Part II: How the NRC Uses a Defense-in-Depth Approach Today to Protect the Public

Mary Drouin
Senior Program Manager
Division of Risk Assessment, Performance and Reliability Branch

Defense-in-depth is a central theme in the NRC’s regulatory oversight of the nuclear power industry. As our agency historian, Tom Wellock, discussed in Monday’s post, the concept of defense-in-depth emerged during the trench warfare of World War I. The idea of multiple lines of defense was applied to nuclear safety in the 1950s as the leading concept for protecting the public from the consequences of a nuclear reactor accident.

The NRC’s predecessor agency, the U.S. Atomic Energy Commission, spelled out defense-in-depth in a 1957 report called WASH-740, Possibilities and Consequences of Major Accidents in Large Nuclear Power Plants. “Should some unfortunate sequence of failures lead to destruction of the reactor core … no hazard to the safety of the public would occur unless two additional lines of defense were also breached,” the report said.

These words are at the heart of defense-in-depth as it has been practiced for six decades: multiple layers of defense to protect against accidents and their effects to ensure the risk to the public is acceptably low.

In a recent report issued this spring, Historical Review and Observations of Defense-in-Depth (NUREG/KM-0009), the NRC looks at how the concept has evolved in practice over the years. It also includes views from other government agencies and the international community.

As the report explains, defense-in-depth recognizes that our knowledge is imperfect. Although we plan for all conceivable accidents, the unexpected may still occur. Even if we have anticipated an event, its characteristics and impacts may be unpredictable. Our design and operation of nuclear plants need to be robust enough to compensate for this lack of knowledge. Defense-in-depth offers multiple layers of protection in case one or more layers fail.

So we don’t just rely on preventing an accident; we also need strong defenses to mitigate the effects of any accident that does occur. This applies to nuclear power plants, waste management and security as well.

In practice, defense-in-depth addresses three principles that should be factored into the design and operation of systems and components to provide additional confidence that an accident would not compromise the defensive layers:

  • Redundancy means more than one component performs the same function – for example, having multiple pumps instead of a single one;
  • Independence means these multiple components rely on separate and distinct attributes to function – the multiple pumps have separate piping from the water tank to where they discharge, and are housed in separate compartments; and
  • Diversity means the multiple components performing the same function rely on different design features to operate – motor-driven pumps versus steam-powered pumps.

dindgraphicIn reactor safety, the layers of defense might be:

  • Maintain reactor stability by limiting the ability of events to disrupt operation (with protective measures such as fire-safe or flood-tight doors, seismically designed buildings)
  • Protect the reactor should operation be disrupted (emergency reactor core cooling with redundant pumps)
  • Barrier integrity to guard against a release of radioactivity to the environment (leak-tight containment structures, filtered vents, containment sprays) and
  • Protect the public if a release does occur (emergency preparedness plans)

This versatile framework can apply whether the risk to the public comes from the reactor, spent fuel pool, nuclear waste or security threats.

When A Strike is a Possibility at a Plant

Diane Screnci
Senior Public Affairs Officer
Region I

Unionized workers at the James A. FitzPatrick nuclear power plant in Oswego, N.Y. recently voted to accept a new contract days before the current pact was to expire. The union representing operations, maintenance and radiation protection staff and Entergy, the company that owns the plant, reached a new four-year agreement.

While it was good news to learn an agreement had been reached, the agency had been tracking the status of the negotiations all along and was prepared to oversee that the unit would be operated safely during any job action.

We have procedures to make sure the owner is taking all of the appropriate steps to ensure continued safe operation in the event of a strike. For example, as a contract expiration is drawing near, the NRC Resident Inspectors assigned to the site and specialist inspectors from the Regional Office in King of Prussia, Pa., review the company’s contingency plans for staffing and other actions to prepare for a strike.

We don’t get involved in contract negotiations. We ensure that the requirements of the facility’s license and technical specifications are maintained at all times. At FitzPatrick and other plants facing an impending contract expiration, NRC inspectors ensure all emergency plan positions are properly staffed and that qualified licensed operators operate the plant. They also review the qualifications of replacement workers to verify they were properly trained to step in.

In the event of a strike at any plant, the NRC Resident Inspectors would be supplemented by additional NRC inspectors to provide round-the-clock NRC inspection coverage for the first 48 hours. We’d have continued additional site coverage for at least the first two weeks. If need be, we could continue enhanced inspector coverage for as long as necessary.

The NRC Wants to Put the “U” in Strategic Plan

Francine Goldberg
Senior Advisor for Performance Management

 

Well, we do realize there is no “u” in “strategic plan,” but the NRC is drafting its 2014-2018 road map and we want your input before we finalize it.

Picture1The plan is updated every four years and is used to guide our work. You may not be aware that all of NRC’s business lines (operating reactors, new reactors, fuel facilities, nuclear materials, etc.) link their annual plans to the strategic plan and all our senior executive performance plans are linked to it as well.

If you’re familiar with our previous Strategic Plan, you’ll notice our mission and strategic goals remain basically unchanged, but the new plan does contain some new components. For example, a vision statement has been added to emphasize the importance, not only of what we achieve, but of how we regulate And there are now three strategic objectives, one for safety and two for security.

Each objective has associated strategies and key activities that will be used to achieve them. For example, this is one of the strategies for the safety objective along with three key activities:

Ensure the NRC’s readiness to respond to incidents and emergencies involving NRC-licensed facilities and radioactive materials, and other events of domestic and international interest.

·        Use operational experience and lessons learned from emergency-preparedness exercises to inform the regulatory activities.

·        Coordinate with federal, state, local, and tribal partners to strengthen national readiness and response capabilities.

·        Employ outreach before, during, and after emergency-preparedness exercises, and increase collaboration and sharing of best practices and lessons learned after emergency-preparedness exercises and incidents.

The goal of the comment period is to take advantage of the collective knowledge of the public – there is a “u” in public, after all — to make sure our plan is as good as it can be.

Picture1Why should you take the time to comment? Well, perhaps you are aware of a key external factor that we have missed that could affect the strategies and activities we have planned. Or maybe you have ideas for additional strategies or activities we need to focus on to achieve one of our objectives. This is your opportunity to weigh in and tell us if we are addressing the issues of importance to you. 

All comments will be reviewed and incorporated, as appropriate, into a revised plan. The disposition of substantive comments will be included in a Commission paper transmitting the resulting plan to the Commission for their final review and approval. 

Please submit your comments online through the federal government’s rulemaking website, www.regulations.gov using Docket ID NRC-2013-0230; or by mail to Cindy Bladey, Chief, Rules, Announcements, and Directives Branch, Office of Administration, Mail Stop:  3WFN-06-44M, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001. The comment period is coming quickly. It closes on 04/04/2014. Comments on this blog post cannot be considered, so please use the official channels. More information is also available in the Federal Register Notice.

We look forward to hearing from you soon.

Spring Is Annual Assessment Time at the NRC

David McIntyre
Public Affairs Officer
 

cherrytreeSpring is here at last, and with it the season of NRC’s annual assessments of nuclear power plant performance during the previous calendar year. The Office of Public Affairs is issuing press releases faster than trees drop pollen announcing public meetings in the vicinity of each plant to update residents on how their local plants performed.

These meetings are routine, in that we hold them every year. Yet they are important, because they represent a report card of sorts on plant safety and because they give the agency a chance to reach out to its most important stakeholders — the people who live near the plants and have the highest stake in their safe operation.

The annual assessment letters were issued to the plants earlier this month. And the grades were mostly good. As of the end of December, 89 of 100 operating commercial nuclear reactors were in the two highest performance categories. Of those, 80 were in the highest level, with nine others requiring some additional oversight to correct issues of low safety significance. Another nine were in the third category, requiring even more oversight to correct what we call “degraded” performance.

More good news though – between December 31 and the time the assessments were issued, four of these 18 reactors in the lower second and third column had resolved their issues and moved back into the top category.

One reactor, Browns Ferry 1 in Alabama, is in the fourth performance category. It requires increased oversight because of a safety finding of high significance – including additional inspections to confirm the plant’s performance issues are being addressed.

Finally, Fort Calhoun plant in Nebraska is currently under a special NRC oversight program distinct from the normal performance levels because of an extended shutdown with significant performance issues. The plant remains under special oversight even though the NRC approved its restart last December.

You can find the report card for your local plant on the NRC website’s Reactor Oversight Process page. Just click on the plant’s name in the left-hand column, then look for the 4Q/2013 assessment report on the plant’s individual page. Here you will also find each plant’s current placement in the NRC action matrix, along with performance indicators and inspection findings. Press releases about when your local plant’s assessment meeting will be held can be found here.

An NRC Official Writes About His First-Hand View of the Japan Nuclear Disaster

Eric Leeds
Director, Office of Nuclear Reactor Regulation
 

Last month, I traveled to Japan with a group of senior NRC executives, including all four Regional Administrators. We spent a busy week meeting with representatives from various Japanese organizations involved in nuclear activities, as well as touring the Kashiwazaki Kariwa, Fukushima Dai-ni and Fukushima Dai-ichi nuclear power plants.

At the end of almost every day, we took time to reflect, to discuss what we learned, and to record our thoughts. I wanted to offer a few personal insights from what I found to be a profound experience.

On the bus ride to the Fukushima Dai-ichi Nuclear Power Plant, the site of the accident in 2011, we passed through the town of Tomioka, about 7 to 10 km south of the site. Before the accident, Tomioka had been a vibrant seaside village of approximately 16,000 residents. It was a resort town, with its own train stop, beachfront, restaurants and hotels.

test11The town is now empty, uninhabitable because of radiological contamination (about 1 microsievert an hour). There are no inhabitants, no electricity, no running water. The damage caused by the earthquake and tsunami remains. Those who had lived in the town are now allowed to enter to visit their homes, but they can’t stay overnight. The authorities are decontaminating the town and plan to have it inhabitable in about three years. Thinking about the people who, for all this time, have lost their homes, lost their jobs, and lost their community leaves me feeling sick to my stomach. For me, a career safety regulator, the feeling is very personal.

When we reached the site, we boarded a different bus, a bus prepared for a contaminated site, with plastic herculite covering the seats and more plastic and duct tape covering the floor. We donned a full set of anti-contamination clothing, shoe covers, and respirators. There are about 250 cars, trucks, and buses on site, ferrying a site workforce of about 4,000 workers. As we passed workers at the site and in other vehicles, it struck me that everyone was wearing full anti-Cs, respirators, and helmets. It left me with an eerie feeling, as if I were in a science fiction movie.

We toured the site, often leaving the bus to see specific site areas. While a great deal of work has already been accomplished, much of the damage from the earthquake and tsunami remains, if only pushed to the side. Broken buildings, twisted metal, crushed concrete and smashed vehicles still litter the site. TEPCO is currently moving the spent fuel from the Unit 4 spent fuel pool to the common pool for the site, and we toured both pools. Since we could not get into the containments of the damaged reactors due to the ongoing high dose rates, our hosts took us to the torus room of the undamaged Unit 5 containment, to show us where the containment vent valves were located on the damaged units. This was done so we could understand the difficulty the operators faced in trying to manually open the valves.

ericquote1I tried to picture the challenge for the operators, going into this confined area in pitch black, the heat stifling, the dose rate steadily increasing, looking for the valves they’d have to operate manually. The descriptions of the accident from the operators who lived through the ordeal will stay with me forever. Many of them truly believed they were going to die. They had no idea if their families survived the tsunami or where their families were. Yet they stayed and fought the accident. They were incredibly courageous.

I am more convinced than ever that the Fukushima lessons learned we are requiring the industry to implement are critical to ensure an accident like the one at Fukushima doesn’t happen here. We have to ensure the licensees fully implement, maintain, and exercise the Fukushima lessons learned. We have to make sure the licensees prepare their facilities and are ready to confront the unexpected. We are the ones who are accountable to and responsible for protecting the American public. It’s our job. For me, it’s personal. It’s what I’m here to do.

Thermal Hydraulics: Heat, Water, Nuclear Power and Safety

Scott Krepel
Reactor System Engineer
 

One of the most important safety questions in a nuclear power plant is: Can you cool the very hot nuclear fuel in an accident when normal cooling is disrupted? The scientific field best equipped to answer this question is called “thermal hydraulics.”

bwrThe first part of the term, “thermal,” relates to heat transfer, such as the movement of heat from the burner on a stove to the water in a pot via the metal of the pot. The second part, “hydraulic,” relates to the flow of a fluid such as water. The combination, “thermal hydraulics,” can be applied to systems where both the flow of fluid and the transfer of heat are important – such as a nuclear power plant.

I work in the NRC’s Office of Nuclear Regulatory Research as part of a team dedicated to expanding our understanding of thermal hydraulics and applying that understanding in nuclear power plant safety. Over time, we’ve put much effort into incorporating existing knowledge into the NRC’s thermal hydraulics computer simulation program, TRACE. This program allows NRC staff to construct computer models of the cooling systems of a nuclear power plant and then simulate accidents such as pipe breaks (but not wildly improbable events such as the considerable destruction caused near the end of a typical superhero action movie).

TRACE is constantly being pushed to become more accurate, reliable and versatile. Universities and test facilities around the world are conducting experiments and accident simulations to collect real-world data that can be used to determine TRACE’s ability to accurately predict specific phenomena. We use the outcomes to update the program as needed to make it more accurate and to better capture certain phenomena.

Sometimes, new safety issues may result in further investigation of certain scenarios and further evolution of TRACE. Ultimately, the goal of this work within the research arm of the NRC is to continuously expand our understanding of situations which may impact the cooling of the nuclear fuel. This knowledge can then be used to ensure that the public and the environment are protected in the unlikely event of an accident at an U.S. nuclear power plant.