UCS Blog - All Things Nuclear (Nuclear Power Safety)

Trump Administration Blocks Government Scientists from Attending International Meeting on Nuclear Power

The Trump administration has barred the participation of US government technical experts on nuclear energy from attending a major international conference in Russia.The conference, co-sponsored by the International Atomic Energy Agency (IAEA) and ROSATOM, the Russia state atomic energy corporation, began today in the city of Ekaterinburg.

Preventing US government scientists from delivering scheduled talks at an IAEA conference is highly unusual. This decision is apparently a consequence of the deteriorating relationship between the US and Russia. I learned about this when I arrived at the conference today to find that I was one of only a handful of US participants, out of several hundred attendees.

With so many communication channels between the U.S. and Russia now cut off, it is essential to preserve scientific cooperation in areas where there is common ground between the two countries. The Trump administration’s action is inconsistent with this goal.

Nuclear Leaks: The Back Story the NRC Doesn’t Want You to Know about Palo Verde

As described in a recent All Things Nuclear commentary, one of two emergency diesel generators (EDGs) for the Unit 3 reactor at the Palo Verde Nuclear Generation Station in Arizona was severely damaged during a test run on December 15, 2016. The operating license issued by the Nuclear Regulatory Commission (NRC) allowed the reactor to continue running for up to 10 days with one EDG out of service. Because the extensive damage required far longer than 10 days to repair, the owner asked the NRC for permission to continue operating Unit 3 for up to 62 days with only one EDG available. The NRC approved that request.

Around May 18, 2017, I received an envelope in the mail containing internal NRC documents with the back story for this EDG saga. I submitted a request under the Freedom of Information Act (FOIA) for these materials, but the NRC informed me that they could not release the documents because the matter was still under review by the agency. I asked the NRC’s Office of Public Affairs for a rough estimate of when the agency would conclude its review and release the documents. I was told that their review of the safety issues raised in the documents wasn’t a priority for the NRC and they’d get to it when they got to it.

Well, nuclear safety is a priority for me at UCS. And since I already have the documents, I don’t need to wait for the NRC to get around to concluding its stonewalling— I mean “review”—of the issues.  Here is the back story the NRC does not want you to know about the busted EDG at Palo Verde.

Emergency Diesel Generator Safety Role

The NRC issued the operating license for Palo Verde Unit 3 on November 25, 1987. That initial operating license allowed Unit 3 to continue running for up to 72 hours with one of its two EDGs out of service. Called the “allowable outage time,” the 72 hours balanced the safety need to have a reliable backup power supply with the need to periodically test the EDGs and perform routine maintenance.

The EDGs are among the most important safety equipment at nuclear power plants like Palo Verde. The March 2011 accident at Fukushima Daiichi tragically demonstrated this vital role. A large earthquake knocked out the electrical power grid to which Fukushima Daiichi’s operating reactors were connected. Power was lost to the pumps providing cooling water to the reactor vessels, but the EDGs automatically started and took over this role. About 45 minutes later, a tsunami wave spawned by the earthquake inundated the site and flooded the rooms housing the EDGs. With both the normal and backup power supplies unavailable, workers could only supply makeup cooling water using battery-powered systems and portable generators. They fought a heroic but futile battle and all three reactors operating at the time suffered meltdowns.

More EDG Allowable Outage Time

On December 23, 2005, the owner of Palo Verde submitted a request to the NRC seeking to extend the allowable outage time for an EDG to be out of service to 10 days from 72 hours. Longer EDG allowable outage times were being sought by nuclear plant owners. Originally, nuclear power reactors shut down every year for refueling. The refueling outages provided ample time to conduct the routine testing and inspection tasks required for the EDGs. To boost electrical output (and hence revenue), owners transitioned to only refueling reactors every 18 or 24 months and to shorten the duration of the refueling outages. To facilitate the transitions, more and more testing and inspections previously performed during refueling outages were being conducted with the reactors operating. The argument supporting online maintenance was that while it adversely affected availability (i.e., an EDG was deliberately removed from service for testing and inspecting), the increased reliability (i.e., tests to confirm EDGs were operable were conducted every few weeks instead of spot checks every 18 to 24 months). The NRC approved the amendment to the operating licenses extending the EDG allowable outage times to 10 days on December 5, 2006.

More NRC/Industry Efforts on Allowable Outage Times

While the EDGs have important safety roles to play, they are not the only safety role players. The operating license for a nuclear power reactor covers dozens of components, each with its own allowable outage time. Around the time that longer EDG allowable outage times were sought and obtained at Palo Verde, the nuclear industry and the NRC were working on protocols to make proper decisions about allowable outage times for various safety components. On behalf of the nuclear industry, the Nuclear Energy Institute submitted guidance document NEI 06-09 to the NRC. On May 17, 2007, the NRC issued its safety evaluation report documenting its endorsement of NEI-06-09 along with its qualifications for that endorsement.

To create yet another acronym for no apparent reason, the nuclear industry and NRC conjured up Risk Informed Completion Time (RICT) to use in place of allowable outage time (AOT). The NRC explicitly endorsed a 30-day limit on RICTs (AOTs):

“The RICT is further limited to a deterministic maximum of 30 days (referred to as the backstop CT [completion time] from the time the TS [technical specification or operating license requirement] was first entered.”

The NRC explained why the 30-day maximum limit was necessary:

“The 30-day backstop CT assures that the TS equipment is not out of service for extended periods, and is a reasonable upper limit to permit repairs and restoration of equipment to an operable status.”

NEI 06-09 and the NRC’s safety evaluation applied to all components within a nuclear power reactor’s operating license. The 30-day backstop limit was the longest AOT (RICT) permitted. Shorter RICTs (AOTs) might apply for components with especially vital safety roles.

For example, the NRC established more limiting AOTs (RICTs) for the EDGs. In February 2002, the NRC issued Branch Technical Position 8-8, “Onsite (Emergency Diesel Generators) and Offsite Power Sources Allowed Outage Time Extensions.” This Branch Technical Position is part of the NRC’s Standard Review Plan for operating reactors. The Standard Review Plan helps plant owners meet NRC’s expectations and NRC reviewers and inspectors verify that expectations have been met. The Branch Technical Position is quite clear about the EDG allowable outage time limit:

“An EDG or offsite power AOT license amendment of more than 14 days should not be considered by the staff for review.” [underlining in original]

Exceptions and Precedent

Consistent with the “every rule has its exception” cliché, neither the 14-day EDG AOT in NRC Branch Technical Position 8-8 nor the 30-day backstop limit in the NRC’s safety evaluation for NEI 06-09 are considered hard and fast limits. Owners can, and do, request NRC’s permission for longer times under special circumstances.

The owner of the DC Cook nuclear plant in Michigan asked the NRC on May 28, 2015, for permission to operate the Unit 1 reactor for up to 65 days with one of its two EDGs out of service. The operating licensee for Unit 1 already allowed one EDG to be out of service for up to 14 days. During testing of an EDG on May 21, 2015, inadequate lubrication caused one of the bearings to be severely damaged. Repairs were estimated to require 56 days.

The NRC emailed the owner questions about the 65-day EDG AOT on May 28 and May 29. Among the questions asked by the NRC was how Unit 1 would respond to a design basis loss of coolant accident (LOCA) concurrent with a loss of offsite power (LOOP) and a single failure of the only EDG in service. The EDGs are designed to automatically start from the standby mode and deliver electricity to safety components within seconds. This rapid response is needed to ensure the reactor core is cooled should a broken pipe (i.e., LOCA) drain cooling water should electrical power to the makeup pumps not be available (i.e., LOOP). The single failure provision is an inherent element of the redundancy and defense-in-depth approach to nuclear safety.

The NRC did not approve the request for a 65-day EDG AOT for Cook Unit 1.

The NRC did not deny the request either.

On June 1, 2015, the owner formally withdrew its request for the 65-day EDG AOT and shut down the Unit 1 reactor. The Unit 1 reactor was restarted on July 29, 2015.

More on the Back Story

About 18 months after one of two EDGs for the Unit 1 reactor at DC Cook was severely damaged during a test run, one of two EDGs for the Unit 3 reactor at Palo Verde was severely damaged during a test run.

About 18 months after DC Cook’s owner requested permission from the NRC to continue running Unit 1 for up to 65 days with only one EDG in service, Palo Verde’s owner requested permission to continue running Unit 3 for up to 62 days.

About 18 months after the NRC staff asked DC Cook’s owner how Unit 1 would respond to a loss of coolant accident concurrent with a loss of offsite power and failure of the remaining EDG, the NRC staff merely assumed that a loss of coolant accident would not happen during the 62 days that Palo Verde Unit 3 ran with only one EDG in service. Enter the back story as reported by the Arizona Republic.

On December 23, 2016, and January 9, 2017, Differing Professional Opinions (DPOs) were initiated by member(s) of the NRC staff registering formal disagreement with NRC senior management’s plan to allow the 62-day EDG AOT for Palo Verde Unit 3. The initiator(s) checked a box on the DPO form to have the DPO case file be made publicly available (Fig. 1).

Fig. 1 (Source: United States Postal Service)

The DPO initiator(s) allege that the 62-day EDG AOT was approved by the NRC because the agency assumed that a loss of coolant accident simply would not happen. The DPO stated:

“The NRC and licensee ignored the loss of coolant accident (LOCA) consequence element. Longer outage times increase the vulnerability to a design basis accident involving a LOCA with the loss of offsite power (LOOP) event with a failure of Train A equipment.”

Palo Verde has two fully redundant sets of safety equipment, Trains A and B. The broken EDG provided electrical power (when unbroken) to Train B equipment. The 62-day EDG AOT was approved based on workers scurrying about to manually start combustible gas turbines and portable generators to provide electrical power that would otherwise be supplied by EDG 3B. The DPO stated:

“The Train B EDG auto starts and loads all safety equipment in 40 seconds. The manual actions take at least 20 minutes, if not significantly longer.”

Again, the rapid response is required to mitigate a loss of coolant accident that drains water from the reactor vessel. When water does not drain away, it takes time for the reactor core’s decay heat to warm up and boil away the reactor vessel’s water, justifying a slower response time.

The NRC staff considered a loss of coolant accident for the broken EDG at Cook but allegedly dismissed it at Palo Verde. Curious.

The DPO also disparaged the non-routine measures undertaken by the NRC to hide their deliberations from the public:

“The pre-submittal call occurred on a “non-recorded” [telephone] line. The NRC staff debated the merits of the call in a headquarters staff only discussion. Note that the Notice of Enforcement Discretion calls are done on recorded [telephone] lines.”

President Richard Nixon’s downfall occurred when it become known that tape recordings of his impeachable offenses existed. The NRC avoided this trap by deliberately not following their routine practice of recording the telephone discussions. Peachy!

Cognitive Dissonance or Unnatural Selection?

The NRC’s approval of the 62-day EDG AOT for Palo Verde Unit 3 is perplexing, at best.

In the amendment it issued January 4, 2017, approving the extension, the NRC wrote:

“Offsite power sources and one train of onsite power source would continue to be available for the scenario of a loss-of-coolant accident” while EDG 3B was out of service.

In other words, the NRC assumed that loss of offsite power (LOOP) and loss of coolant accident (LOCA) are separate events. The NRC assumed that if a LOCA occurred, electrical power from the offsite grid would enable safety equipment to refill the reactor vessel and prevent meltdown. And the NRC assumed that if a LOOP occurred, a LOCA would not drain water from the reactor vessel, giving workers time to find, deploy, and start up the portable equipment and prevent core overheating.

But in the amendment it issued December 5, 2006, establishing the 10-day EDG AOT, the NRC wrote:

“During plant operation with both EDGs operable, if a LOOP occurs, the ESF [engineered safeguards] electrical loads are automatically and sequentially loaded to the EDGs in sufficient time to provide for safe reactor shutdown or to mitigate the consequences of a design-basis accident (DBA) such as a loss-of-coolant accident (LOCA).”

In those words, the NRC assumed that LOOP and LOCA could occur concurrently in design basis space.

More importantly, page B 3.8.1-2 of the bases document dated May 12, 2016, for the Palo Verde operating licenses is quite explicit about the LOOP/LOCA relationship:

“In the event of a loss of preferred power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a loss of coolant accident (LOCA).”

In those words, the operating licenses issued the NRC assumed that LOOP and LOCA could occur concurrently in design basis space.

So, the NRC either experienced cognitive dissonance in having two opposing viewpoints on the same issue or made the unnatural selection of LOCA without LOOP.

Actions May Speak Louder Than Words, But Inaction Shouts Loudest

Check out this chronology:

  • December 15, 2016: EDG 3B for Palo Verde Unit 3 failed catastrophically during a test run
  • December 21, 2016: Owner requested 21-day EDG AOT
  • December 23 2016: NRC approved 21-day EDG AOT
  • December 23, 2016: DPO submitted opposing 21-day EDG AOT
  • December 30, 2016: Owner requested 62-day EDG AOT
  • January 4, 2017: NRC approved 62-day EDG AOT
  • January 9, 2017: DPO submitted opposing 62-day EDG AOT
  • February 6, 2017: NRC special inspection team arrived at Palo Verde to examine EDG’s failure cause
  • February 10, 2017: NRC special inspection team concluded its onsite examinations
  • April 10, 2017: NRC issued special inspection team report

The NRC jumped through hoops during the Christmas and New Year’s holidays to expeditiously approve a request to allow Unit 3 to continue generating revenue.

The NRC has not yet responded to two DPOs questioning the safety rationale behind the NRC’s approval.

If the NRC really and truly had a solid basis for letting Palo Verde Unit 3 run for so long with only one EDG, they have had plenty of time to address the issues raised in the DPOs. Way more than 62 days, in fact.

William Shakespeare wrote about something rotten in Denmark.

The bard never traveled to Rockville to visit the NRC’s headquarters. Had he done so, he might have discovered that rottenness is not confined to Denmark.

Oyster Creek Reactor: Bad Nuclear Vibrations

The Oyster Creek Nuclear Generating Station near Forked River, New Jersey is the oldest nuclear power plant operating in the United States. It began operating in 1969 around the time Neil Armstrong and Buzz Aldrin were hiking the lunar landscape.

Oyster Creek has a boiling water reactor (BWR) with a Mark I containment design, similar to the Unit 1 reactor at Fukushima Daiichi. Water entering the reactor vessel is heated to the boiling point by the energy released by the nuclear chain reaction within the core (see Figure 1). The steam flows through pipes from the reactor vessel to the turbines. The steam spins the turbines connected to the generator that produces electricity distributed by the offsite power grid. Steam discharged from the turbines flows into the condenser where it is cooled by water drawn from the Atlantic Ocean, or Barnegat Bay. The steam vapor is converted back into liquid form. Condensate and feedwater pumps supply the water collected in the condenser to the reactor vessel to repeat the cycle.

Fig. 1 (Source: Tennessee Valley Authority)

The turbine is actually a set of four turbines—one high pressure turbine (HPT) and three low pressure turbines (LPTs). The steam passes through the high pressure turbine and then enters the moisture separators. The moisture separators remove any water droplets that may have formed during the steam’s passage through the high pressure turbine. The steam leaving the moisture separators then flows in parallel through the three low pressure turbines.

The control system for the turbine uses the speed of the turbine shaft (normally 1,800 revolutions per minute) and the pressure of the steam entering the turbine (typically around 940 pounds per square inch) to regulate the position of control valves (CVs) in the steam pipes to the high pressure turbine. If the turbine speed drops or the inlet pressure rises, the control system opens the control valves a bit to bring these parameters back to their desired values. Conversely, if the turbine speed increases or the inlet pressure drops, the control system signals the control valves to close a tad to restore the proper conditions. It has been said that the turbine is slave to the reactor—if the reactor power level increases or decreases, the turbine control system automatically repositions the control valves to correspond to the changed steam flow rate.

The inlet pressure is monitored by Pressure Transmitters (PT) that send signals to the Electro-Hydraulic Control (EHC) system. The EHC system derives its name from the fact that it uses electrical inputs (e.g, inlet pressure, turbine speed, desired speed, desired inlet pressure, etc.) to regulate the oil pressure in the hydraulic system that positions the valves.

Fig. 2 (Source: Nuclear Regulatory Commission)

Bad Vibrations

In the early morning hours of November 20, 2016, the operators at Oyster Creek were conducting the quarterly test of the turbine control system. With the reactor at 95 percent power, the operator depressed a test pushbutton at 3:26 am per the procedure. The plant’s response was unexpected. The positions of the control valves and bypass valves began opening and closing small amounts causing the reactor pressure to fluctuate. Workers in the turbine building notified the control room operators that the linkages to the valves were vibrating. The operators began reducing the reactor power level in an attempt to stop the vibrations and pressure fluctuations.

The reactor automatically shut down at 3:42 pm from 92 percent power on high neutron flux in the reactor. Workers later found the linkage for control valve #2 had broken due to the vibrations and the linkage for control valve #4 had vibrated loose. The linkages are “mechanical arms” that enable the turbine control system to reposition the valves. The broken and loosened linkages impaired the ability of the control system to properly reposition the valves.

These mechanical malfunctions prevented the EHC system from properly controlling reactor pressure during the test and subsequent power reduction. The pressure inside the reactor vessel increased. In a BWR, reactor pressure increases collapse and shrink steam bubbles. Displacing steam void spaces with water increases the reactor power level. When atoms split to release energy, they also release neutrons. The neutrons can interact with other atoms to causing them to split. Water is much better than steam bubbles at slower down the neutrons to the range where the neutrons best interact with atoms. Put another way, the steam bubbles permit high energy neutrons to speed away from the fuel and get captured by non-fuel parts within the reactor vessel while the water better confines the neutrons to the fuel region.

The EHC system’s problem allowed the pressure inside the reactor vessel to increase. The higher pressure collapsed steam bubbles, increasing the reactor power level. As the reactor power level increased, more neutrons scurried about as more and more atoms split. The neutron monitoring system detected the increasing inventory of neutrons and initiated the automatic shut down of the reactor to avoid excessive power and fuel damage.

Workers attributed the vibrations to a design flaw. A component in the EHC system is specifically designed to dampen vibrations in the tubing providing hydraulic fluid to the linkages governing valve positions. But under certain conditions, depressing the test pushbutton creates a pressure pulse on that component. Instead of dampening the pressure piles, the component reacts in a way that causes the hydraulic system pressure to oscillate, creating the vibrations that damaged the linkages.

The component and damaged linkages were replaced. In addition, the test procedure was revised to avoid performing that specific portion of the test when the reactor is operating. In the future, that part of the turbine valve test will be performed during an outage.

Vibrations Re-Visited

It was not the first time that Oyster Creek was shut down due to problems performing this test. It wasn’t even the first time this decade.

On December 14, 2013, operators conducted the quarterly test of the turbine control system at 95 percent power. They encountered unanticipated valve responses and reactor pressure changes during the test. The operators manually shut down the reactor as reactor pressure rose towards the automatic shut down setpoint.

Improper assembly of components in the EHC system and vibrations that caused them to come apart resulted in control valves #2 and #3 closing. Their closure increased the pressure within the reactor pressure, leading the operators to manually shut down the reactor before it automatically scrammed.

The faulty parts were replaced.

Bad Vibrations at a Good Time

If every test was always successful, there would be little value derived by the testing program.

Similarly, if every test was seldom successful, there would be little value from the testing program.

Tests that occasionally are unsuccessful have value.

First, they reveal things that need to be fixed

Second, they provide insights on the reliability of the items being tested. (I suppose tests that always fail also yield insights about reliability, so I should qualify this statement to say they provide useful and meaningful insights about reliability.)

Third, they occur during a test rather than when needed to prevent or mitigate an accident. Accidents may reveal more insights than those revealed by test failures. But the cost per insight is a better deal with test failures.

Increase in Cancer Risk for Japanese Workers Accidentally Exposed to Plutonium

According to news reports, five workers were accidentally exposed to high levels of radiation at the Oarai nuclear research and development center in Tokai-mura, Japan on June 6th. The Japan Atomic Energy Agency, the operator of the facility, reported that five workers inhaled plutonium and americium that was released from a storage container that the workers had opened. The radioactive materials were contained in two plastic bags, but they had apparently ripped.

We wish to express our sympathy for the victims of this accident.

This incident is a reminder of the extremely hazardous nature of these materials, especially when they are inhaled, and illustrates why they require such stringent procedures when they are stored and processed.

According to the earliest reports, it was estimated that one worker had inhaled 22,000 becquerels (Bq) of plutonium-239, and 220 Bq of americium-241. (One becquerel of a radioactive substance undergoes one radioactive decay per second.) The others inhaled between 2,200 and 14,000 Bq of plutonium-239 and quantities of americium-241 similar to that of the first worker.

More recent reports have stated that the amount of plutonium inhaled by the most highly exposed worker is now estimated to be 360,000 Bq, and that the 22,000 Bq measurement in the lungs was made 10 hours after the event occurred. Apparently, the plutonium that remains in the body decreases rapidly during the first hours after exposure, as a fraction of the quantity initially inhaled is expelled through respiration. But there are large uncertainties.

The mass equivalent of 360,000 Bq of Pu-239 is about 150 micrograms. It is commonly heard that plutonium is so radiotoxic that inhaling only one microgram will cause cancer with essentially one hundred percent certainty. This is not far off the mark for certain isotopes of plutonium, like Pu-238, but Pu-239 decays more slowly, so it is less toxic per gram.  The actual level of harm also depends on a number of other factors. Estimating the health impacts of these exposures in the absence of more information is tricky, because those impacts depend on the exact composition of the radioactive materials, their chemical forms, and the sizes of the particles that were inhaled. Smaller particles become more deeply lodged in the lungs and are harder to clear by coughing. And more soluble compounds will dissolve more readily in the bloodstream and be transported from the lungs to other organs, resulting in exposure of more of the body to radiation. However, it is possible to make a rough estimate.

Using Department of Energy data, the inhalation of 360,000 Bq of Pu-239 would result in a whole-body radiation dose to an average adult over a 50-year period between 580 rem and nearly 4300 rem, depending on the solubility of the compounds inhaled. The material was most likely an oxide, which is relatively insoluble, corresponding to the lower bound of the estimate. But without further information on the material form, the best estimate would be around 1800 rem.

What is the health impact of such a dose? For isotopes such as plutonium-239 or americium-241, which emit relatively large, heavy charged particles known as alpha particles, there is a high likelihood that a dose of around 1000 rem will cause a fatal cancer. This is well below the radiation dose that the most highly exposed worker will receive over a 50-year period. This shows how costly a mistake can be when working with plutonium.

The workers are receiving chelation therapy to try to remove some plutonium from their bloodstream. However, the effectiveness of this therapy is limited at best, especially for insoluble forms, like oxides, that tend to be retained in the lungs.

The workers were exposed when they opened up an old storage can that held materials related to production of fuel from fast reactors. The plutonium facilities at Tokai-mura have been used to produce plutonium-uranium mixed-oxide (MOX) fuel for experimental test reactors, including the Joyo fast reactor, as well as the now-shutdown Monju fast reactor. Americium-241 was present as the result of the decay of the isotope plutonium-241.

I had the opportunity to tour some of these facilities about twenty years ago. MOX fuel fabrication at these facilities was primarily done in gloveboxes through manual means, and we were able to stand next to gloveboxes containing MOX pellets. The gloveboxes represented the only barrier between us and the plutonium they contained. In light of the incident this week, that is a sobering memory.

Palo Verde: Running Without a Backup Power Supply

The Arizona Public Service Company’s Palo Verde Generating Station about 60 miles west of Phoenix has three Combustion Engineering pressurized water reactors that began operating in the mid 1980s. In the early morning hours of Thursday, December 15, 2016, workers started one of two emergency diesel generators (EDGs) on the Unit 3 reactor for a routine test. The EDGs are the third tier of electrical power to emergency equipment for Unit 3.

When the unit is operating, the source of power is the electricity produced by the main generator (labeled A in Figure 1.) The electricity flows through the Main Transformer to the switchyard and offsite power grid and also flows through the Unit Auxiliary Transformer to in-plant equipment. If the unit is not operating, electrical power flows from the offsite power grid through the Startup Transformer (B) to in-plant equipment. When the main generator is offline and power from the offsite power grid is unavailable, the EDGs (C) step in to provide electrical power to a subset of in-plant equipment—the emergency equipment needed to protect the reactor core and minimize release of radioactivity to the environment. An additional backup power source exists at Palo Verde in the form of gas turbine generators (D) that can supply power to any of the three units.

Fig. 1 (Source: Arizona Public Service Company)

I toured the Palo Verde site on May 11, 2016. The tour included one of EDG rooms on Unit 2 as shown in Figure 2. Each unit at Palo Verde has two EDGs. The EDG being tested on December 15, 2016, was manufactured in 1981 and was a Cooper Bessemer 20-cylinder V-type turbocharged engine. The engine operated at 600 revolutions per minute with a rated output of 5,500,000 watts.

Fig. 2 (Source: Arizona Public Service Company)

Assuming one of the two EDGs for a unit fails and there are no additional equipment failures, the remaining EDG and the equipment powered by it are sufficient to mitigate any design basis accident (including a loss of coolant accident caused by a broken pipe connected to the reactor vessel) and protect workers and the public from excessive exposure to radiation. Figure 3 shows the major components powered by the Unit 3 EDGs—a High Pressure Safety Injection (HPSI) train, a Low Pressure Safety Injection (LPSI) train, a Containment Spray train, an Essential Cooling Water Pump, an Auxiliary Feedwater Pump, and so on.

Fig. 3 (Source: Arizona Public Service Company Individual Plant Examination)

Because the EDGs are normally in standby mode, the operating license for each unit requires that they be periodically tested to verify they remain ready to save the day should that need arise. At 3:02 am on December 15, 2016, workers started EDG 3B. Workers increased the loading on EDG 3B to about 2,700,000 watts, roughly half load, at 3:46 am per the test procedure.

Ten minutes later, alarms sounded and flashed in the Unit 3 Control Room alerting operators that EDG B had automatically stopped running to due low lube oil pressure. A worker in the area notified the control room operators about a large amount of smoke as well as oil on the floor of the EDG room. The operators contacted the onsite fire department which arrived in the EDG room at 4:06 am. There was no fire ongoing when they arrived, but they remained on scene for about 90 minutes to assist in the response to the event.

Operators declared an Alert, the third most serious in the NRC’s four emergency classifications, at 4:10 am due to a fire or explosion resulting in control room indication of degraded safety system performance. The emergency declaration was terminated at 6:36 am.

Seven weeks later after the fire had long been out, the oil on the floor long since wiped up, and all sharp-edged metal fragments long gone, and any toxic smoke long dissipated, the Nuclear Regulatory Commission (NRC) dispatched a special inspection team to investigate the event and its cause. The NRC dispatched its special inspection team more than a month after it authorized Unit 3 to continue operating for up to 62 days while its blown-up backup power source was repaired. The Unit 3 operating license originally allowed the reactor to operate for only 10 days with one of two EDGs out of service.

Workers at Palo Verde determined that EDG 3B failed because the connecting rod on cylinder 9R failed. It was the fifth time that an EDG of that type at a US nuclear power plant experienced a connecting rod failure and it was the second time that Cylinder 9R on EDG 3B at Palo Verde. It had also failed during a test in 1986.

Examinations in 2017 following the most recent failure traced its root cause back to the first failure. The forces resulting from that failure caused misalignment of the main engine crankshaft. (In this engine, the crankshaft rotates. The crankshaft causes the connecting rods to rise and fall with each rotation, in turn driving the pistons in and out of the cylinders.) The misalignment was very minor—the tolerances are on the order of thousands of an inch. But this minor misalignment over hundreds of hours of EDG operation over the ensuing three decades resulted in high cyclic fatigue failure of the connecting rod.

Workers installed a new crankshaft aligned within the tight tolerances established by the vendor. Workers also installed new connecting rods and repaired the crankcase. After testing the repairs, EDG B was returned to service.

NRC Sanctions

The NRC’s special inspection team did not identify any violations contributing to the cause of the EDG failure, in the response to the failure, or in the corrective actions undertaken to remedy the failure.

UCS Perspective

The NRC’s timeline for this event isn’t comforting.

The operating licenses issued by the NRC for the three reactors at Palo Verde allow each unit to continue running for up to 10 days when one of two EDGs is out of service. The Unit 3 EDG that was blown apart on December 15 could not be repaired within 10 days. So, the owner applied to the NRC for permission to operate Unit 3 for up to 21 days with only one EDG. But the EDG could not be repaired within 21 days. So, the owner applied to the NRC for permission to operate Unit 3 for up to 62 days with only one EDG.

The NRC approved both requests, the second on January 4, 2017. More than a month later, on February 6, 2017, the NRC special inspection team arrived onsite to examine what happened and why it happened.

Wouldn’t a prudent safety regulator have asked and answered those questions before allowing a reactor to continue operating for six times as permitted by its operating license?

Wouldn’t a prudent safety regulator have ensured the cause of EDG 3B blowing itself apart might not also cause EDG 3A to blow itself apart before allowing a reactor to continue operating for two months with a potential explosion in waiting?

Whether the answers are yes or no, could that prudent regulator please call the NRC and share some of that prudency? The NRC may be many things, but it’ll seldom be accused and never be convicted of excessive prudency.

Where’s a prudent regulator when America needs one?

TVA’s Nuclear Allegators

The Nuclear Regulatory Commission (NRC) receives reports about potential safety problems from plant workers, the public, members of the news media, and elected officials. The NRC calls these potential safety problems allegations, making the sources allegators. In the five years between 2012 and 2016, the NRC received 450 to 600 allegations each year. The majority of the allegations involve the nuclear power reactors licensed by the NRC.

Fig. 1 (Source: Nuclear Regulatory Commission)

While the allegations received by the NRC about nuclear power reactors cover a wide range of issues, nearly half involve chilled work environments where workers don’t feel free to raise concerns and discrimination by management for having raised concerns.

Fig. 2 (Source: Nuclear Regulatory Commission)

In 2016, the NRC received more allegations about conditions at the Watts Bar nuclear plant in Tennessee than about any other facility in America. Watts Bar’s 31 allegations exceeded the allegations from the second highest site (the Sequoyah nuclear plant, also in Tennessee, at 17) and third highest site (the Palo Verde nuclear plant in Arizona, at 12) combined.  The Browns Ferry nuclear plant in Alabama and the Pilgrim nuclear plant in Massachusetts tied for fourth place with 10 allegations each. In other words, Watts Bar tops the list with a very comfortable margin.

Fig. 3 (Source: Nuclear Regulatory Commission)

In 2016, the NRC received double-digit numbers of allegations about five nuclear plants. Watts Bar, Sequoyah and Browns Ferry are owned and operated by the Tennessee Valley Authority (TVA). Why did three TVA nuclear plants place among the top five sources of allegations to the NRC?

Because TVA only operates three nuclear plants.

The NRC received zero allegations about ten nuclear plants during 2016. In the five year period between 2012 and 2016, the NRC only received a total of three allegations each about the Clinton nuclear plant in Illinois and the Three Mile Island Unit 1 reactor in Pennsylvania (the unit that didn’t melt down). By comparison, the NRC received 110 allegations about Watts Bar, 55 allegations about Sequoyah, and 58 allegations about Browns Ferry.

TVA President Bill Johnson told Chattanooga Time Free Press Business Editor Dave Flessner that TVA is working on its safety culture problems and “there should be no public concern about the safety of our nuclear plants.” The NRC received 30 of the 31 allegations last year from workers at Watts Bar, all 17 allegations last year from workers at Sequoyah, and all 10 allegations last year from workers at Browns Ferry.

So President Johnson is somewhat right— the public has no concerns about the safety of TVA’s nuclear plants. But when so many TVA nuclear plant workers have so many nuclear safety concerns, the public has every reason to be very, very concerned.

Nuclear plant workers are somewhat like canaries in coal mines. Each is likely to be the first to sense danger. And when nuclear canaries morph into nuclear allegators in such large numbers, that sense of ominous danger cannot be downplayed.

Ad Hoc Fire Protection at Nuclear Plants Not Good Enough

A fire at a nuclear reactor is serious business. There are many ways to trigger a nuclear accident leading to damage of the reactor core, which can result in the release of radiation. But according to a senior manager at the US Nuclear Regulatory Commission (NRC), for a typical nuclear reactor, roughly half the risk that the reactor core will be damaged is due to the risk of fire. In other words, the odds that a fire will cause an accident leading to core damage equals that from all other causes combined. And that risk estimate assumes the fire protection regulations are being met.

However, a dozen reactors are not in compliance with NRC fire regulations:

  • Prairie Island Units 1 and 2 in Minnesota
  • HB Robinson in South Carolina
  • Catawba Units 1 and 2 in South Carolina
  • McGuire Units 1 and 2 in North Carolina
  • Beaver Valley Units 1 and 2 in Pennsylvania
  • Davis-Besse in Ohio
  • Hatch Units 1 and 2 in Georgia

Instead, they are using “compensatory measures,” which are not defined or regulated by the NRC. While originally intended as interim measures while the reactor came into compliance with the regulations, some reactors have used these measures for decades rather than comply with the fire regulations.

The Union of Concerned Scientists and Beyond Nuclear petitioned the NRC on May 1, 2017, to amend its regulations to include requirements for compensatory measures used when fire protection regulations are violated.

Fire Risks

The dangers of fire at nuclear reactors were made obvious in March 1975 when a fire at the Browns Ferry nuclear plant disabled all the emergency core cooling systems on Unit 1 and most of those systems on Unit 2. Only heroic worker responses prevented one or both reactor cores from damage.

The NRC issued regulations in 1980 requiring electrical cables for a primary safety system to be separated from the cables for its backup, making it less likely that a single fire could disable multiple emergency systems.

Fig. 1 Fire burning insulation off cables installed in metal trays passing through a wall. (Source: Tennessee Valley Authority)

After discovering in the late 1990s that most operating reactors did not meet the 1980 regulations, the NRC issued alternative regulations in 2004. These regulations would permit electrical cables to be in close proximity as long as analysis showed the fire could be put out before it damaged both sets of cables. Owners had the option of complying with either the 1980 or 2014 regulations. But the dozen reactors listed above are still not in compliance with either set of regulations.

The NRC issued the 1980 and 2004 fire protection regulations following formal rulemaking processes that allowed plant owners to contest proposed measures they felt were too onerous and the public to contest measures considered too lax. These final rules defined the appropriate level of protection against fire hazards.

Rules Needed for “Compensatory Measures”

UCS and Beyond Nuclear petitioned the NRC to initiate a rulemaking process that will define the compensatory measures that can be substituted for compliance with the fire protection regulations.

The rule we seek will reduce confusion about proper compensatory measures. The most common compensatory measure is “fire watches”—human fire detectors who monitor for fires and report any sightings to the control room operators who then call out the onsite fire brigades.

For example, the owner of the Waterford nuclear plant in Louisiana deployed “continuous fire watches.” The NRC later found that they had secretly and creatively redefined “continuous fire watch” to be someone wandering by every 15 to 20 minutes. The NRC was not pleased by this move, but could not sanction the owner because there are no requirements for fire protection compensatory measures. Our petition seeks to fill that void.

The rule we seek will also restore public participation in nuclear safety decisions. The public had opportunities to legally challenge elements of the 1980 and 2004 fire protection regulations it felt to be insufficient. But because fire protection compensatory measures are governed only by an informal, cozy relationship between the NRC and plant owners, the public has been locked out of the process. Our petition seeks to rectify that situation.

The NRC is currently reviewing our submittal to determine whether it satisfies the criteria to be accepted as a petition for rulemaking. When it does, the NRC will publish the proposed rule in the Federal Register for public comment. Stay tuned—we’ll post another commentary when the NRC opens the public comment period so you can register your vote (hopefully in favor of formal requirements for fire protection compensatory measures.)

Exelon Generation Company (a.k.a. Nuclear Whiners)

The Unit 3 reactor at the Dresden Nuclear Power Station near Morris, Illinois is a boiling water reactor with a Mark I containment design that began operating in 1971. On June 27, 2016, operators manually started the high pressure coolant injection (HPCI) system for a test run required every quarter by the reactor’s operating license. Soon after starting HPCI, alarms sounded in the main control room. The operators shut down the HPCI system and dispatched equipment operators to the HPCI room in the reactor building to investigate the problem.

The equipment operators opened the HPCI room door and saw flames around the HPCI system’s auxiliary oil pump motor and the room filling with smoke. They reported the fire to the control room operators and used a portable extinguisher to put out the fire within three minutes.

Fig. 1 (Source: NRC)

What Broke?

The HPCI system is part of the emergency core cooling systems (ECCS) on boiling water reactors like Dresden Unit 3. The HPCI system is normally in standby mode when the reactor is operating. The HPCI system’s primary purpose is to provide makeup water to the reactor vessel in event that a small-diameter pump connected to the vessel breaks. The rupture of a small-diameter pipe allows cooling water to escape, but maintains the pressure within the reactor vessel too high for the many low pressure ECCS pumps to deliver makeup flow. The HPCI system takes steam produced by the reactor core’s decay heat to spin a turbine connected to a pump. The steam-driven pump transfers water from a large storage tank outside the reactor building into the reactor vessel. The HPCI system can also be used during transients without broken pipes. The HPCI system’s operation can be used by operators to help control the pressure inside the reactor vessel by drawing off the steam being produced by decay heat.

The HPCI auxiliary oil pump is powered by an electric motor. The auxiliary oil pump runs to provide lubricating oil to the HPCI system as the system starts and begins operating. Once the HPCI system is up and running, the auxiliary oil pump is no longer needed. At other boiling water reactors, the auxiliary oil pump is automatically turned off once the HPCI system is up and running—at Dresden, the auxiliary oil pump continues running.

Why the Failure was Reported

On August 25, 2016, Exelon Generation Company (hereafter Exelon) reported the HPCI system problem to the Nuclear Regulatory Commission (NRC). Exelon reported the problem “under 10 CFR 50.73(a)(20(v)(D), ‘Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.’”

Why It Broke

Exelon additionally informed the NRC that the HPCI system auxiliary oil pump motor caught fire due to “inadequate control of critical parameters when installing a DC shunt wound motor.” The HPCI system auxiliary oil pump motor had failed in March 2015 during planned maintenance. The failure in 2015 was attributed by Exelon to “inadequate cleaning and inspection of the motor” which allowed carbon dust to accumulate inside the motor.

How the NRC Assessed the Failure

The NRC issued an inspection report on December 5, 2016, with a preliminary white finding for the HPCI system problem. The NRC determined that the repair of HPCI system auxiliary oil pump motor following its failure in March 2015 resulted in the motor receiving higher electrical current than needed for the motor to run. Consequently, when the HPCI system was tested in June 2016, the high electrical current flowing to the auxiliary oil pump motor caused its windings to overheat and catch fire. The NRC determined that the inadequate repair in March 2015 caused the failure in June 2016. The NRC proposed a white finding in its green, white, yellow, and red string of increasing significant findings and gave Exelon ten days to contest that classification.

During a telephone call between the NRC staff and Exelon representatives on December 15, 2016, Exelon “did not contest the characterization of the risk significance of this finding” and declined the option “to discuss this issue in a Regulatory Conference or to provide a written response.” With the proposed white finding seemingly uncontested, the NRC issued the final white finding on February 27, 2017.

Why the NRC Reassessed the Failure

It took the NRC over two months to finalize an uncontested preliminary finding because Exelon essentially contested the preliminary finding, but not in the way used by the rest of the industry and consistent with the NRC’s longstanding procedures over the 17 years that the agency’s Reactor Oversight Process has been in place.

Instead, Exelon mailed a letter dated January 12, 2017, to the NRC requesting that the agency improve the computer models it uses to determine the significance of events.  Exelon whined that NRC’s computer model over-estimated the real risk because it considered only the failure of a standby component to start and the failure causing a running component to stop. Exelon pointed out that the auxiliary oil pump did permit the HPCI system to successfully start during the June 2016 test run and it later catching on fire did not disable the HPCI system. Exelon whined that the NRC’s modeling was “analogous to the situation where the starter motor of a car breaks down after the car is running and then concluding that ‘the car won’t run’ even though it is already running.”

The NRC carefully considered each of Exelon’s whines in its January 12 letter and still concluded that the failure warranted a white finding. So, the agency issued a white finding. With respect to Exelon’s whine that the auxiliary oil pump burned up after the HPCI system was up and running, the NRC reminded the company that the operators shut down the HPCI system in response to the alarms—had it been necessary to restart the HPCI system, the toasted auxiliary oil pump would have prevented it. It is not uncommon for the HPCI system to be automatically shut down (e.g., due to high water level in the reactor vessel) or to be manually shut down (e.g., due to operators restoring the vessel water level to within the prescribed band or responding to a fire alarm in the HPCI room) only to be restarted later during the transient. The NRC’s review determined that their computer model’s treatment of a “failure to restart” would yield results very similar to its treatment of a “failure to start.”

The auxiliary oil pump’s impairment reduced the HPCI system to one and done use. In an actual emergency, one and done might not have cut it—thus, NRC issued the white finding for Exelon’s poor performance that let the auxiliary oil pump literally go up in smoke.

The NRC conducted a public meeting on May 2, 2017, in response to Exelon’s letter. I called into the meeting to see if Exelon’s whines are as shallow and ill-conceived as they appear in print. I admit to being surprised—their whining came across even shallower live than in writing. And I would have bet it impossible after reading, and re-reading, their whiny letter.

What’s With the Whining?

Does Exelon hire whiners, or does the company train people to become whiners?

It’s a moot point because Exelon should stop whining and start performing.

Exelon whined that the NRC failed to recognize or appreciate that the auxiliary oil pump is only needed during startup of the HPCI system. During the June 2016 test run, the HPCI system successfully started and achieved steady-state running before the auxiliary oil pump caught fire. Workers put out the fire before it disabled the HPCI pump. But the NRC’s justification for the final white characterization of the “uncontested” finding explained why those considerations did not change their conclusion. While the auxiliary oil pump did not catch fire until after the HPCI system was successfully started during the June 2016 test run, its becoming toast would have prevented a second start.

Exelon expended considerable effort contesting and re-contesting the “uncontested” white finding. Had Exelon expended a fraction of that effort properly cleaning and inspection the auxiliary oil pump motor, the motor would not have failed in March 2015. Had Exelon expended a fraction of that effort properly setting control parameters when the failed motor was replaced in March 2015, it would not have caught on fire in June 2016. If the motor had not caught on fire in June 2016, the NRC would not even have reached for its box of crayons in December 2016. If the NRC had not reached for its box of crayons, Exelon would not have been whining in January and May 2017 that the green crayon instead of the white one should have been picked.

So, Exelon would be better off if it stopped whining and started performing. And the people living around Exelon’s nuclear plants would be better off, too.

US Needs More Options than Yucca Mountain for Nuclear Waste

On Wednesday, I testified at a hearing of the Environment Subcommittee of the House Energy and Commerce Committee. The hearing focused on the discussion draft of a bill entitled “The Nuclear Waste Policy Amendments Act of 2017.”

Yucca Mountain (Source: White House)

The draft bill’s primary objective is to revive the program to build a geologic repository at the Yucca Mountain site in Nevada for spent nuclear fuel and other high-level radioactive wastes. The Obama administration cancelled the program in 2009, calling it “unworkable,” and the state of Nevada is bitterly opposed to it, but Yucca Mountain still has devoted advocates in Congress, including the chairman of the subcommittee, John Shimkus (R-IL).

UCS supports the need for a geologic repository for nuclear waste in the United States but doesn’t have a position on the suitability of the Yucca Mountain site. We don’t have the scientific expertise needed to make that judgement.

However, in my testimony, I expressed several concerns about the draft bill, including its focus on locating a repository only at Yucca Mountain and its proposal to weaken the NRC’s review standards for changes to repository design.

UCS believes that rigorous science must underlie the choice of any geologic repository, and that the US needs options in addition to Yucca Mountain, which has many unresolved safety issues. In addition, we believe that any legislation that revises the Nuclear Waste Policy Act must be comprehensive and include measures to enhance the safety and security of spent fuel at reactor sites—where it will be for at least several more decades. For example, we think it is essential to speed up the transfer of spent fuel from pools to dry storage casks.

Watts Bar Lacks a Proper Safety Culture

The Nuclear Regulatory Commission (NRC) issued a Chilled Work Environment Letter to the Tennessee Valley Authority (TVA) on March 23, 2016, about safety culture problems at the Watts Bar nuclear plant. TVA promised to take steps to restore a proper safety culture at the plant.

Nearly 13 months later, has a proper safety culture been restored at Watts Bar?

No, according to a report issued April 19, 2017, by the TVA Office of the Inspector General (TVA OIG).

Fig. 1. (Source: D. Lochbaum)

The TVA OIG report paints a very disturbing picture of conditions at Watts Bar. I monitored safety culture problems at Millstone (1996-2000), Davis-Besse (2002-2004), and Salem/Hope Creek (2004-2005). The problems described in the TVA OIG report are comparable to the unacceptable conditions that existed at Millstone and Davis-Besse. A difference is that the NRC did not allow Millstone or Davis-Besse to operate until those safety culture problems were corrected to an acceptable level.

The TVA OIG report explains why TVA keeps reporting that the chilled work environment at Watts Bar was confined to the Operations Department and did not contaminate other work organizations at the site: The TVA Office of the General Counsel instructed the Employee Concerns Program and others within TVA not to use “chilled work environment” and to use “degraded work environment” instead. So, while TVA cannot find chilled work environments outside Operations, they find “degraded work environments” almost every place they look. But through an artifice of semantics conjured up by TVA’s attorneys, no chilled work environments are being found.

The TVA OIG didn’t buy the semantics: “Additionally, when 75 percent of a work group at a nuclear utility perceives that they are working in a chilled environment as is the case with ECP at TVA, it would seem reasonable to conclude that there is a chilled work environment in that group and unreasonable to pass it off as a ‘degraded work environment’.”

How bad is the chilled work environment at Watts Bar? The TVA OIG report indicates that 75% of the Employee Concerns Program (ECP) staff did not feel safe to raise concerns without fear of retaliation. ECP is supposed to be the organization that workers with safety concerns can go for help resolving them. When the helpers feel chilled, how can they truly help workers?

The ECP hired two individuals from outside TVA in February 2016 to conduct an independent investigation of the work environment at Watts Bar. According to the TVA OIG, this investigation was independent and forthright, but the ensuing report was anything but independent. The TVA OIG reviewed emails and interviewed the independent investigators and found that “the term ‘chilled work environment’ was edited out of the text of the report by ECP personnel.” In fact, the independent investigators did not write the six-page Executive Summary for “their” report—ECP wrote it. ECP wrote that a “degraded work environment” rather than a “chilled work environment” existed at Watts Bar. TVA OIG reported being unable to find “degraded work environment” being used within TVA or elsewhere prior to this “independent” report.

One of the two independent investigators told the TVA OIG that TVA management “did not like the fact that he stated that TVA management contributed to the poor SCWE [safety conscious work environment]” at Watts Bar. He was not invited back to participate in subsequent debriefing activities which “he attributed to management’s reaction to his report-out to them of the results from Phase I.” In other words, TVA shot the messenger.

The TVA OIG report states that “both the independent investigation commissioned by TVA and the SRTR [Special Review Team Report] were inappropriately influenced by TVA management” and that “the independent investigators were told by TVA ECP what they could and could not put in their report and the Executive Summary of that report was written by ECP, not the independent investigators.”

As to whether the chilled work environment issues were confined to the Operations Department, “Through personnel interviews conducted by OIG investigators, it was learned that many instances of HIRD [harassment, intimidation, retaliation, and/or discrimination] have occurred or have been alleged to have occurred in Operations and in other departments at WBN [Watts Bar Nuclear].” More specifically, surveys conducted during 2016 after workers raised concerns that led to the NRC’s Chilled Work Environment Letter being issued reveal safety culture issues outside of the Operations Department at Watts Bar.

Maintenance Department: 36% of workers feel free to report problems and concerns. 55% of workers believe they could report problems and concerns without fear of retaliation. 91% of the workers witnessed behavior contrary to a healthy nuclear safety culture.

Chemistry Department: 50% of workers feel free to report problems and concerns. 50% of workers believe they could report problems and concerns without fear of retaliation. 50% of the workers witnessed behavior contrary to a healthy nuclear safety culture.

Security Department: 34% of workers believe they could report problems and concerns without fear of retaliation. 67% of the workers witnessed behavior contrary to a healthy nuclear safety culture.

Engineering Department: 67% of workers believe they could report problems and concerns without fear of retaliation. 66% of the workers witnessed behavior contrary to a healthy nuclear safety culture.

Radiation Protection Department: 78% of the workers witnessed behavior contrary to a healthy nuclear safety culture.

The TVA OIG explicitly states “TVA’s continuing denials have been found to be incorrect by the NRC and independent assessors: a chilled work environment exists in at least several departments at WBN and within the ECP program itself.”

The TVA OIG makes an interesting observation regarding the 51 actions that TVA identified as necessary to correct the problems expressed in the NRC’s Chilled Work Environment Letter—none of them pertain to TVA’s upper management. The TVA OIG states “It is certainly worth considering whether this might be at least a contributor, if not a root cause, of the failure of any of the CAPRs [corrective actions to prevent recurrence], remediation plans, and the like to correct the continuing recurrence of chilled work environments at TVA over the past decade.” Indeed!

Watts Bar Needs a Proper Safety Culture

The TVA OIG report makes it extremely clear that Watts Bar lacks a proper safety culture and that lack is broader than just within the Operations Department.

Watts Bar needs a proper safety culture because it is the fundamental foundation for nuclear safety overall. If workers do not raise safety concerns—either out of fear of retaliation or out of distrust that management will correct them—the inventory of unresolved safety concerns increases over time. Nuclear power plants are robust and require a large number of failures and malfunctions before an incident morphs into a disaster. The rising number of unresolved safety concerns reduces the number of failures needed to facilitate such transformations.

Proper safety cultures cannot be acquired from eBay or Amazon. Senior managers must make it happen. If TVA’s senior managers can’t or won’t make it happen, either TVA needs new senior managers or NRC needs to write TVA another letter—a stronger letter perhaps along the lines of a Show Cause Order compelling TVA’s lawyers to explain why Watts Bar can continue to operate safely with “degraded work environments” all over the site.

In the meantime, if Watts Bar experiences a disaster, it won’t be an accident. It’ll be an outcome of operating a nuclear power reactor with a safety culture documented to be woefully inadequate.

Columbia Generating Station: NRC’s Special Inspection of Self-Inflicted Safety Woes

Energy Northwest’s Columbia Generating Station near Richland, Washington has one General Electric boiling water reactor (BWR/5) with a Mark II containment design that began operating in 1984. In the late morning hours of Sunday, December 18, 2016, the station stopped generating electricity and began generating problems.

The Nuclear Regulatory Commission (NRC) dispatched a special inspection team to investigate the event after determining it could have increased the risk of reactor core damage by a factor of ten. The NRC team sought to understand the problems occurring during this near-miss as well as assess the breadth and effectiveness of the solutions proposed by the company for them.

Trouble Begins Offsite

The plant was operating at full power when the main generator output breakers opened at 11:24 am due to an electrical transient within the Ashe substation. The Ashe substation is owned and maintained by the Bonneville Power Authority and serves as the connection between electricity produced at the plant and the offsite power grid. At least three electrical breakers at the Ashe substation were supposed to have opened to de-energize the faulted transmission line(s). Had they done so, the loss of the transmission lines could have triggered protective devices at the Columbia Generating Station to automatically trip the main generator. But cold weather kept the breakers from functioning properly. Instead of the protective systems at the Columbia Generating Station responding on a system level (i.e., the de-energized transmission line(s) triggering a main generator trip), they responded at the component level (i.e., the main generator output breaker sensed the electrical transient and opened).

The turbine control valves automatically closed because the main generator was no longer fully loaded with its output breakers opened. The closure of the turbine control valves automatically tripped the reactor. The control rods fully inserted within seconds to stop the nuclear chain reaction. The output breakers, turbine control valves, and control rods all functioned per the plant’s design (see Figure 1).

Fig. 1 (Source: Nuclear Regulatory Commission annotated by UCS)

Before the trip, the main generator was producing electricity at 25,000 volts. The main transformer increased the voltage up to 500,000 volts for transmission out to the offsite power grid. The auxiliary transformers reduced the voltage to 4,160 volts and 6,900 volts for supply to equipment in the plant. The output breakers that opened to start this event are represented by the square box in the upper left corner of Figure 2.

Fig. 2 (Source: Nuclear Regulatory Commission annotated by UCS)

Trouble Begins Onsite – Loss of Heat Sink and Normal Makeup

The main generator was disconnected from the offsite power grid but continued to supply electricity through the auxiliary transformers to plant equipment. Because steam was no longer flowing to the turbine, the voltage and frequency of the electricity dropped. The voltages flowing to in-plant equipment dropped low enough to cause electrical breakers to automatically open at 11:25 am to protect motors and other electrical equipment from damage caused by under-voltage. For example, an electric motor requires an electrical current of a certain voltage in order to operate. Electrical current of lower voltage may not be enough to enable the motor to run, but that current flowing through the motor may be enough to heat it up and damage it. One of the de-energized loads caused the Main Steam Isolation Valves (MSIVs) to close. Their closure meant that steam produced by the reactor’s decay heat no longer flowed to the condenser where it got cooled by water from the plant’s cooling towers. Instead, the steam bottled up in the reactor vessel and piping until it increased the pressure to the point where the safety/relief valves opened to discharge steam to the suppression pool (see Figure 3).

The closure of the MSIVs also stopped the normal flow of makeup cooling water to the reactor vessel. The feedwater system uses steam-driven turbines connected to pumps to supply makeup cooling water to the reactor vessel. But the steam supply for the feedwater pumps is downstream of the now-closed MSIVs. The condensate and condensate booster pumps upstream of the feedwater pumps have electric motors and continued to be available. But collectively they only pump water at about two-thirds of the pressure inside the reactor vessel, meaning they could not supply makeup water unless the pressure inside the reactor vessel decreased by nearly one-third its normal pressure.

Fig. 3 (Source: Nuclear Regulatory Commission annotated by UCS)

Troubles Onsite Grow – Loss of Normal Power for Safety Buses

At 11:28 am, the safety buses SM7 and SM8 tripped on low voltage, causing their respective emergency diesel generators to start and provide power to these vital buses. This was not supposed to happen during this event. By procedure, the operators were directed to manually trip the turbine and generator following the automatic trip of the reactor. They tripped the turbine at 11:27 am, but never tripped the main generator. Tripping the main generator as specified in the procedures would have immediately caused electrical breakers to close and other electrical breakers to open to swap the supply of electricity to plant equipment from the auxiliary transformers to the startup transformers as shown in Figure 4. The startup transformers reduce 230,000 volt electricity from the offsite power grid to 4,160 volts and 6,900 volts for use by plant equipment when the main generator is unavailable. With electricity to plant equipment from the startup transformers, the MSIVs would have remained open and makeup cooling water supplied by the feedwater pumps as normally provided.

Fig. 4 (Source: Nuclear Regulatory Commission annotated by UCS)

Even More Trouble Onsite – Loss of Backup Makeup

The operators manually started the Reactor Core Isolation Cooling (RCIC) system (not shown on the Figure 3, but a smaller version of the High Pressure Coolant System) at 11:32 am to provide makeup cooling water because the feedwater system was unavailable. The RCIC systems’ primary function is to supply makeup cooling water when the feedwater system cannot do so. Like the feedwater pumps, the RCIC pump is connected to a steam-driven turbine. Unlike the feedwater pumps, the RCIC pump’s turbine is supplied with steam from the reactor vessel through a connection upstream of the closed MSIVs. The RCIC pump transfers water from a large storage tank to the reactor vessel.

The operators failed to follow the procedure when starting the RCIC system. The procedure called for them to close the steam admission valve (V-45) and then open the trip valve (V-1) as soon as V-45 was fully closed (see Figure 5). But they did not open V-1. The failure to open V-1 disabled the control system designed to bring the RCIC turbine up to desired speed in 12 seconds. Instead, the RCIC turbine tried to obtain the desired speed instantly. Too much steam too soon caused the RCIC turbine to automatically trip on high speed. This trip guards against the spinning turbine blades coming apart due to excessive forces.

It took about 13 minutes for workers to go down into the RCIC room in the reactor building’s basement and reset the mis-positioned valves to allow the system to be properly started. In that time, the water level inside the reactor vessel dropped about a foot as it boiled away. That still left 162 inches (13.5 feet) of water above the top of fuel in the reactor core. The operators had several hours to restore makeup cooling water flow before the reactor core started uncovering and overheating.

Fig. 5 (Source: Nuclear Regulatory Commission annotated by UCS)

The operators manually started the High Pressure Core Spray (HPCS) system at 12:09 pm to provide makeup cooling water with the feedwater and RCIC systems both unavailable. The main HPCS pump (HPCS-P-1) has an electric motor. The pump transfer water from the large storage tank to the reactor vessel. While RCIC is designed to supply makeup water to compensate for inventory boiled off after the reactor shuts down, the HPCS system is designed to also compensate for water being lost through a small-diameter (about 2 inches) pipe that drains cooling water from the reactor vessel. Consequently, the HPCS system flow rate is about ten times greater than the RCIC system flow rate. And whereas the RCIC system flow rate can be throttled to match the makeup need, the HPCS system makeup flow is either full or zero.

The HPCS system refilled the reactor vessel soon after it was started. The operators closed the HPCS system injection valve (V-4) after about a minute. The minimum flow valve (V-12) automatically opened to direct the pump flow to the suppression pool instead of to the reactor vessel (see Figure 6). The HCPS system ran in “idle” mode for the next 3 hours and 42 minutes.

Fig. 6 (Source: Nuclear Regulatory Commission annotated by UCS)

Yet More Trouble Onsite – Water Leaking into Reactor Building

On December 18, workers discovered that the restricting orifice (RO) downstream of V-12 had leaked an estimated 4.7 gallons per minute into the reactor building while the HPCS system had operated. The NRC team learned that the gasket material used in this restricting orifice had been the subject of an industry operating experience report in 2007. A condition report was written at Columbia Generating Station in 2008 to have engineering assess the operating experience report and gasket materials used at the plant. In early 2010, the condition report was closed out based on engineering’s evaluation to use the gasket material recommended in the industry report. But the “bad” gaskets were not replaced.

Operating experience cited in the 2007 industry report revealed that the original gasket material was vulnerable to erosion. The report described two adverse consequences from the material’s erosion. First, pieces of the gasket could be carried by the water into the reactor vessel where the material impacting the fuel rods could damage their cladding. Second, gasket erosion could allow leakage. The 2007 industry report thus forecast the problem experienced at Columbia Generating Station in December 2016. The solution recommended by the 2007 report was not implemented until after the forecast problem has occurred.

NRC Sanctions

The NRC’s special inspection team identified three safety violations at the Columbia Generating Station. Two violations involved the operators failing to follow written procedures: (1) the failure to trip the main generator which resulted in the unnecessary closure of the MSIVs, and (2) the failure to properly start the RCIC system which resulted in the unnecessary trip of its turbine. The third violation was associated with the continued use of gasket material determined nearly a decade earlier to be improper for this application.

UCS Perspective

Self-inflicted problems turned a fairly routine incident into a near-miss. Luck stopped it from progressing further.

The problem started offsite due to causes outside the control of the plant’s owner. Those uncontrollable causes resulted in the main generator output breakers opening as designed.

By procedure, the operators were supposed to trip the main generator. Failing to do so resulted in the unnecessary closure of the MSIVs and the loss of the normal makeup cooling flow to the reactor vessel.

By procedure, the operators were supposed to manually start the RCIC system to provide backup cooling water flow to the reactor vessel. But they failed to properly start the system and it immediately tripped.

Procedures are like recipes—positive outcomes are achieved only when they are followed.

The operators resorted to using the HPCS system. It took about a minute for the HPCS system to recover the reactor vessel water level—the operators left it running in “idle” for the next three hours and 42 minutes during which time about 5 gallons per minute leaked into the reactor building. The leak was through eroded gasket material that had been identified as improper for this application nearly a decade earlier, but never replaced.

Defense-in-depth is a nuclear safety hallmark. That hallmark works best when operators don’t bypass barriers and when workers patch known holes in barriers. Luckily, other barriers remained effective to thwart this near-miss from becoming a disaster. But luck is a fickle factor that needs to be minimized whenever possible.

Managing Nuclear Worker Fatigue

The Nuclear Regulatory Commission (NRC) issued a policy statement on February 18, 1982, seeking to protect nuclear plant personnel against impairment by fatigue from working too many hours. The NRC backed up this policy statement by issuing Generic Letter 82-12, “Nuclear Power Plant Staff Working Hours,” on June 15, 1982. The Generic Letter outlined guidelines such as limiting individuals to 16-hour shifts and providing for a break of at least 8 hours between shifts. But policy statements and guidelines are not enforceable regulatory requirements.

Fig. 1 (Source: GDJ’s Clipart)

UCS issued a report titled “Overtime and Staffing Problems in the Commercial Nuclear Power Industry” in March 1999 describing how the NRC’s regulations failed to adequately protect against human impairment caused by fatigue. Our report revealed that workers at one nuclear plant in the Midwest logged more than 50,000 overtime hours in one year.

Barry Quigley, then a worker at a nuclear plant in the Midwest, submitted a petition for rulemaking to the NRC on September 28, 1999. The NRC issued regulations in the 1980s intended to protect against human impairment caused by drugs and alcohol. Nuclear plant workers were subject to initial, random follow-up, and for-cause drug and alcohol testing. Quiqley’s petition sought to extend the fitness-for-duty requirements to include limits on working hours. The NRC revised its regulations on March 31, 2008, to require that owners implement fatigue management measures. The revised regulations permit individuals to exceed the working hour limits, but only under certain conditions. Owners are required to submit annual reports to the NRC on the number of working hour limit waivers granted.

The NRC’s Office of Nuclear Regulatory Research recently analyzed the first five years of the working hour limits regulation. The analysis reported that in 2000, the year when the NRC initiated the rulemaking process, more than 7,500 waivers of the working hour limits suggested by Generic Letter 82-12 were being issued at some plants while about one-third of the plants granted over 1,000 waivers annually. In 2010, the first year the revised regulations were in effect, a total of 3,800 waivers were granted for the entire fleet of operating reactors. By 2015, the number of waivers for all nuclear plants had dropped to 338. The Grand Gulf nuclear plant near Port Gibson, Mississippi topped the 2015 list with 69 waivers. But 54 (78%) of the waivers were associated with the force-on-force security exercise.

The analysis indicates that owners have learned how to manage worker shifts within the NRC’s revised regulations. Zero waivers are unattainable due to unforeseen events like workers calling in sick and tasks unexpectedly taking longer to complete. The analysis suggests that the revised regulations enable owners to handle such unforeseen needs without the associated controls and reporting being an undue burden.

The regulatory requirements adopted by the NRC to protect against sleepy nuclear plant workers should let people living near nuclear plants sleep a little better.

Leak at the Creek: Davis-Besse-like Cooling Leak Shuts Down Wolf Creek

The Wolf Creek Generating Station near Burlington, Kansas has one Westinghouse four-loop pressurized water reactor that began operating in 1985. In the early morning hours of Friday, September 2, 2016, the reactor was operating at full power. A test completed at 4:08 am indicated that leakage into the containment from unidentified sources was 1.358 gallons per minute (gpm). The maximum regulatory limit for was such leakage was 1.0 gpm. If the test results were valid, the reactor had to be shut down within hours. Workers began running the test again to either confirm the excessive leak or determine whether it may have been a bad test. The computer collects data over a two-hour period and averages it to avoid false indications caused by momentary instrumentation spikes and other glitches. (It is standard industry practice to question test results suggesting problems but accept without question “good” test results.)

The retest results came in at 6:52 am and showed the unidentified leakage rate to be 0.521 gpm, within the legal limit. Nevertheless, management took the conservative step of entering the response procedure for excessive leakage. At 10 am, the operators began shutting down the reactor. They completed the shutdown by tripping the reactor from 30 percent power at 11:58 am.

Wolf Creek has three limits on reactor cooling water leakage. There’s a limit of 10 gpm from known sources, such as a tank that collects water seeping through valve gaskets. The source of such leakage is known and being monitored for protection against further degradation. There’s a stricter limit of 1 gpm from unknown sources. While such leakage is usually found to be from fairly benign sources, not knowing it to be so imposes a tighter limitation. Finally, there’s the strictest limit of zero leakage, not even an occasional drop or two, from the reactor coolant pressure boundary (i.e., leaks through a cracked pipe or reactor vessel weld. Reactor coolant pressure boundary leaks can propagate very quickly into very undesirable dimensions; hence, there’s no tolerance for them. Figure shows that the unknown leakage rate at Wolf Creek held steady around one-tenth (0.10) gallon per minute during July and August 2016 but significantly increase in early September.

Fig. 1 (Source: Freedom of Information Act response to Greenpeace)

The reactor core at Wolf Creek sits inside the reactor vessel made of metal six or more inches thick (see Figure 2). The reactor vessel sits inside the steel-reinforced concrete containment structure several feet thick. The dome-shaped top, or head, of the reactor vessel is bolted to its lower portion. Dozens of penetrations through the head permit connections between the control rods within the reactor core and their motors housed within a platform mounted on the head. Other penetrations allow temperature instruments inside the reactor vessel to send readings to gauges and computers outside it.

Fig. 2 (Source: Nuclear Regulatory Commission)

Wolf Creek has 78 penetrations through its reactor vessel head, including a small handful of spares. Workers entered containment after the reactor shut down looking for the source(s) of the leakage. They found cooling water spraying from penetration 77 atop the reactor vessel head. The leak sprayed water towards several other penetrations as shown in Figure 3. Penetration 77 allowed a thermocouple within the vessel to send its measurements to instrumentation.

Fig. 3 (Source: Wolf Creek Nuclear Operating Corporation)

The spray slowed and then stopped as the operators cooled the reactor water temperature below the boiling point. Workers performed a closer examination of the leakage source (see Figure 4) and its consequences. The reactor cooling water at Wolf Creek is borated. Boric acid is dissolved in the water to help control the nuclear chain reaction in the core as uranium fuel is consumed. Once water leaked from the vessel evaporated, boric acid crystals remained behind, looking somewhat like frost accumulation.

Fig. 4 (Source: Freedom of Information Act response to Greenpeace)

The spray from leaking Penetration 77 blanketed many neighbors with boric acid as shown in Figure 5. The vertical tubes are made from metal that resists corrosion by boric acid. The reactor vessel (the grayish dome-shaped object on the left side of the picture) is made from metal that is considerably less resistant to boric acid corrosion. The inner surface of the reactor vessel is coated with a thin layer of stainless steel for protection against boric acid. The outer surface is only protected when borated water doesn’t leak onto it.

Fig. 5 (Source: Freedom of Information Act response to Greenpeace)

The white-as-frost blankets coating the penetrations indicated little to no corrosion damage. But rust-colored residue in the Figure 6 pictures is a clear sign of corrosion degradation to the reactor vessel head by the boric acid. It may not be déjà vu all over again, but it’s too much Davis-Besse all over again. Boric acid corroded the Davis-Besse reactor head all the way down to the thin stainless steel liner. The NRC determined Davis-Besse to have come closer to an accident than any other US reactor since the March 1979 meltdown at Three Mile Island.

Fig. 6 (Source: Freedom of Information Act response to Greenpeace)

Fortunately, the degradation appears much worse in the pictures than it actually was. Actually, fortune had an ally at Wolf Creek that was missing at Davis-Besse. Both reactors exhibited signs that reactor cooling water was leaking into containment. The indicated leak rates at both reactors were below regulatory limits, except for one anomalous indication at Wolf Creek. Managers at Davis-Besse opted to dismiss the warning signs and keep the reactor operating. Managers at Wolf Creek heeded the danger signs and shut down the reactor. It’s not that they erred on the side of caution—putting nuclear safety first must never be considered an error. It’s that they avoided making the Davis-Besse mistake of putting production ahead of safety.

Wolf Creek restarted on November 21, 2016, after repairing Penetration 77, removing the boric acid, and verifying no significant damage to other penetrations and the reactor vessel head. But they also conducted refueling activities—already planned to require 55 days—during that 80-day period. The NRC closely monitored the response to the leakage and its repair and found no violations.

Davis-Besse chose production over safety but got neither. The reactor was shut down for over two years, generating no revenue but lots of costly repair bills. The reactor vessel head and other components inside the containment extensively damaged by boric acid corrosion were replaced. Many senior managers at the plant and in the corporate officers were also replaced. And the NRC fined the owner a record $5,450.000 fine for numerous safety violations.

Nuclear Safety Snapshot

Figure 7 shows the reactor vessel head at Wolf Creek without any boric acid blankets and corrosion. But the image I’ll remember about this event is neither this picture, nor the picture of the hole in Penetration 77, nor the picture of the boric acid blankets on adjacent penetrations, and nor the picture of rust-colored residue. It’s the mental picture of operators and managers at Wolf Creek who, when faced with Davis-Besse-like cooling water leak indications, responded unlike their counterparts by shutting the reactor down and fixing the problem rather than rationalizing it away. It’s an easy decision when viewed in hindsight but a tough one at the time it was made.

Davis-Besse made headlines, lots and lots of headlines, for exercising very poor judgment. Wolf Creek may not warrant headlines for using good judgment, but they at least deserve to be on the front page somewhere below the banner headline and feature article about today’s bad guys.

Fig. 7 (Source: Freedom of Information Act —response to Greenpeace)

Nuclear Safety Video

Unfortunately, the picture of Wolf Creek responding well to a safety challenge is a snapshot in time that does not assure success in facing tomorrow’s challenges.

Fortunately, the picture of Davis-Besse responding poorly to a safety challenge is also a snapshot in time that does not assure failure in facing future challenges.

Nuclear safety is dynamic, more like a video than a snapshot. That video is more likely to have a happy ending when the lessons of what worked well along with lessons from what didn’t work factor into decision-making. Being pulled away from bad choices is helpful. Being pushed towards good choices is helpful, too. Nuclear safety works best when both forces are applied.

The NRC and the nuclear industry made quite the hullabaloo about Davis-Besse. Why have they been so silent about Wolf Creek? It’s a swell snapshot that could help the video turn out swell, too.