UCS Blog - All Things Nuclear (with images) - Latest 1

UCS to Nuclear Regulatory Commission: Big THANKS!

This spring, I ran into Mike Weber, Director of the Office of Nuclear Regulatory Research for the Nuclear Regulatory Commission (NRC), at a break during a Commission briefing. The Office of Research hosts a series of seminars which sometimes include presentations by external stakeholders. I asked Mike if it would be possible for me to make a presentation as part of that series.

I explained that I’d made presentations during annual inspector conferences in NRC’s Regions I, II, and III in recent years and would appreciate the opportunity to reach out to the seminars’ audience. Mike commented that he’d heard positive feedback from my regional presentations and would welcome my presentation as part of their seminars. Mike tasked Mark Henry Salley and Felix Gonzalez from the Research staff to work out arrangements with me. The seminar was scheduled for September 19, 2017, in the auditorium of the Two White Flint North offices at NRC headquarters. I appreciate Mike, Mark, and Felix providing me the opportunity I sought to convey a message I truly wanted to deliver.

Fig. 1 (Source: Union of Concerned Scientists)

The title of my presentation at the seminar was “The Other Sides of the Coins.” The NRC subsequently made my presentation slides publicly available in ADAMS, their online digital library.

As I pointed out during my opening remarks, the NRC staff most often hears or reads my statements critical of how the agency did this or didn’t do that. My presentation that day focused on representative positive outcomes achieved by the NRC. For that presentation that day, my whine list was blank by design. Instead, I talked about the other sides of my usual two cents’ worth.

Fig. 2 (Source: Union of Concerned Scientists)

I summarized eight positive outcomes achieved by the NRC and listed five other positive outcomes. I emphasized that these were representative positive outcomes and far from an unabridged accounting. I told the audience members that I fully expected they would be reminded of other positive outcomes they were involved in as I covered the few during my presentation. Rather than feeling slighted, I hoped they would feel acknowledged and appreciated by extension.

One of the eight positive outcomes I summarized was the inadequate flooding protection identified by NRC inspectors at the Fort Calhoun nuclear plant in Nebraska. The NRC issued a preliminary Yellow finding—the second highest severity in its Green, White, Yellow, and Red classification system—in July 2010 for the flood protection deficiencies. To help put that Yellow finding in context, the NRC issued 827 findings during 2010: 816 Green, 9 White, and 2 Yellow. It was hardly a routine, run of the mill issuance.

The plant’s owner formally contested the preliminary Yellow finding, contending among other things that Fort Calhoun had operated for nearly 30 years with its flood protective measures, so they must be sufficient. The owner admitted that some upgrades might be appropriate, but contended that the finding should be Green, not Yellow.

The NRC seriously considered the owner’s appeal and revisited its finding and its severity determination. The NRC reached the same conclusion and issued the final Yellow finding in October 2010. The NRC then monitored the owner’s efforts to remedy the flood protection deficiencies.

The NRC’s findings and, more importantly, the owner’s fixes certainly came in handy when Fort Calhoun (the sandbagged dry spot in the lower right corner of Figure 3) literally became an island in the Missouri River in June 2011.

Recall that the NRC inspectors identified flood protection deficiencies nearly 8 months before the Fukushima nuclear plant in Japan experienced three reactor meltdowns due to flooding. Rather than waiting for the horses to trot away before closing the barn door, the NRC acted to close an open door to protect the horses before they faced harm. Kudos!

Fig. 3 (Source: Union of Concerned Scientists)

The real reason for my presentation in September and my commentary now is to acknowledge the efforts of the NRC staff. My concluding slide pointed out that tens of millions of Americans live within 50 miles of operating nuclear power plants and tens of thousands of Americans work at these operating plants. The efforts of the NRC staff make these Americans safer and more secure. I observed that the NRC staff deserved big thanks for their efforts and my final slide attempted to symbolically convey our appreciation. (The thanks were way bigger on the large projection screen in the auditorium. To replicate that experience, lean forward until your face is mere inches away from your screen.)

Fig. 4 (Source: Union of Concerned Scientists)

Whose Finger Is on the Button? Nuclear Launch Authority in the United States and Other Nations

Throughout the 2016 presidential campaign, and perhaps even more since Trump’s election, the media discovered a newfound interest in the minutiae of US nuclear policy. One question in particular has been asked over and over—can the president, with no one else to concur or even advise, order the use of US nuclear weapons? Most people have been shocked and somewhat horrified to find that there is a simple answer—yes.

Starting a nuclear war shouldn’t be easy

The president has the sole authority to order a nuclear strike—either a first strike or one in response to an attack. Although there are people involved in the process of transmitting and executing this order who could physically delay or refuse to carry it out, they have no legal basis for doing so, and it is far from clear what would happen if they tried.

This belated realization (the system has been in place since the early Cold War) has prompted some ideas for ways to change things, including legislation restricting the president’s ability to order a nuclear first strike without a declaration of war by Congress. But more often it has prompted concern—and sometimes outrage—without a clear idea of how to fix the problem.

It may be useful to ask how other nuclear-armed states approach the problem of making a decision about the use of their nuclear weapons. How does the US compare to Russia, China, and other nuclear-armed states? Are there existing systems that rely on multiple people to order the use of nuclear weapons that the US might learn from?

To try to answer these questions, our new issue brief compiles information on the systems that other nuclear-armed states have in place to order the use of their weapons. While information is necessarily limited, and some of these systems may not completely correspond to what would happen in a true crisis, they still provide useful information about what these countries think is important when making a decision about the use of nuclear weapons. And, in most cases, that includes some form of check on the power of any single individual to order the use of these weapons by him or herself.

The current US process for deciding to use nuclear weapons is unnecessarily risky in its reliance on the judgment of a single individual. There are viable alternatives to sole presidential authority, and it is past time for the US to establish a new process that requires the involvement of multiple decision-makers to authorize the use of nuclear weapons. An investigation of how this decision works in other nuclear-armed states provides a good place to start.

 

Grand Gulf: Three Nuclear Safety Miscues in Mississippi Warranting NRC’s Attention

The Nuclear Regulatory Commission (NRC) reacted to a trio of miscues at the Grand Gulf nuclear plant in Mississippi by sending a special inspection team to investigate. While none of the events had adverse nuclear safety consequences, the NRC team identified significantly poor performance by the operators in all three. The recurring performance shortfalls instill little confidence that the operators would perform successfully in event of a design basis or beyond design basis accident.

The Events

Three events prompted the NRC to dispatch a special inspection team to Grand Gulf:

(1) failure to recognize that reactor power fluctuating up and down by more than 10% during troubleshooting of a control system malfunction in June 2016 exceeded a longstanding safety criterion calling for immediate shutdown,

(2) failure to recognize in September 2016 that the backup reactor cooling system relied upon when the primary cooling system broke was unable to function if needed, and

(3) failure to understand how a control system worked on September 27, 2016, resulting in the uncontrolled and undesired addition of nearly 24,000 gallons of water to the reactor vessel.

(1) June 2016 Reactor Power Oscillation Miscue

Figure 1 shows the main steam system for a typical boiling water reactor like Grand Gulf. The reactor vessel is not shown but is located off its left side. Heat produced by the reactor core boils water. Four pipes transport the steam from the reactor vessel to the turbine. The steam spins the turbine which is connected to a generator (off the right side of Figure 1) to make electricity.

Fig. 1 (Source: Nuclear Regulatory Commission)

Periodically, operators reduce the reactor power level to about 65% power and test the turbine stop valves (labeled SV in Figure 1). The stop valves are fully open when the turbine is in service, but are designed to rapidly close automatically if a turbine problem is detected. When the reactor is operating above about 30 percent power, closure of the stop valves triggers the automatic shutdown of the reactor. Below about 30 percent power, the main steam bypass valves (shown in the lower left of Figure 1) open to allow the steam flow to the main condenser should the stop valves close.

Downstream of the turbine stop valves are the turbine control valves (labeled CV in Figure 1.) The control valves are partially open when the turbine is in service. The control valves are automatically re-positioned by the electro-hydraulic control (labeled EHC) system as the operators increase or decrease the reactor power level. Additionally, the EHC system automatically opens the three control valves in the other steam pipes more fully when the stop valve in one steam pipe closes. The EHC system and the control valve response time is designed to minimize the pressure transient experienced in the reactor vessel when the steam flow pathways change.

The test involves the operators closing each stop valve to verify these safety features function properly. During testing on June 17, 2016, however, unexpected outcomes were encountered. The EHC system failed to properly reposition the control valves in the other lines when a stop valve was closed, and later when it was re-opened. The control system glitch caused the reactor power level to increase and decrease between 63% and 76%.

Water flowing through the core of a boiling water reactor is heated to the boiling point. By design, the formation of steam bubbles during boiling acts like a brake on the reactor’s power level. Atoms splitting within the reactor core release heat. The splitting atoms also release neutrons, subcomponents of the atoms. The neutrons can interact with other atoms to cause them to split in what is termed a nuclear chain reaction. The neutrons emitted by splitting atoms have high energy and high speed. The neutrons get slowed down by colliding with water molecules. While fast neutrons can cause atoms to split, slower neutrons perform this role significantly better.

The EHC system problems caused the turbine control valves to open wider and close more than was necessary to handle the steam flow. Turbine control valves opened wider than necessary lowered the pressure inside the reactor vessel, allowing more steam bubbles to form. With fewer water molecules around to slow down the fast neutrons, more neutrons went places other than interacting with atoms to cause more fissions. The reactor power level dropped as the neutron chain reaction rate slowed.

When turbine control valves closed more than necessary, the pressure inside the reactor vessel increased. The higher pressure collapsed steam bubbles and made it harder for new bubbles to form. With more water molecules around, more neutrons interacted with atoms to cause more fissions. The reactor power level increased as the neutron chain reaction rate quickened.

Workers performed troubleshooting of the EHC system problems for 40 minutes. The reactor power level fluctuated between 63% and 76% as the turbine control valves closed too much and then opened too much. Finally, a monitoring system detected the undesired power fluctuations and automatically tripped the reactor, causing all the control rods to rapidly insert into the reactor core and stop the nuclear chain reaction.

The NRC’s special inspection team reported that the control room operators failed to realize that the 10% power swings exceeded a safety criterion that called for the immediate shut down of the reactor. Following a reactor power level instability event at the LaSalle nuclear plant in Illinois in March 1988, Grand Gulf and other boiling water reactors revised operating procedures in response to an NRC mandate to require reactors to be promptly shut down when the reactor power level oscillated by 10% or more.

EHC system problems causing unwanted and uncontrolled turbine control valve movements had been experienced eight times in the prior three years. Operators wrote condition reports about the problems, but no steps had been taken to identify the cause and correct it.

Consequences

Due to the intervention by the system triggering the automatic reactor scram, this event did not result in fuel damage or release of radioactive materials exceeding normal, routine releases. But that outcome was achieved despite the operators’ efforts but because of them. The operators’ training and procedures should have caused them to manually shut down the reactor when its power level swung up and down by more than 10%. Fortunately, the plant’s protective features intervened to remedy their poor judgement.

(2) September 2016 Backup Reactor Cooling System Miscue

On September 4, 2016, the operators declared residual heat removal (RHR) pump A (circled in red in the lower middle portion of Figure 2) to be inoperable after it failed a periodic test. The pump was one of three RHR pumps that can provide makeup cooling water to the reactor vessel in case of an accident. RHR pumps A and B can also be used to cool the water within the reactor vessel during non-accident conditions. Grand Gulf’s operating license only permitted the unit to continue running for a handful of days with RHR pump A inoperable. So, the operators shut down the reactor on September 8 to repair the pump.

Fig. 2 (Source: Nuclear Regulatory Commission)

The operating license required two methods of cooling the water within the reactor vessel during shut down conditions. RHR pump B functioned as one of the methods. The operators took credit for the alternate decay heat removal (ADHR) system as the second method. The ADHR system is shown towards the upper right of Figure 2. It features two pumps that can take water from the reactor vessel, route it through heat exchangers, and return the cooled water to the reactor vessel. The ADHR system’s heat exchangers are supplied with cooling water from the plant service water (PSW) system. Warmed water from the reactor vessel flows through hundreds of metal tubes within the ADHR heat exchangers. Heat conducted through the tube walls gets carried away by the PSW system.

By September 22, workers had replaced RHR pump A and successfully tested the replacement. The following day, operators attempted to place the ADHR system in service prior to removing RHR pump B from service. They discovered that all the PSW valves (circle in red in the upper right portion of Figure 2) to the ADHR heat exchangers were closed. With these valves closed, the ADHR pumps would only take warm water from the reactor vessel, route it through the ADHR heat exchangers, and return the warm water back to the reactor vessel without being cooled.

The operating license required workers to check each day that both reactor water cooling systems were available during shut down. Each day between September 9 and 22, workers performed this check via a paperwork exercise. No one ever walked out into the plant to verify that the ADHR pumps were still there and that the PSW valves were still open.

The NRC team determined that workers closed the PSW valves to the ADHR heat exchangers on August 10 to perform maintenance on the ADHR system. The maintenance work was completed on August 15, but the valves were mistakenly not re-opened until September 23 after being belatedly discovered to be mis-positioned.

Consequences

Improperly relying on the ADHR system in this event had no adverse nuclear safety consequences. It was relied upon was a backup to the primary reactor cooling system which successfully performed that safety function. Had the primary system failed, the ADHR system would not have been able to take over that function as quickly as intended. Fortunately, the ADHR system’s vulnerability was not exploited.

(3) September 2016 Reactor Vessel Overfilling Miscue

On September 24, Grand Gulf was in what is called long cycle cleanup mode. Water within the condenser hotwell (upper right portion of Figure 3) was being sent by the condensate pumps through filter demineralizers and downstream feedwater heaters before recycling back to the condenser via the startup recirculation line. A closed valve prevented this water from flowing into the reactor vessel. Long cycle cleanup mode allows the filter demineralizers to remove particles and dissolved ions from the water. Water purity is important in boiling water reactors because any impurities tend to collect within the reactor vessel rather than being carried away with the steam leaving the vessel. The water in the condenser hotwell is the water used over and over again in boiling water reactors to make the steam that spins the turbine-generator.

Fig. 3 (Source: Nuclear Regulatory Commission)

Workers were restoring RHR pump B to its standby alignment following testing. The procedure they used directed them to open the closed feedwater valve. This valve was controlled by three pushbuttons in the control room: OPEN, CLOSE, and STOP. As soon as this valve began opening, water started flowing into the reactor vessel rather than being returned to the condenser.

The operator twice depressed the CLOSE pushbutton wanting very much for the valve to re-close. But this valve was designed to travel to the fully opened position after the OPEN pushbutton was depressed and travel to the fully closed position after the CLOSE pushbutton was depressed. By design, the valve would not change direction until after it had completed its full travel.

Unless the STOP pushbutton was depressed. The STOP pushbutton, as implied by its label, caused the valve’s movement to stop. Once stopped, depressing the CLOSE pushbutton would close the valve and depressing the OPEN pushbutton would open it.

According to the NRC’s special inspection team, “operations personnel did not understand the full function of the operating modes of [the] valve.” No operating procedure directed the operators to use the STOP button. Training in the control room simulator never covered the role of the STOP button because it was not mentioned in any operating procedures.

Not able to use the installed control system to its advantage, the operator waited until the valve traveled fully open before getting it to fully re-close. But the valve is among the largest and slowest valves in the plant—more like an elephant than a cheetah in its speed.

During the time the valve was open, an estimated 24,000 gallons of water overfilled the reactor vessel. As shown in Figure 4, the vessel’s normal level is about 33 inches above instrument zero, or about 201 inches above the top of the reactor core. The 24,000 gallons filled the reactor vessel to 151 inches above instrument zero.

Fig. 4 (Source: Nuclear Regulatory Commission)

Consequences

The overfilling event had no adverse nuclear safety consequences (unless revealing procedure inadequacies, insufficient training, and performance shortcomings count.)

NRC Sanctions

The NRC’s special inspection team identified three violations of regulatory requirements. One violation involved inadequate procedures for the condensate and feedwater systems that resulted in the reactor vessel overfilling event on September 24.

Another violation involved crediting the ADHR system for complying with an operating license requirement between September 9 and 22 despite its being unable to perform the necessary reactor water cooling role due to closed valves in the plant service water supply to the ADHR heat exchangers.

The third violation involved inadequate verification of the ADHR system availability between September 9 and 22. Workers failed to properly verify the system’s availability and had merely assumed it was a ready backup.

UCS Perspective

Th trilogy of miscues, goofs, and mistakes that prompted the NRC to dispatch a special inspection team have a common thread. Okay, two common threads since all three happened at Grand Gulf. All three miscues reflected very badly on the operations department.

During the June power fluctuations miscue, the operators should have manually scrammed the reactor, but failed to do so. In addition, operators had experienced turbine control system problems eight times in the prior three years and initiated reports intended to identify the causes of the problems and remedy them. The maintenance department could have, and should have, reacted to these reports earlier. But the operations department could have, and should have, insisted on the recurring problems getting fixed rather than meekly adding to the list of unresolved problem reports.

During the September backup cooling system miscue, many operators over nearly two weeks had many opportunities to notice that the ADHR system would not perform as needed due to mispositioned valves. The maintenance department could have, and should have, not set a trap for the operators by leaving the valves closed when maintenance work was completed. But the operators are the only workers at the plant licensed by the NRC to ensure regulatory requirements intended to protect the public are met. They failed that legal obligation again and again between September 9 and 22.

During the September reactor vessel overfilling event, the operators failed to recognize that opening the feedwater valve while in long cycle cleanup mode would send water into the reactor vessel. That’s a fundamental mistake that’s nearly impossible to justify. The operators then compounded that mistake by failing to properly use the installed control system to mitigate the event. They simply did not understand how the three pushbutton controls worked and thus were unable to use them properly.

The poor operator performance that is the common thread among the trio of problems examined by the NRC’s special inspection team inspire little to no confidence that their performance will be any better during a design basis or beyond design basis event.

Scientists to Congress: The Iran Deal is a Keeper

The July 2015 Iran Deal, which places strict, verified restrictions on Iran’s nuclear activities, is again under attack by President Trump. This time he’s kicked responsibility over to Congress to “fix” the agreement and promised that if Congress fails to do so, he will withdraw from it.

As the New York Times reported, in response to this development over 90 prominent scientists sent a letter to leading members of Congress yesterday urging them to support the Iran Deal—making the case that continued US participation will enhance US security.

Many of these scientists also signed a letter strongly supporting the Iran Deal to President Obama in August 2015, as well as a letter to President-elect Trump in January. In all three cases, the first signatory is Richard L. Garwin, a long-standing UCS board member who helped develop the H-bomb as a young man and has since advised the government on all matters of security issues. Last year, he was awarded a Presidential Medal of Freedom.

What’s the Deal?

Diplomats announcing the framework of the JCPOA in 2015 (Source: US Dept. of State)

If President Trump did pull out of the agreement, what would that mean? First, the Joint Comprehensive Plan of Action (JCPoA) (as it is formally named) is not an agreement between just Iran and the US—but also includes China, France, Germany, Russia, the UK, and the European Union. So the agreement will continue—unless Iran responds by quitting as well. (More on that later.)

The Iran Deal is not a treaty, and did not require Senate ratification. Instead, the United States participates in the JCPoA by presidential action. However, Congress wanted to get into the act and passed The Iran Agreement Review Act of 2015, which requires the president to certify every 90 days that Iran remains in compliance.

President Trump has done so twice, but declined to do so this month and instead called for Congress—and US allies—to work with the administration “to address the deal’s many serious flaws.” Among those supposed flaws is that the deal covering Iran’s nuclear activities does not also cover its missile activities!

According to President Trump’s October 13 remarks:

Key House and Senate leaders are drafting legislation that would amend the Iran Nuclear Agreement Review Act to strengthen enforcement, prevent Iran from developing an inter– —this is so totally important—an intercontinental ballistic missile, and make all restrictions on Iran’s nuclear activity permanent under US law.

The Reality

First, according to the International Atomic Energy Agency, which verifies the agreement, Iran remains in compliance. This was echoed by Norman Roule, who retired this month after working at the CIA for three decades. He served as the point person for US intelligence on Iran under multiple administrations. He told an NPR interviewer, “I believe we can have confidence in the International Atomic Energy Agency’s efforts.”

Second, the Iran Deal was the product of several years of negotiations. Not surprisingly, recent statements by the United Kingdom, France, Germany, the European Union, and Iran make clear that they will not agree to renegotiate the agreement. It just won’t happen. US allies are highly supportive of the Iran Deal.

Third, Congress can change US law by amending the Iran Nuclear Agreement Review Act, but this will have no effect on the terms of the Iran Deal. This may be a face-saving way for President Trump to stay with the agreement—for now. However, such amendments will lay the groundwork for a future withdrawal and give credence to President Trump’s claims that the agreement is a “bad deal.” That’s why the scientists urged Congress to support the Iran Deal as it is.

The End of a Good Deal?

If President Trump pulls out of the Iran Deal and reimposes sanctions against Iran, our allies will urge Iran to stay with the deal. But Iran has its own hardliners who want to leave the deal—and a US withdrawal is exactly what they are hoping for.

If Iran leaves the agreement, President Trump will have a lot to answer for. Here is an agreement that significantly extends the time it would take for Iran to produce enough material for a nuclear weapon, and that would give the world an alarm if they started to do so. For the United States to throw that out the window would be deeply irresponsible. It would not just undermine its own security, but that of Iran’s neighbors and the rest of the world.

Congress should do all it can to prevent this outcome. The scientists sent their letter to Senators Corker and Cardin, who are the Chairman and Ranking Member of the Senate Foreign Relations Committee, and to Representatives Royce and Engel, who are the Chairman and Ranking Member of the House Foreign Affairs Committee, because these men have a special responsibility on issues like these.

Let’s hope these four men will do what’s needed to prevent the end of a good deal—a very good deal.

Grand Gulf: Emergency Pump’s Broken Record and Missing Record

The Grand Gulf Nuclear Station located about 20 miles south of Vicksburg, Mississippi is a boiling water reactor with a Mark III containment that was licensed to operate by the Nuclear Regulatory Commission (NRC) in November 1984. It recently set a dubious record.

The Mark III containment is a pressure-suppression containment type. It features a large amount of water in its pressure suppression pool and upper containment pool. In case of an accident, energy released into containment gets absorbed by this water, thus lessening the pressurization of the atmosphere within containment. The “energy sponge” role allows the Mark III containment to be smaller, and less expensive, than the non-pressure suppression containment structure that would be needed to handle an accident.

Fig. 1 (Source: Nuclear Regulatory Commission)

The emergency core cooling systems (ECCS) reside in a structure adjacent to the containment building. The ECCS for Grand Gulf consist of the high pressure core spray (HPCS) pump, the low pressure core spray (LPCS) pump, and three residual heat removal (RHR). The preferred source of water for the HPCS pump is the condensate storage tank (CST), although it can also draw water from the suppression pool within containment. The other ECCS pumps get their water from the suppression pool.

One of the RHR pumps (RHR Pump C) serves a single function, albeit an important one called the low pressure coolant injection (LPCI) function. When a large pipe connected to the reactor vessel breaks and drains cooling water rapidly from the vessel, RHR Pump C quickly provides a lot of water to replace the lost water and cool the reactor core.

The other two RHR pumps (RHR Pumps A and B) can perform safety functions in addition to the LPCI role. Each of these RHR pumps can be aligned to route water through a pair of heat exchangers. When in use, the heat exchangers cool down the RHR water.

RHR Pumps A and B can be used to cool the water within the reactor vessel. In what is called the shutdown cooling (SDC) mode, RHR Pump A or B takes water from the reactor vessel, routes this water through the pair of heat exchangers, and returns the cooled water to the reactor vessel.

Similarly, RHR Pumps A and B can use used to cool the water within the suppression pool. RHR Pump A or B draws water from the suppression pool, routes this water through the heat exchangers, and returns the cooled water to the suppression pool.

Finally, RHR Pumps A and B can be used to cool the atmosphere within the containment structure. RHR Pump A or B can take water from the suppression pool and discharge it through carwash styled sprinkler nozzles mounted to the inside surfaces of the containment’s upper walls and roof.

Fig. 2 (Source: Nuclear Regulatory Commission)

Given the varied safety roles played by RHR Pumps A and B, the operating license for Grand Gulf only permits the reactor to continue running for up to 7 days when either pump is unavailable. Workers started the 7-day shutdown clock on August 22, 2017, after declaring RHR Pump A to be inoperable. The ECCS pumps are tested periodically to demonstrate their capabilities. RHR Pump A failed to operate within its design band during testing. The pump was supposed to be able to deliver at least a flow rate of 7,756 gallon per minute for a differential pressure of at least 131 pounds per square inch differential across the pump. The differential pressure was too low when the pump delivered the specified flow rate. A higher differential pressure was required to demonstrate that the pump could also supply the necessary flow rate under more challenging accident conditions.

Before the clock ran out, workers shut down the Grand Gulf reactor on August 29. Workers replaced RHR Pump A and restarted the reactor on October 1, 2017.

It is rare that a boiling water reactor has to shut down for a month or longer to replace a broken RHR pump. The last time it happened in the United States was a year ago. Workers shut down the reactor on September 8, 2016, after an RHR pump failed testing on September 4. The RHR pump was unable to achieve the specified differential pressure and flow rate at the same time. Workers could throttle valves to satisfy the differential pressure criterion, but the flow rate was too low. Or, workers could reposition the throttle valves to obtain the specified flow rate, but the differential pressure was too low. The RHR pump was replaced and the reactor restarted on January 29, 2017.

The reactor—Grand Gulf.

The failed pump—RHR Pump A.

The “solution”—replace the failed pump.

UCS Perspective

Grand Gulf has experienced two failures and subsequent replacements of RHR Pump since the summer of 2016. That’s two more RHR pump replacements than the rest of the U.S. boiling water reactor fleet tallied during the same period. Call Guinness—Grand Gulf may have broken the world record for most RHR pump broken in a year!

Records are made to be broken, not RHR pumps.

The company’s report to the NRC about the most recent RHR Pump A failure dutifully noted that the same pump had failed and been replaced a year earlier, but claimed that corrective action could not have prevented this year’s failure of the pump. Maybe the same RHR pump broken twice within a year for two entirely unrelated reasons. The Easter bunny, the tooth fairy, and Santa Claus all agree that it’s at least possible.

On October 31, 2016, the NRC announced it was sending a special inspection team to Grand Gulf to investigate the failure of RHR Pump A and other problems.  The NRC’s press release concluded with this sentence: “An inspection report documenting the team’s findings will be publicly available within 45 days of the end of the inspection.”

As of October 24, 2017, no such inspection report has been made publicly available. Call Guinness—the NRC may have broken the world record for the longest special inspection ever!

Grand Gulf was restarted on January 29, 2017, 90 days after the NRC announced it was sending a special inspection team to investigate a series of safety problems. The inspection report should have been publicly available as promised to allay public concerns that the numerous safety problems that caused Grand Gulf to remain shut down for four months had been fixed.

On June 29, 2017—241 days after the NRC announced the special inspection report—I emailed the NRC’s Executive Director for Operations inquiring about the status of this overdue report.

On October 2, 2017—95 days after my inquiry—the NRC’s Executive Director for Operations emailed me a response. He indicated that the onsite portion of the special inspection was completed on November 4, 2016, and that the inspection report “should be issued within the next few weeks.”

The NRC promised to issue the special inspection report around December 19, 2016, when the inspection ended.

The NRC promises to value transparency.

The NRC should either stop making promises or start delivering results. Promises aren’t made to be broken, either. That’s what RHR pumps are for, at least in Mississippi.

Fig. 3 (Source: Kaja Bilek Flickr photo)

 

Update: Turkey Point Fire and Explosion

An earlier commentary described how workers installing a fire retardant wrap around electrical cables inside Switchgear Room 3A at the Turkey Point nuclear plant in Florida inadvertently triggered an explosion and fire that blew open the fire door between the room and adjacent Switchgear Room 3B.

I submitted a request under the Freedom of Information Act (FOIA) for all pictures and videos obtained by the special inspection team dispatched by the NRC to Turkey Point to investigate this event. The NRC provide me 70 color pictures in response to my request. This post updates the earlier commentary with some of those pictures.

The workers installing the fire retardant wrap cut the material in the hallway outside the switchgear rooms, but trimmed the material to fit as they put it in place. The trimming process created small carbon pieces. Ventilation fans blowing air within the switchgear room carried the carbon fiber debris around. The picture taken inside Switchgear Room 3A after the event show some of the carbon fiber debris on the floor along with debris caused by the fire and explosion (Fig. 1).

Fig. 1 (Source: Nuclear Regulatory Commission)

Some of the carbon fiber debris found its way inside metal panels containing energized electrical equipment. The debris created a pathway for electrical current to arc to nearby metal bolts. The bolts had been installed backwards, resulting in their ends being a little closer to energized electrical lines than intended. The electrical current was 4,160 volts, so it was quite a powerful spark as it arced to an undesired location (Fig. 2).

Fig. 2 (Source: Nuclear Regulatory Commission)

Law enforcement officers sometimes use Tasers to subdue a suspect. Taser guns fire two dart-like electrodes into the body to deliver an electric shock that momentarily incapacitates a person. The nuclear Taser at Turkey Point triggered an explosion and fire. The picture shows damage to a metal panel from the High Energy Arc Fault (HEAF) (Fig. 3).

Fig. 3 (Source: Nuclear Regulatory Commission)

Fortunately, there was not much combustible material within the switchgear room to sustain a fire for long. Fig. 4 shows some of the fire and smoke damage inside the switchgear room.

Fig 4 (Source: Nuclear Regulatory Commission)

The primary consequence from the explosion and fire in Switchgear Room 3A was damage to Fire Door 070-3 to adjacent Switchgear Room 3B. The Unit 3 reactor at Turkey Point has two switchgear rooms containing power supplies and controls for plant equipment. The fire door’s function is to prevent a fire in either room from affecting equipment in the adjacent room to minimize the loss of equipment (Fig. 5).

Fig. 5 (Source: Nuclear Regulatory Commission)

The metal fire door had a three-hour rating, meaning it was designed to remain intact even when exposed to the heat from a fire lasting up to three hours. The plant’s design assumed that a fire would be extinguished within that time. The plant’s design had also considered the forces caused by a HEAF event, but only looked at components within three feet of the arc. The fire door was more than 14 feet from the arc, but apparently was not aware of the 3-feet assumption (Fig. 6).

Fig. 6 (Source: Nuclear Regulatory Commission)

The force of the explosion pressed so hard against the fire door that it broke the latch and popped the door wide open. The fire door was more than 14 feet from the arc (even farther away after the explosion), but apparently was not aware of the 3-feet assumption (Fig. 7).

Fig 7 (Source: Nuclear Regulatory Commission)

I don’t have a picture of the fire door and its latch pre-explosion, but this closeup of the door’s latching mechanism suggests the magnitude of the force applied to popping it open. This picture also suggests the need to go back and revisit the 3-feet rule (Fig. 8).

Fig. 8 (Source: Nuclear Regulatory Commission)

The explosion and fire triggered the automatic shutdown of the Unit 3 reactor. The Shift Manager declared an Alert, the least serious of the NRC’s four emergency classifications, due to the explosion and fire affecting equipment within Switchgear Room 3A. Workers called the local fire department for assistance with the fire and a worker injured by the explosion. This picture of the operations log noted some of the major events during the first 90 minutes of the event (Fig. 9).

Fig. 9 (Source: Nuclear Regulatory Commission)

UCS Perspective

The earlier commentary explained that two minor events occurred the month before the explosion and fire. In each of those events, carbon fiber debris from workers trimming material inside the switchgear room landed on electrical breakers and caused them to open unexpectedly and unwanted. But those warnings were ignored and the practice continued until a more serious event occurred.

This HEAF event is also a warning. It failed a barrier installed to prevent an event in one switchgear room from affecting equipment in the adjacent room. It had been assumed that a HEAF event could only affect components within 3 feet, yet the damaged door was more than 14 feet away. If the assumption now shown to be patently false does not lead to re-evaluations and necessary upgrades, shame on the nuclear industry and the NRC for not heeding this very clear, unambiguous warning.

Why NRC Nuclear Safety Inspections are Necessary: Indian Point

This is the second in a series of commentaries about the vital role nuclear safety inspections conducted by the Nuclear Regulatory Commission (NRC) play in protecting the public. The initial commentary described how NRC inspectors discovered that limits on the maximum allowable control room air temperature at the Columbia Generating Station in Washington had been improperly relaxed by the plant’s owner. This commentary describes a more recent finding by NRC inspectors about an improper safety assessment of a leaking cooling water system pipe on Entergy’s Unit 3 reactor at Indian Point outside New York City.

Indian Point Unit 3: Leak Before Break

On February 3, 2017, the NRC issued Indian Point a Green finding for a violation of Appendix B to 10 CFR Part 50. Specifically, the owner failed to perform an adequate operability review per its procedures after workers discovered water leaking from a service water system pipe.

On April 27, 2016, workers found water leaking from the pipe downstream of the strainer for service water (SW) pump 31. As shown in Figure 1, SW pump 31 is one of six service water pumps located within the intake structure alongside the Hudson River. The six SW pumps are arranged in two sets of three pumps. Figure 1 shows SW pumps 31, 32, and 33 aligned to provide water drawn from the Hudson River to essential (i.e, safety and emergency) components within Unit 3. SW pumps 34, 35, and 36 are aligned to provide cooling water to non-essential equipment within Unit 3.

Fig. 1 (Source: Nuclear Regulatory Commission Plant Information Book) (click to enlarge)

Each SW pump is designed to deliver 6,000 gallons of flow. During normal operation, one SW pump can handle the essential loads while two SW pumps are needed for the non-essential loads. Under accident conditions, two SW pumps are needed to cool the essential equipment. The onsite emergency diesel generators can power either of the sets of three pumps, but not both simultaneously. If the set of SW pumps aligned to the essential equipment aren’t getting the job done, workers can open/close valves and electrical breakers to reconfigure the second set of three SW pumps to the essential equipment loops.

Because river water can have stuff in it that could clog some of the coolers for essential equipment, each SW pump has a strainer that attempts to remove as much debris as possible from the water. The leak discovered on April 27, 2016, was in the piping between the discharge check valve for SW pump 31 and its strainer. An arrow points to this piping section in Figure 1. The strainers were installed in openings called pits in the thick concrete floor of the intake structure. Water from the leaking pipe flowed into the pit housing the strainer for SW pump 31.

The initial leak rate was modest—estimated to be about one-eighth of a gallon per minute. The leak was similar to other pinhole leaks that had occurred in the concrete-lined, carbon steel SW pipes. The owner began daily checks on the leakage and prepared an operability determination. Basically, “operability determinations” are used within the nuclear industry when safety equipment is found to be impaired or degraded. The operability determination for the service water pipe leak concluded that the impairment did not prevent the SW pumps from fulfilling their required safety function. The operability determination relied on a sump pump located at the bottom of the strainer pit transferring the leaking water out of the pit before the water flooded and submerged safety components.

The daily checks instituted by the owner included workers recording the leak rate and assessing whether it had significantly increased. But the checks were against the previous day’s leak rate rather than the initial leak rate. By September 18, 2016, the leakage had steadily increased by a factor of 64 to 8 gallons per minute. But the daily incremental increases were small enough that they kept workers from finding the overall increase to be significant.

The daily check on October 15, 2016, found the pump room flooded to a depth of several inches. The leak rate was now estimated to be 20 gallons per minute. And the floor drain in the strainer pit was clogged (ironic, huh?) impairing the ability of its sump pump to remove the water. Workers placed temporary sump pumps in the room to remove the flood water and cope with the insignificantly higher leak rate. On October 17, workers installed a clamp on the pipe that reduced the leakage to less than one gallon per minute.

The operability determination was revised in response to concerns expressed by the NRC inspectors. The NRC inspectors were not satisfied by the revised operability determination. It continued to rely on the strainer pit sump pump removing the leaking water. But that sump pump was not powered from the emergency diesel generator and thus would not remove water should offsite power become unavailable. Step 5.6.4 of procedure EN-OP-14, “Operability Determination Process,” stated “If the Operability is based on the use or availability of other equipment, it must be verified that the equipment is capable of performing the function utilized in the evaluation.”

The operability determination explicitly stated that no compensatory measures or operator manual actions were needed to handle the leak, but the situation clearly required both compensatory measures and operator manual actions.

The NRC inspectors found additional deficiencies in the revised operability determination. The NRC inspectors calculated that a 20 gallon per minute leak rate coupled with an unavailable strainer pit sump pump would flood the room to a depth of three feet in three hours. There are no flood alarms in the room and the daily checks might not detect flooding until the level rose to three feet. At that level, water would submerge and potentially disable the vacuum breakers for the SW pumps. Proper vacuum breaker operation could be needed to successfully restart the SW pumps.

The NRC inspectors calculated that the 20 gallon per minute leak rate without remediation would flood the room to the level of the control cabinets for the strainers in 10 hours. The submerged control cabinets could disable the strainers, leading to blocked cooling water flow to essential equipment.

The NRC inspects calculated that the 20 gallon per minute leak rate without remediation would completely fill the room in about 29 hours, or only slightly longer than the daily check interval.

Flooding to depths of 3 feet, 10 feet, and the room’s ceiling affected all six SW pumps. Thus, the flooding represented a common mode threat that could disable the entire service water system. In turn, all safety equipment shown in Figure 2 no longer cooled by the disabled service water system could also be disabled. The NRC estimated that the flooding risk was about 5×10-6 per reactor year, solidly in the Green finding band.

Fig. 2 (Source: Nuclear Regulatory Commission Plant Information Book) (click to enlarge)

UCS Perspective

“Leak before break” is a longstanding nuclear safety philosophy. Books have been written about it (well, at least one report has been written and may even have been read.)  The NRC’s approval of a leak before break analysis can allow the owner of an existing nuclear power reactor to remove pipe whip restraints and jet impingement barriers. Such hardware guarded against the sudden rupture of a pipe filled with high pressure fluid from damaging safety equipment in the area. The leak before break analyses can provide the NRC with sufficient confidence that piping degradation will be detected by observed leakage with remedial actions taken before the pipe fails catastrophically. More than a decade ago, the NRC issued a Knowledge Management document on the leak before break philosophy and acceptable methods of analyzing, monitoring, and responding to piping degradation.

This incident at Indian Point illustrated an equally longstanding nuclear safety practice of “leak before break.” In this case, the leak was indeed followed by a break. But the break was not the failure of the piping but failure of the owner to comply with federal safety regulations. Pipe breaks are bad. Regulation breaks are bad. Deciding which is worse is like trying to decide which eye one wants to be poked in. None is far better than either.

As with the prior Columbia Generating Station case study, this Indian Point case study illustrates the vital role that NRC’s enforcement efforts plays in nuclear safety. Even after NRC inspectors voiced clear concerns about the improperly evaluated service water system pipe leak, Entergy failed to properly evaluate the situation, thus violating federal safety regulations. To be fair to Entergy, the company was probably doing its best, but in recent years, Entergy’s best has been far below nuclear industry average performance levels.

The NRC’s ROP is the public’s best protection against hazards caused by aging nuclear power reactors, shrinking maintenance budgets, emerging sabotage threats, and Entergy. Replacing the NRC’s engineering inspections with self-assessments by Entergy would lessen the effectiveness of that protective shield.

The NRC must continue to protect the public to the best of its ability. Delegating safety checks to owners like Entergy is inconsistent with that important mission.

Xi’s China

What’s happening in China? The US consensus seems to be that President Xi Jinping is upending the place. Yet, midway through an expected ten-year term China’s communist party general secretary delivered a report to the 19th Party Congress that reiterated all the language, ideas and policies that the Chinese communists have used to govern the country since the mid-1980s. The most remarkable thing about Xi’s China is that it hasn’t changed at all.

Chinese Communist Party General Secretary Xi Jinping addresses the 19th Party Congress

China remains a socialist country. Xi’s not only proud of that, he’s confident that continuing to follow the socialist road will put China on the right side of history. What makes his tenure at the top seem different is that he’s unapologetically elevated ideology over policy. In Chairman Mao’s parlance, Xi is a little more red than expert.

But that doesn’t mean he’s changed Chinese policy. Internationally, Xi reported China remains open to the outside world. Domestically, his government remains committed to economic and political reform. It may not be the kind of openness or the type of reform US officials hoped for, but US expectations for China have always been based on a different view of history. Even after the Chinese leadership used lethal military force to suppress nationwide public demonstrations in June of 1989, most US observers still believed that international engagement, market economics and the rise of the Chinese middle class would eventually lead to the fall of the Chinese Communist Party (CCP) and the emergence of a multi-party Chinese democracy. Instead, if Xi’s report is to be believed, Chinese socialism has emerged from the crucible of Tiananmen Square stronger than it was before.

Continuity and Change in Communist China

The last time China really changed was when Mao died. Mao believed that global revolution was right around the corner and that China was ready for a rapid transformation to communism. The leaders who inherited the party in Mao’s wake, especially Deng Xiaoping, saw the world and China’s place within it very differently. At home, China was only in the beginning stages of a transformation to socialism that would take a very long time. And as the party set about engineering that incremental transformation, China would need to engage the world as it was rather than imagining they would change it. Deng told his comrades they needed to be humble as they worked to fulfill their Chinese socialist dream to modernize the country and restore Chinese influence in the world.

Xi Jinping’s report does not stray too far from that advice. China’s made a lot of progress since Deng died twenty years ago, but it is still, according to Xi, in the early stages of a long-term transformation to socialism. China’s progress may have elevated its position in the world, and given China a greater say in international governance, but there is nothing in Xi’s report about China leading a movement to upend the global status quo.

Xi does believe that Chinese socialism can set an example for the rest of the world to follow, and that more active Chinese participation can help transform the international order. As a committed Marxist, Xi should believe an eventual transition to a socialist global order is inevitable. But in the short term, Xi’s China appears squarely focused on the fifth of humanity that lives within its borders, where good governance is at a crossroads, crippled by endemic corruption rooted in the attitudes and behavior of party cadres who’ve lost the faith. Xi’s project, if you take his party congress report at face value, seems to be to save Chinese socialism and consolidate its gains, not to change it.

Implications for the United States

Is a consolidated and internationally persuasive Chinese socialism a threat to the United States? Unfortunately, that’s a question many US analysts and officials are no longer inclined to address. During the Maoist era, when China was “more red than expert,” there was greater US interest in the content of Chinese socialism. Today, US observers tend to view the CCP leadership’s repeated recitations of its socialist principles and practices as propaganda masking personal or national ambitions.

US commentaries on Xi’s speech reflect this. Most of them interpret Xi’s campaign against corruption as a personal quest to consolidate power rather than a campaign to save Chinese socialism. Instead of taking Xi and his recent predecessors at their word and seeing the principal aim of their post-1980s efforts as the achievement of a “moderate level of prosperity” for China‘s 1.4 billion, many US observers see this as an attempt to hide the CCP’s real aim, which they believe is kicking the United States out of Asia and supplanting US dominance of the region. For Americans, the contest between the United States and China is perceived as an historic struggle between rising and falling national powers rather than competing ideologies.

If Xi is a budding dictator leading a nationalist political organization focused on replacing the United States at the top of a global hierarchy then US policy makers should be concerned. But what if the Chinese dream articulated in Xi’s report to the 19th Party Congress is a fair representation of the CCP’s ambitions? Should the United States be alarmed? The answer is not obvious and the question seems to deserve greater consideration.

Why NRC Nuclear Safety Inspections are Necessary: Columbia Generating Station

The Nuclear Regulatory Commission (NRC) adopted its Reactor Oversight Process (ROP) in 2000. The ROP is far superior to the oversight processes previously employed by the NRC. Among its many virtues, the NRC treats the ROP as a work in progress, meaning that agency routinely re-assesses the ROP and makes necessary adjustments.

Earlier this year, the NRC initiated a formal review of its engineering inspections with the goal of making them more efficient and more effective. During a public meeting on October 11, 2017, the NRC working group conducting the review outlined some changes to the engineering inspections that would essentially cover the same ground but with an estimated 8 to 15 percent reduction in person-hours (the engineering inspections and suggested revisions are listed on slide 7 of the NRC’s presentation). Basically, the NRC working group suggested repackaging the inspections so as to be able to examine the same number of items, but in fewer inspection trips.

The nuclear industry sees a different way to accomplish the efficiency and effectiveness gains sought by the NRC’s review effort—they propose to eliminate the NRC’s engineering inspections and replace them with self-assessments. The industry would mail the results from the self-assessments to the NRC for their reading pleasure.

UCS is wary of self-assessments by industry in lieu of NRC inspections. On one hand, statistics might show that self-assessments increase safety just as a community firing all its law enforcement officers would see a statistical decrease in arrests, suggesting a lower crime rate. I have been researching the records publicly available in ADAMS to compare the industry’s track record for finding latent safety problems with the NRC’s track record to see whether replacing NRC’s inspections with industry self-assessments could cause nuclear safety to go off-track.

This commentary is the first in a series that convinces us that the NRC’s engineering inspections are necessary for nuclear safety and that public health and safety will be compromised by replacing them with self-assessments by industry.

Columbia Generating Station: Not so Cool Safety Moves

The Columbia Generating Station is a boiling water reactor owned by Energy Northwest and located 12 miles northwest of Richland, Washington. The Washington Public Power Supply System (the original name of the plant’s owner) submitted a Preliminary Safety Analysis Report (PSAR) for the Washington Nuclear Project Unit 2 (the original name for the reactor) to the Atomic Energy Commission (AEC, the original name of the nuclear regulator) in February 1973.

The PSAR described the proposed design of the plant and associated safety studies that demonstrated compliance with regulatory requirements. The PSAR described the two systems intended to cool the control room during normal operation and during postulated accidents. The control room heating, ventilation, and air conditioning (HVAC) would use chillers within the Radwaste Building HVAC system during normal operation. Because the Radwaste Building HVAC system is not designed to withstand earthquake forces or remain running when offsite power is unavailable, it cannot be credited with performing this role during accident conditions. So, the Standby Service Water system was proposed to cool the control room during accidents. The Standby Service Water system features pumps, pipes, and valves that recirculate water between a large cooling pond and safety equipment within the plant. Two independent sets, called divisions in the figure, are used to enhance reliability of this safety function (Fig. 1).

Fig. 1 (Source: Energy Northwest modified by UCS)

The PSAR indicated that for worst-case design conditions of 77°F cooling pond water temperature and 105°F outside air temperature, the Standby Service Water system would prevent the air temperature within the control room from exceeding 104°F. The AEC/NRC expressed concern that such warm control room temperatures could impair both human and equipment performance.

The owner resolved the regulator’s concerns by committing to installing two Seismic Category I emergency chillers for the control room HVAC system (Fig. 2). The emergency chillers were fully redundant such that one emergency chiller alone could maintain the air temperature inside the control room from exceeding 78°F during an accident. The NRC issued an operating license for the Columbia Generating Station on April 13, 1984, with License Condition 2.C.(21) that required the two emergency chillers to be operable by May 31, 1984. In November 1984, the owner revised the PSAR (now called the Final Safety Analysis Report or FSAR) to describe the emergency chillers and their role in keeping the control room air temperature from exceeding 78°F.

Fig. 2 (Source: Energy Northwest)

In September 1989, the owner revised the FSAR to change the control room air temperature limit to 85°F. The owner determined that this change did not require prior NRC review and approval. The NRC later disagreed with this self-imposed temperature relaxation.

In May 1998, the owner revised the FSAR to change the control room air temperature limit from 85°F to 85°F effective (see below). Once again, the owner determined that this change did not require prior NRC review and approval. And again, the NRC later disagreed with this self-imposed temperature limit relaxation.

“Effective temperature” is based on a combination of wet-bulb and dry-bulb temperatures. The original 75°F and initial 85°F limits were based solely on dry-bulb temperatures. The 85°F effective temperature allowed dry-bulb temperatures of up to 105°F—higher than the control room air temperature expressly rejected by the regulator. The owner made this change without seeking NRC’s approval because it was considered an editorial change. The NRC later determined that this temperature limit relaxation was not an editorial change.

Because the Standby Service Water system alone could maintain the dry-bulb temperature inside the control room at or below 104°F and the revised limit was now 105°F, the owner implemented another change—also unreviewed and unapproved by the NRC—eliminating the need for the emergency chillers to perform any safety role during postulated accidents. The NRC issued a Severity Level IV non-cited violation on April 23, 103, for the owner relaxing the control room air temperature limit without prior NRC approval.

The following month, the owner notified the NRC about deficiencies in the test periodically conducted to demonstrate the adequacy of the Standby Service Water system to cool the control room during accident conditions. When the test deficiencies were remedied and the corrected test performed, one of the two Standby Service Water system trains failed. Workers determined that the tubes within the control room cooler units had become degraded due to the buildup of scale on the inside tube surfaces and the collection of sediment in the lower region of the units. Routine testing of the control room cooler units had been discontinued 16 years earlier.

So, around the same time that the owner improperly decided that the emergency chillers were no longer needed to cool the control room during accidents, it discontinued proper testing of the Standby Service Water system that it thought would perform this role during accidents. Maybe it was another editorial change that discontinued the tests.

On November 12, 2015, the NRC issued a Green finding for a violation of Criterion III, “Design Control,” of Appendix B to 10 CFR Part 50. The NRC inspectors found that the emergency chillers, as designed and governed by operating procedures, would not maintain the air temperature inside the control room below 85°F under accident conditions. The vendor manual for the emergency chillers stated that the STOP-RESET pushbutton had to be depressed after a power interruption because the chillers would not automatically restart. But the operating procedures failed to have the operators perform this necessary step.

On December 22, 2015, Energy Northwest contested the NRC’s finding. The owner stated, in writing, that “There are no design basis requirements to maintain the control room temperature at less than or equal to 85°F at all times for all accident scenarios” [boldfacing in original]. The owner further requested that the NRC conduct a backfit analysis per 10 CFR 50.109 before imposing these “new” regulatory requirements.

By letter dated June 10, 2016, the NRC responded to the owner’s appeal. The NRC carefully considered the owner’s arguments and delineated why it was rejecting each one. The NRC concluded “…it cannot be concluded that the system function as described in the current design basis can be achieved.”

On May 3, 2016 (perhaps sensing that its appeal would not be successful), the owner met with the NRC to discuss a pending license amendment request that would resolve the concerns about the emergency chillers. As shown in the figure, the two emergency chillers sit side-by-side in the same room vulnerable to a common mode, like a fire, disabling them both (Fig. 3). But the chillers are seismically qualified and redundant, consistent with the original commitment to install them. The pending license amendment request would reconcile departures from two NRC General Design Criteria and justify the use of manual vice automatic actions to place the chillers in service.

Fig. 3 (Source: Energy Northwest)

UCS Perspective

Under the Atomic Energy Act as amended, the NRC is tasked with establishing and enforcing regulations to protect workers and the public from the inherent hazards from nuclear power reactor operation.

Owners are responsible for conforming with applicable regulatory requirements. In this case, the owner made a series of changes that resulted in the plant not conforming with applicable regulatory requirements for the air temperature within the control room. But there’s no evidence suggesting that the owner knew that the changes were illegal yet made them anyway hoping not to get caught. Nevertheless, ignorance of the law is still not a valid excuse. The public is not adequately protected when safety regulations are not met, regardless of whether the violations are intentional or inadvertent.

This case study illustrates the vital role that NRC’s enforcement efforts plays in nuclear safety. The soundest safety regulation in the world serves little use unless owners abide by it. The NRCs inspection efforts either verify that owners are abiding by safety regulations or identify shortfalls. Self-assessments by owners are more likely to sustain mis-interpretations and misunderstandings than to flush out safety problems.

The NRC’s ROP is the public’s best protection against hazards caused by aging nuclear power reactors, shrinking maintenance budgets, and emerging sabotage threats. Replacing the NRC’s engineering inspections with self-assessments by the owners would lessen the effectiveness of that protective shield.

The NRC must continue to protect the public to the best of its ability. Delegating safety checks to owners is inconsistent with that important mission.

No, Missile Defense Will Not Work 97% of the Time

In an October 11 interview on Fox News, President Trump claimed:

We have missiles that can knock out a missile in the air 97 percent of the time. If you send two of them, they are going to get knocked down.

This is not true. At least not in any relevant way.

The only homeland missile defense system is the Ground-based Midcourse Defense (GMD) system, which I’ve written plenty about here in these pages, and have co-authored a recent report about. If you’ve been following along, you’ll know the president’s statement was clearly untrue.  I’ll explain why.

What does the actual test record show?

The GMD interceptors have succeeded in destroying the target in nine out of 18 tests since 1999 (50%).  They have destroyed their target in four out of 10 tries (40%) since the GMD system was nominally deployed in 2004. They have destroyed their target in two of the last five tests (40%).

So there is no basis to expect it to work any better than 40 to 50% of the time even under the most generous and easiest conditions—former Pentagon testing agency director Phil Coyle calls the test conditions so far as “scripted for success.”

While the test record says something about the GMD’s capabilities under scripted conditions, the real world will be more complex and challenging. The Pentagon’s highest testing official assessed in 2014 that the test program was “insufficient to demonstrate that an operationally useful capability exists.” More on this later.

But for sake of argument, say the “single shot kill probability” has been determined via tests to be 40 to 50% in those optimistic conditions. Because reliability is low, the US would fire multiple interceptors at the missile to try to boost the system’s effectiveness. Using four-on-one targeting, and a 40 to 50% chance that a given interceptor would work, this leads to a 6 to 13% chance that the warhead gets through.

Real-world conditions

But this isn’t the right question. If it came down to a nuclear attack, would North Korea send just a single missile, and choose the most convenient conditions? That seems unlikely. Let’s say the salvo is five incoming missiles. In that case, with an interceptor kill probability of 40 to 50%, using four interceptors on each missile, the probability that one warhead gets through is 28 to 50%. Uncomfortably high.

I could not stress more that this is a best-case scenario. It assumes that:

1) Failures are uncorrelated and not, e.g., a design flaw common to all interceptors, such as the guidance system issues that took nearly a decade to diagnose and fix,

2) The intercept attempts take place under simplified conditions and that the system is not being stressed as it would in a real-world situation, and

3) The system successfully identified the five real targets from among decoys. If the system cannot distinguish decoys from the real targets, it will have to engage them all, quickly depleting the interceptor inventory. These do not need to be the Ferraris of decoys to be an issue. Some of the GMD intercept tests have included decoys, but all of those have been designed to be easily distinguished from the target warhead.

In short, one can construct situations under which missile defense might destroy missiles: a small salvo of missiles sent without countermeasures and under the limited range of conditions under which the system has been tested. The problem is that these are not by any stretch the most *likely* situations. A potential adversary has every incentive to make the attack as difficult as possible to intercept if he is going to initiate World War Three.

Note that even if the president were instead talking about one of the missile defense systems that has a better and more complete test record, such as THAAD, the issues with not having been tested in operationally realistic conditions is the same. And because THAAD defends against shorter-range missiles from North Korea, which are cheaper and more plentiful, it has the additional issue that it may be overwhelmed even if it is able to discriminate between decoys and real targets. There just may be too many targets.

Why is this dangerous?

The best-case scenario is that President Trump is trying to avoid a confrontation by allowing himself to save face: he has declared that North Korea must not be able to threaten the US mainland with nuclear-armed missiles. Or that he hopes such statements would help dissuade North Korea from considering an attack.

Certainly worse than this is the possibility that Trump actually believes that strategic missile defense provides credible protection and he has not been advised correctly. One hopes he is provided accurate information by stewards of these programs, although at least in public, government official often describe the GMD system as much more capable than it has been demonstrated to be.

This is dangerous, because common sense would say that if we have spent $40 billion on a missile defense system that the US has claimed has been “operational” for going on fifteen years, it must “work.” But it doesn’t. Look at the test record.

The problem is that believing missile defense works when it doesn’t can lead you to take actions that make you need it, and then it can’t help you.

Don’t Make the Same Mistake on Iran that Bush Made on North Korea

Press reports say President Trump will likely not certify Iranian compliance with the Iran nuclear deal in the near future, setting up a situation in which Congress can reimpose sanctions and effectively end US compliance with the deal.

(Source: US State Dept.)

Since the agreement includes several other countries, that would significantly weaken the deal but would not end it.

Still, that the United States would undermine the agreement—which administration officials acknowledge Iran is abiding by—is incredibly short-sighted. It goes against the advice of President Trump’s senior advisors and essentially the whole US security policy community. It erodes US credibility as a treaty partner in future negotiations.

Killing the deal would throw out meaningful, verified limits on Iran’s ability to make nuclear weapons because the president doesn’t think the agreement goes far enough.

The US did this with North Korea, and it was a disaster

The US did this before—with North Korea—and that led to the crisis we are in today.

In 2001, when the Bush administration took office, there was an agreement in place (the Agreed Framework) that verifiably stopped North Korea’s production of plutonium for weapons and put international inspectors on the ground to make sure it was not cheating. This stopped Pyongyang from making fissile material that could be used for dozens of nuclear weapons, and provided the world valuable information about an intensely opaque country.

Also by 2001 North Korea had agreed to stop ballistic missile tests—which was readily verified by US satellites—as long as negotiations continued. This was also meaningful since it would cap Pyongyang’s missile capability at a range of only 800 miles.

Former Secretary of Defense William Perry, who was closely involved in the negotiations with Pyongyang, has said he believes at that point the United States was a couple months from reaching an agreement that would have ended the North’s nuclear and missile programs. This was years before North Korea had done any nuclear tests or long-range missile tests.

Instead of capturing these important restrictions and building on them, the Bush administration—like Trump today—argued these limits were flawed because they did not go far enough to reign in the whole range of activities the United States was concerned about. Bush stopped the talks and eventually let the constraints on North Korea’s nuclear and missile programs fall apart, bringing us to where we are today: facing a North Korea with hydrogen bombs and long-range missiles.

One reason the Bush administration gave for stopping implementation of the Agreed Framework was that Pyongyang had a fledgling uranium enrichment program that was not captured by the agreement. US negotiators knew about that program in the 1990s, and were watching it, but decided that ending Korea’s operating plutonium-production capabilities and getting inspectors on the ground was the crucial first step, and with that in place the uranium program could be addressed as a next step. The Agreed Framework was not meant to be all-encompassing—it was an important, logical step toward solving the bigger problem that was too complex to be solved all at once.

The Iran deal was similarly seen by those negotiating it as a meaningful, achievable step toward solving the bigger issues that could not be addressed all at once. And it has been successful at doing that.

Drifting toward disaster

In the case of Iran, as well as North Korea, President Trump is taking provocative steps that go against the advice of his senior advisors—and in many cases simply defy common sense. The stakes are extremely high in both cases. Dealing with them requires an understanding of the issues and potential consequences, and a long-term strategy built on realistic steps and not magical thinking.

If Trump de-certifies the Iran agreement, he will be tossing the fate of the deal to Congress. Congress needs to heed the advice the president is not taking. That means it should listen to Secretary of Defense James Mattis; Gen. Joseph Dunford, chair of the Joint Chiefs of Staff; Secretary of State Rex Tillerson; and others who believe it is in the best interests of the United States to continue to support the agreement.

We find ourselves in a situation in which the whims of the president are escalating conflicts that potentially put millions of lives at risk and create long-term security risks for the United States, and no one appears to have the ability to reign him in and stabilize things. That situation should be unacceptable to Congress and the US public. If this situation continues, it could go down as one of the darkest periods of US history.

Well-Deserved Recognition: ICAN Wins Nobel Peace Prize

For most of my professional life going back to the late 1980’s, I have been a nuclear weapons organizer/campaigner.  It’s my life’s work.  Over all these years, no group of campaigners has impressed me more than the good folks with the International Campaign to Abolish Nuclear Weapons (ICAN).  Their skill, passion, energy, professionalism and unrelenting doggedness is truly inspiring in our mutual pursuit of a safer world free of nuclear weapons.

I am not the only one who feels this way and today I am so pleased to join a global chorus of folks honoring and congratulating ICAN for being awarded the Nobel Peace Prize for their “work to draw attention to the catastrophic humanitarian consequences of any use of nuclear weapons and for its ground-breaking efforts to achieve a treaty-based prohibition of such weapons.”

It is hard to overstate how significant an achievement it was to get 122 nations to join together and adopt this treaty –one vigorously opposed by all of the nuclear weapons states and those under their nuclear protection.

To this day, the many supporters of the US nuclear status quo—both within and outside of the government—are full of excuses for not acting and not aggressively pursuing disarmament.  Even worse, the United States seems to be going in the wrong direction with all of the talk of, and plans for, new more usable nuclear weapons and the rebuilding of the entire US nuclear arsenal at a cost that is sure to exceed $1 trillion of our tax dollars. The international discussion that ICAN has been leading about nuclear weapons and humanitarian consequences is even more important in that context.

Similarly, it’s well past time for a debate on the morality of threatening millions of innocent civilians in the name of national security.  And who thinks it’s OK that one person has the power and authority to effectively end humanity?

What ICAN and many of us are saying is: let’s get serious folks (we are looking at you. nuclear weapons states) about nuclear disarmament before our luck runs out.

But for now, let’s raise our glasses and congratulate and honor everyone at ICAN and elsewhere who wake up every day and work so hard—against such incredible odds—to prevent nuclear war and make the world a safer, better place.  I thank you.  My children thank you.

Nuclear Plant Risk Studies: Then and Now

Nuclear plant risk studies (also called probabilistic risk assessments) examine postulated events like earthquakes, pipe ruptures, power losses, fires, etc. and the array of safety components installed to prevent reactor core damage. Results from nuclear plant risk studies are used to prioritize inspection and testing resources–components with greater risk significance get more attention.

Nuclear plant risk studies are veritable forests of event trees and fault trees. Figure 1 illustrates a simple event tree. The initiating event (A) in this case could be something that reduces the amount of reactor cooling water like the rupture of a pipe connected to the reactor vessel. The reactor protection system (B) is designed to detect this situation and immediately shut down the reactor.

Fig. 1. (Source: Nuclear Regulatory Commission)

The event tree branches upward based on the odds of the reactor protection system successfully performing this action and downward for its failure to do so. Two emergency coolant pumps (C and D) can each provide makeup cooling water to the reactor vessel to replenish the lost inventory. Again, the event tree branches upward for the chances of the pumps successfully fulfilling this function and downward for failure.

Finally, post-accident heat removal examines the chances that reactor core cooling can be sustained following the initial response. The column on the right describes the various paths that could be taken for the initiating event. It is assumed that the initiating event happens, so each path starts with A. Paths AE, ACE, and ACD result in reactor core damage. The letters added to the initiating event letter define what additional failure(s) led to reactor core damage. Path AB leads to another event tree – the Anticipated Transient Without Scram (ATWS) event tree because the reactor protection system failed to cause the immediate shut down of the reactor and additional mitigating systems are involved.

The overall risk is determined by the sum of the odds of pathways leading to core damage. The overall risk is typically expressed something like 3.8×10-5 per reactor-year (3.8E-05 per reactor-year in scientific notation). I tend to take the reciprocal of these risk values. The 3.8E-05 per reactor-year risk, for example, becomes one reactor accident every 26,316 years—the bigger the number, the lower the risk.

Fault trees examine reasons for components like the emergency coolant pumps failing to function. The reasons might include a faulty control switch, inadequate power supply, failure of a valve in the pump’s suction pipe to open, and so on. The fault trees establish the chances of safety components successfully fulfilling their needed functions. Fault trees enable event trees to determine the likelihoods of paths moving upward for success or downward for failure.

Nuclear plant risk studies have been around a long time. For example, the Atomic Energy Commission (forerunner to today’s Nuclear Regulatory Commission and Department of Energy) completed WASH-740 in March 1957 (Fig. 2). I get a kick out of the “Theoretically Possible but Highly Improbable” phrase in its subtitle. Despite major accidents being labeled “Highly Improbable,” the AEC did not release this report publicly until after it was leaked to UCS in 1973 who then made it available. One of the first acts by the newly created Nuclear Regulatory Commission (NRC) in January 1975 was to publicly issue an update to WASH-740. WASH-1400, also called NUREG-75/014 and the Rasmussen Report, was benignly titled “Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants.”

Fig. 2. (Source: Atomic Energy Commission)

Nuclear plant risk studies can also be used to evaluate the significance of actual events and conditions. For example, if emergency coolant pump A were discovered to have been broken for six months, analysts can change the chances of this pump successfully fulfilling its safety function to zero and calculating how much the broken component increased the risk of reactor core damage. The risk studies would determine the chances of initiating events occurring during the six months emergency coolant pump A was disabled and the chances that backups or alternates to emergency coolant pump A stepped in to perform that safety function. The NRC uses nuclear plant risk studies to determine when to send a special inspection team to a site following an event or discovery and to characterize the severity level (i.e., green, white, yellow, or red) of violations identified by its inspectors.

Nuclear Plant Risk Studies: Then

In June 1982, the NRC released NUREG/CR-2497, “Precursors to Potential Severe Core Damage Accidents: 1969-1979, A Status Report,” that reported on the core damage risk from 52 significant events during that 11-year period. The events included the March 1979 meltdown of Three Mile Island Unit 2 (TMI-2), which had a core damage risk of 100%. The effort screened 19,400 licensee event reports submitted to the AEC/NRC over that period, culled out 529 event for detailed review, identified 169 accident precursors, and found 52 of them to be significant from a risk perspective. The TMI-2 event topped the list, with the March 1975 fire at Browns Ferry placing second.

The nuclear industry independently evaluated the 52 significant events reported in NUREG/CR-2497. The industry’s analyses also found the TMI-2 meltdown to have a 100% risk of meltdown, but disagreed with all the other NRC risk calculations. Of the top ten significant events, the industry’s calculated risk averaged only 11.8% of the risk calculated by the NRC. In fact, if the TMI-2 meltdown is excluded, the “closest” match was for the 1974 loss of offsite power event at Haddam Neck (CT). The industry’s calculated risk for this event was less than 7% of the NRC’s calculated risk. It goes without saying (but not without typing) that the industry never, ever calculated a risk to be greater than the NRC’s calculation. The industry calculated the risk from the Browns Ferry fire to be less than 1 percent of the risk determined by the NRC—in other words, the NRC’s risk was “only” about 100 times higher than the industry’s risk for this event.

Fig. 3. Based on figures from June 1982 NRC report. (Source: Union of Concerned Scientists)

Bridging the Risk Gap?

The risk gap from that era can be readily attributed to the immaturity of the risk models and the paucity of data. In the decades since these early risk studies, the risk models have become more sophisticated and the volume of operating experience has grown exponentially.

For example, the NRC issued Generic Letter 88-20, “Individual Plant Examination for Severe Accident Vulnerabilities.” In response, owners developed plant-specific risk studies. The NRC issued documents like NUREG/CR-2815, “Probabilistic Safety Analysis Procedures Guide,” to convey its expectations for risk models. And the NRC issued a suite of guidance documents like Regulatory Guide 1.174, “An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decision on Plant-Specific Changes to the Licensing Basis.” This is but a tiny sampling of the many documents issued by the NRC about how to conduct nuclear plant risk studies—guidance that simply was not available when the early risk studies were performed.

Complementing the maturation of nuclear plant risk studies is the massive expansion of available data on component performance and human reliability. Event trees begin with initiating events—the NRC has extensively sliced and diced initiating event frequencies. Fault trees focus on performance on the component and system level, so the NRC has collected and published extensive operating experience on component performance and system reliability. And the NRC compiled data on reactor operating times to be able to develop failure rates from the component and system data.

Given the sophistication of current risk models compared to the first generation risk studies and the fuller libraries of operating reactor information, you would probably think that the gap between risks calculated by industry and NRC has narrowed significantly.

Except for being absolutely wrong, you would be entirely right.

Nuclear Plant Risk Studies: Now

Since 2000, the NRC has used nuclear plant risk studies to establish the significance of violations of regulatory requirements, with the results determining whether a green, white, yellow, or red finding gets issued. UCS examined ten of the yellow and red findings determined by the NRC since 2000. The “closest” match between NRC and industry risk assessment was for the 2005 violation at Palo Verde (AZ) where workers routinely emptied water from the suction pipes for emergency core cooling pumps. The industry’s calculated risk for that event was 50% (half) of the NRC’s calculated risk, meaning that the NRC viewed this risk as double that of the industry’s view. And that was the closest that the risk viewpoints came. Of these ten significant violations, the industry’s calculated risk averaged only 12.7% of the risk calculated by the NRC. In other words, the risk gap narrowed only a smidgen over the decades.

Fig. 4. Ratios for events after 2000. (Source: Union of Concerned Scientists)

Risk-Deformed Regulation?

For decades, the NRC has consistently calculated nuclear plant risks to be about 10 time greater than the risks calculated by industry. Nuclear plant risk studies are analytical tools whose results inform safety decision-making. Speedometers, thermometers, and scales are also analytical tools whose results inform safety decision-making. But a speedometer reading one-tenth of the speed recorded by a traffic cop’s radar gun, or a thermometer showing a child to have a temperature one-tenth of her actual temperature, or a scale measuring one-tenth of the actual amount of chemical to be mixed into a prescription pill are unreliable tools that could not continue to be used to make responsible safety decisions.

Yet the NRC and the nuclear industry continue to use risk studies that clearly have significantly different scales.

On May 6, 1975, NRC Technical Advisor Stephen H. Hanauer wrote a memo to Guy A. Arlotto, the NRC’s Assistant Director for Safety and Materials Protection Standards. The second paragraph of this two-paragraph memo expressed Dr. Hanauer’s candid view of nuclear plant risk studies: “You can make probabilistic numbers prove anything, by which I mean that probabilistic numbers ‘prove’ nothing.”

Oddly enough, the chronic risk gap has proven the late Dr. Hanauer totally correct in his assessment of the value of nuclear plant risk studies. When risk models permit users to derive results that don’t reside in the same zip code yet alone the same ball park, the results prove nothing.

The NRC must close the risk gap, or jettison the process that proves nothing about risks.

START from the Beginning: 25 Years of US-Russian Nuclear Weapons Reductions

For the past 25 years, a series of treaties have allowed the US and Russia to greatly reduce their nuclear arsenals—from well over 10,000 each to fewer than 2,000 deployed long-range weapons each.  These Strategic Arms Reduction Treaties (START) have enhanced US security by reducing the nuclear threat, providing valuable information about Russia’s nuclear arsenal, and improving predictability and stability in the US-Russia strategic relationship.

US and Russian team members shake hands before a Strategic Arms Reduction Treaty inspection visit in 2009. START established an in-depth verification regime, including boots-on-the-ground inspections that provided unprecedented levels of data exchange and transparency. Photo: U.S. Air Force/Christopher Hubenthal

Twenty-five years ago, US policy-makers of both parties recognized the benefits of the first START agreement: on October 1, 1992, the Senate voted overwhelmingly—93 to 6—in favor of ratifying START I.

The end of START?

With increased tensions between the US and Russia and an expanded range of security threats for the US to worry about, this longstanding foundation is now more valuable than ever.

The most recent agreement—New START—will expire in early February 2021, but can be extended for another five years if the US and Russian presidents agree to do so. In a January 28 phone call with President Trump, Russian President Putin reportedly raised the possibility of extending the treaty. But instead of being extended, or even maintained, the START framework is now in danger of being abandoned.

President Trump has called New START “one-sided” and “a bad deal,” and has even suggested the US might withdraw from the treaty. His advisors are clearly opposed to doing so. Secretary of State Rex Tillerson expressed support for New START in his confirmation hearing. Secretary of Defense James Mattis, while recently stating that the administration is currently reviewing the treaty “to determine whether it’s a good idea,” has previously also expressed support, as have the head of US Strategic Command and other military officials.

Withdrawal seems unlikely, but unless Mattis and other military officials push the president hard, so does an extension. Worse, even if Trump is not re-elected, and the incoming president is more supportive of the treaty, there will be little time for a new administration, taking office in late January 2021, to do an assessment and sign on to an extension before the deadline. While UCS and other treaty supporters will urge the incoming administration to act quickly, if the Trump administration does not extend the treaty, it is quite possible that New START—and the security benefits it provides—will lapse.

The Beginning: The Basics and Benefits of START I

The overwhelming bipartisan support for a treaty cutting US nuclear weapons demonstrated by the START I ratification vote today seems unbelievable. At the time, however, both Democrats and Republicans in Congress, as well as the first President Bush, recognized the importance of the historic agreement, the first to require an actual reduction, rather than simply a limitation, in the number of US and Russian strategic nuclear weapons.

By the end of the Cold War, the US had about 23,000 nuclear warheads in its arsenal, and the Soviet Union had roughly 40,000. These numbers included about 12,000 US and 11,000 Soviet deployed strategic warheads—those mounted on long-range missiles and bombers. The treaty limited each country to 1,600 strategic missiles and bombers and 6,000 warheads, and established procedures for verifying these limits.

The limits on missiles and bombers, in addition to limits on the warheads themselves, were significant because START required the verifiable destruction of any excess delivery vehicles, which gave each side confidence that the reductions could not be quickly or easily reversed. To do this, the treaty established a robust verification regime with an unprecedented level of intrusiveness, including on-site inspections and exchanges of data about missile telemetry.

Though the groundwork for START I was laid during the Reagan administration, ratification and implementation took place during the first President Bush’s term. The treaty was one among several measures taken by the elder Bush that reduced the US nuclear stockpile by nearly 50 percent during his time in office.

START I entered into force in 1994 and had a 15-year lifetime; it required the US and Russia to complete reductions by 2001, and maintain those reductions until 2009. However, both countries actually continued reductions after reaching the START I limits. By the end of the Bush I administration, the US had already reduced its arsenal to just over 7,000 deployed strategic warheads. By the time the treaty expired, this number had fallen to roughly 3,900.

The Legacy of START I

Building on the success of START I, the US and Russia negotiated a follow-on treaty—START II—that required further cuts in deployed strategic weapons. These reductions were to be carried out in two steps, but when fully implemented would limit each country to 3,500 deployed strategic warheads, with no more than 1,750 of these on submarine-launched ballistic missiles.

Phase II also required the complete elimination of independently targetable re-entry vehicles (MIRVs) on intercontinental ballistic missiles. This marked a major step forward, because MIRVs were a particularly destabilizing configuration. Since just one incoming warhead could destroy all the warheads on a MIRVed land-based missile, MIRVs create pressure to “use them or lose them”—an incentive to strike first in a crisis. Otherwise, a country risked losing its ability to use those missiles to retaliate in the case of a first strike against it.

While both sides ratified START II, it was a long and contentious process, and entry into force was complicated by provisions attached by both the US Senate and Russian Duma. The US withdrawal from the Anti-Ballistic Missile (ABM) treaty in 2002 was the kiss of death for START II. The ABM treaty had strictly limited missile defenses. Removing this limit created a situation in which either side might feel it had to deploy more and more weapons to be sure it could overcome the other’s defense. But the George W. Bush administration was now committed to building a larger-scale defense, regardless of Russia’s vocal opposition and clear statements that doing so would undermine arms control progress.

Russia responded by announcing its withdrawal from START II, finally ending efforts to bring the treaty into force. A proposed START III treaty, which would have called for further reductions to 2,000 to 2,500 warheads on each side, never materialized; negotiations had been planned to begin after entry into force of START II.

After the failure of START II, the US and Russia negotiated the Strategic Offensive Reductions Treaty (SORT, often called the “Moscow Treaty”). SORT required each party to reduce to 1,700 to 2,200 deployed strategic warheads, but was a much less formal treaty than START. It did not include the same kind of extensive verification regime and, in fact, did not even define what was considered a “strategic warhead,” instead leaving each party to decide for itself what it would count. This meant that although SORT did encourage further progress to lower numbers of weapons, overall it did not provide the same kind of benefits for the US as START had.

New START

Recognizing the deficiencies of the minimal SORT agreement, the Obama administration made negotiation of New START an early priority, and the treaty was ratified in 2010.

New START limits each party to 1,550 deployed strategic nuclear warheads by February 2018. The treaty also limits the number of deployed intercontinental ballistic missiles, submarine-launched ballistic missiles, and long-range bombers equipped to carry nuclear weapons to no more than 700 on each side. Altogether, no more than 800 deployed and non-deployed missiles and bombers are allowed for each side.

In reality, each country will deploy somewhat more than 1,550 warheads—probably around 1,800 each—because of a change in the way New START counts warheads carried by long-range bombers. START I assigned a number of warheads to each bomber based on its capabilities. New START simply counts each long-range bomber as a single warhead, regardless of the actual number it does or could carry. The less stringent limits on bombers are possible because bombers are considered less destabilizing than missiles. The bombers’ detectability and long flight times—measured in hours vs. the roughly thirty minutes it takes for a missile to fly between the United States and Russia—mean that neither side is likely to use them to launch a first strike.

Both the United States and Russia have been moving toward compliance with the New START limits, and as of July 1, 2017—when the most recent official exchange of data took place—both are under the limit for deployed strategic delivery vehicles and close to meeting the limit for deployed and non-deployed strategic delivery vehicles. The data show that the United States is currently slightly under the limit for deployed strategic warheads, at 1,411, while Russia, with 1,765, still has some cuts to make to reach this limit.

Even in the increasingly partisan atmosphere of the 2000s, New START gained support from a wide range of senators, as well as military leaders and national security experts. The treaty passed in the Senate with a vote of 71 to 26; thirteen Republicans joined all Democratic senators in voting in favor. While this is significantly closer than the START I vote, as then-Senator John F. Kerry noted at the time, “in today’s Senate, 70 votes is yesterday’s 95.”

And the treaty continues to have strong support—including from Air Force General John Hyten, commander of US Strategic Command, which is responsible for all US nuclear forces. In Congressional testimony earlier this year, Hyten called himself “a big supporter” of New START and said that “when it comes to nuclear weapons and nuclear capabilities, that bilateral, verifiable arms control agreements are essential to our ability to provide an effective deterrent.” Another Air Force general, Paul Selva, vice chair of the Joint Chiefs of Staff, agreed, saying in the same hearing that when New START was ratified in 2010, “the Joint Chiefs reviewed the components of the treaty—and endorsed it. It is a bilateral, verifiable agreement that gives us some degree of predictability on what our potential adversaries look like.”

The military understands the benefits of New START. That President Trump has the power to withdraw from the treaty despite support from those who are most directly affected by it is, as he would say, “SAD.”

That the US president fails to understand the value of US-Russian nuclear weapon treaties that have helped to maintain stability for more than two decades is a travesty.

North Korea’s Next Test?

North Korean Foreign Minister Ri Yong Ho warned reporters in New York that his country may place a live nuclear warhead on one of its missiles, launch it, and then detonate the bomb in the open air.

It would not be the first time a country conducted such a test. The Soviet Union tried and failed in 1956. The United States was successful in 1962. But perhaps the most relevant historical precedent is the Chinese test in 1966.

 

An excerpt from 东方巨响 : a documentary film on the history of China’s nuclear weapons program produced by China’s People’s Liberation Army and released in 1999.

 

China’s Choice

At the time China was nearly as isolated as North Korea is today. The Soviet Union was no longer an ally but an adversary, massing military forces along China’s northern border. The United States kept the People’s Republic out of the United Nations and encircled its eastern coast with military bases in Japan, South Korea, the Republic of China on Taiwan, the Philippines, Australia and New Zealand. Despite relentless Chinese propaganda proclaiming invincible revolutionary strength, China’s leaders felt extraordinarily insecure in the face of mounting Soviet and US pressure.

China set off its first nuclear explosion in October of 1964 and proved it could deliver a militarily useful nuclear weapon with a bomber less than a year later. But the Chinese leadership still felt a need to demonstrate it could launch a nuclear-armed missile and detonate it near a target hundreds of kilometers away. Only then could Chinese leaders feel confident they introduced the possibility of nuclear retaliation into the minds of US and Soviet officials considering a first strike. Chinese Marshall Nie Rongzhen, who led China’s nuclear weapons program and directed the test, summed up Chinese thinking in his memoir.

Mating an atomic bomb to a missile and conducting a real swords and spears test required facing very great risks. If the missile exploded at the launch site, if it fell in the middle of its flight or if it strayed out of the target area there would be unthinkable consequences. But I was deeply confident in our scientists, in our engineers and in our comrades working at the bases, who all possessed a spirit of high responsibility. Our research and design work was thorough and the medium-range missile we developed was reliable, with a highly successful launch rate. But more than that, in order to show our missiles were genuinely a weapon of great power that could be used in war we had to conduct this test of them together.

North Korea’s Choice

It is impossible to know if the individuals leading North Korea’s nuclear weapons program have the same degree of confidence in their technology and their personnel.  But it is not hard to believe they feel the same urgent need to prove North Korea has a useable nuclear weapon, especially in the face of continuing US doubts. China’s expansive land mass allowed its leaders to conduct their test in a way that only put their own people at risk. But tiny North Korea must send its nuclear-armed missile out into the Pacific Ocean on a trajectory that would fly over Japan. If a failed North Korean test were to impact Japan it could precipitate a large-scale war in North-East Asia that could kill a million people on the first day.

Hopefully, avoiding that horrible outcome is the top priority of the North Koreans contemplating the test and the Americans considering responses. Kim and his cadres might feel less inclined to risk the test if it they were convinced President Trump and his national security team were already genuinely worried about the possibility of North Korean nuclear retaliation. Unfortunately, that’s an assurance Washington is unlikely to give Pyongyang. It still hasn’t given it to Beijing. US unwillingness to take the option of a first strike off the table, combined with demonstrations of resolve like the provocative flight of B1 bombers out of Guam and F15 fighters out of Okinawa, could tip North Korean scales in favor of conducting the test.

Critical Differences

Chairman Mao didn’t worship nuclear weapons. He famously disparaged the atomic bomb as a paper tiger. Mao believed nuclear weapons were too destructive to use in a war. Their only value was in vitiating nuclear threats against China with the fear of potential retaliation. Does Kim Jong-un think about nuclear weapons the same way? We don’t know, because we don’t talk to the North Koreans enough to understand their point of view or trust anything they say.

China went on to develop a very limited nuclear force calibrated to maintain a credible possibility of nuclear retaliation. The United States government not only never panicked, it found a way to develop a viable relationship with the nuclear-armed communist giant. By the time China first tested an ICBM capable of reaching the United States, reforms within China made it appear even less threatening. Profound US discomfort with China’s nuclear force remains, but the two sides have managed to not only avoid a war but to develop robust and mutually beneficial ties.

North Korea may seem too small, its culture too parochial to make dialog and cooperation as appealing to the United States as Nixon’s opening to China in 1972—just six years after China’s daring nuclear-armed missile test. It is hard for the nation of 24 million with a GDP the size of Jackson, Mississippi’s to command the same respect as China’s 1.3 billion. Perhaps the North Korean leadership sees nuclear weapons as a great equalizer: a viable means to force the United States to sign a peace treaty, and, as one North Korean student recently told a US reporter, “leave us alone.

The US Choice

Ri told the United Nations that the “ultimate goal” of his country’s nuclear weapons program was to “establish a balance of power with the United States.” It is worth exploring what that means, and bilateral dialog is the only way to do that.

There is no indication North Korea will agree to denuclearize unless the United States agrees to join them. The US must decide whether the risks of continuing to rely solely on pressuring North Korea, at the cost of Pyongyang’s ever more provocative demonstrations of its capability to harm the United States, are more likely to yield an acceptable outcome than the risks of engaging the North Koreans in a discussion of what might be required to make their nuclear weapons program less threatening to the United States and its allies. The most immediate choice is whether continuing to introduce ambiguity about pre-emptive US military action is worth provoking the test flight of a nuclear-armed missile over Japan.

In the Chinese case the United States came to tolerate its nuclear weapons program in the context of broader shifts in the international security environment that encouraged a bilateral rapprochement, even though the fundamental security problem – Chinese reunification and the status of the Republic of China on Taiwan – remained unresolved. The initial impetus for reestablishing relations was a shared concern about a mutual adversary, the Soviet Union. But the relationship managed to outlive the Soviet Union’s collapse. Tensions within the US-China security relationship have slowly intensified in the post-Cold War period and the United States is still unwilling to accept its vulnerability to Chinese nuclear retaliation. Yet both sides, for the time being, do not seem overly concerned about the risk of a nuclear confrontation.

Despite their volatility, Donald Trump and Kim Jong-un could find the basis for a US-North Korean rapprochement in their shared concern about an accidental nuclear war, or the outbreak of a conventional confrontation that would cause great harm to both nations. Talking about stopping a risky test of a nuclear-armed missile that would fly over Japan is a good place to start.

China is urging both sides to come to the table.

 

North Korea’s Sept. 15 Missile Launch over Japan

North Korea conducted another missile test at 6:30 am September 15 Korean time (early evening on September 14 in the US). Like the August 28 test, this test appears to have been a Hwasong-12 missile launched from a site near the Pyongyang airport. The missile followed a standard trajectory—rather than the highly lofted trajectories North Korea used earlier this year—and it flew over part of the northern Japanese island of Hokkaido (Fig. 1).

Fig. 1. Approximate path of the launch.

The missile reportedly flew 3,700 kilometers (km) (2,300 miles) and reached a maximum altitude of 770 km (480 miles). It was at an altitude of 650 to 700 km (400 to 430 miles) when it passed over Hokkaido (Fig. 2).

Fig. 2. The parts of Hokkaido the missile flew over lie about 1,250 to 1,500 km (780-930 miles) from the missile launch point.

The range of this test was significant since North Korea demonstrated that it could reach Guam with this missile, although the payload the missile was carrying is not known. Guam lies 3,400 km from North Korea, and Pyongyang has talked about it as a target because of the presence of US forces at Anderson Air Force Base.

This missile very likely has low enough accuracy that it could be difficult for North Korea to use it to destroy this base, even if the missile was carrying a high-yield warhead. Two significant sources of inaccuracy of an early generation missile like the Hwasong-12 are guidance and control errors early in flight during boost phase, and reentry errors due to the warhead passing through the atmosphere late in flight. I estimate the inaccuracy of the Hwasong-12 flown to this range to be likely 5 to 10 km, although possibly larger.

Even assuming the missile carried a 150 kiloton warhead, which may be the yield of North Korea’s recent nuclear test, a missile of this inaccuracy would still have well under a 10% chance of destroying the air base. (For experts: This estimate assumes the air base would have to fall within the warhead’s 5 psi air blast radius, which is 3.7 km, and that the CEP is 5 to 10 km.)

Heating of the reentry vehicle

As I’ve done with some previous tests, I looked at how the heating experienced by the reentry vehicle (RV) on this test compares to what would be experienced by the same RV on a 10,000 km-range missile on a standard trajectory (MET). My previous calculations were done on North Korea’s highly lofted trajectories, which tended to give high heating rates but relatively short heating times.

Table 1 shows that in this case the duration of heating (τ) would be roughly the same in the two cases. However, not surprisingly because of the difference in ranges and therefore of reentry speeds, the maximum heating rate (q) and the total heat absorbed (Q) by the RV on this trajectory is only about half that of the 10,000 km trajectory.

Table 1. A comparison of RV heating on the September 15 missile test and on a 10,000 km-range trajectory, assuming both missiles have the same RV and payload. A discussion of these quantities can be found in the earlier post.

So while it seems likely that North Korea can develop a heat shield that would be sufficient for a 10,000 km range missile, this test does not demonstrate that.

Tennessee Valley Authority’s Nuclear Safety Culture Déjà vu

The Nuclear Regulatory Commission (NRC) issued a Confirmatory Order to the Tennessee Valley Authority (TVA) on July 27, 2017.  An NRC team inspecting the Watts Bar Nuclear Plant in fall 2016 determined that TVA failed to comply with elements of another Confirmatory Order that NRC had issued to TVA on December 22, 2009. Specifically, the 2009 Confirmatory Action required TVA to implement measures at all its nuclear plant sites (i.e., Watts Bar and Sequoyah in Tennessee and Browns Ferry in Alabama) to ensure that adverse employment actions against workers conformed to the NRC’s employee protection regulations and whether the actions could negatively impact the safety conscious work environment. The NRC inspection team determined that TVA was not implementing several of the ordered measures at Watts Bar.

To be fair to TVA, the agency did indeed develop the procedures to ensure adverse employee actions did not violate NRC’s employee protection regulations.

To be fair to NRC, its inspectors found that TVA senior management simply did not use those procedures when taking adverse employee action against several TVA employees and contractors.

To say that TVA has a nuclear safety culture problem is like saying the sun is hot.

After determining that TVA failed to implement mandated in its December 2009 Confirmatory Order, the NRC issued another Confirmatory Order to TVA in July 2017.

How many Confirmatory Orders it will take to get TVA to establish and sustain proper nuclear safety cultures at its nuclear power plants?

I don’t know. But at least we are now one Confirmatory Order closer to that magic number. Perhaps before too many more years roll by, workers at Watts Bar, Sequoyah, and Browns Ferry will actually be protected the way they are supposed to be by NRC’s regulations.

Broken Valve in Emergency System at LaSalle Nuclear Plant

An NRC Special Inspection Team (SIT) conducted an inspection at the LaSalle Nuclear Plant this spring to investigate the cause of a valve’s failure and assess the effectiveness of the corrective actions taken.

The two units at Exelon Generation Company’s LaSalle County nuclear plant about 11 miles southeast of Ottawa, Illinois are boiling water reactors (BWRs) that began operating in the early 1980s. While most of the BWRs operating in the U.S. are BWR/4’s with Mark I containment designs, the “newer” LaSalle Units feature BWR/5’s with Mark II containment designs. The key distinction for this commentary is that while BWR/4’s employ steam-driven high pressure coolant injection (HPCI) systems to provide makeup cooling water to the reactor core in event that a small pipe connected to the reactor vessel breaks, the BWR/5’s use a motor-driven high pressure core spray (HPCS) system for this safety role.

The Event

Workers attempted to refill the Unit 2 high pressure core spray (HPCS) system with water on February 11, 2017, following maintenance and testing of the system. The Unit 2 reactor was shut down for a refueling outage at the time and this downtime was used to inspect emergency systems, like the HPCS system.

The HPCS system is normally in standby mode during reactor operation. The system features one motor-driven pump that supplies a design makeup flow rate of 7,000 gallons per minute to the reactor vessel. The HPCS pump draws water from the suppression pool inside containment. In event that a small-diameter pipe connected to the reactor vessel broke, cooling water would leak out but the pressure inside the reactor vessel would remain too high for the array of low-pressure emergency systems (i.e., the residual heat removal and low pressure core spray pumps) to function. Water pouring from the broken pipe ends drains to the suppression pool for re-use. The motor-driven HPCS pump can be powered from the offsite electrical grid when it is available or from an onsite emergency diesel generator when the grid is unavailable.

Fig. 1(Source: Nuclear Regulatory Commission)

Workers were unable to fill the piping between the HPCS injection valve (1E22-F004) and the reactor vessel. They discovered that the disc had separated from the stem of this double disc gate valve manufactured by Anchor Darling and blocked the flow path for filling the piping. The HPCS injection valve is a normally closed motor-operated valve that opens when the HPCS system is actuated to provide a pathway for makeup water to reach the reactor vessel. The motor applies torque that rotates a screw-like stem to raise (open) or lower (close) the disc in the valve. When fully lowered, the disc blocks flow through the valve. When the disc is fully raised, flow through the valve is unobstructed. Because the disc became separated from the stem in the fully lowered position, the motor might rotate the stem as if to raise the disc, but the disc would not budge.

Fig. 2 (click to enlarge) (Source: Nuclear Regulatory Commission)

Workers took a picture of the separated double disc after the valve’s bonnet (casing) was removed (Fig. 3). The bottom edge of the stem appears at the top center of the picture. The two discs and the guides they travel along (when connected to the stem) can be seen.

Fig. 3 (Source: Nuclear Regulatory Commission)

Workers replaced the internals of the HPCS injection valve with parts redesigned by the vendor and restated Unit 2.

Background

The Tennessee Valley Authority submitted a report under 10 CFR Part 21 to the NRC in January 2013 about a defect in an Anchor Darling double disc gate valve in the high pressure coolant injection system at their Browns Ferry nuclear plant. The following month, the valve’s vendor submitted a 10 CFR Part 21 report to the NRC about a design issue with Anchor Darling double disc gate valves that could result in the stem separating from the discs.

In April 2013, the Boiling Water Reactor Owners’ Group issued a report to its members about the Part 21 reports and recommended methods for monitoring the affected valves for operability. The recommendations included diagnostic testing and monitoring the rotation of the stems. Workers performed the recommended diagnostic testing of HPCS injection valve 2E22-F004 at LaSalle during 2015 without identifying any performance issues. Workers performed maintenance and testing of HPCS injection valve 2E22-F004 on February 8, 2017, using the stem rotation monitoring guidance.

In April 2016, the Boiling Water Reactor Owners’ Group revised their report based on information received from one plant owner. Workers had disassembled 26 potentially susceptible Anchor Darling double disc gate valves and found problems with 24 of them.

In April 2017, Exelon notified the NRC about the failure of HPCS injection valve 2E22-F004 due to separation of the stem from the discs. Within two weeks, a Special Inspection Team (SIT) chartered by the NRC arrived at LaSalle to investigate the cause of the valve’s failure and assess the effectiveness of the corrective actions taken.

SIT Findings and Observations

The SIT reviewed Exelon’s evaluation of the failure mode for the Unit 2 HPCS injection valve. The SIT agreed that a part within the valve had broken due to excessive force. The broken part allowed the stem-to-disc connection to become steadily more misaligned until eventually the discs separated from the stem. The vender redesigned the valve’s internals to correct the problem.

Exelon notified the NRC on June 2, 2017, of its plan to correct 16 other safety-related and important to safety Anchor Darling double disc gate valves that may be susceptible to this failure mechanism during the next refueling outages of the two LaSalle units.

The SIT reviewed Exelon’s justifications for waiting to fix these 16 valves. The SIT found the justifications to be reasonable with one exception—the HCPS injection valve on Unit 1. Exelon had estimated the number of times that the Unit 1 and the Unit 2 HPCS injection valves had been cycled. The Unit 2 valve was original equipment installed in the early 1980s while the Unit 1 valve had been replaced in 1987 following damage due to another cause. Exelon contended that the greater number of strokes by the Unit 2 valve explained its failure and justified waiting until the next refueling outage to address the Unit 1 valve.

Citing factors like unknown pre-operational testing differences between the units, slight design differences of unknown consequence, uncertain material strength properties, and uncertain differences in stem-to-wedge thread wear, the SIT concluded “that it was a matter of “when” and not “if” the 1E22-F004 valve would fail in the future if it had not already failed.” In other words, the SIT did not buy the delayed look at the Unit 1 valve.

Exelon shut down LaSalle Unit 1 on June 22, 2017, to replace the internals of HPCS injection valve 1E22-F004.

NRC Sanctions

The SIT identified a violation of Criterion III, Design Control, of Appendix B to 10 CFR Part 50 associated with the torque values developed by Exelon for the motors of HPCS injection valves 1E22-F004 and 2E22-F004. Exelon assumed the valves’ stem to be the weak link and established motor torque values that would not over-stress the stem. But the weak link turned out to be another internal part. The motor torque values applied by Exelon over-stressed this part, causing it to break and the discs to separate from the stem.

The NRC determined that the violation to be a Severity Level III Violation (out of a four-level system with Level I being most serious) based on the failure of the valves preventing the HPCS system from performing its safety function.

But the NRC exercised enforcement discretion per its Enforcement Policy and did not issue the violation. The NRC determined that the valve design defect was too subtle for Exelon to have reasonably foreseen and corrected before the Unit 2 valve’s failure.

UCS Perspective

Exelon looked pretty good in this event. The NRC’s SIT documented that Exelon was aware of the Part 21 reports made by the Tennessee Valley Authority and the valve’s vendor in 2013. That they were unable to use this awareness to identify and correct the problems with the Unit 2 HPCS injection valve is really not a poor reflection on their performance. After all, they performed the measures recommended by the Boiling Water Reactor Owners’ Group for the two Part 21 reports. The shortcoming was in that guidance, not in Exelon’s application of it.

The only blemish on Exelon’s handling of the matter was its weak justification for operating Unit 1 until its next scheduled refueling outage before checking whether its HPCS injection valve was damaged or broken. But the NRC’s SIT helped Exelon decide to hasten that plan with the result that Unit 1 was shut down in June 2017 to replace the susceptible Unit 1 valve.

The NRC looked really good in this event. Not only did the NRC steer Exelon to a safer place regarding LaSalle Unit 1, but the NRC also prodded the entire industry to get this matter resolved without undue delay. The NRC issued Information Notice 2017-03 to plant owners on June 15, 2017, about the Anchor Darling double disc gate valve design defects and the limitations in the guidance for monitoring valve performance. The NRC conducted a series of public meetings with industry and valve vendor representatives regarding the problem and its solution. Among the outcomes from these interactions is a resolution plan by the industry enumerating a number of steps with target deadlines no later than December 31, 2017, and a survey of where Anchor Darling double disc gate valves are used in U.S. nuclear power plants. The survey revealed about 700 Anchor Darling double disc gate valves (AD DDGVs) used in U.S. nuclear power plants, but only 9 valves characterized as High/Medium risk, multi-stoke valves. (Many valves are single stroke in that their safety function is to close, if open, or open, if closed. Multi-stroke valves may be called open to open and close, perhaps several times, in fulfilling their safety function.)

Fig. 4 (Source: Nuclear Energy Institute)

There’s still time for the industry to snatch defeat from the jaws of victory, but the NRC seems poised to see this matter to a timely and effective outcome.

Florida’s Nuclear Plants and Hurricane Irma

Will Florida’s two nuclear plants, Turkey Point and St. Lucie, be able to withstand Hurricane Irma?

Florida governor Rick Scott, the utility Florida Power & Light (FP&L), and the US Nuclear Regulatory Commission (NRC) have all provided assurances that they will. But we are about to witness a giant experiment in the effectiveness of the NRC’s strategy for protecting nuclear plants from natural disasters.

A review of the plans that the two plants have developed to protect against extreme natural disasters leaves plenty of room for concern. These plans were developed in response to new requirements that the NRC imposed in the years following the March 2011 Fukushima nuclear plant disaster in Japan. A prolonged loss of all electrical power—caused by an earthquake and subsequent tsunami that flooded the Fukushima site—resulted in three nuclear reactor meltdowns and a large release of radioactivity to the environment. (Even when reactors are shut down, they normally rely on electrical power to provide cooling water to the fuel in the cores and the spent fuel in storage pools, which remain hot.)

Fukushima made it clear that nuclear plants around the world were not sufficiently protected against natural disasters. Subsequently, the NRC imposed new requirements on US nuclear plants to develop strategies to cope with prolonged electric blackouts.

However, these new requirements were heavily influenced by pressure from a cost-conscious nuclear industry. As a result, they were limited in scope.

Moreover, these requirements are based on numerous assumptions that may not prove valid in the face of massive and powerful storms. In effect, the NRC is betting that no nuclear plant will experience conditions that don’t conform to these assumptions. Soon, the nation will find out whether the NRC wins or loses the next round with Mother Nature: Hurricane Irma.

The Plan for Turkey Point

Turkey Point Nuclear Plant (Source: NARA)

FP&L’s plan for Turkey Point, 25 miles south of Miami, contains many questionable assumptions.

To give just one example, its strategy to keep the two reactors cool if there is a total loss of electrical power (both offsite and on-site back-up power) includes initially drawing water from two water supply tanks (so-called condensate storage tanks), running the water through the reactors’ steam generators, and dumping the steam that is produced by the heat of the nuclear fuel in the reactor cores into the atmosphere (when the plant is operating, the steam is used to generate electricity).

But here’s the rub: These tanks were not designed to withstand objects thrown about by the high winds occurring during tornadoes or hurricanes.

Nevertheless, FP&L assumed—and the NRC accepted—that at least one of the two tanks on site would withstand any hurricane. They argued that this was a reasonable assumption because the two tanks are separated by a few hundred feet and there are structures between them. There seems to be a degree of wishful thinking at work here. If both tanks were damaged, the challenges in keeping the cores cool would be far greater.

Also, to deal with prolonged station blackouts—when both offsite and onsite back-up power is lost—the Turkey Point plan assumes that offsite assistance would be available after five days. The nuclear industry has set up two “National SAFER Response Centers,” one in Memphis, Tennessee and the other in Phoenix, Arizona. Each one contains additional emergency equipment and supplies to supplement those that each reactor owner is required to have on site. The NRC requires that every plant in the country have an agreement with one of the SAFER centers to provide equipment and assistance should it be needed.

But the functioning of this system depends on the ability of the SAFER centers to deliver the equipment in a timely manner, which might not be possible if there were a widespread and prolonged natural disaster.

Turkey Point’s plan requires that deliveries from the Memphis SAFER center be shipped to Miami International Airport and then hauled (if the roads are clear) to the site or to the Homestead Air Reserve Base and taken to the site via helicopter. But it doesn’t take too great a stretch of the imagination, given the potential impact of a massive storm like Irma, to see where this plan could go badly wrong. And looking at the current track of the storm, the Memphis SAFER center itself could well be in its path, causing problems at the shipping end as well as the receiving end.

Even if the Turkey Point plan were effective, it is not clear how much of it has been put into place on the ground yet. At the end of June, the plant reported to the NRC that it needed to make ten modifications to address the risk of storm surges that could exceed the flood level that the plant was originally designed to withstand.

But it isn’t clear how many of those modifications have been completed yet. And the NRC’s first inspection of the post-Fukushima measures at Turkey Point is not even scheduled until March 2018. So at this time all the public has to rely on is an assumption that FP&L has implemented the plan completely and correctly.

With one assumption piled upon another, it is very hard for observers to assess how prepared Turkey Point really is to deal with superstorms. Hopefully, the plant will pass the Irma test, but the NRC will need to reevaluate whether its new requirements can adequately address the potential for more severe storms in the future.

Strategic missile defense failures: who’s to blame?

In Wednesday’s Washington Post, columnist Marc Thiessen blames Democrats’ historic skepticism about missile defense for the poor state of these systems today, but that’s a misrepresentation of its history.

What is the poor state of the Ground-based Midcourse System (GMD) due to?

In our 2016 report, we looked back at the history of the development of the GMD system since its origins in 2002.

The Bush administration exempted the missile defense development program from the normal oversight and accountability processes required of other major military systems, with the goal of quickly fielding the GMD system. These exemptions allowed the Pentagon to cut engineering cycles short and to field poorly tested equipment; the haste with which the system was fielded ensured this would be the case.

Today this poorly tested equipment makes up key parts of the fielded GMD system. Nearly all of the GMD interceptors—the core of the GMD system’s defensive capability today—were fielded before their design had been successfully intercept-tested even once.

This flawed approach—not a lack of money– is responsible for most of the problems with the system. The GMD system’s test record has been notably poor, with just nine successful intercepts out of 18 tries, despite the fact that the tests are heavily scripted for success. Identifying the cause of these failures and fixing the already-fielded interceptors has cost considerable time and money. The GMD system continues to have major schedule and cost overruns.

Yet, it is not just the execution of the program that has been problematic, it is the approach to the task of hitting a missile with a missile. A scathing 2012 National Academy of Sciences study called the GMD system “deficient” with respect to all of the study’s fundamental principles for a cost-effective missile defense, and recommended a complete overhaul of the interceptors, sensors, and concept of operations.

Insufficient oversight has not only exacerbated the GMD system’s problems, but has obscured their full extent. Obama administration attempts to improve oversight and accountability without bringing missile defense under the normal processes have led to ongoing problems. These include projects that have been started without sufficient vetting and later canceled, and components that are being fielded based on imposed deadlines rather than technical maturity—in some cases with known flaws.

Build more or fix the system?

Is following the Bush plan the right idea? The full complement of 44 interceptors envisioned by the Bush plan will be fielded by the end of this year. Yet Pentagon testing officials assess that the GMD system has not yet demonstrated an operationally useful capability.

The Missile Defense Agency’s (MDA) decision to build and field additional untested interceptors rather than systematically fix all known flaws also ignores specific advice on how best to balance a sense of urgency with the responsibility to build a cost-effective and high-quality system. A top-level recommendation of the 2008 “Welch report” (produced by a panel headed by retired Air Force Chief of Staff General Larry Welch) on missile defense concerned this balance:

For mid-course intercept systems, the balance between qualitative improvements and deploying more of existing capabilities should be strongly in favor of qualitative improvements. Without such a focus, the current system capabilities will become obsolete regardless of the numbers of interceptors deployed.

For the GMD system, however, the balance has been strongly in favor of building more of the existing capabilities, presumably to provide reassurance domestically and to allies. Rushing minimally tested hardware into the field may give the appearance of a defense, but it does not reliably protect US cities.

Did the US abandon promising programs prematurely?

Thiessen suggests that missile defense programs have been abandoned prematurely. In reality, this was the overdue discarding of wasteful, unworkable programs.

Regarding the three programs Thiessen mentions: Airborne Laser, the Kinetic Energy Interceptor, the Multiple Kill Vehicle, Secretary of Defense Robert Gates strongly criticized these (and their supporters) in the New York Times in 2009:

I have found since taking this post that when it comes to missile defense, some hold a view bordering on theology that regards any change of plans or any cancellation of a program as abandonment or even breaking faith. I encountered this in the debate over the Defense Department’s budget for the fiscal year 2010 when I ended three programs: the airborne laser, the multiple-kill vehicle, and the kinetic energy interceptor. All were plainly unworkable, prohibitively expensive and could never be practically deployed—but had nonetheless acquired a devoted following.

In fact, Congress contributes to going down the rabbit hole of wasteful programs in two ways. First, Congress is not providing strict enough oversight of Pentagon proposals, being neither skeptical enough nor requiring robust analyses of alternatives up front, with in-depth analysis of feasibility, costs, and risks.

Second, the weakened oversight system and the politicized nature of missile defense leave strategic missile defense vulnerable to missile defense advocates in Congress adding their own unnecessary or unvetted projects to the missile defense budget. Indeed, several times Congress has generated new and unasked-for efforts, such as a proposal for a third continental interceptor site on the US East Coast. Despite having no validated requirement for such a site, and in spite of testimony from the MDA director that other priorities for improving strategic missile defense are more pressing, congressional advocates of an East Coast site have included mandates in budget legislation intended to fast-track the process for building a third site and have added unasked-for money to the budget for it each year since 2012.

Congress has also pressed for a return to discarded ideas, such as the Bush plan for land-based Ground Based Interceptors in Eastern Europe and space-based boost-phase interceptors. Congress added money to the fiscal year 2016 budget to study the feasibility of a space-based boost-phase missile defense layer—despite having several years ago received the advice it solicited from the National Academy of Sciences on this very question. The NAS recommendation on space-based boost phase missile defense, which it estimated would cost at least $300 billion for a limited capability, was unequivocal:

The total life-cycle cost of placing and sustaining the [space-based boost-phase] constellation in orbit is at least an order of magnitude greater than that of any other alternative and impractical for that reason alone.

Pages