of waterin gas streams.
Maintenance Rule: In 1991 the USNRC published 10 CFR 50.65 (commonly referred to as the“maintenance rule”) which requires that each licensee monitors the performance or condition of SSCs
against licensee-established goals in a manner sufficient to provide reasonable assurance that such SSCs
are capable of fulfilling their intended functions. Such goals are to be established commensurate withsafety and, where practical, take into account industrywide operating experience. When the performance or
condition of an SSC does not meet established goals, appropriate corrective action must be taken. For
additional details see Regulatory Guide 1.160, Revision 3 (May 2013).5
Triaryl Phosphate Ester: A fire resistant self-extinguishing electro-hydraulic control fluid especiallydeveloped for steam turbine application. According to the US National Fire Protection Association (NFPA)
Recommended Practice 850 (“Fire Protection for Electric Generating Plants”), a fire resistant fluid “…isdifficult to ignite and does not sustain combustion due to its low heat of combustion.”
Valve Chatter: Chattering is the rapid opening and closing of a pressure-relief valve. The resulting
vibration may cause misalignment, valve seat damage, and, if prolonged, mechanical failure of valve
internals and associated piping. Some causes of chattering include: excessive inlet pressure drop; excessive
backpressure; an oversized relief valve; and a relief valve that must handle widely varying flow rates.

5. Available on the Internet at www.nrc.gov.

33