Fais ce que dois, advienne que pourra.
Ford Family Motto, 16th Century Middle French
“Do what is right, come what may.”
I’ve been quiet for the better part of a year. A few of you wrote to ask if the Nuclear Inner Critic Podcast was dead. It isn’t.
I was busy defending my own backyard, and that eats more bandwidth than a man my age ought to spend.
I’ll tell you all of it next time. Where I’ve been, what’s going up 19 miles from my house, and why a 40-year nuclear guy is the one standing in the road in front of it.
But I can’t start there. If I’m going to ask you to trust my read on a fight happening right now, you should first know the three times this same fight came for me, and the one time I blinked.
A motto is just words until the day it costs you something. Mine is four centuries older than I am, and I’ve spent a career learning what it costs from every side. The side where you keep it and pay for it yourself. The side where you break it and let other people pay. And the rare one where you keep it and find, for once, that you aren’t standing alone.
I want to tell you three stories. In the first, I did what was right and it cost me my job. In the second, I knew what was right, wrote it down, then let myself be talked out of it, and that one cost about 2,000 other people their jobs, more than $1.5 billion, and 18 years of this country’s ability to make its own tritium for its nuclear weapons. In the third, I’d finally learned enough to hold the line, and a federal watchdog held it with me.
A career bound up in these three stories led me to found an environment, safety, and health practice with a health physics focus. I’d rather you read this entire story before you decide to trust me with anything.
So I’ll start where it really starts. With a needle in the back of my hand.
The needle.
My start in the nuclear world began in 1985 at my alma mater, Texas A&M University, as a health physics technician working for the campus Radiation Safety Office. When I graduated with my bachelor’s in Radiological Health Engineering, I transitioned to a Health Physicist and full-time university staff member, and began work on my Master’s in Health Physics.
At Texas A&M, part of my job was a monthly chore nobody wanted. We hand-sorted radioactive waste from the veterinary school before it was shipped off-site to ensure no liquids were included in the load to comply with our disposal permit. That waste consisted of frozen, formerly living research animals injected with radioactive tracers, and laboratory waste such as gloves, gowns, vials, syringes (with and without needles), sample containers, and beakers. Truly lab waste.
The vet school’s laboratory rad waste came in red biohazard bags signifying “infectious soft waste,” plainly marked as “Biohazard. Autoclave Only.”
For the uninitiated, an autoclave is a specialized pressure chamber that uses high-pressure saturated steam to sterilize equipment and neutralize hazardous waste. Functioning like a large industrial pressure cooker, it is the standard method for ensuring items are free of all microbial life, including bacteria, viruses, fungi, and resistant spores, generally requiring wastes to be treated for up to an hour at 250 degrees F.
The vet school didn’t autoclave their lab waste and there was no autoclave in the rad waste shed. We were told to open those red bags anyway.
And after opening the biohazard bags, our sorting procedure required us to reach in and pull the contents out by hand, seeking those illicit “liquids.” We did it in heavy canvas overalls and leather gloves over latex, inside a metal building that turned into an oven eight months out of the year. Perhaps that mid-Summer metal Morgan building was supposed to be our autoclave.
A sort took two hours or more. It was miserable, and it was the kind of miserable everyone had agreed to stop seeing. Just get through it.
One afternoon, I reached into a bag and felt a sharp sting between two fingers, then something cool running down the back of my hand, inside my hand. I pulled my arm out and found a large-bore hypodermic needle stuck between my index and middle fingers, the syringe still attached. From the swelling that came up within minutes, a couple of cc’s of whatever it held had gone into the back of my hand.
Most injections don’t leave a mark. I’ve carried the scar from that one for 38 years.
I didn’t know what was in that syringe, and I still don’t.
I did know the vet school worked with Brucella, the bacterium that causes brucellosis, in both live and inactivated forms. The reason I knew that is because I operated the university’s cobalt-60 irradiator in the basement of the Zachary Engineering Building. We used the irradiator to kill Brucella and other research pathogens, as well as for other experiments.
And I knew that whatever goes into a biohazard bag is, as a rule, not meant to go into a person.
After removing the needle from my hand, I called a timeout and phoned my management to report what had happened. Aside from hearing “that sounds painful!” on the other end of the line, nothing was done, neither for the operation nor to check on me. No referrals to medical. No injury reports.
These were the days when getting an on-the-job injury on ANY job was just part of the job.
Just walk it off, Son.
So I did the one thing I could control. I informed the head honcho, the Radiological Safety Officer (RSO), I wouldn’t run that process again until it was made safe, and then I designed the fix myself. A commercial shredder could separate the liquids from the solids and end the manual handling for good. I priced it at $600, well within the RSO’s budget, which I knew because I had prepared the most recent budget presentation.
What I hadn’t understood was that refusing to be injured a second time counted, in the eyes of the retired brigadier general RSO, as insubordination. He couldn’t fire me for declining to bleed for him. But he could defund my HP staff position at the Cyclotron Institute, and he did.
I found work 1,500 miles away at the Savannah River Site. The funding for the job I left was quietly restored shortly after I departed, because, of course, it was essential.
That’s the first story. I did what was right, and what it bought me was a one-way move east, a chip on my shoulder, a savior complex I’m not proud of, and the unshakable certainty that I was the only grown-up in every room I walked into because of my experience. Dumb kid.
Caveat lector. The Texas A&M in this story is the university as it stood in the late 1980s, and the office I describe is one office in one era. I’m a proud Aggie. My quarrel was never with the school I love, only with how a particular RSO’s safety culture operated back then (or didn’t). When that culture resurfaced years later, the university faced a very public reckoning that it has worked hard to put behind it. I’m writing about the place I left in 1988, not the place that exists today. Texas A&M is the greatest university on the planet.
The reactor.
The Savannah River Site is a 321-square-mile federal reservation, built in the early 1950s to make the raw materials of the nuclear arsenal: plutonium, enriched uranium, and tritium, the radioactive hydrogen that boosts the yield of the warheads themselves.
Its five production reactors were designed for the Cold War, long before “environmental protection” was a phrase anyone in the complex used. The production reactors had no tertiary cooling loop, as with civilian power reactors, that served as a barrier to environmental releases. Instead, water from a local tributary passed directly through 9,000 thin-walled heat-exchanger tubes with the primary coolant on the other side, and went back out hot, sometimes tritiated, toward municipal drinking-water intakes near and far along the Savannah River.
The K-Reactor was built in 1953 without a containment vessel and designed to run for 5 years at 250 megawatts. By the time Admiral Watkins wanted it back in service, it was 37 years old, had been pushed for decades at roughly 10 times its rated power, and the people downstream were tired of finding tritium in their water and of federal promises to make it stop.
This was the reactor Energy Secretary Admiral James Watkins decided, against a skeptical Congress, to overhaul and restart rather than replace. The fight played out in the national press almost daily. Congressional delegations went to South Carolina to see the K-Reactor beast and came back more certain than ever that the Admiral was wrong.
The admiral was not a man accustomed to dissent. He made it clear that anyone — federal employee or contractor — standing between the K-Reactor and its return to service would find himself on a very windy corner.
Full Pre-Start Press Packet:
I was brought in by my DOE Savannah River (DOE-SR) client to assess whether the contractor was ready to operate without contaminating the countryside. My piece was simple. Review the controls meant to catch a tritium release in the cooling effluent before it reached the river.
Controls? There weren’t any.
What the new contractor sadly offered as a control was a peristaltic pump, a device built to take small samples from small streams for permit paperwork, pointed at an effluent path dumping about 180,000 gallons a minute into the river. And the sampling reservoir was collected once every 72 hours.
So if the reactor leaked, and if that little pump happened to catch any of the torrent rushing past, nobody would know for three days. Not the contractor, not DOE, not the public. Long after the plume reached the downriver intakes of the community water supplies.
In auditor’s language, that’s a “prestart” finding. A violation serious enough that the reactor can’t legally start until it’s fixed. I wrote it up. My DOE client and I carried it to the contractor’s Radiological Control Manager, the man who’d have to answer for it.
He read it, laughed aloud, and said, “Good luck with THAT.” He knew exactly what the Admiral did to people who delayed his startup.
And here time folded over on me. I was suddenly back in the waste shed at A&M: the needle, the heat, the cost of the last principled stand I’d taken. Only now I had a baby at home, a new life, a circle of friends, a career I’d rebuilt from scratch 1,500 miles from where the last one ended.
My calculus took about a heartbeat. I agreed to downgrade the finding to a “poststart,” fixable after the reactor was already running. My relieved client agreed. We walked out with our standing intact.
My training had told me the truth. Only a prestart could have forced the fix the reactor’s survival depended on. I was right.
In late December 1991, during final tests before restart, the K-Reactor leaked about 150 gallons of tritiated water from the primary system into the Savannah River. It began early on December 22nd and was detected late in the afternoon of December 24th.
Downstream intakes shut off for a week. A water utility and two food processors had to stop drawing from the river. It was almost to the letter the failure my finding had described, arriving through the exact blind spot I’d agreed to leave uncovered.
Full Post-Leak Press Packet:
The rush had a particular madness to it. A brand-new cooling tower, all $75 million of it, was rising on the site to close the discharge loop for good, and it simply wasn’t finished. Waiting a few months for it meant missing the Admiral’s date. So they started without it.
And I wasn’t the only one who saw it coming. That same autumn, a federal task group warned that too little thought had gone into preventing a tritium release during startup testing. A member of Congress said plainly that the problem should have been corrected before the reactor ran, not after. The alarm reached the people in charge in several voices, mine among them. They started it anyway.
A second leak came the next spring. The reactor never produced tritium again.
More than $1.5 billion and, by my count, around 2,000 jobs went down with it. Behind it opened a gap in the country’s ability to make its own tritium opened and didn’t close for 18 years, until irradiated rods finally returned to the Site in the mid-2000s.
It wasn’t all my fault. The Cold War was ending. The politics were collapsing under their own weight. A lot of hands were on that runaway train.
But I was the one man in that room with the document, the standing, and the regulation on my side. The one positioned to pull the brake.
And I chose self-preservation instead.
That’s the second story.
Years later I learned what 18 years without your own tritium looks like at the far end.
I was sitting in a colleague’s office on his last afternoon before retirement, and he was walking me through the odd postings of a long military career. One of them had put him on a base at a foreign border, where his unit’s job was to receive certain quiet “guests” who arrived carrying tritium for our nuclear warheads.
He told it lightly, the way you tell a war story that’s lost its edges. I didn’t laugh. I said, “That was my fault.”
And then I told him the story you’ve just read. The prestart I turned into a poststart, the 18 years that followed, and the strange arrangements a country makes to keep its warheads alive when it can’t make their tritium at home.
The welder.
By the late 1990s I’d been in the complex almost a decade, and I’d learned one thing above all. What it feels like to be wrong the way I was wrong at the K-Reactor. So when I landed on the AT-400A, I was paying a different kind of attention.
The AT-400A was a container, a $50 million container program headed by Sandia National Laboratory, meant to hold the plutonium pits at the heart of the nation’s warheads in a clean, helium-filled environment for 50 years. There were over 12,000 pits to repackage out of the corroding old AL-R8 drums they sat in. The schedule was tightening. The urgency was climbing.
Each pit was sealed inside a stainless steel containment vessel by a robotic welder that fused the two halves of the vessel along a seam running, as it happened, directly across from the pit’s equator.
The welder fed wire fast. If the turntable spinning the container ever slowed or stuck, the wire would stop tracing a circle and start boring a hole, through the vessel and into the pit, in a fraction of a second.
An energized weld wire striking a plutonium pit can very rapidly progress to a plutonium fire. In a room with people wearing only coveralls, with no respirators or anti-Cs.
I raised rotation failure concern early, with two other nuclear safety professionals. The robot-welding engineers were good, and they tried. They couldn’t engineer the failure mode out.
So the three of us did the thing the K-Reactor had taught me to do. We wrote a minority report saying the project couldn’t go forward as designed, that the risk of a welder failure leading to a pit breach was built into both the machine and the vessel. A senior manager from the Authorization Basis group read it and signed on with us.
Then the fallout hit, and he unsigned. He told his management chain he’d been misled, that we’d led him to it.
The next morning the project manager greeted me with a thin smile and a line a brigadier general had handed me years before, in different words. “I’m surprised you still have a job.”
But this time I wasn’t the only brake, and this time the brake held.
The Defense Nuclear Facilities Safety Board kept its own people stationed at the plant, and they’d been watching. They ran the problem down themselves and landed where we already stood. The line couldn’t start until a burn-through of the containment vessel could be prevented, and most of the open issues were exactly that: controls to stop the weld wire from driving into the pit.
The program tried. It couldn’t reach the weld quality it needed with the safety controls it needed installed at the same time. After packaging 18 pits, 18 out of 12,000, at a program cost north of $60 million, DOE pulled the plug.
Pantex engineers (my very talented colleagues) then sat down and designed a simple “sealed insert”, or SI, container with a bolted lid: the AL-R8 SI. No robot, no weld, no equator to bore through. It solved everything the AT-400A couldn’t, for a fraction of the cost.
Caveat Lector. This is another story from a very different era, when “safety culture” was seen more as a buzzword than a tangible operating principle. I can say with confidence that Pantex’s current leadership is a far cry from that era. In fact, prior to my departure from Pantex in 2009, and at the urging of the then-Pantex president, I authored the first Differing Professional Opinion program within the Department of Energy, and it continues to perform a critical function today.
That’s the third story.
I did what was right, and this time it didn’t cost me my job, because a watchdog with its own authority and no stake in the schedule was standing where I stood.
Remember that board. It matters for how this ends.
What these stories are for.
People expect a founder’s origin story to be the brave one. The needle, the welder, here’s the time I was right, hire me. I don’t fully trust that story, and you shouldn’t either.
The motto on my family’s crest earns its weight from the day I broke it. ‘Do what is right, come what may’ means something exact to me, because I’ve measured what comes when you don’t. In other people’s jobs. In a soldier’s strange posting on a far border.
That measurement is the credential I actually offer.
I know from the inside how a finding gets quietly downsized: the pressure, the windy corner, the reasonable little heartbeat of fear that turns a prestart into a poststart and tells a man to unsign his own name. I’ve done it. I’ve also, later and at less cost, refused to. The difference between those two days is the whole of what I sell.
Here’s the thread that ties it to the work: The thing that nearly started a plutonium fire was a machine doing exactly what it was told, very fast, with no idea what sat a three finger widths past its wire. What stopped it was three people who could picture that pit, who could hold in a human mind the gap between “the spindle is turning at spec” and “if the spindle stops, really bad things happen.”
A model could watch that spindle’s tolerance tighter than any of us. It still wouldn’t know to care what waited on the other side of the seam, or to bear the consequence if it got it wrong.
“True, our knowledge does grow, but it is threatened by greater increases in confidence, which makes our increase in knowledge at the same time an increase in confusion, ignorance, and conceit.”
— Nassim Nicholas Talib, The Black Swan
That’s why, at HealthPhysics.com, we’re building human-led, AI-assisted workflows. Accountability has to live somewhere it can be felt, and a machine has nowhere to feel it. The tools are remarkable, and I’d have welcomed one at the K-Reactor that caught that peristaltic pump before I did. But the machine has no career to protect, no family 1,500 miles from where it started, and no soldier on a border it will ever answer to. Keeping the human in the lead is how you keep the brake within reach of a hand that pays for using it.
It’s the global effort we’re proud to be part of: keeping human endeavor alive in the age of AI.
The Cracks.
I said the third story matters for how this ends. Here’s where we are now.
Decades on, I was handed a spent-nuclear-fuel storage license application that had run into a ditch at the Nuclear Regulatory Commission, and 30 days to get it back on the road. I pulled together a team of very good people, and we got back in the good graces of the regulator ahead of schedule. As a result of the efforts of a world class team, the application was docketed just two months later.
Then came the celebratory call with the agency, and a sentence I haven’t been able to put down since. ‘Keep a spare transport cask on hand,’ I vividly recall the manager telling me. I asked why. ‘You know,’ he said. ‘In case of a leaking canister.’
I was stunned, and not only by the candor. This was the same agency that had spent years playing down the danger that one of those dry-storage canisters could crack and leak, treating chloride-induced stress-corrosion cracking (CISCC) as a risk that didn’t apply here. Those rejoinders were still fresh in the minds of those who attended the public meetings on this application, just months and weeks before.
The known initiators of CISCC are the salts, MgCl and NaCl, and the proposed site literally sat in the salt country of the Southwest, atop the Salado Formation. Salt outcrops in plain view. Haboobs and dust storms that carry salts for miles and lay it down on everything.
At that time, if a canister cracked, we’d have no way to know soon enough to respond before a real problem had been created. There was no planned hot cell to move a leaking canister into a sound one. Even decanting it into a transport cask would surely mean gross contamination of large areas of the site and serious dose to the workers doing it. The people in the surrounding communities had been promised something the project couldn’t deliver, the same promise the folks downstream of the K-Reactor got 40 years before, just in a new landscape.
That saga ended after the sale of the company ran into legal hurdles and the decision was made to wind down the project.
So I did the thing the whole arc had been training me for. I went back to my company and started bringing the danger to the attention of officials and legislators who could do something about it.
Caveat lector. The facility in this story was never built. A 2021 Texas law, House Bill 7, now bars storing high-level radioactive waste in the state. I’m describing it as it stood when I worked on the application, and the agency’s posture I met then, not the intentions of whoever holds it today.
One wrinkle a health physicist can’t let pass: The Texas law bans “high-level radioactive waste,” and spent fuel, strictly, is not that. High-level waste is what’s left after you reprocess spent fuel. So to reach a spent-fuel site, the Legislature had to add a line declaring that, in Texas, high-level waste “includes spent nuclear fuel.” Strip that clause and the ban arguably doesn’t touch the thing it was written to stop.
And here’s the part that should trouble you as much as it troubles me:
The watchdog that saved the AT-400A, the Defense Nuclear Facilities Safety Board, has been under immense pressure for the last decade with political challenges to its mission.
The thousands of spent-fuel canisters now aging on pads at reactor sites across the country, plenty of them in salt or sea air, still don’t have even the equivalent of an under-powered peristaltic pump sniffing for the very leak people and agencies privately concede is possible.
The leaks of my early career have become the cracks of my late one, and the institutions built to catch them are cracking too. We’re returning to the era that made me, except this time the safeguards themselves are coming apart.
I built Ford ES&H Solutions (dba HealthPhysics.com) for that era. The work goes by other names on the invoice, regulatory strategy, licensing support, but underneath all of it is the same job I’ve had since the needle: find the vulnerability that can end the enterprise, and say so out loud while there’s still time to fix it.
For the moment, in some quiet conference room, when a man is about to smile and say ‘good luck with THAT,’ or ‘keep a spare cask around,’ the right answer is the one nobody wants to write down. Somebody has to be willing to write it anyway. And still be willing the next morning, when his own co-signer claims he was misled.
Fais ce que dois, advienne que pourra.
I’ve done it the wrong way once and the right way more than once, and I’ve carried enough of both to know which is which.
That’s the work. It’s the only thing I’m really selling.
Afterword.
I’ll close where the reactor story began, with a readiness review.
Resetting the calendar back to the 90s, by the summer of 1993 I had moved on from Savannah River, to a new company and a new assignment. The Waste Isolation Pilot Plant, the country’s first deep geologic repository for its defense nuclear waste, carved 2,150 feet down into that same ancient bed of salt, the Salado Formation, in southern New Mexico, had been nearly ready to open for years. Its start date kept slipping to the right. While the place got ready one more time, my team was sent in to make sure — one more time.
The Defense Nuclear Facilities Safety Board had issued Recommendation 91-3 on WIPP. Admiral Watkins had answered it with a DOE readiness review of his own. Now, more than a year later, DOE wanted one last independent set of eyes. My piece was the radiological control program, the workplace air monitoring and the confinement ventilation.
The RadCon program was beautiful on paper. It should have been. It had been written, refined, and exercised for more than a decade while everyone waited for the green light.
The confinement ventilation system was another story.
One part of that system had a single job for the worst day. The instant a continuous air monitor in the underground sensed actinide1 airborne radioactivity sufficiently above background, the exhaust was supposed to divert through a bank of HEPA filters before it ever reached the environment. To make that turn, a set of isolation dampers had to swing shut and seal.
Based on my inspections, those isolation dampers didn’t have a prayer of sealing. Salt crystals and ordinary dirt had built up in the plenum until the dampers leaked during the very seal-maneuver it was designed to complete. The path built to catch a release would instead let a share of it slip past the filters and out the stack.
So I wrote what I found. The RadCon program passed. The confinement ventilation system and its (lack of) maintenance failed.
That finding didn’t land like a thunderclap, even on me. I had seen the pattern too many times. The systems built for the off-normal day are the ones very few tend to, because the off-normal day never seems to come. You have to keep them ready for the moment you need them most, and if you treat them with disrespect, they hand it right back, as failure, on the one day it matters.
The startup green light finally came in 1999. WIPP ran almost 15 years without a serious event.
Then, near midnight on February 14, 2014, a drum of waste from Los Alamos, packed with the wrong absorbent, began to heat from within. The reaction built until the drum burst its lid in its underground cell, jettisoning americium- and plutonium-laden particulates into the mine air.
The confinement ventilation system attempted to respond as designed. The alpha CAMS detected the release and tried to shift the underground exhaust air to filtration. And then the same bypass dampers, their leakage known and on the books for years, let a measurable share of the airborne transuranic contamination slip past the HEPA banks and out the exhaust stack into open air, where it was detected at a monitoring station less than a mile away.
The dose was small, well under every limit; 21 workers with traces of internal contamination and no one harmed in a way anyone could measure.
The consequence was enormous.
The only deep geologic repository the country had for its defense waste went dark for years, and for a while it was an open question whether it would ever reopen.
I was less than 100 miles away when I heard about the release, at another facility, doing another version of the same work. All I could do was shake my head. The seal I had written up in 1993 had finally been asked to do its job 21 years later, and it couldn’t.
When the DOE Accident Investigation Board published its report, its own list of concerns read like my old one with the dates changed. Leakage past the bypass dampers. The effect of salt buildup on those same dampers. A maintenance culture that repaired a thing only when it got in the way of moving waste. I had flagged all of it before the place ever opened its doors.
Under the shock sat something heavier, the tired recognition that people stay people. We go blind to the flaw that sits closest to us.
The first three stories in this piece are about the courage to make the call. This one is about the colder thing I learned in that salt mine.
The call is not enough.
John Gardner said it better than I can.
“Most ailing organizations have developed a functional blindness to their own defects. They are not suffering because they cannot resolve their problems, but because they cannot see their problems.”
That is the whole of it. A correct finding, filed and acknowledged and even agreed with, can sit unread for 21 years while the organization around it goes quietly blind to the very defect it was warned about.
Being right is necessary. It has never once been sufficient.
And that blindness is the thing I watch reassembling now. The board that backed me on the welder is being thinned out. The oversight that is supposed to see the defect and force the repair is being hollowed out where it isn’t simply ignored. Nineteen miles from my house, something enormous is going up fast, and the people building it would rather not explain how certain parts of it will work.
So I can’t just write the finding anymore and trust that someone will read it in time. Not now. Not 19 miles from my own front door.
Which is most of the answer to the question I started with. The rest of it, where I’ve been this past year and what I’ve been doing about it, is the next story.
Isotopes of uranium mass and greater (includes plutonium and americium).
Brought to you by:
