UCS Backgrounder on Pilgrim’s January 27, 2015 Event
February 3, 2015
Source: NRC Flickr Gallery, Courtesy Entergy Nuclear
1
Pilgrim was operating near full power with steam
(red) produced in the reactor vessel flowing to
the turbine/generator unit. Steam exiting the
turbine was cooled by ocean water (green) and
converted back into water. The condensate and
feedwater systems returned the water (blue) to
the reactor vessel. Energy produced by the
reactor core was balanced by heat dissipated to
the environment. Mass leaving the reactor vessel
as steam was matched by the makeup water.
2
Electricity produced by the main generator flowed
through the main transformer to the switchyard
and out to the offsite power grid via transmission
lines 342 and 355. Electricity from the generator
also flowed through the Unit Auxiliary
Transformer to supply in-plant electrical circuits
from Buses A1, A3, A5, A6, A4, and A2.
3
4
5
Main Transformer
One Transmission
Line
Feed to Start-up
Transformer
Cyan circles indicate the
four switchyard electrical
breakers (two per offsite
transmission line)
Second Transmission Line
6
01-27-2015 01:33 am
The winter storm caused a ground fault on Line
355. In response, electrical breakers 105 and 102
opened to prevent this electrical disturbance from
affecting other equipment.
7
01-27-2015 01:34 am
In accordance with their Operation During Severe
Weather procedure, the operators reduce the
speeds of the two recirculation pumps to lower
the flow rate of water through the reactor core.
This reduces the reactor power level from 100
percent to 77 percent.
8
01-27-2015 01:34 am
The intent of the procedure is to reduce the
reactor power level to below the capacity of the
bypass valves (BPVs) that route steam to the
condenser if the turbine is shut down. This
bypass route can only handle up to about 30% of
rated steam flow, or about 30 percent reactor
power.
9
01-27-2015 02:00 am
Electrical breaker 102 automatically reclosed per
design. Workers manually closed electrical
breaker 105 to re-connect the switchyard to Line
355.
10
01-27-2015 02:06 am
The winter storm caused an undervoltage
condition on Line 355. In response, electrical
breakers 105 and 102 opened to prevent this
electrical disturbance from affecting other
equipment.
11
01-27-2015 02:08 am
The operators manually started Emergency Diesel
Generator B and connected it to Bus A6 per
procedures.
12
01-27-2015 02:12 am
1
The operators manually started Emergency Diesel
Generator A and connected it to Bus A5 per
procedures.
13
01-27-2015 02:15 am
Electrical breaker 102 automatically reclosed per
design. Workers manually closed electrical
breaker 105 to re-connect the switchyard to Line
355.
14
01-27-2015 02:28 am
The winter storm caused an undervoltage
condition on Line 355. In response, electrical
breakers 105 and 102 opened to prevent this
electrical disturbance from affecting other
equipment.
15
01-27-2015 02:31 am
Electrical breaker 102 automatically reclosed per
design. Workers manually closed electrical
breaker 105 to re-connect the switchyard to Line
355.
16
01-27-2015 02:35 am
The winter storm disconnected the switchyard
from Line 355. This line remained unavailable for
the remainder of the day.
17
01-27-2015 03:00 am
The wind speed onsite was measured at 54 miles
per hour.
18
01-27-2015 03:24 am
The operators began inserting control rods into
the reactor core to reduce the reactor power level
from approximately 77 percent.
19
01-27-2015 04:00 am
The wind speed onsite was measured at 61 miles
per hour.
20
01-27-2015 04:02 am
Line 342 was lost due an electrical fault. The
generator automatically tripped offline. The
reactor automatically shut down from 52 percent
power. The only alternating power onsite was
provided by the two emergency diesel generators.
Buses A1, A3, A4, and A2 were not getting electricity.
The components powered from these electric circuits
stopped running. The majority of the plant’s
components could no longer be used.
21
01-27-2015 04:02 am
The 23,000 volt transmission line and the Blackout
Diesel Generator remained able to supply electricity
to safety buses A5 and A6 had either or both
emergency diesel generators failed.
22
Instrument Air Problems
Pilgrim has two electric motor-driven air compressors
that provide compressed air at around 100 to 110
pounds per square inch to plant equipment. For example,
many valves are pneumatically controlled and need air
pressure to open and close. Many of these valves have
fail-safe designs. Springs keep the valves closed unless
the air pressure is sufficient to overcome the spring
force and open the valves.
These motor-driven air compressors were powered from
the non-safety buses. Thus, when offsite power was lost,
both air compressors stopped working.
Pilgrim has one diesel-driven air compressor. It can
operate when offsite power is unavailable to supply air
pressure to plant components.
In anticipation of the approaching storm, workers tested
the diesel-driven air compressor on January 22, 2015. It
successfully started.
23
Instrument Air Problems
After offsite power was lost on January 27, workers
tried to start the diesel-driven air compressor. It failed
to start.
The tests had been conducted when offsite power was
available and used that alternating current power to
crank the engine.
The diesel-driven air compressor had a battery to
provide direct current power to crank the engine. But
the temperature on January 27 was below freezing and
battery performance degrades at low temperatures. The
battery lacked the capacity to enable the engine to be
started.
24
Instrument Air Problems
As part of the post-Fukushima safety upgrades ordered
by the NRC, Pilgrim acquired another diesel-driven air
compressor. Workers retrieved this FLEX component
from onsite storage, connected it to the instrument air
system piping, and successfully started it at 1:59 pm on
January 27.
But it only achieved air pressure of 80 pounds per
square inch, insufficient to operate most components.
Another temporary air compressor was obtained from an
offsite location, connected to the instrument air system
piping, and started about 30 hours after offsite power
(and instrument air system pressure) had been lost.
25
Instrument Air Problems
The loss of air pressure adversely affected the plant’s
response in several ways:
• the instruments measuring the sea level were
disabled, leaving the operators unable to ensure an
emergency condition for high storm surge had not
been entered
• the instruments for the water level in the
Condensate Storage Tank were disabled, compelling
the operators to re-align the core spray pumps to a
less desirable source of makeup water to the reactor
vessel
• the valve in the Reactor Water Cleanup System
normally used to regulate water level inside the
reactor vessel during shut down and low power
conditions could not be used by the operators
26
01-27-2015 04:12 am
The operators begin using the High Pressure
Coolant Injection (HPCI) system in the pressure
control mode. The HPCI turbine takes steam from
the reactor vessel and discharges it to the
suppression pool (a.k.a. torus). The HPCI pump
draws water from the Condensate Storage Tank
and returns it to the tank.
27
01-27-2015 9:36 am
The operators started Core Spray pump B eight times between 9:36 am and 4:47 pm to control
water level inside the reactor vessel. The Core Spray pumps are powered by large electric motors
that require considerable power (torque) to start. The large flow of electric current to the motors
during startup generates heat. The motor ‘s vendor recommended cool-off periods between
successive motor starts to allow the heat to dissipate. Several of the pump starts violated the
vendor’s recommendations for consecutive large motor starts.
28
01-27-2015 9:36 am
Each Core Spray pump at Pilgrim is designed to supply at least 3,300 gallons per minute of
makeup flow to the reactor vessel. The operators were trying to control the water level over a 20inch range. It takes about 200 inches of water to fill an inch inside the reactor vessel. Thus, a Core
Spray pump only needed to run for about 70 seconds to fill 20 inches of the reactor vessel. Using
a large Core Spray pump for such modest makeup is like filling a beverage glass using a fire hose.
It works, but there are better ways to accomplish this task.
29
01-27-2015 09:48 am
The operators turn off the HPCI system as the reactor
pressure drops to about 120 pounds per square inch
(from about 1,010 pounds per square inch at full
power). Lower reactor pressures adversely affect the
steam flow rate to the HPCI turbine, necessitating
removing the system from service.
30
01-27-2015 09:48 am
RCIC PUMP
The operators begin using the Reactor Core
Isolation Cooling (RCIC) system in the pressure
control mode. The RCIC turbine takes steam from
the reactor vessel and discharges it to the
suppression pool (a.k.a. torus). The RCIC pump
draws water from the Condensate Storage Tank
and returns it to the tank. The RCIC system is
similar to the HPCI system, but about one-tenth
the size. RCIC can operate down to about 50
pounds per square inch reactor pressure.
31
01-27-2015 09:50 am
Within minutes of turning off the
HPCI system, an alarm in the
control room alerts the operators
of a HPCI system problem.
When HPCI operated, steam and
non-condensible gases (e.g. air)
leaking past the turbine shaft were
collected by the gland seal
condenser and exhausted via the
Stand-by Gas Treatment System.
With HPCI turned off, these
materials were supposed to flow
to the liquid waste system (not
shown on the diagram).
But the loss of instrument air
closed the valves in this drain line.
The condensed water instead
poured from the gland seal
condenser onto the HPCI room
floor, covering it to a depth of over
an inch.
32
01-27-2015 09:58 am
The operator cycled Safety Relief Valve (SRV) D
opened and closed to discharge some steam from the
reactor vessel to the suppression pool to reduce the
reactor pressure. Between 9:58 am and 1:16 pm, SRV
D would be cycled 53 times.
33
01-27-2015 10:15 am
The operator attempted to cycle Safety Relief Valve
(SRV) C opened and closed, but it failed to open. The
plan was to sequentially cycle SRVs B, C, and D to
control the reactor pressure . The operators did not
want to cycle SRV due to its history of problems.
34
Safety Relief Valve Problems
The NRC’s special inspection team determined that SRV
A had failed to open three times during a very similar
loss of offsite power event at Pilgrim on February 9,
2013.
Following that event, the operators initiated a Condition
Report to have maintenance workers check SRV A. The
SRVs have thermocouples installed in the downstream
piping to assist the operator determine whether the
valves are open or closed (one of the post Three Mile
Island safety upgrades ordered by the NRC.)
Because SRV A had failed to open, its downstream
thermocouple had not shown the temperature rise
caused when steam flows by it. Workers assumed that
SRV A had opened each time and that the thermocouple
was bad. They replaced the thermocouple and closed
the Condition Report. Pilgrim was restarted with SRV A
(and SRV C) impaired.
35
01-27-2015 10:16 am
The operator cycled SRV D opened and closed to
discharge some steam from the reactor vessel to the
suppression pool to reduce the reactor pressure.
36
01-27-2015 10:16 am
Main Steam Line
Opening SRV D caused the reactor vessel
water level to momentarily swell as lower
pressure allowed more steam bubbles to
form. The RCIC system automatically tripped
on high water level inside the reactor vessel.
The operators had been controlling the water
level between 20 and 40 inches (denoted by
the cyan rectangle in the diagram) and trying
to maintain it at the high side of that band.
Reactor
Core
The RCIC, HPCI and main turbines
automatically trip at 45 inches as a
precaution against water entering the Main
Steam Line that supplies their steam.
The Emergency Procedures allow the
reactor water level to be maintained
between 12 and 45 inches, with guidance to
use the lower end of this band when SRVs
are being used to control reactor pressure.
The operators should not have tried to
maintain the water level close to 40 inches
when they were cycling SRVs to control the
reactor pressure.
37
This chart shows the position of SRV F on the Unit 2 reactor at Fukushima Daiichi on March 11, 2011. It is a digital
signal with 0 meaning closed and 1 indicating open.
This chart shows the reactor pressure for the Unit 2 reactor at Fukushima Daiichi on March 11, 2011. As SRV F
opened, the reactor pressure dropped. Decay heat from the reactor would cause the reactor pressure to increase
until the SRV cycled again. As decay heat decreased, so did the frequency of SRV openings.
This chart shows the reactor vessel water level for the Unit 2 reactor at Fukushima Daiichi on March 11, 2011.
38
When SRV F opened, the water level momentarily spiked upward and returned to normal when SRV F closed.
01-27-2015 10:16 am
The operator cycled SRV B opened and closed to
discharge some steam from the reactor vessel to the
suppression pool to reduce the reactor pressure.
Between 10:16 am and 1:24 pm, SRV B would be cycled
52times., alternating use with SRV D.
39
01-27-2015 10:56 am
RCIC PUMP
The operators restarted RCIC system in the
pressure control mode.
40
The operator failed to open the cooling
water supply valve, even through it is the
second step in the procedure. As a result,
the RCIC system operated for over 2 ½
hours without cooling water flow to its
lubricating oil cooling and barometric
condenser.
01-27-2015 10:56 am
41
RCIC System Problems
The operators restarted the RCIC system but failed to
open the valve that supplied cooling water to parts of
the system, even though it was the second step in the
procedure.
Two minutes later, an alarm in the control room alerted
the operators to a RCIC system problem. The response
procedure for that alarm indicated that improper valve
lineup was a likely cause. Yet the operator dispatched to
the RCIC room failed to check the valve lineup and the
closed cooling water valve.
One hour and 59 minutes later – with RCIC still running
without cooling water – another alarm sounded in the
control room, once again pointing to a potential valve
alignment error. Once again, the operator’s response to
the alarm failed to notice that the cooling water valve
was closed.
42
01-27-2015 1:26 pm
The operator opened SRV D and left it open
until 5:04 pm to control reactor pressure.
43
01-27-2015 1:32 pm
RCIC PUMP
The operators turned off the RCIC system.
44
01-27-2015 4:26 pm
Each Core Spray pump at Pilgrim is designed to supply at least 3,300 gallons per minute of
makeup flow to the reactor vessel. The operators were trying to control the water level over a 20inch range. Each inch of level inside the reactor vessel requires about 200 inches of water to fill.
Thus, a Core Spray pump need only run for about 70 seconds to fill 20 inches of the reactor
vessel. Using a large Core Spray pump for such modest makeup needs is like using a fire house to
fill a glass. It works, but there are better ways to accomplish this task.
45
The operators established
shutdown cooling mode with
Residual Heat Removal Loop B.
The RHR pumps took water from
one of the recirculation piping
loops, routed it through a heat
exchanger for cooling and
returned the cooled water to the
reactor vessel via the
recirculation loop piping.
01-27-2015 4:26 pm
46
01-27-2015 4:57 pm
The reactor water temperature
was reduced below 212°F.
47
01-29-2015 5:05 pm
Line 342 was restored to service at 4:07 pm. At
4:35 pm, electrical breaker 103 was closed to
supply power to the Start-up Transformer. By 5:05
pm, breakers had been closed to re-energize nonsafety buses A1, A2, A3, and A4 from offsite
power. Safety buses A5 and A6 continued to be
supplied power from the emergency diesel
generators.
48
01-29-2015 7:00 pm
Workers transferred safety bus A5 from
emergency diesel generator A to the Start-up
Transformer. Emergency diesel generator A was
shut down by 7:44 pm.
49
01-30-2015 6:45 pm
Line 355 was restored to service and electrical
breaker 102 closed to achieve the normal
switchyard configuration for the shut down plant.
50
01-31-2015 1:30 am
Workers transferred safety bus A6 from
emergency diesel generator B to the Start-up
Transformer. Emergency diesel generator B was
shut down by 1:51 am.
51
Safety Violations
The NRC’s Special Inspection Team identified eight
violations of safety requirements during its investigation
into the January 27, 2015, event:
• GREEN finding for failure to properly test the dieseldriven air compressor, contributing to its failure to start
during this event
• GREEN finding for initially determining that SRV C,
despite having twice failed to open at low reactor
pressure, was okay because it would likely open at
higher reactor pressure
• Preliminary WHITE finding for inadequate corrective
actions following failure of SRV A to open, three times,
during a shut down on February 9, 2013, contributing to
the failure of SRV C to open during this event
52
Safety Violations
(continued)
• GREEN finding for inadequate training and procedures
for the operators’ response to loss of instrument air
• GREEN finding for failure to follow procedures by
restarting the RCIC system without opening a cooling
water valve and twice failing to notice the improperly
closed valve when responding to system alarms
• GREEN finding for failure to properly evaluate and
remedy a problem involving keeping the emergency
makeup system piping filled with water (not described in
the earlier slides)
• GREEN finding for inadequate emergency response
procedures; specifically, the loss of instrument air
disabled the sea level monitoring instruments leaving
operators unable to ensure that the storm surge steps in
the emergency procedures need not be taken
53
Safety Violations
(continued)
• Severity Level IV finding for failure to report to the NRC
that portions of the emergency plan could not be
implemented due to loss of sea level monitoring
capability
54