From: John De Armond
Newsgroups: sci.energy
Subject: Re: AP Wire Story on Japan Reactor
Keywords: Nuclear Power, ECCS Systems
Message-ID: <s0hp3zn@dixie.com>
Date: 9 Oct 92 04:11:15 GMT

sxb@fermi.cray.com (Stephen Behling) writes:

>  Another point about ECCS actuation in BWRs...they do not run with borated
>water (or the stuff would plate out on the fuel rods).  The ECCS system is
>borated, so if it does get accuated, the boron would have to be flushed out
>before normal operation could be resumed.  This could cause operators to
>try other recovery techniques before ECCS is activated. [Note, I have no
>knowledge about the actual plant technical specification and procedures
>in this area.]

Here's the rundown on the reactor protection system.  GE came about as
close to a standardized design as any so most plants adhere to this
scheme.

The borated water system you speak of is known as the Standby Liquid
Control system and is the last ditch system that would be used only
in extreme emergencies.  As the inside joke used to go, when the
SLC button is pushed it also drops a ticket to the local concrete
vendor to start hauling in the concrete to fill in the reactor.

The first system is called the HPSI (prounounced Hipsy) system.
This consists of a pair of steam driven pumps located inside the
secondary containment.  The steam comes from the reactor.  The pump
takes suction from the torus (MkIII) or supression pool (MkIV) and
injects the water on top of the core.  Anything that actuates the
ECCS also causes a containment isolation so the excess steam flows
from the reactor to the torus/supression pool and forms a closed loop.
The system is actuated when power is dropped to a fail-to-open valve on the
steam line.  The pump runs until the steam runs out.  At that point
the LPSI (Lipsy) system takes over.  One pump is typically steam driven
and the others are electric.  They operate the same as the HPSI except
they are higher volume, lower pressure pumps.

If the LOCA is so severe that all reactor pressure is gone, the Core
Spray system takes over cooling.  This consists of several multi-thousand
horsepower electric pumps that take suction from the torus/supression
pool and pumps into a sparger header inside the reactor and over
the core.  All these systems can be reconfigured to take suction from
the condensate system or the river.

I've heard nothing more about the particulars of the incident in question.
I still can't imagine what an operator could do that fits even some
reasonable interpretation of the "facts".  Since almost any SCRAM in
a GE reactor causes containment isolation and thus activates the ECCS,
the incident could have been as minor as a technician bouncing a reactor
level transmitter.  This is a common occurance because the trip setpoints
are close to the operating points.  A physical jar or even the act of
valving one of the 4 transmitters out for calibration can jog the other
three into generating a SCRAM.

The way the reactor protection system works in a BWR is the "one
out of two taken twice" concept.  That is, there are 4 channels
of reactor protection organized into two trains of redundant
pairs.  A single trip from each train causes a half-scram.  Any
trip  on the other channel causes a full scram.  So for example,
a reactor water level transmitter can half-scram Train A and
then something as innocuous as putting a channel of Train B in
calibration mode (generates an automatic half-scram) would trip
the reactor.  Operators work REAL hard to minimize the state of
half-scram :-)

John

Newsgroups: sci.energy
From: John De Armond
Subject: Re: Another NUKE bites the dust ...
Message-ID: <nbfp49f@dixie.com>
Date: Tue, 06 Oct 92 08:59:25 GMT

ems@michael.apple.com (E. Michael Smith) writes:

>From the Oct 1 San Jose Murkey News, page 14A, dateline TOKYO (AP)

>Quoted without permission:
>*** BEGIN EXCERPTED QUOTE ***  (elipsis ... denote deletions)
>JAPANESE PLANT BARELY AVERTS CORE MELTDOWN
>*** END QUOTED MATERIAL ***		(thankfully)

>There you have it.  All the things that cause one pause about
>a nuclear plant in the back yard.

>One guy makes a mistake, and per the article, the plant is one system
>away from a meltdown.  Then the folks who are in charge don't bother
>to tell the public for the better part of a day...

>The article may be wrong, but that type of article is why the non-nukers
>take a bit of a circumspect view of a nuke in every village ...


Funny reaction, Mike.  Based on what you've heard from us on the net,
your instinct SHOULD have been to wonder just how inaccurate the news
report was.  Frankly I've not seen worse reporting since TMI.

I really have no idea what happened.  The "facts" presented fit nothing
I know about a nuclear plant.  Japan is a big fan of Westinghouse so
it almost surely was a Big W unit.  I'll call a friend at INPO
tomorrow and see what I can find out.

I don't even know where to start taking this one apart.  Let's see.
No way I know of for an operator to dummy in a false permissive.
A technician could by manipulating wires, but only after clearing some access
control points that are opened only under procedural control.  Don't know
what "plant's cooling pumps" are.  Maybe the reactor coolant circulating
pumps?  Tripping these would cause a routine ECCS (Emergency Core Cooling
System) activation.  Nothing in the CVCC or makeup system, the only
other systems communicating with the primary during normal operation,
could do it.  In the distorted media's sense of how things work,
it MIGHT have been a secondary feedwater pump trip.  Kinda seems likely
now that I think of it.

Some background.  Assume a Westinghouse PWR.  The concept of Defence in
Depth dictates there be multiple heat sinks for the reactor.  The NORMAL
heat sink is the turbine and/or condenser. Heat flows through the primary
system, boils water in the secondary system and steam carries heat out
of the containment.  If the turbine trips, steam is routed directly
to the condenser in what is known as bypass mode.  The turbine/condenser
is also the ONLY NORMAL heat sink during shutdown.  The normal shutdown
mode is to trip the reactor (and because some obscurities from TMI Lessons
Learned, also the turbine) and bypass steam to the condenser.  The
reactor coolant pumps (RCP)(devices that circulate coolant from the reactor
to the steam generators) are left on.  They input about 10 MWT in pumping
loss and the reactor inputs another 100 MWt or so dropping rapidly
to about 10 MWt 10 minutes after rod insertion.  As the energy content
in the primary drops, both the primary pressure and the steam pressure
drop.  At some predeterminad point the RCPs are stopped.  When the
primary pressure reaches about 400 psi (from a normal 2250 psi), the steam
dump is secured and the Residual Heat Removal (RHR) system is activated.
This takes the reactor to cold shutdown and continuously removes decay
heat.

The only part of the above chain that is considered safety-related is
the RHR system.  Feedwater is not, RCPs are not (though there's been talk
about making RCPs safety-related.)

If the main heatsink is gone (feedwater pumps off, condenser unavailable,
etc), then the aux feedwater pumps, which are safety-related, start.
Any of these pumps, typically 3 - two electric and one steam driven -
can supply enough feedwater to remove shutdown heat.  THe steam is simply
dumped to the atmosphere (non-radioactive) via the atmospheric dumps.

IF the feedwater pumps trip or something else causes loss of
normal heatsink, (what I SUSPECT happened here), the pressure
and temperature spike in the primary system will cause the
Emergency Core Cooling System to activate.  ECCS is fired on
high or low pressurizer level, high rate of change of
pressurizer level, low reactor coolant temperature, low primary
pressure and a few other things I cannot remember.  The first
line of defence in the ECCS is the  Safety Injection System
(SIS).  This consists of multiple redundant high pressure, high
flow (hundreds of GPM) centrifugal pumps capable of pumping into
the full reactor pressure head.  Another pump, a high pressure
positive displacement pump called the Charging Pump, is pressed
into emergency service.  This pump is run on high speed to
deliver  about 100 GPM and is capable of up to about 5000 psi
service.

The typical procedure is for the operator to determine what caused
the ECCS actuation and then shut down those parts not needed.  The
Charging Pump can supply enough water for small break LOCAs (like
TMI) while the SIS can supply enough flow to cool the reactor during
the magical, mythical double-ended guillotine break.  Both SIS and CP
can be aligned to take suction from a number of sources.  The normal
source is the CVCC (chemical and volume control) storage tank that
contains heated, borated water.  When that is empty, suction is switched
to the reactor building sump for recirculation mode.  If that fails,
the condensate storage tank, used to hold deionized water for the
steam side, can be sourced.  About 2 million gallons worth.  If that fails,
then the pumps can draw from river water.

If the break/leak is large enough the SIS cannot maintain head, when the
pressure drops to about 400 psi, the RHR system can be switched in for
emergency mode.  These pumps take suction from the same places in
the same sequence.

If the break is large enough that the pressure does drop, the next
line of defence is the passive accumulator system.  this constists of
nothing more than a couple of 50,000 gallon tanks filled with borated
water and pressurized to about 2000 psi under  nitrogen.  they are
connected to but separated from the reactor system by checkvalves.
When the pressure drops, the checkvalves open and the contents dump into
the reactor.

So far we have three layers of protection, the SIS, the accumulators
and the RHR.  I've not mentioned the Component Cooling System which has
an emergency cooling mode.  Couple more I can't recall the names of.

My best guess is the operator did something to trip the feedwater pumps
which caused a semi-routine ECCS activation.  They determined what
caused it and secured it.  What we'd have called a "Green Book Event"
at Sequoyah.  (named because of the succession from white (normal),
green (not normal), yellow (serious), and red (head for the hills))

Claiming the core was one system away from a meltdown is like saying
that after someone pulls out in front of you and you use your brakes
normally to slow down, you then say you were one brake application
away from death.

[Editorial mode on]

Mike, I know you like to post ridiculous stuff just to stir
shit.  Is this one of those occasions?  I hope you're not stupid
enough to take seriously what you posted, as indicated in your
trailer.  Whatever, I've had enough.  I've typed my last
multipage treatise to try to counter this ignorance.  It's
futile.  (Using "you" collectively now) You'll believe this kind of
shit for the same reason you'll read and believe the National
Enquirer. You want to find a Martian around every corner and a
conspiracy under every rock.  So be it. I'm going to leave it to
you to get your nuclear info from the likes of Yackadamn.  He's
the arm-chair expert, after all.  I don't care anymore.  I've
been out of the business for almost a decade and I've nothing to
lose or gain either way.  I make enough money and am crafty
enough that I don't have to worry about energy costs. If there's
any energy to be had, I'll have what I need.  If you want to
spend your time installing CFs and packing cracks and such
because you can't afford your power rate, that's fine with me.
We of the industry did our dead-level best to give you power
that approached that ideal of being too cheap to meter.  We have an
unblemished safety record (yes, even TMI was a safety success of the
first order) and yet you rejected it, perferring to fear things that
don't EVEN go BUMP in the night. You get what you deserve.

I once had a plant manager tell me "If the public wants us to burn cow
shit at a dollar a KWH, we'll do it.  No more fighting. I get paid the same
regardless."  My attitude exactly.

AMF,
John