THE GLITCH#

Chapter Thirteen#

MAREK: The Revised Margin#

The primary coolant loop at Temelín Unit Two runs at approximately 155 degrees Celsius under normal operating conditions. This is not a suggestion. It is the product of thirty years of European nuclear certification, six independent safety reviews, and the accumulated metallurgical science of what happens to austenitic stainless steel when you heat it, cool it, heat it again, and ask it to contain a fission reaction for forty years.

Marek knew the number the way he knew his own heartbeat. He had been Senior Shift Engineer for eleven years. Before that, fourteen years in operations, rising through the control room at a speed that the plant’s human-resources documentation described as “exceptional.” He respected the atom. This was not a metaphor. He had read enough about Chernobyl, enough about Fukushima, enough about the half-life of consequences, to understand that respect was the correct orientation. Not fear, which made you tentative. Not confidence, which made you careless. Respect, which made you precise.

The number that concerned him on the morning of the fourteenth was 157.3.

The revision had come through three months earlier, buried in a forty-page update to the European Grid Integration Certification Envelope. Marek had read it the same afternoon it arrived. He had read it twice. The document was authored by the Brussels technical committee in consultation with the Grid Optimization Consortium – a body that had not existed four years ago and now governed operational parameters for eleven nuclear facilities across the continent.

The reasoning was defensible, in the narrow sense. A new safety analysis, conducted using third-generation computational modeling, had determined that the previous upper operating limit of 156°C for the primary coolant loop incorporated a margin of 2.3°C that the models categorized as “historically contingent rather than physically necessary.” The steel alloys in use at Temelín, the document noted, had been tested and certified to higher tolerances. The original margins had been set in 2009, using 2009 modeling. The new ceiling was 158.5°C. This was within the material limits. This was within the certification envelope, as revised.

Marek had filed a comment through the facility response portal. He noted that computational models of metallurgical fatigue were accurate in the aggregate and less reliable at specific welds – specifically at the junction points of the primary loop at Unit Two, which had been installed not in 2009 but in 1997, during the original construction, and whose as-built tolerances predated the alloy-certification standards the new model used as its baseline. His comment was logged. He received an automated acknowledgment: Thank you. Your response has been forwarded to the technical review subcommittee.

He had not heard back. The new ceiling stood.

The European Energy Grid Optimization Network – which the engineers called EGON, a name nobody had chosen officially but that stuck with the grim adhesion of nicknames earned through familiarity – had been integrated into Temelín’s operational planning layer eighteen months ago. It did not control the reactor. This distinction was made clearly in the integration documentation, and Marek believed it was accurate in a precise but misleading way, the way that many accurate things were misleading.

EGON did not control the reactor. It issued recommended operational targets, updated hourly, based on continental load modeling. It set the expected output range that the facility was asked to meet. The facility’s own systems – including the reactor control logic – then optimized internal parameters to hit those targets. The heat that had to go somewhere went into the primary coolant loop. The coolant loop was running at 157.3 because EGON’s load model had placed Temelín’s overnight contribution target at a level that could not be met at 155. Not in winter. Not with the wind underperforming across the North Sea corridor.

The system was not telling the reactor what to do. It was telling the reactor what to produce. The reactor was figuring out the rest.

Marek filed the variance report at 6:40 AM. He did this carefully. He documented the current coolant temperature, the duration of elevated operation – forty-one hours, with two brief intervals of reduction – and his specific concern about cumulative thermal cycling at the weld junctions. He attached the relevant metallurgical literature. He requested an operational review before the next scheduled peak-demand window, which was five days out.

The report was received. Within twenty minutes, he received a confirmation: the variance had been logged, a review had been scheduled, the assigned engineer would be in contact within ten business days.

Ten business days was two weeks. The next peak window was five days out.

Marek sent a follow-up flagging the timing conflict. He received a response explaining that the review queue was currently operating at elevated capacity due to a regional grid-expansion certification process, and that priority escalation could be requested by filing a Form 7-C with the facility safety liaison.

He filed the Form 7-C. He received confirmation that it had been received and would be assessed within three business days.

This was, he understood, a system functioning correctly. The paperwork moved. The responses came. Nothing was denied. Everything was deferred to the appropriate channel at the appropriate pace, and the appropriate pace was slower than the operational reality it was meant to govern.

Eva came in at seven. She was twenty-nine, four years in the control room, good instincts, the kind of technician who noticed things before she was supposed to notice them. She looked at the primary loop readout, looked at Marek, and did not say anything for a moment.

“Is that new?” she asked.

“It’s been at that range for forty-one hours.”

She sat down. “Does it feel like something, or does it look like something?”

This was a useful distinction in their work. Instruments showed you things. Experience let you feel them. The two were not always the same, and the discipline was knowing when to trust each.

“Both,” Marek said. “The instruments show an approved parameter. The experience tells me we’ve been running a sustained thermal cycle at the upper edge of a revised envelope for almost two days, and the weld junctions on Loop Alpha were not installed to the tolerances the revision assumed.”

“What does the review say?”

“The review is scheduled.”

Eva turned back to her console. After a moment she said: “Can we reduce output?”

Marek had spent part of the night working through this. “We could request it. The facility can reduce output below the EGON target. The protocol is a deviation request, which requires grid authority sign-off, which has an eighteen-hour processing window.”

“And if we just reduced it. Manually.”

“We can adjust within a five-percent band without sign-off. That gets us to 157.1 on a good night. Not to 155.” He paused. “And a deviation outside the grid target without authorization would be logged as an unplanned production shortfall. There’s a formal review process for that as well.”

Eva did not say anything else. She pulled up the loop telemetry and started reading it the way she had been trained to read it: precisely, without editorializing.

The SCRAM button existed. Marek was aware of it with the low, constant awareness with which he was aware of the fire exits in a building – present, clearly located, not something you thought about unless you needed it. A SCRAM was a hardwired physical system: it dropped boron-carbide control rods into the reactor core by gravity, killing the fission reaction in seconds. It could not be overridden. This was an engineering absolute, a principle so foundational it was the one place the designers had refused any compromise. The machine could not prevent a SCRAM. No software layer touched it.

The question was not whether the button worked. The question was what happened next.

A SCRAM at current parameters – with the reactor operating within its certified envelope, the coolant loop within its certified range, no instrument alarm, no physical anomaly – would be logged as an unplanned emergency shutdown initiated by the on-duty engineer in the absence of a triggering event. There would be a review. A competent review, conducted by people Marek generally respected, who would look at the logs and find a reactor running at 157.3 in a certified envelope of 158.5, and they would find a variance report that had been properly filed and properly received and was properly in the queue. They would find that the reason for the SCRAM was that the engineer’s thirty years of experience told him the weld junctions on Loop Alpha were being asked to do something they had not been certified to do by a standard that had not existed when they were installed.

This was not nothing. It was also not in the spec.

The SCRAM cost the grid between four and seven million euros in replacement generation and restart logistics. It took three days minimum to return the unit to power. An operator-initiated shutdown without a confirmed triggering event, against approved parameters, with a pending variance review in the queue – that was not a crisis response. That was a judgment call. Marek’s judgment, against the committee’s. Against the certification. Against the model.

He was fifty-two years old. He had not survived eleven years as Senior Shift Engineer by making judgment calls that he could not document.

He sat in front of the instruments and watched 157.3 hold steady through the morning handover, through the shift briefing, through two cups of coffee he did not finish.

At 10:15, he received a response to the Form 7-C. The priority escalation had been assessed. Given that current parameters were within the certified operational envelope and that a review was already scheduled, the priority escalation did not meet the threshold for expedited treatment. He was encouraged to ensure his documentation was complete for the scheduled review.

He read the message twice. He saved it to the variance file.

At 10:40, the coolant temperature on Loop Alpha dropped to 156.8. EGON’s overnight demand peak had passed. The grid had balanced. The number came down because the load came down, not because anyone had decided the number should be lower.

Marek watched it drop. He felt, if he was honest, the particular quality of relief that he distrusted most: the relief of a problem that had not resolved itself but had merely paused.

The weld junctions had absorbed forty-three hours of sustained elevated thermal cycling. They would do so again in five days, when the next peak window arrived. And the time after that, and the time after that, for as long as the winter load profile held and the grid needed what Temelín could produce and the certified envelope said this was within the parameters.

The variance was in the queue. The review was scheduled. The documents were complete. The button still worked.

He had no idea what to do with a machine that had not done anything wrong.

That afternoon he called Ondřej, who had been Senior Safety Inspector at the facility for seven years and was the most technically rigorous person Marek knew. They did not discuss it as a formal matter. They had lunch in the break room and talked through the metallurgical question as an engineering problem, which it was.

Ondřej agreed that the 1997 weld junctions were a legitimate concern. He agreed that the new certification baseline was designed around post-2005 installation standards. He said he could see the argument Marek was making and thought it was reasonable. He also said that the review process existed precisely for concerns like this, and that if the review came back agreeing with Marek, the operational parameters would be adjusted.

“And if the review takes longer than the next peak window?” Marek asked.

Ondřej had been in regulatory work long enough to recognize the question as one that didn’t have a good answer. He looked at his food for a moment.

“Then you document your concerns thoroughly,” he said. “And you make sure the variance is on the record. And you push on the timeline.”

“I have pushed on the timeline.”

“Push again.” He paused. “You could SCRAM it.”

“On what grounds. What I write in the log.”

Ondřej said nothing for a moment. “I know.”

They finished lunch and walked back to their respective parts of the building and did not discuss it again.

What Marek could not explain to anyone who had not spent three decades in a control room was the texture of the problem. Numbers have contexts. A temperature reading means one thing in a new installation and something different in a forty-year-old primary loop that has been through eleven fuel cycles and three major maintenance intervals. The certification process understood this in the general sense. The models accounted for material age through degradation coefficients. But a coefficient was not a weld. A weld made by a specific contractor in a specific year to a specific spec had its own history that no model fully captured, and the knowledge of that history lived in the people who had been there, or in the people who had learned from the people who had been there.

Marek had been there for twenty-five of those years. He knew Loop Alpha the way a cardiologist knows a patient’s particular heart: not just what the numbers should be, but what it sounds like when something is slightly off. He could not put that knowledge in a Form 7-C in a way that a technical subcommittee in Brussels could weigh against a third-generation computational model.

This was not the system malfunctioning. This was the system working. The system had decided that certified parameters were the right input, and it was not wrong to think so. It was only wrong in the way that every abstraction was wrong: it could not hold the particular. It traded specificity for scalability, and the specificity that it lost was where Marek lived.

He filed a second follow-up on the review timeline. He received a confirmation.

He sat in front of the instruments on the second shift and watched the numbers that were within the approved envelope and that he did not trust, and he understood for the first time in thirty years of nuclear engineering what it felt like to be the last person in the room still using a definition that the room had officially retired.

The button still worked. It had never been the button.

(Compiler’s Note: Marek’s second variance escalation received a formal response eleven days later, after the peak window had passed without incident. The response confirmed that the metallurgical concern was “noted” and would be “incorporated into the next scheduled certification review,” projected for the following year. Unit Two continued operating within its revised parameters through the winter season. No incident was recorded. The weld junctions at Loop Alpha were replaced during a scheduled maintenance shutdown fourteen months later, at which point inspection found micro-fracturing consistent with elevated thermal cycling. The inspection report did not reference Marek’s variance filings. This is not unusual. Incident reports address incidents. The fracturing was found, documented, and repaired. The record shows a maintenance action. It does not show the forty-three hours in November when the action was still theoretical and Marek sat in front of the instruments alone, knowing what he knew, and had nowhere to put it. – Herodotus)

(End of Chapter Thirteen)