Futility at the Utility

For over two decades, workers at Detroit Edison's Fermi Unit 2 nuclear power reactor dutifully tested a key safety system—the one that reacts to interruptions in electricity and signals the onsite emergency diesel generators to start and power components that protect the reactor core from damage. The proper functioning of the emergency diesel generators is extremely important. As a measure of that importance, when the emergency diesel generators become disabled, Fermi Unit 2 must be shut down within 12 hours to avoid causing a breakdown at the plant that would expose the public to undue risk.

But over those two decades, workers tested this crucial safety system using the wrong answer key. As a result, although the safety system was repeatedly given a passing grade, this did not indicate that it would actually have worked properly if needed. Twenty years of testing resulted in a safety system that may never have been adequate.

Hard to believe? Certainly. More unbelievable is the fact that Detroit Edison and the Nuclear Regulatory Commission (NRC) had hundreds, perhaps thousands, of opportunities to discover this problem during those decades. Lots of people had lots of chances to notice the problem. It wasn't that one person made many mistakes or many people made the same mistake. Many people made many mistakes for many years.

How could this happen? The failure to ask and answer this simple question just once is the primary reason the problem was missed by so many for so long. When other problems were uncovered—as frequently happened over the years—no one asked how the problems had gone unnoticed until then. Consequently, the process flaws that initially created the problem and then allowed them to remain undetected were not identified and fixed. Instead, the individual problems were remedied when they surfaced. And the uncorrected process flaws continued to create new problems and sustain old ones.

The UCS report Futility at the Utility: How Use of the Wrong Answer Key for Safety Tests Went Undetected for 20 Years at Fermi Unit 2 documents our inquiry into the 20-year period during which Detroit Edison tested the emergency diesel generator protection safety system using the wrong answer key. The report explains how the emergency diesel generator protection system functions and how the discrepancy was introduced in August 1986. A detailed timeline in the report's appendix chronicles the numerous opportunities Detroit Edison and the NRC had to uncover the discrepancy prior to its finally being revealed in August 2006. And the report describes what the NRC must do to put an end to the unsafe futility of testing emergency equipment using the wrong answer key and missing countless opportunities to detect this glaring error. It is an invaluable, long-overdue lesson for safe operation of Fermi Unit 2 and more than 100 other nuclear power reactors in the United States.