NRC waives enforcement of fire rules at nuclear plants

Google Earth image of the Vermont Yankee plant in Vernon, Vt.

Editor’s note: This story is by John Sullivan. It was first published on ProPublica.

ProPublica Editor’s note on Our Investigation Into Fire Risks at Nuclear Power Plants

The Nuclear Regulatory Commission is routinely waiving fire rule violations at nearly half the nation’s 104 commercial reactors, even though fire presents one of the chief hazards at nuclear plants.

The policy, the result of a series of little-noticed decisions in recent years, is meant to encourage nuclear companies to remedy longstanding fire safety problems. But critics say it is leaving decades-old fire hazards in place as the NRC fails to enforce its own rules.

Fires present a special risk to nuclear plants because they can knock out cables that control-room operators need to safely cool down a reactor. The explosions and fires at Japan’s Fukushima Daiichi plant have shown what can happen when operators can’t activate pumps, valves and other equipment needed to prevent damage to the radioactive core.

At the Browns Ferry plant in Alabama, where a devastating cable fire 36 years ago prompted the NRC to adopt tough new fire rules, the plant still doesn’t comply with the requirements to protect cables.

Hazards at other plants include unprotected equipment, inadequate fire doors and missing alarms and sprinklers. To compensate for being out of compliance with the rules, Browns Ferry and other plants are relying on temporary measures such as stationing workers on a fire watch.

No member of the public has ever been injured from a fire at a U.S. nuclear plant, and the NRC says the reactors are safe. But longtime observers of NRC’s fire enforcement say the agency is pressing its luck.

“The agency takes full credit for the grace of God,” said George Mulley, who wrote several scathing reports about lax fire enforcement while chief investigator at the NRC’s Office of Inspector General.

The five-member commission has procrastinated on the issue for a simple reason, he said: “They don’t want to cost the industry money.”

Fires are common at U.S. plants. In all, there have been at least 153 since 1995, or an average of about 10 a year, according to NRC records. Small fires, brief fires and fires in areas that were not considered critical to reactor safety have damaged essential equipment and forced emergency shutdowns, reports reviewed by ProPublica show.

An explosion in an electrical panel at Arizona’s Palo Verde plant in March 2010 and an electrical fire at the Columbia Generating Station in Washington in August 2009 each knocked out reactor cooling pumps.

Last week, a truck delivering flammable hydrogen to the Duane Arnold plant in Iowa burst into flames near a building holding machines that control the reactor. Plant operators declared an emergency while firefighters poured water over nearby hydrogen tanks.

Nine years ago, the NRC did try to confront the fire compliance issue, saying nuclear companies had to address problems such as unprotected cables and missing fire barriers, detectors and sprinklers. But the industry dug in its heels, arguing that the plants already were safe enough.

So the agency offered an alternative: Companies could sign up for a new program requiring them to exhaustively study their plants and write new, customized fire plans. As they worked toward repairs, inspectors would issue violations for only the most dangerous hazards.

Nuclear companies owning 50 reactors initially enlisted. While two test plants have completed their plans and overhauled their plants, the rest continue to operate with a patchwork of interim procedures and fire watches.

“They are not effective measures,” said David Lochbaum, a nuclear engineer with the Union of Concerned Scientists who has worked at Browns Ferry and as a trainer for the NRC. “You can limp by, but you can’t rely on them.”

Gregory B. Jaczko, the NRC’s chairman, said in an interview that the agency’s enforcement approach has not diminished safety. Before waiving a violation, inspectors make sure the safety risk is low and that companies plan to fix the problem or put interim protection in place.

“We do require them to address the deficiencies,” Jaczko said. “It doesn’t give them a blanket pass on being in compliance (or) meeting the safety standard. It’s a very subtle difference.”

But when ProPublica asked the NRC for a list of all the fire safety gaps at plants enrolled in the new program, the agency said it did not have one. Instead, companies are required to maintain a list at each plant so inspectors can review them, NRC spokesman Eliot Brenner said.

Those lists are not publicly available, so there is no way to assess what deficiencies exist, how serious they are and how they are addressed.

Until there is a fire.

At South Carolina’s H.B. Robinson plant last year, a high-voltage cable blew up, temporarily disabling a cooling pump, damaging equipment and shutting down a large part of the plant’s power grid. Errors by operators caused a second fire when they tried to reset the system.

Robinson is one of several plants where the NRC recently has waived fire violations under its new program.

Inspectors had visited Robinson in 2007 and said that it didn’t have enough fire detectors and suppression in the area of the plant where the cable later blew. They did not write a violation, and the detectors and sprinklers were never installed.

How long plants like Robinson will have to address such deficiencies is unclear. The NRC originally gave the plants two years to transition into the new program. That would have required the first enrollees to submit proposed fire plans by 2007.

But just a few weeks ago, the commission voted unanimously to extend the deadlines for at least the third time, pushing final approvals to 2016 or later.

“The NRC has basically granted all these people the ability to not meet the regulations with impunity,” Lochbaum said. “They can continue to drag their feet, and the NRC just sits there and watches.”

An awakening on fire

The dry cask storage units outside of the Vermont Yankee plant. Photo by Laura Frohn, News21.org

For the first quarter century of U.S. nuclear power, fire wasn’t much of an issue. The Browns Ferry blaze forced a paradigm shift.

It began with a tiny flame.

On March 22, 1975, a worker using a candle to hunt for air leaks accidentally set fire to insulation near electrical cables underneath the Browns Ferry control room, which two reactors shared. The plastic foam material flared, and before the flames could be smothered they were sucked along cables into the adjacent reactor building.

The fire seared through trays carrying hundreds of cables, triggering a cascade of shorts and creating havoc in the control room. Indicator lights flicked on and off at random; pumps started on their own and then restarted after being shut down. Smoke poured from a cabinet that controlled emergency cooling, and key pumps on the Unit 1 reactor were lost. Operators “scrammed” the reactor, an emergency shut down.

Loss of cooling is a serious event. When a reactor shuts down, the radioactive fuel remains hot enough to melt. With only one small pump operating, water in the Unit 1 reactor boiled off, dropping nearly 13 feet in depth until only 48 inches covered the top of the reactor core. Uncovered, hot fuel reacts with air to create hydrogen — the gas that ignited and blew buildings apart at Fukushima Daiichi.

Browns Ferry operators were able to stop conditions from degrading further, but only by manually operating valves and calling in electricians for help. In all, it took more than 15 hours to stabilize cooling at Unit 1.

The accident riveted the NRC’s attention on the damage fire could do to control cables. Nuclear companies already were required to have backup cables for safety-related equipment, but Browns Ferry showed that a fire could destroy both sets if they were near each other, a situation common to the design of many plants.

So after five years of study, the agency adopted rules that required companies to separate primary and backup cables by at least 20 feet. Where that wasn’t possible, they had to install protection — automatic sprinklers and fireproof wrappings, or barriers that could protect cables for up to three hours.

The rules required extensive retrofits, and the industry balked. Two nuclear companies sued to block them, but a federal judge agreed with the NRC that they were “urgently needed to protect the public safety.”

Yet over the next two decades, the sense of urgency faded. Some plants installed fireproofing material that later turned out to be defective; others never added required protection. Many companies — acting without NRC approval — got around the rules by substituting manual procedures. If a fire cut off the control room, for example, workers would fan out and operate switches and pumps by hand.

Some of these assignments amounted to implausible acts of derring-do. Shearon Harris assigned a worker to run through the plant, squeeze into a high-voltage electrical cabinet, mount a step stool and disconnect a switch with a screwdriver. (Shearon Harris has since discarded the procedure.)

Other plants assumed workers could pass through burning areas to keep safety systems running. Companies created dozens or even hundreds of such assignments. In a 2008 report, the Government Accountability Office said one plant used 584.

The extensive use of unapproved work-arounds — dubbed “operator manual actions” — came to a head in 2001.

Inspections found that some plants were using an “extreme interpretation” of the rules, relying exclusively on work-arounds instead of fire-wraps. “This condition is similar to the condition Browns Ferry was in prior to the 1975 fire,” according to an NRC white paper in 2001.

The NRC advised inspectors that unapproved measures violated the rules and had to be enforced — a stance that alarmed the industry.

At a pivotal 2002 meeting, the Nuclear Energy Institute, the industry’s trade group, asked the agency to hold off. While conceding that most plants relied on unapproved actions, the industry insisted they were safe and that the NRC had known about them for years.

Taking the industry approach

By 2004, the NRC came up with an alternative. Under a new fire program, nuclear companies could tailor fire protection at their plants based on an in-depth analysis of risk conducted by their own engineers.

To get companies to take part, the agency offered to ease up on enforcement. While the companies wrote new fire plans and the NRC reviewed them, the agency would exercise what it calls “enforcement discretion.” Inspectors would write up violations for the only most serious offenses — red on the agency’s four-color severity scale.

Jaczko, the NRC chairman, has called the program an “industry-developed approach.” As it frequently does, the NRC tapped the Nuclear Energy Institute to help write official guidance for engineers to follow while devising the new plans.

The new approach promised a way out of a long-term problem. But it wasn’t an immediate solution, as the Browns Ferry plant shows.

Except for a brief period after the 1975 fire, the plant’s Unit 1 reactor was mothballed for more than 20 years. The Tennessee Valley Authority, which operates the plant, decided in 2002 to reopen it. The authority spent $1.8 billion on renovations that included new instruments, modern power supplies and 200 miles of cable.

As the work was under way, the NRC began warning that Browns Ferry didn’t meet the rules prompted by the cable fire at that very unit.

In a 2005 letter, inspectors cited “use of an extensive number” of manual work-arounds to deal with unprotected cables all over the plant. Inspectors and the TVA traded letters about missing fire protection right up to the May 2007 restart. But in the end, NRC gave the go-ahead after TVA promised to fix the problems later.

That June, President George W. Bush visited the plant to hail the restart as the beginning of a nuclear renaissance. Browns Ferry, he reassured, was “a safe facility to have in the area of the country in which you live.”

But when NRC inspectors looked again in 2009, they found the cables still weren’t sufficiently protected. The NRC finally sent the TVA a formal notice of violation last year, and in response the authority admitted it “took no action between 2006 and 2009 to comply” with the rules. TVA said it would do so under the new fire program, a promise the NRC said was an appropriate response to the violation.

Today, the problems still aren’t fixed. TVA spokesman Ray Golden said the authority is working on modifications that include better protecting cables. He said the process of transitioning to the new program is expected to cost $30 million to $50 million and take three to five years.

Until then, he said, Browns Ferry is using temporary measures like fire watches to compensate in areas don’t comply with the rules.

Running on exemptions

ProPublica reviewed the most recent NRC fire inspection records for plants enrolled in the new fire program and found more than three dozen instances in which inspectors had identified deficiencies but invoked their discretion not to write violations.

At the Calvert Cliffs plant, 60 miles southeast of Washington, D.C., a 2007 inspection found that if control room workers were forced to evacuate because of a fire, plans didn’t allow enough time for a manual procedure to protect reactor cooling pumps.

Inspectors did not cite the plant. Returning in 2010, they found three different violations that could impede a safe reactor shutdown during a fire, but they also exercised discretion instead of writing a violation.

Last year, inspectors found that cables used to control reactor valves at the Turkey Point plant outside Miami were unprotected from fire. The protection had been missing since at least 2001 and was initially noted in 2004. Citing enforcement discretion, inspectors waived a violation.

The NRC said both plants had taken interim steps to protect the reactors while they worked on their new fire plans.

The NRC conducts special fire inspections at each plant once every three years. Notice is provided in advance, and inspectors single out three to five areas for scrutiny, a review of records and testing safety procedures.

Plants that aren’t in the new fire program can also avoid strict adherence to the rules by obtaining a formal exemption from NRC. Companies must have an alternate method of fire protection that is no less safe.

Fire exemptions are common. In a 2008 report, the GAO found that NRC had issued more than 900. ProPublica examined the agency’s current list of exemptions and counted nearly 700 at 56 reactors, most dating to the 1980s. Three plants with six operating reactors also have pending exemption requests or are planning to submit one.

Among the most controversial exemptions is at the Indian Point Nuclear Plant, 24 miles north of New York City on the Hudson River.

In 2007, the NRC granted an exemption to Indian Point, saying it was safe for certain cables to be protected with a fire barrier rated to last 24 minutes rather than the one hour required under NRC’s fire rules.

Opponents sued the following year, claiming that NRC’s analysis was inadequate and that the agency had violated its procedures. Federal district and appeals courts concluded that NRC had reviewed the exemption properly and dismissed the suit, although the court did not review the underlying technical issues.

“There is an incredible depth of fire protection at this site,” said Jerri Nappi, a spokesman for the plant’s owner, Entergy. “If the NRC believes the plant was not safe, they would shut it down.”

Separately, Entergy has asked NRC for another exemption that identifies 33 instances in which Indian Point fails to meet fire rules. Nappi said the issue involves longstanding work-arounds that operators would perform outside the control room in the event of a fire.

The request has come under fire from New York Attorney General Eric T. Schneiderman. In a petition asking NRC to enforce its rules, Schneiderman said Indian Point does not meet requirements for protecting cables or installing fire detectors in 275 areas.

In an interview, Schneiderman called the situation “ludicrous.”

“It’s pretty hard to argue that the NRC should not enforce its own rules,” he said, “or that they should grant exemption after exemption.”

Taking risk into account

The NRC’s new fire program hinges on the idea that sophisticated mathematical models can help engineers predict fire risk. Companies can then make better decisions about how much protection is truly needed and not worry about situations where it isn’t.

So far, the NRC has approved risk-based plans at the two test plants, Shearon Harris and Oconee in South Carolina. The process can be expensive. Shearon Harris, for example, spent $14 million on engineering work and another $23 million on 44 modifications that included a new fire detection system and upgrading ventilation.

Jaczko said he is so confident of the voluntary program’s effectiveness that he would like to make it mandatory for all plants. “We’ve seen from the pilot programs that it really enhances safety,” he said.

But critics say the new approach gives too much control to companies and their engineers. Unlike straightforward mandates such as detectors or fire barriers, they say, the science of predicting fire is still maturing. Fire models have limited uses and are susceptible to misinterpretation.

“There is no reason to have any confidence that a vaguer, more opaque kind of safety assessment is going to have any enforcement at all,” said Paul Gunter of Beyond Nuclear, a group that opposes nuclear power.

The fire at H.B. Robinson shows what’s riding on the NRC’s approach — and how even a minor fire safety issue, compounded by equipment failures and operator error, can quickly ratchet up the level of risk.

The event on March 28, 2010 — the 31st anniversary of the worst nuclear accident in U.S. history at Three Mile Island — took place in the cavernous building where huge turbines churn out electricity.

Fire inspectors had checked out the area three years earlier and determined it lacked adequate fire detectors or automatic suppression. But after judging it a low safety risk and noting that Robinson was in the new fire program, they chose not to write up a violation.

Just before 7 p.m., a 4,160-volt electrical cable exploded on the turbine building’s ground floor. A massive arc of electricity seared though the steel conduit holding the cable and slammed into a 7-foot-high electrical cabinet, buckling its steel doors and sending smoke into a room above.

A circuit breaker should have isolated the short from the plant’s electrical grid, but it failed — investigators later discovered that it had been flagged for maintenance 18 months earlier but was never properly repaired.

In the control room, dozens of alarms flashed. One was a fire alarm — but from a detector on the floor above the flaring cabinet. A main reactor pump wound down, and as operators scrambled to figure out what was happening, they learned of the fire from two supervisors who arrived at the control room and said they saw it.

While the plant’s fire brigade put out the ground-floor cabinet fire, two security guards upstairs frantically tried to reach the control room to report a smaller fire. They blasted away with extinguishers, a move investigators said created “potential danger” for unknowing operators.

Automatic systems shut down the reactor but didn’t halt the emergency.

Within 12 seconds, a huge swath of Robinson’s electrical system had gone dark, disabling equipment across the plant. Circuits needed to shut down the reactor still worked, partly on an emergency generator. But when operators tried to reset dead circuits four hours into the event, they inadvertently restarted the fire and triggered a second spate of outages.

Lochbaum, of the Union of Concerned Scientists, analyzed the NRC’s investigation of the event and concluded that operators were fortunate that damage wasn’t worse.

“These plants are not a house of cards. It takes a lot of wrong things lined up to lead to a very bad outcome,” Lochbaum said, referring to the many backup systems all nuclear plants have to prevent a serious accident.

“But when you start with a bunch of bad things already lined up, like fire protection violations, that shortens the list that is needed to complete the path from challenge to disaster.”

The NRC’s follow-up investigation criticized H.B. Robinson for multiple failures, including bad maintenance, poor operator responses and actions that started the second fire. Still, the NRC said the response to the fire itself was fine. Missing fire detectors did not figure in the report.

“There were no violations of fire protection regulations,” the chief of the NRC investigation, Brian Haag, told ProPublica.

Jessica Lambert, a Robinson spokeswoman, said lack of an alarm did not affect the fire brigade’s response. The NRC concluded the plant’s fire protection “was adequate to control and extinguish the fire,” she said, “and the fire protection equipment performed in accordance with plant design.”

Robinson’s engineers will decide whether it’s needed, she said, as they move forward with their new fire plan.

ProPublica interns Nick Kusnetz and Sergio Hernandez and news researcher Liz Day contributed to this story.