the water flows by gravity to the top of the reactor where it evaporates to remove heat. The system uses multiple explosively-operated and DC operated valves which must operate within the first 30 minutes. This is designed to happen even if the reactor operators take no action. The electrical system required for initiating the passive systems doesn't rely on external or diesel power and the valves don't rely on hydraulic or compressed air systems. The design is intended to passively remove heat for 72 hours, after which its gravity drain water tank must be topped up for as long as cooling is required. Revision 15 of the AP1000 design has an unusual containment structure which has received approval by the NRC, after a Safety Evaluation Report, and a Design Certification Rule. Revisions 17, 18, and 19 were also approved. Design disputes In April 2010, some environmental organizations called on the NRC to investigate possible limitations in the AP1000 reactor design. These groups appealed to three federal agencies to suspend the licensing process because they believed containment in the new design is weaker than existing reactors. In April 2010, Arnold Gundersen, a nuclear engineer commissioned by several anti-nuclear groups, released a report which explored a hazard associated with the possible rusting through of the containment structure steel liner. In the AP1000 design, the liner and the concrete are separated, and if the steel rusts through, "there is no backup containment behind it" according to Gundersen. If the dome rusted through the design would expel radioactive contaminants and the plant "could deliver a dose of radiation to the public that is 10 times higher than the N.R.C. limit" according to Gundersen. Vaughn Gilbert, a spokesman for Westinghouse, has disputed Gundersen's assessment, stating that the AP1000's steel containment vessel is three-and-a-half to five times thicker than the liners used in current designs, and that corrosion would be readily apparent during routine inspection. Edwin Lyman, a senior staff scientist at the Union of Concerned Scientists, has challenged specific cost-saving design choices made for both the AP1000 and ESBWR, another new design. Lyman is concerned about the strength of the steel containment vessel and the concrete shield building around the AP1000, claiming its containment vessel does not have sufficient safety margins. John Ma, a senior structural engineer at the NRC was quoted on his stance about the AP1000 nuclear reactor. In 2009, the NRC made