On September 11, 1985, operators at the Limerick Generating Station outside Philadelphia tested the plant’s remote shutdown capability. They simulated abandoning the control room and shutting down the reactor using equipment and controls outside the control room.
During the test, the reactor core isolation cooling (RCIC) system injection valve failed to open. The RCIC system uses a small turbine supplied by steam produced by the reactor core’s decay heat connected to a pump to deliver makeup water to the reactor vessel to cool the nuclear fuel. An operator went to the RCIC room to manually open the valve, but found the door to the room locked because it was designated as a high radiation area.(That’s because the steam used by the main turbine, RCIC turbine, and feedwater system turbines in boiling water reactors such as those at Limerick contains radioactivity. Even if the fuel rods are entirely intact, water flowing through the reactor core region forms a radioactive isotope of nitrogen, N-16. This isotope has a half-life of slightly over 7 seconds, but poses a radiation hazard during the minute or so it takes for the number of N-16 atoms in the steam flow to drop to a level that isn’t considered a serious health hazard.)
The operator contacted the Health Physics department. An HP technician was dispatched with the key to the RCIC room. When the HP tech met the operator outside the RCIC room 15 minutes later, they learned he brought the wrong key. The right key was finally located and the operator entered the RCIC room.
The operator found the injection valve’s hand-wheel chained and locked closed. This step prevented the valve from being mistakenly opened during reactor operation. He did not have the key to the padlock. Neither did the operators at the remote shutdown panel. The keys had been left in the control room which they just abandoned.
Bolt cutters were used to cut the chain. The operator finally opened the RCIC system injection valve many minutes after the need arose.
The remote shutdown test was performed during plant startup when decay heat levels were relatively low. The control rod drive system was able to provide sufficient makeup flow to the reactor vessel until the RCIC system could be made available. If this had been an actual emergency, the NRC concluded it was questionable whether the operators would have been able to provide adequate core cooling given the lengthy time required to establish RCIC system flow to the reactor vessel.
Our Takeaway
Like a glass partially filled with water, this event is either good or bad depending on one’s perspective. It’s bad in that two locked barriers impeded the proper response to plant conditions. That imposition had no serious consequences in this case, but could have under different circumstances.
It’s good in illustrating the often under-estimated value of periodic tests. The RCIC room door was locked for the necessary reason of protecting workers from radiation exposures. The RCIC valve hand-wheel was locked for the necessary reason of preventing its inadvertent opening during plant operation. This test revealed unintended consequences from the needed locks and provided the opportunity to make adjustments so as to better serve all needs in the future.
Tests and inspections at nuclear plants are actually not performed to verify that equipment is fully functional today. They are performed to provide assurance that equipment will be fully functional in the future if needed. In that light, tests such as this one at Limerick successfully achieve that desired outcome.
“Fission Stories” is a weekly feature by Dave Lochbaum. For more information on nuclear power safety, see the nuclear safety section of UCS’s website and our interactive map, the Nuclear Power Information Tracker.