UCS Blog - All Things Nuclear (Nuclear Power Safety)

Why NRC Nuclear Safety Inspections are Necessary: Vogtle

This is the third in a series of commentaries about the vital role nuclear safety inspections conducted by the Nuclear Regulatory Commission (NRC) play in protecting the public. This commentary describes how NRC inspectors discovered inadequate flooding protection at the Vogtle nuclear plant near Waynesboro, Georgia despite a prior warning notice.

The first commentary described how NRC inspectors discovered that limits on the maximum allowable control room air temperature at the Columbia Generating Station in Washington had been improperly relaxed by the plant’s owner. The second commentary described how NRC inspectors uncovered an improper safety assessment of a leaking cooling water system pipe on the Unit 3 reactor at Indian Point outside New York City.

Turning Back the Clock

Last century, the NRC issued a warning to nuclear plant owners about the possible submergence of electrical cables located above the estimated flood levels. The NRC’s warning informed owners about a March 20, 1989, event in which the Clinton nuclear plant in Illinois inadvertently drained water into the drywell flooding it to a depth of four inches. Workers discovered that water got into electrical junction boxes located more than four inches above the drywell floor.

Electrical junction boxes house connections of electrical cables. Figure 1 shows water pouring from an electrical junction box at the Fort Calhoun nuclear plant in Nebraska during a flood in June 2011.

Fig. 1 (Source: Nuclear Regulatory Commission)

The NRC’s 1989 warning pointed out that moisture could get into electrical junction boxes various ways—from condensation of steam released from a broken pipe, actuation of overhead fire sprinklers, etc. If the junction boxes lack drain holes, water could accumulate within the boxes to submerge and disable electrical cables.

Workers at Vogtle reviewed the NRC’s warning and determined it was applicable to their plant. A work order was written to require that all electrical junction boxes containing safety-related cables had drain holes.

Stopping the Clock

The work order was closed out on January 25, 1990. Typically, closing out a work order written to correct a safety problem means that work to solve the problem has been completed. But not this time.

Setting off the Clock Alarm

In late 2017, NRC inspectors examined junction box 2BTJB0486 at Vogtle. They observed that the junction box lacked a drain hole and later determined that the cables and connections inside the box were not qualified for submergence in water. The NRC issued a Green finding for the failure to properly protect electrical equipment from the environmental conditions it could experience.

UCS Perspective

The NRC’s inspectors did not examine every junction box at Vogtle. The NRC conducts audits of a few items to gain insights about the condition of the broader universe of items. During this inspection, the NRC examined a whopping total of seven components, only one being a junction box. So, the NRC looked at one junction box and found it deficient. What does that say about the rest of the junction boxes at Vogtle?

Nothing. Maybe other boxes have holes. Maybe they don’t. Maybe is maybe adequate protection of public health and safety. Maybe not.

Workers at Vogtle wrote a work order to check on other junction boxes. In other words, they repeated the same step taken following the NRC’s 1989 warning to respond to the NRC’s 2018 finding that the 1989 response was woefully deficient.

The bad news is that the electrical junction box at Vogtle did not have even a tiny hole in it.

The worse news is that the corrective action program at Vogtle has a big hole in it.

NRC’s Project Aim: Off-target?

A handful of years ago, there was talk about nearly three dozen new reactors being ordered and built in the United States. During oversight hearings, Members of Congress queried the Members of the Nuclear Regulatory Commission on efforts underway and planned to ensure the agency would be ready to handle this anticipated flood of new reactor applications without impeding progress. Those efforts included creating the Office of New Reactors and hiring new staffers to review the applications and inspect the reactors under construction.

Receding Tide

The anticipated three dozen applications for new reactors morphed into four actual applications, two of which have since been cancelled. The tsunami of new reactor applications turned out to be a little ripple, at best.

The tide also turned for the existing fleet of reactors. Unfavorable economics led to the closures of several reactors and the announced closures of several other reactors in the near future.

The majority of the NRC’s annual budget is funded through fees collected from its licensees. For example, in fiscal year 2017 the owner of an operating reactor paid $4,308,000 for the NRC’s basic oversight efforts. For extra NRC attention (such as supplemental inspections when reactor performance dropped below par and for reviews of license renewal applications), the NRC charged $263 per hour.

Still, the lack of upsizing from new reactors and abundance of downsizing from existing reactors meant that NRC would have fewer licensees from whom to collect funds.

Enter Project Aim

The NRC launched Project AIM in June 2014 with the intention of “right-sizing” the agency while retaining the skill sets necessary to perform its vital mission. Project Aim identified 150 items that could be eliminated or performed more cost-effectively. Collectively, these measures were estimated to save over $40 million.

Fig. 1 (Source: Nuclear Regulatory Commission)

Project Aim Targets

Item 59 was among the highest cost-saving measures identified by Project Aim. It terminated research activities on risk assessments of fire hazards for an estimated savings of $935,000. The NRC adopted risk-informed fire protection regulations in 2004 to complement the fire protection regulations adopted by the NRC in 1980 in response to the disastrous fire at the Browns Ferry Nuclear Plant in Alabama. The fire research supported risk assessment improvements to better manage the fire hazards—or would have done so had it not been stopped.

Item 61 was also a high dollar cost-saving measure. It eliminated the development of new methods, models and tools needed to incorporate digital instrumentation and control (I&C) systems into probabilistic risk assessments (PRAs) with an estimated savings of $735,000. Nuclear power reactors were originally equipped with analog I&C systems (which significantly lessened the impact of the Y2K rollover problem). As analog I&C systems become more obsolete, plant owners are replacing them with new-fangled digital I&C systems. Digital I&C systems fail in different ways and at different rates than analog I&C systems and the research was intended to enable the PRAs to better model the emerging reality.

Item 62 eliminated development of methods, models, tools, and data needed to evaluate the transport of radioactive materials released during severe accidents into aquatic environments. For example, the 2011 severe accident at Fukushima involved radioactive releases to the Pacific Ocean via means not clearly understood. This cost-saving measure seems to preserve that secret.

Fig. 2 (Source: Nuclear Regulatory Commission)

Project Aim Off Target?

The need to reduce costs is genuine. Where oh where could savings of $935,000 come if not from killing the fire research efforts? Perhaps the Office of Management and Budget (OMB) has the answer. On May 11, 2012, OMB issued Memorandum M-12-12 that capped the amount federal agencies spent on conferences at $500,000. This OMB action pre-dated Project Aim, but seems consistent with the project’s fiscal responsibility objectives.

But the NRC opts not to abide by the OMB directive. Instead, the NRC Chairman signs a waiver allowing the NRC to spend far more than the OMB limit on its annual Regulatory Information Conferences (RICs). How much does the RIC cost? In 2017, the RIC cost the NRC $932,315.39—nearly double the OMB limit and almost exactly equal to the amount fire research would have cost.

987 persons outside the NRC attended the RIC in 2017. So, the NRC spent roughly $944.60 per outsider at the RIC last year. But don’t fixate on that amount. Whether the NRC had spent $1,000,000 per person or $1 per person, the RIC did not make a single American safer or more secure. (It also did not make married Americans safer or more secure, either.)

Eliminating the RIC would save the NRC nearly a million dollars each year. That savings could fund the fire research this year, which really does make single and married Americans safer. And next year savings could fund the development of digital I&C risk assessment methods to better manage the deployment of these systems throughout the nuclear fleet. And the savings the following year could fund research into transport of radioactive materials during severe accidents.

Fig. 3 (Source: Nuclear Regulatory Commission)

If the cliché “knowledge is power” holds any weight, then stopping fire research, development of digital I&C risk assessment methods, and many other activities leaves the NRC powerless to properly manage the associated risks.

RIC and risk? Nope, non-RIC and lower risk.

Clinton Power Station: Déjà vu Transformer Problems

The Clinton Power Station located 23 miles southeast of Bloomington, Illinois has one General Electric boiling water reactor with a Mark III containment that began operating in 1987.

On December 8, 2013, an electrical fault on a power transformer stopped the flow of electricity to some equipment with the reactor operating near full power. The de-energized equipment caused conditions within the plant to degrade. A few minutes later, the control room operators manually scrammed the reactor per procedures in response to the deteriorating conditions. The NRC dispatched a special inspection team to investigate the cause and its corrective actions.

On December 9, 2017, an electrical fault on a power transformer stopped the flow of electricity to some equipment with the reactor operating near full power. The de-energized equipment caused conditions within the plant to degrade. A few minutes later, the control room operators manually scrammed the reactor per procedures in response to the deteriorating conditions. The NRC dispatched a special inspection team to investigate the cause and its corrective actions. The NRC’s special inspection team issued its report on January 29, 2018.

Same reactor. Same month. Nearly the same day. Same transformer. Same problem. Same outcome. Same NRC response.

Coincidence? Nope. When one does nothing to solve a problem, one invites the problem back. And problems accept the invitations too often.

Setting the Stage(s)

The Clinton reactor was operating near full power on December 8, 2013, and on December 9, 2017. The electricity produced by the main generator (red circle labeled MAIN GEN in Figure 1) at 22 kilovolts (KV) flowed through the main transformers that upped the voltage to 345 KV (345,000 volts) for the transmission lines emanating from the switchyard to carry to residential and industrial customers. Some of the electricity also flowed through the Unit Auxiliary Transformers 1A and 1B that reduced the voltage to 6.9 and 4.16 KV (4,160 volts) for use by plant equipment.

The emergency equipment installed at Clinton to mitigate accidents is subdivided into three divisions. The emergency equipment was in standby mode before things happened. The Division 1 emergency equipment is supplied electrical power from 4,160-volt bus 1A1 (shown in red in Figure 1). This safety bus can be powered from the main generator when the unit is online, from the offsite power grid when the unit is offline, or from emergency diesel generator 1A (shown in green) if none of the other supplies is available. The Divisions 2 and 3 emergency equipment is similarly supplied power from 4,160-volt buses 1B1 and 1C1 respectively, each with three sources of power.

Fig.1 (Source: Clinton Individual Plant Examination Report (1992))

The three buses also provided power to transformers that reduced the voltage down to 480 volts for distribution via the 480-volt buses. For example, 4,160-volt bus 1A1 supplied 480-volt buses A and 1A.

Stage Struck (Twice)

On December 8, 2013, and again on December 9, 2017, an electrical fault on one of the 480-volt auxiliary transformers caused the supply breaker (shown in purple in Figure 2) from 4,160-volt bus 1A1 to open per design. This breaker is normally manually opened and closed by workers to control in-plant power distribution. But this breaker will automatically open to prevent an electrical transient from rippling through the lines to corrupt other equipment.

When the breaker opened, the flow of electricity to 480-volt buses A and 1A stopped, as did the supply of electricity from these 480-volt buses to emergency equipment. It didn’t matter whether electricity from the offsite power grid, the main generator, or emergency diesel generator 1A was supplied to 4,160-volt bus 1A1; no electricity flowed to the 480-volt buses with this electrical breaker open.

Fig. 2 (Source: Clinton Individual Plant Examination Report (1992))

The loss of 480-volt buses A and 1A interrupted the flow of electricity to emergency equipment but did not affect power to non-safety equipment. Consequently, the reactor continued operating near full power.

The emergency equipment powered from 480-volt buses A and 1A included the containment isolation valve on the pipe supplying compressed air to equipment inside the containment building. This valve is designed to fail-safe in the closed position; thus, in response to the loss of power, it closed.

Among the equipment inside containment needing compressed air were the hydraulic control units for the control rod drive (CRD) system (shown in orange in Figure 3). The control rods are positioned using water pistons. Supply water to one side of the piston while venting water from the other side creates a differential pressure causing the control rod to move. Reversing the sides that get water and get vented causes the control rod to move in the opposite direction. Compressed air keeps two scram valves for each control rod closed against coiled springs. Without the compressed air pressure, the springs force the scram valves to open. When the scram valves open, high pressure water is supplied below the pistons while water from above the pistons is vented. As a result, the control rods fully insert into the reactor core within a handful of seconds to stop the nuclear chain reaction.

Fig. 3 (Source: Nuclear Regulatory Commission)

Ten minutes after the electrical breaker opened on December 8, 2013, an alarm in the control room sounded to alert the operators about low pressure in the compressed air system. The operators followed procedures and responded to the alarm by manually scramming the reactor.

Four minutes after the electrical breaker opened on December 9, 2017, an alarm in the control room sounded to alert the operators about low pressure in the compressed air system. Two minutes later, other alarms sounded to inform the operators that some of the control rods were moving into the reactor core. They manually scrammed the reactor. (The timing difference between the two events is explained by the amounts of air leaking from piping inside containment and by the operation of pneumatically controlled components inside containment that depleted air from the isolated piping.)

The event had additional complications. The loss of power disabled: (1) the low pressure core spray system, (2) one of the two residual heat removal trains, the reactor core isolation cooling system, and the normal ventilation system for the fuel handling building (the structure on the left side of Figure 3). These losses were to be expected – subdividing the emergency equipment into three divisions and then losing all the power to that division de-energizes about one-third of the emergency equipment.

Fortunately, the loss of some emergency equipment in this case was tolerable because there was no emergency for the equipment to mitigate. The operators used non-safety equipment powered from the offsite grid and some of the emergency equipment from Divisions 2 and 3 to safely shut down the reactor. The operators anticipated that the loss of compressed air to equipment inside containment would eventually cause the main steam isolation valves to close, taking away the normal means of removing decay heat from the reactor core. The operators opened other valves before the main steam isolation valves close to provide an alternate means of sustaining this heat removal path. About 30 hours after the event began, the operators placed the reactor into a cold shut down mode, within the time frame established by the plant’s safety studies.

Staging a Repeat Performance

Workers replaced the failed Division 1 transformer following the December 2013 event. Clinton has five safety-related and 24 non-safety-related 4,160-volt to 480-volt transformers, including the one that failed in 2013. Following the 2013 failure, a plan was developed to install windows in the transformer cabinets to allow the temperature of the windings inside to be monitored using infrared detectors. Rising temperatures would indicate winding degradation which could lead to failure of the transformer.

But the planned installation of the infrared detection systems was canceled because the transformers were already equipped with thermocouples that could be used to detect degradation. Then the owner stopped monitoring the transformer thermocouples in 2015.

Plan B (or C?) involved developing a procedure for Doble testing of these 29 transformers that would trend performance and detect degradation. The Doble testing was identified in October 2016 as a Corrective Action to Prevent Recurrence (CAPR) from the 2013 transformer failure event. The Doble testing procedure was issued on November 18, 2016.

Clinton was shut down on May 8, 2017, for a refueling outage. The activities scheduled during the refueling outage included performing the Doble testing on the Division 2 4,160-volt to 480-volt transformers. But that work was canceled because it was estimated to extend the length of the refueling outage by three whole days. So, Clinton restarted on May 29, 2017, without the Doble testing being conducted. As noted by the NRC special inspection team dispatched to Clinton following the repeat event in 2017: “…the inspectors determined that revising the model work orders [i.e., the Doble test procedure] alone was not a CAPR. In order for the CAPR to be considered implemented, the licensee needed to complete actual Doble testing of the transformers.”

The NRC’s special inspection team also identified a glitch with how some of the non-safety-related transformers were handled within the preventative maintenance program. A company procedure required components whose failure would result in a reactor scram to be included in the preventative maintenance program to lessen the likelihood of failures (and more importantly, costly scrams). In response to NRC’s questions, workers stated that three of the non-safety-related transformers could fail and cause a reactor scram, but that these transformers were not covered by the preventative maintenance program.

Plan C (or D?) now calls for replacing all five safety-related transformers: the two Division 2 transformers in 2018 and the single Division 3 transformer in 2021. The two Division 1 transformers have already been replaced following their failures. A decision whether to replace the 24 non-safety-related transformers awaits a determination about seeking a 20-year extension to the reactor’s operating license.

NRC Sanctions

The NRC’s special inspection team identified two findings both characterized as Green in the agency’s green, white, yellow and red classification system.

One finding was the violation of 10 CFR Part 50, Appendix B, Criterion XVI, “Corrective Actions,” for failing to implement measures to preclude repetition of a significant condition adverse to quality. Specifically, the fixes identified by the owner following the December 2013 transformer failure were not implemented, enabling the December 2017 transformer to fail.

The other finding was the failure to follow procedures for placing equipment within the preventative maintenance program. Per procedure, three of the non-safety-related transformers should have been covered by the preventative maintenance program but were not.

UCS Perspective

Glass half-full: Clinton started operating in 1987 and didn’t experience a 4,160-volt to 480-volt transformer failure until late 2013. Apparently, transformer failures are exceedingly rare events such that lightning won’t strike twice.

Glass half-empty: All the aging transformers at Clinton were over 25 years old and heading towards, if not already in, the wear out region of the bathtub curve. Lightning may not strike twice, but an aging jackhammer strikes lots of times (until it breaks).

Could another untested, unreplaced aging transformer fail at Clinton? You bet your glass.

Fig. 4 (Source: Nuclear Regulatory Commission)

Benny Hill Explains the NRC Approach to Nuclear Safety

The Nuclear Regulatory Commission’s safety regulations require that nuclear reactors be designed to protect the public from postulated accidents, such as the rupture of pipes that would limit the flow of cooling water to the reactor. These regulations include General Design Criteria 34 and 35 in Appendix A to 10 CFR Part 50.

Emergency diesel generators (EDGs) are important safety systems since they provide electricity to emergency equipment if outside power is cut off to the plant—another postulated accident. This electricity, for example, would allow pumps to continue to send cooling water to the reactor vessel to prevent overheating damage to the core. So the NRC has requirements that limit how long a reactor can continue operating without one of its two EDGs under different conditions. The shortest period is 3 days while the longest period is 14 days.

An All Things Nuclear commentary in July 2017 described how the NRC allowed the Unit 3 reactor at the Palo Verde nuclear plant in Arizona to operate for up to 62 days with one of its EDGs broken, but had denied the Unit 1 reactor at the DC Cook nuclear plant in Michigan permission to operate for up to 65 days with one of its two EDGs broken. It was easy to understand why the NRC denied the request for DC Cook Unit 1 (i.e., 65 days is more than the 14-day safety limit). It was not easy to understand why the NRC granted the request for Palo Verde Unit 3 (i.e., 62 days is also more than the 14-day safety limit).

The NRC also granted a request on November 26, 2017, for the Unit 1 and 2 reactors at the Brunswick nuclear plant in North Carolina to operate for up to 30 days with one EDG broken.

NRC Inspection Findings and Sanctions 2001-2016

UCS examined times between 2001 and 2016 when NRC inspectors identified violations of federal safety regulations and the sanctions imposed by the agency for these safety violations. The purpose of this exercise was to understand the NRC’s position on EDGs and the safety implications of an EDG being inoperable.

As shown in Figure 1, NRC inspectors recorded 12,610 findings over this 16-year period, an average of 788 findings each year. The NRC characterized the safety significance of its findings using a green, white, yellow and red color-code with green representing findings having low safety significance and red assigned to findings with high safety significance. The NRC determined that fewer than 2% of its findings (242 in all) warranted a white, yellow, or red finding (“greater-than-green”).

Fig. 1 (Source: Union of Concerned Scientists)

NRC Greater-than-Green Inspection Findings and Sanctions 2001-2016

UCS reviewed ALL the greater-than-green findings issued by the NRC between 2001 and 2016 to determine what safety problems most concerned the agency over those years. Figure 2 shows the greater-than-green findings issued by the NRC binned by the applicable safety system or process. Emergency planning violations accounted for 22% of the greater-than-green findings over this period—the greatest single category. Other categories are shown in increasing percentages clockwise around the pie chart.

The 32 EDG greater-than-green findings between 2001 and 2016 constituted the second highest tally of such findings over this 16-year period—an average of two greater-than-green EDG findings per year. The NRC issued one Yellow and 31 White findings for EDG violations.

Fig. 2 (Source: Union of Concerned Scientists)

NRC Greater-than-Green EDG Inspection Findings and Sanctions 2001-2016

UCS reviewed all enforcement letters issued by the NRC for all 32 EDG greater-than-green findings to determine what parameters—particularly the length of time the EDG was unavailable—factored into the NRC concluding the findings had elevated safety implications. Several of the greater-than-green findings issued by the NRC involved EDGs being unavailable for less than the 62 days that the NRC permitted Palo Verde Unit 3 to continue operating with an EDG broken. For example:

  • The NRC issued a Yellow finding on August 3. 2007, because Kewuanee (WI) operated for 50 days with one EDG impaired by a fuel oil leak.
  • The NRC issued a White finding on September 19, 2013, because HB Robinson (SC) operated for 36 days with inadequate engine cooling for an EDG.
  • The NRC issued a White finding on June 2, 2004, because Brunswick (NC) operated for 30 days with an impaired jacket water cooling system for one EDG.
  • The NRC issued a White finding on April 15, 2005, because Fort Calhoun (NE) operated for 29 days for approximately 29 days with an inoperable EDG.
  • The NRC issued a White finding on December 7, 2010, because HB Robinson (SC) operated for 26 days with an impaired output breaker on one EDG.
  • The NRC issued a White finding on March 28, 2014, because Waterford (LA) operated for 25 days with inadequate ventilation for one EDG.
  • The NRC issued a White finding on December 18, 2013, because Duane Arnold (IA) operated for 22 days with inadequate lubricating oil cooling for one EDG.
  • The NRC issued a White finding on February 29, 2008, because Comanche Peak (TX) operated for 20 days with one EDG inoperable.
  • The NRC issued a White finding on December 7, 2007, because Fort Calhoun (NE) operated for 14 days with one EDG inoperable.
  • The NRC issued a White finding on April 20, 2007, because Brunswick (NC) operated for 9 days with an impaired lubricating oil system for one EDG.
  • The NRC issued a White finding on August 17, 2007, because Cooper (NE) operated for 5 days with a defective circuit card in the control system for one EDG.

NRC’s Cognitive Dissonance

The NRC issued 32 greater-than-green findings between 2001 and 2016 because inoperable or impaired EDGs increased the chances that an accident could endanger the public and the environment. As the list above illustrates, many of the NRC’s findings involved EDGs being disabled for 29 days or less.

Yet in 2017, the NRC intentionally permitted Palo Verde and Brunswick to continue operating for up to 62 and 30 days respectively.

If operating a nuclear reactor for 5, 9, 14, 20, 22, 26, or 29 days with an impaired EDG constitutes a violation of federal safety regulations warranting a rare greater-than-green finding based on the associated elevated risk to public health and safety, how can operating a reactor for 30 or 62 days NOT expose the public to elevated, and undue, risk?

Benny Hill to the Rescue

Fig. 3 (Source: www.alchetron.com)

Benny Hill was a British comedian who hosted a long-running television show between 1969 and 1989. On one of his shows, Benny observed that: “The odds against there being a bomb on a plane are a million to one, and against two bombs a million times a million to one.” Hence, Benny suggested that to be protected against being blown out of the sky: “Next time you fly, cut the odds and take a bomb” with you.

NRC’s allowing Palo Verde and Brunswick to operate for over 29 days with a broken EDG essentially takes Benny’s advice to take a bomb on board an airplane. Deliberately taking a risk significantly reduces the random risk.

But Benny’s suggestion was intended as a joke, not as prudent (or even imprudent) public policy.

So, while I’ll posthumously (him, not me) thank Benny Hill for much amusing entertainment, I’ll thank the NRC not to follow his advice and to refrain from exposing more communities to undue, elevated risk from nuclear power reactors operating for extended periods with broken EDGs.

Like Bonnie Tyler, NRC is Holding Out for a HERO

In Nuclear Energy Activist Toolkit #47, I summarized the regulations and practices developed to handle emergencies at nuclear power plants. While that commentary primarily focused on the response at the stricken plant site, it did mention that nuclear workers are required to notify the Nuclear Regulatory Commission (NRC) promptly following any declaration of an emergency condition. The NRC staffs its Operations Center 24 hours a day, 365 days a year to receive and process emergency notifications.

In late September 2017, I was made aware that the NRC was not staffing its Operations Center with the number of qualified individuals as mandated by its procedures. Specifically, NRC Management Directive 8.2, “Incident Response Program,” dictates that the Operations Center be staffed with at least two individuals: one qualified as a Headquarters Operations Officer (HOO) and one qualified as a Headquarters Emergency Response Officer (HERO). The HOO is primarily responsible for responding to a nuclear plant emergency while the HERO provides administrative support such as interagency communications.

I learned that the NRC Operations Center was instead often being staffed with only one person qualified as a HOO and a second person tasked with a “life support” role. In other words, the “life support” person would summon help in case the HOO keeled over from a heart attack or spilt hot coffee on sensitive body parts.

Fig. 1 (Source: Joe Haupt Flickr photo)

I wrote to Bernard Stapleton, who heads the NRC’s incident response effort, on October 3, 2017, inquiring about the Operations Center staffing levels. The NRC’s response was both rapid and thorough.

A conference call was conducted on October 12, 2017, between me and Steve West, Acting Director of the NRC’s Office of Nuclear Security and Incident Response, and members of his staff, Bern Stapleton and Bo Pham. They informed me that it had been a challenge for the agency to staff the Operations Center in summer and fall 2017 with qualified HEROs due to several watch standers taking other positions within the NRC and a temporary hiring freeze imposed after the unanticipated termination of the construction of two new reactors at the Summer nuclear plant in South Carolina.

The former reason made sense as individuals with these skills seek promotions. The latter reason made sense as the NRC sought to find new positions for its staff members formerly assigned to the Summer project. The one-two punch of qualified persons leaving and the replacement pipeline being temporary shut off prevented the Operations Center from always being staffed with an individual HERO qualified. The Operations Center always had a HOO; it sometimes lacked a HERO.

They told me that two persons had recently been hired to fill the empty positions on the Operations Center staffing chart and those new hires would be undergoing training to achieve HERO qualifications. In addition, they told me about initiatives to qualify NRC staff outside of the Operations Center section to provide a larger cushion against future staffing challenges. The larger pool of qualified watch standers would have the collateral benefit of expanding the skill sets of individuals not assigned full-time to the Operations Center.

The NRC followed up on the conference call by sending me a letter dated November 16, 2017, documenting our conversation.

UCS Perspective

It would be better for everyone if the NRC had always been able to staff its Operations Center with individuals qualified as HOOs and HEROs. But the downside from problem-free conditions is the challenge in determining whether they are due more to luck than skill. How an organization responds to problems often provides more meaningful insights than a period of problem-free performance. On the other hand, an organization really, really good at responding to problems might reflect way too much experience having problems.

In this case, the NRC did not attempt to downplay or excuse the Operations Center staffing problems. Instead, they explained how the problems came about, what measures were being taken in the interim period, and what steps were planned to resolve the matter in the long term.

In other words, the NRC skillfully responded to the bad luck that had left the Operations Center short-handed for a while.