UCS Blog - All Things Nuclear, Nuclear Power Safety - Latest 2

UCS to Nuclear Regulatory Commission: Big THANKS!

This spring, I ran into Mike Weber, Director of the Office of Nuclear Regulatory Research for the Nuclear Regulatory Commission (NRC), at a break during a Commission briefing. The Office of Research hosts a series of seminars which sometimes include presentations by external stakeholders. I asked Mike if it would be possible for me to make a presentation as part of that series.

I explained that I’d made presentations during annual inspector conferences in NRC’s Regions I, II, and III in recent years and would appreciate the opportunity to reach out to the seminars’ audience. Mike commented that he’d heard positive feedback from my regional presentations and would welcome my presentation as part of their seminars. Mike tasked Mark Henry Salley and Felix Gonzalez from the Research staff to work out arrangements with me. The seminar was scheduled for September 19, 2017, in the auditorium of the Two White Flint North offices at NRC headquarters. I appreciate Mike, Mark, and Felix providing me the opportunity I sought to convey a message I truly wanted to deliver.

Fig. 1 (Source: Union of Concerned Scientists)

The title of my presentation at the seminar was “The Other Sides of the Coins.” The NRC subsequently made my presentation slides publicly available in ADAMS, their online digital library.

As I pointed out during my opening remarks, the NRC staff most often hears or reads my statements critical of how the agency did this or didn’t do that. My presentation that day focused on representative positive outcomes achieved by the NRC. For that presentation that day, my whine list was blank by design. Instead, I talked about the other sides of my usual two cents’ worth.

Fig. 2 (Source: Union of Concerned Scientists)

I summarized eight positive outcomes achieved by the NRC and listed five other positive outcomes. I emphasized that these were representative positive outcomes and far from an unabridged accounting. I told the audience members that I fully expected they would be reminded of other positive outcomes they were involved in as I covered the few during my presentation. Rather than feeling slighted, I hoped they would feel acknowledged and appreciated by extension.

One of the eight positive outcomes I summarized was the inadequate flooding protection identified by NRC inspectors at the Fort Calhoun nuclear plant in Nebraska. The NRC issued a preliminary Yellow finding—the second highest severity in its Green, White, Yellow, and Red classification system—in July 2010 for the flood protection deficiencies. To help put that Yellow finding in context, the NRC issued 827 findings during 2010: 816 Green, 9 White, and 2 Yellow. It was hardly a routine, run of the mill issuance.

The plant’s owner formally contested the preliminary Yellow finding, contending among other things that Fort Calhoun had operated for nearly 30 years with its flood protective measures, so they must be sufficient. The owner admitted that some upgrades might be appropriate, but contended that the finding should be Green, not Yellow.

The NRC seriously considered the owner’s appeal and revisited its finding and its severity determination. The NRC reached the same conclusion and issued the final Yellow finding in October 2010. The NRC then monitored the owner’s efforts to remedy the flood protection deficiencies.

The NRC’s findings and, more importantly, the owner’s fixes certainly came in handy when Fort Calhoun (the sandbagged dry spot in the lower right corner of Figure 3) literally became an island in the Missouri River in June 2011.

Recall that the NRC inspectors identified flood protection deficiencies nearly 8 months before the Fukushima nuclear plant in Japan experienced three reactor meltdowns due to flooding. Rather than waiting for the horses to trot away before closing the barn door, the NRC acted to close an open door to protect the horses before they faced harm. Kudos!

Fig. 3 (Source: Union of Concerned Scientists)

The real reason for my presentation in September and my commentary now is to acknowledge the efforts of the NRC staff. My concluding slide pointed out that tens of millions of Americans live within 50 miles of operating nuclear power plants and tens of thousands of Americans work at these operating plants. The efforts of the NRC staff make these Americans safer and more secure. I observed that the NRC staff deserved big thanks for their efforts and my final slide attempted to symbolically convey our appreciation. (The thanks were way bigger on the large projection screen in the auditorium. To replicate that experience, lean forward until your face is mere inches away from your screen.)

Fig. 4 (Source: Union of Concerned Scientists)

Grand Gulf: Three Nuclear Safety Miscues in Mississippi Warranting NRC’s Attention

The Nuclear Regulatory Commission (NRC) reacted to a trio of miscues at the Grand Gulf nuclear plant in Mississippi by sending a special inspection team to investigate. While none of the events had adverse nuclear safety consequences, the NRC team identified significantly poor performance by the operators in all three. The recurring performance shortfalls instill little confidence that the operators would perform successfully in event of a design basis or beyond design basis accident.

The Events

Three events prompted the NRC to dispatch a special inspection team to Grand Gulf:

(1) failure to recognize that reactor power fluctuating up and down by more than 10% during troubleshooting of a control system malfunction in June 2016 exceeded a longstanding safety criterion calling for immediate shutdown,

(2) failure to recognize in September 2016 that the backup reactor cooling system relied upon when the primary cooling system broke was unable to function if needed, and

(3) failure to understand how a control system worked on September 27, 2016, resulting in the uncontrolled and undesired addition of nearly 24,000 gallons of water to the reactor vessel.

(1) June 2016 Reactor Power Oscillation Miscue

Figure 1 shows the main steam system for a typical boiling water reactor like Grand Gulf. The reactor vessel is not shown but is located off its left side. Heat produced by the reactor core boils water. Four pipes transport the steam from the reactor vessel to the turbine. The steam spins the turbine which is connected to a generator (off the right side of Figure 1) to make electricity.

Fig. 1 (Source: Nuclear Regulatory Commission)

Periodically, operators reduce the reactor power level to about 65% power and test the turbine stop valves (labeled SV in Figure 1). The stop valves are fully open when the turbine is in service, but are designed to rapidly close automatically if a turbine problem is detected. When the reactor is operating above about 30 percent power, closure of the stop valves triggers the automatic shutdown of the reactor. Below about 30 percent power, the main steam bypass valves (shown in the lower left of Figure 1) open to allow the steam flow to the main condenser should the stop valves close.

Downstream of the turbine stop valves are the turbine control valves (labeled CV in Figure 1.) The control valves are partially open when the turbine is in service. The control valves are automatically re-positioned by the electro-hydraulic control (labeled EHC) system as the operators increase or decrease the reactor power level. Additionally, the EHC system automatically opens the three control valves in the other steam pipes more fully when the stop valve in one steam pipe closes. The EHC system and the control valve response time is designed to minimize the pressure transient experienced in the reactor vessel when the steam flow pathways change.

The test involves the operators closing each stop valve to verify these safety features function properly. During testing on June 17, 2016, however, unexpected outcomes were encountered. The EHC system failed to properly reposition the control valves in the other lines when a stop valve was closed, and later when it was re-opened. The control system glitch caused the reactor power level to increase and decrease between 63% and 76%.

Water flowing through the core of a boiling water reactor is heated to the boiling point. By design, the formation of steam bubbles during boiling acts like a brake on the reactor’s power level. Atoms splitting within the reactor core release heat. The splitting atoms also release neutrons, subcomponents of the atoms. The neutrons can interact with other atoms to cause them to split in what is termed a nuclear chain reaction. The neutrons emitted by splitting atoms have high energy and high speed. The neutrons get slowed down by colliding with water molecules. While fast neutrons can cause atoms to split, slower neutrons perform this role significantly better.

The EHC system problems caused the turbine control valves to open wider and close more than was necessary to handle the steam flow. Turbine control valves opened wider than necessary lowered the pressure inside the reactor vessel, allowing more steam bubbles to form. With fewer water molecules around to slow down the fast neutrons, more neutrons went places other than interacting with atoms to cause more fissions. The reactor power level dropped as the neutron chain reaction rate slowed.

When turbine control valves closed more than necessary, the pressure inside the reactor vessel increased. The higher pressure collapsed steam bubbles and made it harder for new bubbles to form. With more water molecules around, more neutrons interacted with atoms to cause more fissions. The reactor power level increased as the neutron chain reaction rate quickened.

Workers performed troubleshooting of the EHC system problems for 40 minutes. The reactor power level fluctuated between 63% and 76% as the turbine control valves closed too much and then opened too much. Finally, a monitoring system detected the undesired power fluctuations and automatically tripped the reactor, causing all the control rods to rapidly insert into the reactor core and stop the nuclear chain reaction.

The NRC’s special inspection team reported that the control room operators failed to realize that the 10% power swings exceeded a safety criterion that called for the immediate shut down of the reactor. Following a reactor power level instability event at the LaSalle nuclear plant in Illinois in March 1988, Grand Gulf and other boiling water reactors revised operating procedures in response to an NRC mandate to require reactors to be promptly shut down when the reactor power level oscillated by 10% or more.

EHC system problems causing unwanted and uncontrolled turbine control valve movements had been experienced eight times in the prior three years. Operators wrote condition reports about the problems, but no steps had been taken to identify the cause and correct it.

Consequences

Due to the intervention by the system triggering the automatic reactor scram, this event did not result in fuel damage or release of radioactive materials exceeding normal, routine releases. But that outcome was achieved despite the operators’ efforts but because of them. The operators’ training and procedures should have caused them to manually shut down the reactor when its power level swung up and down by more than 10%. Fortunately, the plant’s protective features intervened to remedy their poor judgement.

(2) September 2016 Backup Reactor Cooling System Miscue

On September 4, 2016, the operators declared residual heat removal (RHR) pump A (circled in red in the lower middle portion of Figure 2) to be inoperable after it failed a periodic test. The pump was one of three RHR pumps that can provide makeup cooling water to the reactor vessel in case of an accident. RHR pumps A and B can also be used to cool the water within the reactor vessel during non-accident conditions. Grand Gulf’s operating license only permitted the unit to continue running for a handful of days with RHR pump A inoperable. So, the operators shut down the reactor on September 8 to repair the pump.

Fig. 2 (Source: Nuclear Regulatory Commission)

The operating license required two methods of cooling the water within the reactor vessel during shut down conditions. RHR pump B functioned as one of the methods. The operators took credit for the alternate decay heat removal (ADHR) system as the second method. The ADHR system is shown towards the upper right of Figure 2. It features two pumps that can take water from the reactor vessel, route it through heat exchangers, and return the cooled water to the reactor vessel. The ADHR system’s heat exchangers are supplied with cooling water from the plant service water (PSW) system. Warmed water from the reactor vessel flows through hundreds of metal tubes within the ADHR heat exchangers. Heat conducted through the tube walls gets carried away by the PSW system.

By September 22, workers had replaced RHR pump A and successfully tested the replacement. The following day, operators attempted to place the ADHR system in service prior to removing RHR pump B from service. They discovered that all the PSW valves (circle in red in the upper right portion of Figure 2) to the ADHR heat exchangers were closed. With these valves closed, the ADHR pumps would only take warm water from the reactor vessel, route it through the ADHR heat exchangers, and return the warm water back to the reactor vessel without being cooled.

The operating license required workers to check each day that both reactor water cooling systems were available during shut down. Each day between September 9 and 22, workers performed this check via a paperwork exercise. No one ever walked out into the plant to verify that the ADHR pumps were still there and that the PSW valves were still open.

The NRC team determined that workers closed the PSW valves to the ADHR heat exchangers on August 10 to perform maintenance on the ADHR system. The maintenance work was completed on August 15, but the valves were mistakenly not re-opened until September 23 after being belatedly discovered to be mis-positioned.

Consequences

Improperly relying on the ADHR system in this event had no adverse nuclear safety consequences. It was relied upon was a backup to the primary reactor cooling system which successfully performed that safety function. Had the primary system failed, the ADHR system would not have been able to take over that function as quickly as intended. Fortunately, the ADHR system’s vulnerability was not exploited.

(3) September 2016 Reactor Vessel Overfilling Miscue

On September 24, Grand Gulf was in what is called long cycle cleanup mode. Water within the condenser hotwell (upper right portion of Figure 3) was being sent by the condensate pumps through filter demineralizers and downstream feedwater heaters before recycling back to the condenser via the startup recirculation line. A closed valve prevented this water from flowing into the reactor vessel. Long cycle cleanup mode allows the filter demineralizers to remove particles and dissolved ions from the water. Water purity is important in boiling water reactors because any impurities tend to collect within the reactor vessel rather than being carried away with the steam leaving the vessel. The water in the condenser hotwell is the water used over and over again in boiling water reactors to make the steam that spins the turbine-generator.

Fig. 3 (Source: Nuclear Regulatory Commission)

Workers were restoring RHR pump B to its standby alignment following testing. The procedure they used directed them to open the closed feedwater valve. This valve was controlled by three pushbuttons in the control room: OPEN, CLOSE, and STOP. As soon as this valve began opening, water started flowing into the reactor vessel rather than being returned to the condenser.

The operator twice depressed the CLOSE pushbutton wanting very much for the valve to re-close. But this valve was designed to travel to the fully opened position after the OPEN pushbutton was depressed and travel to the fully closed position after the CLOSE pushbutton was depressed. By design, the valve would not change direction until after it had completed its full travel.

Unless the STOP pushbutton was depressed. The STOP pushbutton, as implied by its label, caused the valve’s movement to stop. Once stopped, depressing the CLOSE pushbutton would close the valve and depressing the OPEN pushbutton would open it.

According to the NRC’s special inspection team, “operations personnel did not understand the full function of the operating modes of [the] valve.” No operating procedure directed the operators to use the STOP button. Training in the control room simulator never covered the role of the STOP button because it was not mentioned in any operating procedures.

Not able to use the installed control system to its advantage, the operator waited until the valve traveled fully open before getting it to fully re-close. But the valve is among the largest and slowest valves in the plant—more like an elephant than a cheetah in its speed.

During the time the valve was open, an estimated 24,000 gallons of water overfilled the reactor vessel. As shown in Figure 4, the vessel’s normal level is about 33 inches above instrument zero, or about 201 inches above the top of the reactor core. The 24,000 gallons filled the reactor vessel to 151 inches above instrument zero.

Fig. 4 (Source: Nuclear Regulatory Commission)

Consequences

The overfilling event had no adverse nuclear safety consequences (unless revealing procedure inadequacies, insufficient training, and performance shortcomings count.)

NRC Sanctions

The NRC’s special inspection team identified three violations of regulatory requirements. One violation involved inadequate procedures for the condensate and feedwater systems that resulted in the reactor vessel overfilling event on September 24.

Another violation involved crediting the ADHR system for complying with an operating license requirement between September 9 and 22 despite its being unable to perform the necessary reactor water cooling role due to closed valves in the plant service water supply to the ADHR heat exchangers.

The third violation involved inadequate verification of the ADHR system availability between September 9 and 22. Workers failed to properly verify the system’s availability and had merely assumed it was a ready backup.

UCS Perspective

Th trilogy of miscues, goofs, and mistakes that prompted the NRC to dispatch a special inspection team have a common thread. Okay, two common threads since all three happened at Grand Gulf. All three miscues reflected very badly on the operations department.

During the June power fluctuations miscue, the operators should have manually scrammed the reactor, but failed to do so. In addition, operators had experienced turbine control system problems eight times in the prior three years and initiated reports intended to identify the causes of the problems and remedy them. The maintenance department could have, and should have, reacted to these reports earlier. But the operations department could have, and should have, insisted on the recurring problems getting fixed rather than meekly adding to the list of unresolved problem reports.

During the September backup cooling system miscue, many operators over nearly two weeks had many opportunities to notice that the ADHR system would not perform as needed due to mispositioned valves. The maintenance department could have, and should have, not set a trap for the operators by leaving the valves closed when maintenance work was completed. But the operators are the only workers at the plant licensed by the NRC to ensure regulatory requirements intended to protect the public are met. They failed that legal obligation again and again between September 9 and 22.

During the September reactor vessel overfilling event, the operators failed to recognize that opening the feedwater valve while in long cycle cleanup mode would send water into the reactor vessel. That’s a fundamental mistake that’s nearly impossible to justify. The operators then compounded that mistake by failing to properly use the installed control system to mitigate the event. They simply did not understand how the three pushbutton controls worked and thus were unable to use them properly.

The poor operator performance that is the common thread among the trio of problems examined by the NRC’s special inspection team inspire little to no confidence that their performance will be any better during a design basis or beyond design basis event.

Grand Gulf: Emergency Pump’s Broken Record and Missing Record

The Grand Gulf Nuclear Station located about 20 miles south of Vicksburg, Mississippi is a boiling water reactor with a Mark III containment that was licensed to operate by the Nuclear Regulatory Commission (NRC) in November 1984. It recently set a dubious record.

The Mark III containment is a pressure-suppression containment type. It features a large amount of water in its pressure suppression pool and upper containment pool. In case of an accident, energy released into containment gets absorbed by this water, thus lessening the pressurization of the atmosphere within containment. The “energy sponge” role allows the Mark III containment to be smaller, and less expensive, than the non-pressure suppression containment structure that would be needed to handle an accident.

Fig. 1 (Source: Nuclear Regulatory Commission)

The emergency core cooling systems (ECCS) reside in a structure adjacent to the containment building. The ECCS for Grand Gulf consist of the high pressure core spray (HPCS) pump, the low pressure core spray (LPCS) pump, and three residual heat removal (RHR). The preferred source of water for the HPCS pump is the condensate storage tank (CST), although it can also draw water from the suppression pool within containment. The other ECCS pumps get their water from the suppression pool.

One of the RHR pumps (RHR Pump C) serves a single function, albeit an important one called the low pressure coolant injection (LPCI) function. When a large pipe connected to the reactor vessel breaks and drains cooling water rapidly from the vessel, RHR Pump C quickly provides a lot of water to replace the lost water and cool the reactor core.

The other two RHR pumps (RHR Pumps A and B) can perform safety functions in addition to the LPCI role. Each of these RHR pumps can be aligned to route water through a pair of heat exchangers. When in use, the heat exchangers cool down the RHR water.

RHR Pumps A and B can be used to cool the water within the reactor vessel. In what is called the shutdown cooling (SDC) mode, RHR Pump A or B takes water from the reactor vessel, routes this water through the pair of heat exchangers, and returns the cooled water to the reactor vessel.

Similarly, RHR Pumps A and B can use used to cool the water within the suppression pool. RHR Pump A or B draws water from the suppression pool, routes this water through the heat exchangers, and returns the cooled water to the suppression pool.

Finally, RHR Pumps A and B can be used to cool the atmosphere within the containment structure. RHR Pump A or B can take water from the suppression pool and discharge it through carwash styled sprinkler nozzles mounted to the inside surfaces of the containment’s upper walls and roof.

Fig. 2 (Source: Nuclear Regulatory Commission)

Given the varied safety roles played by RHR Pumps A and B, the operating license for Grand Gulf only permits the reactor to continue running for up to 7 days when either pump is unavailable. Workers started the 7-day shutdown clock on August 22, 2017, after declaring RHR Pump A to be inoperable. The ECCS pumps are tested periodically to demonstrate their capabilities. RHR Pump A failed to operate within its design band during testing. The pump was supposed to be able to deliver at least a flow rate of 7,756 gallon per minute for a differential pressure of at least 131 pounds per square inch differential across the pump. The differential pressure was too low when the pump delivered the specified flow rate. A higher differential pressure was required to demonstrate that the pump could also supply the necessary flow rate under more challenging accident conditions.

Before the clock ran out, workers shut down the Grand Gulf reactor on August 29. Workers replaced RHR Pump A and restarted the reactor on October 1, 2017.

It is rare that a boiling water reactor has to shut down for a month or longer to replace a broken RHR pump. The last time it happened in the United States was a year ago. Workers shut down the reactor on September 8, 2016, after an RHR pump failed testing on September 4. The RHR pump was unable to achieve the specified differential pressure and flow rate at the same time. Workers could throttle valves to satisfy the differential pressure criterion, but the flow rate was too low. Or, workers could reposition the throttle valves to obtain the specified flow rate, but the differential pressure was too low. The RHR pump was replaced and the reactor restarted on January 29, 2017.

The reactor—Grand Gulf.

The failed pump—RHR Pump A.

The “solution”—replace the failed pump.

UCS Perspective

Grand Gulf has experienced two failures and subsequent replacements of RHR Pump since the summer of 2016. That’s two more RHR pump replacements than the rest of the U.S. boiling water reactor fleet tallied during the same period. Call Guinness—Grand Gulf may have broken the world record for most RHR pump broken in a year!

Records are made to be broken, not RHR pumps.

The company’s report to the NRC about the most recent RHR Pump A failure dutifully noted that the same pump had failed and been replaced a year earlier, but claimed that corrective action could not have prevented this year’s failure of the pump. Maybe the same RHR pump broken twice within a year for two entirely unrelated reasons. The Easter bunny, the tooth fairy, and Santa Claus all agree that it’s at least possible.

On October 31, 2016, the NRC announced it was sending a special inspection team to Grand Gulf to investigate the failure of RHR Pump A and other problems.  The NRC’s press release concluded with this sentence: “An inspection report documenting the team’s findings will be publicly available within 45 days of the end of the inspection.”

As of October 24, 2017, no such inspection report has been made publicly available. Call Guinness—the NRC may have broken the world record for the longest special inspection ever!

Grand Gulf was restarted on January 29, 2017, 90 days after the NRC announced it was sending a special inspection team to investigate a series of safety problems. The inspection report should have been publicly available as promised to allay public concerns that the numerous safety problems that caused Grand Gulf to remain shut down for four months had been fixed.

On June 29, 2017—241 days after the NRC announced the special inspection report—I emailed the NRC’s Executive Director for Operations inquiring about the status of this overdue report.

On October 2, 2017—95 days after my inquiry—the NRC’s Executive Director for Operations emailed me a response. He indicated that the onsite portion of the special inspection was completed on November 4, 2016, and that the inspection report “should be issued within the next few weeks.”

The NRC promised to issue the special inspection report around December 19, 2016, when the inspection ended.

The NRC promises to value transparency.

The NRC should either stop making promises or start delivering results. Promises aren’t made to be broken, either. That’s what RHR pumps are for, at least in Mississippi.

Fig. 3 (Source: Kaja Bilek Flickr photo)

 

Update: Turkey Point Fire and Explosion

An earlier commentary described how workers installing a fire retardant wrap around electrical cables inside Switchgear Room 3A at the Turkey Point nuclear plant in Florida inadvertently triggered an explosion and fire that blew open the fire door between the room and adjacent Switchgear Room 3B.

I submitted a request under the Freedom of Information Act (FOIA) for all pictures and videos obtained by the special inspection team dispatched by the NRC to Turkey Point to investigate this event. The NRC provide me 70 color pictures in response to my request. This post updates the earlier commentary with some of those pictures.

The workers installing the fire retardant wrap cut the material in the hallway outside the switchgear rooms, but trimmed the material to fit as they put it in place. The trimming process created small carbon pieces. Ventilation fans blowing air within the switchgear room carried the carbon fiber debris around. The picture taken inside Switchgear Room 3A after the event show some of the carbon fiber debris on the floor along with debris caused by the fire and explosion (Fig. 1).

Fig. 1 (Source: Nuclear Regulatory Commission)

Some of the carbon fiber debris found its way inside metal panels containing energized electrical equipment. The debris created a pathway for electrical current to arc to nearby metal bolts. The bolts had been installed backwards, resulting in their ends being a little closer to energized electrical lines than intended. The electrical current was 4,160 volts, so it was quite a powerful spark as it arced to an undesired location (Fig. 2).

Fig. 2 (Source: Nuclear Regulatory Commission)

Law enforcement officers sometimes use Tasers to subdue a suspect. Taser guns fire two dart-like electrodes into the body to deliver an electric shock that momentarily incapacitates a person. The nuclear Taser at Turkey Point triggered an explosion and fire. The picture shows damage to a metal panel from the High Energy Arc Fault (HEAF) (Fig. 3).

Fig. 3 (Source: Nuclear Regulatory Commission)

Fortunately, there was not much combustible material within the switchgear room to sustain a fire for long. Fig. 4 shows some of the fire and smoke damage inside the switchgear room.

Fig 4 (Source: Nuclear Regulatory Commission)

The primary consequence from the explosion and fire in Switchgear Room 3A was damage to Fire Door 070-3 to adjacent Switchgear Room 3B. The Unit 3 reactor at Turkey Point has two switchgear rooms containing power supplies and controls for plant equipment. The fire door’s function is to prevent a fire in either room from affecting equipment in the adjacent room to minimize the loss of equipment (Fig. 5).

Fig. 5 (Source: Nuclear Regulatory Commission)

The metal fire door had a three-hour rating, meaning it was designed to remain intact even when exposed to the heat from a fire lasting up to three hours. The plant’s design assumed that a fire would be extinguished within that time. The plant’s design had also considered the forces caused by a HEAF event, but only looked at components within three feet of the arc. The fire door was more than 14 feet from the arc, but apparently was not aware of the 3-feet assumption (Fig. 6).

Fig. 6 (Source: Nuclear Regulatory Commission)

The force of the explosion pressed so hard against the fire door that it broke the latch and popped the door wide open. The fire door was more than 14 feet from the arc (even farther away after the explosion), but apparently was not aware of the 3-feet assumption (Fig. 7).

Fig 7 (Source: Nuclear Regulatory Commission)

I don’t have a picture of the fire door and its latch pre-explosion, but this closeup of the door’s latching mechanism suggests the magnitude of the force applied to popping it open. This picture also suggests the need to go back and revisit the 3-feet rule (Fig. 8).

Fig. 8 (Source: Nuclear Regulatory Commission)

The explosion and fire triggered the automatic shutdown of the Unit 3 reactor. The Shift Manager declared an Alert, the least serious of the NRC’s four emergency classifications, due to the explosion and fire affecting equipment within Switchgear Room 3A. Workers called the local fire department for assistance with the fire and a worker injured by the explosion. This picture of the operations log noted some of the major events during the first 90 minutes of the event (Fig. 9).

Fig. 9 (Source: Nuclear Regulatory Commission)

UCS Perspective

The earlier commentary explained that two minor events occurred the month before the explosion and fire. In each of those events, carbon fiber debris from workers trimming material inside the switchgear room landed on electrical breakers and caused them to open unexpectedly and unwanted. But those warnings were ignored and the practice continued until a more serious event occurred.

This HEAF event is also a warning. It failed a barrier installed to prevent an event in one switchgear room from affecting equipment in the adjacent room. It had been assumed that a HEAF event could only affect components within 3 feet, yet the damaged door was more than 14 feet away. If the assumption now shown to be patently false does not lead to re-evaluations and necessary upgrades, shame on the nuclear industry and the NRC for not heeding this very clear, unambiguous warning.

Why NRC Nuclear Safety Inspections are Necessary: Indian Point

This is the second in a series of commentaries about the vital role nuclear safety inspections conducted by the Nuclear Regulatory Commission (NRC) play in protecting the public. The initial commentary described how NRC inspectors discovered that limits on the maximum allowable control room air temperature at the Columbia Generating Station in Washington had been improperly relaxed by the plant’s owner. This commentary describes a more recent finding by NRC inspectors about an improper safety assessment of a leaking cooling water system pipe on Entergy’s Unit 3 reactor at Indian Point outside New York City.

Indian Point Unit 3: Leak Before Break

On February 3, 2017, the NRC issued Indian Point a Green finding for a violation of Appendix B to 10 CFR Part 50. Specifically, the owner failed to perform an adequate operability review per its procedures after workers discovered water leaking from a service water system pipe.

On April 27, 2016, workers found water leaking from the pipe downstream of the strainer for service water (SW) pump 31. As shown in Figure 1, SW pump 31 is one of six service water pumps located within the intake structure alongside the Hudson River. The six SW pumps are arranged in two sets of three pumps. Figure 1 shows SW pumps 31, 32, and 33 aligned to provide water drawn from the Hudson River to essential (i.e, safety and emergency) components within Unit 3. SW pumps 34, 35, and 36 are aligned to provide cooling water to non-essential equipment within Unit 3.

Fig. 1 (Source: Nuclear Regulatory Commission Plant Information Book) (click to enlarge)

Each SW pump is designed to deliver 6,000 gallons of flow. During normal operation, one SW pump can handle the essential loads while two SW pumps are needed for the non-essential loads. Under accident conditions, two SW pumps are needed to cool the essential equipment. The onsite emergency diesel generators can power either of the sets of three pumps, but not both simultaneously. If the set of SW pumps aligned to the essential equipment aren’t getting the job done, workers can open/close valves and electrical breakers to reconfigure the second set of three SW pumps to the essential equipment loops.

Because river water can have stuff in it that could clog some of the coolers for essential equipment, each SW pump has a strainer that attempts to remove as much debris as possible from the water. The leak discovered on April 27, 2016, was in the piping between the discharge check valve for SW pump 31 and its strainer. An arrow points to this piping section in Figure 1. The strainers were installed in openings called pits in the thick concrete floor of the intake structure. Water from the leaking pipe flowed into the pit housing the strainer for SW pump 31.

The initial leak rate was modest—estimated to be about one-eighth of a gallon per minute. The leak was similar to other pinhole leaks that had occurred in the concrete-lined, carbon steel SW pipes. The owner began daily checks on the leakage and prepared an operability determination. Basically, “operability determinations” are used within the nuclear industry when safety equipment is found to be impaired or degraded. The operability determination for the service water pipe leak concluded that the impairment did not prevent the SW pumps from fulfilling their required safety function. The operability determination relied on a sump pump located at the bottom of the strainer pit transferring the leaking water out of the pit before the water flooded and submerged safety components.

The daily checks instituted by the owner included workers recording the leak rate and assessing whether it had significantly increased. But the checks were against the previous day’s leak rate rather than the initial leak rate. By September 18, 2016, the leakage had steadily increased by a factor of 64 to 8 gallons per minute. But the daily incremental increases were small enough that they kept workers from finding the overall increase to be significant.

The daily check on October 15, 2016, found the pump room flooded to a depth of several inches. The leak rate was now estimated to be 20 gallons per minute. And the floor drain in the strainer pit was clogged (ironic, huh?) impairing the ability of its sump pump to remove the water. Workers placed temporary sump pumps in the room to remove the flood water and cope with the insignificantly higher leak rate. On October 17, workers installed a clamp on the pipe that reduced the leakage to less than one gallon per minute.

The operability determination was revised in response to concerns expressed by the NRC inspectors. The NRC inspectors were not satisfied by the revised operability determination. It continued to rely on the strainer pit sump pump removing the leaking water. But that sump pump was not powered from the emergency diesel generator and thus would not remove water should offsite power become unavailable. Step 5.6.4 of procedure EN-OP-14, “Operability Determination Process,” stated “If the Operability is based on the use or availability of other equipment, it must be verified that the equipment is capable of performing the function utilized in the evaluation.”

The operability determination explicitly stated that no compensatory measures or operator manual actions were needed to handle the leak, but the situation clearly required both compensatory measures and operator manual actions.

The NRC inspectors found additional deficiencies in the revised operability determination. The NRC inspectors calculated that a 20 gallon per minute leak rate coupled with an unavailable strainer pit sump pump would flood the room to a depth of three feet in three hours. There are no flood alarms in the room and the daily checks might not detect flooding until the level rose to three feet. At that level, water would submerge and potentially disable the vacuum breakers for the SW pumps. Proper vacuum breaker operation could be needed to successfully restart the SW pumps.

The NRC inspectors calculated that the 20 gallon per minute leak rate without remediation would flood the room to the level of the control cabinets for the strainers in 10 hours. The submerged control cabinets could disable the strainers, leading to blocked cooling water flow to essential equipment.

The NRC inspects calculated that the 20 gallon per minute leak rate without remediation would completely fill the room in about 29 hours, or only slightly longer than the daily check interval.

Flooding to depths of 3 feet, 10 feet, and the room’s ceiling affected all six SW pumps. Thus, the flooding represented a common mode threat that could disable the entire service water system. In turn, all safety equipment shown in Figure 2 no longer cooled by the disabled service water system could also be disabled. The NRC estimated that the flooding risk was about 5×10-6 per reactor year, solidly in the Green finding band.

Fig. 2 (Source: Nuclear Regulatory Commission Plant Information Book) (click to enlarge)

UCS Perspective

“Leak before break” is a longstanding nuclear safety philosophy. Books have been written about it (well, at least one report has been written and may even have been read.)  The NRC’s approval of a leak before break analysis can allow the owner of an existing nuclear power reactor to remove pipe whip restraints and jet impingement barriers. Such hardware guarded against the sudden rupture of a pipe filled with high pressure fluid from damaging safety equipment in the area. The leak before break analyses can provide the NRC with sufficient confidence that piping degradation will be detected by observed leakage with remedial actions taken before the pipe fails catastrophically. More than a decade ago, the NRC issued a Knowledge Management document on the leak before break philosophy and acceptable methods of analyzing, monitoring, and responding to piping degradation.

This incident at Indian Point illustrated an equally longstanding nuclear safety practice of “leak before break.” In this case, the leak was indeed followed by a break. But the break was not the failure of the piping but failure of the owner to comply with federal safety regulations. Pipe breaks are bad. Regulation breaks are bad. Deciding which is worse is like trying to decide which eye one wants to be poked in. None is far better than either.

As with the prior Columbia Generating Station case study, this Indian Point case study illustrates the vital role that NRC’s enforcement efforts plays in nuclear safety. Even after NRC inspectors voiced clear concerns about the improperly evaluated service water system pipe leak, Entergy failed to properly evaluate the situation, thus violating federal safety regulations. To be fair to Entergy, the company was probably doing its best, but in recent years, Entergy’s best has been far below nuclear industry average performance levels.

The NRC’s ROP is the public’s best protection against hazards caused by aging nuclear power reactors, shrinking maintenance budgets, emerging sabotage threats, and Entergy. Replacing the NRC’s engineering inspections with self-assessments by Entergy would lessen the effectiveness of that protective shield.

The NRC must continue to protect the public to the best of its ability. Delegating safety checks to owners like Entergy is inconsistent with that important mission.

Why NRC Nuclear Safety Inspections are Necessary: Columbia Generating Station

The Nuclear Regulatory Commission (NRC) adopted its Reactor Oversight Process (ROP) in 2000. The ROP is far superior to the oversight processes previously employed by the NRC. Among its many virtues, the NRC treats the ROP as a work in progress, meaning that agency routinely re-assesses the ROP and makes necessary adjustments.

Earlier this year, the NRC initiated a formal review of its engineering inspections with the goal of making them more efficient and more effective. During a public meeting on October 11, 2017, the NRC working group conducting the review outlined some changes to the engineering inspections that would essentially cover the same ground but with an estimated 8 to 15 percent reduction in person-hours (the engineering inspections and suggested revisions are listed on slide 7 of the NRC’s presentation). Basically, the NRC working group suggested repackaging the inspections so as to be able to examine the same number of items, but in fewer inspection trips.

The nuclear industry sees a different way to accomplish the efficiency and effectiveness gains sought by the NRC’s review effort—they propose to eliminate the NRC’s engineering inspections and replace them with self-assessments. The industry would mail the results from the self-assessments to the NRC for their reading pleasure.

UCS is wary of self-assessments by industry in lieu of NRC inspections. On one hand, statistics might show that self-assessments increase safety just as a community firing all its law enforcement officers would see a statistical decrease in arrests, suggesting a lower crime rate. I have been researching the records publicly available in ADAMS to compare the industry’s track record for finding latent safety problems with the NRC’s track record to see whether replacing NRC’s inspections with industry self-assessments could cause nuclear safety to go off-track.

This commentary is the first in a series that convinces us that the NRC’s engineering inspections are necessary for nuclear safety and that public health and safety will be compromised by replacing them with self-assessments by industry.

Columbia Generating Station: Not so Cool Safety Moves

The Columbia Generating Station is a boiling water reactor owned by Energy Northwest and located 12 miles northwest of Richland, Washington. The Washington Public Power Supply System (the original name of the plant’s owner) submitted a Preliminary Safety Analysis Report (PSAR) for the Washington Nuclear Project Unit 2 (the original name for the reactor) to the Atomic Energy Commission (AEC, the original name of the nuclear regulator) in February 1973.

The PSAR described the proposed design of the plant and associated safety studies that demonstrated compliance with regulatory requirements. The PSAR described the two systems intended to cool the control room during normal operation and during postulated accidents. The control room heating, ventilation, and air conditioning (HVAC) would use chillers within the Radwaste Building HVAC system during normal operation. Because the Radwaste Building HVAC system is not designed to withstand earthquake forces or remain running when offsite power is unavailable, it cannot be credited with performing this role during accident conditions. So, the Standby Service Water system was proposed to cool the control room during accidents. The Standby Service Water system features pumps, pipes, and valves that recirculate water between a large cooling pond and safety equipment within the plant. Two independent sets, called divisions in the figure, are used to enhance reliability of this safety function (Fig. 1).

Fig. 1 (Source: Energy Northwest modified by UCS)

The PSAR indicated that for worst-case design conditions of 77°F cooling pond water temperature and 105°F outside air temperature, the Standby Service Water system would prevent the air temperature within the control room from exceeding 104°F. The AEC/NRC expressed concern that such warm control room temperatures could impair both human and equipment performance.

The owner resolved the regulator’s concerns by committing to installing two Seismic Category I emergency chillers for the control room HVAC system (Fig. 2). The emergency chillers were fully redundant such that one emergency chiller alone could maintain the air temperature inside the control room from exceeding 78°F during an accident. The NRC issued an operating license for the Columbia Generating Station on April 13, 1984, with License Condition 2.C.(21) that required the two emergency chillers to be operable by May 31, 1984. In November 1984, the owner revised the PSAR (now called the Final Safety Analysis Report or FSAR) to describe the emergency chillers and their role in keeping the control room air temperature from exceeding 78°F.

Fig. 2 (Source: Energy Northwest)

In September 1989, the owner revised the FSAR to change the control room air temperature limit to 85°F. The owner determined that this change did not require prior NRC review and approval. The NRC later disagreed with this self-imposed temperature relaxation.

In May 1998, the owner revised the FSAR to change the control room air temperature limit from 85°F to 85°F effective (see below). Once again, the owner determined that this change did not require prior NRC review and approval. And again, the NRC later disagreed with this self-imposed temperature limit relaxation.

“Effective temperature” is based on a combination of wet-bulb and dry-bulb temperatures. The original 75°F and initial 85°F limits were based solely on dry-bulb temperatures. The 85°F effective temperature allowed dry-bulb temperatures of up to 105°F—higher than the control room air temperature expressly rejected by the regulator. The owner made this change without seeking NRC’s approval because it was considered an editorial change. The NRC later determined that this temperature limit relaxation was not an editorial change.

Because the Standby Service Water system alone could maintain the dry-bulb temperature inside the control room at or below 104°F and the revised limit was now 105°F, the owner implemented another change—also unreviewed and unapproved by the NRC—eliminating the need for the emergency chillers to perform any safety role during postulated accidents. The NRC issued a Severity Level IV non-cited violation on April 23, 103, for the owner relaxing the control room air temperature limit without prior NRC approval.

The following month, the owner notified the NRC about deficiencies in the test periodically conducted to demonstrate the adequacy of the Standby Service Water system to cool the control room during accident conditions. When the test deficiencies were remedied and the corrected test performed, one of the two Standby Service Water system trains failed. Workers determined that the tubes within the control room cooler units had become degraded due to the buildup of scale on the inside tube surfaces and the collection of sediment in the lower region of the units. Routine testing of the control room cooler units had been discontinued 16 years earlier.

So, around the same time that the owner improperly decided that the emergency chillers were no longer needed to cool the control room during accidents, it discontinued proper testing of the Standby Service Water system that it thought would perform this role during accidents. Maybe it was another editorial change that discontinued the tests.

On November 12, 2015, the NRC issued a Green finding for a violation of Criterion III, “Design Control,” of Appendix B to 10 CFR Part 50. The NRC inspectors found that the emergency chillers, as designed and governed by operating procedures, would not maintain the air temperature inside the control room below 85°F under accident conditions. The vendor manual for the emergency chillers stated that the STOP-RESET pushbutton had to be depressed after a power interruption because the chillers would not automatically restart. But the operating procedures failed to have the operators perform this necessary step.

On December 22, 2015, Energy Northwest contested the NRC’s finding. The owner stated, in writing, that “There are no design basis requirements to maintain the control room temperature at less than or equal to 85°F at all times for all accident scenarios” [boldfacing in original]. The owner further requested that the NRC conduct a backfit analysis per 10 CFR 50.109 before imposing these “new” regulatory requirements.

By letter dated June 10, 2016, the NRC responded to the owner’s appeal. The NRC carefully considered the owner’s arguments and delineated why it was rejecting each one. The NRC concluded “…it cannot be concluded that the system function as described in the current design basis can be achieved.”

On May 3, 2016 (perhaps sensing that its appeal would not be successful), the owner met with the NRC to discuss a pending license amendment request that would resolve the concerns about the emergency chillers. As shown in the figure, the two emergency chillers sit side-by-side in the same room vulnerable to a common mode, like a fire, disabling them both (Fig. 3). But the chillers are seismically qualified and redundant, consistent with the original commitment to install them. The pending license amendment request would reconcile departures from two NRC General Design Criteria and justify the use of manual vice automatic actions to place the chillers in service.

Fig. 3 (Source: Energy Northwest)

UCS Perspective

Under the Atomic Energy Act as amended, the NRC is tasked with establishing and enforcing regulations to protect workers and the public from the inherent hazards from nuclear power reactor operation.

Owners are responsible for conforming with applicable regulatory requirements. In this case, the owner made a series of changes that resulted in the plant not conforming with applicable regulatory requirements for the air temperature within the control room. But there’s no evidence suggesting that the owner knew that the changes were illegal yet made them anyway hoping not to get caught. Nevertheless, ignorance of the law is still not a valid excuse. The public is not adequately protected when safety regulations are not met, regardless of whether the violations are intentional or inadvertent.

This case study illustrates the vital role that NRC’s enforcement efforts plays in nuclear safety. The soundest safety regulation in the world serves little use unless owners abide by it. The NRCs inspection efforts either verify that owners are abiding by safety regulations or identify shortfalls. Self-assessments by owners are more likely to sustain mis-interpretations and misunderstandings than to flush out safety problems.

The NRC’s ROP is the public’s best protection against hazards caused by aging nuclear power reactors, shrinking maintenance budgets, and emerging sabotage threats. Replacing the NRC’s engineering inspections with self-assessments by the owners would lessen the effectiveness of that protective shield.

The NRC must continue to protect the public to the best of its ability. Delegating safety checks to owners is inconsistent with that important mission.

Nuclear Plant Risk Studies: Then and Now

Nuclear plant risk studies (also called probabilistic risk assessments) examine postulated events like earthquakes, pipe ruptures, power losses, fires, etc. and the array of safety components installed to prevent reactor core damage. Results from nuclear plant risk studies are used to prioritize inspection and testing resources–components with greater risk significance get more attention.

Nuclear plant risk studies are veritable forests of event trees and fault trees. Figure 1 illustrates a simple event tree. The initiating event (A) in this case could be something that reduces the amount of reactor cooling water like the rupture of a pipe connected to the reactor vessel. The reactor protection system (B) is designed to detect this situation and immediately shut down the reactor.

Fig. 1. (Source: Nuclear Regulatory Commission)

The event tree branches upward based on the odds of the reactor protection system successfully performing this action and downward for its failure to do so. Two emergency coolant pumps (C and D) can each provide makeup cooling water to the reactor vessel to replenish the lost inventory. Again, the event tree branches upward for the chances of the pumps successfully fulfilling this function and downward for failure.

Finally, post-accident heat removal examines the chances that reactor core cooling can be sustained following the initial response. The column on the right describes the various paths that could be taken for the initiating event. It is assumed that the initiating event happens, so each path starts with A. Paths AE, ACE, and ACD result in reactor core damage. The letters added to the initiating event letter define what additional failure(s) led to reactor core damage. Path AB leads to another event tree – the Anticipated Transient Without Scram (ATWS) event tree because the reactor protection system failed to cause the immediate shut down of the reactor and additional mitigating systems are involved.

The overall risk is determined by the sum of the odds of pathways leading to core damage. The overall risk is typically expressed something like 3.8×10-5 per reactor-year (3.8E-05 per reactor-year in scientific notation). I tend to take the reciprocal of these risk values. The 3.8E-05 per reactor-year risk, for example, becomes one reactor accident every 26,316 years—the bigger the number, the lower the risk.

Fault trees examine reasons for components like the emergency coolant pumps failing to function. The reasons might include a faulty control switch, inadequate power supply, failure of a valve in the pump’s suction pipe to open, and so on. The fault trees establish the chances of safety components successfully fulfilling their needed functions. Fault trees enable event trees to determine the likelihoods of paths moving upward for success or downward for failure.

Nuclear plant risk studies have been around a long time. For example, the Atomic Energy Commission (forerunner to today’s Nuclear Regulatory Commission and Department of Energy) completed WASH-740 in March 1957 (Fig. 2). I get a kick out of the “Theoretically Possible but Highly Improbable” phrase in its subtitle. Despite major accidents being labeled “Highly Improbable,” the AEC did not release this report publicly until after it was leaked to UCS in 1973 who then made it available. One of the first acts by the newly created Nuclear Regulatory Commission (NRC) in January 1975 was to publicly issue an update to WASH-740. WASH-1400, also called NUREG-75/014 and the Rasmussen Report, was benignly titled “Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants.”

Fig. 2. (Source: Atomic Energy Commission)

Nuclear plant risk studies can also be used to evaluate the significance of actual events and conditions. For example, if emergency coolant pump A were discovered to have been broken for six months, analysts can change the chances of this pump successfully fulfilling its safety function to zero and calculating how much the broken component increased the risk of reactor core damage. The risk studies would determine the chances of initiating events occurring during the six months emergency coolant pump A was disabled and the chances that backups or alternates to emergency coolant pump A stepped in to perform that safety function. The NRC uses nuclear plant risk studies to determine when to send a special inspection team to a site following an event or discovery and to characterize the severity level (i.e., green, white, yellow, or red) of violations identified by its inspectors.

Nuclear Plant Risk Studies: Then

In June 1982, the NRC released NUREG/CR-2497, “Precursors to Potential Severe Core Damage Accidents: 1969-1979, A Status Report,” that reported on the core damage risk from 52 significant events during that 11-year period. The events included the March 1979 meltdown of Three Mile Island Unit 2 (TMI-2), which had a core damage risk of 100%. The effort screened 19,400 licensee event reports submitted to the AEC/NRC over that period, culled out 529 event for detailed review, identified 169 accident precursors, and found 52 of them to be significant from a risk perspective. The TMI-2 event topped the list, with the March 1975 fire at Browns Ferry placing second.

The nuclear industry independently evaluated the 52 significant events reported in NUREG/CR-2497. The industry’s analyses also found the TMI-2 meltdown to have a 100% risk of meltdown, but disagreed with all the other NRC risk calculations. Of the top ten significant events, the industry’s calculated risk averaged only 11.8% of the risk calculated by the NRC. In fact, if the TMI-2 meltdown is excluded, the “closest” match was for the 1974 loss of offsite power event at Haddam Neck (CT). The industry’s calculated risk for this event was less than 7% of the NRC’s calculated risk. It goes without saying (but not without typing) that the industry never, ever calculated a risk to be greater than the NRC’s calculation. The industry calculated the risk from the Browns Ferry fire to be less than 1 percent of the risk determined by the NRC—in other words, the NRC’s risk was “only” about 100 times higher than the industry’s risk for this event.

Fig. 3. Based on figures from June 1982 NRC report. (Source: Union of Concerned Scientists)

Bridging the Risk Gap?

The risk gap from that era can be readily attributed to the immaturity of the risk models and the paucity of data. In the decades since these early risk studies, the risk models have become more sophisticated and the volume of operating experience has grown exponentially.

For example, the NRC issued Generic Letter 88-20, “Individual Plant Examination for Severe Accident Vulnerabilities.” In response, owners developed plant-specific risk studies. The NRC issued documents like NUREG/CR-2815, “Probabilistic Safety Analysis Procedures Guide,” to convey its expectations for risk models. And the NRC issued a suite of guidance documents like Regulatory Guide 1.174, “An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decision on Plant-Specific Changes to the Licensing Basis.” This is but a tiny sampling of the many documents issued by the NRC about how to conduct nuclear plant risk studies—guidance that simply was not available when the early risk studies were performed.

Complementing the maturation of nuclear plant risk studies is the massive expansion of available data on component performance and human reliability. Event trees begin with initiating events—the NRC has extensively sliced and diced initiating event frequencies. Fault trees focus on performance on the component and system level, so the NRC has collected and published extensive operating experience on component performance and system reliability. And the NRC compiled data on reactor operating times to be able to develop failure rates from the component and system data.

Given the sophistication of current risk models compared to the first generation risk studies and the fuller libraries of operating reactor information, you would probably think that the gap between risks calculated by industry and NRC has narrowed significantly.

Except for being absolutely wrong, you would be entirely right.

Nuclear Plant Risk Studies: Now

Since 2000, the NRC has used nuclear plant risk studies to establish the significance of violations of regulatory requirements, with the results determining whether a green, white, yellow, or red finding gets issued. UCS examined ten of the yellow and red findings determined by the NRC since 2000. The “closest” match between NRC and industry risk assessment was for the 2005 violation at Palo Verde (AZ) where workers routinely emptied water from the suction pipes for emergency core cooling pumps. The industry’s calculated risk for that event was 50% (half) of the NRC’s calculated risk, meaning that the NRC viewed this risk as double that of the industry’s view. And that was the closest that the risk viewpoints came. Of these ten significant violations, the industry’s calculated risk averaged only 12.7% of the risk calculated by the NRC. In other words, the risk gap narrowed only a smidgen over the decades.

Fig. 4. Ratios for events after 2000. (Source: Union of Concerned Scientists)

Risk-Deformed Regulation?

For decades, the NRC has consistently calculated nuclear plant risks to be about 10 time greater than the risks calculated by industry. Nuclear plant risk studies are analytical tools whose results inform safety decision-making. Speedometers, thermometers, and scales are also analytical tools whose results inform safety decision-making. But a speedometer reading one-tenth of the speed recorded by a traffic cop’s radar gun, or a thermometer showing a child to have a temperature one-tenth of her actual temperature, or a scale measuring one-tenth of the actual amount of chemical to be mixed into a prescription pill are unreliable tools that could not continue to be used to make responsible safety decisions.

Yet the NRC and the nuclear industry continue to use risk studies that clearly have significantly different scales.

On May 6, 1975, NRC Technical Advisor Stephen H. Hanauer wrote a memo to Guy A. Arlotto, the NRC’s Assistant Director for Safety and Materials Protection Standards. The second paragraph of this two-paragraph memo expressed Dr. Hanauer’s candid view of nuclear plant risk studies: “You can make probabilistic numbers prove anything, by which I mean that probabilistic numbers ‘prove’ nothing.”

Oddly enough, the chronic risk gap has proven the late Dr. Hanauer totally correct in his assessment of the value of nuclear plant risk studies. When risk models permit users to derive results that don’t reside in the same zip code yet alone the same ball park, the results prove nothing.

The NRC must close the risk gap, or jettison the process that proves nothing about risks.

Tennessee Valley Authority’s Nuclear Safety Culture Déjà vu

The Nuclear Regulatory Commission (NRC) issued a Confirmatory Order to the Tennessee Valley Authority (TVA) on July 27, 2017.  An NRC team inspecting the Watts Bar Nuclear Plant in fall 2016 determined that TVA failed to comply with elements of another Confirmatory Order that NRC had issued to TVA on December 22, 2009. Specifically, the 2009 Confirmatory Action required TVA to implement measures at all its nuclear plant sites (i.e., Watts Bar and Sequoyah in Tennessee and Browns Ferry in Alabama) to ensure that adverse employment actions against workers conformed to the NRC’s employee protection regulations and whether the actions could negatively impact the safety conscious work environment. The NRC inspection team determined that TVA was not implementing several of the ordered measures at Watts Bar.

To be fair to TVA, the agency did indeed develop the procedures to ensure adverse employee actions did not violate NRC’s employee protection regulations.

To be fair to NRC, its inspectors found that TVA senior management simply did not use those procedures when taking adverse employee action against several TVA employees and contractors.

To say that TVA has a nuclear safety culture problem is like saying the sun is hot.

After determining that TVA failed to implement mandated in its December 2009 Confirmatory Order, the NRC issued another Confirmatory Order to TVA in July 2017.

How many Confirmatory Orders it will take to get TVA to establish and sustain proper nuclear safety cultures at its nuclear power plants?

I don’t know. But at least we are now one Confirmatory Order closer to that magic number. Perhaps before too many more years roll by, workers at Watts Bar, Sequoyah, and Browns Ferry will actually be protected the way they are supposed to be by NRC’s regulations.

Broken Valve in Emergency System at LaSalle Nuclear Plant

An NRC Special Inspection Team (SIT) conducted an inspection at the LaSalle Nuclear Plant this spring to investigate the cause of a valve’s failure and assess the effectiveness of the corrective actions taken.

The two units at Exelon Generation Company’s LaSalle County nuclear plant about 11 miles southeast of Ottawa, Illinois are boiling water reactors (BWRs) that began operating in the early 1980s. While most of the BWRs operating in the U.S. are BWR/4’s with Mark I containment designs, the “newer” LaSalle Units feature BWR/5’s with Mark II containment designs. The key distinction for this commentary is that while BWR/4’s employ steam-driven high pressure coolant injection (HPCI) systems to provide makeup cooling water to the reactor core in event that a small pipe connected to the reactor vessel breaks, the BWR/5’s use a motor-driven high pressure core spray (HPCS) system for this safety role.

The Event

Workers attempted to refill the Unit 2 high pressure core spray (HPCS) system with water on February 11, 2017, following maintenance and testing of the system. The Unit 2 reactor was shut down for a refueling outage at the time and this downtime was used to inspect emergency systems, like the HPCS system.

The HPCS system is normally in standby mode during reactor operation. The system features one motor-driven pump that supplies a design makeup flow rate of 7,000 gallons per minute to the reactor vessel. The HPCS pump draws water from the suppression pool inside containment. In event that a small-diameter pipe connected to the reactor vessel broke, cooling water would leak out but the pressure inside the reactor vessel would remain too high for the array of low-pressure emergency systems (i.e., the residual heat removal and low pressure core spray pumps) to function. Water pouring from the broken pipe ends drains to the suppression pool for re-use. The motor-driven HPCS pump can be powered from the offsite electrical grid when it is available or from an onsite emergency diesel generator when the grid is unavailable.

Fig. 1(Source: Nuclear Regulatory Commission)

Workers were unable to fill the piping between the HPCS injection valve (1E22-F004) and the reactor vessel. They discovered that the disc had separated from the stem of this double disc gate valve manufactured by Anchor Darling and blocked the flow path for filling the piping. The HPCS injection valve is a normally closed motor-operated valve that opens when the HPCS system is actuated to provide a pathway for makeup water to reach the reactor vessel. The motor applies torque that rotates a screw-like stem to raise (open) or lower (close) the disc in the valve. When fully lowered, the disc blocks flow through the valve. When the disc is fully raised, flow through the valve is unobstructed. Because the disc became separated from the stem in the fully lowered position, the motor might rotate the stem as if to raise the disc, but the disc would not budge.

Fig. 2 (click to enlarge) (Source: Nuclear Regulatory Commission)

Workers took a picture of the separated double disc after the valve’s bonnet (casing) was removed (Fig. 3). The bottom edge of the stem appears at the top center of the picture. The two discs and the guides they travel along (when connected to the stem) can be seen.

Fig. 3 (Source: Nuclear Regulatory Commission)

Workers replaced the internals of the HPCS injection valve with parts redesigned by the vendor and restated Unit 2.

Background

The Tennessee Valley Authority submitted a report under 10 CFR Part 21 to the NRC in January 2013 about a defect in an Anchor Darling double disc gate valve in the high pressure coolant injection system at their Browns Ferry nuclear plant. The following month, the valve’s vendor submitted a 10 CFR Part 21 report to the NRC about a design issue with Anchor Darling double disc gate valves that could result in the stem separating from the discs.

In April 2013, the Boiling Water Reactor Owners’ Group issued a report to its members about the Part 21 reports and recommended methods for monitoring the affected valves for operability. The recommendations included diagnostic testing and monitoring the rotation of the stems. Workers performed the recommended diagnostic testing of HPCS injection valve 2E22-F004 at LaSalle during 2015 without identifying any performance issues. Workers performed maintenance and testing of HPCS injection valve 2E22-F004 on February 8, 2017, using the stem rotation monitoring guidance.

In April 2016, the Boiling Water Reactor Owners’ Group revised their report based on information received from one plant owner. Workers had disassembled 26 potentially susceptible Anchor Darling double disc gate valves and found problems with 24 of them.

In April 2017, Exelon notified the NRC about the failure of HPCS injection valve 2E22-F004 due to separation of the stem from the discs. Within two weeks, a Special Inspection Team (SIT) chartered by the NRC arrived at LaSalle to investigate the cause of the valve’s failure and assess the effectiveness of the corrective actions taken.

SIT Findings and Observations

The SIT reviewed Exelon’s evaluation of the failure mode for the Unit 2 HPCS injection valve. The SIT agreed that a part within the valve had broken due to excessive force. The broken part allowed the stem-to-disc connection to become steadily more misaligned until eventually the discs separated from the stem. The vender redesigned the valve’s internals to correct the problem.

Exelon notified the NRC on June 2, 2017, of its plan to correct 16 other safety-related and important to safety Anchor Darling double disc gate valves that may be susceptible to this failure mechanism during the next refueling outages of the two LaSalle units.

The SIT reviewed Exelon’s justifications for waiting to fix these 16 valves. The SIT found the justifications to be reasonable with one exception—the HCPS injection valve on Unit 1. Exelon had estimated the number of times that the Unit 1 and the Unit 2 HPCS injection valves had been cycled. The Unit 2 valve was original equipment installed in the early 1980s while the Unit 1 valve had been replaced in 1987 following damage due to another cause. Exelon contended that the greater number of strokes by the Unit 2 valve explained its failure and justified waiting until the next refueling outage to address the Unit 1 valve.

Citing factors like unknown pre-operational testing differences between the units, slight design differences of unknown consequence, uncertain material strength properties, and uncertain differences in stem-to-wedge thread wear, the SIT concluded “that it was a matter of “when” and not “if” the 1E22-F004 valve would fail in the future if it had not already failed.” In other words, the SIT did not buy the delayed look at the Unit 1 valve.

Exelon shut down LaSalle Unit 1 on June 22, 2017, to replace the internals of HPCS injection valve 1E22-F004.

NRC Sanctions

The SIT identified a violation of Criterion III, Design Control, of Appendix B to 10 CFR Part 50 associated with the torque values developed by Exelon for the motors of HPCS injection valves 1E22-F004 and 2E22-F004. Exelon assumed the valves’ stem to be the weak link and established motor torque values that would not over-stress the stem. But the weak link turned out to be another internal part. The motor torque values applied by Exelon over-stressed this part, causing it to break and the discs to separate from the stem.

The NRC determined that the violation to be a Severity Level III Violation (out of a four-level system with Level I being most serious) based on the failure of the valves preventing the HPCS system from performing its safety function.

But the NRC exercised enforcement discretion per its Enforcement Policy and did not issue the violation. The NRC determined that the valve design defect was too subtle for Exelon to have reasonably foreseen and corrected before the Unit 2 valve’s failure.

UCS Perspective

Exelon looked pretty good in this event. The NRC’s SIT documented that Exelon was aware of the Part 21 reports made by the Tennessee Valley Authority and the valve’s vendor in 2013. That they were unable to use this awareness to identify and correct the problems with the Unit 2 HPCS injection valve is really not a poor reflection on their performance. After all, they performed the measures recommended by the Boiling Water Reactor Owners’ Group for the two Part 21 reports. The shortcoming was in that guidance, not in Exelon’s application of it.

The only blemish on Exelon’s handling of the matter was its weak justification for operating Unit 1 until its next scheduled refueling outage before checking whether its HPCS injection valve was damaged or broken. But the NRC’s SIT helped Exelon decide to hasten that plan with the result that Unit 1 was shut down in June 2017 to replace the susceptible Unit 1 valve.

The NRC looked really good in this event. Not only did the NRC steer Exelon to a safer place regarding LaSalle Unit 1, but the NRC also prodded the entire industry to get this matter resolved without undue delay. The NRC issued Information Notice 2017-03 to plant owners on June 15, 2017, about the Anchor Darling double disc gate valve design defects and the limitations in the guidance for monitoring valve performance. The NRC conducted a series of public meetings with industry and valve vendor representatives regarding the problem and its solution. Among the outcomes from these interactions is a resolution plan by the industry enumerating a number of steps with target deadlines no later than December 31, 2017, and a survey of where Anchor Darling double disc gate valves are used in U.S. nuclear power plants. The survey revealed about 700 Anchor Darling double disc gate valves (AD DDGVs) used in U.S. nuclear power plants, but only 9 valves characterized as High/Medium risk, multi-stoke valves. (Many valves are single stroke in that their safety function is to close, if open, or open, if closed. Multi-stroke valves may be called open to open and close, perhaps several times, in fulfilling their safety function.)

Fig. 4 (Source: Nuclear Energy Institute)

There’s still time for the industry to snatch defeat from the jaws of victory, but the NRC seems poised to see this matter to a timely and effective outcome.

Florida’s Nuclear Plants and Hurricane Irma

Will Florida’s two nuclear plants, Turkey Point and St. Lucie, be able to withstand Hurricane Irma?

Florida governor Rick Scott, the utility Florida Power & Light (FP&L), and the US Nuclear Regulatory Commission (NRC) have all provided assurances that they will. But we are about to witness a giant experiment in the effectiveness of the NRC’s strategy for protecting nuclear plants from natural disasters.

A review of the plans that the two plants have developed to protect against extreme natural disasters leaves plenty of room for concern. These plans were developed in response to new requirements that the NRC imposed in the years following the March 2011 Fukushima nuclear plant disaster in Japan. A prolonged loss of all electrical power—caused by an earthquake and subsequent tsunami that flooded the Fukushima site—resulted in three nuclear reactor meltdowns and a large release of radioactivity to the environment. (Even when reactors are shut down, they normally rely on electrical power to provide cooling water to the fuel in the cores and the spent fuel in storage pools, which remain hot.)

Fukushima made it clear that nuclear plants around the world were not sufficiently protected against natural disasters. Subsequently, the NRC imposed new requirements on US nuclear plants to develop strategies to cope with prolonged electric blackouts.

However, these new requirements were heavily influenced by pressure from a cost-conscious nuclear industry. As a result, they were limited in scope.

Moreover, these requirements are based on numerous assumptions that may not prove valid in the face of massive and powerful storms. In effect, the NRC is betting that no nuclear plant will experience conditions that don’t conform to these assumptions. Soon, the nation will find out whether the NRC wins or loses the next round with Mother Nature: Hurricane Irma.

The Plan for Turkey Point

Turkey Point Nuclear Plant (Source: NARA)

FP&L’s plan for Turkey Point, 25 miles south of Miami, contains many questionable assumptions.

To give just one example, its strategy to keep the two reactors cool if there is a total loss of electrical power (both offsite and on-site back-up power) includes initially drawing water from two water supply tanks (so-called condensate storage tanks), running the water through the reactors’ steam generators, and dumping the steam that is produced by the heat of the nuclear fuel in the reactor cores into the atmosphere (when the plant is operating, the steam is used to generate electricity).

But here’s the rub: These tanks were not designed to withstand objects thrown about by the high winds occurring during tornadoes or hurricanes.

Nevertheless, FP&L assumed—and the NRC accepted—that at least one of the two tanks on site would withstand any hurricane. They argued that this was a reasonable assumption because the two tanks are separated by a few hundred feet and there are structures between them. There seems to be a degree of wishful thinking at work here. If both tanks were damaged, the challenges in keeping the cores cool would be far greater.

Also, to deal with prolonged station blackouts—when both offsite and onsite back-up power is lost—the Turkey Point plan assumes that offsite assistance would be available after five days. The nuclear industry has set up two “National SAFER Response Centers,” one in Memphis, Tennessee and the other in Phoenix, Arizona. Each one contains additional emergency equipment and supplies to supplement those that each reactor owner is required to have on site. The NRC requires that every plant in the country have an agreement with one of the SAFER centers to provide equipment and assistance should it be needed.

But the functioning of this system depends on the ability of the SAFER centers to deliver the equipment in a timely manner, which might not be possible if there were a widespread and prolonged natural disaster.

Turkey Point’s plan requires that deliveries from the Memphis SAFER center be shipped to Miami International Airport and then hauled (if the roads are clear) to the site or to the Homestead Air Reserve Base and taken to the site via helicopter. But it doesn’t take too great a stretch of the imagination, given the potential impact of a massive storm like Irma, to see where this plan could go badly wrong. And looking at the current track of the storm, the Memphis SAFER center itself could well be in its path, causing problems at the shipping end as well as the receiving end.

Even if the Turkey Point plan were effective, it is not clear how much of it has been put into place on the ground yet. At the end of June, the plant reported to the NRC that it needed to make ten modifications to address the risk of storm surges that could exceed the flood level that the plant was originally designed to withstand.

But it isn’t clear how many of those modifications have been completed yet. And the NRC’s first inspection of the post-Fukushima measures at Turkey Point is not even scheduled until March 2018. So at this time all the public has to rely on is an assumption that FP&L has implemented the plan completely and correctly.

With one assumption piled upon another, it is very hard for observers to assess how prepared Turkey Point really is to deal with superstorms. Hopefully, the plant will pass the Irma test, but the NRC will need to reevaluate whether its new requirements can adequately address the potential for more severe storms in the future.