On June 17, 1998, maintenance activities at the Columbia Generating Station in Richland, Washington, were wrapping up prior to restarting the plant. Workers cutting and grinding metal tubing in the emergency diesel generator building produced smoke. Fire detectors mounted near the ceiling sensed the smoke and automatically opened valves that permitted water from piping filled with water and dedicated for use in fighting fires, called the fire header, to fill the fire-spray piping.
No water sprayed from the fire nozzles, however, because the nozzles were still blocked by metal caps that melt when there’s an actual fire. The pressure in the fire header dropped as its water flowed into the empty fire-spray piping. The pressure reduction signaled the four fire-protection-system pumps to automatically start. The pumps rapidly re-filled the fire header. The piping was re-filled so quickly that when the water rushed to an isolation valve at the end of the long piping, the force, or “water-hammer,” broke the casing of the valve.
Water poured through the broken valve casing until workers stopped the pumps. The plant’s owner estimated that 163,000 gallons of water poured out in the interim.
The broken valve was located on a section of piping that ran vertically up a stairwell in the reactor building. Water cascaded down the stairwell and entered residual heat removal (RHR) pump room C in the basement through a watertight door that had not been properly closed. The water flooded the room until the electric motor for RHR pump C was underwater.
The water, cooped up for so long in the fire header, went sightseeing. It flowed into the floor drain located in RHR pump room C. That drain was connected to the drain from in a nearby room containing the low pressure core spray (LPCS) pump room. A valve in the drain pipe was designed to automatically close to prevent a flood in either room from transferring water to the other room. This valve failed to automatically close and operators were unable to remotely close the valve from the control room. Investigators believe that the valve failed because some of its internal components had aged, essentially locking the valve in the open position. In any case, water flooded the LPCS pump room up to the pump’s electric motor.
The flooding affected all three RHR pumps and the LPCS pump. That’s all the low pressure emergency core cooling systems at the plant. At the time, the plant was in cold shut down, which meant that the temperature of the reactor water was less than 212°F and the reactor was depressurized. The high pressure emergency core cooling system was not affected by the flood, but it would not have worked, if needed, with since the reactor was depressurized.
Fortunately, the irony of having flood water preventing cooling water from reaching the core remained a theoretical, rather than literal, matter. For even though the reactor was shut down at the time, the reactor core continued to generate substantial amounts of decay heat. Had a pipe burst to drain water from the reactor vessel when neither the high pressure or low pressure emergency core cooling systems were available to replace it, the uncovered fuel in the reactor core could still overheat .
Incidentally, investigators determined that the outcome would have been the same even if the watertight door to RHR pump room C had been properly closed. It seems that the watertight door is designed to keep water inside the pump room from leaking out, not to prevent water outside it from leaking in.
Nuclear power plant safety relies on defense-in-depth: diverse methods of cooling the water, redundant pumps, measures to lessen the likelihood of an accident along with measures to lessen the likelihood of a significant release of radioactivity should an accident occur. Defense-in-depth becomes shallow when a single event, such as the fire header rupture in this case, takes all of the low pressure core cooling systems out of the game at a time when the high pressure core cooling systems are already on the bench. “What if” is a better question to answer than “what the?”
“Fission Stories” is a weekly feature by Dave Lochbaum. For more information on nuclear power safety, see the nuclear safety section of UCS’s website and our interactive map, the Nuclear Power Information Tracker.
Support from UCS members make work like this possible. Will you join us? Help UCS advance independent science for a healthy environment and a safer world.