In early February, the Nuclear Regulatory Commission (NRC) sent in a Special Inspection Team (SIT) to review Pilgrim’s equipment problems and unplanned shutdown due to Winter Storm “Juno.” The SIT’s special investigation report was issued in May 2015. Here’s an overview of the findings.
On Jan. 27, 2015 the nor’easter storm nicknamed “Juno” hit the coast of Massachusetts and forced an unplanned reactor shutdown at Pilgrim Nuclear. Pilgrim lost offsite power and experienced a variety of other problems due to the storm conditions.
The Nuclear Regulatory Commission (NRC) sent in a Special Inspection Team (SIT) on Feb. 2, 2015 to evaluate Entergy’s equipment problems at Pilgrim following the reactor shutdown due to Juno.
According to the report that was issued earlier this month, the NRC identified eight violations of federal safety requirements. Pilgrim earned 1 preliminary “white” finding, 6 green findings, and 1 Severity Level IV non-cited violation. The NRC rates incidents from green (lowest safety significance) to white (low to moderate safety concern), then to orange and red (the most safety concern).
There was a combination of technology failures and human errors had created a scenario that was close to becoming a serious accident at Pilgrim.
At 2:35 am during the storm, 345 kilovolt Line 355, which brings outside electricity to the plant, was disconnected from the switchyard by the storm (NRC 10). At 4:02 am, Line 342 was lost as well, effectively cutting off all offsite electricity from Pilgrim.
This is a problem because Pilgrim needs electricity to circulate sea water in order to keep temperature in the reactor core at a safe level. Sea water is also used via a series of heat exchangers to keep Pilgrim’s spent fuel pool cool. If water from Cape Cod Bay cannot be pumped into Pilgrim, a meltdown can ultimately occur. The uranium fuel rods could heat up, breaching the core’s containment vessel and releasing radiation into the surrounding environment.
Pilgrim has some ways of dealing with a loss of offsite power (LOOP) to ensure a meltdown does not happen. When dealing with a LOOP, three main aspects within the containment vessel need to be considered and monitored: temperature, pressure, and water level.
Immediately after the fault of Line 342, at 4:03 am workers started the High Pressure Coolant Injection (HPCI) system to control pressure, and the Reactor Core Isolation Cooling (RCIC) system to control water level (NRC A2-2). These systems can operate without AC power – powered instead by steam generated in the reactor and only require DC power to monitor indicators and controls. Pilgrim did have DC power, generated by two diesel-powered backup generators, so it seemed that everything was under control and functioning according to emergency response procedures. However, only 5 minutes later they began seeing complications.
First, Pilgrim experienced a “loss of instrument air,” meaning that their essential way of controlling air pressure, i.e. using a diesel-fueled air compressor, failed, because the air compressor refused to start when called upon. It turns out that while Entergy had performed the NRC-required test of the air compressor in anticipation of the storm and found it functional, the test itself was inadequate because it didn’t demonstrate it could start at below freezing temperatures. The air compressor is stored outside, and according to the NRC, “the battery’s capacity is reduced as its temperature is lowered.” The NRC goes on to say in the report that this failure “was within Entergy’s ability to foresee and correct.”
This lack of foresight had serious consequences. At 9:53 am, the air compressor failure had caused a subsequent failure of the HPCI system, which relies upon a certain level of air pressure to open and close its drain valves. Operators then had to quickly find another method for pressure control. They decided trying to open two of the four safety relief valves (SRV) to depressurize the reactor. They successfully opened the ‘D’ SRV at 9:58 am, but repeatedly could not open the ‘C’ SRV. The failure of ‘C’ SRV to open was yet another example of a technological failure that the SIT determined “was reasonably within Entergy’s ability and foresight to correct.”
Back in February of 2013, the “Nemo” storm led to a Pilgrim “cool down,” in which the ‘A’ SRV also failed to open during emergency procedures. However, due to an oversight, the ‘A’ SRV wasn’t deemed necessary to test and replace, and it was allowed to remain in operation. Had Entergy staff tested the SRV after this incident (as they should have according to the SIT), they would have realized that it was damaged. They also would have tested the remaining SRVs for similar damage. Had this been done, one would think the ‘C’ SRV would have been replaced with a functional SRV.
However, even after the LOOP resulting from the Juno storm was over, Entergy performed a “past operability determination” from which they concluded, incredibly, that the ‘C’ SRV was fully operational and didn’t need replacing. This conclusion was based on the fact that it had only failed because the pressure was irregular during the storm, and would have worked in regular pressure.
In response to the NRC’s disapproval, Entergy later re-evaluated its determination and concluded that the ‘C’ SRV was indeed “inoperable.”
There were a number of other problems stemming from the loss of instrument air that Entergy responded poorly to as well. For example, in starting the RCIC system in pressure control mode in order to replace the inoperable HPCI system, the workers responsible for starting it failed to open the system cooling water supply valve. This is the second step in the manual startup procedure, yet it was not followed. This meant that for 2.5 hours the RCIC system was operating without any cooling water supplied to the lubricating oil cooler or the barometric condenser, which could have resulted in the overheating and ultimately failing of the RCIC system. Two minutes after the RCIC system was started, the crew received an alarm in the control room, and the procedure associated with the alarm would have told them “Improper Valve Lineup” was the probable cause. Yet this was ignored for 2.5 hours.
Eventually another back-up air compressor was brought in from outside the plant around 1:59 pm. This effectively solved the abnormal pressure issue within the reactor until NSTAR energized Line 342 at 4:07 pm.
In total, the SIT team found eight safety violations. Seven were determined to be “violations of NRC requirements.” One was a Severity Level IV non-cited violation (NCV). This was because Entergy at one point completely lost all instrumentation to measure sea water levels, and did not report it to anyone for 8 hours. Entergy did not implement any “compensatory measures” as required by the relevant Emergency Plan Implementing Procedure. In not doing so, Entergy could not have known if the sea water levels were at emergency levels or not, and could not have planned accordingly.
This series of events could have led to a disaster, and the disturbing presence of holes within their safety procedures, as well as Entergy’s calloused attitude towards addressing flaws in its system, are unacceptable.
Pilgrim is one of the worst performing reactors in the country. The NRC needs to make Entergy improve performance at Pilgrim, especially during severe storms that are common on the Mass. coast. Several local groups recently filed a petition with the NRC asking it to require Pilgrim to shut down during winter storms and reevaluate emergency plans and procedures during storms. Learn more →