The Limerick Unit 1 boiling water reactor (BWR) outside Philadelphia was operating at full power on September 11, 1995, when alarms in the control room indicated that one of the safety/relief valves had opened. Four large pipes, roughly 2-feet in diameter, carry steam produced in the reactor vessel to the main turbine. Each steam pipe is equipped with safety/relief valves that automatically open to protect the reactor vessel and the piping connected to it from damage if excessive pressure develops.
At Limerick that day, the steam flowing out the open safety/relief valve passed through a pipe to the suppression pool as shown in Figure 1. The suppression pool contains nearly 2 million gallons of water and serves as a heat sink for energy released inside containment. As shown in Figure 2, the steam passing through the safety/relief valve was carried below the surface of the suppression pool water and entered the water through small holes in the discharge line piping. The suppression pool water cooled the steam and condensed it back into water.
The operators tried closing the safety/relief valve, but it remained stuck open. The operators manually shut down the reactor in accordance with the emergency procedures. The steam flowing through the open safety/relief valve heated up the suppression pool water. So, the operators started a pump of the residual heat removal (RHR) system in cooling mode. The RHR pump took water from the suppression pool, sent it through heat exchangers where it was cooled down, and returned it to the suppression pool.
In addition to being a heat sink, the suppression pool is also a source of water for the emergency core cooling system (ECCS) pumps, which includes the pumps of the RHR system. Figure 3 shows the pipe that carries water for the ECCS system leading from the pool, although it pictures a BWR Mark I containment design and Limerick has a BWR Mark II containment. Instead of the suppression pool residing in a large metal torus as shown in Figure 3, Limerick’s suppression pool is in a concrete pit as shown in Figure 1. In both cases, the safety/relief valve discharge line exhausts near the bottom of the suppression pool to lessen the chances that uncondensed steam reaches the surface of the water. Also in both cases, the ECCS pumps draw water from the suppression pool through a strainer intended to filter out debris that might otherwise clog the ECCS pumps.
About 30 minutes after starting an RHR pump, the motor currents and flow rates for RHR pump ‘A’ fluctuated. The operators manually stopped the pump and started RHR pump ‘B.’ They checked things out, found nothing unexplained, and restarted RHR pump ‘A’ without further incident.
When the plant was cooled down, a diver entered the suppression pool water to investigate the cause of the anomalous behavior of RHR pump ‘A.’ The diver discovered that the suction strainers for RHR pump ‘A’ were almost entirely covered with a thin mat of fibers and sludge. The suction strainers for RHR pump ‘B’ were also covered, but not to the same extent. Workers removed nearly 1,400 pounds of debris from the suppression pool.
Suction strainers are pieces of metal with small holes. They prevent particles larger than 3/8 inches in diameter from entering the piping going to the RHR pumps. The RHR pumps have impellers (fan-like components) that push water through piping. Small particles pass right through the impellers, but larger particles – those screened out by the suction strainers – can clog the impellers.
Debris that had settled on the bottom of the suppression pool was stirred up when the safety/relief valve opened. Before that debris resettled on the bottom, the operators started RHR pump ‘A’ to cool the suppression pool water. Debris was pulled onto and clogged the strainer for RHR pump A’ and then for RHR pump ‘B’ when it was started. Because all the emergency pumps that cool the reactor during an accident also get their water from the suppression pool, the debris had the potential for disabling all the emergency pumps.
This was not the first time that debris in the suppression pool water caused problems. On January 16, 1993, and again on April 14, 1993, the Perry nuclear plant outside Cleveland, Ohio experienced it. The first time, debris clogged the suction strainers for the RHR pumps. In the second event, glass fibers from a temporary filter for the drywell ventilation system that had accidentally fallen into the pool clogged the suction strainers for the RHR pumps.
The NRC reacted to the third incident by requiring BWR owners to perform better housekeeping for their suppression pools. The large pool had become a tempting receptacle for items accidentally or intentionally discarded. Workers removed hard hats, plastic bags and foam rubber cleanliness covers from the suppression pool at the Nine Mile Point nuclear plant in New York. Workers at the LaSalle nuclear plant in Illinois recovered a rubber mat, a nylon bag, a flashlight, a large sheet of gasket material, anti-contamination coveralls, 15 feet of black duct tape, 50 feet of tygon tubing, and a substantial amount of sludge from the suppression pool. Divers also found a sediment layer up to 2 inches thick in the LaSalle suppression pool. At the River Bend nuclear plant in Louisiana, workers removed an antenna, length of rope, a hammer, a wrench, a step-off pad, and plastic bags from the suppression pool.
The NRC also required owners to modify their suction strainer configurations. Even when all extraneous debris was properly kept out, the NRC was concerned that the steam and water jetting from a broken pipe inside the drywell could knock insulation off piping and scour coatings off equipment. Water could then carry this debris into the suppression pool water where it could clog the suction strainers and disable all of the emergency pumps.
The NRC required a two-prong solution to the problem: (1) minimize the amount of debris in suppression pool water during an accident, and (2) minimize the vulnerability of ECCS pump suction strainers to clogging by debris. This was a good approach.
However, the NRC did not require any reactor to immediately shut down to correct this serious safety problem. Instead, they allowed the plants to continue operating until their next scheduled refueling outage. Some reactors operated for over a year. The NRC felt that the chances of an accident occurring during this grace period were small, very small. If an accident had happened, the consequences could have been big, very big.
The NRC knew about this safety problem – clogged pipes restricting the circulation of cooling water – long before the incidents at Perry and Limerick. NRC Chairman Joseph Hendrie wrote to President Jimmy Carter on Valentines Day 1979:
Following a postulated loss-of-coolant accident, i.e., a break in the reactor coolant system piping, the water flowing through the break would be collected in the emergency sump at the low point in the containment. This water would be recirculated through the reactor system by the emergency core cooling pumps to maintain core cooling. This water would also be circulated through the containment spray system to remove heat and fission products from the containment. Loss of the ability to draw water from the emergency sump could disable the emergency core cooling and containment spray systems. The consequences of the resulting inability to cool the reactor core or the containment atmosphere could be melting of the core and/or breaking of the containment.
Chairman Hendrie described the vulnerability on PWRs, which comprise two-thirds of the nation’s operating reactors. The vulnerability equally applied to BWRs, as Perry and Limerick demonstrated. The emergency sump functions on a PWR as the suppression pool does on a BWR.
But rather than addressing the problem head on, the NRC employed classic bureaucratic stall tactics: commissioning study after study, having the national labs perform lots of modeling, and pondering all sorts of useless aspects. In short, the NRC seemed up for anything and everything except something that might actually resolve the known safety problem.
Nearly two decades after warning the President about the safety problem that actually manifested itself at Perry twice and then Limerick, the NRC finally compelled the long overdue safety repairs at boiling water reactors like Perry and Limerick.
If fixing this known safety shortcoming was a good idea in 1995, it would have been a great idea in 1979. The NRC simply cannot sit on safety problems that one day may cause unnecessary harm to thousands of Americans.
As for the PWR threat that Chairman Hendrie warned President Carter about back in 1979, it remains unresolved at dozens of the PWRs operating in the US. Tomorrow, the Commission will hear about the latest plans to resolve this known safety problem. That’s merely 11,550 days after an NRC Chairman warned a US president about it.
“Fission Stories” is a weekly feature by Dave Lochbaum. For more information on nuclear power safety, see the nuclear safety section of UCS’s website and our interactive map, the Nuclear Power Information Tracker.