UCS Blog - All Things Nuclear (text only)

Why NRC Nuclear Safety Inspections are Necessary: Indian Point

This is the second in a series of commentaries about the vital role nuclear safety inspections conducted by the Nuclear Regulatory Commission (NRC) play in protecting the public. The initial commentary described how NRC inspectors discovered that limits on the maximum allowable control room air temperature at the Columbia Generating Station in Washington had been improperly relaxed by the plant’s owner. This commentary describes a more recent finding by NRC inspectors about an improper safety assessment of a leaking cooling water system pipe on Entergy’s Unit 3 reactor at Indian Point outside New York City.

Indian Point Unit 3: Leak Before Break

On February 3, 2017, the NRC issued Indian Point a Green finding for a violation of Appendix B to 10 CFR Part 50. Specifically, the owner failed to perform an adequate operability review per its procedures after workers discovered water leaking from a service water system pipe.

On April 27, 2016, workers found water leaking from the pipe downstream of the strainer for service water (SW) pump 31. As shown in Figure 1, SW pump 31 is one of six service water pumps located within the intake structure alongside the Hudson River. The six SW pumps are arranged in two sets of three pumps. Figure 1 shows SW pumps 31, 32, and 33 aligned to provide water drawn from the Hudson River to essential (i.e, safety and emergency) components within Unit 3. SW pumps 34, 35, and 36 are aligned to provide cooling water to non-essential equipment within Unit 3.

Fig. 1 (Source: Nuclear Regulatory Commission Plant Information Book) (click to enlarge)

Each SW pump is designed to deliver 6,000 gallons of flow. During normal operation, one SW pump can handle the essential loads while two SW pumps are needed for the non-essential loads. Under accident conditions, two SW pumps are needed to cool the essential equipment. The onsite emergency diesel generators can power either of the sets of three pumps, but not both simultaneously. If the set of SW pumps aligned to the essential equipment aren’t getting the job done, workers can open/close valves and electrical breakers to reconfigure the second set of three SW pumps to the essential equipment loops.

Because river water can have stuff in it that could clog some of the coolers for essential equipment, each SW pump has a strainer that attempts to remove as much debris as possible from the water. The leak discovered on April 27, 2016, was in the piping between the discharge check valve for SW pump 31 and its strainer. An arrow points to this piping section in Figure 1. The strainers were installed in openings called pits in the thick concrete floor of the intake structure. Water from the leaking pipe flowed into the pit housing the strainer for SW pump 31.

The initial leak rate was modest—estimated to be about one-eighth of a gallon per minute. The leak was similar to other pinhole leaks that had occurred in the concrete-lined, carbon steel SW pipes. The owner began daily checks on the leakage and prepared an operability determination. Basically, “operability determinations” are used within the nuclear industry when safety equipment is found to be impaired or degraded. The operability determination for the service water pipe leak concluded that the impairment did not prevent the SW pumps from fulfilling their required safety function. The operability determination relied on a sump pump located at the bottom of the strainer pit transferring the leaking water out of the pit before the water flooded and submerged safety components.

The daily checks instituted by the owner included workers recording the leak rate and assessing whether it had significantly increased. But the checks were against the previous day’s leak rate rather than the initial leak rate. By September 18, 2016, the leakage had steadily increased by a factor of 64 to 8 gallons per minute. But the daily incremental increases were small enough that they kept workers from finding the overall increase to be significant.

The daily check on October 15, 2016, found the pump room flooded to a depth of several inches. The leak rate was now estimated to be 20 gallons per minute. And the floor drain in the strainer pit was clogged (ironic, huh?) impairing the ability of its sump pump to remove the water. Workers placed temporary sump pumps in the room to remove the flood water and cope with the insignificantly higher leak rate. On October 17, workers installed a clamp on the pipe that reduced the leakage to less than one gallon per minute.

The operability determination was revised in response to concerns expressed by the NRC inspectors. The NRC inspectors were not satisfied by the revised operability determination. It continued to rely on the strainer pit sump pump removing the leaking water. But that sump pump was not powered from the emergency diesel generator and thus would not remove water should offsite power become unavailable. Step 5.6.4 of procedure EN-OP-14, “Operability Determination Process,” stated “If the Operability is based on the use or availability of other equipment, it must be verified that the equipment is capable of performing the function utilized in the evaluation.”

The operability determination explicitly stated that no compensatory measures or operator manual actions were needed to handle the leak, but the situation clearly required both compensatory measures and operator manual actions.

The NRC inspectors found additional deficiencies in the revised operability determination. The NRC inspectors calculated that a 20 gallon per minute leak rate coupled with an unavailable strainer pit sump pump would flood the room to a depth of three feet in three hours. There are no flood alarms in the room and the daily checks might not detect flooding until the level rose to three feet. At that level, water would submerge and potentially disable the vacuum breakers for the SW pumps. Proper vacuum breaker operation could be needed to successfully restart the SW pumps.

The NRC inspectors calculated that the 20 gallon per minute leak rate without remediation would flood the room to the level of the control cabinets for the strainers in 10 hours. The submerged control cabinets could disable the strainers, leading to blocked cooling water flow to essential equipment.

The NRC inspects calculated that the 20 gallon per minute leak rate without remediation would completely fill the room in about 29 hours, or only slightly longer than the daily check interval.

Flooding to depths of 3 feet, 10 feet, and the room’s ceiling affected all six SW pumps. Thus, the flooding represented a common mode threat that could disable the entire service water system. In turn, all safety equipment shown in Figure 2 no longer cooled by the disabled service water system could also be disabled. The NRC estimated that the flooding risk was about 5×10-6 per reactor year, solidly in the Green finding band.

Fig. 2 (Source: Nuclear Regulatory Commission Plant Information Book) (click to enlarge)

UCS Perspective

“Leak before break” is a longstanding nuclear safety philosophy. Books have been written about it (well, at least one report has been written and may even have been read.)  The NRC’s approval of a leak before break analysis can allow the owner of an existing nuclear power reactor to remove pipe whip restraints and jet impingement barriers. Such hardware guarded against the sudden rupture of a pipe filled with high pressure fluid from damaging safety equipment in the area. The leak before break analyses can provide the NRC with sufficient confidence that piping degradation will be detected by observed leakage with remedial actions taken before the pipe fails catastrophically. More than a decade ago, the NRC issued a Knowledge Management document on the leak before break philosophy and acceptable methods of analyzing, monitoring, and responding to piping degradation.

This incident at Indian Point illustrated an equally longstanding nuclear safety practice of “leak before break.” In this case, the leak was indeed followed by a break. But the break was not the failure of the piping but failure of the owner to comply with federal safety regulations. Pipe breaks are bad. Regulation breaks are bad. Deciding which is worse is like trying to decide which eye one wants to be poked in. None is far better than either.

As with the prior Columbia Generating Station case study, this Indian Point case study illustrates the vital role that NRC’s enforcement efforts plays in nuclear safety. Even after NRC inspectors voiced clear concerns about the improperly evaluated service water system pipe leak, Entergy failed to properly evaluate the situation, thus violating federal safety regulations. To be fair to Entergy, the company was probably doing its best, but in recent years, Entergy’s best has been far below nuclear industry average performance levels.

The NRC’s ROP is the public’s best protection against hazards caused by aging nuclear power reactors, shrinking maintenance budgets, emerging sabotage threats, and Entergy. Replacing the NRC’s engineering inspections with self-assessments by Entergy would lessen the effectiveness of that protective shield.

The NRC must continue to protect the public to the best of its ability. Delegating safety checks to owners like Entergy is inconsistent with that important mission.

Xi’s China

What’s happening in China? The US consensus seems to be that President Xi Jinping is upending the place. Yet, midway through an expected ten-year term China’s communist party general secretary delivered a report to the 19th Party Congress that reiterated all the language, ideas and policies that the Chinese communists have used to govern the country since the mid-1980s. The most remarkable thing about Xi’s China is that it hasn’t changed at all.

Chinese Communist Party General Secretary Xi Jinping addresses the 19th Party Congress

China remains a socialist country. Xi’s not only proud of that, he’s confident that continuing to follow the socialist road will put China on the right side of history. What makes his tenure at the top seem different is that he’s unapologetically elevated ideology over policy. In Chairman Mao’s parlance, Xi is a little more red than expert.

But that doesn’t mean he’s changed Chinese policy. Internationally, Xi reported China remains open to the outside world. Domestically, his government remains committed to economic and political reform. It may not be the kind of openness or the type of reform US officials hoped for, but US expectations for China have always been based on a different view of history. Even after the Chinese leadership used lethal military force to suppress nationwide public demonstrations in June of 1989, most US observers still believed that international engagement, market economics and the rise of the Chinese middle class would eventually lead to the fall of the Chinese Communist Party (CCP) and the emergence of a multi-party Chinese democracy. Instead, if Xi’s report is to be believed, Chinese socialism has emerged from the crucible of Tiananmen Square stronger than it was before.

Continuity and Change in Communist China

The last time China really changed was when Mao died. Mao believed that global revolution was right around the corner and that China was ready for a rapid transformation to communism. The leaders who inherited the party in Mao’s wake, especially Deng Xiaoping, saw the world and China’s place within it very differently. At home, China was only in the beginning stages of a transformation to socialism that would take a very long time. And as the party set about engineering that incremental transformation, China would need to engage the world as it was rather than imagining they would change it. Deng told his comrades they needed to be humble as they worked to fulfill their Chinese socialist dream to modernize the country and restore Chinese influence in the world.

Xi Jinping’s report does not stray too far from that advice. China’s made a lot of progress since Deng died twenty years ago, but it is still, according to Xi, in the early stages of a long-term transformation to socialism. China’s progress may have elevated its position in the world, and given China a greater say in international governance, but there is nothing in Xi’s report about China leading a movement to upend the global status quo.

Xi does believe that Chinese socialism can set an example for the rest of the world to follow, and that more active Chinese participation can help transform the international order. As a committed Marxist, Xi should believe an eventual transition to a socialist global order is inevitable. But in the short term, Xi’s China appears squarely focused on the fifth of humanity that lives within its borders, where good governance is at a crossroads, crippled by endemic corruption rooted in the attitudes and behavior of party cadres who’ve lost the faith. Xi’s project, if you take his party congress report at face value, seems to be to save Chinese socialism and consolidate its gains, not to change it.

Implications for the United States

Is a consolidated and internationally persuasive Chinese socialism a threat to the United States? Unfortunately, that’s a question many US analysts and officials are no longer inclined to address. During the Maoist era, when China was “more red than expert,” there was greater US interest in the content of Chinese socialism. Today, US observers tend to view the CCP leadership’s repeated recitations of its socialist principles and practices as propaganda masking personal or national ambitions.

US commentaries on Xi’s speech reflect this. Most of them interpret Xi’s campaign against corruption as a personal quest to consolidate power rather than a campaign to save Chinese socialism. Instead of taking Xi and his recent predecessors at their word and seeing the principal aim of their post-1980s efforts as the achievement of a “moderate level of prosperity” for China‘s 1.4 billion, many US observers see this as an attempt to hide the CCP’s real aim, which they believe is kicking the United States out of Asia and supplanting US dominance of the region. For Americans, the contest between the United States and China is perceived as an historic struggle between rising and falling national powers rather than competing ideologies.

If Xi is a budding dictator leading a nationalist political organization focused on replacing the United States at the top of a global hierarchy then US policy makers should be concerned. But what if the Chinese dream articulated in Xi’s report to the 19th Party Congress is a fair representation of the CCP’s ambitions? Should the United States be alarmed? The answer is not obvious and the question seems to deserve greater consideration.

Why NRC Nuclear Safety Inspections are Necessary: Columbia Generating Station

The Nuclear Regulatory Commission (NRC) adopted its Reactor Oversight Process (ROP) in 2000. The ROP is far superior to the oversight processes previously employed by the NRC. Among its many virtues, the NRC treats the ROP as a work in progress, meaning that agency routinely re-assesses the ROP and makes necessary adjustments.

Earlier this year, the NRC initiated a formal review of its engineering inspections with the goal of making them more efficient and more effective. During a public meeting on October 11, 2017, the NRC working group conducting the review outlined some changes to the engineering inspections that would essentially cover the same ground but with an estimated 8 to 15 percent reduction in person-hours (the engineering inspections and suggested revisions are listed on slide 7 of the NRC’s presentation). Basically, the NRC working group suggested repackaging the inspections so as to be able to examine the same number of items, but in fewer inspection trips.

The nuclear industry sees a different way to accomplish the efficiency and effectiveness gains sought by the NRC’s review effort—they propose to eliminate the NRC’s engineering inspections and replace them with self-assessments. The industry would mail the results from the self-assessments to the NRC for their reading pleasure.

UCS is wary of self-assessments by industry in lieu of NRC inspections. On one hand, statistics might show that self-assessments increase safety just as a community firing all its law enforcement officers would see a statistical decrease in arrests, suggesting a lower crime rate. I have been researching the records publicly available in ADAMS to compare the industry’s track record for finding latent safety problems with the NRC’s track record to see whether replacing NRC’s inspections with industry self-assessments could cause nuclear safety to go off-track.

This commentary is the first in a series that convinces us that the NRC’s engineering inspections are necessary for nuclear safety and that public health and safety will be compromised by replacing them with self-assessments by industry.

Columbia Generating Station: Not so Cool Safety Moves

The Columbia Generating Station is a boiling water reactor owned by Energy Northwest and located 12 miles northwest of Richland, Washington. The Washington Public Power Supply System (the original name of the plant’s owner) submitted a Preliminary Safety Analysis Report (PSAR) for the Washington Nuclear Project Unit 2 (the original name for the reactor) to the Atomic Energy Commission (AEC, the original name of the nuclear regulator) in February 1973.

The PSAR described the proposed design of the plant and associated safety studies that demonstrated compliance with regulatory requirements. The PSAR described the two systems intended to cool the control room during normal operation and during postulated accidents. The control room heating, ventilation, and air conditioning (HVAC) would use chillers within the Radwaste Building HVAC system during normal operation. Because the Radwaste Building HVAC system is not designed to withstand earthquake forces or remain running when offsite power is unavailable, it cannot be credited with performing this role during accident conditions. So, the Standby Service Water system was proposed to cool the control room during accidents. The Standby Service Water system features pumps, pipes, and valves that recirculate water between a large cooling pond and safety equipment within the plant. Two independent sets, called divisions in the figure, are used to enhance reliability of this safety function (Fig. 1).

Fig. 1 (Source: Energy Northwest modified by UCS)

The PSAR indicated that for worst-case design conditions of 77°F cooling pond water temperature and 105°F outside air temperature, the Standby Service Water system would prevent the air temperature within the control room from exceeding 104°F. The AEC/NRC expressed concern that such warm control room temperatures could impair both human and equipment performance.

The owner resolved the regulator’s concerns by committing to installing two Seismic Category I emergency chillers for the control room HVAC system (Fig. 2). The emergency chillers were fully redundant such that one emergency chiller alone could maintain the air temperature inside the control room from exceeding 78°F during an accident. The NRC issued an operating license for the Columbia Generating Station on April 13, 1984, with License Condition 2.C.(21) that required the two emergency chillers to be operable by May 31, 1984. In November 1984, the owner revised the PSAR (now called the Final Safety Analysis Report or FSAR) to describe the emergency chillers and their role in keeping the control room air temperature from exceeding 78°F.

Fig. 2 (Source: Energy Northwest)

In September 1989, the owner revised the FSAR to change the control room air temperature limit to 85°F. The owner determined that this change did not require prior NRC review and approval. The NRC later disagreed with this self-imposed temperature relaxation.

In May 1998, the owner revised the FSAR to change the control room air temperature limit from 85°F to 85°F effective (see below). Once again, the owner determined that this change did not require prior NRC review and approval. And again, the NRC later disagreed with this self-imposed temperature limit relaxation.

“Effective temperature” is based on a combination of wet-bulb and dry-bulb temperatures. The original 75°F and initial 85°F limits were based solely on dry-bulb temperatures. The 85°F effective temperature allowed dry-bulb temperatures of up to 105°F—higher than the control room air temperature expressly rejected by the regulator. The owner made this change without seeking NRC’s approval because it was considered an editorial change. The NRC later determined that this temperature limit relaxation was not an editorial change.

Because the Standby Service Water system alone could maintain the dry-bulb temperature inside the control room at or below 104°F and the revised limit was now 105°F, the owner implemented another change—also unreviewed and unapproved by the NRC—eliminating the need for the emergency chillers to perform any safety role during postulated accidents. The NRC issued a Severity Level IV non-cited violation on April 23, 103, for the owner relaxing the control room air temperature limit without prior NRC approval.

The following month, the owner notified the NRC about deficiencies in the test periodically conducted to demonstrate the adequacy of the Standby Service Water system to cool the control room during accident conditions. When the test deficiencies were remedied and the corrected test performed, one of the two Standby Service Water system trains failed. Workers determined that the tubes within the control room cooler units had become degraded due to the buildup of scale on the inside tube surfaces and the collection of sediment in the lower region of the units. Routine testing of the control room cooler units had been discontinued 16 years earlier.

So, around the same time that the owner improperly decided that the emergency chillers were no longer needed to cool the control room during accidents, it discontinued proper testing of the Standby Service Water system that it thought would perform this role during accidents. Maybe it was another editorial change that discontinued the tests.

On November 12, 2015, the NRC issued a Green finding for a violation of Criterion III, “Design Control,” of Appendix B to 10 CFR Part 50. The NRC inspectors found that the emergency chillers, as designed and governed by operating procedures, would not maintain the air temperature inside the control room below 85°F under accident conditions. The vendor manual for the emergency chillers stated that the STOP-RESET pushbutton had to be depressed after a power interruption because the chillers would not automatically restart. But the operating procedures failed to have the operators perform this necessary step.

On December 22, 2015, Energy Northwest contested the NRC’s finding. The owner stated, in writing, that “There are no design basis requirements to maintain the control room temperature at less than or equal to 85°F at all times for all accident scenarios” [boldfacing in original]. The owner further requested that the NRC conduct a backfit analysis per 10 CFR 50.109 before imposing these “new” regulatory requirements.

By letter dated June 10, 2016, the NRC responded to the owner’s appeal. The NRC carefully considered the owner’s arguments and delineated why it was rejecting each one. The NRC concluded “…it cannot be concluded that the system function as described in the current design basis can be achieved.”

On May 3, 2016 (perhaps sensing that its appeal would not be successful), the owner met with the NRC to discuss a pending license amendment request that would resolve the concerns about the emergency chillers. As shown in the figure, the two emergency chillers sit side-by-side in the same room vulnerable to a common mode, like a fire, disabling them both (Fig. 3). But the chillers are seismically qualified and redundant, consistent with the original commitment to install them. The pending license amendment request would reconcile departures from two NRC General Design Criteria and justify the use of manual vice automatic actions to place the chillers in service.

Fig. 3 (Source: Energy Northwest)

UCS Perspective

Under the Atomic Energy Act as amended, the NRC is tasked with establishing and enforcing regulations to protect workers and the public from the inherent hazards from nuclear power reactor operation.

Owners are responsible for conforming with applicable regulatory requirements. In this case, the owner made a series of changes that resulted in the plant not conforming with applicable regulatory requirements for the air temperature within the control room. But there’s no evidence suggesting that the owner knew that the changes were illegal yet made them anyway hoping not to get caught. Nevertheless, ignorance of the law is still not a valid excuse. The public is not adequately protected when safety regulations are not met, regardless of whether the violations are intentional or inadvertent.

This case study illustrates the vital role that NRC’s enforcement efforts plays in nuclear safety. The soundest safety regulation in the world serves little use unless owners abide by it. The NRCs inspection efforts either verify that owners are abiding by safety regulations or identify shortfalls. Self-assessments by owners are more likely to sustain mis-interpretations and misunderstandings than to flush out safety problems.

The NRC’s ROP is the public’s best protection against hazards caused by aging nuclear power reactors, shrinking maintenance budgets, and emerging sabotage threats. Replacing the NRC’s engineering inspections with self-assessments by the owners would lessen the effectiveness of that protective shield.

The NRC must continue to protect the public to the best of its ability. Delegating safety checks to owners is inconsistent with that important mission.

No, Missile Defense Will Not Work 97% of the Time

In an October 11 interview on Fox News, President Trump claimed:

We have missiles that can knock out a missile in the air 97 percent of the time. If you send two of them, they are going to get knocked down.

This is not true. At least not in any relevant way.

The only homeland missile defense system is the Ground-based Midcourse Defense (GMD) system, which I’ve written plenty about here in these pages, and have co-authored a recent report about. If you’ve been following along, you’ll know the president’s statement was clearly untrue.  I’ll explain why.

What does the actual test record show?

The GMD interceptors have succeeded in destroying the target in nine out of 18 tests since 1999 (50%).  They have destroyed their target in four out of 10 tries (40%) since the GMD system was nominally deployed in 2004. They have destroyed their target in two of the last five tests (40%).

So there is no basis to expect it to work any better than 40 to 50% of the time even under the most generous and easiest conditions—former Pentagon testing agency director Phil Coyle calls the test conditions so far as “scripted for success.”

While the test record says something about the GMD’s capabilities under scripted conditions, the real world will be more complex and challenging. The Pentagon’s highest testing official assessed in 2014 that the test program was “insufficient to demonstrate that an operationally useful capability exists.” More on this later.

But for sake of argument, say the “single shot kill probability” has been determined via tests to be 40 to 50% in those optimistic conditions. Because reliability is low, the US would fire multiple interceptors at the missile to try to boost the system’s effectiveness. Using four-on-one targeting, and a 40 to 50% chance that a given interceptor would work, this leads to a 6 to 13% chance that the warhead gets through.

Real-world conditions

But this isn’t the right question. If it came down to a nuclear attack, would North Korea send just a single missile, and choose the most convenient conditions? That seems unlikely. Let’s say the salvo is five incoming missiles. In that case, with an interceptor kill probability of 40 to 50%, using four interceptors on each missile, the probability that one warhead gets through is 28 to 50%. Uncomfortably high.

I could not stress more that this is a best-case scenario. It assumes that:

1) Failures are uncorrelated and not, e.g., a design flaw common to all interceptors, such as the guidance system issues that took nearly a decade to diagnose and fix,

2) The intercept attempts take place under simplified conditions and that the system is not being stressed as it would in a real-world situation, and

3) The system successfully identified the five real targets from among decoys. If the system cannot distinguish decoys from the real targets, it will have to engage them all, quickly depleting the interceptor inventory. These do not need to be the Ferraris of decoys to be an issue. Some of the GMD intercept tests have included decoys, but all of those have been designed to be easily distinguished from the target warhead.

In short, one can construct situations under which missile defense might destroy missiles: a small salvo of missiles sent without countermeasures and under the limited range of conditions under which the system has been tested. The problem is that these are not by any stretch the most *likely* situations. A potential adversary has every incentive to make the attack as difficult as possible to intercept if he is going to initiate World War Three.

Note that even if the president were instead talking about one of the missile defense systems that has a better and more complete test record, such as THAAD, the issues with not having been tested in operationally realistic conditions is the same. And because THAAD defends against shorter-range missiles from North Korea, which are cheaper and more plentiful, it has the additional issue that it may be overwhelmed even if it is able to discriminate between decoys and real targets. There just may be too many targets.

Why is this dangerous?

The best-case scenario is that President Trump is trying to avoid a confrontation by allowing himself to save face: he has declared that North Korea must not be able to threaten the US mainland with nuclear-armed missiles. Or that he hopes such statements would help dissuade North Korea from considering an attack.

Certainly worse than this is the possibility that Trump actually believes that strategic missile defense provides credible protection and he has not been advised correctly. One hopes he is provided accurate information by stewards of these programs, although at least in public, government official often describe the GMD system as much more capable than it has been demonstrated to be.

This is dangerous, because common sense would say that if we have spent $40 billion on a missile defense system that the US has claimed has been “operational” for going on fifteen years, it must “work.” But it doesn’t. Look at the test record.

The problem is that believing missile defense works when it doesn’t can lead you to take actions that make you need it, and then it can’t help you.

Don’t Make the Same Mistake on Iran that Bush Made on North Korea

Press reports say President Trump will likely not certify Iranian compliance with the Iran nuclear deal in the near future, setting up a situation in which Congress can reimpose sanctions and effectively end US compliance with the deal.

(Source: US State Dept.)

Since the agreement includes several other countries, that would significantly weaken the deal but would not end it.

Still, that the United States would undermine the agreement—which administration officials acknowledge Iran is abiding by—is incredibly short-sighted. It goes against the advice of President Trump’s senior advisors and essentially the whole US security policy community. It erodes US credibility as a treaty partner in future negotiations.

Killing the deal would throw out meaningful, verified limits on Iran’s ability to make nuclear weapons because the president doesn’t think the agreement goes far enough.

The US did this with North Korea, and it was a disaster

The US did this before—with North Korea—and that led to the crisis we are in today.

In 2001, when the Bush administration took office, there was an agreement in place (the Agreed Framework) that verifiably stopped North Korea’s production of plutonium for weapons and put international inspectors on the ground to make sure it was not cheating. This stopped Pyongyang from making fissile material that could be used for dozens of nuclear weapons, and provided the world valuable information about an intensely opaque country.

Also by 2001 North Korea had agreed to stop ballistic missile tests—which was readily verified by US satellites—as long as negotiations continued. This was also meaningful since it would cap Pyongyang’s missile capability at a range of only 800 miles.

Former Secretary of Defense William Perry, who was closely involved in the negotiations with Pyongyang, has said he believes at that point the United States was a couple months from reaching an agreement that would have ended the North’s nuclear and missile programs. This was years before North Korea had done any nuclear tests or long-range missile tests.

Instead of capturing these important restrictions and building on them, the Bush administration—like Trump today—argued these limits were flawed because they did not go far enough to reign in the whole range of activities the United States was concerned about. Bush stopped the talks and eventually let the constraints on North Korea’s nuclear and missile programs fall apart, bringing us to where we are today: facing a North Korea with hydrogen bombs and long-range missiles.

One reason the Bush administration gave for stopping implementation of the Agreed Framework was that Pyongyang had a fledgling uranium enrichment program that was not captured by the agreement. US negotiators knew about that program in the 1990s, and were watching it, but decided that ending Korea’s operating plutonium-production capabilities and getting inspectors on the ground was the crucial first step, and with that in place the uranium program could be addressed as a next step. The Agreed Framework was not meant to be all-encompassing—it was an important, logical step toward solving the bigger problem that was too complex to be solved all at once.

The Iran deal was similarly seen by those negotiating it as a meaningful, achievable step toward solving the bigger issues that could not be addressed all at once. And it has been successful at doing that.

Drifting toward disaster

In the case of Iran, as well as North Korea, President Trump is taking provocative steps that go against the advice of his senior advisors—and in many cases simply defy common sense. The stakes are extremely high in both cases. Dealing with them requires an understanding of the issues and potential consequences, and a long-term strategy built on realistic steps and not magical thinking.

If Trump de-certifies the Iran agreement, he will be tossing the fate of the deal to Congress. Congress needs to heed the advice the president is not taking. That means it should listen to Secretary of Defense James Mattis; Gen. Joseph Dunford, chair of the Joint Chiefs of Staff; Secretary of State Rex Tillerson; and others who believe it is in the best interests of the United States to continue to support the agreement.

We find ourselves in a situation in which the whims of the president are escalating conflicts that potentially put millions of lives at risk and create long-term security risks for the United States, and no one appears to have the ability to reign him in and stabilize things. That situation should be unacceptable to Congress and the US public. If this situation continues, it could go down as one of the darkest periods of US history.

Well-Deserved Recognition: ICAN Wins Nobel Peace Prize

For most of my professional life going back to the late 1980’s, I have been a nuclear weapons organizer/campaigner.  It’s my life’s work.  Over all these years, no group of campaigners has impressed me more than the good folks with the International Campaign to Abolish Nuclear Weapons (ICAN).  Their skill, passion, energy, professionalism and unrelenting doggedness is truly inspiring in our mutual pursuit of a safer world free of nuclear weapons.

I am not the only one who feels this way and today I am so pleased to join a global chorus of folks honoring and congratulating ICAN for being awarded the Nobel Peace Prize for their “work to draw attention to the catastrophic humanitarian consequences of any use of nuclear weapons and for its ground-breaking efforts to achieve a treaty-based prohibition of such weapons.”

It is hard to overstate how significant an achievement it was to get 122 nations to join together and adopt this treaty –one vigorously opposed by all of the nuclear weapons states and those under their nuclear protection.

To this day, the many supporters of the US nuclear status quo—both within and outside of the government—are full of excuses for not acting and not aggressively pursuing disarmament.  Even worse, the United States seems to be going in the wrong direction with all of the talk of, and plans for, new more usable nuclear weapons and the rebuilding of the entire US nuclear arsenal at a cost that is sure to exceed $1 trillion of our tax dollars. The international discussion that ICAN has been leading about nuclear weapons and humanitarian consequences is even more important in that context.

Similarly, it’s well past time for a debate on the morality of threatening millions of innocent civilians in the name of national security.  And who thinks it’s OK that one person has the power and authority to effectively end humanity?

What ICAN and many of us are saying is: let’s get serious folks (we are looking at you. nuclear weapons states) about nuclear disarmament before our luck runs out.

But for now, let’s raise our glasses and congratulate and honor everyone at ICAN and elsewhere who wake up every day and work so hard—against such incredible odds—to prevent nuclear war and make the world a safer, better place.  I thank you.  My children thank you.