UCS Blog - All Things Nuclear (text only)

Pressuring China on North Korea Could Be a Mistake

The Trump administration is intentionally putting China in very tough spot. It is attempting to make the Chinese leadership believe it must choose between a preemptive US attack on North Korea or agreeing to US requests to strangle North Korea’s economy with even tougher sanctions, including cutting off North Korea’s oil supply at the beginning of winter. That may seem like clever diplomacy to some. But it’s a high stakes game of poker that the United States could lose.

The problem with the Trump administration’s strategy – if it is a strategy – is that from China’s point of view both choices lead to war.

China’s Bad Hand

Chinese arms control analysts do not believe North Korea is willing to give up its nuclear weapons program. Moreover, they think the uptick in threatening US language and military posturing have led the North Koreans to accelerate their efforts to develop a credible nuclear deterrent. In their view, the Trump administration’s policy of “maximum pressure” is pushing North Korea farther away from the negotiating table, not towards it.

Chinese scholars do not believe the Chinese leadership can influence North Korean decisions about security. One of the most often repeated laments I’ve heard from Chinese colleagues during this visit is that Americans don’t understand that China is not North Korea’s ally. North Korea does not trust China. It never has. Chinese historians are quick to point out that even during the Korean War in the 1950s the North Korean leadership resisted Chinese military intervention. And because North Korea does not trust China, the Hermit Kingdom’s nuclear weapons program is the only credible security guarantee it’s got. It is also the only bargaining chip the North Koreans can use to encourage the United States to negotiate, and then honor, a permanent peace treaty.

Chinese military experts do not believe US preemption will succeed. They think the North Korean leadership, and the nuclear weapons program, will survive a surgical strike. In their view, only a massive US attack, accompanied by a ground invasion, has a chance of permanently disarming the North Koreans. Moreover, Chinese military analysts believe that any US attack, no matter how limited, will precipitate North Korean retaliation. That will invite additional US attacks and begin a downward spiral of military activity that will be very hard to stop once it starts.

What does China believe? The Chinese government has stated, on multiple occasions, that severe sanctions, like cutting off oil and food supplies, will “destabilize” the peninsula. That’s the diplomatic way of saying it will lead to war. Chinese analysts do not rule out the possibility that North Korea might decide to punish China for capitulating to the United States. A Chinese military response to any North Korean attack against China risks inviting unwanted US military involvement. Alternatively, a North Korean military attack against South Korea or Japan would compel US military action. Either way, Chinese experts believe the same pattern of escalating attacks and retaliation will ensue.

So, if the Trump administration isn’t bluffing about preemption, and the Chinese leadership believes preemption and sanctions both lead to war, the only real choice China faces is how it should respond to this no-win situation.

Possible Chinese Responses

Like most people faced with impossible choices, China’s leaders will probably try to put things off as long as they can. They will try to give the Trump administration a little more on sanctions and hope that’s enough to keep things quiet a bit longer. At some point, however, when sanctions begin to have a meaningful effect on North Korea, China’s leaders will likely conclude they cannot apply additional pressure without triggering a North Korean military provocation.

Some of the Chinese experts advising President Xi think that time has already come. They are the ones behind the Global Times editorial that threatened Chinese military intervention if the United States fires the first shot. These Chinese hard-liners are now trying to bring Russia on board with discussions about a joint statement warning the Trump administration against a preemptive attack on North Korea. They do not believe the United States is willing to risk a war with China and Russia to attempt a preemptive strike against North Korea that has a low probability of success.

Other Chinese experts don’t want the leadership to take such a huge step backwards and revert to a Cold War-style relationship with the United States. They agree there is no reason to expect North Korea to freeze or dismantle its nuclear weapons program, and that tightened sanctions and increased pressure only strengthen North Korean resolve. Nevertheless, they would rather work with the United States than against it. A tiny minority of those experts would even like the Chinese leadership to consider cooperating with the United States on military action against North Korea.

Likely Outcomes

The chance of that happening is probably quite small. Chinese cooperation in US military action against North Korea would invite North Korean retaliation against China. And China’s leaders have good reason to doubt whether there will be any meaningful reciprocation from the Trump administration in exchange for taking such a huge risk. Chinese military and foreign policy analysts presume the United States will still see China as a rising economic and military threat. Moreover, the Trump administration’s notorious unpredictability would make any US promise unreliable.

Because the choice the United States is presenting to China is so unpalatable, the most likely Chinese response will be to wait out the storm and hope Trump is bluffing. US efforts to ratchet up inflammatory rhetoric and military exercises are unlikely to alter Chinese thinking. Chinese leaders have been confronting US threats and enduring US military posturing for decades. Moreover, there is a tendency in traditional Chinese military culture to believe that preparations for actual military moves are concealed, while advertised preparations, like anchoring a nuclear submarine in South Korea, or practicing air strikes, are for show. Mainstream Chinese interpretations of post-1949 US-China relations reinforce that tendency. From China’s point of view, the Trump administration’s threat to start a war with North Korea looks like a bluff.

If the Trump administration is bluffing, and the Chinese government manages to keep its cool, what happens then? Will China look like the wiser party? Will Japan and South Korea lose faith in Trump’s judgment? It is possible that instead of backing China into a corner, President Trump may find himself trapped in a situation where he feels he has to attack North Korea just to preserve his credibility in Asia.

It would not be the first time a US president fell into this trap. President Eisenhower got stuck in the same conundrum during the Taiwan Straights Crisis of 1954-55. The Joint Chiefs argued the United States had to attack China, and risk nuclear war with the Soviet Union, to preserve US credibility in the region. But Ike was a general too, understood the nature of war, and chose to subordinate concerns about credibility to caution and wait. He chose wisely. How President Trump would respond is a question worth pondering before pushing the strategy of “maximum pressure” to the breaking point.

 

Reentry of North Korea’s Hwasong-15 Missile

Photos of the Hwasong-15 missile North Korea launched on its November 29 test suggest it is considerably more capable than the long-range missiles it tested in July. This missile’s length and diameter appear to be larger by about 10 percent than July’s Hwasong-14. It has a significantly larger second stage and a new engine in the first stage that appears to be much more powerful.

While we are still working through the details, this strongly implies that North Korea could use this missile to carry a nuclear warhead to cities throughout the United States. A final possible barrier people are discussing is whether Pyongyang has been able to develop a reentry vehicle that can successfully carry a warhead through the atmosphere to its target, while protecting the warhead from the very high stresses and heat of reentry.

Here are my general conclusions, which I discuss below:

  1. North Korea has not yet demonstrated a working reentry vehicle (RV) on a trajectory that its missiles would fly if used against the United States.
  2. However, there doesn’t appear to be a technical barrier to building a working RV, and doing so is not likely to be a significant challenge compared to what North Korea has already accomplished in its missile program.
  3. From its lofted tests, North Korea can learn significant information needed for this development, if it is able to collect this information.
  4. While the United States put very significant resources into developing sophisticated RVs and heatshields, as well as extensive monitoring equipment to test them, that effort was to develop highly accurate missiles, and is not indicative of the effort required by North Korea to develop an adequate RV to deliver a nuclear weapon to a city.

The Hwasong-15 RV

When the photos appeared after North Korea’s November 29 missile launch, I was particularly interested to see the reentry vehicle (RV) on the top of this missile. The RV contains the warhead and protects it on its way to the ground. It is significant that the Hwasong-15 RV is considerably wider and blunter than that on the Hwasong-14 (Fig. 1).

Fig. 1. The RVs for the Hwasong-14 (left) and Hwasong-15 (right), roughly to scale. (Source: KCNA)

This fact has several implications. The new RV can clearly accommodate a larger diameter warhead, and the warhead can sit farther forward toward the nose of the RV. This moves the center of mass forward and makes the RV more stable during reentry. (This drawing shows how the cylindrical nuclear weapon in the US Trident II RV, which was roughly the same size and shape, although much heavier, than the Hwasong-15 RV.)

But the blunter nose on the Hwasong-15 RV also helps protect it from high atmospheric forces and heating during reentry. Here’s why:

As the RV enters the atmosphere, drag due to the air acts as a braking force to slow it down, and that braking force puts stress on the warhead. At the same time, much of the kinetic energy the RV loses as it slows down shows up as heating of the air around the RV. Some of that heat is transferred from the air to the RV, and therefore heats up the warhead. If the stress and/or heating are too great they can damage the RV and the warhead inside it.

A blunter RV has higher drag and slows down in the thin upper parts of the atmosphere more than does a slender RV, which continues at high speed into the thick lower parts of the atmosphere. This results in significantly less intense stress and heating on the blunter RV. In addition to that, a blunt nose creates a broad shock wave in front of the RV that also helps keep the hot air from transferring its heat to the RV.

Fig. 2. This shows two low-drag RVs being placed on a Minuteman III missile, which can carry three RVs. (Source: US Air Force).

A rough estimate shows that if the RVs had the same mass and flew on the same trajectory, the peak atmospheric forces and heating experienced by the Hwasong-14 RV in Fig. 1 would be roughly four or more times as great as that experienced by the Hwasong-15 RV; those on a modern US RV, like that on the Minuteman III missile (Fig. 2), might be 20 times as large as on the Hwasong-15 RV.

The tradeoff of having a blunt warhead is that when the RV travels more slowly through the atmosphere it reduces its accuracy. In order to get very high accuracy with its missiles, the United States spent a tremendous amount of effort developing highly sophisticated heatshields that could withstand the heating experienced by a slender, low-drag RV.

For North Korea, the decrease in accuracy due to a blunt RV is not particularly important. The accuracy of its long-range missiles will likely be tens of kilometers. That means that it would not use its missiles to strike small military targets, but would instead strike large targets like cities. For a large target like that, the reduction in accuracy due to a blunt RV is not significant.

What could North Korea learn from its recent test?

Press stories report US officials as saying that the reentry vehicle on North Korea’s November 29 test “had problems” and “likely broke up” during reentry. If true, this implies that the RV used on this flight could not withstand the strong drag forces as the RV reached low altitudes.

It’s worth noting that the drag forces on the RV during reentry on the lofted trajectory would be more than twice as great as they would be on a standard trajectory of 13,000 km range flown by the same missile (Fig. 3). This is because on the flatter trajectory, the RV flies through a longer path of thin air and therefore slows down more gently than on the lofted trajectory. It is therefore possible the RV might survive if flown on a standard trajectory, but North Korea has not yet demonstrated that it would.

However, given the estimated capability of the Hwasong-15 missile, North Korea appears to have the option of strengthening the RV, which would increase its mass somewhat, and still be able to deliver a warhead to long distances.

Fig. 3. This figure shows the atmospheric forces on the RV with altitude as it reenters, for the highly lofted test on November 29 (black curve) compared to the same missile flying a 13,000 km standard  trajectory (a minimum-energy trajectory, MET). The horizontal axis plots the product of the atmospheric density and square of the RV speed along its trajectory, which is proportional to the drag force on the RV. The calculations in all these figures assume a ballistic coefficient of the RV of 100 lb/ft2 (5 kN/m2). Increasing the ballistic coefficient will increase the magnitude of the forces and move the peaks to somewhat lower altitudes, but the comparative size of the curves will remain similar.

The situation is similar with heating of the RV. The last three columns of Fig. 4 compare several measures of the heating experienced by the RV on the lofted November 29 test to what would be experienced by the same RV on a 13,000 km-range missile on a standard trajectory (MET).

Fig. 4. A comparison of RV forces and heating on the November 29 test and on a 13,000 km-range trajectory, assuming both missiles have the same RV and payload. A discussion of these quantities is given in the “Details” section below.

These estimates show that the maximum heating experienced on the lofted trajectory would be about twice that on a standard trajectory, but that total heat absorbed by the RV on the two trajectories would be roughly the same. Because the heating occurs earlier on the RV on the standard trajectory than on the lofted trajectory, that heat has about 130 seconds to diffuse through the insulation of the RV to the warhead, while the heat on the lofted trajectory diffuses for about 80 seconds (Fig. 5). This somewhat longer time for “heat soak” can increase the amount of heat reaching the warhead, but North Korea would put insulation around the warhead inside the RV, and the heat transfer through insulators that North Korea should have access to is low enough that this time difference is probably not significant.

Fig. 5: This figure shows how the heating rate of the RV surface varies with time before impact on the lofted and standard trajectory. The areas under the curves are proportional to the total heat absorbed by the RV, and is only about 20% larger for the MET. The vertical axis plots the product of the atmospheric density and the cube of the RV speed along its trajectory, which is proportional to the heating rate on the RV.

Fig. 6 shows heating on the two trajectories with altitude.

Fig. 6. This figure shows the heating of the RV with altitude as it reenters.

These results show that if North Korea were able to demonstrate that its RV could survive the peak drag forces and heating on a lofted trajectory, it should also be able to survive those on a standard trajectory. As noted above, the estimated capability of the Hwasong-15 missile suggests North Korea would be able to increase the structural strength of the RV and its heat shielding and still be able to deliver a warhead to long distances.

There is still some question about what information North Korea may actually be getting from its tests. One advantage of testing on highly lofted trajectories that fall in the Sea of Japan is that the RV can presumably radio back data to antennae in North Korea for most of the flight. However, because of the curvature of the Earth, an antenna on the ground in North Korea would not be able to receive signals once the RV dropped below about 80 km altitude at a distance of 1000 km. To be able to track the missile down to low altitudes it would likely need a boat or plane in the vicinity of the reentry point.

Some details

The rate of heat transfer per area (q) is roughly proportional to ρV3, where ρ is the atmospheric density and V is the velocity of the RV through the atmosphere. Since longer range missiles reenter at higher speeds, the heating rate increases rapidly with missile range. The total heat absorbed (Q) is the integral of q over time during reentry. Similarly, forces due to atmospheric drag are proportional to ρV2, and also increase rapidly with missile range.

The calculations above assume a ballistic coefficient of the RV equal to 100 lb/ft2 (5 kN/m2). The ballistic coefficient β = W/CdA (where W is the weight of the RV, Cd is its drag coefficient, and A is its cross-sectional area perpendicular to the air flow) is the combination of parameters that determines how atmospheric drag reduces the RV’s speed during reentry. The drag and heating values in the tables roughly scale with β. A large value of β means less atmospheric drag so the RV travels through the atmosphere at higher speed. That increases the accuracy of the missile but also increases the heating. The United States worked for many years to develop RVs with special coatings that allowed them to have high β and therefore high accuracy, but could also withstand the heating under these conditions.

Based on the shape of the Hwasong-15 RV, I estimate that its drag coefficient Cd is 0.35-0.4. That value gives β in the range of 100-150 lb/ft2 (5-7 kN/m2) for an RV mass of 500-750 kg. The drag coefficient of the Hwasong-14 RV is roughly 0.15.

Did Pilots See North Korea’s Missile Fail during Reentry?

News reports say that a Cathay Airlines flight crew on November 29 reported seeing North Korea’s missile “blow up and fall apart” during its recent flight test. Since reports also refer to this as happening during “reentry,” they have suggested problems with North Korea’s reentry technology.

But the details suggest the crew instead saw the missile early in flight, and probably did not see an explosion.

One report of the sighting by the Cathay CX893 crew gives the time as about 2:18 am Hong Kong time, which is 3:18 am Japan time (18:18 UTC). According to the Pentagon, the launch occurred at 3:17 am Japanese time (18:17 UTC), which would put the Cathay sighting shortly after the launch of the missile from a location near Pyongyang, North Korea.

Since the missile flew for more than 50 minutes, it would not have reentered until after 4 am Japanese time. Given the timing, it seems likely the crew might have seen the first stage burn out and separate from the rest of the missile. This would have happened a few minutes after launch, so is roughly consistent with the 3:18 time.

The New York Times posted a map that shows the track of flight CX893. It shows that the flight was over northern Japan at 6:18 pm UTC (Fig. 1) and the pilots would have had a good view of the launch. By the time reentry occurred around 7:11 pm UTC, the plane would have been over mid-Japan and reentry would have occurred somewhat behind them (Fig. 1).

Fig. 1. Maps showing the location of flight CX893 shortly after launch of North Korea’s missile near the red dot on the left map, and at the time of reentry of North Korea’s missile, which took place near the red dot on the right map. (Source: NYT with UCS addition)

Burnout of the first stage would have taken place at an altitude about 100 km higher than the plane, but at a lateral distance of some 1,600 km from the plane. As a result, it would have only been about 4 degrees above horizontal to their view—so it would not have appeared particularly high to them. Ignition of the second stage rocket engine and separation of the first stage may have looked like an explosion that caused the missile to fall apart.

There are also reports of two Korean pilots apparently seeing a “flash” about an hour after the missile’s launch, which would be consistent with the warhead heating up during reentry, since the missile flew for 53-54 minutes. Neither reported seeing an explosion, according to the stories.

Like Bonnie Tyler, NRC is Holding Out for a HERO

In Nuclear Energy Activist Toolkit #47, I summarized the regulations and practices developed to handle emergencies at nuclear power plants. While that commentary primarily focused on the response at the stricken plant site, it did mention that nuclear workers are required to notify the Nuclear Regulatory Commission (NRC) promptly following any declaration of an emergency condition. The NRC staffs its Operations Center 24 hours a day, 365 days a year to receive and process emergency notifications.

In late September 2017, I was made aware that the NRC was not staffing its Operations Center with the number of qualified individuals as mandated by its procedures. Specifically, NRC Management Directive 8.2, “Incident Response Program,” dictates that the Operations Center be staffed with at least two individuals: one qualified as a Headquarters Operations Officer (HOO) and one qualified as a Headquarters Emergency Response Officer (HERO). The HOO is primarily responsible for responding to a nuclear plant emergency while the HERO provides administrative support such as interagency communications.

I learned that the NRC Operations Center was instead often being staffed with only one person qualified as a HOO and a second person tasked with a “life support” role. In other words, the “life support” person would summon help in case the HOO keeled over from a heart attack or spilt hot coffee on sensitive body parts.

Fig. 1 (Source: Joe Haupt Flickr photo)

I wrote to Bernard Stapleton, who heads the NRC’s incident response effort, on October 3, 2017, inquiring about the Operations Center staffing levels. The NRC’s response was both rapid and thorough.

A conference call was conducted on October 12, 2017, between me and Steve West, Acting Director of the NRC’s Office of Nuclear Security and Incident Response, and members of his staff, Bern Stapleton and Bo Pham. They informed me that it had been a challenge for the agency to staff the Operations Center in summer and fall 2017 with qualified HEROs due to several watch standers taking other positions within the NRC and a temporary hiring freeze imposed after the unanticipated termination of the construction of two new reactors at the Summer nuclear plant in South Carolina.

The former reason made sense as individuals with these skills seek promotions. The latter reason made sense as the NRC sought to find new positions for its staff members formerly assigned to the Summer project. The one-two punch of qualified persons leaving and the replacement pipeline being temporary shut off prevented the Operations Center from always being staffed with an individual HERO qualified. The Operations Center always had a HOO; it sometimes lacked a HERO.

They told me that two persons had recently been hired to fill the empty positions on the Operations Center staffing chart and those new hires would be undergoing training to achieve HERO qualifications. In addition, they told me about initiatives to qualify NRC staff outside of the Operations Center section to provide a larger cushion against future staffing challenges. The larger pool of qualified watch standers would have the collateral benefit of expanding the skill sets of individuals not assigned full-time to the Operations Center.

The NRC followed up on the conference call by sending me a letter dated November 16, 2017, documenting our conversation.

UCS Perspective

It would be better for everyone if the NRC had always been able to staff its Operations Center with individuals qualified as HOOs and HEROs. But the downside from problem-free conditions is the challenge in determining whether they are due more to luck than skill. How an organization responds to problems often provides more meaningful insights than a period of problem-free performance. On the other hand, an organization really, really good at responding to problems might reflect way too much experience having problems.

In this case, the NRC did not attempt to downplay or excuse the Operations Center staffing problems. Instead, they explained how the problems came about, what measures were being taken in the interim period, and what steps were planned to resolve the matter in the long term.

In other words, the NRC skillfully responded to the bad luck that had left the Operations Center short-handed for a while.

Chinese Military Strategy: A Work in Progress

Chinese President Xi Jinping, also general secretary of the Communist Party of China (CPC) Central Committee and chairman of the Central Military Commission (CMC), presents the heads of the People’s Liberation Army (PLA) Academy of Military Science with the military flag in Beijing, capital of China, July 19, 2017. (Xinhua/Li Gang)

Several years ago UCS reported China could put its nuclear weapons on high alert so they could be launched on warning of an incoming attack. Last week I had the opportunity to speak with some of the authors of The Science of Military Strategy: the authoritative Chinese military publication that was the source of the information in our report.

In a lively discussion, most of which took place between the authors themselves, I was able to confirm our original report is accurate. But I also learned more about how and why The Science of Military Strategy was written and what that can tell US observers about the broader context of how military thinking is evolving in China.

What it means to say China “can” launch on warning.

As of today, China keeps its nuclear forces off alert. The warheads and the missiles are separated and controlled by different commands. The operators are trained to bring them together and prepare them for launch after being attacked first.

China’s nuclear arsenal is small. Reliable estimates of the amount of weapons-grade plutonium China produced and the amount of plutonium China uses in its warheads tell us China has, at most, several hundred nuclear warheads. It has even fewer long-range missiles that could deliver those warheads to targets in the United States.

Because China’s nuclear arsenal is small and kept off alert some Chinese military strategists worry it could be completely wiped out in a single attack. Their US counterparts have told them, in person, that the United States will not rule out attempting a preemptive strike at the beginning of a war. The question for Chinese strategists is whether or not they should do something to mitigate this vulnerability. Many believe the risk of a major war with the United States is low and the risk of a nuclear war is even lower.

For Chinese strategists who don’t share that optimism, there are two basic ways to address their vulnerability. The first would be to significantly increase the size of China’s forces. Chinese nuclear weapons experts told me that would require a lot of time and considerable effort. They would need to resume producing plutonium for weapons and may also need to resume nuclear testing. The economic costs would be considerable. The diplomatic costs would be even greater.

The second way to avoid the risk of allowing an adversary to think they can wipe out China’s nuclear force with a preemptive strike is for China to put its forces on alert and enable them to be launched on warning of an incoming attack. That would require the development of an early warning system. It may also require upgrading China’s nuclear-capable missiles. One Chinese missile engineer explained that China’s existing missiles are not designed to be kept on continuous alert.

Either option would significantly alter China’s nuclear posture. But the latter may also require a consequential change in China’s nuclear doctrine.

China’s political leaders promised the world they would never, under any circumstances, be the first to use nuclear weapons. Wouldn’t launching on warning of attack, before any damage is done, violate that promise? The answer is not as obvious to Chinese policy-makers as it probably seems to their American counterparts, who don’t believe in the efficacy or credibility of a no first use pledge in the first place.

What I learned in my conversation with the authors of The Science of Military Strategy is that when they wrote that China “can” launch on warning of an incoming attack they were not saying China has the technical capability to do so,  nor were they announcing the intention to implement a launch on warning policy. They were simply declaring that, in their view, China could launch on warning—before their missiles were destroyed—without violating China’s no first use pledge.

Shouldn’t they have made that more explicit?

The authors told me, in response to a direct question, that they did not consider the impact of what they were writing on external audiences. That does not mean they were unaware non-Chinese might read it, just that they weren’t writing for them. The Science of Military Strategy is  an institutional assessment of China’s current strategic situation prepared for the consideration of the rest of China’s defense establishment and its political leadership. Those two audiences wouldn’t need to be told what the “can” in an Academy of Military Science (AMS) statement on launch on warning was referencing. They would already understand the context. As the authors explained, AMS is not responsible for making technical assessments of China’s capabilities, nor does it make public announcements about Chinese military policies or the intentions of China’s political leadership.

It’s difficult for many US observers to imagine that Chinese open source publications like The Science of Military Strategy aren’t just another form of Chinese Communist Party (CCP) propaganda. That’s understandable given Chinese government controls on speech and publication. But even in a relatively closed and tightly controlled polity like China’s, professionals still need to engage in meaningful discussion, including military professionals. Understanding that internal discussion from abroad requires more than parsing the language in Chinese publications. It also requires a sufficient degree of familiarity with the social, institutional and sometimes even the personal factors that define the context within which Chinese discussions of controversial topics – like nuclear weapons policy – take place.

Regular interaction with Chinese counterparts is the only way to acquire this familiarity. Unfortunately, both governments make that much more difficult than it needs to be. And language is still a significant barrier, especially on the US side.

Pessimism on US-China Relations

Most of my Chinese colleagues believe the intergovernmental relationship between China and the United States is deteriorating. The cooperative relationship of the 1980s and 1990s gradually gave way to an increasingly competitive relationship over the past two US administrations. The new edition of The Science of Military Strategy, composed over an 18-month period prior to its publication in 2013, addresses new issues that might emerge if this trend continues, and the relationship moves from competition toward conflict.

There is no fixed schedule for putting out a new edition. According to a general who was also involved the production of two prior editions, the first addressed concerns related to China-USSR relations. The second responded to the so-called “revolution in military affairs” exemplified by the new technologies used in the 1991 Gulf War. The current edition had no equally specific point of origin. It was, in the Chinese general’s words, more “forward-looking.” And as the Chinese military looks forward, its relationship with the United States looms large on the horizon.

None of the authors felt China’s overall military capabilities were remotely comparable to those of the United States. One of the more interesting barometers they used was the average annual salary of an ordinary soldier. All of the authors agreed this gap is unlikely to be closed in the foreseeable future. China still needs to focus its military development in select areas. Having a clearer understanding of what China’s future military challenges might be—an understanding AMS is charged with articulating—can help Chinese decision-makers set priorities.

That one of those priorities is addressing the vulnerability of China’s nuclear forces to a US preemptive attack is a troubling indicator of deteriorating relations.

 

North Korea’s Longest Missile Test Yet

After more than two months without a missile launch, North Korea did a middle-of-the-night test (3:17 am local time) today that appears to be its longest yet.

Reports are saying that the missile test was highly lofted and landed in the Sea of Japan some 960 km (600 miles) from the launch site. They are also saying the missile reached a maximum altitude of 4,500 km. This would mean that it flew for about 54 minutes, which is consistent with reports from Japan.

If these numbers are correct, then if flown on a standard trajectory rather than this lofted trajectory, this missile would have a range of more than 13,000 km (8,100 miles). This is significantly longer than North Korea’s previous long range tests, which flew on lofted trajectories for 37 minutes (July 4) and 47 minutes (July 28). Such a missile would have more than enough range to reach Washington, DC, and in fact any part of the continental United States.

We do not know how heavy a payload this missile carried, but given the increase in range it seems likely that it carried a very light mock warhead. If true, that means it would not be capable of carrying a nuclear warhead to this long distance, since such a warhead would be much heavier.

Trump and Asia’s Strongmen

Japanese Prime Minister Shinzo Abe poses for the cameras with US President Donald Trump during his recent trip to Asia.

Earlier this month, from the gallery of the Diet building in Tokyo, I listened to Prime Minister Shinzo Abe talk up his friendship with US President Donald Trump and their plans to pressure North Korea into giving up its nuclear weapons. This was the centerpiece of his State of the Union address and the claim that convinced anxious Japanese voters to support Abe’s Liberal Democratic Party (LDP) during the October 22nd election.

It is not unusual for the US-Japan relationship to take center stage in Japan’s domestic politics. No matter who is in the White House, most Japanese voters expect their prime minister to get on well the US president. The cold shoulder Barack Obama gave Abe’s predecessors from the Democratic Party of Japan (DPJ) expedited the demise of the only non-LDP led Japanese government in the last fifty years.

Abe’s domestic policies are unpopular. He rammed through a divisive national security law that restricted press freedom, stifling inquiry and dissent. He continues to push nuclear power despite the public’s post-Fukushima reticence. Abenomics increased economic growth but exploded the deficit and shuffled the gains to Japan’s top 1%, increasing inequality and undermining Japan’s social safety net without addressing any of Japan’s long-term economic challenges. Had the opposition not split over national security concerns, the LDP would have had a tougher time convincing Japanese voters to support them at the polls.

Playing the Field

Unfortunately for Mr. Abe, Mr. Trump is also fond of Chinese President Xi Jinping. The lavish praise Trump awarded the Chinese leader could eventually undermine Abe’s reputation as an able steward of US-Japan relations. Japanese anxieties about China run deeper than their concerns about North Korea. Sporadic fears of US abandonment have plagued Japan ever since Nixon went to China in 1972. For the time being, the Japanese media tends to underreport Trump’s budding bromance with Xi. Should that change, Mr. Abe might start to look like the weaker suitor for the current US president’s attention.

Vladimir Putin also got his share of kind words from the US president on his first official trip to Asia. Most importantly, the ex-KGB officer received a US presidential vote of confidence in his denial of Kremlin meddling in American politics. Putin’s illegal annexation of Crimea and his ongoing military intervention in Ukraine didn’t even make the news. Instead, the leader of the free world focused global attention on the Russian autocrat’s rough treatment at the hands of his Western critics.

Looking Forward

Sooner or later the Japanese public will start to wonder about the wisdom of Abe’s close personal relationship with Trump, especially if his US approval ratings stay in the basement and he begins to look like a one-term president. Japanese doubts may quickly turn to anger if the governing LDP spends money it doesn’t have on expensive military hardware it doesn’t need just to mollify Mr. Trump’s anger over a trade deficit that, because of the sheer size of the Japanese and US economies, could never be closed by US arms sales.

Unlike China and Russia, Japan is a democracy where its leaders are only as strong as the support of the people they govern, who eventually will hold them accountable at the polls. Mr. Abe’s tendency to stoke their fears and promise protection may win over a majority of Japanese voters for awhile, and some Japanese voters indefinitely. But the old adage attributed to Abraham Lincoln about the impossibility of successfully manipulating most voters most of the time probably still holds, even in the age of Facebook and Twitter.

Progressive opponents of authoritarian politicians can hasten their demise and prevent their return with better answers to the national security problems that often get them elected. Here in Japan, Yuriko Koike’s “Party of Hope” tried to out tough the LDP with nationalistic rhetoric on defense and trade. But the popular Tokyo governor’s party was crushed at the polls and she resigned from its leadership. Progressive Japanese legislators uncomfortable with Koike’s turn to the right reassembled as the Constitutional Democratic Party of Japan (CDPJ), which fared much better in the recent election and is now the largest opposition party in the Diet.

Tsujimoto Kiyomi, who is leading the fight against Abe’s effort to limit the opposition’s ability to question him, recognizes the CDPJ needs to address the electorate’s concerns about North Korea and China if it wants to lead a progressive Japanese majority back to power. In an interview hours before Abe’s address to the Diet, she explained that Trump’s hard line on North Korea—and Abe’s willingness to parrot it—were not the source of their support in Japan. Japanese voters, like their counterparts in South Korea and the United States, are understandably nervous when they hear both men claim that the time for dialog with North Korea is over. That implies preparations for military actions that could drag Japan into a war and lead to attacks on Japanese cities.

According to Ms. Kiyomi, and other CDPJ legislators I spoke with this month, Japanese voters were responding to Trump’s camaraderie with their prime minister. They understand Japan’s national defense depends on help from the United States. Specific policies matter less than the personal relationships Japanese voters find reassuring.

Unfortunately, because the LDP has been the majority party for all but three of the past 50 years, Japan’s progressive opposition hasn’t had much of chance to develop mature relationships with US government officials. Even when progressives were in charge of the government, the career LDP officials in the bureaucracy continued to dominate US-Japan relations. Moreover, these LDP bureaucrats sought to undermine their political opponents by telling US officials, and the Japanese public, that the new progressive Japanese leadership was anti-American. It’s an unfair accusation that stuck, creating a false impression that the new leadership of the CDPJ intends to work hard to correct.

Support from leading progressive politicians in the United States would help, a lot. Senator Bernie Sanders, for example, is a political hero in Japan. His campaign for the US presidency was well-received by Japanese voters who share many of the same economic anxieties Sanders spoke to during the 2016 election. Visible friendly relations with progressive US leaders like Sanders would give the LDP’s progressive opponents the same political shot in the arm that Abe got from his relationship with Trump.

More importantly, US progressives could learn a great deal about America’s most important Asian ally if they expanded their brief beyond the old school US Japan hands who steered President Obama away from progressive politicians in Japan. That’s especially true when it comes to defense and foreign policy. Progressive politicians in both countries have a hard-time convincing their respective voters that they can be effective international leaders. They might be able to change that by working together on tough problems like North Korea, rather than continuing to work separately.

 

UCS to Nuclear Regulatory Commission: Big THANKS!

This spring, I ran into Mike Weber, Director of the Office of Nuclear Regulatory Research for the Nuclear Regulatory Commission (NRC), at a break during a Commission briefing. The Office of Research hosts a series of seminars which sometimes include presentations by external stakeholders. I asked Mike if it would be possible for me to make a presentation as part of that series.

I explained that I’d made presentations during annual inspector conferences in NRC’s Regions I, II, and III in recent years and would appreciate the opportunity to reach out to the seminars’ audience. Mike commented that he’d heard positive feedback from my regional presentations and would welcome my presentation as part of their seminars. Mike tasked Mark Henry Salley and Felix Gonzalez from the Research staff to work out arrangements with me. The seminar was scheduled for September 19, 2017, in the auditorium of the Two White Flint North offices at NRC headquarters. I appreciate Mike, Mark, and Felix providing me the opportunity I sought to convey a message I truly wanted to deliver.

Fig. 1 (Source: Union of Concerned Scientists)

The title of my presentation at the seminar was “The Other Sides of the Coins.” The NRC subsequently made my presentation slides publicly available in ADAMS, their online digital library.

As I pointed out during my opening remarks, the NRC staff most often hears or reads my statements critical of how the agency did this or didn’t do that. My presentation that day focused on representative positive outcomes achieved by the NRC. For that presentation that day, my whine list was blank by design. Instead, I talked about the other sides of my usual two cents’ worth.

Fig. 2 (Source: Union of Concerned Scientists)

I summarized eight positive outcomes achieved by the NRC and listed five other positive outcomes. I emphasized that these were representative positive outcomes and far from an unabridged accounting. I told the audience members that I fully expected they would be reminded of other positive outcomes they were involved in as I covered the few during my presentation. Rather than feeling slighted, I hoped they would feel acknowledged and appreciated by extension.

One of the eight positive outcomes I summarized was the inadequate flooding protection identified by NRC inspectors at the Fort Calhoun nuclear plant in Nebraska. The NRC issued a preliminary Yellow finding—the second highest severity in its Green, White, Yellow, and Red classification system—in July 2010 for the flood protection deficiencies. To help put that Yellow finding in context, the NRC issued 827 findings during 2010: 816 Green, 9 White, and 2 Yellow. It was hardly a routine, run of the mill issuance.

The plant’s owner formally contested the preliminary Yellow finding, contending among other things that Fort Calhoun had operated for nearly 30 years with its flood protective measures, so they must be sufficient. The owner admitted that some upgrades might be appropriate, but contended that the finding should be Green, not Yellow.

The NRC seriously considered the owner’s appeal and revisited its finding and its severity determination. The NRC reached the same conclusion and issued the final Yellow finding in October 2010. The NRC then monitored the owner’s efforts to remedy the flood protection deficiencies.

The NRC’s findings and, more importantly, the owner’s fixes certainly came in handy when Fort Calhoun (the sandbagged dry spot in the lower right corner of Figure 3) literally became an island in the Missouri River in June 2011.

Recall that the NRC inspectors identified flood protection deficiencies nearly 8 months before the Fukushima nuclear plant in Japan experienced three reactor meltdowns due to flooding. Rather than waiting for the horses to trot away before closing the barn door, the NRC acted to close an open door to protect the horses before they faced harm. Kudos!

Fig. 3 (Source: Union of Concerned Scientists)

The real reason for my presentation in September and my commentary now is to acknowledge the efforts of the NRC staff. My concluding slide pointed out that tens of millions of Americans live within 50 miles of operating nuclear power plants and tens of thousands of Americans work at these operating plants. The efforts of the NRC staff make these Americans safer and more secure. I observed that the NRC staff deserved big thanks for their efforts and my final slide attempted to symbolically convey our appreciation. (The thanks were way bigger on the large projection screen in the auditorium. To replicate that experience, lean forward until your face is mere inches away from your screen.)

Fig. 4 (Source: Union of Concerned Scientists)

Whose Finger Is on the Button? Nuclear Launch Authority in the United States and Other Nations

Throughout the 2016 presidential campaign, and perhaps even more since Trump’s election, the media discovered a newfound interest in the minutiae of US nuclear policy. One question in particular has been asked over and over—can the president, with no one else to concur or even advise, order the use of US nuclear weapons? Most people have been shocked and somewhat horrified to find that there is a simple answer—yes.

Starting a nuclear war shouldn’t be easy

The president has the sole authority to order a nuclear strike—either a first strike or one in response to an attack. Although there are people involved in the process of transmitting and executing this order who could physically delay or refuse to carry it out, they have no legal basis for doing so, and it is far from clear what would happen if they tried.

This belated realization (the system has been in place since the early Cold War) has prompted some ideas for ways to change things, including legislation restricting the president’s ability to order a nuclear first strike without a declaration of war by Congress. But more often it has prompted concern—and sometimes outrage—without a clear idea of how to fix the problem.

It may be useful to ask how other nuclear-armed states approach the problem of making a decision about the use of their nuclear weapons. How does the US compare to Russia, China, and other nuclear-armed states? Are there existing systems that rely on multiple people to order the use of nuclear weapons that the US might learn from?

To try to answer these questions, our new issue brief compiles information on the systems that other nuclear-armed states have in place to order the use of their weapons. While information is necessarily limited, and some of these systems may not completely correspond to what would happen in a true crisis, they still provide useful information about what these countries think is important when making a decision about the use of nuclear weapons. And, in most cases, that includes some form of check on the power of any single individual to order the use of these weapons by him or herself.

The current US process for deciding to use nuclear weapons is unnecessarily risky in its reliance on the judgment of a single individual. There are viable alternatives to sole presidential authority, and it is past time for the US to establish a new process that requires the involvement of multiple decision-makers to authorize the use of nuclear weapons. An investigation of how this decision works in other nuclear-armed states provides a good place to start.

 

Grand Gulf: Three Nuclear Safety Miscues in Mississippi Warranting NRC’s Attention

The Nuclear Regulatory Commission (NRC) reacted to a trio of miscues at the Grand Gulf nuclear plant in Mississippi by sending a special inspection team to investigate. While none of the events had adverse nuclear safety consequences, the NRC team identified significantly poor performance by the operators in all three. The recurring performance shortfalls instill little confidence that the operators would perform successfully in event of a design basis or beyond design basis accident.

The Events

Three events prompted the NRC to dispatch a special inspection team to Grand Gulf:

(1) failure to recognize that reactor power fluctuating up and down by more than 10% during troubleshooting of a control system malfunction in June 2016 exceeded a longstanding safety criterion calling for immediate shutdown,

(2) failure to recognize in September 2016 that the backup reactor cooling system relied upon when the primary cooling system broke was unable to function if needed, and

(3) failure to understand how a control system worked on September 27, 2016, resulting in the uncontrolled and undesired addition of nearly 24,000 gallons of water to the reactor vessel.

(1) June 2016 Reactor Power Oscillation Miscue

Figure 1 shows the main steam system for a typical boiling water reactor like Grand Gulf. The reactor vessel is not shown but is located off its left side. Heat produced by the reactor core boils water. Four pipes transport the steam from the reactor vessel to the turbine. The steam spins the turbine which is connected to a generator (off the right side of Figure 1) to make electricity.

Fig. 1 (Source: Nuclear Regulatory Commission)

Periodically, operators reduce the reactor power level to about 65% power and test the turbine stop valves (labeled SV in Figure 1). The stop valves are fully open when the turbine is in service, but are designed to rapidly close automatically if a turbine problem is detected. When the reactor is operating above about 30 percent power, closure of the stop valves triggers the automatic shutdown of the reactor. Below about 30 percent power, the main steam bypass valves (shown in the lower left of Figure 1) open to allow the steam flow to the main condenser should the stop valves close.

Downstream of the turbine stop valves are the turbine control valves (labeled CV in Figure 1.) The control valves are partially open when the turbine is in service. The control valves are automatically re-positioned by the electro-hydraulic control (labeled EHC) system as the operators increase or decrease the reactor power level. Additionally, the EHC system automatically opens the three control valves in the other steam pipes more fully when the stop valve in one steam pipe closes. The EHC system and the control valve response time is designed to minimize the pressure transient experienced in the reactor vessel when the steam flow pathways change.

The test involves the operators closing each stop valve to verify these safety features function properly. During testing on June 17, 2016, however, unexpected outcomes were encountered. The EHC system failed to properly reposition the control valves in the other lines when a stop valve was closed, and later when it was re-opened. The control system glitch caused the reactor power level to increase and decrease between 63% and 76%.

Water flowing through the core of a boiling water reactor is heated to the boiling point. By design, the formation of steam bubbles during boiling acts like a brake on the reactor’s power level. Atoms splitting within the reactor core release heat. The splitting atoms also release neutrons, subcomponents of the atoms. The neutrons can interact with other atoms to cause them to split in what is termed a nuclear chain reaction. The neutrons emitted by splitting atoms have high energy and high speed. The neutrons get slowed down by colliding with water molecules. While fast neutrons can cause atoms to split, slower neutrons perform this role significantly better.

The EHC system problems caused the turbine control valves to open wider and close more than was necessary to handle the steam flow. Turbine control valves opened wider than necessary lowered the pressure inside the reactor vessel, allowing more steam bubbles to form. With fewer water molecules around to slow down the fast neutrons, more neutrons went places other than interacting with atoms to cause more fissions. The reactor power level dropped as the neutron chain reaction rate slowed.

When turbine control valves closed more than necessary, the pressure inside the reactor vessel increased. The higher pressure collapsed steam bubbles and made it harder for new bubbles to form. With more water molecules around, more neutrons interacted with atoms to cause more fissions. The reactor power level increased as the neutron chain reaction rate quickened.

Workers performed troubleshooting of the EHC system problems for 40 minutes. The reactor power level fluctuated between 63% and 76% as the turbine control valves closed too much and then opened too much. Finally, a monitoring system detected the undesired power fluctuations and automatically tripped the reactor, causing all the control rods to rapidly insert into the reactor core and stop the nuclear chain reaction.

The NRC’s special inspection team reported that the control room operators failed to realize that the 10% power swings exceeded a safety criterion that called for the immediate shut down of the reactor. Following a reactor power level instability event at the LaSalle nuclear plant in Illinois in March 1988, Grand Gulf and other boiling water reactors revised operating procedures in response to an NRC mandate to require reactors to be promptly shut down when the reactor power level oscillated by 10% or more.

EHC system problems causing unwanted and uncontrolled turbine control valve movements had been experienced eight times in the prior three years. Operators wrote condition reports about the problems, but no steps had been taken to identify the cause and correct it.

Consequences

Due to the intervention by the system triggering the automatic reactor scram, this event did not result in fuel damage or release of radioactive materials exceeding normal, routine releases. But that outcome was achieved despite the operators’ efforts but because of them. The operators’ training and procedures should have caused them to manually shut down the reactor when its power level swung up and down by more than 10%. Fortunately, the plant’s protective features intervened to remedy their poor judgement.

(2) September 2016 Backup Reactor Cooling System Miscue

On September 4, 2016, the operators declared residual heat removal (RHR) pump A (circled in red in the lower middle portion of Figure 2) to be inoperable after it failed a periodic test. The pump was one of three RHR pumps that can provide makeup cooling water to the reactor vessel in case of an accident. RHR pumps A and B can also be used to cool the water within the reactor vessel during non-accident conditions. Grand Gulf’s operating license only permitted the unit to continue running for a handful of days with RHR pump A inoperable. So, the operators shut down the reactor on September 8 to repair the pump.

Fig. 2 (Source: Nuclear Regulatory Commission)

The operating license required two methods of cooling the water within the reactor vessel during shut down conditions. RHR pump B functioned as one of the methods. The operators took credit for the alternate decay heat removal (ADHR) system as the second method. The ADHR system is shown towards the upper right of Figure 2. It features two pumps that can take water from the reactor vessel, route it through heat exchangers, and return the cooled water to the reactor vessel. The ADHR system’s heat exchangers are supplied with cooling water from the plant service water (PSW) system. Warmed water from the reactor vessel flows through hundreds of metal tubes within the ADHR heat exchangers. Heat conducted through the tube walls gets carried away by the PSW system.

By September 22, workers had replaced RHR pump A and successfully tested the replacement. The following day, operators attempted to place the ADHR system in service prior to removing RHR pump B from service. They discovered that all the PSW valves (circle in red in the upper right portion of Figure 2) to the ADHR heat exchangers were closed. With these valves closed, the ADHR pumps would only take warm water from the reactor vessel, route it through the ADHR heat exchangers, and return the warm water back to the reactor vessel without being cooled.

The operating license required workers to check each day that both reactor water cooling systems were available during shut down. Each day between September 9 and 22, workers performed this check via a paperwork exercise. No one ever walked out into the plant to verify that the ADHR pumps were still there and that the PSW valves were still open.

The NRC team determined that workers closed the PSW valves to the ADHR heat exchangers on August 10 to perform maintenance on the ADHR system. The maintenance work was completed on August 15, but the valves were mistakenly not re-opened until September 23 after being belatedly discovered to be mis-positioned.

Consequences

Improperly relying on the ADHR system in this event had no adverse nuclear safety consequences. It was relied upon was a backup to the primary reactor cooling system which successfully performed that safety function. Had the primary system failed, the ADHR system would not have been able to take over that function as quickly as intended. Fortunately, the ADHR system’s vulnerability was not exploited.

(3) September 2016 Reactor Vessel Overfilling Miscue

On September 24, Grand Gulf was in what is called long cycle cleanup mode. Water within the condenser hotwell (upper right portion of Figure 3) was being sent by the condensate pumps through filter demineralizers and downstream feedwater heaters before recycling back to the condenser via the startup recirculation line. A closed valve prevented this water from flowing into the reactor vessel. Long cycle cleanup mode allows the filter demineralizers to remove particles and dissolved ions from the water. Water purity is important in boiling water reactors because any impurities tend to collect within the reactor vessel rather than being carried away with the steam leaving the vessel. The water in the condenser hotwell is the water used over and over again in boiling water reactors to make the steam that spins the turbine-generator.

Fig. 3 (Source: Nuclear Regulatory Commission)

Workers were restoring RHR pump B to its standby alignment following testing. The procedure they used directed them to open the closed feedwater valve. This valve was controlled by three pushbuttons in the control room: OPEN, CLOSE, and STOP. As soon as this valve began opening, water started flowing into the reactor vessel rather than being returned to the condenser.

The operator twice depressed the CLOSE pushbutton wanting very much for the valve to re-close. But this valve was designed to travel to the fully opened position after the OPEN pushbutton was depressed and travel to the fully closed position after the CLOSE pushbutton was depressed. By design, the valve would not change direction until after it had completed its full travel.

Unless the STOP pushbutton was depressed. The STOP pushbutton, as implied by its label, caused the valve’s movement to stop. Once stopped, depressing the CLOSE pushbutton would close the valve and depressing the OPEN pushbutton would open it.

According to the NRC’s special inspection team, “operations personnel did not understand the full function of the operating modes of [the] valve.” No operating procedure directed the operators to use the STOP button. Training in the control room simulator never covered the role of the STOP button because it was not mentioned in any operating procedures.

Not able to use the installed control system to its advantage, the operator waited until the valve traveled fully open before getting it to fully re-close. But the valve is among the largest and slowest valves in the plant—more like an elephant than a cheetah in its speed.

During the time the valve was open, an estimated 24,000 gallons of water overfilled the reactor vessel. As shown in Figure 4, the vessel’s normal level is about 33 inches above instrument zero, or about 201 inches above the top of the reactor core. The 24,000 gallons filled the reactor vessel to 151 inches above instrument zero.

Fig. 4 (Source: Nuclear Regulatory Commission)

Consequences

The overfilling event had no adverse nuclear safety consequences (unless revealing procedure inadequacies, insufficient training, and performance shortcomings count.)

NRC Sanctions

The NRC’s special inspection team identified three violations of regulatory requirements. One violation involved inadequate procedures for the condensate and feedwater systems that resulted in the reactor vessel overfilling event on September 24.

Another violation involved crediting the ADHR system for complying with an operating license requirement between September 9 and 22 despite its being unable to perform the necessary reactor water cooling role due to closed valves in the plant service water supply to the ADHR heat exchangers.

The third violation involved inadequate verification of the ADHR system availability between September 9 and 22. Workers failed to properly verify the system’s availability and had merely assumed it was a ready backup.

UCS Perspective

Th trilogy of miscues, goofs, and mistakes that prompted the NRC to dispatch a special inspection team have a common thread. Okay, two common threads since all three happened at Grand Gulf. All three miscues reflected very badly on the operations department.

During the June power fluctuations miscue, the operators should have manually scrammed the reactor, but failed to do so. In addition, operators had experienced turbine control system problems eight times in the prior three years and initiated reports intended to identify the causes of the problems and remedy them. The maintenance department could have, and should have, reacted to these reports earlier. But the operations department could have, and should have, insisted on the recurring problems getting fixed rather than meekly adding to the list of unresolved problem reports.

During the September backup cooling system miscue, many operators over nearly two weeks had many opportunities to notice that the ADHR system would not perform as needed due to mispositioned valves. The maintenance department could have, and should have, not set a trap for the operators by leaving the valves closed when maintenance work was completed. But the operators are the only workers at the plant licensed by the NRC to ensure regulatory requirements intended to protect the public are met. They failed that legal obligation again and again between September 9 and 22.

During the September reactor vessel overfilling event, the operators failed to recognize that opening the feedwater valve while in long cycle cleanup mode would send water into the reactor vessel. That’s a fundamental mistake that’s nearly impossible to justify. The operators then compounded that mistake by failing to properly use the installed control system to mitigate the event. They simply did not understand how the three pushbutton controls worked and thus were unable to use them properly.

The poor operator performance that is the common thread among the trio of problems examined by the NRC’s special inspection team inspire little to no confidence that their performance will be any better during a design basis or beyond design basis event.

Scientists to Congress: The Iran Deal is a Keeper

The July 2015 Iran Deal, which places strict, verified restrictions on Iran’s nuclear activities, is again under attack by President Trump. This time he’s kicked responsibility over to Congress to “fix” the agreement and promised that if Congress fails to do so, he will withdraw from it.

As the New York Times reported, in response to this development over 90 prominent scientists sent a letter to leading members of Congress yesterday urging them to support the Iran Deal—making the case that continued US participation will enhance US security.

Many of these scientists also signed a letter strongly supporting the Iran Deal to President Obama in August 2015, as well as a letter to President-elect Trump in January. In all three cases, the first signatory is Richard L. Garwin, a long-standing UCS board member who helped develop the H-bomb as a young man and has since advised the government on all matters of security issues. Last year, he was awarded a Presidential Medal of Freedom.

What’s the Deal?

Diplomats announcing the framework of the JCPOA in 2015 (Source: US Dept. of State)

If President Trump did pull out of the agreement, what would that mean? First, the Joint Comprehensive Plan of Action (JCPoA) (as it is formally named) is not an agreement between just Iran and the US—but also includes China, France, Germany, Russia, the UK, and the European Union. So the agreement will continue—unless Iran responds by quitting as well. (More on that later.)

The Iran Deal is not a treaty, and did not require Senate ratification. Instead, the United States participates in the JCPoA by presidential action. However, Congress wanted to get into the act and passed The Iran Agreement Review Act of 2015, which requires the president to certify every 90 days that Iran remains in compliance.

President Trump has done so twice, but declined to do so this month and instead called for Congress—and US allies—to work with the administration “to address the deal’s many serious flaws.” Among those supposed flaws is that the deal covering Iran’s nuclear activities does not also cover its missile activities!

According to President Trump’s October 13 remarks:

Key House and Senate leaders are drafting legislation that would amend the Iran Nuclear Agreement Review Act to strengthen enforcement, prevent Iran from developing an inter– —this is so totally important—an intercontinental ballistic missile, and make all restrictions on Iran’s nuclear activity permanent under US law.

The Reality

First, according to the International Atomic Energy Agency, which verifies the agreement, Iran remains in compliance. This was echoed by Norman Roule, who retired this month after working at the CIA for three decades. He served as the point person for US intelligence on Iran under multiple administrations. He told an NPR interviewer, “I believe we can have confidence in the International Atomic Energy Agency’s efforts.”

Second, the Iran Deal was the product of several years of negotiations. Not surprisingly, recent statements by the United Kingdom, France, Germany, the European Union, and Iran make clear that they will not agree to renegotiate the agreement. It just won’t happen. US allies are highly supportive of the Iran Deal.

Third, Congress can change US law by amending the Iran Nuclear Agreement Review Act, but this will have no effect on the terms of the Iran Deal. This may be a face-saving way for President Trump to stay with the agreement—for now. However, such amendments will lay the groundwork for a future withdrawal and give credence to President Trump’s claims that the agreement is a “bad deal.” That’s why the scientists urged Congress to support the Iran Deal as it is.

The End of a Good Deal?

If President Trump pulls out of the Iran Deal and reimposes sanctions against Iran, our allies will urge Iran to stay with the deal. But Iran has its own hardliners who want to leave the deal—and a US withdrawal is exactly what they are hoping for.

If Iran leaves the agreement, President Trump will have a lot to answer for. Here is an agreement that significantly extends the time it would take for Iran to produce enough material for a nuclear weapon, and that would give the world an alarm if they started to do so. For the United States to throw that out the window would be deeply irresponsible. It would not just undermine its own security, but that of Iran’s neighbors and the rest of the world.

Congress should do all it can to prevent this outcome. The scientists sent their letter to Senators Corker and Cardin, who are the Chairman and Ranking Member of the Senate Foreign Relations Committee, and to Representatives Royce and Engel, who are the Chairman and Ranking Member of the House Foreign Affairs Committee, because these men have a special responsibility on issues like these.

Let’s hope these four men will do what’s needed to prevent the end of a good deal—a very good deal.

Grand Gulf: Emergency Pump’s Broken Record and Missing Record

The Grand Gulf Nuclear Station located about 20 miles south of Vicksburg, Mississippi is a boiling water reactor with a Mark III containment that was licensed to operate by the Nuclear Regulatory Commission (NRC) in November 1984. It recently set a dubious record.

The Mark III containment is a pressure-suppression containment type. It features a large amount of water in its pressure suppression pool and upper containment pool. In case of an accident, energy released into containment gets absorbed by this water, thus lessening the pressurization of the atmosphere within containment. The “energy sponge” role allows the Mark III containment to be smaller, and less expensive, than the non-pressure suppression containment structure that would be needed to handle an accident.

Fig. 1 (Source: Nuclear Regulatory Commission)

The emergency core cooling systems (ECCS) reside in a structure adjacent to the containment building. The ECCS for Grand Gulf consist of the high pressure core spray (HPCS) pump, the low pressure core spray (LPCS) pump, and three residual heat removal (RHR). The preferred source of water for the HPCS pump is the condensate storage tank (CST), although it can also draw water from the suppression pool within containment. The other ECCS pumps get their water from the suppression pool.

One of the RHR pumps (RHR Pump C) serves a single function, albeit an important one called the low pressure coolant injection (LPCI) function. When a large pipe connected to the reactor vessel breaks and drains cooling water rapidly from the vessel, RHR Pump C quickly provides a lot of water to replace the lost water and cool the reactor core.

The other two RHR pumps (RHR Pumps A and B) can perform safety functions in addition to the LPCI role. Each of these RHR pumps can be aligned to route water through a pair of heat exchangers. When in use, the heat exchangers cool down the RHR water.

RHR Pumps A and B can be used to cool the water within the reactor vessel. In what is called the shutdown cooling (SDC) mode, RHR Pump A or B takes water from the reactor vessel, routes this water through the pair of heat exchangers, and returns the cooled water to the reactor vessel.

Similarly, RHR Pumps A and B can use used to cool the water within the suppression pool. RHR Pump A or B draws water from the suppression pool, routes this water through the heat exchangers, and returns the cooled water to the suppression pool.

Finally, RHR Pumps A and B can be used to cool the atmosphere within the containment structure. RHR Pump A or B can take water from the suppression pool and discharge it through carwash styled sprinkler nozzles mounted to the inside surfaces of the containment’s upper walls and roof.

Fig. 2 (Source: Nuclear Regulatory Commission)

Given the varied safety roles played by RHR Pumps A and B, the operating license for Grand Gulf only permits the reactor to continue running for up to 7 days when either pump is unavailable. Workers started the 7-day shutdown clock on August 22, 2017, after declaring RHR Pump A to be inoperable. The ECCS pumps are tested periodically to demonstrate their capabilities. RHR Pump A failed to operate within its design band during testing. The pump was supposed to be able to deliver at least a flow rate of 7,756 gallon per minute for a differential pressure of at least 131 pounds per square inch differential across the pump. The differential pressure was too low when the pump delivered the specified flow rate. A higher differential pressure was required to demonstrate that the pump could also supply the necessary flow rate under more challenging accident conditions.

Before the clock ran out, workers shut down the Grand Gulf reactor on August 29. Workers replaced RHR Pump A and restarted the reactor on October 1, 2017.

It is rare that a boiling water reactor has to shut down for a month or longer to replace a broken RHR pump. The last time it happened in the United States was a year ago. Workers shut down the reactor on September 8, 2016, after an RHR pump failed testing on September 4. The RHR pump was unable to achieve the specified differential pressure and flow rate at the same time. Workers could throttle valves to satisfy the differential pressure criterion, but the flow rate was too low. Or, workers could reposition the throttle valves to obtain the specified flow rate, but the differential pressure was too low. The RHR pump was replaced and the reactor restarted on January 29, 2017.

The reactor—Grand Gulf.

The failed pump—RHR Pump A.

The “solution”—replace the failed pump.

UCS Perspective

Grand Gulf has experienced two failures and subsequent replacements of RHR Pump since the summer of 2016. That’s two more RHR pump replacements than the rest of the U.S. boiling water reactor fleet tallied during the same period. Call Guinness—Grand Gulf may have broken the world record for most RHR pump broken in a year!

Records are made to be broken, not RHR pumps.

The company’s report to the NRC about the most recent RHR Pump A failure dutifully noted that the same pump had failed and been replaced a year earlier, but claimed that corrective action could not have prevented this year’s failure of the pump. Maybe the same RHR pump broken twice within a year for two entirely unrelated reasons. The Easter bunny, the tooth fairy, and Santa Claus all agree that it’s at least possible.

On October 31, 2016, the NRC announced it was sending a special inspection team to Grand Gulf to investigate the failure of RHR Pump A and other problems.  The NRC’s press release concluded with this sentence: “An inspection report documenting the team’s findings will be publicly available within 45 days of the end of the inspection.”

As of October 24, 2017, no such inspection report has been made publicly available. Call Guinness—the NRC may have broken the world record for the longest special inspection ever!

Grand Gulf was restarted on January 29, 2017, 90 days after the NRC announced it was sending a special inspection team to investigate a series of safety problems. The inspection report should have been publicly available as promised to allay public concerns that the numerous safety problems that caused Grand Gulf to remain shut down for four months had been fixed.

On June 29, 2017—241 days after the NRC announced the special inspection report—I emailed the NRC’s Executive Director for Operations inquiring about the status of this overdue report.

On October 2, 2017—95 days after my inquiry—the NRC’s Executive Director for Operations emailed me a response. He indicated that the onsite portion of the special inspection was completed on November 4, 2016, and that the inspection report “should be issued within the next few weeks.”

The NRC promised to issue the special inspection report around December 19, 2016, when the inspection ended.

The NRC promises to value transparency.

The NRC should either stop making promises or start delivering results. Promises aren’t made to be broken, either. That’s what RHR pumps are for, at least in Mississippi.

Fig. 3 (Source: Kaja Bilek Flickr photo)

 

Update: Turkey Point Fire and Explosion

An earlier commentary described how workers installing a fire retardant wrap around electrical cables inside Switchgear Room 3A at the Turkey Point nuclear plant in Florida inadvertently triggered an explosion and fire that blew open the fire door between the room and adjacent Switchgear Room 3B.

I submitted a request under the Freedom of Information Act (FOIA) for all pictures and videos obtained by the special inspection team dispatched by the NRC to Turkey Point to investigate this event. The NRC provide me 70 color pictures in response to my request. This post updates the earlier commentary with some of those pictures.

The workers installing the fire retardant wrap cut the material in the hallway outside the switchgear rooms, but trimmed the material to fit as they put it in place. The trimming process created small carbon pieces. Ventilation fans blowing air within the switchgear room carried the carbon fiber debris around. The picture taken inside Switchgear Room 3A after the event show some of the carbon fiber debris on the floor along with debris caused by the fire and explosion (Fig. 1).

Fig. 1 (Source: Nuclear Regulatory Commission)

Some of the carbon fiber debris found its way inside metal panels containing energized electrical equipment. The debris created a pathway for electrical current to arc to nearby metal bolts. The bolts had been installed backwards, resulting in their ends being a little closer to energized electrical lines than intended. The electrical current was 4,160 volts, so it was quite a powerful spark as it arced to an undesired location (Fig. 2).

Fig. 2 (Source: Nuclear Regulatory Commission)

Law enforcement officers sometimes use Tasers to subdue a suspect. Taser guns fire two dart-like electrodes into the body to deliver an electric shock that momentarily incapacitates a person. The nuclear Taser at Turkey Point triggered an explosion and fire. The picture shows damage to a metal panel from the High Energy Arc Fault (HEAF) (Fig. 3).

Fig. 3 (Source: Nuclear Regulatory Commission)

Fortunately, there was not much combustible material within the switchgear room to sustain a fire for long. Fig. 4 shows some of the fire and smoke damage inside the switchgear room.

Fig 4 (Source: Nuclear Regulatory Commission)

The primary consequence from the explosion and fire in Switchgear Room 3A was damage to Fire Door 070-3 to adjacent Switchgear Room 3B. The Unit 3 reactor at Turkey Point has two switchgear rooms containing power supplies and controls for plant equipment. The fire door’s function is to prevent a fire in either room from affecting equipment in the adjacent room to minimize the loss of equipment (Fig. 5).

Fig. 5 (Source: Nuclear Regulatory Commission)

The metal fire door had a three-hour rating, meaning it was designed to remain intact even when exposed to the heat from a fire lasting up to three hours. The plant’s design assumed that a fire would be extinguished within that time. The plant’s design had also considered the forces caused by a HEAF event, but only looked at components within three feet of the arc. The fire door was more than 14 feet from the arc, but apparently was not aware of the 3-feet assumption (Fig. 6).

Fig. 6 (Source: Nuclear Regulatory Commission)

The force of the explosion pressed so hard against the fire door that it broke the latch and popped the door wide open. The fire door was more than 14 feet from the arc (even farther away after the explosion), but apparently was not aware of the 3-feet assumption (Fig. 7).

Fig 7 (Source: Nuclear Regulatory Commission)

I don’t have a picture of the fire door and its latch pre-explosion, but this closeup of the door’s latching mechanism suggests the magnitude of the force applied to popping it open. This picture also suggests the need to go back and revisit the 3-feet rule (Fig. 8).

Fig. 8 (Source: Nuclear Regulatory Commission)

The explosion and fire triggered the automatic shutdown of the Unit 3 reactor. The Shift Manager declared an Alert, the least serious of the NRC’s four emergency classifications, due to the explosion and fire affecting equipment within Switchgear Room 3A. Workers called the local fire department for assistance with the fire and a worker injured by the explosion. This picture of the operations log noted some of the major events during the first 90 minutes of the event (Fig. 9).

Fig. 9 (Source: Nuclear Regulatory Commission)

UCS Perspective

The earlier commentary explained that two minor events occurred the month before the explosion and fire. In each of those events, carbon fiber debris from workers trimming material inside the switchgear room landed on electrical breakers and caused them to open unexpectedly and unwanted. But those warnings were ignored and the practice continued until a more serious event occurred.

This HEAF event is also a warning. It failed a barrier installed to prevent an event in one switchgear room from affecting equipment in the adjacent room. It had been assumed that a HEAF event could only affect components within 3 feet, yet the damaged door was more than 14 feet away. If the assumption now shown to be patently false does not lead to re-evaluations and necessary upgrades, shame on the nuclear industry and the NRC for not heeding this very clear, unambiguous warning.

Why NRC Nuclear Safety Inspections are Necessary: Indian Point

This is the second in a series of commentaries about the vital role nuclear safety inspections conducted by the Nuclear Regulatory Commission (NRC) play in protecting the public. The initial commentary described how NRC inspectors discovered that limits on the maximum allowable control room air temperature at the Columbia Generating Station in Washington had been improperly relaxed by the plant’s owner. This commentary describes a more recent finding by NRC inspectors about an improper safety assessment of a leaking cooling water system pipe on Entergy’s Unit 3 reactor at Indian Point outside New York City.

Indian Point Unit 3: Leak Before Break

On February 3, 2017, the NRC issued Indian Point a Green finding for a violation of Appendix B to 10 CFR Part 50. Specifically, the owner failed to perform an adequate operability review per its procedures after workers discovered water leaking from a service water system pipe.

On April 27, 2016, workers found water leaking from the pipe downstream of the strainer for service water (SW) pump 31. As shown in Figure 1, SW pump 31 is one of six service water pumps located within the intake structure alongside the Hudson River. The six SW pumps are arranged in two sets of three pumps. Figure 1 shows SW pumps 31, 32, and 33 aligned to provide water drawn from the Hudson River to essential (i.e, safety and emergency) components within Unit 3. SW pumps 34, 35, and 36 are aligned to provide cooling water to non-essential equipment within Unit 3.

Fig. 1 (Source: Nuclear Regulatory Commission Plant Information Book) (click to enlarge)

Each SW pump is designed to deliver 6,000 gallons of flow. During normal operation, one SW pump can handle the essential loads while two SW pumps are needed for the non-essential loads. Under accident conditions, two SW pumps are needed to cool the essential equipment. The onsite emergency diesel generators can power either of the sets of three pumps, but not both simultaneously. If the set of SW pumps aligned to the essential equipment aren’t getting the job done, workers can open/close valves and electrical breakers to reconfigure the second set of three SW pumps to the essential equipment loops.

Because river water can have stuff in it that could clog some of the coolers for essential equipment, each SW pump has a strainer that attempts to remove as much debris as possible from the water. The leak discovered on April 27, 2016, was in the piping between the discharge check valve for SW pump 31 and its strainer. An arrow points to this piping section in Figure 1. The strainers were installed in openings called pits in the thick concrete floor of the intake structure. Water from the leaking pipe flowed into the pit housing the strainer for SW pump 31.

The initial leak rate was modest—estimated to be about one-eighth of a gallon per minute. The leak was similar to other pinhole leaks that had occurred in the concrete-lined, carbon steel SW pipes. The owner began daily checks on the leakage and prepared an operability determination. Basically, “operability determinations” are used within the nuclear industry when safety equipment is found to be impaired or degraded. The operability determination for the service water pipe leak concluded that the impairment did not prevent the SW pumps from fulfilling their required safety function. The operability determination relied on a sump pump located at the bottom of the strainer pit transferring the leaking water out of the pit before the water flooded and submerged safety components.

The daily checks instituted by the owner included workers recording the leak rate and assessing whether it had significantly increased. But the checks were against the previous day’s leak rate rather than the initial leak rate. By September 18, 2016, the leakage had steadily increased by a factor of 64 to 8 gallons per minute. But the daily incremental increases were small enough that they kept workers from finding the overall increase to be significant.

The daily check on October 15, 2016, found the pump room flooded to a depth of several inches. The leak rate was now estimated to be 20 gallons per minute. And the floor drain in the strainer pit was clogged (ironic, huh?) impairing the ability of its sump pump to remove the water. Workers placed temporary sump pumps in the room to remove the flood water and cope with the insignificantly higher leak rate. On October 17, workers installed a clamp on the pipe that reduced the leakage to less than one gallon per minute.

The operability determination was revised in response to concerns expressed by the NRC inspectors. The NRC inspectors were not satisfied by the revised operability determination. It continued to rely on the strainer pit sump pump removing the leaking water. But that sump pump was not powered from the emergency diesel generator and thus would not remove water should offsite power become unavailable. Step 5.6.4 of procedure EN-OP-14, “Operability Determination Process,” stated “If the Operability is based on the use or availability of other equipment, it must be verified that the equipment is capable of performing the function utilized in the evaluation.”

The operability determination explicitly stated that no compensatory measures or operator manual actions were needed to handle the leak, but the situation clearly required both compensatory measures and operator manual actions.

The NRC inspectors found additional deficiencies in the revised operability determination. The NRC inspectors calculated that a 20 gallon per minute leak rate coupled with an unavailable strainer pit sump pump would flood the room to a depth of three feet in three hours. There are no flood alarms in the room and the daily checks might not detect flooding until the level rose to three feet. At that level, water would submerge and potentially disable the vacuum breakers for the SW pumps. Proper vacuum breaker operation could be needed to successfully restart the SW pumps.

The NRC inspectors calculated that the 20 gallon per minute leak rate without remediation would flood the room to the level of the control cabinets for the strainers in 10 hours. The submerged control cabinets could disable the strainers, leading to blocked cooling water flow to essential equipment.

The NRC inspects calculated that the 20 gallon per minute leak rate without remediation would completely fill the room in about 29 hours, or only slightly longer than the daily check interval.

Flooding to depths of 3 feet, 10 feet, and the room’s ceiling affected all six SW pumps. Thus, the flooding represented a common mode threat that could disable the entire service water system. In turn, all safety equipment shown in Figure 2 no longer cooled by the disabled service water system could also be disabled. The NRC estimated that the flooding risk was about 5×10-6 per reactor year, solidly in the Green finding band.

Fig. 2 (Source: Nuclear Regulatory Commission Plant Information Book) (click to enlarge)

UCS Perspective

“Leak before break” is a longstanding nuclear safety philosophy. Books have been written about it (well, at least one report has been written and may even have been read.)  The NRC’s approval of a leak before break analysis can allow the owner of an existing nuclear power reactor to remove pipe whip restraints and jet impingement barriers. Such hardware guarded against the sudden rupture of a pipe filled with high pressure fluid from damaging safety equipment in the area. The leak before break analyses can provide the NRC with sufficient confidence that piping degradation will be detected by observed leakage with remedial actions taken before the pipe fails catastrophically. More than a decade ago, the NRC issued a Knowledge Management document on the leak before break philosophy and acceptable methods of analyzing, monitoring, and responding to piping degradation.

This incident at Indian Point illustrated an equally longstanding nuclear safety practice of “leak before break.” In this case, the leak was indeed followed by a break. But the break was not the failure of the piping but failure of the owner to comply with federal safety regulations. Pipe breaks are bad. Regulation breaks are bad. Deciding which is worse is like trying to decide which eye one wants to be poked in. None is far better than either.

As with the prior Columbia Generating Station case study, this Indian Point case study illustrates the vital role that NRC’s enforcement efforts plays in nuclear safety. Even after NRC inspectors voiced clear concerns about the improperly evaluated service water system pipe leak, Entergy failed to properly evaluate the situation, thus violating federal safety regulations. To be fair to Entergy, the company was probably doing its best, but in recent years, Entergy’s best has been far below nuclear industry average performance levels.

The NRC’s ROP is the public’s best protection against hazards caused by aging nuclear power reactors, shrinking maintenance budgets, emerging sabotage threats, and Entergy. Replacing the NRC’s engineering inspections with self-assessments by Entergy would lessen the effectiveness of that protective shield.

The NRC must continue to protect the public to the best of its ability. Delegating safety checks to owners like Entergy is inconsistent with that important mission.

Xi’s China

What’s happening in China? The US consensus seems to be that President Xi Jinping is upending the place. Yet, midway through an expected ten-year term China’s communist party general secretary delivered a report to the 19th Party Congress that reiterated all the language, ideas and policies that the Chinese communists have used to govern the country since the mid-1980s. The most remarkable thing about Xi’s China is that it hasn’t changed at all.

Chinese Communist Party General Secretary Xi Jinping addresses the 19th Party Congress

China remains a socialist country. Xi’s not only proud of that, he’s confident that continuing to follow the socialist road will put China on the right side of history. What makes his tenure at the top seem different is that he’s unapologetically elevated ideology over policy. In Chairman Mao’s parlance, Xi is a little more red than expert.

But that doesn’t mean he’s changed Chinese policy. Internationally, Xi reported China remains open to the outside world. Domestically, his government remains committed to economic and political reform. It may not be the kind of openness or the type of reform US officials hoped for, but US expectations for China have always been based on a different view of history. Even after the Chinese leadership used lethal military force to suppress nationwide public demonstrations in June of 1989, most US observers still believed that international engagement, market economics and the rise of the Chinese middle class would eventually lead to the fall of the Chinese Communist Party (CCP) and the emergence of a multi-party Chinese democracy. Instead, if Xi’s report is to be believed, Chinese socialism has emerged from the crucible of Tiananmen Square stronger than it was before.

Continuity and Change in Communist China

The last time China really changed was when Mao died. Mao believed that global revolution was right around the corner and that China was ready for a rapid transformation to communism. The leaders who inherited the party in Mao’s wake, especially Deng Xiaoping, saw the world and China’s place within it very differently. At home, China was only in the beginning stages of a transformation to socialism that would take a very long time. And as the party set about engineering that incremental transformation, China would need to engage the world as it was rather than imagining they would change it. Deng told his comrades they needed to be humble as they worked to fulfill their Chinese socialist dream to modernize the country and restore Chinese influence in the world.

Xi Jinping’s report does not stray too far from that advice. China’s made a lot of progress since Deng died twenty years ago, but it is still, according to Xi, in the early stages of a long-term transformation to socialism. China’s progress may have elevated its position in the world, and given China a greater say in international governance, but there is nothing in Xi’s report about China leading a movement to upend the global status quo.

Xi does believe that Chinese socialism can set an example for the rest of the world to follow, and that more active Chinese participation can help transform the international order. As a committed Marxist, Xi should believe an eventual transition to a socialist global order is inevitable. But in the short term, Xi’s China appears squarely focused on the fifth of humanity that lives within its borders, where good governance is at a crossroads, crippled by endemic corruption rooted in the attitudes and behavior of party cadres who’ve lost the faith. Xi’s project, if you take his party congress report at face value, seems to be to save Chinese socialism and consolidate its gains, not to change it.

Implications for the United States

Is a consolidated and internationally persuasive Chinese socialism a threat to the United States? Unfortunately, that’s a question many US analysts and officials are no longer inclined to address. During the Maoist era, when China was “more red than expert,” there was greater US interest in the content of Chinese socialism. Today, US observers tend to view the CCP leadership’s repeated recitations of its socialist principles and practices as propaganda masking personal or national ambitions.

US commentaries on Xi’s speech reflect this. Most of them interpret Xi’s campaign against corruption as a personal quest to consolidate power rather than a campaign to save Chinese socialism. Instead of taking Xi and his recent predecessors at their word and seeing the principal aim of their post-1980s efforts as the achievement of a “moderate level of prosperity” for China‘s 1.4 billion, many US observers see this as an attempt to hide the CCP’s real aim, which they believe is kicking the United States out of Asia and supplanting US dominance of the region. For Americans, the contest between the United States and China is perceived as an historic struggle between rising and falling national powers rather than competing ideologies.

If Xi is a budding dictator leading a nationalist political organization focused on replacing the United States at the top of a global hierarchy then US policy makers should be concerned. But what if the Chinese dream articulated in Xi’s report to the 19th Party Congress is a fair representation of the CCP’s ambitions? Should the United States be alarmed? The answer is not obvious and the question seems to deserve greater consideration.

Why NRC Nuclear Safety Inspections are Necessary: Columbia Generating Station

The Nuclear Regulatory Commission (NRC) adopted its Reactor Oversight Process (ROP) in 2000. The ROP is far superior to the oversight processes previously employed by the NRC. Among its many virtues, the NRC treats the ROP as a work in progress, meaning that agency routinely re-assesses the ROP and makes necessary adjustments.

Earlier this year, the NRC initiated a formal review of its engineering inspections with the goal of making them more efficient and more effective. During a public meeting on October 11, 2017, the NRC working group conducting the review outlined some changes to the engineering inspections that would essentially cover the same ground but with an estimated 8 to 15 percent reduction in person-hours (the engineering inspections and suggested revisions are listed on slide 7 of the NRC’s presentation). Basically, the NRC working group suggested repackaging the inspections so as to be able to examine the same number of items, but in fewer inspection trips.

The nuclear industry sees a different way to accomplish the efficiency and effectiveness gains sought by the NRC’s review effort—they propose to eliminate the NRC’s engineering inspections and replace them with self-assessments. The industry would mail the results from the self-assessments to the NRC for their reading pleasure.

UCS is wary of self-assessments by industry in lieu of NRC inspections. On one hand, statistics might show that self-assessments increase safety just as a community firing all its law enforcement officers would see a statistical decrease in arrests, suggesting a lower crime rate. I have been researching the records publicly available in ADAMS to compare the industry’s track record for finding latent safety problems with the NRC’s track record to see whether replacing NRC’s inspections with industry self-assessments could cause nuclear safety to go off-track.

This commentary is the first in a series that convinces us that the NRC’s engineering inspections are necessary for nuclear safety and that public health and safety will be compromised by replacing them with self-assessments by industry.

Columbia Generating Station: Not so Cool Safety Moves

The Columbia Generating Station is a boiling water reactor owned by Energy Northwest and located 12 miles northwest of Richland, Washington. The Washington Public Power Supply System (the original name of the plant’s owner) submitted a Preliminary Safety Analysis Report (PSAR) for the Washington Nuclear Project Unit 2 (the original name for the reactor) to the Atomic Energy Commission (AEC, the original name of the nuclear regulator) in February 1973.

The PSAR described the proposed design of the plant and associated safety studies that demonstrated compliance with regulatory requirements. The PSAR described the two systems intended to cool the control room during normal operation and during postulated accidents. The control room heating, ventilation, and air conditioning (HVAC) would use chillers within the Radwaste Building HVAC system during normal operation. Because the Radwaste Building HVAC system is not designed to withstand earthquake forces or remain running when offsite power is unavailable, it cannot be credited with performing this role during accident conditions. So, the Standby Service Water system was proposed to cool the control room during accidents. The Standby Service Water system features pumps, pipes, and valves that recirculate water between a large cooling pond and safety equipment within the plant. Two independent sets, called divisions in the figure, are used to enhance reliability of this safety function (Fig. 1).

Fig. 1 (Source: Energy Northwest modified by UCS)

The PSAR indicated that for worst-case design conditions of 77°F cooling pond water temperature and 105°F outside air temperature, the Standby Service Water system would prevent the air temperature within the control room from exceeding 104°F. The AEC/NRC expressed concern that such warm control room temperatures could impair both human and equipment performance.

The owner resolved the regulator’s concerns by committing to installing two Seismic Category I emergency chillers for the control room HVAC system (Fig. 2). The emergency chillers were fully redundant such that one emergency chiller alone could maintain the air temperature inside the control room from exceeding 78°F during an accident. The NRC issued an operating license for the Columbia Generating Station on April 13, 1984, with License Condition 2.C.(21) that required the two emergency chillers to be operable by May 31, 1984. In November 1984, the owner revised the PSAR (now called the Final Safety Analysis Report or FSAR) to describe the emergency chillers and their role in keeping the control room air temperature from exceeding 78°F.

Fig. 2 (Source: Energy Northwest)

In September 1989, the owner revised the FSAR to change the control room air temperature limit to 85°F. The owner determined that this change did not require prior NRC review and approval. The NRC later disagreed with this self-imposed temperature relaxation.

In May 1998, the owner revised the FSAR to change the control room air temperature limit from 85°F to 85°F effective (see below). Once again, the owner determined that this change did not require prior NRC review and approval. And again, the NRC later disagreed with this self-imposed temperature limit relaxation.

“Effective temperature” is based on a combination of wet-bulb and dry-bulb temperatures. The original 75°F and initial 85°F limits were based solely on dry-bulb temperatures. The 85°F effective temperature allowed dry-bulb temperatures of up to 105°F—higher than the control room air temperature expressly rejected by the regulator. The owner made this change without seeking NRC’s approval because it was considered an editorial change. The NRC later determined that this temperature limit relaxation was not an editorial change.

Because the Standby Service Water system alone could maintain the dry-bulb temperature inside the control room at or below 104°F and the revised limit was now 105°F, the owner implemented another change—also unreviewed and unapproved by the NRC—eliminating the need for the emergency chillers to perform any safety role during postulated accidents. The NRC issued a Severity Level IV non-cited violation on April 23, 103, for the owner relaxing the control room air temperature limit without prior NRC approval.

The following month, the owner notified the NRC about deficiencies in the test periodically conducted to demonstrate the adequacy of the Standby Service Water system to cool the control room during accident conditions. When the test deficiencies were remedied and the corrected test performed, one of the two Standby Service Water system trains failed. Workers determined that the tubes within the control room cooler units had become degraded due to the buildup of scale on the inside tube surfaces and the collection of sediment in the lower region of the units. Routine testing of the control room cooler units had been discontinued 16 years earlier.

So, around the same time that the owner improperly decided that the emergency chillers were no longer needed to cool the control room during accidents, it discontinued proper testing of the Standby Service Water system that it thought would perform this role during accidents. Maybe it was another editorial change that discontinued the tests.

On November 12, 2015, the NRC issued a Green finding for a violation of Criterion III, “Design Control,” of Appendix B to 10 CFR Part 50. The NRC inspectors found that the emergency chillers, as designed and governed by operating procedures, would not maintain the air temperature inside the control room below 85°F under accident conditions. The vendor manual for the emergency chillers stated that the STOP-RESET pushbutton had to be depressed after a power interruption because the chillers would not automatically restart. But the operating procedures failed to have the operators perform this necessary step.

On December 22, 2015, Energy Northwest contested the NRC’s finding. The owner stated, in writing, that “There are no design basis requirements to maintain the control room temperature at less than or equal to 85°F at all times for all accident scenarios” [boldfacing in original]. The owner further requested that the NRC conduct a backfit analysis per 10 CFR 50.109 before imposing these “new” regulatory requirements.

By letter dated June 10, 2016, the NRC responded to the owner’s appeal. The NRC carefully considered the owner’s arguments and delineated why it was rejecting each one. The NRC concluded “…it cannot be concluded that the system function as described in the current design basis can be achieved.”

On May 3, 2016 (perhaps sensing that its appeal would not be successful), the owner met with the NRC to discuss a pending license amendment request that would resolve the concerns about the emergency chillers. As shown in the figure, the two emergency chillers sit side-by-side in the same room vulnerable to a common mode, like a fire, disabling them both (Fig. 3). But the chillers are seismically qualified and redundant, consistent with the original commitment to install them. The pending license amendment request would reconcile departures from two NRC General Design Criteria and justify the use of manual vice automatic actions to place the chillers in service.

Fig. 3 (Source: Energy Northwest)

UCS Perspective

Under the Atomic Energy Act as amended, the NRC is tasked with establishing and enforcing regulations to protect workers and the public from the inherent hazards from nuclear power reactor operation.

Owners are responsible for conforming with applicable regulatory requirements. In this case, the owner made a series of changes that resulted in the plant not conforming with applicable regulatory requirements for the air temperature within the control room. But there’s no evidence suggesting that the owner knew that the changes were illegal yet made them anyway hoping not to get caught. Nevertheless, ignorance of the law is still not a valid excuse. The public is not adequately protected when safety regulations are not met, regardless of whether the violations are intentional or inadvertent.

This case study illustrates the vital role that NRC’s enforcement efforts plays in nuclear safety. The soundest safety regulation in the world serves little use unless owners abide by it. The NRCs inspection efforts either verify that owners are abiding by safety regulations or identify shortfalls. Self-assessments by owners are more likely to sustain mis-interpretations and misunderstandings than to flush out safety problems.

The NRC’s ROP is the public’s best protection against hazards caused by aging nuclear power reactors, shrinking maintenance budgets, and emerging sabotage threats. Replacing the NRC’s engineering inspections with self-assessments by the owners would lessen the effectiveness of that protective shield.

The NRC must continue to protect the public to the best of its ability. Delegating safety checks to owners is inconsistent with that important mission.

No, Missile Defense Will Not Work 97% of the Time

In an October 11 interview on Fox News, President Trump claimed:

We have missiles that can knock out a missile in the air 97 percent of the time. If you send two of them, they are going to get knocked down.

This is not true. At least not in any relevant way.

The only homeland missile defense system is the Ground-based Midcourse Defense (GMD) system, which I’ve written plenty about here in these pages, and have co-authored a recent report about. If you’ve been following along, you’ll know the president’s statement was clearly untrue.  I’ll explain why.

What does the actual test record show?

The GMD interceptors have succeeded in destroying the target in nine out of 18 tests since 1999 (50%).  They have destroyed their target in four out of 10 tries (40%) since the GMD system was nominally deployed in 2004. They have destroyed their target in two of the last five tests (40%).

So there is no basis to expect it to work any better than 40 to 50% of the time even under the most generous and easiest conditions—former Pentagon testing agency director Phil Coyle calls the test conditions so far as “scripted for success.”

While the test record says something about the GMD’s capabilities under scripted conditions, the real world will be more complex and challenging. The Pentagon’s highest testing official assessed in 2014 that the test program was “insufficient to demonstrate that an operationally useful capability exists.” More on this later.

But for sake of argument, say the “single shot kill probability” has been determined via tests to be 40 to 50% in those optimistic conditions. Because reliability is low, the US would fire multiple interceptors at the missile to try to boost the system’s effectiveness. Using four-on-one targeting, and a 40 to 50% chance that a given interceptor would work, this leads to a 6 to 13% chance that the warhead gets through.

Real-world conditions

But this isn’t the right question. If it came down to a nuclear attack, would North Korea send just a single missile, and choose the most convenient conditions? That seems unlikely. Let’s say the salvo is five incoming missiles. In that case, with an interceptor kill probability of 40 to 50%, using four interceptors on each missile, the probability that one warhead gets through is 28 to 50%. Uncomfortably high.

I could not stress more that this is a best-case scenario. It assumes that:

1) Failures are uncorrelated and not, e.g., a design flaw common to all interceptors, such as the guidance system issues that took nearly a decade to diagnose and fix,

2) The intercept attempts take place under simplified conditions and that the system is not being stressed as it would in a real-world situation, and

3) The system successfully identified the five real targets from among decoys. If the system cannot distinguish decoys from the real targets, it will have to engage them all, quickly depleting the interceptor inventory. These do not need to be the Ferraris of decoys to be an issue. Some of the GMD intercept tests have included decoys, but all of those have been designed to be easily distinguished from the target warhead.

In short, one can construct situations under which missile defense might destroy missiles: a small salvo of missiles sent without countermeasures and under the limited range of conditions under which the system has been tested. The problem is that these are not by any stretch the most *likely* situations. A potential adversary has every incentive to make the attack as difficult as possible to intercept if he is going to initiate World War Three.

Note that even if the president were instead talking about one of the missile defense systems that has a better and more complete test record, such as THAAD, the issues with not having been tested in operationally realistic conditions is the same. And because THAAD defends against shorter-range missiles from North Korea, which are cheaper and more plentiful, it has the additional issue that it may be overwhelmed even if it is able to discriminate between decoys and real targets. There just may be too many targets.

Why is this dangerous?

The best-case scenario is that President Trump is trying to avoid a confrontation by allowing himself to save face: he has declared that North Korea must not be able to threaten the US mainland with nuclear-armed missiles. Or that he hopes such statements would help dissuade North Korea from considering an attack.

Certainly worse than this is the possibility that Trump actually believes that strategic missile defense provides credible protection and he has not been advised correctly. One hopes he is provided accurate information by stewards of these programs, although at least in public, government official often describe the GMD system as much more capable than it has been demonstrated to be.

This is dangerous, because common sense would say that if we have spent $40 billion on a missile defense system that the US has claimed has been “operational” for going on fifteen years, it must “work.” But it doesn’t. Look at the test record.

The problem is that believing missile defense works when it doesn’t can lead you to take actions that make you need it, and then it can’t help you.

Don’t Make the Same Mistake on Iran that Bush Made on North Korea

Press reports say President Trump will likely not certify Iranian compliance with the Iran nuclear deal in the near future, setting up a situation in which Congress can reimpose sanctions and effectively end US compliance with the deal.

(Source: US State Dept.)

Since the agreement includes several other countries, that would significantly weaken the deal but would not end it.

Still, that the United States would undermine the agreement—which administration officials acknowledge Iran is abiding by—is incredibly short-sighted. It goes against the advice of President Trump’s senior advisors and essentially the whole US security policy community. It erodes US credibility as a treaty partner in future negotiations.

Killing the deal would throw out meaningful, verified limits on Iran’s ability to make nuclear weapons because the president doesn’t think the agreement goes far enough.

The US did this with North Korea, and it was a disaster

The US did this before—with North Korea—and that led to the crisis we are in today.

In 2001, when the Bush administration took office, there was an agreement in place (the Agreed Framework) that verifiably stopped North Korea’s production of plutonium for weapons and put international inspectors on the ground to make sure it was not cheating. This stopped Pyongyang from making fissile material that could be used for dozens of nuclear weapons, and provided the world valuable information about an intensely opaque country.

Also by 2001 North Korea had agreed to stop ballistic missile tests—which was readily verified by US satellites—as long as negotiations continued. This was also meaningful since it would cap Pyongyang’s missile capability at a range of only 800 miles.

Former Secretary of Defense William Perry, who was closely involved in the negotiations with Pyongyang, has said he believes at that point the United States was a couple months from reaching an agreement that would have ended the North’s nuclear and missile programs. This was years before North Korea had done any nuclear tests or long-range missile tests.

Instead of capturing these important restrictions and building on them, the Bush administration—like Trump today—argued these limits were flawed because they did not go far enough to reign in the whole range of activities the United States was concerned about. Bush stopped the talks and eventually let the constraints on North Korea’s nuclear and missile programs fall apart, bringing us to where we are today: facing a North Korea with hydrogen bombs and long-range missiles.

One reason the Bush administration gave for stopping implementation of the Agreed Framework was that Pyongyang had a fledgling uranium enrichment program that was not captured by the agreement. US negotiators knew about that program in the 1990s, and were watching it, but decided that ending Korea’s operating plutonium-production capabilities and getting inspectors on the ground was the crucial first step, and with that in place the uranium program could be addressed as a next step. The Agreed Framework was not meant to be all-encompassing—it was an important, logical step toward solving the bigger problem that was too complex to be solved all at once.

The Iran deal was similarly seen by those negotiating it as a meaningful, achievable step toward solving the bigger issues that could not be addressed all at once. And it has been successful at doing that.

Drifting toward disaster

In the case of Iran, as well as North Korea, President Trump is taking provocative steps that go against the advice of his senior advisors—and in many cases simply defy common sense. The stakes are extremely high in both cases. Dealing with them requires an understanding of the issues and potential consequences, and a long-term strategy built on realistic steps and not magical thinking.

If Trump de-certifies the Iran agreement, he will be tossing the fate of the deal to Congress. Congress needs to heed the advice the president is not taking. That means it should listen to Secretary of Defense James Mattis; Gen. Joseph Dunford, chair of the Joint Chiefs of Staff; Secretary of State Rex Tillerson; and others who believe it is in the best interests of the United States to continue to support the agreement.

We find ourselves in a situation in which the whims of the president are escalating conflicts that potentially put millions of lives at risk and create long-term security risks for the United States, and no one appears to have the ability to reign him in and stabilize things. That situation should be unacceptable to Congress and the US public. If this situation continues, it could go down as one of the darkest periods of US history.

Well-Deserved Recognition: ICAN Wins Nobel Peace Prize

For most of my professional life going back to the late 1980’s, I have been a nuclear weapons organizer/campaigner.  It’s my life’s work.  Over all these years, no group of campaigners has impressed me more than the good folks with the International Campaign to Abolish Nuclear Weapons (ICAN).  Their skill, passion, energy, professionalism and unrelenting doggedness is truly inspiring in our mutual pursuit of a safer world free of nuclear weapons.

I am not the only one who feels this way and today I am so pleased to join a global chorus of folks honoring and congratulating ICAN for being awarded the Nobel Peace Prize for their “work to draw attention to the catastrophic humanitarian consequences of any use of nuclear weapons and for its ground-breaking efforts to achieve a treaty-based prohibition of such weapons.”

It is hard to overstate how significant an achievement it was to get 122 nations to join together and adopt this treaty –one vigorously opposed by all of the nuclear weapons states and those under their nuclear protection.

To this day, the many supporters of the US nuclear status quo—both within and outside of the government—are full of excuses for not acting and not aggressively pursuing disarmament.  Even worse, the United States seems to be going in the wrong direction with all of the talk of, and plans for, new more usable nuclear weapons and the rebuilding of the entire US nuclear arsenal at a cost that is sure to exceed $1 trillion of our tax dollars. The international discussion that ICAN has been leading about nuclear weapons and humanitarian consequences is even more important in that context.

Similarly, it’s well past time for a debate on the morality of threatening millions of innocent civilians in the name of national security.  And who thinks it’s OK that one person has the power and authority to effectively end humanity?

What ICAN and many of us are saying is: let’s get serious folks (we are looking at you. nuclear weapons states) about nuclear disarmament before our luck runs out.

But for now, let’s raise our glasses and congratulate and honor everyone at ICAN and elsewhere who wake up every day and work so hard—against such incredible odds—to prevent nuclear war and make the world a safer, better place.  I thank you.  My children thank you.

Nuclear Plant Risk Studies: Then and Now

Nuclear plant risk studies (also called probabilistic risk assessments) examine postulated events like earthquakes, pipe ruptures, power losses, fires, etc. and the array of safety components installed to prevent reactor core damage. Results from nuclear plant risk studies are used to prioritize inspection and testing resources–components with greater risk significance get more attention.

Nuclear plant risk studies are veritable forests of event trees and fault trees. Figure 1 illustrates a simple event tree. The initiating event (A) in this case could be something that reduces the amount of reactor cooling water like the rupture of a pipe connected to the reactor vessel. The reactor protection system (B) is designed to detect this situation and immediately shut down the reactor.

Fig. 1. (Source: Nuclear Regulatory Commission)

The event tree branches upward based on the odds of the reactor protection system successfully performing this action and downward for its failure to do so. Two emergency coolant pumps (C and D) can each provide makeup cooling water to the reactor vessel to replenish the lost inventory. Again, the event tree branches upward for the chances of the pumps successfully fulfilling this function and downward for failure.

Finally, post-accident heat removal examines the chances that reactor core cooling can be sustained following the initial response. The column on the right describes the various paths that could be taken for the initiating event. It is assumed that the initiating event happens, so each path starts with A. Paths AE, ACE, and ACD result in reactor core damage. The letters added to the initiating event letter define what additional failure(s) led to reactor core damage. Path AB leads to another event tree – the Anticipated Transient Without Scram (ATWS) event tree because the reactor protection system failed to cause the immediate shut down of the reactor and additional mitigating systems are involved.

The overall risk is determined by the sum of the odds of pathways leading to core damage. The overall risk is typically expressed something like 3.8×10-5 per reactor-year (3.8E-05 per reactor-year in scientific notation). I tend to take the reciprocal of these risk values. The 3.8E-05 per reactor-year risk, for example, becomes one reactor accident every 26,316 years—the bigger the number, the lower the risk.

Fault trees examine reasons for components like the emergency coolant pumps failing to function. The reasons might include a faulty control switch, inadequate power supply, failure of a valve in the pump’s suction pipe to open, and so on. The fault trees establish the chances of safety components successfully fulfilling their needed functions. Fault trees enable event trees to determine the likelihoods of paths moving upward for success or downward for failure.

Nuclear plant risk studies have been around a long time. For example, the Atomic Energy Commission (forerunner to today’s Nuclear Regulatory Commission and Department of Energy) completed WASH-740 in March 1957 (Fig. 2). I get a kick out of the “Theoretically Possible but Highly Improbable” phrase in its subtitle. Despite major accidents being labeled “Highly Improbable,” the AEC did not release this report publicly until after it was leaked to UCS in 1973 who then made it available. One of the first acts by the newly created Nuclear Regulatory Commission (NRC) in January 1975 was to publicly issue an update to WASH-740. WASH-1400, also called NUREG-75/014 and the Rasmussen Report, was benignly titled “Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants.”

Fig. 2. (Source: Atomic Energy Commission)

Nuclear plant risk studies can also be used to evaluate the significance of actual events and conditions. For example, if emergency coolant pump A were discovered to have been broken for six months, analysts can change the chances of this pump successfully fulfilling its safety function to zero and calculating how much the broken component increased the risk of reactor core damage. The risk studies would determine the chances of initiating events occurring during the six months emergency coolant pump A was disabled and the chances that backups or alternates to emergency coolant pump A stepped in to perform that safety function. The NRC uses nuclear plant risk studies to determine when to send a special inspection team to a site following an event or discovery and to characterize the severity level (i.e., green, white, yellow, or red) of violations identified by its inspectors.

Nuclear Plant Risk Studies: Then

In June 1982, the NRC released NUREG/CR-2497, “Precursors to Potential Severe Core Damage Accidents: 1969-1979, A Status Report,” that reported on the core damage risk from 52 significant events during that 11-year period. The events included the March 1979 meltdown of Three Mile Island Unit 2 (TMI-2), which had a core damage risk of 100%. The effort screened 19,400 licensee event reports submitted to the AEC/NRC over that period, culled out 529 event for detailed review, identified 169 accident precursors, and found 52 of them to be significant from a risk perspective. The TMI-2 event topped the list, with the March 1975 fire at Browns Ferry placing second.

The nuclear industry independently evaluated the 52 significant events reported in NUREG/CR-2497. The industry’s analyses also found the TMI-2 meltdown to have a 100% risk of meltdown, but disagreed with all the other NRC risk calculations. Of the top ten significant events, the industry’s calculated risk averaged only 11.8% of the risk calculated by the NRC. In fact, if the TMI-2 meltdown is excluded, the “closest” match was for the 1974 loss of offsite power event at Haddam Neck (CT). The industry’s calculated risk for this event was less than 7% of the NRC’s calculated risk. It goes without saying (but not without typing) that the industry never, ever calculated a risk to be greater than the NRC’s calculation. The industry calculated the risk from the Browns Ferry fire to be less than 1 percent of the risk determined by the NRC—in other words, the NRC’s risk was “only” about 100 times higher than the industry’s risk for this event.

Fig. 3. Based on figures from June 1982 NRC report. (Source: Union of Concerned Scientists)

Bridging the Risk Gap?

The risk gap from that era can be readily attributed to the immaturity of the risk models and the paucity of data. In the decades since these early risk studies, the risk models have become more sophisticated and the volume of operating experience has grown exponentially.

For example, the NRC issued Generic Letter 88-20, “Individual Plant Examination for Severe Accident Vulnerabilities.” In response, owners developed plant-specific risk studies. The NRC issued documents like NUREG/CR-2815, “Probabilistic Safety Analysis Procedures Guide,” to convey its expectations for risk models. And the NRC issued a suite of guidance documents like Regulatory Guide 1.174, “An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decision on Plant-Specific Changes to the Licensing Basis.” This is but a tiny sampling of the many documents issued by the NRC about how to conduct nuclear plant risk studies—guidance that simply was not available when the early risk studies were performed.

Complementing the maturation of nuclear plant risk studies is the massive expansion of available data on component performance and human reliability. Event trees begin with initiating events—the NRC has extensively sliced and diced initiating event frequencies. Fault trees focus on performance on the component and system level, so the NRC has collected and published extensive operating experience on component performance and system reliability. And the NRC compiled data on reactor operating times to be able to develop failure rates from the component and system data.

Given the sophistication of current risk models compared to the first generation risk studies and the fuller libraries of operating reactor information, you would probably think that the gap between risks calculated by industry and NRC has narrowed significantly.

Except for being absolutely wrong, you would be entirely right.

Nuclear Plant Risk Studies: Now

Since 2000, the NRC has used nuclear plant risk studies to establish the significance of violations of regulatory requirements, with the results determining whether a green, white, yellow, or red finding gets issued. UCS examined ten of the yellow and red findings determined by the NRC since 2000. The “closest” match between NRC and industry risk assessment was for the 2005 violation at Palo Verde (AZ) where workers routinely emptied water from the suction pipes for emergency core cooling pumps. The industry’s calculated risk for that event was 50% (half) of the NRC’s calculated risk, meaning that the NRC viewed this risk as double that of the industry’s view. And that was the closest that the risk viewpoints came. Of these ten significant violations, the industry’s calculated risk averaged only 12.7% of the risk calculated by the NRC. In other words, the risk gap narrowed only a smidgen over the decades.

Fig. 4. Ratios for events after 2000. (Source: Union of Concerned Scientists)

Risk-Deformed Regulation?

For decades, the NRC has consistently calculated nuclear plant risks to be about 10 time greater than the risks calculated by industry. Nuclear plant risk studies are analytical tools whose results inform safety decision-making. Speedometers, thermometers, and scales are also analytical tools whose results inform safety decision-making. But a speedometer reading one-tenth of the speed recorded by a traffic cop’s radar gun, or a thermometer showing a child to have a temperature one-tenth of her actual temperature, or a scale measuring one-tenth of the actual amount of chemical to be mixed into a prescription pill are unreliable tools that could not continue to be used to make responsible safety decisions.

Yet the NRC and the nuclear industry continue to use risk studies that clearly have significantly different scales.

On May 6, 1975, NRC Technical Advisor Stephen H. Hanauer wrote a memo to Guy A. Arlotto, the NRC’s Assistant Director for Safety and Materials Protection Standards. The second paragraph of this two-paragraph memo expressed Dr. Hanauer’s candid view of nuclear plant risk studies: “You can make probabilistic numbers prove anything, by which I mean that probabilistic numbers ‘prove’ nothing.”

Oddly enough, the chronic risk gap has proven the late Dr. Hanauer totally correct in his assessment of the value of nuclear plant risk studies. When risk models permit users to derive results that don’t reside in the same zip code yet alone the same ball park, the results prove nothing.

The NRC must close the risk gap, or jettison the process that proves nothing about risks.

Pages