1. Source: NRC Flickr Gallery, Courtesy Entergy Nuclear UCS Backgrounder on Pilgrim’s January 27, 2015 Event February 3, 2015 1

2. Pilgrim was operating near full power with steam (red) produced in the reactor vessel flowing to the turbine/generator unit. Steam exiting the turbine was cooled by ocean water (green) and converted back into water. The condensate and feedwater systems returned the water (blue) to the reactor vessel. Energy produced by the reactor core was balanced by heat dissipated to the environment. Mass leaving the reactor vessel as steam was matched by the makeup water. 2

3. Electricity produced by the main generator flowed through the main transformer to the switchyard and out to the offsite power grid via transmission lines 342 and 355. Electricity from the generator also flowed through the Unit Auxiliary Transformer to supply in-plant electrical circuits from Buses A1, A3, A5, A6, A4, and A2. 3

4. 4

5. 5

6. 6 Main Transformer Second Transmission Line One Transmission Line Feed to Start-up Transformer Cyan circles indicate the four switchyard electrical breakers (two per offsite transmission line)

7. The winter storm caused a ground fault on Line 355. In response, electrical breakers 105 and 102 opened to prevent this electrical disturbance from affecting other equipment. 7 01-27-2015 01:33 am

8. In accordance with their Operation During Severe Weather procedure, the operators reduce the speeds of the two recirculation pumps to lower the flow rate of water through the reactor core. This reduces the reactor power level from 100 percent to 77 percent. 8 01-27-2015 01:34 am

9. The intent of the procedure is to reduce the reactor power level to below the capacity of the bypass valves (BPVs) that route steam to the condenser if the turbine is shut down. This bypass route can only handle up to about 30% of rated steam flow, or about 30 percent reactor power. 9 01-27-2015 01:34 am

10. Electrical breaker 102 automatically reclosed per design. Workers manually closed electrical breaker 105 to re-connect the switchyard to Line 355. 10 01-27-2015 02:00 am

11. The winter storm caused an undervoltage condition on Line 355. In response, electrical breakers 105 and 102 opened to prevent this electrical disturbance from affecting other equipment. 11 01-27-2015 02:06 am

12. The operators manually started Emergency Diesel Generator B and connected it to Bus A6 per procedures. 12 01-27-2015 02:08 am

13. The operators manually started Emergency Diesel Generator A and connected it to Bus A5 per procedures. 13 01-27-2015 02:12 am 1

14. Electrical breaker 102 automatically reclosed per design. Workers manually closed electrical breaker 105 to re-connect the switchyard to Line 355. 14 01-27-2015 02:15 am

15. The winter storm caused an undervoltage condition on Line 355. In response, electrical breakers 105 and 102 opened to prevent this electrical disturbance from affecting other equipment. 15 01-27-2015 02:28 am

16. Electrical breaker 102 automatically reclosed per design. Workers manually closed electrical breaker 105 to re-connect the switchyard to Line 355. 16 01-27-2015 02:31 am

17. The winter storm disconnected the switchyard from Line 355. This line remained unavailable for the remainder of the day. 17 01-27-2015 02:35 am

18. The wind speed onsite was measured at 54 miles per hour. 18 01-27-2015 03:00 am

19. The operators began inserting control rods into the reactor core to reduce the reactor power level from approximately 77 percent. 19 01-27-2015 03:24 am

20. The wind speed onsite was measured at 61 miles per hour. 20 01-27-2015 04:00 am

21. Line 342 was lost due an electrical fault. The generator automatically tripped offline. The reactor automatically shut down from 52 percent power. The only alternating power onsite was provided by the two emergency diesel generators. 21 01-27-2015 04:02 am Buses A1, A3, A4, and A2 were not getting electricity. The components powered from these electric circuits stopped running. The majority of the plant’s components could no longer be used.

22. The 23,000 volt transmission line and the Blackout Diesel Generator remained able to supply electricity to safety buses A5 and A6 had either or both emergency diesel generators failed. 22 01-27-2015 04:02 am

23. 23 Instrument Air Problems Pilgrim has two electric motor-driven air compressors that provide compressed air at around 100 to 110 pounds per square inch to plant equipment. For example, many valves are pneumatically controlled and need air pressure to open and close. Many of these valves have fail-safe designs. Springs keep the valves closed unless the air pressure is sufficient to overcome the spring force and open the valves. These motor-driven air compressors were powered from the non-safety buses. Thus, when offsite power was lost, both air compressors stopped working. Pilgrim has one diesel-driven air compressor. It can operate when offsite power is unavailable to supply air pressure to plant components. In anticipation of the approaching storm, workers tested the diesel-driven air compressor on January 22, 2015. It successfully started.

24. 24 Instrument Air Problems After offsite power was lost on January 27, workers tried to start the diesel-driven air compressor. It failed to start. The tests had been conducted when offsite power was available and used that alternating current power to crank the engine. The diesel-driven air compressor had a battery to provide direct current power to crank the engine. But the temperature on January 27 was below freezing and battery performance degrades at low temperatures. The battery lacked the capacity to enable the engine to be started.

25. 25 Instrument Air Problems As part of the post-Fukushima safety upgrades ordered by the NRC, Pilgrim acquired another diesel-driven air compressor. Workers retrieved this FLEX component from onsite storage, connected it to the instrument air system piping, and successfully started it at 1:59 pm on January 27. But it only achieved air pressure of 80 pounds per square inch, insufficient to operate most components. Another temporary air compressor was obtained from an offsite location, connected to the instrument air system piping, and started about 30 hours after offsite power (and instrument air system pressure) had been lost.

26. 26 Instrument Air Problems The loss of air pressure adversely affected the plant’s response in several ways: the instruments measuring the sea level were disabled, leaving the operators unable to ensure an emergency condition for high storm surge had not been entered the instruments for the water level in the Condensate Storage Tank were disabled, compelling the operators to re-align the core spray pumps to a less desirable source of makeup water to the reactor vessel the valve in the Reactor Water Cleanup System normally used to regulate water level inside the reactor vessel during shut down and low power conditions could not be used by the operators

27. The operators begin using the High Pressure Coolant Injection (HPCI) system in the pressure control mode. The HPCI turbine takes steam from the reactor vessel and discharges it to the suppression pool (a.k.a. torus). The HPCI pump draws water from the Condensate Storage Tank and returns it to the tank. 27 01-27-2015 04:12 am

28. 28 01-27-2015 9:36 am The operators started Core Spray pump B eight times between 9:36 am and 4:47 pm to control water level inside the reactor vessel. The Core Spray pumps are powered by large electric motors that require considerable power (torque) to start. The large flow of electric current to the motors during startup generates heat. The motor ‘s vendor recommended cool-off periods between successive motor starts to allow the heat to dissipate. Several of the pump starts violated the vendor’s recommendations for consecutive large motor starts.

29. 29 01-27-2015 9:36 am Each Core Spray pump at Pilgrim is designed to supply at least 3,300 gallons per minute of makeup flow to the reactor vessel. The operators were trying to control the water level over a 20- inch range. It takes about 200 inches of water to fill an inch inside the reactor vessel. Thus, a Core Spray pump only needed to run for about 70 seconds to fill 20 inches of the reactor vessel. Using a large Core Spray pump for such modest makeup is like filling a beverage glass using a fire hose. It works, but there are better ways to accomplish this task.

30. The operators turn off the HPCI system as the reactor pressure drops to about 120 pounds per square inch (from about 1,010 pounds per square inch at full power). Lower reactor pressures adversely affect the steam flow rate to the HPCI turbine, necessitating removing the system from service. 30 01-27-2015 09:48 am

31. The operators begin using the Reactor Core Isolation Cooling (RCIC) system in the pressure control mode. The RCIC turbine takes steam from the reactor vessel and discharges it to the suppression pool (a.k.a. torus). The RCIC pump draws water from the Condensate Storage Tank and returns it to the tank. The RCIC system is similar to the HPCI system, but about one-tenth the size. RCIC can operate down to about 50 pounds per square inch reactor pressure. 31 01-27-2015 09:48 am RCIC PUMP

32. 32 01-27-2015 09:50 am Within minutes of turning off the HPCI system, an alarm in the control room alerts the operators of a HPCI system problem. When HPCI operated, steam and non-condensible gases (e.g. air) leaking past the turbine shaft were collected by the gland seal condenser and exhausted via the Stand-by Gas Treatment System. With HPCI turned off, these materials were supposed to flow to the liquid waste system (not shown on the diagram). But the loss of instrument air closed the valves in this drain line. The condensed water instead poured from the gland seal condenser onto the HPCI room floor, covering it to a depth of over an inch.

33. The operator cycled Safety Relief Valve (SRV) D opened and closed to discharge some steam from the reactor vessel to the suppression pool to reduce the reactor pressure. Between 9:58 am and 1:16 pm, SRV D would be cycled 53 times. 33 01-27-2015 09:58 am

34. The operator attempted to cycle Safety Relief Valve (SRV) C opened and closed, but it failed to open. The plan was to sequentially cycle SRVs B, C, and D to control the reactor pressure. The operators did not want to cycle SRV due to its history of problems. 34 01-27-2015 10:15 am

35. 35 Safety Relief Valve Problems The NRC’s special inspection team determined that SRV A had failed to open three times during a very similar loss of offsite power event at Pilgrim on February 9, 2013. Following that event, the operators initiated a Condition Report to have maintenance workers check SRV A. The SRVs have thermocouples installed in the downstream piping to assist the operator determine whether the valves are open or closed (one of the post Three Mile Island safety upgrades ordered by the NRC.) Because SRV A had failed to open, its downstream thermocouple had not shown the temperature rise caused when steam flows by it. Workers assumed that SRV A had opened each time and that the thermocouple was bad. They replaced the thermocouple and closed the Condition Report. Pilgrim was restarted with SRV A (and SRV C) impaired.

36. The operator cycled SRV D opened and closed to discharge some steam from the reactor vessel to the suppression pool to reduce the reactor pressure. 36 01-27-2015 10:16 am

37. 37 01-27-2015 10:16 am Opening SRV D caused the reactor vessel water level to momentarily swell as lower pressure allowed more steam bubbles to form. The RCIC system automatically tripped on high water level inside the reactor vessel. The operators had been controlling the water level between 20 and 40 inches (denoted by the cyan rectangle in the diagram) and trying to maintain it at the high side of that band. The RCIC, HPCI and main turbines automatically trip at 45 inches as a precaution against water entering the Main Steam Line that supplies their steam. The Emergency Procedures allow the reactor water level to be maintained between 12 and 45 inches, with guidance to use the lower end of this band when SRVs are being used to control reactor pressure. The operators should not have tried to maintain the water level close to 40 inches when they were cycling SRVs to control the reactor pressure. Main Steam Line Reactor Core

38. 38 This chart shows the position of SRV F on the Unit 2 reactor at Fukushima Daiichi on March 11, 2011. It is a digital signal with 0 meaning closed and 1 indicating open. This chart shows the reactor pressure for the Unit 2 reactor at Fukushima Daiichi on March 11, 2011. As SRV F opened, the reactor pressure dropped. Decay heat from the reactor would cause the reactor pressure to increase until the SRV cycled again. As decay heat decreased, so did the frequency of SRV openings. This chart shows the reactor vessel water level for the Unit 2 reactor at Fukushima Daiichi on March 11, 2011. When SRV F opened, the water level momentarily spiked upward and returned to normal when SRV F closed.

39. The operator cycled SRV B opened and closed to discharge some steam from the reactor vessel to the suppression pool to reduce the reactor pressure. Between 10:16 am and 1:24 pm, SRV B would be cycled 52times., alternating use with SRV D. 39 01-27-2015 10:16 am

40. The operators restarted RCIC system in the pressure control mode. 40 01-27-2015 10:56 am RCIC PUMP

41. 41 01-27-2015 10:56 am The operator failed to open the cooling water supply valve, even through it is the second step in the procedure. As a result, the RCIC system operated for over 2 ½ hours without cooling water flow to its lubricating oil cooling and barometric condenser.

42. 42 RCIC System Problems The operators restarted the RCIC system but failed to open the valve that supplied cooling water to parts of the system, even though it was the second step in the procedure. Two minutes later, an alarm in the control room alerted the operators to a RCIC system problem. The response procedure for that alarm indicated that improper valve lineup was a likely cause. Yet the operator dispatched to the RCIC room failed to check the valve lineup and the closed cooling water valve. One hour and 59 minutes later – with RCIC still running without cooling water – another alarm sounded in the control room, once again pointing to a potential valve alignment error. Once again, the operator’s response to the alarm failed to notice that the cooling water valve was closed.

43. The operator opened SRV D and left it open until 5:04 pm to control reactor pressure. 43 01-27-2015 1:26 pm

44. The operators turned off the RCIC system. 44 01-27-2015 1:32 pm RCIC PUMP

45. 45 01-27-2015 4:26 pm Each Core Spray pump at Pilgrim is designed to supply at least 3,300 gallons per minute of makeup flow to the reactor vessel. The operators were trying to control the water level over a 20- inch range. Each inch of level inside the reactor vessel requires about 200 inches of water to fill. Thus, a Core Spray pump need only run for about 70 seconds to fill 20 inches of the reactor vessel. Using a large Core Spray pump for such modest makeup needs is like using a fire house to fill a glass. It works, but there are better ways to accomplish this task.

46. 46 01-27-2015 4:26 pm The operators established shutdown cooling mode with Residual Heat Removal Loop B. The RHR pumps took water from one of the recirculation piping loops, routed it through a heat exchanger for cooling and returned the cooled water to the reactor vessel via the recirculation loop piping.

47. 47 01-27-2015 4:57 pm The reactor water temperature was reduced below 212°F.

48. Line 342 was restored to service at 4:07 pm. At 4:35 pm, electrical breaker 103 was closed to supply power to the Start-up Transformer. By 5:05 pm, breakers had been closed to re-energize non- safety buses A1, A2, A3, and A4 from offsite power. Safety buses A5 and A6 continued to be supplied power from the emergency diesel generators. 48 01-29-2015 5:05 pm

49. Workers transferred safety bus A5 from emergency diesel generator A to the Start-up Transformer. Emergency diesel generator A was shut down by 7:44 pm. 49 01-29-2015 7:00 pm

50. Line 355 was restored to service and electrical breaker 102 closed to achieve the normal switchyard configuration for the shut down plant. 50 01-30-2015 6:45 pm

51. 51 01-31-2015 1:30 am Workers transferred safety bus A6 from emergency diesel generator B to the Start-up Transformer. Emergency diesel generator B was shut down by 1:51 am.

52. 52 Safety Violations The NRC’s Special Inspection Team identified eight violations of safety requirements during its investigation into the January 27, 2015, event: GREEN finding for failure to properly test the diesel- driven air compressor, contributing to its failure to start during this event GREEN finding for initially determining that SRV C, despite having twice failed to open at low reactor pressure, was okay because it would likely open at higher reactor pressure Preliminary WHITE finding for inadequate corrective actions following failure of SRV A to open, three times, during a shut down on February 9, 2013, contributing to the failure of SRV C to open during this event

53. 53 Safety Violations (continued) GREEN finding for inadequate training and procedures for the operators’ response to loss of instrument air GREEN finding for failure to follow procedures by restarting the RCIC system without opening a cooling water valve and twice failing to notice the improperly closed valve when responding to system alarms GREEN finding for failure to properly evaluate and remedy a problem involving keeping the emergency makeup system piping filled with water (not described in the earlier slides) GREEN finding for inadequate emergency response procedures; specifically, the loss of instrument air disabled the sea level monitoring instruments leaving operators unable to ensure that the storm surge steps in the emergency procedures need not be taken

54. 54 Safety Violations (continued) Severity Level IV finding for failure to report to the NRC that portions of the emergency plan could not be implemented due to loss of sea level monitoring capability