REFRESH — SATAN’s Code: The Early Years of Accident Models

Thomas Wellock
Historian

When the first mass-produced computers hit the stage in the 1950s, nuclear engineers saw the opportunity to use them to help run accident scenarios. It was a good idea that took decades to become reality and the computer limitations created early uncertainty about reactor safety.

refresh leafIn 1954, Westinghouse experts put together a homemade digital computer that read punch tape. With a practiced ear, you could tell from the computer sounds which program was being run.

In 1959, Battelle Memorial Institute developed an early Loss-of-Coolant-Accident model for a heavy-water plutonium reactor. The program was run on an IBM-650/653, the first mass production computer ever developed. The 650 weighed more than a 1955 Cadillac Deville, had vacuum tubes, and used a punch-card reader. Even if it had the memory and someone willing to load the 50 million cards, it would take six months to boot up Microsoft Windows 7.

Fortunately, Battelle’s code was a mere 166 cards. It calculated the behavior of just one fuel rod (modern reactors have thousands of rods) and took minutes to produce one data point.

For the sake of speedier results, gross simplifications were made. For example, an ideal accident code would have broken a reactor cooling system into many small volumes and done extensive calculations on each one to accurately simulate the complex conditions that existed throughout the reactor core and piping. But to run it on mid-1960s computers could take days. As a result, Westinghouse’s FLASH code used just three volumes to represent the whole reactor system.

At least they had computers. Neither the Idaho National Labs, a center for accident-code development, nor the Atomic Energy Commission had them. INL relied on weekend visits to the University of Utah. At the AEC, engineer Norm Lauben begged time from the National Bureau of Standards. Norm drove to the Bureau’s headquarters in Gaithersburg, Md., in the morning to submit his job on the 12,000-line RELAP-3 code, and returned after lunch to pick up the results.

Engineers were confident that the codes would prove reactor designs were overly conservative. Early results dashed their optimism.

When Westinghouse proudly unveiled its 70-volume SATAN code in 1970, AEC staffers discovered errors in the code indicating that the company’s Emergency Core Cooling System might fail in an accident. The problems of the SATAN code helped lead to a major rulemaking hearing in 1972 on the adequacy of both emergency cooling system designs and accident codes. Those hearings revealed just how embarrassingly uncertain and rudimentary the early codes were about what happened during an accident.

The AEC and later the NRC had to make a huge investment in creating more robust – and accurate – codes. Additional research that produced the RELAP-5 Code that became an industry standard worldwide.

REFRESH is an occasional series where we revisit previous blog posts. This post first ran in July 2011.

NRC Issues Comprehensive Inspection Report on Arkansas Nuclear One

Victor Dricks
Senior Public Affairs Officer
Region IV

The NRC has just issued a lengthy report documenting the results of a comprehensive inspection conducted earlier this year at Arkansas Nuclear One, or ANO. The plant, operated by Entergy Operations, Inc., is located in Russellville, Ark.

anoOn March 4, 2015, the NRC moved ANO into Column 4 of the agency’s Action Matrix (where operating plants with significant performance issues receive the second highest level of NRC oversight). This followed inspection findings of substantial safety significance stemming from a heavy equipment incident as well as degraded flood protection at the site. As part of its increased oversight of ANO, the NRC conducted a rigorous, independent, diagnostic assessment of the performance, programs and processes at the site earlier this year.

A team of 27 NRC inspectors from all four NRC regional offices and NRC headquarters spent about 3,800 hours of direct inspection. They concluded that despite its problems, ANO has been –- and continues to be — operated safely. This judgement was based on the fact there have not been any safety-significant inspection findings since the plant’s move to Column 4. Inspectors also concluded the robust plant design had not been compromised and the ANO staff’s operational focus has improved.

In addition to inspecting ANO’s program for evaluating and correcting performance issues, the NRC team developed insights into the causes for the performance decline at ANO. The team also evaluated the adequacy of a third-party safety culture assessment ANO commissioned. Additionally, the NRC inspection included an assessment of how well ANO determined the root causes for its performance deficiencies and developed performance improvement programs.

PI_ROPBased on Entergy’s review of the causes of the performance decline, the independent third-party nuclear safety culture assessment findings, and the results of the NRC’s independent diagnostic evaluation, “the team determined that Entergy understands the depth and breadth of performance concerns associated with ANO’s performance decline,” NRC Region IV Administrator Marc Dapas said in a letter to Entergy officials accompanying the report.

Dapas further stated that “effective implementation of the comprehensive recovery plan, supported by the allocation of adequate resources and continued enhanced oversight by Entergy leadership, should lead to substantial sustained performance improvement.”

The NRC team documented 16 findings of very low safety significance. The 243-page report goes into a high level of detail about the results of the inspections, but here are some highlights:

  • Resource reductions and leadership behaviors were the most significant causes for ANO’s declining performance. Entergy reduced resources across its fleet in 2007 and 2013, but it did not adequately consider the unique staffing needs for ANO created by having two units with different designs.
  • ANO management did not reduce workloads through efficiencies or the elimination of unnecessary work, as was intended as part of the resource reduction initiatives. Leaders attempted to prioritize work with the available resources, but they did not address expanding work backlogs. Over time, this contributed to equipment reliability challenges.
  • An unexpected increase in employee attrition between 2012 and 2014 caused a loss in experienced personnel, which led to a reduced capacity to accomplish work, and an increased need for training and supervision.
  • Since 2007, the reduced resources created a number of changes that slowly began to impact equipment reliability. The Entergy fleet reduced preventive maintenance and extended the time between some maintenance activities.

Although ANO is in the early stages of implementing its comprehensive recovery plan, there have been some notable improvements in station performance. ANO implemented prompt action to improve operator performance, for example, and ANO management decision making has increased in rigor and conservatism. The NRC resident inspectors have noted a number of examples that indicate the operations department is taking a leadership role and raising the standards across the station. Also, employees are engaging in discussions of the potential risk of plant activities, and the corrective action program rigor has improved. And ANO staff have begun to question the status quo and emphasize the need to assess and address problems.

The NRC inspection team reported its preliminary findings at an April 6 public meeting held in Russellville. The NRC is preparing a Confirmatory Action Letter to document Entergy’s commitments to address performance issues identified in the inspection report and the key actions needed to ensure sustained improvement in safety performance. The NRC expects to issue this letter and make it publicly available later this month.

NRC will conduct quarterly inspections to verify that ANO successfully undertakes all necessary improvement actions. From these inspections, NRC will independently determine whether ANO’s corrective actions have been effective and whether, after a period of sustained good performance, the NRC can return ANO to normal oversight.

An Outage Twist: Degraded bolts at New York Nuclear Plant Warrant Attention

Neil Sheehan
Public Affairs Officer
Region I

When the Indian Point Unit 2 nuclear power plant entered a refueling and maintenance outage in early March, the to-do list included a task born of industry operating experience, both in the United States and overseas.

BaffleBoltsGraphic1_cleanbigfontSpecialists were geared up to check on the condition of bolts employed in the reactor vessel at the Buchanan, N.Y., facility. These are the kind of bolts you likely wouldn’t find at your local hardware store. Rather, they are made of a stainless-steel alloy capable of withstanding decades’ worth of neutron bombardment, as well as extraordinarily high temperatures and pressure.

Measuring about 2 inches in length and 5/8ths of an inch in diameter, the bolts hold in place a series of vertical metal plates. Known as baffle plates, they help direct water up through the nuclear fuel assemblies, where it is heated and subsequently used for power production.

The baffle plates are attached to eight levels of horizontal plates called baffle-former plates, which are in turn connected to the reactor core barrel.

As far back as the late 1980s, cracking was identified in baffle-former bolts – the bolts securing the baffle plates to the baffle-former plates — in pressurized-water reactors (PWRs) in France. (Both Indian Point Units 2 and 3 are PWRs.) The degradation is caused by what is known as irradiation-assisted stress corrosion cracking.

In response, the U.S nuclear industry began checking on these bolts in a small number of domestic PWRs on a sample basis.

The NRC staff also made use of a communications tool called an Information Notice to advise U.S. plant owners of what had been observed in Europe. A March 1998 notice let U.S. plant owners know that the baffle-former bolt cracking reported in foreign PWRs had occurred at the juncture of the bolt head and the shank, a location not accessible for visual examination.

Several U.S. plants subsequently evaluated their baffle-former bolts and in some cases replaced a sizable number.

Jumping ahead, the Electric Power Research Institute developed a standard industry program for the aging management of PWR reactor vessel internals and submitted it to the NRC in January 2009. The NRC staff approved the approach in an agency safety evaluation issued in December 2011 and then published in January 2012 as MRP-227-A. (MRP is short for Materials Reliability Program.)

Under this new standard, U.S. PWRs were to conduct an initial ultrasonic examination of all of their baffle-former bolts when the plant had between 25 and 35 effective full power years of service.

This is exactly what was being done at Indian Point Unit 2 during the current outage. It was adhering to the standards of MRP-227-A. In the course of this review, it was determined that 227 of 832 baffle-former bolts at the plant were degraded, which means any indication of cracking. What’s more, two bolt heads were missing.

The number of degraded baffle-former bolts was the largest seen to date at a U.S. reactor.

Entergy, Indian Point’s owner, is in the process of analyzing the condition and replacing the degraded bolts. It will also assess any implications for Indian Point Unit 3, though that reactor is believed to be less susceptible to the condition for several reasons, including fewer operational cycles.

As for the NRC, we will independently review the company’s analysis and bolt-replacement plans to ensure safety. The results of those reviews will be documented in an upcoming inspection report for the plant.

We have already had a metallurgical specialist on-site reviewing the company’s evaluations of the bolts and have agency experts reviewing the matter.

More information will be forthcoming on the issue. However, it’s important to note that the NRC staff will ensure the condition is fully understood and addressed prior to the plant returning to service. The NRC staff will also consider all available information in evaluating if changes are needed to the current inspection programs for these bolts across the industry.

 

NRC Talks Research in Tennessee

Salman Haq
Reactor Engineer
Office of Nuclear Regulatory Research

We recently issued the draft report summarizing detailed research and analyses into what might happen during an accident at a nuclear power plant. Tomorrow, we’ll head to the third plant we analyzed, Sequoyah Nuclear Plant, to discuss the results with the surrounding communities. The plant is located in Soddy-Daisy, Tenn.

Cover of SOARCA Communications Brochure (NUREG BR-0359 Rev2)The project, called the State-of-the-Art Reactor Consequence Analyses, or SOARCA, looked at potential situations that could disable a reactor’s normal safety systems. The project used powerful computer programs to predict the plants’ behavior based on decades of real-world experiments into issues such as how reactor fuel responds during the extreme temperatures expected during these accidents.

SOARCA then plugged up-to-date information about the plants into the programs and examined how a potential accident might unfold.

We found that safety equipment the NRC required after the 9/11 attacks, or additional equipment that industry voluntarily added following the Fukushima event, if used according to plan, would help prevent or mitigate a reactor accident. Even for the most severe accidents the research came to three basic conclusions:

  • Accidents occur more slowly than we originally thought;
  • Accidents release less radioactive material than we originally thought; and
  • The emergency plans every U.S. reactor has in place can help keep people safe.

The project came to some more specific conclusions about accident effects around the three plants, Surry (southeast of Richmond, Va.), Peach Bottom (southeast of Lancaster, Pa.), and Sequoyah. For example, the slowly developing nature of the accidents and the existing emergency plans would help keep people safe, even during uncontrolled accidents.

Some of the NRC staff involved in SOARCA discussed the Sequoyah project on April 20, at the TVA Sequoyah Nuclear Training Building.

If you have comments on the draft report, you have until May 12, 2016 to send them in. The best way to comment is through regulations.gov, using Docket ID NRC-2016-0074. You can also mail comments (referencing the Docket ID) to Cindy Bladey, Office of Administration, Mail Stop: OWFN-12-H08, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001.

If you submit comments in writing or in electronic form, they will be posted on the NRC website and on regulations.gov. The NRC will not edit or remove any identifying or contact information; please don’t include any information you wish to keep private.

We’ve also developed a public communications brochure to help explain the SOARCA project to a wider audience of stakeholders using plain language and more illustrations.

NRC Oversight at Pilgrim Plant Entering a New Phase

Neil Sheehan
Public Affairs Officer
Region I

One phase down but more to go. We’re referring here to the multiple steps involved in the NRC’s heightened oversight of the Pilgrim nuclear power plant.

pilgIn January, an NRC team completed Phase “A” of the multi-step inspection process required for plants that end up in Column 4 of the agency’s Action Matrix. Pilgrim received that designation last September based on earlier performance issues.

This first inspection examined various aspects of the Plymouth, Mass., plant’s corrective action program, which is in place to ensure that problems, once identified, are fixed on a timely basis according to their safety importance.

Our report on that review noted the identification on one inspection finding of very low safety significance involving a failure to adequately correct water leakage from the core spray system. Otherwise, the inspectors determined that there were no longstanding risk-significant issues in the program that were not addressed or assigned appropriate corrective actions and due dates.

Beginning today, the Phase “B” review will get under way at the facility. This inspection will focus additional attention on the corrective action program but with emphasis on its effectiveness more recently, specifically since the plant began undergoing increased scrutiny last summer.

As was the case with the first phase, the results will be documented in a report due out within 45 days after the assessment has been formally concluded, or exited.

The most comprehensive phase of this process (known in NRC terms as a 95003 inspection) will take place later this year or in early 2017. It will zero in on areas that will include human performance, equipment reliability and the quality of plant procedures, as well as the site’s safety culture, or the willingness of employees to freely and openly raise safety concerns. The corrective action program will also receive another look.

In the meantime, the NRC will be updating the public on Pilgrim’s performance during 2015 at a meeting scheduled for Wednesday, April 13, in Plymouth. We’ll also be taking questions, including those pertaining to our additional oversight of the plant. Further details will be available soon in a meeting notice to be posted on the agency’s website.

More information on NRC oversight activities at Pilgrim can be found on our webpage devoted to the subject.

A Chilling Effect is Not Cool

Roger Hannah
Senior Public Affairs Officer
Region II

The NRC Region II office issued a “chilling effect” letter to the Tennessee Valley Authority’s Watts Bar nuclear plant this week, but what exactly does that mean?

The “chilling” has nothing to do with weather, but rather refers to a workplace environment where employees may be hesitant to raise safety concerns for fear of retaliation or because previously raised concerns were not adequately addressed.

wbIn the Watts Bar case and several others before it, the NRC identified situations where some employees told the NRC they might be reluctant to talk to their supervisors, managers or even the NRC about safety issues because they were afraid of potential effects on their jobs. At Watts Bar, these concerns arose in the operations department, but the NRC takes those concerns very seriously whether they are isolated or more widespread.

When the NRC issues a “chilling effect” letter to a nuclear plant or any other licensed facility, it is designed to ensure that those organizations are taking appropriate actions to foster a workplace environment that encourages workers at all levels to raise safety concerns without the fear of retaliation and management to promptly and effectively address the concerns.

The NRC met with TVA officials March 22 to discuss the work environment concerns and the letter issued the following day simply puts into writing the expectations that the NRC has for TVA to address the concerns at the Watts Bar plant.

TVA officials are being asked to provide a plan that describes how work environment issues at the Watts Bar plant will be addressed and then attend another public meeting to discuss both that plan and how the NRC will monitor and inspect any corrective actions.

The NRC is confident that most workers at the Watts Bar plant and throughout the nuclear industry feel safe in raising safety concerns within their own organizations or directly to the NRC. That ability is an important supplement to the NRC inspection program in ensuring the safety of the facilities the agency regulates.

Any attempt to influence that ability will not be tolerated by the NRC and there are other similar letters in the past showing just how uncool the NRC finds any workplace chilling effect.

 

 

Crossing the Finish Line at Watts Bar

Joey Ledford
Public Affairs Officer
Region II

Watts Bar Unit 2, the nation’s first new commercial nuclear unit in a generation, received its NRC operating license last October and is closing in on its first nuclear chain reaction. (Power production is still a ways off.) The NRC is still on the job as the staff transitions to operational inspection duties.

An NRC inspector looks on as TVA workers install components at Watts Bar Unit 2.
An NRC inspector looks on as TVA workers install components at Watts Bar Unit 2.

The agency’s Region II-based construction inspection staff, supplemented by headquarters staff, have booked more than 127,000 hours making sure the new unit has been built according to its design specifications. More than 350 agency inspectors and other staff have been involved in the inspection and project management effort, which geared up in earnest in 2008 when the Tennessee Valley Authority committed to completing the unit it had initially started building in 1973 and later suspended.

The Watts Bar plant, located about 50 miles northeast of Chattanooga, Tenn., has a unique history. Unit 1, which also traces its roots to 1973, was the last U.S. plant to come on line when it was finally licensed in 1996 after a similarly lengthy construction hiatus.

When work resumed on Unit 2, the NRC recalled a handful of staffers who had been involved in inspecting work on the sister unit to ensure “knowledge transfer.”

“Our goal is to verify the design is accurate,” said James Baptist, who was a team leader for several years during Watts Bar 2 construction and has recently become chief of the Region II branch overseeing the transition from construction to operation. “We want to ensure Unit 2 looks and operates just like Unit 1. It greatly assists the effort when you have a working model right beside you.”

As is the case with most NRC inspection efforts, the corps of construction resident inspectors led the way, reporting to the site daily and amassing a big percentage of those 127,000 hours.

“Everything came through the residents in terms of what was going on at the site,” said Chris Even, who recently transitioned from senior construction project manager to senior project inspector in the new branch overseeing the transition. “We always relied on the residents for knowing exactly what was going on.”

The workload was huge from the beginning, with more than 550 construction inspection items to be inspected and closed. And Baptist noted that even though the plant was designed in the 1970s, it’s built to today’s standards.

“They purposely built Unit 2 to be a mirror image of Unit 1 while including all the updated safety enhancements that have accrued over the last 25 or 30 years,” he said.

For example, Watts Bar is the first plant in the nation to comply with all the NRC’s post- Fukushima upgrades as well as the newest cybersecurity requirements.

One might think that with the license issued and the plant about to start up that the NRC inspection effort would be winding down. Baptist said that is not the case.

“We still have our foot on the gas,” he said.

Just as the NRC inspectors were dedicated to make sure Watts Bar Unit 2 was constructed and tested according to the design and NRC regulatory requirements, they will continue to maintain that vigilance as the plant begins and continues to operate.