Document Sample
NRC Powered By Docstoc

        In the wake of the Three Mile Island accident in March 1979, the Nuclear Regulatory
Commission (NRC) revamped its program for monitoring safety levels at nuclear power reactors.
Key components of the Systematic Assessment of Licensee Performance (SALP) program were
the biannual Watch Lists identifying problem-plagued reactors warranting heightening NRC
scrutiny. Following the Millstone debacle in March 1996, the NRC again revamped its safety
monitoring program. The Reactor Oversight Process (ROP) replaced SALP while the Action
Matrix replaced the Watch List. Like the Watch List, the Action Matrix identifies reactors
warranting heightened NRC attention. Unlike the Watch List, the Action Matrix reveals the
NRC’s quarterly assessment for every operating reactor via five columns. The Licensee
Response Column contains those reactors receiving normal NRC attention. The majority of the
reactors fall into this category. When the NRC detects a gradual performance drop, reactors
move into the Regulatory Response Column. If the performance decline persists, reactors can
move into the Degraded Cornerstone Column, the Multiple/Repetitive Degraded Cornerstone
Column, and finally the Unacceptable Performance Column. The NRC’s level of oversight
escalates as reactors transition through the columns – more and more NRC inspectors arrive on
the doorstep as a reactor moves farther and farther to the right on the Action Matrix. The Action
Matrix is the NRC’s equivalent to Santa’s list of who’s naughty and who’s nice.

        The three reactors at the Palo Verde nuclear plant west of Phoenix, Arizona “jumped”
from the Licensee Response Column in the 4th quarter of 2004 to the Degraded Cornerstone
Column in the 1st quarter of 2005. What prompted this jump was the NRC’s finding that, for over
a decade, workers had deliberately gone out of their way to empty water from portions of the
piping for the pumps that cool the reactor core and the containment building in event of an
accident. In the initial response to an
accident, the low pressure safety injection
(LPSI), containment spray (CS), and high
pressure safety injection (HPSI) pumps
transfer water from the refueling water tank
to cool the reactor core and containment.
When the refueling water tank level drops
below a certain point, a signal automatically
closes a valve between the tank and the
auxiliary building and opens two valves in
the piping between the containment sump
and the emergency pumps. This permits the
pumps to recirculate water collecting in the
sump for continued reactor core and
containment cooling. But from 1992 until 2004, workers deliberately kept the section of piping
between the two valves emptied of water.

 Washington Office: 1707 H Street NW Suite 600 • Washington DC 20006-3919 • 202-223-6133 • FAX: 202-223-6162
   Cambridge Headquarters: Two Brattle Square • Cambridge MA 02238-9105 • 617-547-5552 • FAX: 617-864-9405
  California Office: 2397 Shattuck Avenue Suite 203 • Berkeley CA 94704-1567 • 510-843-1872 • FAX: 510-843-3785
                                                                          November 22, 2006
                                                                          Page 2 of 5

        The safety studies the NRC reviewed before they originally licensed the three reactors at
Palo Verde had assumed that the piping for the emergency pumps would be filled with water.
After receiving the reactor operating licenses from the NRC, Palo Verde’s owner revised
procedures in 1992 to intentionally drain water from the piping between the two valves on the
line from the sump. When the NRC discovered in 2004 what had been done, they sanctioned the
company for increasing the chances the emergency pumps would not perform their safety
function during an accident and fined the company $50,000 for revising safety procedures
without first obtaining NRC concurrence as required by federal regulations. That unsafe, illegal
stunt moved the plant into the Degraded Cornerstone Column. On NRC’s list of who’s naughty
and who’s nice, Palo Verde is no longer nice.

       In recent years, Palo Verde has often been naughty more than it has been nice. An
abridged summary of the naughtiness:

                                                               March 31, 2006: The NRC
                                                               issued its final accident sequence
                                                               precursor analysis for the July
                                                               2004 empty piping problem. The
                                                               NRC determined the risk of core
                                                               meltdown to be 1.4x10-5 per

                                                              March 18, 2006: Unit 1 was
                                                              manually shut down to conduct
                                                              testing to confirm the source of
                                                              excessive vibration on the
                                                              shutdown      cooling     piping.
                                                              Unusual vibrations had first been
                                                              detected in 2001, but the
                                                              company’s efforts to correct the
                                                              problem proved futile and the
                                                              vibrations worsened with time.
                                                              After the reactor restarted in
                                                              December 2005 from a refueling
                                                              outage, the vibrations had
                                                              become so bad that the reactor’s
                                                              output was limited to less than
                                                              25 percent of rated. The
           shutdown cooling line was modified to reduce the vibrations.

           October 11, 2005: Units 2 and 3 were manually shut down (Unit 1 was already shut
           down) after it was discovered that the level in the refueling water tank following a
           certain accident could drop low enough to enable vortexing and/or air entrainment
           and disabling of the emergency pumps – a deficiency that had existed for nearly two
           decades. On this same day, the NRC issued its final accident sequence precursor
           analysis for the June 2004 loss of offsite power event. The NRC determined the risk
           of core meltdown for Unit 2 had been 4x10-5 per year and the risk for Units 1 and 3
           had been 9x10-6 per year.
                                                                 November 22, 2006
                                                                 Page 3 of 5

May 23, 2005: Workers replaced 9 of the 36 heaters in the Unit 3 pressurizer. The 36
heaters had been replaced during the fall 2004 refueling outage, but four of the
replacement heaters failed after the reactor restarted. After the reactor restarted from
the May 2005 maintenance outage, five more of replacement heaters failed. Unit 3
was manually shut down again to replace all of the problematic heaters. Subsequent
investigation revealed that the heaters installed during the fall 2004 outage had longer
heater elements than in the original design. The improperly sized heater elements did
not dissipate heat away from the electrical connections, causing the connections to

June 14, 2004: A disturbance on the electrical grid forced all three reactors at Palo
Verde to automatically shut down. The company declared an Unusual Event, the
lowest of the NRC’s four emergency classifications, due to the loss of offsite power.
The emergency diesel generators automatically started and supplied electrical power
to essential safety equipment. But one of the Unit 2 emergency diesel generators
failed, prompting the company to upgrade the emergency classification to the Alert
level. The NRC dispatched an Augmented Inspection Team (AIT) to Palo Verde that
day to investigate. The AIT identified a number of equipment and personnel problems
that made the loss of offsite power event worse, including: (a) the emergency diesel
generator for the Technical Support Center failed because a test switch was left in the
wrong position following maintenance six days earlier, (b) the loss of power
adversely affected the ability to contact emergency responders offsite, (c) personnel
errors delayed proper notification about the emergency declarations, (d) one of the
Unit 1 atmospheric dump valves failed to function properly following the reactor’s
shut down, (e) the Unit 1 letdown system did not isolate as required when system
temperatures increased too high, (f) the Unit 2 Train “A” emergency diesel generator
failed, (g) Unit 3 experienced an unexpected main steam line isolation, (g) the Unit 3
main generator did not automatically trip like the Unit 1 and Unit 2 main generators
and the Unit 3 reactor coolant pumps remained connected to the station electrical bus
even as the turbine went into an overspeed condition, (h) the Unit 3 reactor coolant
pump 2B lift oil pump tripped due to a breaker problem as the operators attempted to
restore forced recirculation cooling of the reactor core, (i) a leaking check valve
caused water to leak into the low pressure safety injection system and forced the
operators to drain water from the system three times to keep it operable, (j) two
electrical breakers in the plant’s switchyard failed to close upon demand from the
control room, delaying restoration of offsite power to the plant, (k) high vibration of
the auxiliary feedwater (AFW) system piping occurred on Unit 1, prompting
operators to secure an AFW pump, (l) a combination of procedure weaknesses and
operator errors complicated the transfer of the supply to the Unit 2 Train “E” charging
pump from the volume control tank to the refueling water tank, and (m) operators did
not comply with three Technical Specification requirements for steps to be taken to
compensate for safety equipment being unavailable.

May 14, 2004: A check valve failed to open in piping between the Unit 3 spent fuel
pool and the cask washdown pit, creating a siphon pathway that caused the
inadvertent transfer of water out of the spent fuel pool. Left unchecked, this pathway
could have drained the spent fuel pool to below the minimum level needed for
adequate cooling of the irradiated fuel in the spent fuel.
                                                                                        November 22, 2006
                                                                                        Page 4 of 5

             April 27, 2004: After determining that the refueling machine hoist was not
             functioning properly (i.e., its brake was broke), workers continued to use it to move
             irradiated fuel in the Unit 1 reactor vessel in violation of procedures.

             April 12, 2004: While a technician was conducting an unapproved, unauthorized test
             of a remotely controlled submersible in the Unit 1 spent fuel pool, the device got
             pulled into the suction piping for the spent fuel pool cooling pumps. One of the two
             operating pumps had to be turned off so the submersible could be extracted from the
             piping. During the 16 minutes one of the pumps was off, the spent fuel pool
             temperature heated up 3°F.

        These problems, along with a dozen more like them, have one very disturbing common
thread – in each case, workers fail multiple opportunities over many months or years to identify
and correct one or more safety problems until a near-miss or the NRC forces them to implement
fixes. Federal regulations, specifically Appendix B to 10 CFR Part 50, require Palo Verde’s
owners to find and fix safety problems in a timely and effective manner. It is abundantly clear
and extensively documented that Palo Verde’s owner is either scoffing at this federal regulation
or is doing its best, but falling way short. As a direct result, the public has been exposed to undue
risk (and the company’s stockholders have been poorly served).

        On November 20, 2006, the NRC met with the Palo Verde owner regarding NRC
inspectors’ discovery of a long undetected, long uncorrected safety problem at Palo Verde. This
time, workers dumped so many chemicals into the cooling water system that the water was
unable to dissolve them all, causing precipitants to coat and clog the inner surfaces of equipment,
including heat exchangers. On May 17, 2006, a test of emergency diesel generator 2B indicated a
high intake air temperature of 145°F, 29°F above the value from the last test. The NRC
dispatched a special inspection team to the site to investigate. The NRC inspectors found that
improperly implemented chemistry controls for the emergency spray pond system dating back to
1995 caused increased heat exchanger fouling in all three units. The NRC estimated that
Emergency Cooling Water Heat Exchanger 2B was degraded to the point where it would not
have been capable of performing its safety function in event of an accident for approximately 6.8
months in 2003. The NRC determined that workers at Palo Verde had noticed the degradation,
but had not responded properly to those warning signs. In fact, the NRC documented that
workers had loosened the chemistry controls further. Instead of figuring out what was wrong and
fixing that cause, workers merely cleaned the gunk out of equipment more and more often.∗

        The purpose of the November 20th meeting was to allow Palo Verde’s owner to present
the NRC with its take (read “excuses”) for the latest NRC finding. The NRC will now consider
the company’s input into its deliberations for the final color to assign to its inspection findings. If
the NRC issues a White, Yellow, or Red findings, the Palo Verde reactors could move over into
the Multiple/Repetitive Degraded Cornerstone Column. If the NRC issues a Green finding, the
reactors will stay in the Degraded Cornerstone Column. So, Palo Verde will either remain in its
current naughty spot or move to an even naughtier spot on the NRC’s list.

 Many people wondered how workers at Davis-Besse could have overlooked the obvious warning sign posed by
workers suddenly having to replace clogged filters inside containment every day instead of every few months as had
been the practice for decades. The workers at Palo Verde demonstrated once again just how easy it has become to
overlook clear safety problems and simply treat their symptoms – doing what is needed to keep the reactor operating
as opposed to keeping the reactor safe.
                                                                          November 22, 2006
                                                                          Page 5 of 5

What Does It All Mean?
        The past two years provide ample evidence that the owner of the Palo Verde nuclear
plant lacks the proper safety focus. NRC inspectors, not plant workers, are identifying safety
problem after safety problem – except for those problems exposed by near-misses. Rather than
reacting to those unambiguous clues by forming squads to seek out and correct other undetected
safety problems, Palo Verde’s owner instead opts to waste considerable time and many millions
of dollars in futile efforts to convince the NRC that inexcusable acts like deliberately draining
water from ECCS piping and that a decade-long chemical addiction problem are okay.

         Everyone is entitled to a defense, but no one is entitled to operate three large nuclear
power reactors while seemingly constructing grounds for an insanity plea. It is insane for the
Palo Verde owner to spend so much time looking in the rear-view mirror trying to explain away
yesterday’s mistakes and so little time watching the road ahead to prevent tomorrow’s mistakes.
In fact, it is very close to the time that the NRC should take the keys away from this owner and
let that owner sit in an idle car – looking ahead or looking back as he pleases – posing no more
risk to an unsuspecting and undeserving public.

Prepared by: David Lochbaum
             Director, Nuclear Safety Project

Shared By: