On 20 April 2005, a leak from a pipe was discovered at the Thermal Oxide Reprocessing Plant (Thorp) at the Sellafield site in the UK. The pipe supplied highly radioactive liquor to an accountancy tank in a part of the plant known as the feed clarification cell. The incident was categorised by British Nuclear Group Sellafield (BNGSL) as Level 3 on the International Nuclear Event Scale.
In total, about 83m3 of nitric acid dissolver liquor, containing approximately 22t of nuclear fuel (mostly uranium incorporating around 160kg of plutonium), had leaked onto the floor of the cell. That leak had begun prior to 28 August 2004.
Video evidence indicated that the leak came from a pipe that had completely severed at a point just above where it enters an accountancy tank. The most likely cause was fatigue failure from the swaying motion of the suspended tank, which occurred during agitation of the contents. The motion occurred because of design inconsistencies in the later stages of the design process and during construction, together with a modification to operations around 1997, which inadequately considered the impact on pipework.
The Nuclear Installations Inspectorate (NII) of the UK’s Health and Safety Executive (HSE) investigated the leak, resulting in the recent publication of Report of the investigation into the leak of dissolver product liquor at the Thermal Oxide Reprocessing Plant, Sellafield, notified to HSE on 20 April 2005. According to the NII, the leak remained undetected for a period of some eight months for two reasons: a failure to ensure that leak detection equipment was in effective working order; and a failure to follow key operating instructions. These failures were not identified due to inadequate monitoring arrangements and management oversight.
The NII made 55 recommendations and issued two formal improvement notices. The investigation identified that BNGSL had been in breach of nuclear site licence conditions; three of these breaches were serious, had continued over a prolonged period and directly contributed to the incident. The company fell “well below” the standard required by the licence conditions and, as a result, was charged with three offences alleging breaches of site licence conditions, which BNGSL pleaded guilty to. On 16 October 2006 the company was fined a total of £500,000 ($990,000) with costs of £67,959 ($134,400) awarded to HSE. Thorp was shut down following the incident and required regulatory consent before being allowed to begin reprocessing again. Although consent was granted on 9 January 2007, Thorp is not expected to restart operations until the middle of the year due to ongoing checks on a downstream evaporator, which processes highly active liquors prior to storage in the high-level waste tanks.
Thorp
Alarms
In terms of leak detection, the HSE found that the pneumercator in the buffer sump had not been working properly. The pneumercator is a device that measures liquor level and which warns operators of liquor loss. It had been in low alarm or producing an erratic output for some considerable time and did not therefore respond to the level rise during the period of the leak. Another problem at Thorp was operational response to alarms. Supervisors did not see low-level alarms as being as important as high alarms, so they were not always responded to. This might partly be due to the fact that the safety case did not recognise a low sump alarm as being significant, but it did for a high alarm. In the low alarm case, the safety case appears inadequate and this is thought to have had an influence on the level of attention of supervisors.
The HSE investigation team found there were significant operational problems with the management of a vast number of alarms in Thorp, resulting in important alarms being missed. Thorp Head End Chemical (HEC) plant had a culture that seemed to allow instruments to operate in alarm mode rather than questioning the alarm and rectifying the relevant fault. The large number of alarms, and it being left to the supervisor to make a judgement on what was a priority, may have exacerbated this alarm-tolerant culture. This also meant that the alarm response instructions were not being followed, leading to the conclusion that the culture also condoned non-compliance with instructions and fault tolerance.
There was no formal log of standing alarms and thus no audit trail for rectification follow-up. The fact that the plant had deliberately been operating for some time in alarm mode, and was therefore non-compliant with instructions, raised concerns about control and supervision as well as the effectiveness of the safety management system and safety culture.
It appeared to the HSE that Thorp had been given internal dispensation from the alarm response instruction format code of practice. It was unclear why this dispensation occurred and whether the lack of compliance with this code of practice contributed to the inadequacy of the alarm response instructions for alarms associated with this event.
Samples
Thorp operational arrangements require a sample to be taken from the sump in the event of a high alarm from the pneumercator in addition to the regular three-monthly checks. Only dilute nitric acid primer should be present in the sump, so the presence of uranium would be a strong indicator of a leak from primary containment. The HSE concluded that if the sump sampling (in particular, the buffer sump) had been properly carried out, and the results assessed, this would have identified the problem much earlier. It appeared that the requirement for sump sampling at three-monthly intervals had been changed some years ago from a monthly interval. The reason for this change of frequency could not be established.
The investigation found that positive uranium sample results were not acted upon and that there were apparent difficulties in getting samples from the buffer sump, resulting in several nil volume samples in the auto-sample records. The investigation team was satisfied that the analytical services’ auto-sampling team was requesting samples to be taken in accordance with the schedule and reporting the nil volume samples to the HEC team. In most cases, HEC staff did not follow this through. There is some evidence that the nil volume sample problem had been going on since 1995.
There was also evidence that the routine buffer sump samples had frequently not been successfully taken. There were no results between mid November 2003 and August 2004, and between August 2004 and April 2005. The 28 August 2004 result was the only one in the 2004 calendar year. The feed clarification sump samples were mainly reliable, with only one nil volume (August 2004) in the last three years.
The HSE team saw evidence of samples from both sumps that had not been acted upon: buffer sump result of 50g/l uranium on 28 August 2004; feed clarification sump result of 9g/l uranium on 26 November 2004; and feed clarification sump result of 60g/l uranium on 24 February 2005. The HSE noted that if an appropriate response had been made to these results, the leak could have been spotted at that time. These sample results indicate that the leak started prior to 28 August 2004.
In addition to confusion between teams over responsibility for aspects of plant monitoring and trending of plant safety data, a number of staff that could have monitored plant data trends were unable to do so as they had not been trained to use ‘Process Explorer’, a program to interpret data from the distributed control system. The HSE gained the impression that those who could use this program had taught themselves how to do so.
Other factors
In 1998 the plant suffered a similar but less serious event in the head end dissolver cell when a small quantity of dilute dissolver product leaked through eroded pipework into the sump. That leak should have resulted in recommended arrangements being put in place to improve leak detection and monitoring at the head end. HSE felt that the recommendations made after that leak were directly relevant to what was discovered in the investigation of the 2004/5 leak. But BNGSL had no formal record of how or to what extent HEC staff implemented all of the 1998 recommendations. Regulators found that few of the older recommendations had been effectively implemented.
Other indications of a leak which went unheeded included changes in volume flow, banging noises, and increasing temperature in the buffer sump.
In terms of tank swaying which induced stresses, two changes to operation of the agitation system that were subsequently introduced, led to the accountancy tank contents being agitated for prolonged periods, and continuously when less than full. These would have taken the tanks through what is now known to be the most vulnerable point for vibration and resulted in large horizontal movement. The HSE found no BNGSL procedures for auditing how these decisions were made.
Lessons to be learned
The HSE highlighted “ill-conceived or inadequately executed” changes to design, procedures or organisation, and said it is essential that the potential impact of even minor changes is assessed properly by people who understand their safety significance.
The HSE also pointed to the plant culture of ignoring alarms, non-compliance with operating instructions, ineffective safety equipment, and the absence of a questioning attitude – which led to the possibility of a leak not being considered credible until the evidence was incontrovertible. “The importance of a questioning attitude towards potential safety issues and the need to encourage challenge are aspects of culture that need to be instilled and demonstrated by the most senior managers. They need to lead by example in this respect.” There is also a need for staff to understand why safety procedures are necessary, to reduce the likelihood of shortcuts.
The HSE said long-standing failings in key safety arrangements raised questions about the effectiveness of BNGSL’s arrangements for monitoring, audit and review and continued: “Senior managers cannot rely on the absence of incidents as an indicator that everything is as it should be or as they would wish. This reinforces the importance of a questioning attitude and a challenge culture.” The HSE also felt that the Thorp experience demonstrated a failure to learn from previous events.
Mike Weightman, HSE chief inspector of nuclear installations, said: “Although we stress that there is no evidence of any harm to workers or the public, the leak being contained within a stainless steel lined, heavily shielded cell, there had been a significant prolonged reduction in attention to the high standards demanded for the unique nature of nuclear operations, something we are not prepared to tolerate.”
Weightman noted that Thorp was Sellafield’s flagship built to high standards, and should be operated, maintained and managed to high standards, which means “continued vigilance and close attention to maintaining each and every one of the multiple physical and administrative barriers put in place to protect people and society from highly radioactive material.” Allowing any of these barriers to degrade is not acceptable, he said.
Lessons he saw for regulators included: pushing further in directing available resources to regulating on the basis of hazard potential as well as risk, and maintaining an appropriate balance between day-to-day regulation and strategic issues.
BNGSL responded to the recommendations and carried out work in various areas, including operations and training, asset care, and emergency arrangements. When the company’s response was assessed by the NII, it found that BNGSL responded positively to the incident, conducting a board of inquiry, examining root causes, identifying a way forward for restart and implementing the necessary plant modifications, a new mode of operations and revisions to the safety case. Regulators said BNGSL has, and will continue to, address leadership and cultural issues.
For restart of Thorp, NII concluded that there were no outstanding issues to prevent granting consent to the start of moving fuel from the feed pond to the shear cave. Nevertheless some follow up work was identified for BNGSL to address at various key stages post-restart.
The fractured pipe at Thorp Fractured pipe Thorp Thorp Author Info:
“Report of the investigation into the leak of dissolver product liquor at the Thermal Oxide Reprocessing Plant, Sellafield, notified to HSE on 20 April 2005” is published on the HSE website
Related ArticlesBNG pleads guilty over Thorp leak Thorp leak fines for BNG Thorp restart approved HSE publishes Thorp report Thorp is back Initial Thorp investigation shows opportunities were missed New plant cultureExternal weblinksNuclear Engineering International is not responsible for the content of external internet sites.HSE website
