When concern started to grow about the strength of the containment of one type of reactor in particular, the Mark I boiling water reactor, the NRC found itself in a straitjacket. If the agency were to require safety fixes for the Mark I containment on the basis of “ensuring” or “redefining” adequate protection, this would be seen as an admission that the fleet of Mark Is was unsafe. Otherwise, the NRC would have to prove the benefits justified the costs. That option would leave the fate of any safety improvements at the mercy of the risk assessors.
In the 1980s, there were twenty-four GE Mark I boiling water reactors in the United States. Because of their relatively small and weak “pressure suppression” containment structures, these reactors had been controversial almost from the time that the first commercial version, Oyster Creek in New Jersey, went on line in 1969. After the hydrogen explosion at Three Mile Island, in 1981 the NRC required that the relatively vulnerable Mark I and II containments be “inerted” with nitrogen gas to prevent such explosions.
But that was not the Mark I’s only problem. As NRC staff members began to contemplate events they had never thought possible before Three Mile Island, additional frightening scenarios began to emerge. For instance, if a prolonged station blackout were to occur, operators would lose the ability not only to cool the core but also to remove heat from the containment, which could eventually over-pressurize and leak through seals not designed to withstand such high pressures and temperatures. Even worse, if power were not restored, the core would melt through both the reactor vessel and the steel containment liner. Such events would inexorably result in breaches of each of the multiple layers meant to prevent radioactive materials from reaching the environment.
The NRC was already addressing station blackout issues under a 1988 regulation. But that only required plants to develop a strategy to cope with a blackout for no more than sixteen hours. A prolonged station blackout at a Mark I reactor—one longer than the 1988 rule contemplated—would defeat the NRC’s “defense-in-depth” multiple-barrier strategy for protecting the public. An NRC task force convened in 1988 to study the liner melt-through issue concluded that this vulnerability was a “risk outlier” that warranted prompt attention.
That was easier said than done, because the industry’s IDCOR program was already out front with its opposite argument. At the same time the NRC’s analyses were raising alarms about liner melt-through, IDCOR was asserting that the risks of core damage and containment breach were very low. In addition, an industry group, the Nuclear Utility Management & Resources Council (now folded into the Nuclear Energy Institute), immediately submitted a report opposing the NRC task force’s conclusions, asserting that generic hardware modifications to the Mark I were not cost-beneficial because “the total risk from severe core melt accidents is low.” In place of mandatory fixes to the Mark I, the industry wanted the NRC to consider plants on a case-by-case basis as part of the ongoing Individual Plant Examination program, which would take many more years to complete.
For the next several years, the NRC staff and the industry continued to wield dueling technical analyses to get the upper hand with the commissioners. To complicate matters, the NRC staff itself was divided, with some members aligning with the industry. The trade journal Inside N.R.C., covering a three-day meeting in 1988 in which quarrelling NRC staff and officials were sequestered in a Baltimore hotel, quoted sources as stating that “there is literally a war going on” and alluding to instances in which “disagreement over the Mark I issue led to threats involving job security and research funding.” One source told Inside N.R.C. that “there are some senior staff members who are doing everything they can to make sure the game is played by industry’s rules . . . if the industry can win this one, they can win everything.”
At the core of the dispute was the question of how much risk the Mark I fleet posed (an issue that would again loom large in 2011). Although the NRC’s analyses showed a high likelihood that a Mark I reactor’s containment would fail if the core were damaged, even the agency’s staff believed that the chance of core damage was low—perhaps lower than at a pressurized water reactor like Three Mile Island. So the overall risk to the public might not be any greater from the Mark I than from other reactor types.
If so, it would be hard to demonstrate that fixing the Mark I problems would reduce risks by a big enough factor to satisfy the requirements of the backfit rule. And the majority of commissioners would not be likely to perturb the cherished meaning of “adequate protection” to address the problem via that route. A few weeks after the contentious Baltimore meeting, Themis Speis, the director of the NRC’s research office, wrote an internal memorandum in which he contended that improvements to reduce the likelihood of containment failure would probably be blocked by the backfit rule.
Notwithstanding a likely defeat, the NRC staff went before the commissioners in early 1989 with a proposal for five critical improvements for Mark I plants that reduce their risk of core damage and containment failure. The staff asked the commissioners to:
•Speed up implementation of the 1988 blackout rule.
•Require acquisition of backup water supplies and pumps that could operate in a station blackout.
•Require hardened torus vents that could be used during accidents to expel steam and other gases to reduce containment pressure and temperature. Crucially, operators should be able to open and close the vent valves remotely and in the absence of AC power.
•Require that the systems needed to automatically depressurize the reactor vessel in an accident—an essential step to be able to pump emergency coolant into an overheating core—be made more reliable, especially in the case of an extended station blackout when the battery power needed to operate the valves would not be available.
•Require more robust emergency procedures to ensure that operators could effectively utilize all this new hardware.
The staff argued that certain Mark I containment failure modes, such as liner melt-through, could not be stopped should a core meltdown occur. The only strategy was to prevent meltdowns in the first place—and for that the backup coolant supplies and hardened containment vents were crucial. The staff presented calculations supporting its claim that the improvements would pass the backfit test. The staff’s analysis showed that the owners of the Mark I could reduce the likelihood of core damage by a factor of ten by installing hardened vents: a substantial safety increase. The staff’s calculations also showed the cost of the improvements justified the benefits.
At the commission meeting, the NRC staff faced a hostile audience in Commissioner Thomas Roberts and his colleagues. They were not helped by the fact that the Advisory Committee on Reactor Safeguards, the independent panel that reviews NRC activities, also vigorously opposed the staff and supported the industry.
Despite the commissioners’ skepticism at the briefing, they remained deadlocked for months on the Mark I improvement proposal. The tiebreaker was Commissioner James Curtiss. The NRC staff told Curtiss that if the commissioners did not vote for the containment improvement program, and instead folded it into the Individual Plant Examination program, Mark I fixes would be put off for another five years. Curtiss apparently believed resolving the issue could not wait that long.
In July 1989, the commission finally made its decision. Although the final vote was 3–2 in favor of taking action, the outcome was far short of what the staff had requested. Of the five recommendations, the commission accepted only two, and even then it pulled its punches. First, it authorized speeding up the timetable for Mark I plants to comply with the station blackout rule—but this was an easy call, since it did not involve new requirements. Second, the commission decided to take action on hardened containment vents. But, reluctant to directly confront the industry on such a sensitive issue, the NRC gave Mark I owners an offer they couldn’t refuse: install hardened containment vents voluntarily or the NRC staff would conduct plant-specific backfit analysis to determine if the agency could legally require
them to comply.
The commission’s offer presented an easy choice for most Mark I owners. If they installed the vents as a voluntary initiative, they would not have to submit a license amendment to the NRC for approval, and the NRC would have almost no regulatory control over the vents.3 Although the NRC set basic standards for the design, construction, maintenance, and testing of the vents, Mark I operators would be under no obligation to meet them. The NRC would also have no authority to issue violation notices if it found problems, unless the vents interfered with other safety systems. In contrast, if the agency could show that the hardened vents passed the backfit test, it could force reactor owners to install and maintain them on the NRC’s terms.
Initially, owners of all but five reactors decided to voluntarily install hardened vents. For the holdouts, the NRC followed through on its threat and did backfit analyses, concluding that it could require all five to install the vents. Four of the plant owners gave up at that point and “voluntarily” complied before they were forced to. The fifth owner—the New York State Power Authority—went on the offensive, challenging the staff’s analyses and cost-benefit calculations regarding its James A. FitzPatrick nuclear plant. This time, it was the NRC’s turn to buckle. FitzPatrick, located on Lake Ontario near the town of Oswego, became the only Mark I BWR in the United States that did not harden its vents.
The NRC staff audited some of the hardened vent designs and inspected the hardware and operating procedures after the vents were installed. But the fact that the licensees had performed the work voluntarily severely restricted the NRC’s ability to ensure that the vents would be usable when needed.
And there was good reason to believe that they wouldn’t be usable. The vents were designed to operate only within the design basis of the plant and only before core damage occurred. That meant that in the event of more severe conditions—high radiation fields, heat, or pressure—the vents might not function. And the NRC staff did not even require the vents to function during a station blackout, relegating that issue to future consideration in the Individual Plant Examination program. Once again, it was one step sideways.
As to the remaining three staff recommendations for Mark I improvements—alternate ways to inject water, improved reliability of reactor vessel depressurization, and emergency procedures and training—the majority of the commissioners supported the industry position that they should be folded into the quasi-voluntary IPE program. Accordingly, later in 1989 the NRC sent a letter to Mark I licensees meekly stating that the NRC “expects” them to “seriously consider these improvements during their Individual Plant Examinations.”
This lackluster request received a lackluster response. When the NRC finally reported on the results of the IPEs in 1996, seven years after the project began, it noted that in several cases the licensees indicated that the containment performance improvements were being “considered, but do not identify the recommendations as commitments.” Most of the Mark I plant owners stated that they already had alternate water sources and merely credited them in the IPE; some did not even bother to credit them. With regard to emergency training, the licensees simply committed to voluntary industry guidelines. And with regard to enhancing the reactor vessel depressurization system, many licensees did not respond at all. The NRC claimed victory in those cases when licensees actually did something, but it was powerless to compel any of them to do more; much less could it conduct thorough reviews and inspections to verify that what they had done would lead to meaningful safety improvements.
One could hardly judge the outcomes of the Mark I containment improvement program and the IPEs to be successes. Yet they set a major precedent for dealing with severe accident issues through “voluntary industry initiatives” (sometimes also confusingly called “regulatory commitments”). Like the backfit requirements of the 1980s, this was in keeping with the regulatory trends of the times, in which industry “self-regulation” tools like voluntary codes of conduct were increasingly used to forestall new government mandates, despite concerns about foxes guarding henhouses. For its part, the nuclear industry now could tout its voluntary actions as examples of its commitment to safety beyond what the NRC required.
One of the key voluntary industry initiatives of the 1990s was the development of Severe Accident Management Guidelines, or SAMGs. These were emergency plans plant operators were to use during an accident in which core damage had already occurred or was imminent. (SAMGs were to be used if a plant’s emergency operating procedures, which in contrast were regulated by the NRC, failed to prevent core damage.) In 1994, the industry, under the auspices of its newly constituted advocacy group, the NEI, developed a guideline document that all licensees promised to adopt. Once again, however, because the SAMGs were voluntary practices, the NRC was virtually powerless to ensure that they would be workable and that plant workers would be appropriately trained to use them.4
Mark I containments were not the only ones that concerned the NRC; the Mark II had similar issues. Also, another type of containment—the Westinghouse ice condenser, a PWR version of a pressure-suppression containment—was vulnerable to failure in severe accidents, especially in the event of a hydrogen explosion. (Although it required the Mark I and II to be inerted with nitrogen gas, the NRC had not done so for ice condensers, or another model of BWR called the Mark III.) Several years after Three Mile Island, the NRC had required owners of ice condensers and Mark III plants to install igniters—similar to spark plugs—that could burn off hydrogen accumulating in a containment before it reached an explosive concentration. However, those igniters required AC power to function, so they wouldn’t be available in a station blackout, a potentially major weakness. Even the gold standard—large, dry PWR containments—might be vulnerable to accidents in which the reactor vessel failed at high pressure. But the NRC’s failure to impose meaningful changes on the Mark I, perhaps the worst of the lot, did not bode well for the future of the containment improvement program.
Over time, the NRC staff appeared to lose its appetite for grappling with the industry over new requirements to reduce severe accident risk. Even worse, in response to growing political pressure, the NRC decided to sweep other stubborn issues under the rug. In fact, as Three Mile Island receded into the past and no other Western-designed reactor experienced an event to jolt the memory (Chernobyl didn’t really count, as it was considered an exotic Soviet beast), the agency in the 1990s embraced a sentiment that its requirements were not too lenient but rather too strict.
According to this line of thinking, severe accident risks were already so low that certain regulations could be weakened without significantly affecting safety. The NRC dubbed this approach “risk-informed regulation,” and counted on probabilistic risk assessment data to justify what it euphemistically referred to as “reducing unnecessary conservatism” but actually amounted to removing safety requirements. Risk-informed regulation was seen by critics (such as David Lochbaum of the Union of Concerned Scientists) as a “single-edged sword”: it was only used to reduce regulatory requirements, never to strengthen them.5
Reservations about the validity of probabilistic risk assessments faded as more and more utilities began to use them in regulatory applications. And why not? They seemed to enable the utilities to get what they wanted: less regulation. But even though PRA methodology had advanced, it still suffered from many of the same problems, including huge uncertainty factors when addressing earthquakes, other external events, and reactor shutdowns (when the risk of an accident can be surprisingly high). Again, the tendency of the NRC and plant owners when confronted with these uncertainties was to downplay or ignore them. As a result, safety decisions based on PRA analysis did not accurately account for the risks of these additional hazards. The misuse of PRA analysis did, however, lend credence to the concerns James Asselstine raised in his 1985 vote on the Severe Accident Policy Statement, when he accused his colleagues of deliberately ignoring uncertainties to minimize risks: “the Commission chooses to r
ely on a faulty [risk] number which supports the outcome they prefer.”
Take the issue of developing a reliable PRA for an earthquake, which very few plant owners have done. To perform the assessment properly one would need accurate estimates of the likelihoods of earthquakes at each magnitude; detailed models of the effect that a quake of each magnitude would have on plant structures; and a defensible analysis of how the earthquake damage would affect plant operation and the ability of operators to carry out manual actions. Assembling this information would be a daunting task, and the uncertainties at every step would be formidable. There is little wonder that the industry has had difficulty tackling seismic PRAs.6
Among the first regulations that the NRC set its sights on “risk informing” was a post–Three Mile Island requirement that all reactors install “recombiners” that could prevent the accumulation of hydrogen during a loss-of-coolant accident. In reconsidering the requirement for the Mark I and II, the NRC’s analysis found that the recombiners would not be needed to prevent hydrogen explosions during the first twenty-four hours after an accident because the reactor containments were inerted with nitrogen. However, the recombiners could be useful after twenty-four hours had passed because the inerting would become ineffective.7 Nonetheless, in 2003 the NRC eliminated the recombiner requirement, concluding that removing this equipment would not be “risk significant.” The reason: the SAMGs at those plants called for operators to vent or purge hydrogen in a severe accident, and the NRC believed that twenty-four hours gave them plenty of time to prepare to get that done. Based on this calculation, the agency concluded that the monetary value of the increased threat to public health was less than what the utilities would save by not having to maintain the recombiners—$36,000 per year per reactor.
Thus the NRC removed regulatory requirements to prevent hydrogen explosions in part by taking credit for voluntary initiatives—SAMGs—that it did not regulate. This type of twisted logic was typical of the risk analysis that enabled the NRC to weaken its regulations at the beginning of the twenty-first century.
Fukushima: The Story of a Nuclear Disaster Page 26