UCS Blog - All Things Nuclear (Nuclear Power Safety)

High Energy Arc Faults and the Nuclear Plant Fire Protection IOU

Last year, we posted a commentary and an update about a high energy arc fault (HEAF) event that occurred at the Turkey Point nuclear plant in Florida. The update included color photographs obtained from the Nuclear Regulatory Commission (NRC) via a Freedom of Information Act request showing the damage wrought by the explosion and ensuing fire. Neither the HEAF event or its extensive damage surprised the NRC—they had been researching this fire hazard for several years. While the NRC has long known about this fire hazard, its resolution remains unknown. Meanwhile, Americans are protected from this hazard by an IOU. The sooner this IOU is closed out, the better that Americans in jeopardy will be really and truly protected.

What is a HEAF?

The Nuclear Energy Agency (NEA), which has coordinated international HEAF research efforts for several years, defines HEAF this way: “An arc is a very intense abnormal discharge of electrons between two electrodes that are carrying an electrical current. Since arcing is not usually a desirable occurrence, it is described as an arcing fault.”

Nuclear power plants generate electricity and use electricity to power in-plant equipment. The electricity flows through cables or metal bars, called buses. An arc occurs when electricity jumps off the intended pathway to a nearby metal cabinet or tray.

Electricity is provided at different voltages or energy levels for different needs. Home and office receptacles provide 120-volt current. Nuclear power plants commonly have higher voltage electrical circuits carrying 480-volt, 4,160-volt, and 6,900-volt current for motors of different sizes. And while main generators at nuclear plants typically produced electricity at 22,000 volts, onsite transformers step up the voltage to 345,000 volts or higher for more efficient flow along the transmission lines of the offsite power grid.

How is the Risk from HEAF Events Managed?

Consistent with the overall defense-in-depth approach to nuclear safety, HEAF events are managed by measures intended to prevent their occurrence backed by additional measures intended to minimize consequences should they occur.

Preventative measures include restrictions on handling of electrical cables during installation. Limits on how much cables can be bent and twisted, and on forces applied when cables are pulled through wall penetrations seek to keep cable insulation intact as a barrier against arcs. Other preventative measures seek to limit the duration of the arc through detection of the fault and automatic opening of a breaker to stop the flow of electrical current through the cables (essentially turning the arc off).

Mitigative measures include establishing zones of influence (ZOI) around energized equipment that controls the amount of damage resulting from a HEAF event. Figure 1 illustrates this concept using an electrical cabinet as the example Electrical cabinets are metal boxes containing breakers, relays, and other electrical control devices. Current fire protection regulatory requirements impose a 3-foot ZOI around electrical cabinets and an 18-inch ZOI above them. Anything within the cabinet and associated ZOI is assumed to be damaged by the energy released during a HEAF event. Sufficient equipment must be located outside the affected cabinet and its ZOI to survive the event and adequately cool the reactor core to prevent meltdown.

Fig. 1 (Source: Nuclear Regulatory Commission)

Even with these preventative and mitigative measures, NEA recognized the hazard that HEAF events poses when it wrote in a May 2017 report: “The electrical disturbance initiating the HEAF often causes loss of essential electrical power and the physical damage and products of combustion provide significant challenges to the operators and fire brigade members handling the emergency. It is clear that HEAFs present one of the most risk significant and challenging fire scenarios that a [nuclear power plant] will face.”

What is the Problem with HEAF Risk Management?

Actual HEAF events have shown that the preventative and mitigative measures intended to manage the hazard have shortcomings and weaknesses. For example, arcs have sometimes remained energized far longer than assumed, enabling the errant electricity to wreak more havoc.

Additionally, HEAF events have damaged components far outside the assumed zones of influence, such as in the Turkey Point event from March 2017. In other words, the HEAF hazard is larger than its defenses.

How is the HEAF Risk Management Problem Being Resolved?

On March 11, 2011, an earthquake offshore of Japan and the tsunami it spawned led to the meltdown of three reactors at the Fukushima Daiichi nuclear plant. That earthquake also caused a HEAF event at the Onagawa nuclear plant in Japan. The ground motion from the earthquake prevented an electrical circuit breaker from opening to limit the duration of the arc. The HEAF event damaged equipment and started a fire (Fig. 2). Because the fire brigade could not enter the room due to heat and smoke, the fire blazed for seven hours until it had consumed all available fuel. As an NRC fire protection engineer commented in April 2018, “If Fukushima wasn’t occurring, this is probably what would have been in the news headlines.” Onogawa was bad. Fukushima was just worse.

Fig. 2 (Source: Nuclear Regulatory Commission)

Research initiated in Japan following the Onagawa HEAF event sought to define the factors affecting the severity of the events. Because the problem was not confined to nuclear power plants in Japan, other countries collaborated with the Japanese researchers in pursuit of a better understanding of, and better protection for, HEAF events.

The NRC participated in a series of 26 tests conducted between 2014 and 2016 using different types of electrical panels, bus bar materials, arc durations, electrical current voltages, and other factors. The results from the tests enabled the NRC to take two steps.

First, the NRC entered HEAF events into the agency’s generic issues program in August 2017. In a related second step, the NRC formally made the owners of all operating US nuclear power plants aware of this testing program and its results via an information notice also issued in August 2017. The NRC has additionally shared its HEAF information with plant owners during the past three Regulatory Information Conferences and several other public meetings and workshops.

The NRC plans a second series of tests to more fully define the conditions that contribute to the severity of HEAF events.

How Are HEAF Events Tested?

Test 23 during the Phase I program subjected a 480-volt electrical cabinet with aluminum bus material to an arc lasting 7.196 seconds. Figure 3 shows the electrical cabinet with its panel doors opened prior to the test. A pointer on the left side of the picture shows the location where the arc was intentionally caused.

Fig. 3 (Source: Nuclear Energy Agency)

To induce an arc for the test, a wire was wrapped around all three phases of the 480-volt alternating current connectors within one of the cabinet’s panels as shown in Figure 4. On the right edge of the picture is a handswitch used to connect or disconnect electrical power flowing into the cabinet via these buses to in-plant electrical loads.

Fig. 4 (Source: Nuclear Energy Agency)

Instrumentation racks and cameras were positioned around the cabinet being tested. The racks included instruments measuring the temperature and pressure radiating from the cabinet during the HEAF event. High-speed, high definition cameras recorded the progression of the event while infrared cameras captured its thermal signature. A ventilation hood positioned over the cabinet connected to a duct with an exhaust fan conducted smoke away from the area to help the cameras see what was happening. More importantly, the ventilation duct contained instruments measuring the heat energy and byproducts released during the event.

Fig. 5 (Source: Nuclear Regulatory Commission)

What Are the HEAF Test Results?

For a DVD containing reports on the HEAF testing conducted between 2014 and 2016 as well as videos from the 26 tests conducted during that period, send an email with your name and address to RES_DRA_FRBQnrc.gov. Much of the information in this commentary comes from materials on the DVD the NRC mailed me in response to my request.

Test 4 in the Phase I Program subjected a 480-volt electrical cabinet with aluminum bus material to an arc lasting only 0.009 seconds (i.e., 9 milliseconds). The short duration arc had minimal consequences, entirely missed if one blinks at the wrong time while watching the video. This HEAF event did not damage components within the electrical cabinet, yet alone any components outside the 3-foot zone of influence around it.

Test 3 in the Phase I Program subjected a 480-volt electrical cabinet with copper bus material to an arc lasting 8.138 seconds. The longer duration arc produced greater consequences than in Test 4. But the video shows that the consequences are largely confined to the cabinet and zone of influence.

Test 23 in the Phase I Program subjected a 480-volt electrical cabinet with aluminum bus material to an arc lasting 7.196 seconds. The voltage level and arc duration for Test 23 were essentially identical to that for Test 3, but the consequences were significantly different. Aluminum behaved differently than copper during the HEAF event, essentially fueling the explosion and ensuing fire. As a result, the damage within the cabinet, zone of influence, and even beyond the 3-foot zone of influence was much greater. For example, some of the instruments on the rack positioned just outside the 3-foot zone of influence were vaporized.

Until debris from the event obscured the lens of a camera positioned many feet outside the 3-foot zone of influence, a side view of the Test 23 HEAF event showed it was a bigger and badder event than the HEAF event in Test 3 and the HEAF event in Test 4.

Figure 6 shows the electrical cabinet with its panel doors open after Test 23. The cabinet clearly looks different from its pre-test appearance (see Figure 4). But this view does not tell the entire story.

Fig. 6 (Source: Nuclear Energy Agency)

Figure 7 shows the left side of the electrical cabinet after Test 23. The rear upper left corner of the cabinet is missing. It was burned and/or blown away by the HEAF event. The cabinet is made of metal, not wood, plastic, or ice. The missing cabinet corner is compelling testimony to the energy released during HEAF events.

Fig. 7 (Source: Nuclear Energy Agency

Tests 3, 4 and 23 all featured electrical cabinets supplied with 480-volt power.

Tests 4 and 23 each featured aluminum bus material. Test 4 had negligible consequences while Test 23 had significant consequences, attesting to the role played by arc duration. The arc lasted 0.009 seconds in Test 4 while it lasted 7.196 seconds in Test 23.

Tests 3 and 23 featured arcs lasting approximately 8 seconds. Test 23 caused substantially greater damage within the electrical cabinet and beyond the 3-foot zone of influence due to the presence of aluminum rather than copper materials.

How Vulnerable Are US Nuclear Plants to HEAF Events?

The Phase I series of tests revealed that HEAF events depend on the voltage level, the conducting material (i.e., copper, iron, or aluminum), and the arc duration. The higher the voltage, the greater the amount of aluminum, and the longer the arc duration, the greater the consequences from HEAF events.

The NRC received results in 2017 from an industry survey of US nuclear plants. The survey showed that the plants have electrical circuits with voltage levels of 480, 4160, 6900, and 22000 volts. The survey also showed that while some plants did not have electrical circuits with components plated with aluminum, many did.

As to arc durations, actual HEAF events at US plants have involved arc durations longer than the 8 seconds used in Tests 3 and 23. The May 2000 event at Diablo Canyon lasted 11 seconds. The March 2010 event at HB Robinson last 8 to 12 seconds. And the June 2011 event at Fort Calhoun last 42 seconds and likely would have lasted even longer had operators not intervened by manually opening an electrical breaker to end the event.

So, many US nuclear plants have all the ingredients necessary for really nasty HEAF events.

What Might the Fixes Entail?

The testing program results to date suggest a tiered approach to the HEAF event solution. Once the key factors (i.e., combinations of voltage levels, materials, and arc durations) are definitively established, they can be used to screen out configurations within the plant where a HEAF event cannot compromise safety margins. For example, a high voltage electrical cabinet with aluminum bus material and suspect arc duration limiters might need no remedies if it is located sufficiently far away from safety components that its HEAF vaporization carries only economic rather than safety implications. Similarly, configurations with voltage levels and materials that remain bound by the current assumptions like the 3-foot zone of influence would require no remedies.

When a configuration cannot be screened out, the remedy might vary. In some cases, it might involve providing more reliable, quick-acting fault detection and isolation systems that limit the duration of the arc. In other cases, replacing aluminum buses with copper or iron buses might be a suitable remedy. And the fix might be simply installing a protective wall between an electrical cabinet and safety equipment.

Further HEAF testing will expand knowledge of the problem, thus more fully informing the decisions about effective solutions.

UCS Perspective

It has been known for many years now that HEAF events could cause wider damage than currently assumed in designing and applying fire protection measures. As a result, a fire could damage primary safety systems and their backups—the very outcome the fire protection regulatory requirements are intended to prevent.

This is normally the time and spot where I chastise the NRC for dragging its feet in resolving this known safety hazard. But while years have passed since the HEAF hazard flag was first raised, the NRC’s feet have been busy. For while it was known that HEAF events could cause greater damage than previously realized, it was not known what factors played what roles in determining the severity of HEAF events and the damage they inflict. The NRC joined regulatory counterparts worldwide in efforts designed to fill in these information gaps. That knowledge was vitally needed to ensure that a real fix, rather than an ineffective band-aid fix, was applied.

That research took time to plan and conduct. And further research is needed to fully define the problem to find its proper solution. In the meantime, the NRC has been very forthcoming with plant owners and the public about its concerns and associated learnings to date.

While the NRC’s efforts to better understand HEAF events may be justified, it’s worth remembering that the agency’s intentions and plans are little more than IOUs to the millions of Americans living close to vulnerable nuclear plants. IOUs provide zero protection. The NRC needs to wrap up its studies ASAP and turn the IOUs into genuine protection.

Made in Chattanooga

What do the Arkansas Nuclear One Unit 2, Beaver Valley Unit 1, Beaver Valley Unit 2, Big Rock Point, Callaway, Calvert Cliffs Unit 1, Calvert Cliffs Unit 2, Catawba Unit 2, Comanche Peak Unit 1, Comanche Peak Unit 2, Connecticut Yankee, Cooper, Diablo Canyon Unit 1, Diablo Canyon Unit 2, Donald C. Cook Unit 1, Edwin I. Hatch Unit 1, Edwin I. Hatch Unit 2, Fort Calhoun, HB Robinson, Indian Point Unit 1, Indian Point Unit 2, Indian Point Unit 3, James A. FitzPatrick, Joseph M. Farley Unit 1, Joseph M. Farley Unit 2, Fermi Unit 2, Kewaunee, LaSalle Unit 1, Maine Yankee, Marble Hill, McGuire Unit 1, Millstone Unit 1, Millstone Unit 2, Millstone Unit 3, Nine Mile Point Unit 1, Oyster Creek, Palisades, Palo Verde Unit 1, Palo Verde Unit 2, Palo Verde Unit 3, Pilgrim, Point Beach Unit 2, Salem Unit 1, Salem Unit 2, San Onofre Unit 1, San Onofre Unit 2, San Onofre Unit 3, Seabrook, South Texas Project Unit 1, South Texas Project Unit 2, St. Lucie Unit 1, St. Lucie Unit 2, Vogtle Unit 1, Vogtle Unit 2, Waterford, and Wolf Creek nuclear power reactors have in common?

True, they are all mentioned in this same question. But the subject commonality has a broader dimension.

Also true, they are all located on planet earth. But the subject commonality has a narrower dimension.

Hint: Check out the title of this commentary.

Yes, the reactor vessels for all these nuclear plants, and many others worldwide, were manufactured by Combustion Engineering at their factory in Chattanooga, Tennessee.

Indeed, the Chattanooga factory made the vessels for boiling water reactors like FitzPatrick and Pilgrim, for Westinghouse pressurized water reactors like Diablo Canyon and Indian Point and for Combustion Engineering pressurized water reactors like Palo Verde and Waterford.

In the days before FedEx, how did reactor vessels made in the hills of east Tennessee get to so many locations coast to coast? The Tennessee River winds through Chattanooga and empties into the Mississippi River. Whenever possible, the reactor vessels were lifted onto barges in Chattanooga and floated to the plant sites. For example, the Unit 1 reactor vessel for the Nine Mile Point nuclear plant in Oswego, New York took the scenic route down the Tennessee River, up the Mississippi River, up the Illinois River, across four of the five Great Lakes.

Fig. 1 (Source: Daily Standard (October 7, 1966))

It took 29 days for Pilgrim’s reactor vessel to make the 3,587-mile journey down the Tennessee and Mississippi Rivers, across the Gulf of Mexico and along the Atlantic coast to Plymouth, Massachusetts. (The plant is scheduled to permanently shut down by June 2019. On behalf of my fellow citizens of Chattanooga, the current owner should check out the “No Return” provision in the contract.)

Fig. 2 (Source: UPI Telephoto published in News Journal (March 4, 1970))

The Unit 1 reactor vessel for the San Onofre Nuclear Generating Station in southern California began its 2,000-mile journey on a barge, was transferred onto a freighter for passage through the Panama Canal, was transferred back onto a barge, and then loaded onto a train car for delivery to the site.

Fig. 3 (Source: Daily Republican (April 23, 1965))

Not all the journeys were event-free. The Unit 3 reactor vessel for the Indian Point nuclear plant in Buchanan, New York was dropped on January 12, 1971, as it was being unloaded at the plant. Well, it was not actually dropped. It underwent an “unscheduled descent during its installation” at the plant. An overhead crane rated for 175-tons was being used to lift the 456-ton package of reactor vessel and shipping rig. Somehow, the motor for the 175-ton rated crane became overheated as it was lifting the 456-ton load. The 456-ton load had been raised from its original horizontal configuration to nearly the vertical (i.e., 90°) position when the lift was halted to let the overheated crane motor cool down. The 175-ton crane’s hoist failed, dropping the load—or letting the load make its unscheduled descent back to the horizontal position.

Fig. 4 (Source: Oak Ridge National Laboratory)

Scientists from Oak Ridge, representatives of Combustion Engineering in Chattanooga, and workers from Westinghouse huddled to determine whether the unscheduled descent of the reactor vessel resulted in its unscheduled dis-use. They reviewed results from magnetic particle and ultrasonic examinations and concluded the vessel could be used.

Scientists from the Oak Ridge National Laboratory traveled to Buchanan to view the Unit 3 reactor vessel. They heard contradictory accounts as to the position of the reactor vessel when it began its unscheduled descent. Some eyewitnesses said the vessel and rig were about three feet off the ground. Others insisted it was not off the ground at all. Similarly, the scientists received varying accounts of how long it took the vessel to complete its unscheduled decent. Some eyewitnesses reported the descent took 15 seconds. Others claimed the descent went on for nearly 60 seconds. The discrepancies might be attributed to the eyewitnesses making unscheduled departures from the vicinity.

UCS Perspective

UCS has staffed a remote office in Chattanooga for the past eight years. At the time, we knew the city was the location for the International Towing Museum, but did not realize that the city played such a prominent role in the development of nuclear power reactors in the United States. And as if making tow trucks and reactor vessels was not enough, but Moon Pies were invented in Chattanooga in 1917.

Chattanooga also has the offices for the Nuclear Division of the Tennessee Valley Authority (TVA), with TVA’s Sequoyah Nuclear Plant within sight of downtown. Chattanooga also has the Nuclear Regulatory Commission’s Technical Training Center as well as a Westinghouse training facility.

But Chattanooga no longer makes reactor vessels. Combustion Engineering scaled back manufacturing at the factory as demand for nuclear components dwindled in the U.S. and abroad. In 2007, the nearly idled manufacturing plant was acquired by French-based Alstom with intentions to make components to support the nuclear renaissance. The factory did not need a first shift, yet alone a second or third shift, to handle all the non-orders for reactor vessels and other nuclear plant parts. The factory closed shop in 2016.

But don’t despair. Chattanooga still makes Moon Pies and tow trucks.

NRC Cherry-Picking in the Post-Fukushima Era: A Case Study

In the late 1960s, the Atomic Energy Commission (AEC), the forerunner of the NRC, paid the very companies that designed nuclear reactors—Westinghouse and General Electric (GE)—to test the efficacy of their own emergency cooling systems.

In the event of an accident in which a reactor loses water, uncovering the fuel rods—called a “loss-of-coolant accident”—these systems inject water back into the reactor in an attempt to prevent a meltdown. The tests that Westinghouse and GE performed were named the Full Length Emergency Cooling Heat Transfer (FLECHT) tests. The FLECHT tests simulated fuel rods undergoing a loss-of-coolant accident. The tests were intended to be as realistic as possible: bundles of 12-foot-tall rods, simulating fuel rods, were electrically heated up to reactor-accident temperatures and then inundated with cooling water.

Several of the tests were geared toward assessing how well the outer casing of fuel rods, called “cladding,” would endure in accident conditions. The cladding of fuel rods is primarily zirconium, a silver-colored metal. After the injection of water in an accident, hot-zirconium cladding is intended to endure the thermal shock of swift re-submergence and cooling. The cladding must not be stressed to its failure point. It is crucial that the fuel cladding perform well in an accident because it is a barrier preventing the release of highly radioactive materials into the exterior environment.

Figure 1. Source: Westinghouse)

Robert Leyse, my father, a nuclear engineer employed by Westinghouse, conducted a number of the FLECHT tests. On December 11, 1970, one of those tests, designated as Run 9573, had unexpected results. In Run 9573, a section of the test bundle’s zirconium cladding essentially caught on fire. The cladding burned in steam—then, when cooled, shattered like overheated glass doused with cold water.

Mr. Leyse instructed a lab assistant to take photographs of the destroyed test bundle, one of which is displayed as Figure 1. In a report on the FLECHT tests that Mr. Leyse coauthored, Westinghouse referred to the severely burnt, shattered section as the “severe damage zone” and noted that “the remainder of the [test] bundle was in excellent condition.”

Westinghouse’s FLECHT data is nearly 50 years old yet it is still highly regarded. The AEC used some of the FLECHT data to establish regulations that remain in place to this day. Westinghouse’s report on the FLECHT tests states that data from the first 18 seconds of Run 9573—before the cladding caught fire—is valid.

Concern over the extent zirconium burns in reactor accidents

In 2009, I submitted a rulemaking petition (PRM-50-93), requesting new regulations intended to improve public and plant worker safety. PRM-50-93 contends industry and NRC computer safety models under-predict the extent zirconium fuel cladding burns in steam. In more technical terms, the petition alleges models under-predict the rates at which zirconium chemically reacts with steam in a reactor accident. I buttressed my claims by citing data from FLECHT Run 9573 and other experiments conducted with bundles of zirconium cladding.

The zirconium-steam reaction produces zirconium dioxide, hydrogen, and heat. In a serious accident, the rate of the zirconium-steam reaction increases as local cladding temperatures increase within the reactor core. As the reaction speeds up, more and more heat is generated; in turn, the additional heat increases the rate of the reaction, potentially leading to thermal runaway and a meltdown.

It is problematic that the zirconium-steam reaction generates hundreds of kilograms of explosive hydrogen gas in a meltdown. In the Fukushima Daiichi accident—in which three reactors melted down—hydrogen leaked out of reactors’ containments and detonated, blowing apart reactor buildings. The release of radioactive material prompted the evacuation of tens of thousands of people and rendered a large area of land uninhabitable.

A “high priority”

In 2010, the NRC said its technical analysis of my 2009 rulemaking petition (PRM-50-93) was a “high priority.” Then, in 2011, the agency issued a press release announcing it intended to “increase transparency” in its petition review process by releasing preliminary evaluations of PRM-50-93. The announcement said the final decision on the petition would “not be issued until after the NRC Commissioners…considered all staff recommendations and evaluations.”

As part of the preliminary technical analysis of PRM-50-93, the NRC staff conducted computer simulations of FLECHT Run 9573. They compared the results of their simulations to data Westinghouse reported. However, there is a major problem with the staff’s simulations. They did not simulate the section of the test bundle that ignited. (Or if they did simulate that section, they decided not to release their findings.)

By way of an analogy: what the NRC staff did would be like simulating a forest fire and omitting trees reduced to ash and only simulating those that had been singed. After doing such a bogus simulation one might try to argue that trees actually do not burn down in forest fires. The staff basically did just that. They used the results of their simulations to argue that models of the zirconium-steam reaction are not flawed—that reaction rates are not under-predicted.

On January 31, 2013, I gave a presentation to the five commissioners who were heading the NRC at the time. They invited me to present my views in a meeting addressing public participation in the NRC’s rulemaking process. They apparently wanted my insights, because, in 2007, I raised a safety issue in a rulemaking petition (PRM-50-84) that they decided to incorporate into one of their regulations. I had pointed out that computer safety models neglected to simulate a phenomenon affecting the performance of fuel rods in a loss-of-coolant accident.

In my presentation, I criticized the staff’s computer simulations of FLECHT Run 9573. I said: “You cannot do legitimate computer simulations of an experiment that [caught on fire] by not actually modeling the section of the test bundle that [caught on fire].” In the Q and A session, Commissioner William Magwood assured me that he and the other commissioners would instruct the staff “to follow up on” my comments, including my criticism of the staff’s simulations of Run 9573. Then, five weeks after the meeting, Annette Vietti-Cook, Secretary of the Commission, instructed the staff to “consider and respond” to my comments on its review of PRM-50-93.

I hoped the staff would promptly conduct and report on legitimate computer simulations of FLECHT Run 9573. Instead, in March 2013, the staff restated that their prior, incomplete simulations of Run 9573 over-predicted the extent that zirconium burns in steam, indicating computer safety models are beyond adequate.

In November 2015, after I made a series of additional complaints, with help from Dave Lochbaum of the Union of Concerned Scientists, Aby Mohseni, Deputy Director of the NRC’s Division of Policy and Rulemaking, disclosed results of computer simulations of FLECHT Run 9573 including the section of the test bundle that ignited. The simulations drastically under-predict temperatures Westinghouse reported for that section.

The NRC’s severe-damage-zone computer simulations of Run 9573

The NRC’s severe-damage-zone computer simulations predicted cladding and steam temperatures for the FLECHT Run 9573 test bundle, at the 7-foot elevation, at 18 seconds into the experiment. (The severe damage zone was approximately 16 inches long, centered at the 7-foot elevation of the 12-foot-tall test bundle.)

The highest cladding temperature the severe-damage-zone simulations of Run 9573 predicted is 2,350°F, at the 7-foot elevation, at 18 seconds. Westinghouse reported that at 18.2 seconds into Run 9573, cladding temperatures by the 7-foot elevation exceeded 2,500°F. Cladding temperatures by the 7-foot elevation were not directly measured by thermocouples (temperature-measuring devices); however, Westinghouse reported that electrical heaters installed in the cladding began to fail at 18.2 seconds, by the 7-foot elevation, after local cladding temperatures reached higher than 2,500°F. Hence, even considering the time difference of a 0.2 second, one can infer that the severe-damage-zone simulations of Run 9573 under-predicted the cladding temperature by a margin of more than 100°F (at the section of the test bundle that ignited).

(Note that there is a time difference of a 0.2 second between the time the NRC picked for its simulations of Run 9573 and the time that the electrical heaters began to fail in the experiment. In the staff’s incomplete simulations of Run 9573—reported in the staff’s preliminary evaluations of PRM-50-93—the highest predicted cladding temperature is 2,417.5°F, at the 6-foot elevation, at 18 seconds. And the highest predicted cladding temperature increase rate is 29°F per second, at the 6-foot elevation, at 18 seconds. From these predictions we can infer that—although the value has not been reported—the highest predicted cladding temperature increase rate would be approximately 29°F per second or less, at the 7-foot elevation, at 18 seconds.)

In Run 9573, at the 7-foot elevation, the heat generated by the zirconium-steam reaction radiated to the local environment, heating the steam in proximity. The highest steam temperature the NRC’s severe-damage-zone simulations of Run 9573 predicted is 2,055°F, at the 7-foot elevation, at 18 seconds. Westinghouse reported that at 16 seconds into Run 9573, a steam-probe thermocouple mounted at the 7-foot elevation directly recorded steam temperatures that exceeded 2,500°F. And a Westinghouse memorandum (included as Appendix I of PRM-50-93) stated that after 12 seconds, the steam-probe thermocouple recorded “an extremely rapid rate of temperature rise (over 300°F/sec).” (Who knows how high the local steam temperatures actually were at 18 seconds; they were likely hundreds of degrees Fahrenheit higher than 2,500°F.) Hence, the severe-damage-zone simulations of Run 9573 under-predicted the steam temperature by a margin of more than 400°F (by the section of the test bundle that ignited).

The fact the NRC’s severe-damage-zone simulations under-predict cladding and steam temperatures that occurred in Run 9573 is powerful evidence indicating models under-predict the zirconium-steam reaction rates that occur in reactor accidents.

Qualifying power level increases for reactors

Since the 1970s, the NRC has approved more than 150 power level increases (termed “power uprates”) for reactors in the US fleet, enabling them to generate more and more electricity. An important part of qualifying a power uprate is to provide assurance with computer simulations that emergency systems would be able to prevent a meltdown if there were a loss-of-coolant accident at the proposed, higher power level.

A computer simulation is supposed to over-predict the severity of a potential nuclear accident. A margin of safety is established when a reactor’s power level is qualified by a “conservative” simulation—one that overcompensates. Meltdowns are less likely to occur if the reactor operates at a safe power level, providing a sufficient safety margin.

The extent zirconium burns at high temperatures has a major impact on the progression and outcome of a reactor accident. If zirconium-steam reaction rates are under-predicted by computer safety models, they will also under-predict the severity of potential reactor accidents. And, if power uprates have been qualified by models under-predicting the severity of potential accidents, it is likely power levels of reactors have been set too high and emergency cooling systems might not be able to prevent a meltdown in the event of a loss-of-coolant accident.

A petition review process of beyond eight years (with cherry-picking)

The NRC staff’s technical analysis of my 2009 rulemaking petition (PRM-50-93) was completed on March 18, 2016, but was not made publicly available until March 5, 2018, nearly two years later. The technical analysis signals an intention to deny PRM-50-93. It concludes with the statement: “Each of the petition’s key presumptions was investigated in detail. … The petition fails to provide any new information that supports a rule change. The NRC staff does not agree with the petition’s assertions, and concludes that revisions to [NRC regulations] or other related guidance are not necessary.”

Interestingly, a NRC staff e-mail, released in response to a Freedom of Information Act request, reveals that in August 2015—seven months before their technical analysis was completed—the staff already planned to deny PRM-50-93. At that time, the staff intended to announce their denial in August 2016.

The 2016 technical analysis of PRM-50-93 fails to discuss or even mention the results of the computer simulation of FLECHT Run 9573 that Mr. Mohseni disclosed in November 2015. Certain staff members appear intent on denying PRM-50-93 to the extent that they’re willing to make false statements and omit evidence lending support to the petition’s allegations. They appear determined to bury the fact their own computer simulation underpredicts, by a large margin, temperatures Westinghouse reported for the section of the Run 9573 test bundle that ignited.

The staff members who conducted the 2016 technical analysis of PRM-50-93 did not comply with the commissioners who directed them, in January 2013, to “consider and respond” to my criticisms of their simulation of Run 9573. The 2016 technical analysis has a section titled “Issues Raised at the Public Commission Meeting in January 2013;” however, that section fails to discuss the simulation results Mr. Mohseni disclosed in November 2015.

In April 2014, I submitted over 50 pages of comments alleging the staff’s preliminary evaluations of PRM-50-93 have numerous errors as well as misrepresentations of material I discussed to support my arguments. In my opinion, the 2016 technical analysis has the same shortcomings. I suspect that portions of the technical analysis have been conducted in bad faith. Perhaps certain staff members fear enacting the regulations I requested would force utilities to lower the power levels of reactors.

As a member of the public, who spent months writing PRM-50-93, I personally resent the way certain staff members disrespect science and efforts of the public to participate in the NRC’s rulemaking process. (The NRC gives lip service to encouraging public participation. Its website boasts that the agency is “committed to providing opportunities for the public to participate meaningfully in the NRC’s decision-making process.”) Even worse, much worse, their cynical actions undermine public safety.

In a written decision, D.C. Circuit appeals court judges said it was “nothing less than egregious” when a federal agency took longer than six years to review a rulemaking petition. The NRC has been reviewing PRM-50-93 for longer than eight years—procrastinating as well as cherry-picking.

UCS perspective

[What follows was written by Dave Lochbaum, Director of the Nuclear Safety Project at the Union of Concerned Scientists]

I (Dave Lochbaum) invited Mark Leyse to prepare this commentary. I more than monitored Mark’s efforts—I had several phone conversations with him about his research and its implications. I also reviewed and commented on several of his draft petitions and submissions.

Mark unselfishly devoted untold hours researching this safety issue and painstakingly crafting his petition. He did not express vague safety concerns in his petition. On the contrary, his concerns were described in excruciating detail with dozens of citations to source documents. (Reflective of that focused effort, Mark’s draft of this commentary contained 33 footnotes citing sources and page numbers, supporting his 2,300-plus words of text. I converted the footnotes to embedded links, losing chapter and verse in the process. Anyone wanting the specific page numbers can email me for them.)

Toward the end of his commentary, Mark expresses his personal resentment over the way the NRC handled his concerns. It is not my petition, but I also resent how the NRC handled, or mis-handled, Mark’s sincere safety concerns. He made very specific points that are solidly documented. The NRC refuted his concerns with vague, ill-supported claims. If Mark’s safety concerns are unfounded, the NRC must find a way to conclusively prove it. “Nuh-uh” is an unacceptable way to dismiss a nuclear safety concern.

In addition to handling Mark’s safety concerns shoddily from a technical standpoint, the NRC mistreated his concerns process-wise. Among other things, Mark asked the NRC staff to explain why it had not conducted a complete computer simulation of Westinghouse’s experiment, FLECHT Run 9573. The NRC refused to answer his questions, contending that its process did not allow it to release interim information to him. I protested to the NRC on Mark’s behalf, pointing out case after case where the NRC had routinely provided interim information about rulemaking petitions to plant owners. I asked why the NRC’s process treated members of the public one way and plant owners a completely different way. Their subterfuge exposed, the NRC “suddenly” found itself able to provide Mark with interim information, or at least selective portions of that information.

The NRC completed its technical analysis of Mark’s petition in March 2016 but withheld that information from him and the public for two years. The NRC would not withhold similar information from plant owners for two years. The NRC must play fair and stop being so cozy with the industry it sometimes regulates.

If how the NRC handled Mark’s petition is the agency at its best, we need a new agency. These antics are simply unacceptable.

The “Race” to Resolve the Boiling Water Reactor Safety Limit Problem

General Electric (GE) informed the Nuclear Regulatory Commission (NRC) in March 2005 that its computer analyses of a depressurization event for boiling water reactors (BWRs) non-conservatively assumed the transient would be terminated by the automatic trips of the main turbine and reactor on high water level in the reactor vessel. GE’s updated computer studies revealed that one of four BWR safety limits could be violated before another automatic response terminated the event.

Over the ensuring decade-plus, owners of 28 of the 34 BWRs operating in the US applied for and received the NRC’s permission to fix the problem. But it’s not clear why the NRC allowed this known safety problem, which could allow nuclear fuel to become damaged, to linger for so long or why the other six BWRs have yet to resolve the problem. UCS has asked the NRC’s Inspector General to look into why and how the NRC tolerated this safety problem affecting so many reactors for so long.

BWR Transient Analyses

The depressurization transient in question is the “pressure regulator fails open” (PRFO) event. For BWRs, the pressure regulator positions the bypass valves (BPV in Figure 1) and control valves (CV) for the main turbine as necessary to maintain a constant pressure at the turbine inlet.

When the reactor is shut down or operating at low power, the control valves are fully closed and the bypass valves are partially opened as necessary to maintain the specified pressure. When the turbine/generator is placed online, the bypass valves are closed and the control valves are partially opened to maintain the specified inlet pressure. As the operators increase the power level of the reactor and send more steam towards the turbine, the pressure regulator senses this change and opens the control valves wider to accept the higher steam flow and maintain the constant inlet pressure.

Fig. 1 (Source: Nuclear Regulatory Commission, annotated by UCS)

If the sensor monitoring turbine inlet pressure provides a false high value to the pressure regulator or an electronic circuit card within the regulator fails, the pressure regulator can send signals that fully open the bypass valves and the control valves. This is called a “pressure regulator fails open” (PRFO) event. The pressure inside the reactor vessel rapidly decreases as the opened bypass and control valves accept more steam flow. Similar to how the fluid inside a shaken bottle of soda rises to and out the top when the cap is removed (but for different physical reasons), the water level inside the BWR vessel rises as the pressure decreases.

The water level is normally about 10 feet above the top of the reactor core. When the water level rises about 2 feet above normal, sensors will automatically trip the main turbine. When the reactor power level is above about 30 percent of full power, the turbine trip will trigger the automatic shut down of the reactor. The control rods will fully insert into the reactor core within a handful of seconds to stop the nuclear chain reaction and terminate the PRFO event.

The Race to Automatic Reactor Shut Down

The reactor depressurization during a PRFO event above 30 percent power actually starts two races to automatically shut down the reactor. One race ends when high vessel level trips the turbine which in turn trips the reactor. The second race is when low pressure in the reactor vessel triggers the automatic closure of the main steam isolation valves (MSIV in Figure 1). As soon as sensors detect the MSIVs closing, the reactor is automatically shut down.

BWRs do not actually stage PRFO events to see what parameter wins the reactor shut down race. Instead, computer analyses are performed of postulated PRFO events. The computer codes initially used by GE had the turbine trip on high water level winning the race. GE’s latest code shows MSIV closure on low reactor vessel pressure winning the race.

The New Race Winner and the Old Race Loser

The computer analyses are performed for reasons other than picking the winner of the reactor shut down race. The analyses are performed to verify that regulatory requirements will be met. When the winner of the PRFO event reactor shut down race was correctly determined, the computer analyses showed that one of four BWR safety limits could be violated.

Figure 2 shows the four safety limits for typical BWRs. The safety limits are contained within the technical specifications issued by the NRC as appendices to reactor operating licenses. GE’s latest computer analyses of the PRFO event revealed that the reactor pressure could decrease below 785 pounds per square inch gauge (psig) before the reactor power level dropped below 25 percent—thus violating Safety Limit 2.1.1.1. The earlier computer analyses non-conservatively assumed that reactor shut down would be triggered by high water level, reducing reactor power level below 25 percent before the reactor pressure decreased below 785 psig.

Fig. 2 (Source: Nuclear Regulatory Commission)

Safety Limit 2.1.1.1 supports Safety Limit 2.1.1.2. Safety Limit 2.1.1.2 requires the Minimum Critical Power Ratio (MCPR) limit to be met whenever reactor pressure is above 785 psig and the flow rate trough the reactor core is above 10 percent of rated flow. The MCPR limit protects the fuel from being damaged by insufficient cooling during transients, including PRFO events. The MCPR limit keeps the power output from individual fuel bundles from exceeding the amount that can be carried away during transients.

As in picking reactor shut down race winners, BWRs do not slowly increase fuel bundle powers until damage begins, then back it down a smidgen or two. Computer analyses of transients also model fuel performance. The results from the computer analyses establish MCPR limits that guard against fuel damage during transients.

The computer analyses examine transients from a wide, but not infinite, range of operating conditions. Safety Limit 2.1.1.1 defines the boundaries for some of the transient analyses. Because Safety Limit 2.1.1.1 does not permit the reactor power level to exceed 25 percent when the reactor vessel pressure is less than 785 psig, the computer analyses performed to establish the MCPR limit in Safety Limit 2.1.1.2 do not include an analysis of a PRFO event for high power/low pressure conditions.

Thus, the problem reported by GE in March 2005 was not that a PRFO event could violate Safety Limit 2.1.1.1 and result in damaged fuel. Rather, the problem was that if Safety Limit 2.1.1.1 was violated, the MCPR limit established in Safety Limit 2.1.1.2 to protect against fuel damage could no longer be relied upon. Fuel damage may, or may not occur, as a result of a PRFO event. Maybe, maybe not is not prudent risk management.

The Race to Resolve the BWR Safety Limit Problem

The technical specifications allow up to two hours to remedy a MCPR limit violation; otherwise the reactor power level must be reduced to less than 25 percent within the next four hours. This short time frame implies that the race to resolve the BWR Safety Limit problem would be a dash rather than a marathon.

Fig. 3 (Source: Nuclear Regulatory Commission)

The nuclear industry submitted a request to the NRC on July 18, 2006, asking that the agency merely revise the bases for the BWR technical specifications to allow safety limits to be momentarily violated. The NRC denied this request on August 27, 2007, on grounds that it was essentially illegal and unsafe:

Standard Technical Specifications, Section 5.5.14(b)(1), “Technical Specifications (TS) Bases Control Program,” states that licensees may make changes to Bases without prior NRC approval, provided the changes do not involve a change in the TS incorporated in the license. The proposed change to the TS Bases has the effect of relaxing, and hence, changing, the TS Safety Limit. An exception to a stated TS safety limit must be made in the TS and not in the TS Bases. In addition,  a potential exists that the requested change in the TS Bases could have an adverse effect on maintaining the reactor core safety limits specified in the Technical Specifications, and thus, may result in violation of the stated requirements. Therefore, from a regulatory standpoint, the proposed change to the TS Bases is not acceptable. [emphasis added]

and

… the staff is concerned that in some depressurization events which occur at or near full power, there may be enough bundle stored energy to cause some fuel damage. If a reactor scram does not occur automatically, the operator may have insufficient time to recognize the condition and to take the appropriate actions to bring the reactor to a safe configuration. [emphasis added]

In April 2012, the nuclear industry abandoned efforts to convince the NRC to hand wave away the BWR safety limit problem and recommended that owners submit license amendment requests to the NRC to really and truly resolve the problem.

Forget the Tortoise and the Hare—the Snail “Wins” the Race

On December 31, 2012, nearly ten years after GE reported the problem, the owner of two BWRs submitted a license amendment request to the NRC seeking to resolve the problem. The NRC issued the amendment on December 8, 2014. Table 1 shows the “race” to fix this problem at the 34 BWRs operating in the US.

Table 1: License Amendments to Resolve BWR Safety Limit Problem Reactor License Amendment Request License Amendment Original Reactor  Pressure Revised Reactor  Pressure Susquehanna Units 1 and 2 12/31/2012 12/08/2014 785 psig 557 psig Monticello 03/11/2013 11/25/2014 785 psig 686 psig Pilgrim 04/05/2013 03/12/2015 785 psig 685 psig River Bend 05/28/2013 12/11/2014 785 psig 685 psig FitzPatrick 10/08/2013 02/09/2015 785 psig 685 psig Hatch Units 1 and 2 03/24/2014 10/20/2014 785 psig 685 psig Browns Ferry Units 1, 2, and 3 12/11/2014 12/16/2015 785 psig 585 psig Duane Arnold 08/06/2015 08/18/2016 785 psig 686 psig Clinton 08/18/2015 05/11/2016 785 psig 700 psia Dresden Units 2 and 3 08/18/2015 05/11/2016 785 psig 685 psig Quad Cities Units 1 and 2 08/18/2015 05/11/2016 785 psig 685 psig LaSalle Units 1 and 2 11/19/2015 08/23/2016 785 psig 700 psia Peach Bottom Units 2 and 3 12/15/2015 04/27/2016 785 psig 700 psia Limerick Units 1 and 2 01/15/2016 11/21/2016 785 psig 700 psia Columbia Generating Station 07/12/2016 06/27/2017 785 psig 686 psig Nine Mile Point Unit 1 08/01/2016 11/29/2016 785 psig 700 psia Oyster Creek 08/01/2016 11/29/2016 785 psig 700 psia Perry 11/01/2016 06/19/2017 785 psig 686 psig Nine Mile Point Unit 2 12/13/2016 10/31/2017 785 psig 700 psia Brunswick Units 1 and 2 None found None found 785 psig Not revised Cooper None found None found 785 psig Not revised Fermi Unit 2 None found None found 785 psig Not revised Grand Gulf None found None found 785 psig Not revised Hope Creek None found None found 785 psig Not revised

 

UCS Perspective

BWR Safety Limits 2.1.1.1 and 2.1.1.2 provide reasonable assurance that nuclear fuel will not be damaged during design bases transients. In March 2005, GE notified the NRC that a computer analysis glitch undermined that assurance.

The technical specifications issued by the NRC allow BWRs to operate above 25 percent power for up to six hours when the MCPR limit is violated. GE’s report did not reveal the MCPR limit to be violated at any BWR; but it stated that the computer methods used to establish the MCPR limits were flawed.

There are only four BWR safety limits. After learning that one of the few BWR safety limits could be violated and determining that fuel could be damaged as a result, the NRC monitored the glacial pace of the resolution of this safety problem. And six of the nation’s BWRs have not yet taken the cure. Two of those BWRs (Brunswick Units 1 and 2) do not have GE fuel and thus may not be susceptible to this problem. But Cooper, Fermi Unit 2, and Hope Creek have GE fuel. It is not clear why their owners have not yet implemented the solution.

The NRC is currently examining how to implement transformational changes to become able to fast track safety innovations. I hope those efforts enable the NRC to resolve safety problems in less than a decade; way, way less than a decade. Races to resolve reactor safety problems must become sprints and no longer leisurely paced strolls. Americans deserve better.

UCS asked the NRC’s Inspector General to look into how the NRC mis-handled the resolution of the BWR safety limit problem. The agency can, and must, do better and the Inspector General can help the agency improve.

Commendable Nuclear Safety Catch at the Susquehanna Nuclear Plant

The owner of the two boiling water reactors (BWRs) at the Susquehanna Steam Electric Station in northeastern Pennsylvania notified the Nuclear Regulatory Commission (NRC) on April 2, 2018, that workers’ mistakes rendered an emergency core cooling system on Unit 1 vulnerable to being disabled by an earthquake at the same time that another emergency core cooling system was out of service for work on its power supply system. This is good news—not in having two safety systems impaired while the reactor operated, but in how quickly the problem was detected and corrected.

Fig. 1 (Source: Nuclear Regulatory Commission)

The Emergency Core Cooling Systems

Susquehanna Unit 1 is a model BWR/4 reactor with a Mark II containment design that was placed into commercial operation in June 1983. In case of an accident that drains cooling water from the reactor vessel, Unit 1 is equipped with an array of emergency core cooling system (ECCS) pumps that will automatically start and provide makeup water. The ECCS include one steam-driven high pressure coolant injection (HPCI) pump, four motor-driven low pressure coolant injection (LPCI) pumps, and more motor-driven core spray (CS) pumps. The LPCI and CS pumps are split into two divisions of two LPCI pumps and two CS pumps each. Each division is powered from separate electrical buses, backed by separate emergency diesel generators, to increase the chances that enough pumps survive whatever challenge is experienced to provide adequate makeup cooling water flow for the reactor core.

The Situation

During the early afternoon of December 1, 2017, workers moved pipe sections into the room housing the Division II core spray pumps and staged this material on the floor as close as six inches from one of the two air conditioning units for the room.

At 7:48 am on December 2, the power supply to the Division II low pressure coolant injection pumps was removed from service to enable its voltage regulator to be replaced.

The Problem

At 10:30 am on December 3, an operator noticed that the materials staged in the core spray pump room were not seismically restrained and were close to one of the room’s air conditioning unit. The Operations department conservatively assumed that an earthquake could case the pipe sections to move into and damage the air conditioning unit. If that occurred, the heat from the running core spray pump motors could warm the room above the temperature that electrical equipment was qualified to endure. The Operations department declared the Division II core spray pumps inoperable due to their potential loss in event of an earthquake.

The Unit 1 operation license allowed the Division II low pressure coolant injection pumps to be out of service for up to 7 days while the reactor continued operating. This allowed outage time relied on other ECCS pumps being available in case an accident happened. The discovery that the Division II core spray pumps were also inoperable undermined that reliance. The operating license for Unit 1 required the reactor to be shut down within 7 hours with both the Division II low pressure coolant injection and core spray pumps inoperable.

The Solution

At 1:35 pm on December 3, the Division II low pressure coolant injection pumps were restored to operable following replacement of the voltage regulator on their power supply. Their restoration ended the need for the reactor to be shut down and returned the unit to the need to restore the Division II core spray pumps to service within 5 days (the 7-day clock started on December 1).

Around 4:00 pm on December 3, workers completed the removal of the pipe sections from the Division II core spray pump room. Doing so ended the need to shut down the reactor as all ECCS pumps were restored to service.

The Armchair Viewpoint

The Engineering department analyzed the temperature in the Division II core spray pump room with both motor-driven core spray pumps running and only one of two air conditioning units in the room operating. The second air conditioning unit was assumed not to be running due to damage from the pipe sections hitting it during an earthquake. The engineering analysis concluded that the room temperature would have remained below the temperatures used to qualify safety components in the room and that the core spray pumps would have performed their safety function successfully.

UCS Perspective

The staging of the replacement pipe sections without seismic restraints in the Division II core spray pump rooms near its air conditioning unit could have resulted in an air conditioning unit becoming damaged during an earthquake. That potential vulnerability was not recognized the next day when the Division II low pressure coolant injection pumps were taken out of service for maintenance to their power supply. The defense-in-depth approach to nuclear safety gets undermined when multiple layers are missing and/or impaired concurrently.

It would have been better had the pipe sections not been staged improperly or had that mistake been identified before it was compounded by the intentional disabling of additional ECCS pumps the next day. But dozens of activities are ongoing each and every day at a nuclear power plant. And materials temporary stored in the core spray pump room—a confined area infrequently accessed by workers on a daily basis—made detection of their improper configuration less than readily evident.

The mistake was identified by the Operations department less than two days after it was made and a day after it was compounded by taking other ECCS pumps out of service. It would have been easy not to have discovered the subtle mistake, but it was found. Once found, it would have been easy to presume that the core spray pumps would have functioned despite the potential loss of one of two air conditioning units in the room. But the Operations department lacked an analysis to support that presumption and declared the pumps inoperable. That conservative call accelerated the solution to the problem. Within about 185 minutes, the low pressure coolant injection pumps were restored to service. And within 330 minutes, the pipe sections were removed to eliminate the potential hazard to the air conditioning unit in the core spray pump room. The Operations department handled this matter very well. The Operations department handled this matter very well.

Defense-in-depth is frequently discussed in terms of equipment—two redundant pumps provided when only one needs to run for the necessary safety function to be fulfilled. This case illustrates how defense-in-depth also has an important role to play in human performance reliability. The Maintenance department placed the pipe sections in the core spray pump room. They should have stored the material properly, but failed to do so. The Operations department caught the mistake and caused it to be promptly remedied. And the Engineering department reviewed the mistake to determine its safety significance.

This event also reveals an unintended consequence from defense-in-depth applied to human performance reliability—when the first defense-in-depth layer succeeds, backup layers are not tested. Here, the first layer failed but the second and third layers came through. The next best thing to perfection is having a highly reliable first layer backed by a highly reliable second layer backed by a highly reliable third layer and so on.

Nuclear Regulatory Commission SAGging?

The Screen Actors Guild (SAG) is part of a labor union that represents nearly 160,000 actors and others in America. I don’t know how many NRC senior managers are SAG members, but with more and more individuals acting as senior managers for longer and longer periods, SAG may need to open an office in Rockville, Maryland where NRC is headquartered.

Figure 1 shows the NRC’s organization chart as of March 1, 2018. At the top are the five Commissioners, or rather the three Commissioners because two Commission positions have been vacant for over a year. Below the Commissioners are the 29 senior NRC managers. Of those 29 senior managers, the seven managers circled in red are only acting in those roles. Some have been acting at it for a long time. Fred Brown has been acting as the Director of the Office of New Reactors for over a year while Brian Holian has been acting as the Director of the Office of Nuclear Reactor Regulation since July 1, 2017. And Victor McCree, the NRC’s Executive Director for Operations (EDO), announced he will be retiring on June 30, 2018. The casting calls for an EDO actor have not yet been announced.

Fig. 1  Red boxes indicate acting or missing managers. (Source: NRC annotated by UCS)

Why Does it Matter?

Who commands more respect:

  • A full-time teacher or a substitute?
  • A real doctor or someone who stayed at Holiday Inn Express last night?
  • A parent or a babysitter?
  • A sheriff or a mall cop (Paul Blart excepted)?
  • A bona fide manager or an acting manager?

An acting manager can tackle the job as if it is a permanent one. But will she or he truly expend as much effort on long term tasks as someone who will be in that same job when those tasks are conducted?

Even if the acting manager performs the job as fully and capably as someone in the position for real, will her or his subordinates really raise longer term matters or will they simply wait until the real boss takes over?

A non-acting manager “owns” the job and can devote all her or his skills and attention to every aspect of that job. And staff can follow non-acting leaders without being distracted by the temptation to tolerate supervision until the real boss reports for duty.

What Does It Take to Stop the Acting?

The President nominates and the Senate confirms NRC Commissioners. So, the two empty Commissioner seats are up to the President and Senate to fill—you know, the folks unable to pass real budgets and who rely instead on serial “acting” budgetary measures. The other 29 positions on Figure 1 can be filled by the NRC itself without Presidential or Congressional involvement.

The Commission, or a majority thereof, fill the positions explicitly defined in the Atomic Energy Act. These positions include the EDO and the Directors of the Office of New Reactors and Nuclear Reactor Regulation. The EDO fills the remaining positions. For example, the NRC announced on January 2, 2018, that K. Steven West had been appointed Regional Administrator for Region III, replacing Cynthia D. Pederson who retired on December 30, 2017 (three days earlier).

Mr. West had been the Acting Director of the Office of Nuclear Security and Incident Response since July 2017 when Brian Holian became the Acting Director of the Office of Nuclear Reactor Regulation. After Mr. West got his permanent assignment, Brian McDermott was named to become the new Acting Director of NSIR. Since Mr. McDermott filled in for Acting Director West who was filling in for real Director Holian, perhaps Mr. McDermott is Acting Acting Director of NSIR.

UCS Perspective

Despite how many NRC senior managers have been acting at their positions for so long, they should probably not become SAG members. SAG represents actors and others in the entertainment industry. The NRC’s musical chairs is neither entertaining to play nor to watch.

The NRC filled Ms. Pederson’s position as Regional Administrator within three days of her retirement with a permanent, not Acting, Regional Administrator. So, the NRC can fill senior management positions expeditiously without needing actors. Despite this proven ability, 24 percent of the NRC’s top 29 management positions are filled by actors. So, the NRC can do better but has chosen—for reasons unknown—not to do so.

The NRC needs to stop acting so much, Otherwise, will the last non-actor please turn out the lights on the way out the door.

Nuclear Regulatory Commission’s Safety Dashbored

Who says the Nuclear Regulatory Commission does not have a delightful sense of humor?

Not me. Not anymore. Not after stumbling across the NRC’s Generic Issues Dashboard on its website.

The Dashboard page shows the status of three open generic issues. I look at two of them here.

GI204: Flooding of nuclear sites

Generic Issue (GI) 204 was initiated due to concerns that failure of dams upriver from nuclear power plants could flood the sites and disable emergency systems needed to prevent reactor core damage. The NRC staff completed a screening analysis in July 2011 and formally accepted GI-204 in February 2012, nine months after flooding at Fukushima Daiichi caused the three reactors operating at the time to melt down.

So, what’s the status of the resolution of this generic issue six years later? Dashboard, please.

Fig. 1 (Source: Nuclear Regulatory Commission)

A whopping 13.1% of the affected reactors have implemented the fixes. That’s a racy rate of over 2% per year sustained for six whole years!

How many of the affected reactors have completed all the effort needed to resolve this safety issues? Three—South Texas Project Units 1 and 2 and Callaway.

But that’s a recent generic issue. Let’s examine an older generic issue.

GI-191: Debris accumulation

GI-191 was identified in September 1996 and was assigned High priority by June 28, 1999, with a target resolution of September 2001. GI-191 affected all the 69 pressurized water reactors operating in the U.S. at the time.

If a pipe connected to the reactor vessel broke, the fluid jetting out of the pipe ends would scour insulation off piping, coatings off equipment, and even paint off walls. This debris would then be carried by the water to the basement of the containment building where it could collect in the sump. The emergency pumps for PWRs draw water from the containment sump. The amount of debris transported to the sump could block the flow to the emergency pumps, disabling both reactor core cooling and containment cooling.

Fig. 2 (Source: Nuclear Regulatory Commission SECY-99-185)

So, what’s the status of this High priority generic issue more than 16 years after its target resolution date of September 2001? Dashboard, please.

Fig. 3 (Source: Nuclear Regulatory Commission)

Less than half of the affected reactors have reportedly implemented the fixes to this High priority safety problem more than two decades after it was identified. And the NRC has verified the adequacy of the fixes at less than 35 percent of the affected reactors. And for all we know, the NRC is taking credit for the issue no longer being unresolved at PWRs like Crystal River 3, Kewaunee, San Onofre Units 2 and 3, and Fort Calhoun that have permanently shut down since GI-191 became a High priority or the statistics would reflect even worse.

UCS Perspective

Dashboard? Very funny. Not very accurate, but very amusing.

Come on. A safety problem afflicting more than half the nation’s nuclear power reactors that remains unresolved at most of them more than two decades later cannot be monitored by anything having “Dash” in its title. Unless “Dash” is paired with a verb that prevents any one from inferring that swiftness is involved.

Like “DashBored.”

DashBored might better convey the NRC’s efforts—they started out really and truly wanting to quickly resolve these known safety problems to protect the American public from unduly elevated risks, but then they got bored. Something else came up, like certifying new reactor designs and approving 20-year extensions to the operating licenses of problem-plagued reactors.

The dashboard of a competent nuclear safety regulator would not show known safety problems to remain unresolved for so long.

Fukushima’s Nuclear Safety Dividend at Surry Nuclear Plant

On March 11, 2011, a large earthquake with an epicenter a few miles off the northeastern shores of Japan spawned a tsunami that inundated the Fukushima Daiichi nuclear plant. The earthquake disconnected the plant from the offsite power grid. The tsunami disabled the onsite emergency diesel generators. Deprived of electricity for emergency systems, the reactor cores for Units 1, 2 and 3 overheated and melted down.

On March 12, 2012, the Nuclear Regulatory Committee (NRC) ordered owners of US nuclear power plants to develop and implement mitigation strategies to reduce the vulnerabilities of their facilities to extreme earthquakes and floods. While the specific measures varied from plant to plant, the mitigating strategies generally involved portable pumps, portable generators, cables, hoses, and hauling equipment (called FLEX equipment) and associated procedures for workers to use should permanently installed equipment become disabled.

While the NRC’s order and the industry’s FLEX equipment were intended to reduce vulnerabilities to hazards over and above those deemed credible when the nuclear plants were designed and licensed, Dominion Energy has figured out how to use the new equipment to lessen old risks at its Surry nuclear plant, thus reaping a nuclear safety dividend from its Fukushima investment.

Surry’s Internal Flooding Risk

The Surry Power Station is located about 17 miles northwest of Newport News, Virginia. The nuclear plant has two three-loop pressurized water reactors designed by Westinghouse. Each unit can supply 838 megawatts of electricity to the offsite power grid. Unit 1 commenced commercial operation in December 1972 and Unit 2 followed in May 1973.

Fig. 1 (Source: Dominion Energy)

The large white rectangular structures in the center of Figure 1 are the turbine buildings with the two reactor containments on the left. The turbine buildings contain the turbine generators used to make electricity. The turbine buildings also house the emergency switchgear rooms that route electricity from the offsite power grid, onsite emergency diesel generators, and onsite battery banks to safety equipment throughout the plant.

It has long been recognized that a large risk of reactor core damage at Surry was an internal flood that caused water to enter the switchgear rooms and disable their electricity distribution capabilities. Figure 2 shows that this internal flooding risk constituted 47% of the overall risk of reactor core damage at Surry, or nearly equal to all other hazards combined (CDF refers to core damage frequency).

Fig. 2 (Source: Dominion Energy)

If water from an internal flood enters the switchgear room and disables the supply of electricity to safety equipment, Surry has turbine driven auxiliary feedwater (TDAFW) pumps that would continue to provide makeup water to the steam generators so that decay heat produced by the shut-down reactor cores would be removed. The TDAFW pumps are powered by steam produced by the reactor core’s decay heat in the steam generators.

But the TDAFW pumps could be deprived of their automatic control system during an internal flooding event and the event could also disable the instruments that workers need to manually control the pumps. If the TDAFW pumps overfill the steam generators due to inadequate control of their flow rates, the steam flow for the pumps would be stopped which in turn halts the removal of decay heat from the reactor cores. If cooling cannot be restored in time, meltdown happens.

The turbine buildings are filled with pipes transporting water here, there and everywhere. Some pipes move water from the intake canal shown on the right in the photograph through the condensers beneath the main turbines and return it to the discharge canal appearing to the left of the reactor containment domes. Other pipes carry cooling water to equipment within the turbine buildings. And other pipes recycle water from the condensers to the steam generators located within the reactor containments.

The internal flooding hazard involves one of these pipes breaking and flooding the turbine building with water until a valve can be closed to isolate the break or a pump turned off to stop the flow. Depending on which pipe broke and how long it took to stop water pouring from its broken ends, the turbine building will be flooded to a certain depth. Figure 3 shows a dyke installed in the turbine building outside the doors to the emergency switchgear room for protection against internal flooding.

Fig. 3 (Source: Dominion Energy)

Dominion Energy built a concrete building at Surry and filled it with FLEX equipment as part of its response to the NRC’s mitigating strategies order. Figure 4 shows some of the FLEX equipment housed within this new building.

Fig. 4 (Source: Dominion Energy)

Surry’s Internal Flooding Risk Reduction

The NRC’s order and Dominion Energy’s FLEX equipment were intended to reduce the vulnerability of Surry to hazards posed by earthquakes and external floods more severe than anticipated when the plant was designed and licensed. Permanently installed equipment mitigate anticipated internal and external hazards; FLEX provides workers alternative means to cope with greater hazards.

Dominion Energy developed the capability for its FLEX equipment to also lessen the internal flooding risk. A Remote Monitoring Panel (RMP) was installed at Surry in response to the fire protection regulations imposed by the NRC in 1980. If a fire forced workers to abandon the main control room, they would relocate to the RMP which had switches and instruments needed to cool the reactor cores.

Dominion Energy modified the RMP to enable the FLEX equipment to provide power for its controls and instruments. If an internal flooding event disabled the electricity distribution from the switchgear rooms, workers could connect FLEX equipment to the RMP and increase their chances of successfully cooling the reactor cores until permanently installed systems could take back over that role. Figure 5 shows that the FLEX equipment significantly reduces the internal flooding and station blackout risks. Because these pose the two largest risks of core damage at Surry, reducing them also reduces the overall core damage risk, and by more than a smidgen or even two smidgens.

Fig. 5 (Source: Union of Concerned Scientists based on data from Dominion Energy)

UCS Perspective

Dominion Energy achieved a safety two-fer—the equipment procured to reduce Surry’s vulnerability to external hazards has also been able to reduce the plant’s risk from internal hazards.

UCS applauds this approach to nuclear safety. The FLEX equipment did not replace existing equipment; it supplemented it. In this way, workers are provided more options and thus given greater chances of successfully intervening to prevent bad outcomes.

We remain concerned—not specifically at Surry or by Dominion Energy but more generally—that FLEX will be used to justify increased risks. As a hypothetical example, suppose someone’s flood protection dyke broke when workers accidentally rammed it with an equipment cart. Justifying not fixing the broken flood barrier because of the FLEX safety net would be disappointing.

Similarly, justifying the elimination of inspections of pipes inside the turbine building for signs of degradation by reliance on the FLEX safety net would also be disappointing. The inspections detect degraded pipes for their replacement before they rupture, thereby reducing the need for a reliable safety net.

Drivers of vehicles equipped with airbags should not justify driving while intoxicated or blindfolded or both citing the airbags as their safety net. That’s a safety not rather than a safety net.

Why NRC Nuclear Safety Inspections are Necessary: Vogtle

This is the third in a series of commentaries about the vital role nuclear safety inspections conducted by the Nuclear Regulatory Commission (NRC) play in protecting the public. This commentary describes how NRC inspectors discovered inadequate flooding protection at the Vogtle nuclear plant near Waynesboro, Georgia despite a prior warning notice.

The first commentary described how NRC inspectors discovered that limits on the maximum allowable control room air temperature at the Columbia Generating Station in Washington had been improperly relaxed by the plant’s owner. The second commentary described how NRC inspectors uncovered an improper safety assessment of a leaking cooling water system pipe on the Unit 3 reactor at Indian Point outside New York City.

Turning Back the Clock

Last century, the NRC issued a warning to nuclear plant owners about the possible submergence of electrical cables located above the estimated flood levels. The NRC’s warning informed owners about a March 20, 1989, event in which the Clinton nuclear plant in Illinois inadvertently drained water into the drywell flooding it to a depth of four inches. Workers discovered that water got into electrical junction boxes located more than four inches above the drywell floor.

Electrical junction boxes house connections of electrical cables. Figure 1 shows water pouring from an electrical junction box at the Fort Calhoun nuclear plant in Nebraska during a flood in June 2011.

Fig. 1 (Source: Nuclear Regulatory Commission)

The NRC’s 1989 warning pointed out that moisture could get into electrical junction boxes various ways—from condensation of steam released from a broken pipe, actuation of overhead fire sprinklers, etc. If the junction boxes lack drain holes, water could accumulate within the boxes to submerge and disable electrical cables.

Workers at Vogtle reviewed the NRC’s warning and determined it was applicable to their plant. A work order was written to require that all electrical junction boxes containing safety-related cables had drain holes.

Stopping the Clock

The work order was closed out on January 25, 1990. Typically, closing out a work order written to correct a safety problem means that work to solve the problem has been completed. But not this time.

Setting off the Clock Alarm

In late 2017, NRC inspectors examined junction box 2BTJB0486 at Vogtle. They observed that the junction box lacked a drain hole and later determined that the cables and connections inside the box were not qualified for submergence in water. The NRC issued a Green finding for the failure to properly protect electrical equipment from the environmental conditions it could experience.

UCS Perspective

The NRC’s inspectors did not examine every junction box at Vogtle. The NRC conducts audits of a few items to gain insights about the condition of the broader universe of items. During this inspection, the NRC examined a whopping total of seven components, only one being a junction box. So, the NRC looked at one junction box and found it deficient. What does that say about the rest of the junction boxes at Vogtle?

Nothing. Maybe other boxes have holes. Maybe they don’t. Maybe is maybe adequate protection of public health and safety. Maybe not.

Workers at Vogtle wrote a work order to check on other junction boxes. In other words, they repeated the same step taken following the NRC’s 1989 warning to respond to the NRC’s 2018 finding that the 1989 response was woefully deficient.

The bad news is that the electrical junction box at Vogtle did not have even a tiny hole in it.

The worse news is that the corrective action program at Vogtle has a big hole in it.

NRC’s Project Aim: Off-target?

A handful of years ago, there was talk about nearly three dozen new reactors being ordered and built in the United States. During oversight hearings, Members of Congress queried the Members of the Nuclear Regulatory Commission on efforts underway and planned to ensure the agency would be ready to handle this anticipated flood of new reactor applications without impeding progress. Those efforts included creating the Office of New Reactors and hiring new staffers to review the applications and inspect the reactors under construction.

Receding Tide

The anticipated three dozen applications for new reactors morphed into four actual applications, two of which have since been cancelled. The tsunami of new reactor applications turned out to be a little ripple, at best.

The tide also turned for the existing fleet of reactors. Unfavorable economics led to the closures of several reactors and the announced closures of several other reactors in the near future.

The majority of the NRC’s annual budget is funded through fees collected from its licensees. For example, in fiscal year 2017 the owner of an operating reactor paid $4,308,000 for the NRC’s basic oversight efforts. For extra NRC attention (such as supplemental inspections when reactor performance dropped below par and for reviews of license renewal applications), the NRC charged $263 per hour.

Still, the lack of upsizing from new reactors and abundance of downsizing from existing reactors meant that NRC would have fewer licensees from whom to collect funds.

Enter Project Aim

The NRC launched Project AIM in June 2014 with the intention of “right-sizing” the agency while retaining the skill sets necessary to perform its vital mission. Project Aim identified 150 items that could be eliminated or performed more cost-effectively. Collectively, these measures were estimated to save over $40 million.

Fig. 1 (Source: Nuclear Regulatory Commission)

Project Aim Targets

Item 59 was among the highest cost-saving measures identified by Project Aim. It terminated research activities on risk assessments of fire hazards for an estimated savings of $935,000. The NRC adopted risk-informed fire protection regulations in 2004 to complement the fire protection regulations adopted by the NRC in 1980 in response to the disastrous fire at the Browns Ferry Nuclear Plant in Alabama. The fire research supported risk assessment improvements to better manage the fire hazards—or would have done so had it not been stopped.

Item 61 was also a high dollar cost-saving measure. It eliminated the development of new methods, models and tools needed to incorporate digital instrumentation and control (I&C) systems into probabilistic risk assessments (PRAs) with an estimated savings of $735,000. Nuclear power reactors were originally equipped with analog I&C systems (which significantly lessened the impact of the Y2K rollover problem). As analog I&C systems become more obsolete, plant owners are replacing them with new-fangled digital I&C systems. Digital I&C systems fail in different ways and at different rates than analog I&C systems and the research was intended to enable the PRAs to better model the emerging reality.

Item 62 eliminated development of methods, models, tools, and data needed to evaluate the transport of radioactive materials released during severe accidents into aquatic environments. For example, the 2011 severe accident at Fukushima involved radioactive releases to the Pacific Ocean via means not clearly understood. This cost-saving measure seems to preserve that secret.

Fig. 2 (Source: Nuclear Regulatory Commission)

Project Aim Off Target?

The need to reduce costs is genuine. Where oh where could savings of $935,000 come if not from killing the fire research efforts? Perhaps the Office of Management and Budget (OMB) has the answer. On May 11, 2012, OMB issued Memorandum M-12-12 that capped the amount federal agencies spent on conferences at $500,000. This OMB action pre-dated Project Aim, but seems consistent with the project’s fiscal responsibility objectives.

But the NRC opts not to abide by the OMB directive. Instead, the NRC Chairman signs a waiver allowing the NRC to spend far more than the OMB limit on its annual Regulatory Information Conferences (RICs). How much does the RIC cost? In 2017, the RIC cost the NRC $932,315.39—nearly double the OMB limit and almost exactly equal to the amount fire research would have cost.

987 persons outside the NRC attended the RIC in 2017. So, the NRC spent roughly $944.60 per outsider at the RIC last year. But don’t fixate on that amount. Whether the NRC had spent $1,000,000 per person or $1 per person, the RIC did not make a single American safer or more secure. (It also did not make married Americans safer or more secure, either.)

Eliminating the RIC would save the NRC nearly a million dollars each year. That savings could fund the fire research this year, which really does make single and married Americans safer. And next year savings could fund the development of digital I&C risk assessment methods to better manage the deployment of these systems throughout the nuclear fleet. And the savings the following year could fund research into transport of radioactive materials during severe accidents.

Fig. 3 (Source: Nuclear Regulatory Commission)

If the cliché “knowledge is power” holds any weight, then stopping fire research, development of digital I&C risk assessment methods, and many other activities leaves the NRC powerless to properly manage the associated risks.

RIC and risk? Nope, non-RIC and lower risk.

Clinton Power Station: Déjà vu Transformer Problems

The Clinton Power Station located 23 miles southeast of Bloomington, Illinois has one General Electric boiling water reactor with a Mark III containment that began operating in 1987.

On December 8, 2013, an electrical fault on a power transformer stopped the flow of electricity to some equipment with the reactor operating near full power. The de-energized equipment caused conditions within the plant to degrade. A few minutes later, the control room operators manually scrammed the reactor per procedures in response to the deteriorating conditions. The NRC dispatched a special inspection team to investigate the cause and its corrective actions.

On December 9, 2017, an electrical fault on a power transformer stopped the flow of electricity to some equipment with the reactor operating near full power. The de-energized equipment caused conditions within the plant to degrade. A few minutes later, the control room operators manually scrammed the reactor per procedures in response to the deteriorating conditions. The NRC dispatched a special inspection team to investigate the cause and its corrective actions. The NRC’s special inspection team issued its report on January 29, 2018.

Same reactor. Same month. Nearly the same day. Same transformer. Same problem. Same outcome. Same NRC response.

Coincidence? Nope. When one does nothing to solve a problem, one invites the problem back. And problems accept the invitations too often.

Setting the Stage(s)

The Clinton reactor was operating near full power on December 8, 2013, and on December 9, 2017. The electricity produced by the main generator (red circle labeled MAIN GEN in Figure 1) at 22 kilovolts (KV) flowed through the main transformers that upped the voltage to 345 KV (345,000 volts) for the transmission lines emanating from the switchyard to carry to residential and industrial customers. Some of the electricity also flowed through the Unit Auxiliary Transformers 1A and 1B that reduced the voltage to 6.9 and 4.16 KV (4,160 volts) for use by plant equipment.

The emergency equipment installed at Clinton to mitigate accidents is subdivided into three divisions. The emergency equipment was in standby mode before things happened. The Division 1 emergency equipment is supplied electrical power from 4,160-volt bus 1A1 (shown in red in Figure 1). This safety bus can be powered from the main generator when the unit is online, from the offsite power grid when the unit is offline, or from emergency diesel generator 1A (shown in green) if none of the other supplies is available. The Divisions 2 and 3 emergency equipment is similarly supplied power from 4,160-volt buses 1B1 and 1C1 respectively, each with three sources of power.

Fig.1 (Source: Clinton Individual Plant Examination Report (1992))

The three buses also provided power to transformers that reduced the voltage down to 480 volts for distribution via the 480-volt buses. For example, 4,160-volt bus 1A1 supplied 480-volt buses A and 1A.

Stage Struck (Twice)

On December 8, 2013, and again on December 9, 2017, an electrical fault on one of the 480-volt auxiliary transformers caused the supply breaker (shown in purple in Figure 2) from 4,160-volt bus 1A1 to open per design. This breaker is normally manually opened and closed by workers to control in-plant power distribution. But this breaker will automatically open to prevent an electrical transient from rippling through the lines to corrupt other equipment.

When the breaker opened, the flow of electricity to 480-volt buses A and 1A stopped, as did the supply of electricity from these 480-volt buses to emergency equipment. It didn’t matter whether electricity from the offsite power grid, the main generator, or emergency diesel generator 1A was supplied to 4,160-volt bus 1A1; no electricity flowed to the 480-volt buses with this electrical breaker open.

Fig. 2 (Source: Clinton Individual Plant Examination Report (1992))

The loss of 480-volt buses A and 1A interrupted the flow of electricity to emergency equipment but did not affect power to non-safety equipment. Consequently, the reactor continued operating near full power.

The emergency equipment powered from 480-volt buses A and 1A included the containment isolation valve on the pipe supplying compressed air to equipment inside the containment building. This valve is designed to fail-safe in the closed position; thus, in response to the loss of power, it closed.

Among the equipment inside containment needing compressed air were the hydraulic control units for the control rod drive (CRD) system (shown in orange in Figure 3). The control rods are positioned using water pistons. Supply water to one side of the piston while venting water from the other side creates a differential pressure causing the control rod to move. Reversing the sides that get water and get vented causes the control rod to move in the opposite direction. Compressed air keeps two scram valves for each control rod closed against coiled springs. Without the compressed air pressure, the springs force the scram valves to open. When the scram valves open, high pressure water is supplied below the pistons while water from above the pistons is vented. As a result, the control rods fully insert into the reactor core within a handful of seconds to stop the nuclear chain reaction.

Fig. 3 (Source: Nuclear Regulatory Commission)

Ten minutes after the electrical breaker opened on December 8, 2013, an alarm in the control room sounded to alert the operators about low pressure in the compressed air system. The operators followed procedures and responded to the alarm by manually scramming the reactor.

Four minutes after the electrical breaker opened on December 9, 2017, an alarm in the control room sounded to alert the operators about low pressure in the compressed air system. Two minutes later, other alarms sounded to inform the operators that some of the control rods were moving into the reactor core. They manually scrammed the reactor. (The timing difference between the two events is explained by the amounts of air leaking from piping inside containment and by the operation of pneumatically controlled components inside containment that depleted air from the isolated piping.)

The event had additional complications. The loss of power disabled: (1) the low pressure core spray system, (2) one of the two residual heat removal trains, the reactor core isolation cooling system, and the normal ventilation system for the fuel handling building (the structure on the left side of Figure 3). These losses were to be expected – subdividing the emergency equipment into three divisions and then losing all the power to that division de-energizes about one-third of the emergency equipment.

Fortunately, the loss of some emergency equipment in this case was tolerable because there was no emergency for the equipment to mitigate. The operators used non-safety equipment powered from the offsite grid and some of the emergency equipment from Divisions 2 and 3 to safely shut down the reactor. The operators anticipated that the loss of compressed air to equipment inside containment would eventually cause the main steam isolation valves to close, taking away the normal means of removing decay heat from the reactor core. The operators opened other valves before the main steam isolation valves close to provide an alternate means of sustaining this heat removal path. About 30 hours after the event began, the operators placed the reactor into a cold shut down mode, within the time frame established by the plant’s safety studies.

Staging a Repeat Performance

Workers replaced the failed Division 1 transformer following the December 2013 event. Clinton has five safety-related and 24 non-safety-related 4,160-volt to 480-volt transformers, including the one that failed in 2013. Following the 2013 failure, a plan was developed to install windows in the transformer cabinets to allow the temperature of the windings inside to be monitored using infrared detectors. Rising temperatures would indicate winding degradation which could lead to failure of the transformer.

But the planned installation of the infrared detection systems was canceled because the transformers were already equipped with thermocouples that could be used to detect degradation. Then the owner stopped monitoring the transformer thermocouples in 2015.

Plan B (or C?) involved developing a procedure for Doble testing of these 29 transformers that would trend performance and detect degradation. The Doble testing was identified in October 2016 as a Corrective Action to Prevent Recurrence (CAPR) from the 2013 transformer failure event. The Doble testing procedure was issued on November 18, 2016.

Clinton was shut down on May 8, 2017, for a refueling outage. The activities scheduled during the refueling outage included performing the Doble testing on the Division 2 4,160-volt to 480-volt transformers. But that work was canceled because it was estimated to extend the length of the refueling outage by three whole days. So, Clinton restarted on May 29, 2017, without the Doble testing being conducted. As noted by the NRC special inspection team dispatched to Clinton following the repeat event in 2017: “…the inspectors determined that revising the model work orders [i.e., the Doble test procedure] alone was not a CAPR. In order for the CAPR to be considered implemented, the licensee needed to complete actual Doble testing of the transformers.”

The NRC’s special inspection team also identified a glitch with how some of the non-safety-related transformers were handled within the preventative maintenance program. A company procedure required components whose failure would result in a reactor scram to be included in the preventative maintenance program to lessen the likelihood of failures (and more importantly, costly scrams). In response to NRC’s questions, workers stated that three of the non-safety-related transformers could fail and cause a reactor scram, but that these transformers were not covered by the preventative maintenance program.

Plan C (or D?) now calls for replacing all five safety-related transformers: the two Division 2 transformers in 2018 and the single Division 3 transformer in 2021. The two Division 1 transformers have already been replaced following their failures. A decision whether to replace the 24 non-safety-related transformers awaits a determination about seeking a 20-year extension to the reactor’s operating license.

NRC Sanctions

The NRC’s special inspection team identified two findings both characterized as Green in the agency’s green, white, yellow and red classification system.

One finding was the violation of 10 CFR Part 50, Appendix B, Criterion XVI, “Corrective Actions,” for failing to implement measures to preclude repetition of a significant condition adverse to quality. Specifically, the fixes identified by the owner following the December 2013 transformer failure were not implemented, enabling the December 2017 transformer to fail.

The other finding was the failure to follow procedures for placing equipment within the preventative maintenance program. Per procedure, three of the non-safety-related transformers should have been covered by the preventative maintenance program but were not.

UCS Perspective

Glass half-full: Clinton started operating in 1987 and didn’t experience a 4,160-volt to 480-volt transformer failure until late 2013. Apparently, transformer failures are exceedingly rare events such that lightning won’t strike twice.

Glass half-empty: All the aging transformers at Clinton were over 25 years old and heading towards, if not already in, the wear out region of the bathtub curve. Lightning may not strike twice, but an aging jackhammer strikes lots of times (until it breaks).

Could another untested, unreplaced aging transformer fail at Clinton? You bet your glass.

Fig. 4 (Source: Nuclear Regulatory Commission)