Nuclear Accidents: Lessons Learned (Dr. Brian Sheron)

[Music] thank you it's a pleasure to be here and I can talk a little bit about subject that's kind of been near and dear to my heart for about the past 42 years and that's nuclear safety as Mark said I actually started before there wasn't a Nuclear Regulatory Commission there was an Atomic Energy Commission and I started there in 1973 and started working on breeder reactors which are liquid sodium reactors however that was promised on a thought that we only had 25 years of proven reserves of uranium and therefore we needed to breed plutonium as a fuel but since then it was discovered a lot more uranium reserves so breeders were not as urgently needed and also because it was in he thought because it was a new new technology utilities quite honestly were very hesitant to to just jump in and say hey I'll be the first one to do that they want to demonstrate it's there anyway I spent most of my career working on current generation water reactors and I happen to be in a position at the Nuclear Regulatory Commission when TMI happened that I was I got heavily involved in the accident analyzing what happened trying to determine what the lessons learned were what needed to be done differently there are a lot of technical issues that came up then in 1986 Chernobyl happened and I was in an office I was a deputy deputy division director in an office that was charged with basically trying to understand what happened and what does that mean for us reactors so I was heavily involved in Chernobyl I was on the US team that went to Vienna in August 86 when the Russians finally announced their their side of the story of what happened and then most recently in 2011 when the tsunami hit in Japan and Fukushima reactor had to meltdown the actually the the three of them had meltdowns I was heavily involved in that has again part of the research office again trying to understand what the implications were for u.s. reactors so that's kind of my background in terms of where I got all my information so I've accumulated this over the years so we'll we'll start the last item near that's not a reactor Sora is an acronym we live in acronyms in the government its state of the art it's a state of the art report on severe accident analysis [Music] that's a SOR on actually its consequence analysis state of the art report on consequence analysis and what that is is a study we did my office did we were just finishing it up actually we had just finished it right before I retired on what we believe the most realistic consequences would be if there was a core meltdown in the United States at a reactor and I'll talk a little bit about that let me first talk historical perspective and this goes back to when I first joined the agency back and I'd actually joined in 1776 the Nuclear Regulatory Commission but when I got there what I noticed was their focus was on what they call a design basis accident what's that well that's something that you designed a plant to withstand okay and it's a very stylized accident okay and at that time the design basis accident for nuclear plants was called a large break loss-of-coolant accident or a large break loca okay and what that was was you postulated that the coal leg in a reactor which is the water going into the reactor before it gets heated up sudden it's about a 30 inch pipe okay they're very big and these reactors run it anywhere from like twenty-two hundred pounds pressure which is very high for a pressurized water reactor to maybe about eleven hundred pounds pressure for a boiling water reactor but what you assume in this scenario is that this pipe suddenly has a guillotine break like somebody could take a butter knife and just cut straight through okay and this pipe would suddenly separate so water would this high-pressure water would gush out of both ends of the pipe and you would lose cooling to the reactor and so that was the design basis and what the designers at the time Westinghouse General Electric Babcock & Wilcox and combustion engineering had to do was put in safety systems that would protect the fuel so it wouldn't melt and that was the design basis and we focused all of our time and energy on trying to prove that there was millions of dollars of tests run at facilities around the country where they would try to simulate this breaking of a pipe and watching what happens there were there were heat transfer loops where they had electrically heated bundles fuel rods but instead of being nuclear they had electric current going through them to simulate the the energy and they culminated it with a facility out in Idaho that Idaho national engineering lab called loft which was the loss of flow test and that was a real reactor okay nuclear had nuclear fuel and but it wasn't a full-scale reactor the core was not as tall and it wasn't as big it was a small scale obviously because of the costs but they actually ran a test where they simulated breaking a pipe to see whether or not this fuel was going to melt or not or whether the safety systems would actually kick in and keep it cool so that's the basis that's what plants nuclear plants were designed to and that's what everybody focused on back in the 70s it was based on what they call a defense-in-depth strategy and that is that you don't rely on any one system so we always had a rule back when licensees had to analyze the safety of their plants they had to do a thing called the worst single act of failure and what we made them assume is not only did you get the accident but the most critical safety system that was designed to protect against it failed when it was called upon so there was a lot of redundancy so if you had a pump that had to come on to push water into the core you didn't have one pump you had to and they had to have a separate electrical trains they had to be diverse it couldn't even be from the same manufacturer okay because there may be a common mode failure so there was a lot of that thinking going on okay and at the same time the NRC started what was called the reactor safety study and the the technical title of the report that came out was washed 1,400 it was headed up by norm rest Rasmussen who was a professor at MIT and it had a number of experts in probabilistic risk assessment which was still a kind of a new thing then and what they did is they did a study to show what are the risks from nuclear power okay if I have a reactor what are the failures what are the what are the failures from a probabilistic standpoint that are going to cause a reactor milk and lo and behold what they came up with was that the large break loca that we were designing these plants to and spending all these millions of dollars on testing was not the main contributor to risk okay it was other things that was called a station blackout and that is where you assume that you lose the the grid okay the transmission lines because nuclear plants require electricity to keep running even though they're shut down and so when they're shut down energy from the grid comes in through transmission lines to the plant to keep pumps and everything running you assume that they lose the off-site power and then you also assume that the diesel generators that are designed to start up and you know supply power to keep the pumps and everything going to put water through the core you assume they fail and so you getting what we call a blackout you lose all electricity okay that turned out to be a much higher contributor to the risk of a meltdown than this large break loca small break loss-of-coolant accident snot this this stylized break that somebody you know man pipes don't break by just severing like that okay but pipes going to break it's probably going to eat the corrode or it may fish mouth but it's not going to be a double-ended break it's going to be a different kind it's going to be a small area you won't lose as much water bottom line is what we learned from that study at that time was that this large break loca that we were studying was not likely to be the accident that was going to get us okay from a risk standpoint it was going to be a small break accident a small pipe is going to break and systems are going to fail or we're going to have a loss of electricity and our Diesel's won't start and the coral melt and right after this study which came out in 76 and people were still trying to digest it and there was a lot of resistance because there was such an infrastructure built up in the industry focusing on its large break accident and lo and behold Three Mile Island happens and what caused that okay well that was a loss of feed water this is the water that goes into the steam generators okay in other words if you remember oppressed as a pressurized water reactor the way it works is the water is circulated through the core it's heated up but it's under pressure so it doesn't boil okay but it gets very hot that's why they keep it at very high pressure so it can get up around five hundred and some-odd degree or six hundred degrees actually no five hundred degrees or so then it goes through a steam generator and as it goes to the steam generator it gives off heat to the secondary side but secondary sides of lower pressure so that water boils because it's at a lower pressure and it's that steam that is used to turn the turbine which turns the generator which generates electricity once that steam comes out of the turbine it's a very low pressure but it's still steam and it's condensed that's where they take water out of a river or a lake or whatever and they use that water to condense the steam back to a liquid and then it is pumped back through the steam generators okay and it's now it's called feed water okay and so that is the feed water that I'm talking about here and what they did is they had a loss of this feed water one of the pumps failed okay and what happens if you are generating a lot of energy in a reactor and all of a sudden you can't get rid of it okay well you start storing it up and how do you store it up when you have a reactor well the water temperature starts to go up which means the pressure goes up just like a pressure cooker okay and so what happened is that as the pressure and the primary system started going up because it couldn't pass this couldn't it couldn't reject the heat through the steam generator it reached the safety valve set point the point is is that they have safety valves on reactors for that very purpose so they don't over pressurize but they don't like them to open because safety valves are a passive system they open and sometimes they stick especially if they're not used a lot and so to protect the safety valves from opening they had a different kind of valve called a pilot-operated relief valve on these reactors and this was set at a slightly lower pressure and these valves were designed to open first so they didn't challenge the safety valves so what happened is the primary system comes up and this pressure operated relief valve goes open and it sticks okay here's a picture of the Three Mile Island plant up in Middletown Pennsylvania if you ever go up to Harrisburg and go along the New Jersey Pennsylvania Turnpike you can see the cooling towers if you look off to the right stuck in the open position so what happened was that and this it's a little more complicated net on why this feedwater failed but you know it was a combination of mechanical equipment failures and then there were human errors that were also involved and I'll finish up a little bit more in a scenario what happened then was that as the as this valve stuck open and it was in a tank called the pressurizer there's a big tank that is connected to the primary system of the reactor now what they do is they actually that's how they keep the pressure up very high they actually have heaters in it it pressurizes the system so the water won't boil and the way they tell and it's up high so the way they tell the system is full is they have a level gauge in there and what happened is this p ORV this valve opened up and all of a sudden started letting water out from the primary system it was losing water as a small break okay however the water is now because that's the that's the low-pressure point now where this hole is it's bringing water up through the primary system okay into this pressurizer tank so when the operators are sitting there looking at the level gauge they still see like the tank is full because water is being sucked up into it okay from the primary system because going out the hole because that's the low pressure point so they're looking and they're going oh you know they didn't know the valve was stuck open because they looked and they said gee we have a level in our pressurizer what they didn't look at was the primary system pressure which was coming down okay and the water is about 523 degrees or so the primary system pressure is coming down because you're losing energy through the hole okay what happens when that pressure comes down to the saturation point at 523 degrees that water boils okay and so all of a sudden you now start getting two-phase mixture steam and water in the primary system okay so that's circulating around remember this is a pressurized water reactor was not designed to have steam in it and what happens is that the pumps are still running okay well if you've ever run a pump and you get air in it okay it doesn't like that okay it starts to vibrate it makes funny noises the current fluctuates and cavitation okay that's what happened is they because they've generated steam in this primary loop the steam started to cavitate the pumps because it was being pumped through the pumps okay it was a mixture okay of steam and water in this primary system the operators are sitting there and they're gone whom they're looking at the pump current gauge and it's doing this you know and they're like you know these are these like four million-dollar pumps okay so these guys don't want to mess up a four million dollar pump or whatever so they start to worry so they go hey maybe we better turn these pumps off so they turn the pumps off okay and what happens when you quit circulating steam and water in a mixture around a loop okay where's the steam go up where's the water go it settles down everything separates out okay so what happens the water that's in there drops down to the bottom of the vessel and the bottom of the lower pipes and everything the steam goes up and what happens is you uncover the core and they uncovered the core and once you uncover the core you cannot remove the energy in the core okay with just steam okay the heat transfer characteristics are not enough okay in order to get the right amount of heat out the fuel temperature has to go way up to get the to get the heat transfer now you got to remember the reactor is shut down the operator shut the reactor down okay but you're saying well where's this heat coming from all right well reactors have a thing called the K heat all right net is that once you shut a reactor down you stop the nuclear reaction but the fission products that were generated during the reaction those fission products also are radioactive and they decay and they decay with certain different half-lives okay and as they decay they give off energy so when you shut a reactor down you put the control rods in and you shut it down okay seven percent of the initial energy that that reactor was producing is still being produced after it's shut down and you've got to remove that energy okay now that decay energy slowly decays away over time okay usually takes months before but you have to keep the fuel cool that's that's the biggest concern with us reactors it's not you know when the reactors in power it's when you shut it down you still have to remove 7% of that power and if you're talking a thousand megawatt plant okay seven percent of a thousand is still 70 megawatts of power you have to remove so you have to have coolant always flowing past the cool cool growth of the fuel rods to keep them cool and if you have steam go past it you lose the cooling okay in order to get the right amount of heat transfer okay the the fuel temperature has to keep going up and it will it will just keep going until it melts and that's what causes core meltdown is when that fuel just just keeps generating energy and it the temperature will up that's why you hear about the China Syndrome that's what that means you know that the the fuel okay because it's continuing to generate energy okay and won't stop okay would literally burn its way through to the center of the earth once they had figured out what was what should they or not what should they have done actually what they should have done is tried to close that valve okay they didn't know the valve was stuck open but even though they knew the valve was stuck open okay what they should have and the other thing they did is because they thought that they had liquid they had a full system okay they turned off their emergency core cooling system that was starting to put water in the core because they said hey you know I don't have a I don't have a small break here and look my system is full okay so they misinterpreted the symptoms okay and that was one of the big lessons learned from this accident okay because all of their procedures in the control room were event based okay in other words they see stuff happening and they pull the notebook off the shelf and they go let me see this is small break loca I do this this and this okay one of the biggest things we learned from that accident was to change over their instructions to what are called symptom based don't try and figure out what accident occurred okay whether it's a small break enough or a large break or steamed a steam line break okay or something you know don't just treat the symptoms okay so for example if your primary system if you lose the subcooling okay or the amount of you know so you see that the primary system is saturated has steam in it okay that's a symptom okay did you've got a hold don't worry about where the level is okay put water so anyway what happened is that they uncovered the core about half the core melted and it you know when a core melts it starts to slump down the hottest part of a core is in the center okay if you ever go through the math the physics for cylindrical tour which is the way they're designed okay the power profile is a cosine shape in the axial direction and well it's part of a Bessel function but it's typically it's a almost like a cosine shape in the center so the hottest part is right in the middle that's the part that's going to heat up first okay so I used to call it was like a chocolate-covered cherry okay Center parts nice and soft and mushy but the outer side is still hot okay and what happened is that it it started to melt in the center okay it built up a crust on the outside but once it reached a certain point okay it actually broke through this crust and all of a sudden this molten fuel and material ran down and relocated in the bottom part of the vessel head okay and now the big question we all had is why didn't that lower head fail because steel melts at what twenty-five hundred pound are twenty five hundred degrees or so and this stuff is over 3,000 degrees Fahrenheit there's a lot of theories it still hasn't been conclusively shown but the theory is is the best one right now is that there was a layer of water that got trapped in there and even though it may have generated steam it was enough to insulate the lower head from the from the Milt actually heating it up to the point word fail so fortunately the lower head didn't fail but the consequence is that about 144,000 people were evacuated it scared the bejesus out of a lot of people it was a public relations nightmare the other thing that happens in these plants by the way is that the fuel is clad in a material called those Iconium okay it's called Zircaloy and what happens is when steam reacts with zirconium at very high temperature generates hydrogen okay you get zirconium oxide and hydrogen the hydrogen as you know had about I think 8% will detonate I'm sorry will will definitely which means it will burn and at about 12 or 13 percent of detonates which means you got a an explosion and this hydrogen that was being generated in the core from this zirconium water reaction actually went out into the upper part of the containment building which is that big concrete building that you saw there and in one point there was actually we saw a big pressure spike which means there was a detonation it did explode yes so yeah this was the nasty accident okay the best thing I can say is that we go back these are the containment buildings he's big these things are very very thick the walls are like about eight feet of concrete okay with reinforcing rod in there they're designed to hold their design pressure for the ASME boiler and pressure vessel codes around 50 psi what that really means is that their ultimate pressure when they really will break is probably about 120 psi okay that's a fairly high pressure okay if you remember you take your radiator cap off your car and you see it goes spilling out that's only 15 pounds so but anyway the these containment buildings are what really saved everybody because they didn't fail there was a minor release of radioactivity where that probably came out they have vents they have stacks okay where they have to do normal yeah okay because there are had there have to be penetrations going through the containment buildings and there's been a lot of controversy on exactly how much was was released and everything you know and there were reports of you know giant dandelions five feet in diameter and all sorts of stuff there but so anyway this was a defining moment for the nuclear industry in the NRC very much for the people up there and a camera of the company actually ran at the time but pretty much every time you know you get a nuclear accident and you know pretty much everybody's you know in the management level is going to get fired okay and they did they all left anyway but it was a loss of feedwater initiating event they had a reactor and a turbine trip there pressurizer pilot operate life elv lifted failed to close the operators failed to diagnose to stuck open valve they prematurely turned off the high-pressure injection which is water that the safety system and they turned off the reactor coolant pumps this caused the Koren covery partial meltdown and a lot of the molten core relocated to the lower head they had a hydrogen generation and then a burn inside the containment and there were serious concerns about a hydrogen bubble inside to reactor cooling system itself in other words that was worried about this was kind of a false concern because in order for hydrogen to burn you have to have air and there was no air in the vessel but people were worried about this about a hydrogen bubble in the top head of the reactor vessel actually you know thinking that could explode or something and there was a lot of worry about that here's the reactor here's the core okay the way this works real simply is that you you pump water in to the reactor okay it goes through the core comes up comes up here this hot water goes into a steam generator goes down to generator comes out goes through a pump okay and then back into the reactor on the steam generator side the water on the secondary side here goes through okay it comes down the steam coming out goes into a turbine then it goes which turns the generator and then it comes down and it goes back into the steam generator okay once it's condensed so it's it's a two cycle it's a two loop okay what happened here was this is the P ORV is up at the top of this tank here this thing called a pressurizer which is where the safety valves are also and that valve opened and stuck open and what happened is that once stuck open the water comes down into what's called a quench tank okay because that's steam up there so what they try and do is if it does open they want to condense the steam so it comes down but they what happened is they filled up to quench tank to the point where it ruptured and then you can see that's how a lot of this material steam and everything got into this upper area of the containment the valve that stuck open is right up here at the top of this crusher Iser what really caused it was the fact that the the feed water system failed and that was because they had some condensate polishers that clogged up and when the condensate polishers clogged up that shut down the pumps in the feed water system and that's what caused the feed water system to stop putting water into this generator this is a picture of the reactor core I don't know if you can see it there this is sort of what I call the chips chocolate covered cherry approach this is the in the center part there that's the molten material then there's a crust which is basically it's like it's it's material that basically started to melt but it's it's crusty okay it's thick it's not it's not molten okay and then you got a crust failure over here on the southeast corporate it actually got to the point where it burned through and then what happens is this molten material was able to run down and accumulate down here in the bottom of the vessel okay how thick is a steel on that vessel you didn't know through in the bottom vessel is I think they're about eight or not no they're 89 inches thick steel I mean these things are massive yeah and I'll talk a little bit about when I get to Chernobyl because they did not have the capability to build these big steel vessels which is why they had what they did at Chernobyl this is just some of the the press that went on at the time it was it was pretty pretty scary lessons learned there was a need for better human factors emergency operating procedures and more plant specific simulators in other words we needed to make sure these operators were trained for a host of different scenarios and not just these design basis ones we needed to focus more on the smaller brakes which were considered to be a much higher probability and much more likely we made numerous Hardware modifications to the plants to help protect against this the industry itself increased oversight by the formation of info which is the Institute for nuclear power operation they're down in Atlanta and they basically were required to set standards for industry excellence in terms of training and like and they went out and they would actually test plants and operators to make sure that they had the proper training programs we also created the NRC resident inspector program before TMI there was no NRC presence at the plants on a continuing basis after TMI we now have resident inspectors they actually live in the area they have offices on-site and they are constantly walking around the plants doing inspections and you know if they find violations of our regulations they they cite them and alike so we have now at every nuclear operating nuclear plant across the country we have inspectors on-site every day so if you have any concerns you can actually call right to the site and these people of dear there was a lessons learned Task Force there are a lot of task forces but here's I won't I'm not going to read these for the sake of time but this just goes to show some of the some of the changes the short-term recommendations that were made and then some of the recommendations in the final report one of the recommendations was for a single NRC administrator and a stronger Advisory Committee on reactor safeguards the no one opted the NRC single administrator because we have five commissioners at the NRC and they like the collegial atmosphere it also prevents somebody from having a political agenda trying to wear a safety organization our job is to determine whether or not a plan is safe to operate and we should be a genetical and so we felt having five commissioners and the way the rules are is that no more than three commissioners can be of any one party so if you have three Democrats and two Republicans you have a Republican president I'm a sorry Democrat president and a Republican goes off the commission the president cannot nominate a Democrat he has to Democrat nominated or an independent or a Republican and vice versa from my you know over the years I've been there I would probably say I've only thought there was one or two commissioners that I think came in with political agendas the rest of them I think were pretty much a political despite you know who nominated them or like they pretty much focused on safety I won't talk about the action plan you can read that these are all the areas that we focused on though these are the impacts as I said pretty much it told us that we're focusing on the wrong accidents PRA became a big tool for us after this probabilistic risk assessment as a way to identify what the most common or most probable accidents are let me skip now Chernobyl real quick this happened in I think it was more a Prolixin tree actors than we do we have pressurized in what we call light water reactors they have what's called an RBMK i can't remember what the acronym is for an in russian on that but it's basically a graphite moderated boiling water boiling light water-cooled pressure tube design they don't have these big containment buildings around them they have pressure tubes they have uo2 fueled with zirconium alloy cladding but these are embedded in graphite graphite it's a good moderator for for neutrons these evolved from lower power plutonium production reactors they had a computerized control system they had a thing called a positive void coefficient which is scary that is not something that could not be licensed in this country positive void coefficient what that means is that when you change the power on a reactor okay you change those of you that remember your physics okay the nuclear cross-section changes with temperature it broadens okay it's called the Doppler effect and the like and what happens is that basically as you raise the power and a reactor okay it provides negative reactivity feedback okay so it tends to stop the power from going up okay when you have a positive void coefficient or a positive reactivity coefficient what that means is when the power goes up it increases the reactivity in other words that tends to make the power want to go up even more okay and what happens when the power goes up even more the positive reactivity goes up so it's sort of autocatalytic okay positive feedback yeah exactly and that's what this reactor had which was not something that was very good and they had poor reactivity control because the rods their control rods moved very slowly and actually inserted some positive reactivity when they initially went into the core then once they got further and they had negative reactivity and it had a very low coolant to fuel ratio which means that if you if you you don't have a lot of coolant in there to absorb heat okay especially if you start to lose it okay and most importantly they did not have a containment building around it they had what was called a confinement it was just a structure but it doesn't have the strength and the leak requirements that a containment structure like we use in the u.s. does this just shows you kind of a cross-section of what these reactors look like they were big massive things so I said the reason they went to this design is they did not have the technical capability to produce large pressure vessels like we do there are only a couple countries in the world that can actually produce these large pressure vessels with eight-inch thick walls that are rolled and welded and everything and the like Japan the u.s. I don't even know whether we have the capability anymore it used to be Chicago bridge and iron up in Chicago but I don't think they do it anymore I think Japan's the only one right now that I'm aware of that's that's actually making these pressure vessels what happened the operators were rushing to complete a test they were going to go into a shutdown they wanted to do this one test and get it over with what they were trying to do is to see is if they were to rip the reactor pumps the coolant pumps these are big spinning these things are huge okay well if they hooked them up to they they thought that if they hooked them up to a generator as these pumps coasted down they could turn a generator which would generate electricity which would continue to basically energize the grid until if they had diesel generators those diesels could start up and accept a load so that was the whole purpose of this test was to see whether or not that would that would work they were in a rush they had complacency this was a good road to reactor you know they felt they couldn't do anything you know that you know this thing's always run great we've never had any problems they didn't adequately analyze the test at a potential consequences they turned off safety systems to run the test okay and what happened is when they did to Coast down okay as the coolant you know the flow through the core went down what happens is that you generate more heat okay more steam because the flows going down okay so if you think about it just that's because the water has more time to pass through the core okay more heat can pass into it so you can generate more steam remember the positive void coefficient okay well guess what steam is that's a void okay from the standpoint of physics okay and what they did is they generated a large positive you know reactivity insertion this caused so much energy to go you know the fuel rods started the increase in energy so much what happened is they they start to expand because they give all fission gases and everything they literally the fuel rods you know kind of blew up and went into the coolant channel and if you've ever taken something that's very very hot you know thousands of degrees and put it in water okay you get a little phenomena called a steam explosion and that's what happened we think is that they increase the power so fast the fuel rods failed they fragmented went into the coolant channels hit the coolant and caused a huge steam explosion and what that is is what happens is that fuel rods go in there the waters around and all of a sudden you build up Vapor blanket around there and it literally the steam expands so fast okay it's like an explosion and they think that's what destroyed the whole reactor and the containment large amounts of radioactive material were spewed all over the place there were pictures of firemen on the roof of the building trying to put out burning fuel rods standing right next to it with bears they took up their fire suits because it was so hot you know and it was you know and I think 31 firefighters died from radiation as I said the purpose of the test was to show the turbine Coast down could provide actually was the turbine I'm sorry not the pumps to power the safety systems until the diesel generators loaded and what that does is what you don't like to do is you don't like to start these diesel generators cold and load them immediately it's just like starting your car up in the morning okay you like to let it run and warm up a little bit before you go out there and get on the Beltway and do 70 miles an hour this was not an uncommon procedure in Russia but they had virtually no additional safety measures they deactivated that I said the emergency core cooling system ECC s prevent complications during the test they got a violent reactivity excursion with a vapor explosion nano as hydrogen also generated and we think that contributed there were two explosions that were heard the first one we think was a steam explosion nobody knows what that second one was they speculated it was a second steam explosion others speculate it was hydrogen nobody really knows yet the plumes spread into Europe was first detected I think over Norway and that's when people started asking questions the Russians I think at first tried to deny it and everything and we couldn't get any information and I probably spend about a week or two in our Operations Center and we were just trying to figure out what could have happened there you know trying to glean information from all our sources overseas and the like contaminated large land areas food supplies I think there's still television shows on you can watch and it still talks about about a 30-mile radius areas that just basically deserted around there even though those reactors could never be licensed in this country and we try to explain that it did add to the nuclear controversy not only in the US but worldwide I think I went over to Europe five times that year to write a report for the OECD which is the Organisation for Economic Cooperation development on a report trying to basically explain the difference between Western reactors and the Russian RBM case this shows just the power trace you can see they were operating the power came down then they tripped a reactor and then they had this power excursion and you can see what happened it just went through the roof I'm not gonna just explain most of this as I said second explosions possible hydrogen or carbon monoxide explosion but that blew the roof off the building started 30 fires and they had graphite fires there for ten days this is when you see the pictures of the helicopters trying to drop sand on it and everything to put them out these are some photos this is the destroyed reactor you can see how violent that was in these areas here this was a four unit plant this is this is molten material molten core and material that they found underneath the reactor with I think these are robots that went in there these are just a list of the differences in summary of between us reactors and the Russian reactors as I said they're very different they can never be licensed in this country implications for us plants again this additional training the biggest thing again was this whole question of complacency these operators were complacent they felt that you know they knew this reactor you know it can do no wrong Three Mile Island was a little bit like that you know the operators just felt comfortable they knew what they were doing you know we always tell people you know you can't become complacent okay with your reactors alright okay you know one of our executive director for operations used to thank me paraphrased I think it was Roosevelt used to say that you know the price of nuclear nuclear power is eternal vigilance it's true so as I said the human performance aspects were not unique they were more focused on sate on success rather than safety over confidence in the facilities and lack of protection of design and operating margins this was the first event that was ever ready to level seven on the international nuclear energy scale which is the scale by the international nuclear energy agency explode like a big pleasure I'm sure it's by two completely different things but for somebody who doesn't know this stuff the physics are not there it's not enough there's not enough highly enriched uranium okay see that's the whole thing right now for example you know a lot of the utilities they want to extend the life before between refueling outages because that's money every time they go down for an outage that's a month where the reactors not generating electricity these plants aren't about a million dollars a day probably even more now and so they want to extend the life are that the time between outages right now it's be anywhere between a year and a half and two years and then they got to shut down to refuel well if they can go to higher enrichment they go to higher enrichments then they can burn up more fuel which means they can have longer times between outages which translates to money problem is is that once you start getting into higher enrichment fuel you have proliferation concerns and all sorts of stuff so right now we have a limit on the on the amount of enrichment this is the percent of u-235 in the u-238 okay and I think that's it four percent now okay but you have to get up much higher than that to get to actually where you have a bomb with regard to Fukushima okay what happened they had a big earthquake Richter 9 out in the ocean generated a tsunami wave the wave was very high they had a seawall that was I think about it was about 20 feet or so but anyway the tsunami wave just washed right over it it was way too low okay and what happened is that the diesel generators were below grade you can see right here never below grade once that water comes over okay and they're below grade it just goes in and floods them out so what happened is they shut the reactors down a it took out the transmission lines coming in loss of off-site power okay so there's no electricity coming into the plan from off-site the diesels are flooded because the wave goes in there and just floods out the room okay so they have no diesels to start up and the only thing they have is batteries and the batteries were below the grade level okay so the batteries were shorted out okay so they basically went into what I described before is a station blackout in other words I got a reactor there and I have no way to power pumps valves anything I have no instruments no lights and matter of fact operated the some of the crew we're actually running out to their cars trying to get their car batteries out and trying to hook them up so they could get batteries so they could at least get some instrumentation and figure out what was going on we initiated our incident response Center down in Rockville and we staffed at 24/7 we we had a Japan site team that went over and supported the Ambassador and the Japanese regulatory counterparts we had several including some of my staff went over and spent several weeks in Japan doing net we had a near-term task force and we did a systematic review of what went on and whether we needed to do anything near-term actions included conducting additional inspections regarding coping measures for extensive damage mitigation we supported a Department of Energy Initiative on Fukushima Daiichi a forensic accident study using plant specific milk or is a computer code we had that the NRC developed on severe accidents what we concluded for the US was that there was no imminent risk from continued operations and continued our licensing activities we set a similar sequence of events in the US is not likely and what we did is we said okay can we get a tsunami that's going to flood out a plant on the west coast there's only two plants okay there was Palo Verde I'm sorry not Palo Verde Diablo Canyon and I'm sorry and San Onofre and San Onofre I think it's shutting down but Diablo is actually if you ever been out there tough about on a cliff on the side of a mountain okay and if you had a tsunami that got up that high you've got bigger problems trust me when you looked on East Coast where we have some plants on the coast what we concluded was that the the biggest threat was not from an earthquake but from an undersea landslide that could generate a wave like that and what we concluded was that the waves from hurricanes on the East Coast and storm surges are actually much higher than what could be generated by an undersea or earthquake or I mean a landslide so basically what we concluded was that the u.s. plants were still adequately protected and designed against the maximum type of event that could concur from you know an onrushing water one of the things that really came about was the question of this and it's not on here I don't think maybe the next one was this question of the station blackout okay u.s. plants were designed to cope with a station blackout for about eight hours and what that means is that they have about if you lose off-site power you lose on-site power the diesels you have batteries available that can power critical systems for about eight hours okay and after that the batteries are dead and you you know what's Creek but the thought is is that you would be able to get equipment either started or operating within that time period and because of this it we started to scratch our head and say is this really a good is a good assumption and so the industry picked up the ball and right now what they did is they've created these equipment centers around a country and if there is a some sort of a catastrophic event that takes out off-site power at a nuclear plant and somehow takes out the diesels so the diesels are gone the plants have theirs it's a three step approach now that as a result of this accident one is that they operate on the batteries that they have which are hooked up and ready to go for about eight hours okay then they have to have other equipment on site either portable generators portable pumps and the like that they can bring in and hook up and temporarily keep systems moving so that they can continue to cool the core okay and then the last step is that the industry has these equipment centers around the country and helicopters and stuff and what they would do is that before this temporary equipment that's on-site you know for example it needs gasolina run before you run out of gas and all that they would helicopter in this emergency equipment that could be hooked up to all the plants you know they made sure that they have standardized fittings and everything and these plants then could basically survive for an indefinite period without their diesels or off-site power so that was one of the big lessons learned and one of the big steps that we took following this event was to enhance the capability of us plants to withstand a complete loss of all-electric power and these are just number the regulations that we we felt we're applicable I'm not going to get into all of them because of the time here now I'm going to just fine finish up here with what I call the state of the art reactor consequence analysis report and this was a study we did the last time we did this was back in around 1990 this kind of a study and we figured you know we've been doing a lot of research and testing trying to understand core melt progression fission product release fission product transport we've include we've improved our analysis capabilities tremendously with our computer codes with because of the computer capabilities have gone up so much in terms of computing power we can do much fine a nodal ization and alike and so we decided we were going to take our best tools and our best knowledge and say if we got a severe accident which we call it that's basically a core mill something that happens that melts the core what is the most likely consequence and this will also include all the safety related improvements that we've made to plants over the years okay and so what we did is we took two pilot plants Peach Bottom and Sri peach bottoms up in Pennsylvania and Suri's down in Virginia down them around Virginia Beach area and for scenarios that assume mitigation which means that somehow they're able to terminate the event the results show the core damage is prevented or radiation release is reduced and or delayed compared with previous predictions for scenarios that precede unmitigated which means that there's no action taken to try to stop the progression of the event the results show the radiation release is reduced and delayed compared to previous predictions and the individual latent cancer risk for elected scenarios generally comes from the population returning home after the event okay which is millions of times lower than other cancer risks assuming the linear no-threshold hypothesis okay and that's that's controversial in and of itself if you guys ever want to have a you know a speaker come in have somebody come in and talk to you about the linear no-threshold hypothesis versus other other theories in terms of you know because people say the no threshold says that no can't know no radiation is good for you okay which means that even that my nudist amount of radiation is going to predict some pop some percentage is going to get cancer okay and yet other people say wait a minute we're exposed to radiation all the time okay look at the people in Denver okay they get much more you know you fly in an airplane okay everybody gets roughly 600 milligrams a year of radiation 300 from natural Rica causing substances and about 300 from medical tests and so the point is is that you know well people aren't dropping over from cancer because they get 600 so maybe that's a threshold you know or maybe it's something even higher than that but we use the linear not know threshold which says that even small amounts of radiation can cause cancer and what we concluded was that what happens is in these events and this will show you the this is the fraction of the initial core inventory okay that's released and this is the time this was a 1982 study that was done was very conservative it was admitted to be very conservative but you can see here for peach bottom and Sri okay peach bottom you don't start to get a release until about eight hours and it looks like Sri you get about that 10 hours you start to get a release okay what does that mean okay well if you have an accident okay what's the first thing the governor you're going to do you're going to ask the governor do I evacuate okay well if you evacuate if you assume you have an evacuation okay in eight hours most of the people are going to evacuate out of that area okay in twelve hours even more time so when we do the study and we make assumptions about the evacuation this is the caesium release but what what you conclude is that when the release actually occurs from the plant in other words you assume that that containment finally fails and material gets released to the environment everybody's gone they're evacuated okay they're out of harm's way all right I'm not saying it's not a financial disaster all right now I mean you're still going to have contamination and everything in the land okay but nobody got irradiated okay they're gone okay they're out of there and so what you conclude is that you know and you know this gets into a controversy area at the NRC and that is do we protect public health or do we also protect economic okay and that's sort of a policy issue our commissioners always debate but the conclusion was is that people are gone they've evacuated so they don't get irradiated so where where is the where is the the concern coming from well it's actually it's not even NRC it's EPA which sets the radiation standards okay and it's when you assume that they've done all a cleanup and that they've gotten the radiation levels in the contaminated area below the EPA limits okay that you allow people to come back in and Rehab at 8:00 the place and what you do is you take a very low radiation dose which is you know basically the EPA limit you take a very low dose and you multiply it by a very very large population and what happens is you will always get some calculated amount of latent cancers okay and that gets into the area of you know do we believe the no-threshold theory or is there some threshold you know and is that a danger okay but the bottom line we came up with was that nobody's going to get hurt from the initial part of the accident when there's a release because we have enough time to get people evacuated from the study because these events progress much slower than what we had previously predicted and that the releases are a lot less and the reason is because we know more now we know that material that gets released in the containment plates out on the inside of the containment radioactive material it doesn't just hang in there and get released okay it plates out so you don't get as much released and right now what this when I retired the last thing we were going to start doing I started this actually was to do a what we call a level three PR a level one PR a is where you just calculate the risk of a core melt so if somebody says what's the probability the core is going to melt okay you can give them a number if you do a level two PR a you not only calculate the probability of a core melt but you also calculate the probability of a release what's the probability that core milk will ultimately lead to a release and then if you do a level three PRA you go the full nine yards and you say what's the probability somebody's going to die or get latent cancer from that accident okay so we're actually doing a level three PRA and we want to look at the what we've always done in the past is just the reactors we haven't you know we always said what's what's the risk per reactor year full power reactor year that means if the actor was operating for full power for one year what's the risk of living next to it and getting cancer or dying or whatever but there's a lot more to it okay one is that most plants are multi-unit sites they either have two or three reactors there and you might speculate and you say okay you know well if whatever caused one minute of meltdown like a station blackout won't that happen with the other two it might so I wanted to do a study where we said let's take into account the probability of not one reactor but maybe if there's two reactors at that site they both expiry it's the same problem what's that likelihood and what does that mean for the dose rate and everything the other thing that's on site is spent fuel and that was a big concern of Fukushima when nuclear fuel comes out of a reactor it's still very radioactive it's still very hot okay physically you know thermally hot what they do with is that they put it in a spent fuel pool okay which is a big swimming pool basically that this water that goes in there and this stuff stays underwater to keep it cool it's got to stay there about five years okay once it's been in there about five years the heat generation has decayed down enough that it can actually be cooled in air without overheating and what they do usually after about five years is they can take it out of the pool and put it into these big concrete cylinders called spent fuel casks and these can be air-cooled they have holes in the bottom they just use natural circulation air and they put them in these big contain this big concrete containers they're about 20 feet high ten feet in diameter they hold don'know maybe about a dozen or a couple dozen fuel assemblies they seal them up and they put them out on a concrete cask near the plant and now they're just waiting for the government to figure out where they're going to dispose it okay and that's a whole other issue I won't even discuss but there's always a concern of well what happens if you lose cooling to that spent fuel pool okay turns out that there's so much water in those pools that would take forever to boil it down just from the heat so then we get into the question of well what about a terrorist what if they drop the shape charge down and blew a hole on the side and everything it's like you know one of the things NRC does not do is come up with a risk of terrorism or a terrorist event okay and the reason is is because we don't know what the probability is and we don't know how to put a probability on a terrorist event okay what's the probability someone's going to plow an airplane into a plant okay or two airplanes okay we don't know all right we do have a design basis threat at plan we have security forces there that are well trained to fend off any kind of a you know an attack by terrorists up to a point but people will some people will say you know at some point okay those attacks become an act of war and we don't expect a utility to defend the United States okay at some point you have to say you know I can't expect you know a company or utility to defend against some foreign adversary that's when the military has to come in and take over so we don't we don't put probabilities when we put these risk assessments they don't include anything about terrorism or anything or sabotage what we do is we say we have a design basis threat and we test the security crews at the plants on their ability to withstand that threat and they actually go through drills where they have these actual rifles with lasers and stuff and they actually try and infiltrate a plant you know in a drill to see how well they do but what we're doing is we're trying to combine all of the risks from a plant from the reactor when it's running from the reactor when it shut down when you shut a reactor down you turn a lot of safety systems off you have a lot of doors that are supposed to normally closed wide open because people got to get in and that might be a whole different set of risks okay because there's still radioactive material in there we're also looking at when you combine that with the risk of the spent fuel pools and the risk of even the dry casks setting out there that still radioactive material so the idea was to do a complete you know what is the risk of living next to a nuclear site not just what is the risk per reactor year so that's the study they're still finishing it up I don't know how they're doing every time I talk to them they're still moaning about funding because they keep getting their funding cut but hopefully they'll they'll get it finished here's just a list of references if you all want to do any more reading on that these might help and with that I'll finish you

Channel: NCASVideo

Views: 497,456

Keywords:

Id: ryI4TTaA7qM

Length: 68min 50sec (4130 seconds)

Published: Tue May 09 2017