The “Race” to Resolve the Boiling Water Reactor Safety Limit Problem

, former director, Nuclear Safety Project

General Electric (GE) informed the Nuclear Regulatory Commission (NRC) in March 2005 that its computer analyses of a depressurization event for boiling water reactors (BWRs) non-conservatively assumed the transient would be terminated by the automatic trips of the main turbine and reactor on high water level in the reactor vessel. GE’s updated computer studies revealed that one of four BWR safety limits could be violated before another automatic response terminated the event.

Over the ensuring decade-plus, owners of 28 of the 34 BWRs operating in the US applied for and received the NRC’s permission to fix the problem. But it’s not clear why the NRC allowed this known safety problem, which could allow nuclear fuel to become damaged, to linger for so long or why the other six BWRs have yet to resolve the problem. UCS has asked the NRC’s Inspector General to look into why and how the NRC tolerated this safety problem affecting so many reactors for so long. Read more >

Bookmark and Share

Nuclear Plant Containment Failure: Isolation Devices

, former director, Nuclear Safety Project

Disaster by Design/Safety by Intent #32

Disaster by Design

Containment structures at nuclear power plants have multiple purposes. Containments protect vital safety equipment from damage caused from external events like high winds and the debris they can fling. And containments protect nearby communities against radiation released from reactor cores damaged during accidents. Read more >

Bookmark and Share

Fission Stories #56: Locked out at Limerick – Twice

, former director, Nuclear Safety Project

On September 11, 1985, operators at the Limerick Generating Station outside Philadelphia tested the plant’s remote shutdown capability. They simulated abandoning the control room and shutting down the reactor using equipment and controls outside the control room.

During the test, the reactor core isolation cooling (RCIC) system injection valve failed to open. The RCIC system uses a small turbine supplied by steam produced by the reactor core’s decay heat connected to a pump to deliver makeup water to the reactor vessel to cool the nuclear fuel. An operator went to the RCIC room to manually open the valve, but found the door to the room locked because it was designated as a high radiation area.(That’s because the steam used by the main turbine, RCIC turbine, and feedwater system turbines in boiling water reactors such as those at Limerick contains radioactivity. Even if the fuel rods are entirely intact, water flowing through the reactor core region forms a radioactive isotope of nitrogen, N-16. This isotope has a half-life of slightly over 7 seconds, but poses a radiation hazard during the minute or so it takes for the number of N-16 atoms in the steam flow to drop to a level that isn’t considered a serious health hazard.)

The operator contacted the Health Physics department. An HP technician was dispatched with the key to the RCIC room. When the HP tech met the operator outside the RCIC room 15 minutes later, they learned he brought the wrong key. The right key was finally located and the operator entered the RCIC room.

The operator found the injection valve’s hand-wheel chained and locked closed. This step prevented the valve from being mistakenly opened during reactor operation. He did not have the key to the padlock. Neither did the operators at the remote shutdown panel. The keys had been left in the control room which they just abandoned.

Bolt cutters were used to cut the chain. The operator finally opened the RCIC system injection valve many minutes after the need arose.

The remote shutdown test was performed during plant startup when decay heat levels were relatively low. The control rod drive system was able to provide sufficient makeup flow to the reactor vessel until the RCIC system could be made available. If this had been an actual emergency, the NRC concluded it was questionable whether the operators would have been able to provide adequate core cooling given the lengthy time required to establish RCIC system flow to the reactor vessel.

Our Takeaway

Like a glass partially filled with water, this event is either good or bad depending on one’s perspective. It’s bad in that two locked barriers impeded the proper response to plant conditions. That imposition had no serious consequences in this case, but could have under different circumstances.

It’s good in illustrating the often under-estimated value of periodic tests. The RCIC room door was locked for the necessary reason of protecting workers from radiation exposures. The RCIC valve hand-wheel was locked for the necessary reason of preventing its inadvertent opening during plant operation. This test revealed unintended consequences from the needed locks and provided the opportunity to make adjustments so as to better serve all needs in the future.

Tests and inspections at nuclear plants are actually not performed to verify that equipment is fully functional today. They are performed to provide assurance that equipment will be fully functional in the future if needed. In that light, tests such as this one at Limerick successfully achieve that desired outcome.


Bookmark and Share

Fission Stories #12: Clogged Drains

, former director, Nuclear Safety Project

The Limerick Unit 1 boiling water reactor (BWR) outside Philadelphia was operating at full power on September 11, 1995, when alarms in the control room indicated that one of the safety/relief valves had opened. Four large pipes, roughly 2-feet in diameter, carry steam produced in the reactor vessel to the main turbine. Each steam pipe is equipped with safety/relief valves that automatically open to protect the reactor vessel and the piping connected to it from damage if excessive pressure develops.

At Limerick that day, the steam flowing out the open safety/relief valve passed through a pipe to the suppression pool as shown in Figure 1. The suppression pool contains nearly 2 million gallons of water and serves as a heat sink for energy released inside containment. As shown in Figure 2, the steam passing through the safety/relief valve was carried below the surface of the suppression pool water and entered the water through small holes in the discharge line piping. The suppression pool water cooled the steam and condensed it back into water.

The operators tried closing the safety/relief valve, but it remained stuck open. The operators manually shut down the reactor in accordance with the emergency procedures. The steam flowing through the open safety/relief valve heated up the suppression pool water. So, the operators started a pump of the residual heat removal (RHR) system in cooling mode. The RHR pump took water from the suppression pool, sent it through heat exchangers where it was cooled down, and returned it to the suppression pool.

In addition to being a heat sink, the suppression pool is also a source of water for the emergency core cooling system (ECCS) pumps, which includes the pumps of the RHR system. Figure 3 shows the pipe that carries water for the ECCS system leading from the pool, although it pictures a BWR Mark I containment design and Limerick has a BWR Mark II containment. Instead of the suppression pool residing in a large metal torus as shown in Figure 3, Limerick’s suppression pool is in a concrete pit as shown in Figure 1. In both cases, the safety/relief valve discharge line exhausts near the bottom of the suppression pool to lessen the chances that uncondensed steam reaches the surface of the water.  Also in both cases, the ECCS pumps draw water from the suppression pool through a strainer intended to filter out debris that might otherwise clog the ECCS pumps.

About 30 minutes after starting an RHR pump, the motor currents and flow rates for RHR pump ‘A’ fluctuated. The operators manually stopped the pump and started RHR pump ‘B.’ They checked things out, found nothing unexplained, and restarted RHR pump ‘A’ without further incident.

When the plant was cooled down, a diver entered the suppression pool water to investigate the cause of the anomalous behavior of RHR pump ‘A.’ The diver discovered that the suction strainers for RHR pump ‘A’ were almost entirely covered with a thin mat of fibers and sludge. The suction strainers for RHR pump ‘B’ were also covered, but not to the same extent. Workers removed nearly 1,400 pounds of debris from the suppression pool.

Suction strainers are pieces of metal with small holes. They prevent particles larger than 3/8 inches in diameter from entering the piping going to the RHR pumps. The RHR pumps have impellers (fan-like components) that push water through piping. Small particles pass right through the impellers, but larger particles – those screened out by the suction strainers – can clog the impellers.

Debris that had settled on the bottom of the suppression pool was stirred up when the safety/relief valve opened. Before that debris resettled on the bottom, the operators started RHR pump ‘A’ to cool the suppression pool water. Debris was pulled onto and clogged the strainer for RHR pump A’ and then for RHR pump ‘B’ when it was started. Because all the emergency pumps that cool the reactor during an accident also get their water from the suppression pool, the debris had the potential for disabling all the emergency pumps.

This was not the first time that debris in the suppression pool water caused problems. On January 16, 1993, and again on April 14, 1993, the Perry nuclear plant outside Cleveland, Ohio experienced it. The first time, debris clogged the suction strainers for the RHR pumps. In the second event, glass fibers from a temporary filter for the drywell ventilation system that had accidentally fallen into the pool clogged the suction strainers for the RHR pumps.

The NRC reacted to the third incident by requiring BWR owners to perform better housekeeping for their suppression pools. The large pool had become a tempting receptacle for items accidentally or intentionally discarded. Workers removed hard hats, plastic bags and foam rubber cleanliness covers from the suppression pool at the Nine Mile Point nuclear plant in New York. Workers at the LaSalle nuclear plant in Illinois recovered a rubber mat, a nylon bag, a flashlight, a large sheet of gasket material, anti-contamination coveralls, 15 feet of black duct tape, 50 feet of tygon tubing, and a substantial amount of sludge from the suppression pool. Divers also found a sediment layer up to 2 inches thick in the LaSalle suppression pool. At the River Bend nuclear plant in Louisiana, workers removed an antenna, length of rope, a hammer, a wrench, a step-off pad, and plastic bags from the suppression pool.

The NRC also required owners to modify their suction strainer configurations. Even when all extraneous debris was properly kept out, the NRC was concerned that the steam and water jetting from a broken pipe inside the drywell could knock insulation off piping and scour coatings off equipment. Water could then carry this debris into the suppression pool water where it could clog the suction strainers and disable all of the emergency pumps.

The NRC required a two-prong solution to the problem: (1) minimize the amount of debris in suppression pool water during an accident, and (2) minimize the vulnerability of ECCS pump suction strainers to clogging by debris. This was a good approach.

However, the NRC did not require any reactor to immediately shut down to correct this serious safety problem. Instead, they allowed the plants to continue operating until their next scheduled refueling outage. Some reactors operated for over a year. The NRC felt that the chances of an accident occurring during this grace period were small, very small. If an accident had happened, the consequences could have been big, very big.

Our Takeaway

The NRC knew about this safety problem – clogged pipes restricting the circulation of cooling water – long before the incidents at Perry and Limerick. NRC Chairman Joseph Hendrie wrote to President Jimmy Carter on Valentines Day 1979:

Following a postulated loss-of-coolant accident, i.e., a break in the reactor coolant system piping, the water flowing through the break would be collected in the emergency sump at the low point in the containment. This water would be recirculated through the reactor system by the emergency core cooling pumps to maintain core cooling. This water would also be circulated through the containment spray system to remove heat and fission products from the containment. Loss of the ability to draw water from the emergency sump could disable the emergency core cooling and containment spray systems. The consequences of the resulting inability to cool the reactor core or the containment atmosphere could be melting of the core and/or breaking of the containment.

Chairman Hendrie described the vulnerability on PWRs, which comprise two-thirds of the nation’s operating reactors. The vulnerability equally applied to BWRs, as Perry and Limerick demonstrated. The emergency sump functions on a PWR as the suppression pool does on a BWR.

But rather than addressing the problem head on, the NRC employed classic bureaucratic stall tactics: commissioning study after study, having the national labs perform lots of modeling, and pondering all sorts of useless aspects. In short, the NRC seemed up for anything and everything except something that might actually resolve the known safety problem.

Nearly two decades after warning the President about the safety problem that actually manifested itself at Perry twice and then Limerick, the NRC finally compelled the long overdue safety repairs at boiling water reactors like Perry and Limerick.

If fixing this known safety shortcoming was a good idea in 1995, it would have been a great idea in 1979. The NRC simply cannot sit on safety problems that one day may cause unnecessary harm to thousands of Americans.

As for the PWR threat that Chairman Hendrie warned President Carter about back in 1979, it remains unresolved at dozens of the PWRs operating in the US. Tomorrow, the Commission will hear about the latest plans to resolve this known safety problem. That’s merely 11,550 days after an NRC Chairman warned a US president about it.


Bookmark and Share