> it didn’t shutdown completely. This would be the only possible explanation, and it is directly contradicted by calling it "decay heat". It's pretty tricky

> it didn’t shutdown completely. This would be the only possible explanation, and it is directly contradicted by calling it "decay heat". It's pretty tricky to think of a scenario where you'd have 5-10% of nameplate days after attempted shutdown. The worst incident where there was a failed shutdown-- other than Chernobyl-- that I'm aware of was a 1980 BWR incident. * The reactor was at nearly no power except decay power for the entire duration of the incident: half the rods fully inserted. * Manual remediation got all the rods in within 15 minutes. * Last-ditch shutdown procedures, e.g. SLCS, were unnecessary because there was still sufficient control and rapid rampdown of reactor output. * This is an old BWR design and... * Procedures were updated and improved, and even with these old BWR designs we've had no subsequent incidents in 40 years. Failure to shut down is indeed something really, really bad-- but insisting that cooling be designed to withstand this is a bit silly. Instead, we'd best design to be sure to avoid failures to shutdown, excursions in power far over nameplate, etc... rather than insist cooling systems survive fundamentally unsurvivable events without any intervention. E.g. we don't criticize SL-1's cooling design for not surviving the excursion to 10,000x nameplate.