The sinking of the Titanic on her maiden voyage has been immortalized in countless books, articles, movies, and documentaries. Billions of people across the globe know about the luxury liner’s collision with an iceberg in the north Atlantic on April 14, 1912, on her way to New York City with the ensuing loss of 829 passengers and 694 crew members. The ship’s band playing while passengers gathered on deck to board lifeboats and the radio operator staying on duty tapping out SOS distress messages are legends. While the Titanic’s tragic encounter with an iceberg is widely known, her second sinking is virtually unknown.
Shortly after 7:00 am on the morning of Saturday, July 24, 1915, the gang planks on the steamship Eastland (Figure 2) were taken in after 2,501 passengers had boarded in Chicago for a day’s excursion across Lake Michgan to St. Joseph. With the Eastland still tied to the wharf on the south side of the Chicago River between LaSalle and Clark streets, she capsized. A total of 841 passengers—more than died when the Titanic sank in mid-ocean—and 3 crew members perished. Twenty-two entire families perished.
The Eastland can be considered the Titanic’s second sinking because had the Titanic not sunk, the Eastland very likely would not have capsized. Additional lifeboats, rafts, and davits installed to comply with a U.S. law enacted in response to the Titanic disaster caused the Eastland to become more susceptible to capsizing. The added weight to the steamship’s upper decks reduced her ability to right herself in response to a list, or lean, to one side or the other.
On the morning of the disaster, the Eastland listed about 10 degrees towards the wharf as boarding passengers collected on that side of the steamship to communicate with friends yet to board. The crew corrected the list by admitting water to the ballast tanks on the steamship’s other side. As more passengers boarded, their more uniform distribution on the steamship caused her to list about ten degrees away from the wharf. The crew attempted to correct this list by reallocating water among the ballast tanks, but small-diameter piping limited how fast water could be transferred between tanks. The list increased until the Eastland rolled over onto her side. Figure 3 captured rescuers assisting survivors off the capsized vessel.
There are important lessons to be learned from both tragedies. The Titanic put to sea with more persons on board than could be accommodated in her lifeboats. If the ship sank, this shortfall meant that some would have to go down with her. To rectify that safety problem, the Eastland was retrofitted with lifeboat capacity for all persons on board. But fixing safety in one area made Eastland less safe in another.
The “Eastland phenomena” has also occurred at nuclear power plants. Well-intentioned efforts to enhance safety levels have unintentionally reduced safety levels. Two examples illustrate such outcomes. One involves the emergency core cooling systems (ECCS) for boiling water reactors (BWRs) and the other involves the ECCS for pressurized water reactors (PWRs).
The majority of BWRs operating in the U.S. have two recirculation loops of piping, pumps, and valves as illustrated in Figure 4. Each recirculation pump draws water from within the reactor vessel and returns it to the reactor vessel at high velocity to promote cooling flow through the reactor core. If one of the large diameter pipes in either recirculation loop were to rupture (represented by the red X on the right side of Figure 4), cooling water would very rapidly escape through the open ends.
To ensure adequate cooling of the reactor core during such an event, four large emergency pumps will start and transfer makeup water from the suppression pool into the reactor vessel. The suppression pool is a large volume of water stored inside containment to absorb the energy released during an accident. The piping from these emergency pumps connects to the recirculation loop piping. When the emergency pumps are running and pressure inside the reactor vessel has dropped low enough, injection valves automatically open allowing makeup flow to enter the recirculation loops. Two emergency pumps supply makeup water to one recirculation loop while the other two emergency pumps use the second recirculation loop.
Designers recognized that injecting water into a ruptured recirculation loop would result in most of that makeup water spilling out through the broken pipe end and not cooling the reactor. They developed a loop selection logic system that used the differential pressure between the two recirculation loops to detect which loop had broken. It would have lower pressure than the intact loop. The loop selection logic system would respond by not opening the injection valve for two emergency pumps to inject into the broken loop. Instead, the cross-connect valve would automatically open to allow flow from those two emergency pumps to join the flow from the other two emergency pumps entering the intact loop. Consequently, instead of half of the makeup flow spilling out onto the containment floor, all the makeup flow would enter the reactor vessel to cool the reactor core.
This well-intended safety upgrade had the potential for significantly decreasing safety levels. If the single injection valve on the makeup line to the intact loop failed to open, no makeup flow would reach the reactor core. Makeup flow to the broken loop is prevented by design while makeup flow to the intact loop is prevented by accident. The loop selection logic system was removed from BWRs. Higher reliability of having half of the makeup flow is safer than lower reliability of having full makeup flow.
The nation’s PWRs faced a similar Eastland. As shown in Figure 5, the ECCS for PWRs initially transfer water from an external tank, the Refueling Water Storage Tank (RWST), to the reactor vessel to makeup for water lost through a broken pipe. Before the RWST empties, the lineup is changed to draw water instead from the sump where it collects after spilling out the broken pipe ends. To prevent debris in this water from clogging the pumps, the sumps have metal mesh screens.
In September 1996, the NRC staff undertook to resolve a safety problem with this arrangement. The violence of water jetting from broken pipe ends can scour insulation off piping, paint off walls, and coatings off equipment. The water can then carry this debris with it down to the sumps. Concerned that debris could block the sump screens and thus disable the available reactor core cooling capability, the NRC required PWR owners to take steps to reduce this potential hazard. The owners modified their plants to increase the surface area of the sump screens. Today’s sump screens are up to 25 times larger than the original screens.
This safety upgrade also comes with a price. In the original designs, debris collecting on the smaller screens filtered out smaller particles, The accumulated debris essentially descreased the mesh size. The new, larger screens are less likely to become clogged by debris and hence more likely to pass smaller particles on to the reactor vessel. Recent tests have indicated that as little as 2 ounces of small particles is enough to cause overheating damage to fuel in the reactor core.
Obviously, taking steps to prevent a nuclear Titanic is only commendable when those steps also avoid a nuclear Eastland. The NRC’s safety regulations seek commendable outcomes. Specifically, Regulation 10 CFR 50.59 requires that plant owners answer a series of questions before implementing modifications to their facilities and/or its procedures: Will the proposed change increase the chances of a previously analyzed accident? Will a proposed change increase the consequences of a previously analyzed accident? Will a proposed change create the possibility for a different type of accident than any previously analyzed?
It’s tempting to undertake a safety upgrade when the answers show it to have no downside. It’s tempting fate not to keep asking questions.
Pietro “Pete” Pasqua, the head of the nuclear engineering department when I attended the University of Tennessee, instilled in us the concept that having the right answers is sufficient only when one has asked all the right questions. The Eastland and many other tragedies have occurred not because people had the wrong answers, but because they failed to ask all the right questions.
“Fission Stories” is a weekly feature by Dave Lochbaum. For more information on nuclear power safety, see the nuclear safety section of UCS’s website and our interactive map, the Nuclear Power Information Tracker.