PAGENO="0001" NUCLEAR POWERPLANT SAFETY SYSTEMS HEARINGS BEFORE THE SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION OF THE COMMITTEE ON SCIENCE AND TECHNOLOGY U.S. HOUSE OF REPRESENTATIVES NINETY-SIXTH CONGRESS FIRST SESSION MAY 22, 23, 24, 1979 [No. 32] Printed for the use of the Committee on Science and Technology U.S. GOVERNMENT PRINTING OFFICE 48-721 0 WASHINGTON: 1979 For sale by the Superintendent of Documents, U.S. Government Printing Office Washington, D.C., 20402 PAGENO="0002" COMMITTEE ON SCIENCE AND TECHNOLOGY DON FUQUA, Florida, Chairman ROBERT A. ROE, New Jersey MIKE McCORMACK, Washington GEORGE E. BROWN, JR., California JAMES H. SCHEUER, New York RICHARD L. OITINGER, New York TOM HARKIN, Iowa JIM LLOYD, California JEROME A. AMBRO, New York MARILYN LLOYD BOUQUARD, Tennessee JAMES J. BLANCHARD, Michigan DOUG WALGREN, Pennsylvania RONNIE G. FLIPPO, Alabama DAN GLICKMAN, Kansas ALBERT GORE, JR., Tennessee WES WATKINS, Oklahoma ROBERTA. YOUNG, Missouri RICHARD C. WHITE, Texas HAROLD L. VOLKMER, Missouri DONALD J. PEASE, Ohio HOWARD WOLPE, Michigan NICHOLAS MAVROULES, Massachusetts BILL NELSON, Florida BERYL ANTHONY, JR., Arkansas STANLEY N. LUNDINE, New York ALLEN E. ERTEL, Pennsylvania KENT HANCE, Texas HAIIoU) A. Gouu, Executive Director PHILIP B. YEAGER, General Counsel REGINA A. DAVIS, Chief Clerk PAUL A. VANDER MYDE, Minority Staff Director SUBCOMMITrEE ON ENERGY RESEARCH AND PRODUCTION MIKE McCORMACK, Washington, Chairman MARILYN LLOYD BOUQUARD, Tennessee JOHN W. WYDLER, New York ROBERT A. ROE, New Jersey EDWIN B. FORSYTHE, New Jersey STANLEY N. LUNDINE, New York TOBY ROTH, Wisconsin ROBERT A. YOUNG, Missouri BARRY M. GOLDWATER, JR., California RICHARD C. WHITE, Texas MANUEL LUJAN, JR., New Mexico HOWARD WOLPE, Michigan HAROLD C. HOLLENBECK, New Jersey RNNIE G. FLIPPO Alabama NICHOLAS MAVROULES, Massachusetts RICHARD L. O~ETINGER, New York BERYL ANTHONY, JR., Arkansas JOHN W. WYDLER, New York LARRY WINN, JR., Kansas BARRY M. GOLDWATER, JR., California HAMILTON FISH, JR., New York MANUEL LUJAN, JR., New Mexico HAROLD C. HOLLENBECK, New Jersey ROBERT K. DORNAN, California ROBERT S. WALKER, Pennsylvania EDWIN B. FORSYTHE, New Jersey KEN KRAMER, Colorado WILLIAM CARNEY, New York ROBERT W. DAVIS, Michigan TOBY ROTH, Wisconsin DONALD LAWRENCE RY[TER, Pennsylvania BILL ROYER, California (II) PAGENO="0003" CONTENTS WITNESSES May 22, 1979: Page Dr. Joseph Dietrich, chief scientist, Nuclear Power Systems, Combustion Engineering 6 Milton Levenson, director, Nuclear Power Division, Electric Power Re- search Institute 16 William Kennedy, vice president and director of engineering, Stone & Webster Engineering Corp 26 Dr. Chauncey Kepford, director, Environmental Coalition on Nuclear Power 30 Saul Levine, director, Office of Nuclear Regulatory Research, Nuclear Regulatory Commission 92 Dr. Harold W. Lewis, professor of physics, University of California 117 Appendix I: Questions and answers for the record 136 Appendix II: Additional material for the record 247 May 23, 1979: Glen J. Schoessow, professor of nuclear engineering, University of Florida, accompanied by Dr. John G. Stampelos and Fred Domerow 332 Hon. John W. Wydler, U.S. Representative from the State of New York ... 342 John Macmillan, vice president, Nuclear Power Generation Division, Bab- cock & Wilcox Co., accompanied by Donald Roy, Manager, Engineering, Nuclear Power Generation Division 343 Herman Dieckamp, president, General Public Utilities Corp 411 Hon. William W. Scranton III, lieutenant governor, Commonwealth of Pennsylvania 425 Harold Denton, director, Office of Nuclear Reactor Regulation, Nuclear Regulatory Commission, accompanied by Roger Mattson, director, Divi- sion of System Safety, Nuclear Regulatory Commission, and Frank Congel, acting branch chief, Radiological Assessment Branch, Nuclear Regulatory Commission 453 Appendix I: Questions and answers for the record 496 May 24, 1979: Dr. Lars Larsson, technical and scientific attaché, The Swedish Embassy, accompanied by Ingmar Tiren, Manager, Nuclear Safety and Licensing (ASEA-ATOM), Vasteran, Sweden 857 George M. Low, president, Rensselaer Polytechnic Institute 880 Adm. H. G. Rickover, USN, director, Naval Nuclear Propulsion Program.. 917 Appendix I: Additional material for the record 1178 (III) PAGENO="0004" PAGENO="0005" NUCLEAR POWERPLANT SAFETY SYSTEMS TUESDAY, MAY 22, 1979 HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION, COMMITTEE ON SCIENCE AND TECHNOLOGY, Washington, D.C. The subcommittee met, pursuant to notice, at 9:45 a.m., in room 2318, Rayburn House Office Building, Hon. Mike McCormack (chairman of the subcommittee) presiding. Mr. MCCORMACK. The meeting will come to order, please. Good morning, ladies and gentlemen. Today the Subcommittee on Energy Research and Production starts 3 days of hearings on the issue of nuclear powerplant safety. As we are all aware, this subject has been in the public's mind since the Three Mile Island accident on March 28. However, it is important to note that nuclear safety is not a new issue with this committee or with its predecessor, the Joint~Committee on Atomic Energy. It is not a new issue with the Nuclear Regulatory Commis- sion or is predecessor, the Atomic Energy Commission. Indeed, it is not a new issue with the nuclear industry. The need for strict safety precautions has been recognized since the inception of nuclear power development, and this is borne out, of course, by the excellent safety record of our nuclear power- plants. Not a single person has ever been harmed by any nuclear accident in any nuclear powerplant anywhere in the free world. However, it is clear that if nuclear energy is to move forward as a major contributing factor in the energy mix of the free world, the questions concerning nuclear safety that are in the public's mind and that have been exaggerated by the Three Mile Island accident must be understood, must be answered, and must be rationalized. The hearings beginning today are the second in a series of three sets of hearings on nuclear issues which this subcommittee is ad- dressing. Last week the subcommittee held three hearings on nuclear waste management, and on June 13, 14, and 15 they will hold 3 days of hearings on low-level radiation. The Three Mile Island accident, focusing our attention on the question of nuclear safety, was clearly a serious accident. There were a number of mechanical failures, possible design weaknesses, and possible operator errors. All these mechanical failure, design weaknesses, and human errors occurring together in a very short time made the accident as serious as it was. However, it was not a catastrophe, and the maximum radiation exposure received by any citizen was at most equivalent to an X-ray. (1) PAGENO="0006" 2 Similarly, we must remember that this Nation has accumulated about 460 reactor years of experience with licensed commercial nuclear powerplants, and a much larger amount of experience with our naval nuclear reactor program. There are more than 100 li- censed nuclear powerplants operating outside the United States in the free world, also contributing to that pooi of knowledge and experience. In all that time, as I say, there has never been a single person harmed, let alone killed, by any nuclear accident in any nuclear powerplant. I want to emphasize that these hearings today will be broad in scope. We are starting with the basic concepts of nuclear power- plant construction, philosophy, safety, and operation. The main objective of holding these hearings is to help the committee, and the Congress, and members of the public to under- stand the questions associated with nuclear powerplant safety. Also, to help the committee and the Congress to take what steps it feels necessary in assuring that our nuclear powerplants will be even safer in the future than they are today. Learning the lessons from Three Mile Island, asking the tough questions, and providing responsible answers to them will be part of the functioning of this committee. This committee, by the way, has the responsibility for energy research, development, and demonstration associated with our nu- clear powerplant research, development, and demonstration pro- grams which ultimately will lead to commercialization. In conducting these hearings, the subcommittee intends to ex- plore every aspect of safety technology and to conduct a thorough review of the status of the technology. We want to develop a detailed understanding of nuclear safety and operating philosophy as well as the implications of the Three Mile Island accident and any other accident. In so doing, we will seek unique perspectives from outside the nuclear energy community itself and, among others, we will hear from Admiral Rickover, to learn his perspectives on providing ade- quate safety standards for a nuclear system. But today the hear- ings will concentrate on the philosophy and the status of technol- ogy of safety systems and procedures. Today's hearings will include testimony from the nuclear indus- try, the Nuclear Regulatory Commission, and a nuclear critic. The Rasmussen report on reactory safety will also be discussed, togeth- er with recent criticism of it by the Lewis panel. Tomorrow, wit- nesses will concentrate on the Three Mile Island accident itself and its technological implications. That testimony will cover industry, utility, regulatory, and State government views of the accident. We are particularly interested in the system failures and the extent to which human error played a role in the accident. The final hearings on Thursday will provide additional perspec- tives on nuclear safety. Representatives of the Swedish nuclear industry will testify about this program, and Admiral Rickover, as I have said, head of the naval nuclear reactor program, and Dr. George Low, former Deputy Administrator of the National Aero- nautics and Space Administration, will provide their unique views PAGENO="0007" 3 on safety systems and methods for improving the interface between men and machines; Before we move into our testimony this morning, I would like to introduce some distinguished guests that we are honored to have visiting us today. We have with us four Members of the French Parliament, the equivalent of our Congress, and they are seated here to my left, in the front row. Since I am not very good at speaking French or pronouncing French names, I would like to ask Dr. Pierre Zaleski, the nuclear attaché of the French Embassy, to introduce our guests from the French Parliament. Dr. Zaleski. Dr. ZALESKI. Thank you, Mr. McCormack. We have here a delegation of French Parliament, the head of the delegation on my left is Mr. M. Xavier Hamelin, President, Depute du Rhone, l2eme circonscription-Groupe du Rasemblement pour la Republique; Vice President de la Commission de la Production et des Echanges; Conseiller municipal de la Mulatiere; Ne le 4 fevrier 1922. au Lardin-Dordogne; Ingenieur chimiste; Elu a l'Assemblee Nationale le 11 mars 1973; Reelu le 19 mars 1978. Membres: M. Roger Couhier, Depute de la Seine-Saint-Denis, 5eme circonscription-Groupe communiste; Marie de Noisy-le-Sec; Ne le 26 janvier 1928 a Vitrai-sous-Laigle-Orne; Employe a la S.N.C.F.; Elu a l'Assemblee Nationale le 12 mars 1967; Reelu les 11 mars 1973 et 19 ars 1978. M. Paul Pernin, Depute de Paris, ileme circonscription-Appar- ente au groupe de l'Union pour la Democratie fracaise; Marie- adjoint de Paris; Ne le 30 octobre 1914 a Oran-Algerie; Conseil d'entreprise; Elu a l'Assemblee Nationale le 19 mars 1978. M. Allain Chernard, Depute de Loire-Atlantique, 2eme circon- scription-Groupe socialiste; Conseiller general, Marie de Nantes; Ne le 20 fevrier 1937 a Nantes-Loire-Atlantique; Ingenieur; Elu a l'Assemblee Nationale le 19 mars 1978. Mr. MCCORMACK. Thank you very much. I think we ought to give our French guests a hand. [Applause.] May I say for the benefit of the audience that the blonde lady in the middle, who was not introduced, is an interpreter, and since I can't speak French names, I am going to have trouble with that one too. I want to welcome all of you, and say that the representa- tives introduced represent four different French political parties. France has a unified program which provides nuclear leadership throughout the world. Not only are they moving forward agressive- ly with their light-water reactor program, their pressurized-water reactors, but they are also moving forward with the breeder program. The French Phenix has been on line since 1973 and it is perform- ing beautifully. The Super Phenix is under construction near Lyon. The French are glassifying waste and they are way ahead of the rest of the free world in that. They now have a major uranium enrichment program, and of course a reprocessing program. They are providing leadership for all the free world, and we congratulate them on that, and I want to thank you gentlemen. PAGENO="0008" 4 Members who left after they were introduced are going to an- other committee meeting, but they are going as a team, to come here and look at our nuclear program. Before we begin our testimony I would like to welcome Congress- man Goldwater this morning, and I want -to ask Mr. Goldwater if he would like to make an opening statement. Mr. GOLDWATER. Thank you very much, Mr. Chairman. I join you in welcoming our friends from France. France is a great country, and they are a great people, who I think provide our world with leadership and who have made a significant contribu- tion to mankind, and I think it is a wonderful gesture when Mem- bers of the French Parliament come over to exchange ideas and to learn some of the things that we are doing, and hopefully we can learn from them. I think, Mr. Chairman, these hearings are timely. I think this committee must look carefully at the status of safety technology and related procedures and practices for operating nuclear plants. These hearings should indicate where technology improvements are warranted so that the committee can identify areas for specific program initiatives. This is a time for frankness. No one can afford to overlook any aspects of safety which can reasonably be enhanced. Although the nuclear safety record has been very impressive, neither the indus- try nor the utiljties can afford to approach nuclear safety with a business as usual view. A serious accident did occur, and we must learn from it. Today we will learn where the technology is so we can identify specific elements which must be enhanced. Public perception of these issues demands fresh scrutiny I of how to plan for likely events. We should not succumb to any temptation to preoccupy ourselves with a series of improbable accidents. The combination of human error and absence of adequate instrumentation played a role in this incident, and we must look carefully at aspects of the man-machine interface. I believe that our witnesses on the third day will provide unique perspectives from outside of the U.S. civilian nuclear community. From tl~e aerospace aspect, I intend to see that the Three Mile Island becomes the Apollo fire for the nuclear industry. I also believe that we should learn from the naval nuclear propulsion program, which utilizes a most thorough system of training, and checks and balances, to insure that their excellent people are given top quality training. This is a time for soul searching, Mr. Chairman, for without the nuclear option, this country's energy supply problem will be great- ly aggravated. Thank you, Mr. Chairman. Mr. MCCORMACK. Thank you, Mr. Goldwater. Before we proceed with our hearings, I am going to make an announcement for the record. During our hearings last week on high-level nuclear waste man- agement, it became obvious that we are taking too much time with questions and discussions, thus depriving ourselves of the balanced presentation available if all witnesses were to be heard. This is also PAGENO="0009" o unfair to the witnesses, several of whom have come long distances to testify. I expect that this problem of not having enough time for every- one to ask questions, and to say everything he or she wishes, will become apparent this week as we conduct our hearings on nuclear powerplant safety. It will be obvious that we have attempted to schedule a large number of expert witnesses to provide the members of the commit- tee with the benefit of testimony from a number of different view- points. In order to make it possible for us to complete our hearings on schedule, it will be necessary for the Chair to sharply restrict the amount of time allowed for questions. Accordingly, the 5-minute rule will be strictly enforced. In addition, it will not be possible for every member to question every witness. Accordingly, questions of each witness will be struc- tured as follows: After questions by the chairman and the ranking minority member, two members from the majority and one from the minority may question the witness. We will then proceed to the next witness. Then two other members from the majority and one other member from the minority may question that witness. This procedure will be followed until all witnesses have testified and been questioned. If there is additional time after all witnesses have testified and been questioned, additional questions may be asked of any witness who is still present in the room by any member of the committee. In such a situation the 5-minute rule will still apply, and no member may ask more than one question while another member is requesting an opportunity to question a witness. I regret the necessity of establishing such a procedure, but with- out doing so, it will not be possible to obtain the information these witnesses will provide during the time we have available. I know the members of the committee will agree that this system is as fair and practical as any. Our first witness today is Dr. Joseph Dietrich, chief scientist of the Advanced Nuclear Systems Department of the Combustion En- gineering Co. He will participate in a panel which also includes Mr. Milton Levenson, director of the Nuclear Power Division of the Electric Power Research Institute; Mr. William Kennedy, vice president and director of engineering for the Stone & Webster Engineering Corp.; together with Dr. Chauncey Kepford, director of the Environmental Coalition on Nuclear Power. We will ask these four gentlemen to each present his testimony, and then we will have questions following the testimony of the four witnesses. Gentlemen, welcome. We have your written testimony before us, and without objec- tion, all the written testimony that each of you has submitted will be included in the record at this point, and you will be free to proceed to make your presentation and summarize your remarks as you wish. Dr. Dietrich, do you wish to proceed? PAGENO="0010" 6 STATEMENT OF DR. JOSEPH DIETRICH, CHIEF SCIENTIST, NUCLEAR POWER SYSTEMS, COMBUSTION ENGINEERING Dr. DIETRICH. Thank you, Mr. Chairman. It is a pleasure to testify before this committee on the subject of nuclear plant safety. I believe that what I say with respect to safety principles and areas in which safety can be improved is representative of industry thinking, but of course when I speak of what is being done within the industry, I will have to confine my remarks to the activities of my company, Combustion Engineering. I am afraid that when I prepared my written testimony, I did not have an entirely correct concept, had a little bit the wrong impres- sion of the objective of this day's hearings. I thought that its thrust was directly toward the implications of Three Mile Island, but I understand now that the Three Mile Island subject will be ad- dressed directly tomorrow. Mr. MCCORMACK. Dr. Dietrich, we don't want to deprive you of making any point you want to make, and we don't want to deprive this committee of the benefit of your testimony, so I will not try to restrict you to any degree that reduces your effectiveness and makes you uncomfortable. Dr. DIETRICH. Thank you. Today we consider the philosophy and technology of nuclear safety. Nevertheless I think my prepared testimony is pertinent, for we have no reason to question our basic safety approach, that is, the defense in-depth principle which provides not only in-depth safety systems designed to cope with postulated accident sequences, but also safeguards of a more general nature with capabilities for countering the effects of unforeseen sequences. The general safeguards saved the day at Three Mile Island, and provided the means to protect the public. I believe that the only fruitful reexamination of our safety philosphy and technology must be one based on the Three Mile Island experience, which I think did not invalidate the basic principles or the effectiveness of our technology, but did indicate the need for a certain shift of emphasis. I am appending to my testimony a list of potential research and development projects which are consistent with the lessons of Three Mile Island, and which we at Combustion Engineering feel are worth assessment for possible Government support. Each of the projects listed is directed toward a rather specific safety function. Most of these functions are applicable generally to pressurized-water nuclear plants, but their effectiveness, the need for them, and the ease or difficulty of implementing them depend upon overall plant design. We, therefore, believe that, for maxi- mum effectiveness, the examination of specific possibilities such as these should be supplemented by an integrated approach which would not only consider existing and proposed individual safety features but would also reexamine the design approaches used for the plant itself. Here I am not speaking of the possibility of major changes in plant design concepts but of approaches to detailed design which might have safety benefits. PAGENO="0011" 7 The objective would be to implement design principles which best serve a threefold purpose: First, to make less difficult demands on the operator, and to be more forgiving of operator errors through minimization of the fre- quency of occurrence and speed of development of operational per- turbations with potential for hazard; Second, to increase the effectiveness of safety systems and engi- neered safeguards, and, to the extent possible, to decrease the complexity of integrating those safety features into the overall plant design; and Third, without compromising the protection of the public from the most severe postulated accidents, to improve defenses against lesser accidents which may result in substantial financial loss and which erode public confidence even if they produce no substantial public hazard. We recommend a project with these approaches and objectives which would draw expertise from all appropriate segments of the industry and which would be conducted under the aegis of some organization with the capability of sponsoring intraindustry efforts, such as the American National Standards Institute. I will now consider directly the specific and generic consider- ations that have resulted from the Three Mile Island experience. The first lesson to be learned is that we must continue to improve the communication between machine and man, and of course I mean this to apply to the operating phase. Communication from machine to man comes by way of instru- mentation. We know that the Three Mile Island experience sug- gested certain specific hardware improvements that might be made in the instrumentation area. Although the Combustion Engineer- ing plants are rather different in design from the Three Mile Island plant and would have responded differently to the initiating events, we are currently examining these suggested improvements for feasibility, method, and value. They include: Positive position indication-that is, open or shut-for critical valves; Instrumentation for indicating water level in the reactor vessel; and Improved instruments for detecting significant leakage from the primary system. Generically, the Three Mile Island experience has suggested the degree of safety could be improved by simplyfing the interpretation of instrument readings. With this in mind we are initiating an instrumentation review of the Combustion Engineering plants which addresses the generic problem as well as the specific instru- mentation needs suggested by the incident. The review has the following objectives: Find the most direct and positive ways of indicating those condi- tions that are crucial to the safety of the plant; Search out any abnormal conditions under which each particular type of instrument could give readings having a significant differ- ence from the normal one, and correct that; and Finally, whenever possible, assist the operator in recognizing abnormal conditions quickly by combining information from differ- ent instruments automatically-for example, via a computer-in PAGENO="0012" 8 cases where such information processing would give direct indica- tion of an abnormality. Let me emphasize that we are proceeding out of a sense of prudence, not of doubt about the safety of our systems instrumen- tation. Our customers, the public, expect no less of us in light of the Three Mile Island incident. On a related, important subject, additional members of the operating crews must be given greater understanding of the entire plant's behavior and of the physical principles that govern that behavior. Let me now address the second generic lesson to be learned from Three Mile Island: the need for more attention to generalized safeguards as well as those that deal with prepostulated accident scenarios. The containment building is such a generalized safeguard, and it certainly proved its value at Three Mile Island. We do not visualize another generalized safeguard of the scope and magnitude of the containment building, but we do see the need to continue to search out the possibilities of hazardous conditions, regardless of how those conditions might come into being, and provide means to cope with them. The Three Mile Island experience, for example, demonstrated the need for a means of remotely controlled venting of noncondensible gases from the dome of the reactor vessel. We are undertaking a generic investigation of the need for addi- tional general safeguards equipment. In conclusion, let me say that the engineering of new safety equipment must proceed on an integrated systems basis to assure that equipment added to improve safety under one set of circum- stances does not degrade it under other circumstances. Finally, let me repeat something our company president, Mr. Arthur Santry, said recently at our annual meeting of sharehold- ers. He said that it is essential that we all heed President Carter's urging to proceed with "care and reason" in considering the effects of the Three Mile Island incident. Nuclear power is far too important to be written off in an atmos- phere of fear, doubt, and incomplete information. I know that you, Mr. Chairman, and the members of your committee are sincerely engaged in a search for truth about nuclear plant safety, and I pledge my full support and that of my colleagues in the Nuclear Power Systems Division of Combustion Engineering to help toward that end. I thank you very much. [The prepared statement and biographical sketch of Dr. Dietrich follow:] PAGENO="0013" 9 Testimony for the Subcommittee on Energy Research and Production of the U. S. House of Representatives, 5/22/79 I am Joseph R. Dietrich, Chief Scientist for Nuclear Power Systems at Combustion Engineering, Inc., and for many years Chairman of the Nuclear Safety Committee for my company. It is a pleasure to testify before the Subcommittee on Energy Research and Production, on the subject of nuclear plant safety. I believe that what I say with respect to safety principles and areas in which safety can be improved is representa- tive of industry thinking, but when I speak of what is being done within the industry I am confining my remarks to the activities of Combustion Engineering. I am sure that a primary concern of this Committee is the implications of the recent incident at Three. Mile Island, so I will concentrate on those implications. The Three Mile Island experience is regrettable and very costly, and an experience which we are studying intensively so that our knowledge of safety technology and operating practices may continue to improve. A nuclear power plant is a complex system of machinery. That is why its designers have adopted the defense-in-depth principle for its safety design That principle provides not only in-depth safety systems and carefully engineering safe- guards designed to cope with postulated accident sequences, but also safeguards of a more general nature with capabilities for countering the effects of unforeseen sequences. I believe the public is protected by the generalized safeguards. The Three Mile Island incident did not prove otherwise. While the specific accident sequence was unforeseen, the engineered safeguards used were successful in protecting the public. One generic lesson to be learned from Three Mile Island is that we must continue to improve the communication between machine and man. Another is that we must give increased attention to generalized safeguards, as distinguished from those that deal with pre-postulated accident scenarios. In discussing these points I will cite specific improvements suggested by the Three Mile Island experience, and place them in the context of more generalized classes of possible safety improvements which merit further investigation. I am also appending to this testimony a list of potential research and development projects which are consistent with the approaches suggested here, and which we at Combustion Engineering feel are worth assessment for possible government support. Some of these have already been discussed with appropriate staff of the Department of Energy. PAGENO="0014" 10 Each of the projects listed is directed toward a rather specific safety function. Most of these functions are applicable generally to pressurized water nuclear plants, but their effectiveness, the need for them, and the ease or difficulty of implementing them depend upon over-all plant design. We therefore believe that, for maximum effectiveness, the examination of specific possibilities such as these should be supplemented by an integrated approach which would not only consider existing and proposed individual safety features, but would also re-examine the design approaches used for the plant itself. Here I am not speaking of the possi- bility of major changes in plant design concepts, but of approaches to detailed design which might have safety benefits. The objective would be to implement design principles which best serve a three-fold purpose: - to make less difficult demands on the operator, and to be more forgiving of operator errors through minimization of the fre- quency of occurrence and speed of development of operational perturbations with potential for hazard; - to increase the effectiveness of safety systems and engineered safeguards, and, to the extent possible, to decrease the com- plexity of integrating those safety features into the over-all plant design; - without compromising the protection of the public from the most severe postulated accidents, to improve defenses against lesser accidents which may result in substantial financial loss and which erode public confidence even if they produce no substantial public hazard. We recommend a project with these approaches and objectives which would draw expertise from all appropriate segments of the industry, and which would be conducted under the aegis of some organization with the capability of sponsoying intra-industry efforts, such as the American National Standards Institute. V PAGENO="0015" 11 Let me now return to the subject of the specific and generic considerations that have resulted from the Three Mile Island experience. I have said earlier that the first lesson is that we must continue to improve the communication be- tween machine and man, and I mean this to apply to the operating phase. Communication from machine to man comes by way of instrumentation. We know that the Three Mile Island experience suggested certain specific hard- ware improvements that might be made in the instrumentation area. Although the Combustion Engineering plants are rather different in design from the Three Mile Island plant, and would have responded differently to the initiating events, we are currently examining these suggested improvements for feasibility, method, and value. They include: - Positive position indication (i. e. open or shut) for critical valves. - Instrumentation for indicating water level in the reactor vessel. - Improved instruments for detecting significant leakage from the primary system. (~ffl~'5i~ The Three Mile Island experience has suggested the degree of safety could be improved by simplifying the interpretation of instrument readings. With this in mind we are initiating an instrumentation review of the Combustion Engineering plants which addresses the generic problem as well as the specific instrumentation needs suggested by the incident. The review has the following objectives: - Find the most direct and positive ways of indicating those conditions that are crucial to the safety of the plant. - Search out any abnormal conditions under which each particular type of instrument could give r~adings having a significance different from the normal one./ When such conditions are found, provide other instruments or adequate operator instructions for recognizing the abnormality. - JWhenever possible, assist the operator in recognizing abnormal conditions quickly by combining information from different instru- ments automatically (e. g. via a computer) in cases where such information processing would give direct indication of an abnormality. Let rue emphasize that we are proceeding out of a sense of prudence, not of doubt about the safety of our systems' instrumentation. Our customers, the public, expect no less of us in light of the Three Mile Island incident. On a related, important, subject, additional members of the operating crews must be given greater understanding of the entire plant's behavior and of the physical principles that govern that behavior. PAGENO="0016" 12 Let me now address the second generic lesson to be learned from Three Mile Island: the need for more attention to generalized safeguards as well as those that deal with pre-postulated accident scenarios. The containment building is such a generalized safeguard, and it certainly proved its value at Three Mile Island. We do not visualize another generalized safeguard of the scope and magni- tude of the containment building, but we do see the need to continue to search out the possibilities of hazardous conditions, regardless of how those conditions might come into being, and provide means to cope with them. The Three Mile Island experience, for example, demonstrated the need for a means of remotely con_I trolled venting of non- condensible gases from the dome of the reactor vesselY While we do not believe that there was ever a danger from the explosion of the so-called hydrogen bubble, the presence of that non-condensible gas was a major impediment to coolant circulation and pressure reduction during the process of recovery from the incident. A generic investigation of the need for additional general safeguard equipment is being initiated at Combustion Engineering. J In conclusion let me say that the engineering of new safety equipment must proceed on an integrated systems basis to assure that equipment added to improve safety under one set of circumstances does not degrade it undef other circumstances. Finally, let me repeat something our Company presiden4aid recently at our annual meeting of shareholders. He said that it is essential that we all heed President Carter's urging to proceed with/care and reason' in considering the effects of the Three Mile Island incident. iAdding to that, let me say, there is no justification, in my opinion, to denigrate the bard work of many talented, dedicated engineers and scientists who literally have devoted their lives to trying to make nuclear power work for the nation's energy needs-with the utmost concern for the safety of our citizens and workers. There also is no justification to automatically condemn as hazardous the nuclear plants that have been operating efficiently and safely for many years before the ThU incident. I believe you, Congressman McCormack, and the members of your subcom- mittee are sincerely engaged in a search for truth about nuclear plant safety and I pledge my full support and that of my colleagues in the Nuclear Power Systems Division of Combustion Engineering to help in that end. Again, as Arthur J. Santry, Jr., Combustion Engineering's president has said, "Nuclear power is far too important to be written off in an atmosphere of fear, doubt and incomplete information'. Thank you for your attention. PAGENO="0017" 13 List of Suggested R&D Pro~~ The following is a suggested list of projects for consideration in a government_sponsored safety R&D program. The list contains some that have not yet been thoroughly assessed for their potential value or effective- ness. There is no intent to imply that the developmental products of all of the projects listed are needed for safety improvement: some of the projects represent alternate routes to the same result, and some would simply result in alternate, and possibly better, ways of implementing safety functions already provided on operating plants. - Improvement of Analytical Methods and Computer Codes 1. Development of a Best Estimate* NSSS (Nuclear Steam Supply System) Simulation Code for Non-LOCA Design Basis Events 2. Development and Test of a Best Estimate* Small Break LOCA Model 3. Development of an Improved Set of Event Scenarios for Consider- ation During Safety Evaluations 4. Verification of Methodology of Best Estimate* NSSS Models 5. Extension of NSSS Simulation Codes to Include the Power Conversion System - Analytical Investigations 1. Best Estimate* NSSS and Containment Transient Analysis for Operator Guidance and Training 2. Evaluations of Changes in Plant Design Features 3. Natural Circulation Separate Effects Studies and Best Estimate Analysis* * Analyses and computer codes used for licensing calculations have built-in conservatisms which yield conservative results, but distort the calculated * course of events relative to reality. Alternate best estimate codes are needed to give designers and operators the true picture of the physical situation to be addressed. 48~~721 0 - 79 2 PAGENO="0018" 14 4. Analysis of Post-Accident Operation of Reactor Coolant Pump Auxiliaries and Recommendations for Post-Accident Handling of Pumps 5. Development of Fuel Behavior Analysis System, and Analysis of Methods of Operation for Minimizing Probability of Fuel Damage 6. Analytical Prediction of Behavior of Reactor Core When Under-Cooled - Fluid System Improvements 1. Design Development of a High Pressure Shutdown Cooling System 2. Design Development of a Passive Residual Heat Removal System 3. Design Development of a Post-Accident Sampling and Chemical Control System 4. Design Development of a Post-Accident Reactor Coolant System Venting and Degassing System 5. Evaluation of Radioactive Waste Processing Systems under Post- Accident Conditions 6. Equipment Certification for Radioactive Waste Treatment Systems under Post-Accident Conditions - Instrumentation, Control, and Monitoring 1. Development of a Reliable System for Giving Positive Indication of Relief Valve Position 2. Feasibility Evaluation of Measurement of Reactor Vessel Water Level 3. Development of a Plant Status Monitoring System 4. Development of a Display System to Indicate Proximity to Operating Limitations During Off-Normal Conditions 5. Development of a Display System to Indicate and Predict Trends of Safety-Related Plant Variables 6. Development of a Post-Accident Plant Monitoring System PAGENO="0019" 15 - Operating Procedures and Man-Machine Interface 1. Develop and Assess Symptom/Function Oriented Operating Procedures for Abnormal Conditions, as an Alternative to Event Oriented Procedures 2. Improve and Expand Procedures for Initiating and Maintaining Natural Circulation 3. Improve Information Displays through the Application of Human Engineering Principles 4. Development of an Advanced Monitoring System to Provide Diagnostic Information, Recommend Corrective Actions, and Pre-Calculate Effects of Specific Operator Actions under Prevailing Conditions PAGENO="0020" 16 RESUME JOSEPH R. DIETRICH Chief Scientist, Nuclear Power Systems, Combustion Engineering, Inc., Ph. D., Physics, University of Virginia, 1939. During the years of World War U worked as a physicist with National Advisory Committee for Aeronautics. Has been in nuclear power development since 1946, joining the first "Power Pile" group at Oak Ridge. Later, at Argonne National Laboratory, was in charge of reactor physics for the prototype power plant for first nuclear submarine. At Argonne was in charge of planning, theory and experimental instrumentation for BORAX experi- ments, and during 1953 and 1954 was one of team which carried out the experiments at National Reactor Testing Station. These were the first large-scale reactor safety experiments; they demonstrated the inherent safety of the light water moderated nuclear reactor against reactivity accidents, and proved the feasibility of the boiling water reactor. Later became Associate Director of the Reactor Engineering Division at Argonne. 1956-1964, a Vice President of General Nuclear Engineering Corporation, Dunedin, Florida, which, during the latter part of that period, was a subsidiary of Combustion Engineering. In 1964 became Chief Scientist, Nuclear Power Systems, for Combustion Engineering at Windsor, Connecticut. His current duties cover line responsibility for advanced systems, including the fast breeder, as well as participation in such over-all tech- nical management activities as R&D direction, coordination of international technical cooperation, and planning and policy decisions. Compiled and edited (with Dr. Walter H. Zinn) the United States Presentation volume Solid Fuel Reactors for Second International Con- ference on Peaceful Uses of Atomic Energy in 1958. Was Editor of AEC- published quarterly technical review, Power Reactor Technolo_gy from 1961 to 1965. Fellow, and was President of American Nuclear Society for the 1977-l978terrn; Member, National Academy of Engineering. Mr. MCCORMACK. Thank you, Dr. Dietrich. We appreciate yc:lv statement, and I have some questions for you when the times comes. I would like to move now to Mr. Milton Levenson. Mr. Levenson is director of the Nuclear Power Division of the Electric Power Research Institute. EPRI is doing a great deal of research on its own, and it has been doing so for a long time. We are very pleased to have you here, Milt, and we would like to ask you to proceed with your testimony as you wish. STATEMENT OF MILTON LEVENSON, DIRECTOR, NUCLEAR POWER DIVISION, ELECTRIC POWER RESEARCH INSTITUTE Mr. LEVENSON. Thank you. Mr. Chairman, members of the committee and distinguished guests, my name is Milton Levenson. I am director of the Nuclear Power Division of the Electric Power Research Institute. I recently served as chairman of the Three Mile Island Ad Hoc Industry Advisory Group, a group of 100 experts from all sectors of the technical community, including reactor manufacturers, archi- tect/engineers, utilities, national laboratories, universities, consult- PAGENO="0021" 17 ants, NASA, and EPRI. This group responded to the call for help issued by GPU, and provided an independent onsite review of all major actions undertaken during the month following the TMI accident. The basis of my remarks is this recent experience super- imposed on a background of 35 years in nuclear R. & D. The aspect of today's hearing theme of "Nuclear Reactor Safety Systems-Philosophy and Technology" that I would like to com- ment on is the man-machine interface. Dr. Dietrich has mentioned that phrase. One member, Mr. Gold~ water, also mentioned that phrase. It is clearly an important part of the issue, but I think it is not just the classical question of what should be done by a man or what should be done by the machine, but I think we must address the much broader issues of man's relation to the machine, not only the man in the control room, but during design, construction, management, all aspects of operation, including maintenance, and regulation. The TMI accident was very serious from a plant damage stand- point, and involved a very complex chain of events whose succes- sion after the originating event was triggered by both men and machines. Because of the complex nature of both the systems and the accident, it will be some time before all the lessons that can be learned are learned. In fact, a significant number of the lessons- my personal opinion is the majority of the lessons-will have noth- ing to do with the accident itself but will be learned because the system is being subjected to a scrutiny considerably more intense and somewhat different in direction than has been the case in the recent past. During the weeks spent at Harrisburg and in the weeks since, I have been attempting to categorize, both the initiating events and the secondary events-not only from the overall safety aspects concerning what should we do about running plants, but also from the viewpoint of on the nuclear R. & D. program for which EPRI is responsible. I have been unable to identify any new phenomena uncovered by the accident, nor have there really been any major surprises to the technical or scientific community with the exception, and it is perhaps a very large exception, of the realization of how preoccu- pied everyone had become with an unlikely public catastrophe- TMJ was not such a catastrophe. I am sure that the current scrutiny nuclear plants are undergo-* ing will lead to some changes in the nuclear steam supply system hardware, some changes in the balance of plant, some revision in the roles and emphasis of supervision and management, some revi- sions in operations including information display and analysis. It will probably also lead to revisions in the emphasis of training programs and procedures and to changes in regulation. These changes will not require extensive new developments nor research into entirely new areas nor require new technology, but rather will require that we go back into more mundane areas we once explored more thoroughly, but in recent years have skimmed over in our search for larger and more serious pseudo-hazards with which to terrify ourselves. Designing and building powerplants so that they have a minimum probability of failing under improbable events does not guarantee maximum safety and does not guarantee PAGENO="0022" 18 that the risk to the public is at the practically achievable mini- mum. It is much more important to design and protect against events which are more likely to occur. Training operators to respond to accidents initiated by double ended, guillotine, large pipe breaks, coincident with either a large earthquake or a large commercial airliner crashing into the plant does not necessarily train that operator to properly cope with a stuck valve or an ambiguous water level indication, and more intense training is no answer if the training is for the wrong contingency. Risk assessments have been done by many groups in this country and several are underway abroad. I don't intend to get into the argument of the merits of any particular study nor defend the absolute values of any of the conclusions, but I think there is one thing that is consistent in all of the studies and I think is defensi- ble, and that is the maximum risk arises not from the maximum events, but rather from the aggregate of the lesser events. The message of Three Mile Island is that we must go back and assure ourselves that we are doing everything that is practical to reduce the risk to the public and to the plant, instead of attempt- ing to assure ourselves that we are doing everything possible about the largest conceivable accidents. To do this, we must review our plant designs. We must ask ourselves how we operate our plants and how we manage them and how we regulate them when lesser accidents occur so that another TMI sump pump out doesn't occur. We must refocus the thinking of the designers, the builders, the owners, the operators, and the regulators toward this objective of minimizing the real risks. It is essential that this be a common objective because if it is not also the objective of the reviewers and regulators, it becomes an unachievable goal. The theme of today's session is "Safety Systems," and we all recognize that both men and machines are essential parts of that system. I believe that safety enhancement will be maximized by remembering that it isn't only the operator and the switch he throws, but also the designer and the lines he draws, the electri- cian and the wires he pulls, and the regulator and the changes he permits or induces or in some cases demands. Each of these actions can be done correctly and each can be done incorrectly, and there- fore, reviews of checks and balances must exist for all. It should be noted that while TMI was a very serious accident from the property damage standpoint and from its financial impact, and we should recognize that the financial impact is due primarily to the high price of the replacement electricity produced from oil compared to the cheaper cost of nuclear power, and it may have been a disaster from the communications standpoint, it was not a disaster from the public safety standpoint. Because many of the lessons learned have already been imple- mented, those nuclear plants now operating are even safer than they were before the accident. PAGENO="0023" 19 In closing, I would like to say that I think it would be unfortu- nate indeed if TMI resulted in massive new programs to explore extremely unlikely events, or at the other extreme, people attempt to gloss it over by saying, it is just better operator training is all we need, or better management. It was a system problem. I think we must review all aspects of this system and improve each and every piece of the total system. Thank you, Mr. Chairman. [The prepared statement and biographical sketch of Mr. Levenson follow:] PAGENO="0024" - 20 MILTON LEVENSON Milton Levenson is Director. of the Nuclear Power Division, Electric Power Research Institute (EPRI), Palo Alto, California. Prior to joining EPRI, Levenson was Associate Laboratory Director for Energy and Environment at the Argonne National Laboratory in Argonne, Illinois. At Argonne he at various times held the positions of project manager of the Argonne Advanced Research Reactor, Project Director of the Experimental Breeder Reactor, and Deputy Director of the Chemical Engineering Division. Prior to joining Argonne, Mr. Levenson worked at what is now the Oak Ridge National Laboratory from 1944 to 1948. Levenson was chairman of Argonne's Reactor Safety Review Committee from 1954 to 1968 and was technical advisor at the Geneva Conferences on the Peaceful Uses of Atomic Energy in 1958, 1964, and 1971. Levenson is a member of the National Academy of Engineering, a Fellow of the American Nuclear Society, and~a member of the American Institute of Chemical Engineers as well as the recipient of its Robert E. Wilson Award for 1975. PAGENO="0025" 21 TESTIMONY FOR THE HOUSE SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION BY MILTON LEVENSON MAY 22, 1979 Electric Power Research Institute P. 0. Box 1O4~2 Palo Alto, CA 94303 415/855-2030 PAGENO="0026" 22 Testimony for the House Subcommittee on Energy Research and Production by Hilton Levenson May22, 1979 Mr. Chairman, members of the committee, my name is Milton Levenson. I am Director of the Nuclear Power Division of the Electric Power Research Institute.* I recently served as Chairman of the Three Mile Island Ad Hoc Industry Advisory Group, a group of 100 experts from all sectors of the technical community including reactor vendors, architect/engineers, utilities, National Laboratories, universities, consultants, NASA and EPRI. This group responded to the call for help and provided an independent on-site review of all major actions undertaken during the month following the TNT accident. The basis of these remarks is this most recent experience superimposed on a background of 35 years in nuclear R & D. The aspect of todays hearing theme of Nuclear Reactor Safety Systems - Philosophy and Technology that I would like to comment on is the man-machine interface - not just the classical question of what should be done by a man and what should be automated, but rather the much broader issues of man's relation to the machine during design, construction, management, operation, and regulation. The THI accident was very serious from a plant damage standpoint, and involved a very complex chain of events whose succession was triggered by both men and machines. Because of the complex nature of both the systems and the accident, it will be sometime before all the lessons that can be learned are learned and, in fact, * EPRI is a not-for-profit research institute established by the electric utility industry to manage research leading toward low cost, yet reliable electric power. The membership consists of government, municipal , rural cooperative and investor-owned utilities. Approximately one-quarter of the budget is related to research in the nuclear power area, about 30 is devoted to fossil fuel research, and there are ongoing programs in all relevent areas of electric power research. PAGENO="0027" 23 a significant number of the lessons will have nothing to do with the accident, but will be learned because the system is being subjected to a scrutiny considerably more intense than has been the case in the recent past. During the weeks spent at Harrisburg and in the weeks since, we have been attempting to categorize both the initiating events and the secondary events - not only from the overall safety aspects, but also from the viewpoint of impact on the Nuclear R & D Program that EPRI is responsible for. We have been unable to identify any new phenomena uncovered by the accident, nor have there really been any major surprises to the technical or scientific community except for the realization of how preoccupied everyone had become with the unlikely public catastrophe. I am sure that the current scrutiny will eventually lead to some changes in the Nuclear Steam Supply System Hardware, to some changes in the Balance of Plant Hardware, to some revision in the roles and emphasis of supervision and management, to some revisions in operations including information display and analysis and revisions in the emphasis of training programs and procedures and also to changes in regulation. These changes will not require extensive new developments nor research into entirely new areas nor require new technology, but rather will require that we go back into more mundane areas we once exploed more thoroughly, but in recent years have skimmed over in our search for larger and more serious hazards with which to terrify ourselves. Designing and building power plants so that they have a minimum probability of failing under improbable events does not guarantee maximum safety and does not guarantee that the risk to the public is at the practically achievable minimum. It is more important to design and protect against the more likely. -2- PAGENO="0028" 24 Training operators to respond to accidents initiated by double ended guillotine large ~pipe breaks coincident witheitirer a large earthquake or a large commercial airliner crashing into the plant does not necessarily train that operator to properly cope with a stuck valve or an ambiguous water level indication. Risk assessments have been done by many groups in this country and several are underway abroad. I dont intend to argue the merits of any particular study nor defend the absolute values of any of the conclusions, but one thing the studies all point out is that the maximum risk arises not from the maximum events, but rather from the aggregate of the lessor events. The confirmatory message of Three Mile Island is that we must go back and assure ourselves that we are doing everything that is practical to reduce the risk to the public and to the plant, instead of attempting to assure ourselves that we are doing everything possible about the largest conceivable accidents. To do this, we must review our designs and plants for lessor events - for example, to make sure that containment buildings isolate on lessor accidents so that another TWI sump pump-out doesn't occur automatically. We must refocus the thinking of the designers, the builders, the owners, the operators and the regulators toward this objective of minimizing real risks. It is essential that this be a common objective, because if it is not also the objective of the reviewers and regulators, it becomes an unachievable goal. The theme of today's session is Safety Systems, and we all recognize that both men and machines are essential parts of that system. I believe that safety enhancement will be maximized by remembering that it isn't only the operator and the switch he throws, but rather also the designer and the lines he draws, the electrician and the wires he pulls, and the regulator and the changes -3- PAGENO="0029" 25 he permits or induces or demands. Each of these actions can be done correctly and each can be done incorrectly and, therefore, reviews of checks and balances must exist for all. It should be noted that while It'll was a very serious accident from the property damage standpoint and from its financial impact - due primarily to the high price of the replacement electricity produced from oil compared to nuclear - and it may have been a disaster from the communication standpoint, it was not a disaster from the public health standpoint. Because many of the lhssons learned have already been implemented; those nuclear plants now operating are even safer than they were before the accident. In closing, I would like to say that I think it would be unfortunate indeed if It'll resulted in massive new programs to explore the unlikely or, at the other extreme, resulted in people oversimplifying the cause and saying we just need different management or better operators or more training will solve it all. It was a system problem, and we must address it as such. MILTON LEVENSON Milton Levenson is Director of the Nuclear Power Division, Electric Power Re- search Institute (EPRI), Palo Alto, California. Prior to joining EPRI, Levenson was Associate Laboratory Director for Energy and Environment at the Argonne National Laboratory in Argonne, Illinois. At Argonne he at various times held the positions of project manager of the Argonne Advanced Research Reactor, Project Director of the Experimental Breeder Reactor, and Deputy Director of the Chemical Engineering Division. Prior to joining Argonne, Mr. Levenson worked at what is now the Oak Ridge National Laboratory from 1944 to 1948. Levenson was chairman of Argonne's Reactor Safety Review Committee from 1954 to 1968 and was technical advisor at the Geneva Conferences on the Peaceful Uses of Atomic Energy in 1958, 1964, and 1971. Levenson is a member of the National Academy of Engineering, a Fellow of the American Nuclear Society, and a member of the American Institute of Chemical Engineers as well as the recipient of its Robert E. Wilson Award for 1975. Mr. MCCORMACK. Thank you, Mr. Levenson. We also have some questions for you when the time comes. Our next witness is Mr. William Kennedy, vice president and director of engineering, Stone & Webster Engineering Corp. Mr. Kennedy, you are welcome. We have your testimony in its entirety, and it will be included in the record, and we should like to have you proceed as you wish. PAGENO="0030" 26 STATEMENT OF WILLIAM KENNEDY, VICE PRESIDENT AND DI- RECTOR OF ENGINEERING, STONE & WEBSTER ENGINEERING CORP. Mr. KENNEDY. Thank you very much, Mr. Chairman. I will summarize my testimony, and probably throw in a few more thoughts. My name is Bill Kennedy, vice president and director of engi- neering of Stone & Webster. Not only am I responsible for our nuclear work, but I do a great deal in fusion, solar, and all kinds of other things. Mr. MCCORMACK. I am going to have to ask you to speak a little harder into that mike. You have to drive these mikes pretty hard. Mr. KENNEDY. I am glad to appear before the committee today to offer some general thoughts on a part of the engineering profession in the nuclear industry. Safety, it is fundamental to an engineer's philosophy. We have in nuclear industry probably misled the public in that we have al- lowed ourselves to concentrate on major accidents with extremely low probability, and in that way we have allowed the public to believe that we thought and told them we could design foolproof systems. We cannot nor do we need to. All of the accidents with which I am familiar in some detail, and I will not comment on Three Mile Island greatly because I have had tremendous difficulty in trying to sort out the facts from fiction, but from Fermi 1 on, in no case was this the kind of an accident on which we had spent the majority of our time. They were much smaller accidents. Certainly they had tremendous eco- nomic impact, but none of these accidents represented a clear danger to the public. The public, however, is left with the impression that we have said that it couldn't happen. Well, what we said couldn't happen didn't in fact happen. We have spent far too much time worrying about these major accidents, a double ended rupture of 3½ inch thick wall pipe, and we have not spent enough time looking at the reliability of lesser important systems. As engineers, we assume that there will be failures of equipment, operators, and designs, and our designs take this into consideration by the use of redundancy and diversity in these, and as a matter of fact, the nuclear reactor is a pretty important giving device. The plant itself at Three Mile Island and at Fermi before it, the reactor portion of the plant performed very well. Good engineering then does not assume nothing can go wrong. In fact it assumes precisely the oposite and tries to take account of that. I have brought along with me a scale model over there which the committee may find of some interest in looking at some of the details regarding safety systems and defense in depth, and I will not dwell on that. Mr. GOLDWATER. Mr. Kennedy, I am having a difficult time hearing you. Mr. KENNEDY. I will have to try speaking louder then. The next two points that I would like to address are quality assurance and standardization, and I can't help note our French friends here. Some of my associates had the privilege of visiting PAGENO="0031" 27 Gravelines not so long ago. Plants are built in 5 years and on a continuous basis. One of the major difficulties with our quality control requirements in the United States is the fact that the industry is starting and stopping. Our construction workers can and will do a good job. They are interested in quality, particularly they understand the importance of it. Yet all of the changes and all of the time delays that we put into our designs are very debili- tating. There is nothing that hurts a workman worse than to see his work removed because somebody decided it needed to be a little bit different. It is a terrible thing on workmen, and pretty quickly they lose interest. Also, when jobs are started and stopped, it is very hard for them to believe that it is really necessary. As far as standardization is concerned, I am personally convinced that once again we have referred in large measure to the major accident, whereas it is the detailed engineering that will make this industry go. It is attention to detail. Just to give you some indication, I worked and was project engi- neer on the Connecticut Yankee plant, of which I am extremely proud. We spend right now in the design portion for great earth- quakes more than the entire engineering that we put in the Con- necticut Yankee plant. I personally think that is a complete and total waste. We should be looking at the system design and not wasting our time looking at these very unusual accidents in the depth that we are. Now I believe the standardization can particularly allow us to get ahead with designs that will in fact withstand major earth- quakes, and I note in passing that there is no instance of a modern powerplant being damaged by an earthquake anywhere in the world, and we spend unbelievable amounts of engineering time in doing seismic analysis. But standardization, allows engineers to look at the things we need to, the regulators to look at the things that they need to, and the operators not to have a diversity of plants in which to operate, and when an accident does occur, that there will be many more people much more familiar with the plant. Certainly the recent accident at Three Mile Island is of great interest to all of us. It is certainly a laboratory waiting to be analyzed. We fairly recently, in Stone & Webster, have taken up using Bell Telephone System PhonoVision for meetings and confer- ences. My own personal opinion is that one of the things that is missing from our nuclear plants is a much more improved commu- nications system, the use of television, the use of small micro- phones within containment. Just think of how nice it would have been to have had two or three TV cameras within the Three Mile Island containment, or even a couple of microphones. I think that this kind of thing can be done. I think our public relations is a problem we didn't think about, that there is absolutely no reason why full information from a faulted powerplant cannot be put into load dispatch centers, almost anything that is necessary so that the operator can virtual- ly instantaneously have at his services the help of some very experienced people. PAGENO="0032" 28 In short, I believe that the engineering profession has done an outstanding job in designing nuclear powerplants. We have never said they will be foolproof. We will probably have problems again. We believe that with the proper emphasis on the detailed design, rather than on major accidents, on standardization, and on careful attention to quality control, we will continue to have an excellent and outstanding industry. Thank you, sir. [The prepared statement of Mr. Kennedy follows:] STATEMENT OF WILLIAM J. L. KENNEDY, VICE PRESIDENT AND DIRECTOR TO ENGINEERING, STONE & WEBSTER ENGINEERING CORP. Mr. Chairman and members of the subcommittee, My name is William J. L. Kennedy and I am a Vice President and Director of Engineering of Stone & Webster Engineering Corporation. I am pleased to appear before your subcommittee to discuss nuclear power plant safety philosophy and technology. Stone & Webster has been involved in the design and construction of nuclear energy facilities since the outset of the commercial nuclear power industry, having engineered and built the first demonstration plant, Shippingport. Needless to say, safety considerations are fundamental to engineering philosophy. Indeed, by definition an engineer's job is to employ technology for the benefit of man in a safe and economical manner. This underlying principle is even more emphasized in the nuclear power field, given the origin of this energy source. Unfortunately, this background has led the public to fear any accident or failure of equipment in a nuclear plant and to assume that any accident in a nuclear plant will have catastrophic effects. Perhaps by way of excessive response to this situa- tion, industry and government alike, through efforts to allay public anxiety, relied so heavily on probability data showing the low likelihood of an accident with severe public consequences that we led the public to believe the nuclear plants are fool- proof. Thus, the assertions since TMI that the public was lied to-that "they said it couldn't happen, but it did." What was said in engineering language was that a major loss-of-coolant accident with a total core melt-down was an event Of very low probability; and it did not happen at TMI. From the outset, an architect-engineer incorporates the philosophy of safety into the basic plant engineering and, in addition, provides specific protection by incorpo- rating redundant safety systems to accommodate possible accident conditions, by separating physically three systems, by adding diverse systems to perform similiar functions and by separating safety systems from non-safety systems. The concept is then carried to the extreme of assuming the failure of such systems and providing means to mitigate the results which could be expected. Thus, we add the contain- ment with attendent filtering systems, etc. We have available a scale model of our reference nuclear plant depicting the various special safety systems employed. I have attached as an appendix to my testimony a listing of the safety features displayed and I'd be pleased to explain them using them the model, as time permits. This model illustrates the overall "defense-in-depth" reactor safety philosophy used in the design of nuclear facilities. These facilities are designed to provide (1) a large margin of safety for defects in materials and equipment, acts of nature, and possible human error; (2) backup systems that will compensate automatically for failure of essential equipment and (3) equipment and systems (such as the emergecy core cooling systems and containment) to limit the public consequences of even highly unlikely accidents. Application of the "defense-in-depth" philosophy results in the provision of multi- ple physical barriers between the reactor fuel and the environment outside its plant. The fuel is contained in a sealed metal claddinger the clad fuel is contained in a heavy steel primary contain system; and the primary coolant system is enclosed in a massive concrete and steel containment building. A Quality Assurance program is employed from the outset of the design phase through component manufacture and containment to ensure a finished product of high quality. This program also features multiple, redundant efforts to review calculations, designs, and specifications by independent reviewers. Manufacturers inspect their products and these are verified by both the utilities and AEC. The federal government, through AEC, audits and inspects to ensure program validity. PAGENO="0033" 29 Obviously however quality must be designed and built in at the outset no amount of inspection will add quality. QA organizations are independent of production and are answerable directly to top management. This ensures against diminution of QA efforts due to production demands and pressures and enhances objectivity where these interests may conflict. In the construction of a plant, we have* learned that standardization pays hand- some dividends. Detailed work processes involving parallel paths and repetitive operations yield a higher degree of skills and therefore improved quality. Our construction innovations program is aimed at using the best and most efficient methods and needs, reducing peak manpower requirements and permitting firmer quality control. Our basic plant designs are evaluated for safe constructurability, operability, and maintainability. For each phase of a project, we have standardized our construction methods and procedures, such as material controls, handling and storage, steel erection, concrete placement, etc., including independent inspection of each. Special training is provided to responsible personnel on these procedures. We also have developed a standardized system for reviewing significant engineer- ing, design, construction and QA issue that arise in order to ensure incorporation of lessons learned from each into other project efforts. These efforts, while not un- known to other large industrial programs, are unprecedented in the degree to which they are employed on nuclear facilities. Obviously, the unmatched safety record of the nuclear industry bears witness to the wisdom of this approach. We believe standardization can contribute positively in a number of ways. Repeat- ed designs and construction and manufacturing techniques and procedures permit increased efficiency resulting in higher quality; and that translates to greater safety. Another significant advantage of standardization in the reduction in the number of plant design variations with which plant operators and emergency teams would have to be familiar. This would concern increased operator capability. Stand- ardization will permit greater concentration of specialized talents on more detailed safety considerations. Standardization will lead to increased efficiency and thus improved safety and, because of favorable cost impact, the additional benefit of lower power costs to the public. The recent accident at Three Mile Island Unit 2 provides a here-to-fore unavail- able perspective from which to view this approach to safety. The defense-in-depth concept appears to be valid. Safety systems did work. The physical integrity of the reactor coolant system was maintained. When initiated, containment was main- tained. While we have not had the opportunity to evalute the data in detail, it appears that this was true despite some failures of equipment and some yet to be explained operator actions. This, I think, demonstrates the remarkable resiliency of the plant to withstand adverse conditions, and that is exactly what is is designed to do. We have much to learn from this event as the detailed information becomes available. The plant has been characterized as a laboratory awaiting analysis and I agree. There are some lessons which are already apparent. Perhaps the most obvi- ous is that in both licensing and design, the industry and the regulators may have been concentrating too hard on the hypothetical catastrophic event involving total instantaneous loss of coolant with the necessity of response in fractions of a second to the exclusion of more likely incidents of lesser severity. I would point out, contrary to what one might believe from reading the papers or watching television accounts, that TMI was far short of such a hypothetical event. It appears that there is considerable room for improvement in the manner in which information for plant status is made available to the operators and the public. The ability to verify what is actually occurring is vitally important to ensure confident decision making. In this regard, I personally favor extensive use of video and audio relay systems so the plant operators can actually see and hear what is happening. Had the TMI operators seen the water running out of the pressurizer and accumulating on the containment building floor, they obviously would have had a better basis upon which to assess conditions and determine the required responses. Recent experiments at the LOFT facility in Idaho have confirmed the efficacy of current designs to protect the core against the catastrophic loss-of-coolant accident. The real life experience of TMI indicates the need to expend further effort to ensure that lesser events are not permitted to propagate to endanger the public or plant performance. There are obviously several facets to this including equipment design, control design, and operator training. The safety record of nuclear plants is un- matched by any other industrial sector, and I inc1ude~ recent events in that assess- ment. We are proud of this record and will strive to improve on it. Of course, the broader aspects of governmental response to emergency conditions and all that involves has been shown to be amenable to improvements as well. 48-721 0 - 79 - 3 PAGENO="0034" 30 I shall be pleased to respond to your questions. - APPENDIX-SAFETY FEATURES, STONE & WEBSTER MODEL Reactor Vessel-Contains core, control rods, and reactor coolant. Reactor Core-Generates heat by nuclear fission. Reactor Coolant Pumps and Piping System-Circulate reactor coolant. Pressurizer-Pressurizes reactor coolent to 2250 psi. Pressurizer Relief Tank-Receives pressurizer discharges. Steam Generators-Generate non-radioactive steam. Reactor Containment and Liner-Contain radioactive vapors. Accumulators-Automatically inject emergency core cooling (ECC) water. Safety Injection Pumps-Automatically pump ECC water. Charging Pumps-Automatically pump ECC water. Boron Injection Tank-Boron prevents nuclear chain reaction. Residual Heat Removal Pumps-Automatically pump ECC water. Residual Heat Removal Heat Exchangers-Remove heat from core. Containment Spray Pumps and Spray Headers-Spray reduces pressure and ad- sorbs radioactive iodine. / Refueling Water Storage Tank-Stores ECC and spray water. Chemical Addition Tank-Adds iodine absorbent to spray. Containment Atmosphere Recirculation Coolers-Remove heat. Supplementary Leak Collection and Release System Fans and Charcoal Filters- Filter air. Hydrogen Recombiner-Removes hydrogen from containment. Turbine and Motor Driven Auxiliary Feedwater Pumps-Provide water to steam generators to cool core. Auxiliary Feedwater Storage Tank. Main Feedwater Piping-From main feedwater pumps. Main Steam Piping-To turbine-generator. Atmospheric Dump Valves-Release non-radioactive steam to remove heat. Containment Isolation Valves-Automatically close when required. Cable Trays-Separate red, white, blue, and yellow electrical safety circuits and black non-safety circuits. Cable Spreading Areas-Separate cables for protection. Control Room. Main Control Boards-Used during normal operation. Engineered Safety Features (ESF) Control Boards-Control and monitor safety systems. ESF Relay, Logic and Actuation Panels-Redundant Safety control equipment. Electrical Circuit Breakers-Control and power safety electrical equipment. Auxiliary Shutdown Panels-Alternate shutdown controls. Batteries-Power safety electrical circuits if off-site power is lost. Diesel Generators-Provide standby power if off-site power is lost. Fire Protection-Red piping and hose stations. Fuel Transfer Mechanism. Spent Fuel Racks-Provide underwater storage. Spent Fuel Shipping Cask. Mr. MCCORMACK. Thank you, sir. We will come back to the questions presently. We will now hear from Dr. Chauncey Kepford, director of the Environmental Coalition on Nuclear Power. Dr. Kepford, welcome. Your testimony will be included in the record. You may proceed STATEMENT OF DR. CHAUNCEY KEPFORD, DIRECTOR, ENVIRONMENTAL COALITION ON NUCLEAR POWER Dr. KEPFORD. Thank you, Mr. Chairman. First off, I am not the director of the Environmental Coalition on Nuclear Power. One of the codirectors is here with me today, Dr. Judith Johnsrud. By default, I am the legal and technical director of the coalition, because nobody wants to be. Mr. MCCORMACK. We welcome you with whatever title. Dr. KEPFORD. Thank you. PAGENO="0035" 31 I wasn't inside at Three Mile Island. I was on the outside. Our house was used and our facilities were used by the refugees from Three Mile Island, people who had to flee their own homes because of this accident, because they were not being told the truth by Metropolitan Edison Co., or the Nuclear Regulatory Commission, about what was going on. There were thousands of people in this very kind of a position, that they had to leave their homes. It really bothers me to hear this put down as a nasty accident that really didn't hurt anybody, that nobody is going to die from it. I think such talk is utter bunk and should be described as such. I might add that I am not speaking now from ignorance. I have reviewed quite thoroughly the data contained in the population dose and health impact of the accident at the Three Mile Island nuclear station from the Ad Hoc Population Dose Assessment Group. I think the review of that data and the monitoring efforts that took place around that accident border on the criminally negligent. It just happens to turn out that there were no radiation monitors between the plant and the largest concentrations of people. Nor did they go out anywhere near far enough. The NRC's monitors went out only 13.8 miles. On the basis of a very poor set of data, these gentlemen then dragged out of the sky, out of a hat, a distance-dose model to calculate doses out to 50 miles. But that model is not supported by the data close in. Why should it be supported farther out? If you would like more details on this, I can give them to you. With regard to the research philosophy, which is the subject of these hearings, it has been my impression throughout the nuclear power program that the primary emphasis has been based on theoretical impressions of safety rather than experimentally deter- mining safety. I have characterized this in my testimony as the law of the universe according to Walt Disney: Wishing will make it so. Let's look at the situation realistically. Experiments tell us where we are. They give us information that can tell us yes or no, we can go ahead, we should not go ahead. Theoretical calculations, no matter how well founded or what kind of a data base we have, normally have to be treated with suspicion. For instance, we have 20 years or so of tracking satellites from the satellite program. There are thousands of chunks of metal up there that are monitored more or less on a daily basis. Yet, now we are facing the fact that Skylab is going to come slipping down on us sometime, perhaps this fall. We cannot predict when. We might have a 20-minute warning. But not to worry because it will happen in somebody else's backyard. I have been lulled into this false sense of security about nuclear reactors, until Three Mile Island happened in my backyard. I think it is time we stopped delving into this world of theoretical safety, imaginary safety, or speculative safety, or whatever you want to call it, and started going back to the basics, and started asking the question are we at the point where we can prevent the worst imaginable accident; not the design basis accidents that we have PAGENO="0036" 32 heard about this morning, or maximum credible accident, or hypo- thetical accident, or postulated accident, whatever? Do we know that we can prevent a severe power excursion at a nuclear powerplant? I suggest the answer is no. Do we know that the emergency core cooling system will work as it is designed to? I suggest the answer is no. Do we know whether or not the ECCS system will work on a hot core? I suggest the answer is no. Do we even know what happened at Three Mile Island inside that pressure vessel between 4 a.m. Wednesday morning, March 28 and, say, 8 or 10 p.m. March 28? I suggest the answer is no, and it really bothers me that the NRC is rushing forth and slapping a bunch of band-aids on the other operating B and W reactors, and hoping that those band-aids will prevent TMI-2 from happening all over again. What we don't know, of course, is whether or not those band-aids that the NRC is slapping on will make matters worse. That we don't know. An interesting question to ask throughout all this is what would have happened if that reactor had failed to scram. One problem that has been nagging the regulatory bodies and the industry for years has been this problem of an anticipated transient without scram; that is, without the reactor shutting down. The feed water pumps quit at 4 a.m. Wednesday morning. Within 1 minute and 45 seconds after they quit, the reactor had been shut down for virtually all of that time, but in that time, the steam generators boiled dry, and then things started getting sticky. Of course, they were complicated by the fact that the emergency feed water pumps were turned off. But suppose the reactor hadn't scrammed. Would there be anybody living in eastern Pennsylvania today? I suggest things might have turned out quite a bit differently. But we don't know, do we? Most of our safety estimations are based on unverified computer calculations. We have an enormous theo- retical basis for safety. I suggest our experimental basis for safety is much, much shallower; in fact, dangerously shallow. I would like to point out some ideas that were communicated to the Joint Committee on Atomic Energy years ago by Dr. Clifford Beck as a result of the results of the' steering committee that was working toward revising the original WASH-740. It is just half a dozen lines. He stated, and this is a letter dated May 18, 1965: There is no objective, quantitative means of assurance that all possible paths leading to catastrophe have been recognized and safeguarded or that the safeguard will in every case function as intended when needed. Here is encountered the most baffling and insoluble enigma existing in our technology. It is in principle easy and straightforward to calculate potential dam- ages that might be realized under such postulated accident conditions. There is not even' in principle an objective and quantitative method of calculating probability or improbability of accidents or the likelihood that potential hazards will or will not be realized. I suggest nothing that came out of the reactor safety study contradicts a word that Dr. Beck said. He was talking, after all, about objective and quantitative means of calculating probabilities. PAGENO="0037" 33 Last, if the theoretical aspects of safety are so good, I suggest that a good method of verifying our predictive abilities will be for elections for Congress, for instance, to be determined on the basis of predicted popularities and so on, say the day before the election, and that all parties agree to the results and postpone the election because the election is, of course, expensive. That would simplify things. But I don't really think that most Members of Congress would really buy that. They would rather go through the experiment and have it verified. As one of those who is under the gun, I, too, would like to have the reactor safety experiments verified. Most haven't been. Most are still waiting to be done. I suggest that those of you who are very dedicated to the further- ing of this industry, which has the potential for doing so much damage, and causing such an overwhelming level of human misery, volunteer your districts for the next nuclear success story; that is, an accident which wasn't an accident. Thank you. [The prepared statement of Dr. Kepford follows:] PAGENO="0038" 34 Testimony of Dr. Chauncey Kepford Environmental Coalition on. Nuclear Power before the Subcommittee on Energy Research and Production ofthe Committee on Science and Technology May 22, 1979 Mr. Chairman, members of this Subcommittee, it is an honor to appear before this body to discuss the most important subject of nuclear reactor safety today. The near catastrophe at Three Mile Island, Unit 2 has shocked many people on both sides of the ongoing debate about nuclear power. For my own part, I was one of those who had been lulled into believing the. soothing chorus of assurances of the promoters of nuclear power, from the Nuclear Regulatory Commission (NRC) on down to the public relations persons for our own local nuclear utilities. This false sense of security fell in face of the recent partial renunciation of the widely and justifiably criticized, (but yet much relied upon) Reactor Safety Study, WASH-l400, or the Rasmussen Report, ~r Whitewash-l400, asit has been referred to. On top of this, there was the additional, and somewhat sick, rationalization of "safety,' and that is that when a serious accident finally does happen, it will be in someone else's backyard. But things don't always go according to plan. When this "worst yet" nuclear reactor accident did happen, it was in my backyard. It occurred at the very reactor that I had fought throughout its still uncompleted licensing proceeding. In this proceeding, with the most able assistance of Dr. Judith Johnsrud, who is Co-Director of the Environmental Coalition on Nuclear Power, we became aware through our own totally unschooled efforts at cross- examination, that the emergency plans of Dauphin County, where TMI-2 is located, PAGENO="0039" 35 the Commonwealth of Pennsylvania, and the NRC itself, had no basis in fact at all. Assurances of preparedness were rhetorical only. We did not have the resources to rebut this concept of paper, or even imaginary, preparedness. Subsequent events have thoroughly confirmed our belief that all talk of emergency preparedness at these licensing hearings was a hoax. Needless to say, the Licensing Board predictably and dutifully licensed the plant. It was also the ThI-2 proceeding where, for the first time ever in a licensing proceeding, it was shown that the largest source of radioactive emissions in the entire nuclear fuel cycle had been doggedly and resolutely ignored by the NRC. This source of emissions was, of course, the abandoned mill tailings piles. It was my testimony on July 5, 1977, that caused the NRC to act on a long forgotten rule-making petition filed in late 1975 by the New England Coalition on Nuclear Pollution on February 28, 1978. On that day the Commissioners voted to void the 74.5 curie number for radon-222 emissions in the infamous Table S-3 for the special case of TMI-2. On April 14, 1978, this number was struck for all licensed facilities. Yet even with this radon-222 issue unresolved by the Licensing Board, the plant was licensed to operate. In spite of the seeming irrelevance of the preceeding discussion about the TMI-2 licensing process, there is at least one lesson to be learned from this exercise, and that is, there is no problem that any intervenor can raise which will prevent the licensing of any nuclear facility. The relevance to today's subject is clear. Had I gone before the Licensing Board to address an accident sequence at TMI-2 that included a simultaneous tripping of both feedwater pumps, a pressurizer relief valve that would not close when ordered to do so, both emergency feedwater valves being closed, and so on, it is my considered opinIon that I would have been laughed and scolded out of the hearing room. Such an accident, I would have PAGENO="0040" 36 been told, when the snickering finally subsided, would be hypothetical, speculative, and beyond the scope of the hearing. I must confess, the logic of the Board would have been hard to refute. Then it all happened, and it happened at TMI-2, in my backyard. All of a sudden, the probability of a serious accident went from be.ing said to be infinitesimally small to unity. And to make matters worse yet, the weather condi tions for the first few days after that accident were among the worst imaginable. Situated over the Eastern U.S. was a stagnant air mass. As a result, most of the radioactive materials released in those early days did not dissipate and blow off toward the Atlantic Ocean, instead, they sloshed around like water in a bathtub. This is just one item that the NRC has missed in its cumulative dose estimates. It is not the only one. I am convinced that the 3550 person-rem exposure reported by the NRC between March 28, 1979, and April 7, 1979, is a face-saving, even imaginary value, since it is not supported or supportable by the NRC's own monitoring data. But in getting back to the subject of reactor safety, I would like to point out that my background is in experimental science. From my own attempts at theoretical calculations, using computer models, and from many years of general observations of theoretical predictions, I have acquired a fairly deep seated mistrust of computer calculations which are not firmly rooted in experi- mental terra firma. It is, of course, only through experimentation that we pass judgement on theoretical predictions, conjectures, projections, speculations, and so on. Even some of Einstein'~ theor~s have been checked experimentally, and this is as it should be. Yet even in areas where there is an enormous data base for predicting future events, failures of computational predictive techniques still occur. As an example, the U.S. has over 20 years experience at tracking satellites and observing orbital alterations and variations. Even with this backlog of observation and experience, we are still faced with the seeming PAGENO="0041" 37 certainty that Skylab will reenter that atmosphere, and we will have, at. best, just 20 minutes warning. That's not much of a warning. But, we are assured, there is still nothing to worry about, because the overwhelming odds are that it will fall in someone else's backyard. It does not take much time to discover that in the strange world of a nuclear power industry that was created by Congress and has been both promoted and regulated by one agency, explorations into the basics of reactor engineering, physics, and chemistry have taken a course other than knowledge through experi- mentation. If there were a rational regulatory and licensing scheme, the burden of proof in the area of reactor safety would be placed firmly upon the shoulders of the nuclear industry. But the passage of the Price-Anderson Act in 1957 absolved the then infant nuclear industry of its responsibility to the public before the damage was done. This Act established the principle tha-t the promotion into existence of an industry where corporate survival was given preeminence above any rights of the members of the potentially affected public. One result of this principle was that it became clear to the infant industry that reactor safety was someone els~s responsibility. With the nipple of Price-Anderson firmly in its teeth, a grip which time has only tightened, the nuclear industry assured all who would listen that nuclear reactors were safe enough that even utility executives themselves would have no fear living next to one. The Atomic Energy Coninission (AEC) did not fail to protect and encourage its creation at every step of the way. The Licensing Boards, long before the affected public became aware of what was being perpetrated, developed a genuinely Pavlovian response to any construction permit or operating license submitted. PAGENO="0042" 38 These Boards success rates greatly exceed the successful graduation rate from the Oak Ridge reactor operators school. The contemporary approach is one of safety by edict, procrastination, speculation, economics, double-talk, and ignorance with just an occasional digression into an enormous and largely unplowed field of fundmental reactor research. This is a rather sweeping statement, but it is one that is well supported in history. As an example, the Loss of Fluid Test facility (LOFT) serves as an excellent case study. This facility was designed to verify the computer programs, or codes, which had been developed to predict the rate of core flooding in a Loss of Coolant Accident (LOCA). Attachment 1 is ~a copy of two pages from the 1965 report to Congress by the AEC entitled "Major Activities iii the Atomic Energy Programs." I repeat, this is from a 1965 report, and from page 186 and 187 of this report it is seen that these very important tests were to have begun in the spring of 1969. Procrastination set in, the comple- tion date slipped, but reactor licensing went on, unhindered by the knowledge that safety systems, upon which tens or hundreds of thousands of lives might depend, had never been tested under realistic operating conditions. Ignorance prevailed and the design effectiveness and functional capability of the ECCS were accepted on the basis of computer calculations, calculated information, and computer speculations, not on the basis of experimental knowledge. More details on the LOFT facility are presented in Attachment 2, which is pages 851 through 864 of the AEC Authorizing Legislation, Fiscal Year 1972, before the Joint Coninitteeon Atomic Energy, March 4, 1971, Part 2. I call your attention to page 854 where the foremost objective of this program is shown to be experiments to test "analytical methods" pertaining to a LOCA. PAGENO="0043" 39 Unfortunately, as is seen on page 855, the completion date had slipped from the spring of 1969 to late 1973. Needless to say, the licensing and operation of reactors proceeded. In Washington, D.C., the Emergency Core Cooling System (ECCS) hearings came and went, and countless flaws in the system were highlighted. But down came the edict that, based on computer calculations, or those `analytical methods' that the LOFT facility was supposed to have verified, everything was al~(ight. Licensing proceeded, unabated. In the fall of 1978, almost ten years late, the initial experiments at LOFT were conducted, with an electrically heated core. With great fanfare, the NRC announced the success of the test. Mr. Chairman, when I saw the results of that test a few weeks ago I was stunned. The test had failed. Phenomena were observed in the experiment which were completely unpredicted by the computer code being tested. The results were distributed to numerous Licensing Boards and the parties to each proceeding. Attachment 3 is the notice that was circulated, only after TMI-2. I must emphasize just what the purpose of the test was, and that was to experimentally check the predictive ability of the computer program. A quick reading of this brief notice vividly demonstrated that this goal was not realized; the computer code, called RELAP-4, failed to predict the course the experiment took. And that failure is cloaked in double-talk. The double-talk comes from the lame explanation put forth by the NRC officials to coverup this obvious failure. That explanation is to characterize the experiment as "atypical." Here the meaning is crystal clear: the computer speculation is being accepted as more valid than experimental results. And licensing goes on. PAGENO="0044" 40 Over fourteen years of procrastination, edict, speculation and ignorance are now topped with double-talk. Are these characteristics of a research program or a regulatory program that the public should trust or have confidence in? I suggest the answer is no. It would have been much more difficult for me to appear here today if the LOFT-ECCS fiasco were unique in the nuclear reactor safety research program. However, it is not unique, though the subject of the ECCS has been widely publicized. The fact is, much of the basic research still remains to be carried out. Attachment 4 speaks to this issue. This attachment contains the conclusions from a report released by Oak Ridge National. Labs in 1968 entitled Emergency Core-Cooling Systems for Light-Water-Cooled Power Reactors,' by C.G.Lawson. I have taken the liberty to underline a phrase or twø, the many conditional verbs, and a couple of sentences. While it is not clear how many of the problems mentioned in this conclusion have been resolved experi- mentally, I have little reason to believe many have. Part of the justification for this belief comes from Attachment 2, mentioned earlier. Here I turn your attention to the general testimony of Mr. Milton Shaw, former Director of the Division of Reactor Development and Technology, of the AEC. Mr. Shaw speaks of budget cuts, slowed and curtailed experimental programs, and even questionable information coming out of existing experiments. At one point he states on page 860. There is also arremendous controversy as to how beneficial such small-scale experiments can be, but our position, is `that we can't afford to build them much bigger. So here is one place where economics plays a key role. Here it should also be noted that in these Hearings, a list of general unsolved problems and areas for research pertaining to reactors was presented on page 852. PAGENO="0045" 41 These were listed before we became aware, as we have in more recent years, of fuel densificatjon, steam generator tube denting, stress-corrosiao cracking and the torus jump problem in BWRs, and so on. And to this short list we must list those generic unresolved safety problems that the NRC annually sends to Congress. No, I don't think we have made much progress in the last 20 years. But this lack of progress has never slowed the relentless licensing of new and larger nuclear power plants. Let's go back to that recent LOFT experiment. LOFT is a 50 Megawatt Thermal (~4t) test reactor. Many operating PWRs have thermal outputs between about 2800 MWt, like 1111-2, to over 3400 MWt,like Trojan 1. It is evident that the computer code whose accuracy to predict events was being tested, RELAP-4, did not succeed in predicting the course of events. There is an all i~portant question that remains unanswered, and certainly seems to be avoided in silent desperation by the NRC. That question is: what does that experiment at the LOFT facility tell us that is applicable to operating PWRs? Or, do the results of the LOFT facility experiment instill any confidence in RELAP-4 to predict to the ability of the ECCS in a large reactor~carry out its intended function in the event of a LOCA? I can come to no other answer than another negative one. In northern Pennsylvania, near Berwick, a pair of BWR reactors, Susquehanna 1 and 2, are soon coming up for operating license hearings. The ECNP is an Intervenor in that proceeding and already troubling aspects are arising. For example, on the subject of power excursions, it appears that great reliance is placed on a computer program dating back to 1956, which, when subjected to preliminary verification experiments, failed in an~unsafe direction. (See, for a fuller discussion, "The Accident Hazards of Nuclear Plants," by Dr. Richard E. Webb, University of Mass. Press, 1976, Chapters 3 and 4). PAGENO="0046" 42 Now, over twenty years have gone by and the question of the susceptibility of large reactors to destructive power excursion accidents does not appear to be resolved, except through speculation, rhetoric, and Licensing Board approvals. Just last week, we received a communication from the NRC stat$ng that some reports from one of the Susquehanna 1 and 2 subcontractors, Kraftwerk Union Akliengesellschaft (KWU) are granted an exemption from public disclosure by the NRC. The letter, dated May 11, 1979, is sufficiently vague that it is impossible to determine even the general subject of the now `confidential' KWU reports. The letter contains the following statement We have also found at this time that the right of the public to be fully apprised as to the basis for and effects of the proposed action does not outweigh the demonstrated concern for protection of your competitive position. It is certainly not encouraging to learn that the "competitive position" of a subcontractor is more important to the NRC than the right of those affected by some nebu'ous design feature to know to what kind of risk they are being subjected. If anything, the ThI-2 accident showed that gaping holes exist in not only our understanding of reactor accidents, but also the ability of not only the NRC to review, inspect, and license reactors, but also of utilities to safely operate them when deviations from anticipated behaviour occur. From the materials I have seen concerning the course and results of this accident, I am exceedingly disappointed in the extremely shallow and unsophisticated nature of the analyses. For example, in a report entitled "Core Damage Assess- ment for TMI-2," memo from R.O. Meyer to Roger Mattson, April 13, 1979, the heat-up rate of the uncovered core of 1141-2 is discussed, along with the quantity of zirconium fuel cladding estimated to have been consumed by reaction with steam. However, the contribution of heat from the zirconium-steam reaction was neglected in assuming the c~5re heat-uy~ate. The deficiency here PAGENO="0047" 43 is because thischemical energy may have been of comparable magnitude to that of the fission product decay heat over the hour or so that the heatup is assumed to have occurred. Equally unsettling is the rush made by the NRC to apply a series of bandaids to the other operating Babcock and Wilcox (B&W) reactors to get them back to operation as soon as possible. This crash course seems to have precedded an appreciation or even understanding of what the real course of the TMI-2 accident was. To be more precise, it does not appear to be known pre- cisely when thezirconium-steam reaction occurred, or the effect of the elec- tromatic relief valve which stuck open in the early stage of the accident. It has obviously been assumed that had this valve properly closed, damage would have been less severe to the reactor. The validity of this assumption has not been established, in my opinion. During most of the initial few minutes of the accident, after the steam generators had boiled dry (at about 1 mm. 45 sec. into the accident), water steam flashing through this valve was the major heat release mechanism for the hot core. Had this valve closed properly and stayed closed, the primary coolant system may well have become greatly overpressurized. The rush action by the NRC seems to suggest that the avoidance of the exact sequence of events at TMI-2 is desireable, but it does not appear grounded in a firm understanding of whether or not the recommended solutions might cause worse conditions, should this sequence ever repeat itself. There is another equally troubling aspect to this whole accident, and that is that ThI-2. was a new reactor with a core that had less than 90 full power days in its operational history. From this fact, it seems necessary to ask whether or not, had this accident happened at a B&W reactor with a higher fission product inventory, like TMI-l, or Rancho Seco, would the results have PAGENO="0048" 44 been the same? Another seemingly unanswered question is whether or not the quick fix solutions required by the NRC for older operating B&W reactors will work where fission product inventories are higher. It should be pointed out here that higher fission product inventories mean, in general, a higher core heat-uprate. Furthermore, it should be pointed out that the ECCS is designed to function for a relatively cool core, that is, one right after blowdown. It is entirely possible that the actuation of the ECCS onto a hot core, one where the fuel cladding is very hot or melting, may do more harm than good. The promoters of nuclear power, from the NRC on down, have repeatedly pointed to the supposed `accident_free! or "mortality-free" past history of the commercial nuclear power program. These comments however appealing they might sound, are deserving of a closer scrutiny. As far as the accident-free part goes, it suffices to say that at least three (3) of the 80 or so nuclear power plants licensed by the AECZNRC have had very serious accidents early in their respective li.ves. These were Enrico Fermi I, Browns Ferry 2, and, now, TMI-2. Fermi was down four years for repair. Browns Ferry l&2 suffered a fire in electrical cables and, for Unit 2, many safety systems were disabled. The third was TMI-2, where half-a million people faced a core meltdown for 4 or 5 days. This is a less than enviable safety record, and it does not include the many other near-misses. While the validity of the population dose estimates released by the NRC and HEW are not the subject of these hearings, they deserve a few short comments made from my reviewing of the data in report of the Ad Hoc Population Dose Assessment Group. My conclusion is that the members of this group chose to seriously understate the population dose due to the TMI-2 accident. This dubious result was achieved by ignoring completely the character of the data PAGENO="0049" 45 they had to work with. For most directions around TMI-2, between March 31 and April 7, 1979, the exposures measured by the NRC do not decrease rapidly with increasing distance from the reactor. Quite the contrary, most doses were approximately constant, and some even increased with increasing distance. Unfortunately, the NRC chose not to monitor beyond about 14 miles from the plant, or in the directions in which most of the population was located. However, the Ad Hoc group used these deficiencies to their own seeming advantage, ignored the trends of the monitoring data theydid have, and assumed a standard atmospheric dispersion model to calculate exposures beyond 10 miles from the plant. This model requires that doses decrease according to a minus 1 .5 power law,contrary to the existing data out to distances of about 14 miles. As a result, the public exposure widely reported by the press are nothing more than fabrications designed to conceal both the real magnitude of the exposure dose ~`~the accident, but also the incredible incompetence of the NRC in its monitoring efforts. Many people will die as a direct result of the TMI-2 accident. I cannot qu.antify the number exactly, but I have reason to believe it will number in the hundreds, maybe in the thousands. Efforts by the NRC to conceal this carnage will not solve the problem. Honesty and candor would help, but there appears to be little chance for either in assessing pronouncements from this~ organization. So licensing must go on, on until we apparently must learn the accident probabilities at nuclear power plants by trial and error. Just what the ult~rnate* toll in human life and misery will be is not predictable, but if Fermi, Brown's Ferry, and TMI-2 are any indication, that toll will be high, both in lives lost and in misery. Tragically, the TMI-2 accident is not over, nor are thereleases of radioactive materials. When all is said and done, the safety philosophy of the nuclear power program, when stripped of the endless self-serving words of praise, and reduced 48-721 0 - 79 - PAGENO="0050" 46 to how it really works in practice, has been accurately characterized as the Law of the Universe according to Walt Disney, which is Wishing will make it so To this fundamental NRC and industry philosophy, I have added twocorollaries 1. Wishing that problems were solved is as good as solving them; and 2. Programs can only succeed; failures are simply relabeled as successes. Evidence of the validity of the first corollary comes from the fact that so many unresolved safety problems remain unresolved after so many years, and so much basic safety research has been postponed and terminated. In addition, the radioactive waste problem and the still nagging problem of low-level radiation persist, even though they have been solved many times through agency and industry press releases. Failures.always become successes in the strange world of nuclear power. The Enrico Fermi accident was one such success. It cost between 60 and 300 million dollars to build, depending on whose figures you believe. It operated for the equivalent of a full month or so before it was mercifully mothballed (but not decommissioned,. dismantled, and removed). A lot was learned at the Fermi reactor. The Browns Ferry fire was also a success because a lot was learned there, like how a core meltdown was averted. Yet today, most reactors are just as vulnerable to fires as Browns Ferry was. So while the $150 million or so that fire cost taught someone a lot, the lessons yet remain to be applied to many other reactors, but it was a success. So, of course, was 1111-2 a roaring success. It may be out of service for from 2 or 3 years to forever, it may cost $300 million to clean it up, or it may be a total loss of over $700 million, But it was a success. The safety systems worked, and according to the fudged data nc~bne was killed. These accidents are all part of a strange definition of ~success, but then, "wishing will make it so." Gentlemen, who among you would volunteer the constiuents of your District or your backyard for the next nuclear "success" story? PAGENO="0051" 47 Attachment I /`~~-~ Tcrrestricd .9y8tem.s. Del ailed design of- i.he Loss of Fluid Test (LOFT) facilit.y was essentially completed in 1)ecéinber by Kaiser Engineers, Oakland, Calif. A contract to fabricate the cotitttiiiinent vessel for the LOFT facility, which will be located at N.I~TS, was awarded in January to Pittsburgll?Des Moines Co., Pittsburgh, Pa., by M. `W. Kellogg, prime contr:~ctor for the construction of the LOFT facility. The reactor vessel fabrication contract w'as awarded in October to the P. F. Avery Corp.. Billerica, Mass. Construction of the facility, expected to be complete in . late 1967, had passed the 10 percent completion mark by December. `Within this reusable test facility, the flatcar-mounted LOFT reactor system will be used to conduct a loss-of-coolant test on a ~0-tliermal megawatt pressurized water reactor. Following an extensive nonnuclear test program, the i/f (*7 ~- ~ I ~ ~ It. ~. ~ en I.OJ-"J' J'aeili(i~. C()IiStructjon i'(a4'1)e(l groniid lt~vcl during -it)6~ 011 liii' IMSS of Fluid Test (LOFT) Facility, (lepicted here by an artist's conceptual drawing. Beluw-grontid.lev~l construct ion started in October 1961, and LOFV1~ is expected to be opera t ional in lot e 1067. A cuta way sect ion of the c nt a in iiwiit shell shows the reactor safety experiment mounted on a double-width Ilatcar or dolly which can be pulled by shielded locomotive over qtUtdrlll)le rails to a nearby "hot shop" for post-test analysis. One of the principal reasons for building LOFT is to demonstrate the safety of water-cooleti power reactors by deliherately triggering a runaway power burst caused by major coolant pipe rupture, a highly improbable but the worst conceivable acci(Ient for such r~'actois. LOFT lS part of the safety test engineering program conducted for the AEC by PhillipS Petroleum Co. q I - ~ ~ 4~PUM~' t'--(~':~ `~ p PAGENO="0052" 48 first nuclear test will be conducted iii the spring of 1969. Supporting research and development programs were established at national laboratories :111(1 AEC field installations to test equipment and special instrunientat ion, and to perlorni analytical studies for predicting the sequence and magnitude of events expected to occur in the LOFT tests. Aerospace systems. Transient experiments on uranium-zirconium hydride reactors for space nuclear power al)plications continued dur- ing the year at the National Reactor Testing Station. These experi- ments, conducted by the Phillips Petroleum Co. with the support of Atomics International and Edgerton, Germesliansen, and Grier, Inc.. are investigating the kinetic behavior of SNAP reactors when sub- jected to large and rapid reactivity insertions. The SNAPTRAN-i series of experiments to investigate the behavior of a reactor in the nondestructive region was completed in September 1965. SNAP- TRAN-2, to follow, will project the investigations into the destruc- tive range. A series of full-scale re-entry flight tests, supported by applied research, have been pumsmmecl to determine the effectiveness of using tin heat generated by the atmosphere during re-entry to burn up nucleai systems. This burnup, with the subsequent wide dispersal of the debris in time atmosphere, would thus serve as a safe means fot radioactive fuel disposal. During 1965, further analysis was made of time data acquired from re-entry flight tests conducted on a simulated SNAP-bA reactor ii May 1903 and October 1964. This flight analysis has provided prool that the specific systenis tested would disassemble as designed, and ha~ substantially increased confidence in the ability to predict re-ent.r~ heating effects from theoretical analysis. Effluent Control Research and Developni eat The programs in effluent control research an(l (levelol)ment are di- rected toward the safe nianagenieiit and disposal of vatious types of ra(lioact.iVe wastes resulting from nuclear i'eiictot' oI)el~iltiOnS, the quati t it at i ye det eiminii t lOll of t he behavior of I liesc residual ra(l io- active effluents in the environment, and the development of engineer- ing criteria associated with the. environment :il aspects of nuclear tech- nology oI)erat lOliS. This work proVi(leS a basis f~r defining and controlling time ultimate fate and possible effects of radioactivity in time enviroimmnent. PAGENO="0053" 49 Attachment~2 &~ AEC AUTHORIZING LEGISLATION FISCAL YEAR 1972 HEARINGS BEFORE THE JOINT COMMITTEE ON ATOMIC ENERGY CONGRESS OF THE UNITED STATES NINETY-SECOND CONGRESS FIRST SESSION ON CIVILIArc NUCLEAR POWER PROGRAM MARCH 4, 1971 PART 2 Printed for the use of the Joint Committee on Atomic Energy 0 U.S. GOVERNMENT PRINTING OFFICE 6~258 0 WASHINGTON: 1971 PAGENO="0054" 50 sect ions that we may be obtaining from the machines-arc more relate(l to a narrow spectrum of interest, because we just don't have the money to (10 the. 1)ronder areas. t~ Vf'iy real sense, we have had about a 40-percent red uctionin this ~)TO~fl)~ when oiio h)Oks at cost of living here 5111 CO 1969. Certainly the number of people funded by the program has been rc(luce(l by about 40 1)Prcent in this period SOIflO 1,300 1)001)10, 1 T1Cl(I(liflg many good scientific people, that we just are tiiiable to fund . The number of con- tractors will have been cut from 54 to 18 by the end of fiscal year 1972. We have had to phase out a number of programs that I prorn dict ~vil1 affect adversely our long-termoutl ook and caJ)abihty in the nuclear power business. Perhaps, if we were doing the work it w0UI(1 prevent us from getting into a lot of trouble, compared to having to bale ourselves out later by leaning back on the people an(l the tech- nology as a ~esu1t of present confinements of this program. I don't know what the solution is, but it is characteristic of the general problem we face. Representative H0sMER. You mentioned a research and develop- ment tax earlier today. Mr. SHAW. I doubt that the typo of tax we talked about will be (levoted to this longer term work, which is mostly performed in the laboratories and in the universities, as much as it will be used to build demonstration hardware. Senator BAKER. I am sort of open on it. We will talk about it some time. Mr. S1-iAw. Yes, sir. NUCLEAR SAFETY The next area is nuclear safety (fig.-.97). here we are requesting REACTOR SAFElY PROGRAM PROGRAM. ELEMENTS RESEARCH AND OEVEI.OPMENT _____________ SUBASSEM8LY TRANSIENT TESTING FUEL FAILURE PROPAGATION COOLANT DYNAMiCS FUEL COOLANT INTERACTIONS FISSION PRODUCT AEROSOLS ANALYSIS AND EVALUATION PROGRAM PLANNING INFORMATION HANDLING TECH. ASSISTANCE TO PEG. PRESSURE VESSEL STUDIES RELATED MAJOR FACIUT1ES LOFT - LOSS OF F)~UIt) TEST PBF - PCTNER BURST FACILITY CDC - CAPSULE DRIVER CORE WSEP - WASTE SOLIDIFICATION ENGR. PROTO. TREAT - TRANSIENT REACTOR TEST * `FUNDED UNDER CIVILIAN POMR * PROGRAMS. EFFLUENT CONTROL ENVIRONMENTAL INVESTIGATIONS THERMAL EFFECTS STUDIES WASTE TREATMENT & DISPOSAL ENGIMIRING FIELD TESTS LOSS OF COOLANT TESTS AND EMERGENCY CORE COOLING INVESTIGATIONS ENGIFtERED SAFETY SYSTEMS CONTAINMENT TECHNOLOGY PLANT APPLICATIONS & ENG. TEST PROGRAM STANDARDS, CODES, SPECIFICATIONS GEOLOGIC SEISMIC FACTORS BASIC CEO-SEISMIC DATA ENVIRONMENTAL MAPPING LIAISON WITH OTHER CEO-SEISMIC PROGRAMS DEVEEOP ASEISMIC DESIGNS & DATA SPECIFIC SITE INVESIIGATIONS D(MONSTRATION OF ASEISMIC DESiGNS PAGENO="0055" 51 $35.9 million for fiscal year 1972, ~vhich is the same as the 1971 est iiiiate. `the major incr(nsc iS ~Ii fast r~actor saf(~ty, whih has been iIi('rPflS((l ill OUr projections from $7.4 million to $10.6 million. Of (OIlFSe, Wit Ii the level budget this increase 11115 had to be offset by olecreases iii several other vit at or im port ant safety areas. These (le(rea~es ilIclli(lP lit) fiirt her fuel procurement lU (cii flu of the test rea(t(rs, purti('ulnrly (lie J)OW(~F burst facility and cutback of other light water safety work. }or exam pie, we have had to terminate programs related to failure modes of zirconium-cl ad fuel F nis which are useol iii light water reactors. This work was being p~rformed at Oak Ridge. Again we would like to (Wit flute that work, whirli is out-of-pile work, hut we feel We must go iti-l)ile with Sonic of this ZIFCOII111II1 \VO1'k to build on the out-of-pile work alrea(ly accomplished. `flie waste sOli(lihda t ion experimental program (WSE P) underway at Hanford is being l)hiIse(1 (lown anol ~siIl be Cli)se(l out in 1972. Much of the work on l)il)e ruptures and reactor acci(lent analysis that was going on in a number of organizations will be l)haSNl oiiit. Sonic of these activities are alrea(ly phased out iii order to Coflsoli(late ~vork in a small number of orgalnzrLt ions. Of course, we are investigating work on siting and safety problems which are of general applicability not only to the commercial reactors, or potentially commercial reactors, but also for reactors of our own. This includes our test reactors and other facilities, for which we must (10 safety ~voi~k iii oroler to assure the .cOntiiluNl s~~k operation of these fn(ilitjes Examples of the type of requirements plnee(1 Ott the nuclear safety program are those showir on figi.ire 98, and those that arise from a (letluled analysis of the accioleuut. sequence diagram, figure 99. REACTOR SAFETY PROGRAM ACRS `ASTER IS KED" ITEMS 1. THERMAL SHOCK TO PRESSURE VESSEL FROM ECCS OPERATION. 2. SEISMIC INSTRUMENTATION FOR STRONG-MOTION RECORDING. 3. IMPROVED PRESSURE VESSEL FABRICATION AND IN-SERVICE INSFECTION TECHNIQUES. 4. CALCULATIONAL MODELS FOR REACTOR B1(YNDOWN. 5. FUEL FAILURE MODE IN LOSS-OF-COOlANT-ACCIDENT AND EFFECT ON ECCS CAPABILITY TO PREVENT CLAD MELTING. 6. FUEL FAiLURE - LOSS-OF-COOLANT-ACCIDENT ANALYS IS AT CURRENT HIGH POWER DENSITIES AND BURNUPS. 7. EFFECT OF SUBASSEMBLY FLOW BLOCKAGE. 8. EFFECT OF (ND-OF-LIFE TRANSiENTS ON FUEl. FAILURE. 9. DETECTION OF GROSS FUEL ELEMENT FAILURES. 10. SEPARATION OF CONTROL AND PROTECTION INSTRUMENTATION (DESIGN). 11. HYDROGEN EVOLUTION 12. VITAL EQUIPMENT SURVIVAL lN A LOSS-OF-COOLANT ACCIDENT. FIGURE 93 PAGENO="0056" 52 ACCIDENT SEQUENCE DIAGRAM W1Th ENGINEERED SAFE IV FEATURES FIGURE 99 LOFT PROGRAM Principal areas for hardware and fuel commitments in this budget category currently are in the LOFT program, which is the loss of fluid test facility being built at Idaho, as ~vell as in the 1)o\~(r 1' facility I)ro~'am at Idaho. llu' LOFI bU(lget Ft'J)fl~WIitS $9.9 miLL ~vhith is nit increase over fiscal year 1971 of $1 .S million. This in'r is principally due to the fabrication and assembly of large corn ~` for this unique facility. It is the only facility iii the world in ~ WC ~vill he able to obtain large-scale reactions to a loss of coolant accident and st tidy the i'dat ed phenomena front act tially using emer- gen(y core cooling systems in an operating reactor. Of course, this is one of the prin('ipal areas that hmis beeii discussed 1111(1 (lel)Ilte(I heavily in the safety circuit ; thu t. is, this tremendous concern over a loss of coolnat . For example, if a pipe ru pt tires, do - loss of coolant occur rather (ttIuklv? IS one ;il)le to inject water tpttrki into the Ft'aCtoI~? \\lmat ~vill be the t~1rt~ct of doing this? This, of cou1r~-, is one of the principal areas of interest in the licensing of light ~voter reactors. W'e are quite J)l('ase(l with the regroitpitig at Idaho in the 14011 project. The project. design is moving nitenul quite will now, and we believe that the facility, if fLinding remains eoInl)nt ihle wit Ii \VIIILt we have Schedule(l, Cull be l)rought into use within the neXt 3 years. Representative hANSEN. May I ask a question here, Mr. Chairman? Representative PRIcE. Mr. 1 lansen. Represetitative hANSEN. T what extent will LOFT yield some of the answers that may be needed in the area of safety for the fast breeder reactor, gas cooled reactor or other COflt~el)t5? [~~E1 PAGENO="0057" 53 Mr. SILAW. Very little, sir. LOFT is principally related to safety cviii eat ions for the pressurize(l \VH ter reartor. It. has sothe value to ti1I(lPNt aniiiiig some of the parts of the i)oiiing Wit t er reactor, but is J)I iliCi J)ii liv (liFer tC(l ilrOUn(l t he l)ressurize(l \ViLteF reactot safety consi(iera t ions. Its (OiltFibtitiOIis to the other reactors ~viil be J)riflciJ)aily along the Ii ni's of being able to relate nit a ivt ira I work to eX )erimentai results, and iiI(iiVi(l titti srJ)arat e (`ff(('tS (ISIS itS t hey relate to t he whole. rfhat is, it. will give the confidence to the analytical people and relate anal- ysis to the experimental results to permit carry-over into other concel)ts. That is about the limit of it, sir. (Testimony continues on p. 855) (Additional in formation provided for the recor(I follows:) LOFT Significant. progrc~s has been made in the design and construction of the 55 MWt Loss of Fluid Test Facility (LOFT). LOFT is the only nuclear facility in the world planned to conduct major loss-of-coolant accident experinient.s (see chart below for LOFT experimental objectives.) - LOFT EXPERIMENTAL OBJECTIVES 1. lEST THE ADEQUACY OF ANALYTICAL METHODS USED TO PREDICT: a, THE WSS-OF-COOLANT PHENOMENA AFFECTING CORE THERMAL RESPONSE; b. THE CAPABILITY OF THE EMERGENCY CORE COOLING SYSTEM (ECCS) TO FULFILL THE INTENDED FUNCTION; C. THE MARGINS OF SAFETY INHERENT IN THE CAPABILITY OF THE ECCS; d. THE THERMAL AND MECHANICAL RESPONSE OF THE CORE AND PRIMARY SYSTEM COMPONENTS; e. TIE PRESSUREJEMP(RATURE RESPONSE OF TIE CONTAINMENT ATME)SPHERE; AND f. THE MAGNITUDE, COMPOSITION, AND DISTRIBUTION WiTH RESPECT TO TIME OF THE FISSION PRODUCTS iN THE CONTAINMENT BUILDING. 2. VERIFY THE DESIGN REQUIREMENTS WHICH DETERMINE TIlE CAPABILITY OF THE ECCS AND THE PRESSURE REDUCTION SYSTEM TO FULFILL THEIR INTENDED FUNCTION. 3. REVEAL THRESHOLDS OR UNEXPECTED PHENOMENA WHICH AFFECT THE VALIDITY OF THE ANALYTICAL METHODS USED TO PREDICT THE EFFECTS OF A WSS-OF-COOLANT ACCIDENT AS LISTED ABOVE. The importance of an actual power reactor plant to conducting these experi- ments cannot be eieith'restimated. As noted in previous hearings, the overall LOFT effort has beret successful iii (I) providing a focal point and a fundamental sense of direction to the water reactor safety program, (2) forcing investigators to face the reality of an actual power reactor in the accident. mode, an(l (3) prOvi(ling a central vehicle to build and hold a competent safety oriented technical stalT in a vital national program. The fundamental soundness of the LOFT objectives have been reinforced by continued engineering and analysis of 1A)l~T which has further established the relationship of the LOFT program to the current industry light water reactors. This has also been reconlirmed by reviews conducted by industry consultanLs, the AEC Regulatory I)ivisions, and the ACRS. PAGENO="0058" ~54 LOFT DESIGN AND CONSTRUCTION The project design ha.s progressed to the point that procurement of all the major reactor plant components is underway. S stem (l(Ysign descriptions of almost all major plant systems have been COmj)ltted by INC. in addition, 10 water reactor major component standards and associated LOFT specifications have been ap- proved by INC and AEC.- As a result of this engineering progress, procurement act ion is underway on the reactor fr~stl~~ vessel nlo(lilications, steam generator, l)resslrizer, primary reactor piping, and reactor support frame. \Vork has been initiated on reactor vessel nlodilicat ions. The design of the reactor core and vessel internals and associated in-core instrumentation is well underway. This is a large effort since the core will be heavily instrumented in order to derive the experi- mental information. In addition to those lfl)T water reactor standards that have been approved there is work underway on 2~i standards which are being prepared with the hell) of ORNL. l)esign and cOnstruction of LOFT construction funded facilities continues with the status at about 90% of design and 60% of construction completed. 1)uring the past year the basic containment structure including the large railroad door and frame have been completed and considerable outside concrete was poured. 1)esign and procurement work is underway on the reactor auxiliary systems with addi- tional concrete pours and final containment tests planned for later this year. In order to efficiently complete the 1)r~j~ct certain experimental equipment of low priority such as an extensive fis.~ioii product sampling system has been deferred. As reported last year, the overall plant continues to be scheduled for late 1973 initial operation. However, difficulties are still being encountered due to the short supply of experienced water reactor design and manufacturing personnel and the problem of obtaining small one-of-a-kind high quality components, instruments and equipment from industrial sources that are heavily committed to the large scale manufacture of equipment for the large commercial water reactors. * EMERGENCY CORE COOLING AND RELATED RESEARCH As part of the LOFT R & I) support effort, various emergency core cooling V analytical studies and .scparateV effects tests are in progress as indicated below. The results of these efforts form the basisforplanning LOFT experiments and the basis for direct technical assistance to the AEC I)ivision of Iteactor Licensing. V Analytical studies and code development at BMI-Columnhus will be terminated at the end of FY 1971. Analytical studies, cOde development and assistance to AEC regulatory divisions will continue on through FY 1972 in support of LOFT. Blowdown experiments on the sea!ed reactor system (semniscale system at .INC) will continue on through FY 1972 in support of LOFT. The intent of these tests is summarized in the following chart: REACTOR SAFETY PROGRAM EMERGENCY CORE COOLING SYSTEM (ECCS) TESTS V THE OVERALL INTENT OF THE SEPARATE EFFECTS TESTS IS TO PROVIDE: V ~ EARLY SCOPING INFORMATION TO ASSIST IN THE DEVELOPMENT AND V V EVALUATION OF ANALYTICAL TECHNIQUES OVER A WIDE RANGE OF VARIABLES. V ~. INFORMATION ON THE CONTROLLING VARIABLES WHICH ULTIMATELY DETERMINE THE PERFORMANCE REQUIREMENTS OR CRITERIA FOR THE EMERGENCY CORE COOLING SYSTEM. , INFORMATION TO ESTABLISH INITIAL TEST CONDITIONS FOR THE LOFT INTEGRAL TEST SERIES AT THE MOST SEVERE DEMAND CONDITIONS FOR THE EMERGENCY CORE COOLING: SYSTEM. I. PARAMETRIC INFORMATION FOR USE IN THE ANALYSIS TO PROViDE FOR VE)crR~nEs OF ELU1D ENVELOPE GEOMETRIES AND BREAK CONDITIONS CHARACTERiZING THE CURRENT AND NEAR FUTURE PRESSURIZED WATER REACTORS. PAGENO="0059" 55 The semiseale system shown below was modified as reported last year for simulated core heat and again this year for emergency core cooling injection. Future plans call for scaled IflhlltilOOJ) systeni modifications. SEMISCALE S~TEM DOUBLE ENDED BREAK CONFIGURATION Rupture -Initiation Device -Rupture Disc Assembly Au~iliary Nozzle Main Nozzle A series of tests have been run in the serniscale apparatus using simulated core heat (electric h~tters) and ztNumfliulat or injection of enItIg((ncy r'ore cooling (ECC) water. The coudition~ of the tests are as tvjnral of large PVs lt:~ as the sealed model ~vill puini it. Iht' results ar I)eing uied to (lock analvt ieal models, (Valuate EGG sVst(Ifl~ afl(I I rovid (Iota for I.( ) VT. ~1he results are also being provided to indus- try as rapidly as obt ainud u mid its sum~ upoit is I ei ng solicited. ~ix tests to date have exp(ricne(cl (lithculty in injecting EGG accumulator water ilit() the core region under P\\ R b-of-coolant -acci(IemLt conditions because of ai )I)ar(Iit bypass of the F.CC ~vater. ihe aluparatus will he nuo(lifi((l liv early FY 1972 to moore realis- ticallv study this proihun u~ing LOFT geomnetry and system conditions more closely rel)restnt ~tive of those of commercial reactors. Testing of enierginCy cooling c:q)ahulitv was completed using full size (12 ft. long) pin assemblies in the Full Length l~mergeiicy Cooling heat Tran$er Pro- Coolant Circ~otuon Butterfly Flow Control Valve Rupture Disc Assembly PAGENO="0060" 56 gram (FLECIIT) at GE and Westinghouse under subcontract to Idaho Nuclear Corporation (INC), a~ shown below. REACTOR SAFEtY PROCRAM~ FUU. LENGTH~MER~E'COOLING_H~T TRANSFER (RECHT) CLI\D HEATE~] Ternp.>1800 F CCC Flcw . ECC FIc~v Design Design Degraded Dog rad3d These tests, in which electrically heated flsselllI)lieS simulated decay heat geziciat ion in full size reactor fuel pins cooled by sprays and flooding, were needlr! to 055(55 (Tuergency co)liIlg svt ~il) perfurnlanc( Itfl(ler (lesign aini ofT-design con- di tions. The tests perfornud indicate that under most emergency conditie:: post i ilat ed I he tmere' iicv cool i rig svst eros will perform their jut ended fi over :t w id range of cooling and tenilarat ore condit ion~. 11 Ow(ver, thk e11 lvi I )e(olols reduced it ndir cirt ~iii tOilti)illat ions of dad 1 eniperat ore and or delayed low coridit iOnS as might 1)1 reasonably post tilat ed for higher o~ power densities characteristic of fut nrc nuclear l)lants. Under sonic of th~- ext r~rne coudit iOfl~ tested in the FLPX: I IT projects, 49 pin bundles were daittaced ~s the zircalov passed the timue_at-tetnperatur( threho1d~ a-- wit Ii chenitical reactions between clad and water or steam. Iniforni~i t ion of I hi~ tv ~ was conidered valuable in (lemnon~tr:tt ing and bracket lag are:ts of concern in the design of fut tire tntergency cooling svstents. ~1he limit at linus of these tests, such a~ lack of complete system simulation and the it~e if elect rical heaters which failed when ext rcnne cui~i~t ions were iulJ)ose(t, were recognized and taken into 1tcCOUflt ill mt erpret ing tie dat a. As a result of the FLI:CIIT project, a better understanding is available on the mit tiract momis between (niergency coolant t (assumed capal de of (lelivery to the core within 1 a-3D seconds from a nIajor coolant pipe break) and Ito zircztloy cladel lug (~s-oinnie(l to heat liJ) front a - comnihimiat loll of stored fuel energy at t hi time of the pipe break, pints the loss of coolant Pius decay heat gemmerat ion). it owever informmta- loll g:t~ s rermia in in tile t bite regime following the as~tiiiteii ~ui~,t 111(8k, bitt `nor to EUC inject ion. I )uning this regime, stored fuel iiimi heat is tramu~f rriil to tin; cladding, to th~ renlOirlilIg coolant, and to steam formed ditnitig svtt dl sunizat ion. the rate and amount of heat transferred during I his t univ perHI, u he l3low down II eat Fran~-fer (111)1! T) reginu, ~5 mliii ort :intt in est ti 1; -hint g ciaddi mtg t enipera tin re at the I mint. of emergency core cool mug inj ci mont. The in portance of obtaining BI ) iii' information, for 1)0th I)resstttizi(l arid boiling re- actors, is recognized by the industry, as well as the AEC 1)evdopment and Regulatory l)nvnsions. SS CLAD HEATER~] Temp. ~ 1800 F PAGENO="0061" 57 In recognition of this common flOPE!, the I)ivisiofl of Reactor Development and Technology has held discussions with PW It ruin 11W It vendors to encourage co- operat i~e efforts between indtist ry and t hi A EC to stud the B 1)1 IT regime with experiments scaled t.o flpr(S(il t. the lilajor (`OrniponeIl Is of operating power plants. General Elect ne has proposed a shared cost Coop(rat ye program on l3I)IIT for B \V It's, and It 1 )T has agreed in pni nciple, assitit i rig that mutual agreement on work scope and contract conditions can be obtained. POWER BURST FACILITY (PBF) Mr. SHAW. The power burst facility is a reactor for testing effects of fuel failures resulting from a burst mode or steady state operation (fig. 100). We put. fuel samples that have an operating history- that is, have previously been irradiate(l-and give them a nuclear J)1LISO ot' give them au oveupressure (`I 1)o\V0I to flow imbalance, in 1)1(1(1' 1(1 500 the types (if failures that WO mriv ifl(ltlCC ttfl(l the COHSC- (Il10II(es of t hose fri ilutes. Of course, to (10 this, WO have tt Sj)e(iiLI closet! 1001) Ill the power burst facility, such 1 lutE whieui tIle failure Occurs it tiocs uiot affect the [`(`St of the syst euul. (Additional iuiforunatjou provided for the r('cor(l follows:) `I'he Power BurstS Facility (P1111, (shown in chart, below) being completed at N RI~, is an oxide-fueled, (Jut hermal, water moderated react or capable of steady- state and transient opera I ion iticlirding tIre l)(rfOrfllanee of Iuo~~tr bursts having rut ml periods a ~ujuroachiiig I nisec. Fuel loading is scheduled for C Y 1971 and ~hc start of t he exp(nirir(nlal program is scheduled for early C Y 1972. On Octo- ber 29, 1970, responsibility for the PBF was transferred from the construction FIGURE 100 PAGENO="0062" 58 contractor, howard S. Wright and Associates, to the operating contractor, Idaho Nuclear Corporation. On l)ecember Il, 1970, the efforts of the architect- engineer, hbasco Services Inc., were terminated. :~ H V __________ t - ~J~1.: ~ 4~ PG~VER BURST FACILITY. View looking northeast showing cooling tower on left, emergency generator in center, and PBF reactor building on right. The overall objectives of the Power Burst Facility is to provide a safety test facility for conducting research on accidental melting of reactor fuel samples and assemblies (See chart below) Such information is vitally needed to Supl)lelfleflt the out-of-pile work on fuel assembly mock-ups which have been undertaken to study fuel failure modes and emergency cooling effectiveness using electrical heaters (e.g., FLECHT program). By performing fuel assembly tests in PBF it will he possil)le to more realistically l)redict full scale reactor core behavior under equiva- lent accident conditions. Analyses presently conducted on full scale systems are deemed to be conservative in the determination of accident consequences-but significant experimental proof is lacking. REACTOR SMtIY PROGRAM P(WiER BURST FACILITY (PBF) OBJECTIVES : 1. TO STUDY NUCLEAR RJEL. AND CLADDING BEHAVIOR OF RJEL PIN CLUSTERS UNDR.ABNOR?ML OPERATING AND POSTULATED ACCIDENT SITUATIONS TO DETERMINE SAFETY t~RcsNs: 2. TO IDENTIFY ANY UNEXPECTED EVENTS OR THRESHOLDS NOT PRESENTLY ACCOIJNTED FOR IN THE ANALYSiS OF RJEL. AND CLADDING RESFVNSE. 3. TO EVALUATE T}t ADEQUACY OF ANALYTICAL MODElS TO PREDICT TI( CONSEQUENCES OF POSTULATED ACCIDENTS IN NUCLEAR REACTORS. DESCRIPTION : SAFETY TEST REACTOR, CONTAINING A DRIVER CORE WITH A CENTRAL PRESSURiZED WATER LOOP DESIGNEE) TO TEST THREE-FOOT LENGTH PNR OR BWR FUEL ASSEMBLIES, CAPABLE OF STEADY-STATE AND TRANSIENT OPERATION. EXPERIMENTS : LOSSOFCOOIANI, POWERCOOLINGMISPMTCH, AND REACTIVITY iNITIATED TESTS WITH SINGLE PIN AND MULTIROD CLUSTERS USING UN)RR.ADIATED AND IRRADIATED PWR AND BWR RJEI. FOR CONDUCTING RESEARCH ON MELTING OF REACTOR FUEL SAMPLES AND ASSEMBUES. STATUS FACILITY COMPLETION AND Rift LOADING DURING CY 1971 AND START - OF THE EXPERIMENTAl. PROGRAM IN EARLY CY 1972. PAGENO="0063" 59 The basic document which will focus on the (`xperinwnt.al program in relation to the crirrrrit safety issues and jiriorit irs is the PBF Progr:uii Plan, an outline of which was circulat rd to t he AC US ann the A iC regulatory staff in May 1969 and to indust rv in November 1 ¶Hi9. Ba~r'(1 on AC ItS, regrilat ory staff, inultist rv and it t)T review a rid corn rnrn t , I N C is in t hr process of (st a l)lishi ng a Ii rio test program for the initial trst,i ng series and or it lining t hr long t erni t (st i rig series. Present program plans ~t i~ divot rd to water coolerl reactor fuels and (`1111 ili~siz~ the si mulat ion of those accident conditions considrre(l roost. representative of (he route by which reactor fuel macit might he achieved. Exploratory work will continue on the POsSibility of testing ot her fuel types. Snow facility modifications are being con- si(Lrred which, if incorporated, %%ouII(l Provide the PB l~' with increased capability to model the potential accident conditions of advanced high power density reactors. The Citpsuilc Driver (`ore (C I )C) program, which l)rovided failure data on individual pins under static coolant conditions as a prelude to more complex tests of fuel clusters in the Power Burst Facility, was terminated (luring F Y 1971. Mr. SHAW. The unfortunate l)tUt about every one of these facilities is that they lire (1tlite eX~)CIlSi\.e to build ltn(l (1tlite eXJ~enSiVe to operate. But we know of no other way to get the kind of (LaIn we need. There is t1lS() Ii tremendous amount of controversy as to lioiv benelicinti such small-scale eXl)erilfleilts (lIfl he, ~ our position is that we can't afford to bllil(l I hem nuicli bigger. Ihese data become very signilieant in terms of insuring analytical and experiment mtl results. We believe we have to keep this kind of effoit going to provide the best. l)o5511)1e iiiiS\VCFS to the (OUCCFUS (bitt Can be expressed l)V those looking at. what happens if many things go wrong and if systems put in to take care of these accidents don't work. FUNDING OF SAFETY PROGRAM Representative T-TANSEX. My concern, if I can express it., is that really we may not l)C moving irlie~ul fast enough ill terms of the funding, of 11w kind of safety research that will helJ) produce time aitswers to the growing cont~iiis t lint are 1)eing VOiCe(l, p~Ut icularly by environment al groups; safety being such an un port ant 1)itlt of react or technology its 11w unit ~ gio~ iii terms of size, it seemims to inc that \V(.' are goulig to have to keep price in the level of effort that we are mounting for reactor safety. ~. ly conce~n is what a ppears to be a tapering off in the area of safety research just at the time that we probably ought to be stepping it. ill). \ I r. StrAw. \ I r. II ~fls~ii, it is lit) seci't. tim at. t hemi' ml rt' sI rung feelings 811(1 1(1)! (`sent at in ills lb at say ( xnet ly what. you liii ye sai(l . \\o certainly ii rn not get t ing iVita t we ii mm Vt asked for in m (`net or smtf~t v funding. `Ike ~(0~i( (1 )ti((IflO(l mi mt ren gliize t Ii at wit in am t tim (` (1 itt 8, 1 lieie has to Ill SoflW (OIl1~flitS;ltiIlg 8(tioIl takeim, such as iii tnrmmls of being Illume commserv ittive nut! thor carefuni 1 lout mu iglit ol hmerwise be neces- sat~. & (nummot exl)k it tile react ors or push time react ui's IlS hum d ui, we believe they could 1)1 t'luit~mtt~'d. \\e feel we tin ye t I) (I tveh p on list' fronts ; th at. is, st rung quril i ty assutrum lice pn `grim imis htmt still exti rninumlg to our l)est )( )ssil)le abut ity whmmtt lluLl)lRIms if timings go wrong 1111(1 get tin' signs of !)rubiemlms early (notigli timid (`X(I'(lSt' t lU tVl)( of (oil t tul nee(i(d. it is t I tie I lint 1)1111 inllv its ti restmlt of limo Ilet.(l to increase the lt(lVrtllced I (tl(tUN safety prugi tints, we have hir~d to back off on the light water srtftt~ pm.i~m ants. We hut ye had a imumber of meet illgs with the industrial gioups 111 oider to try to get them to pick up these light water safety activities. There is a good agreement that something PAGENO="0064" 60 hkt this w ill I1R\ e to b( dOIl( , but ~ e haven't moV( d aht ad as qui kly as sh,uld havo been dour. We feel we have excellent facilities in house. We have excellent iwople ; but we feel that the iiidu~ try should i eally be SU~)j)Ortit1g more of these activities before we terminate theni completely. We nerd to get mnatiy of the answems that must. be available if we are to continue to live with the analyses ammo1 ttsSUIfll)tionS niado on such matters as failure modes an(I responso of safety systems with increased P0\Ve1 density and cci tairi materials and operating pt~ttems. 1 want to note, however, that the worth of the safety program relates not only to the timing of initial start UI) of these 1)lants, but. also throughout the 01)0.1 ating history. Many of the safety concemns you hear about right now relate to the consideration of long-term operation, which we think tue vei~y kgiti- mate. \Ve feel that this concern over safety is. the kind of thing we must keep in front of us afl(l talk about openly. - The safety program suffers tho disadvantage of open discussiom; although we feel it is the right way to do it. We have discus~od suf~;. l)lans we have ideutifie(l all the pioblenis and many of these may miot be meal. Unfortunately, our critics and intervellors are using much of this information against nuclear power in many cases. We feel we have no option hut to conduct. the safety irlated ptograflis this way and accept the criticism and the. consequences. Rej)r(sentative H.&N5EN. What is the request for safety? Mr. ABBADESSA. ~1h (liVisioll request. was for $49 million. `lhi' agency request was $42 million, and the budget that you are looking at, Mr. hansen, has $35.0 million, which is the prior year's level. (Testimony continues on P. 864.) (Additional information provided for the record follows:) NUCLEAR SAFETY PROGRAM The Nuclear Safety Program is divided into five budget categories-Ne :.t. Safety Research and I)evelopment, Effluent Control. Research and l.)eveli'lc: nt., Engineering Field Fests, Reactor Safety Analysis and Evaluation, and Etigi- ricering Safety Features. The Fl 1972 funding request for NuclearSafety Research and l)evelopment is $14.4 million, an increase of $1.4 million above the current Fl 1971 estitii~tC. This represents an increase of ~3.2 million for LMFBIt safety R& I), part of which is offset by reductions in AEC funding for the Power Burst Facility program and by completion of a study of failure modes in light. ~vat ci reactor fuel cladding. The increased LM FB It safety l~& 1) funding is for expanding j~rograris in the areas of fuel (l(lnen t failure m ropagat ion, fuel-coolant interact ions and post- accident hint removal, and for t st irradiat ions. `I'he F V 1972 funding request for Eliluent Control Research and Development i~ $4.1) niillion, a decrease of $1.5 million below the current F V 1971 i~-t itnate. `1'hi~ act ivitv is direct eij tow:trd developing .~f practical nietliods for long tern! inanagenwnt of the radioactive wastes resulting froiti ii~iclear facility opcr- at ions; determining and ~sses~.ing t lie fate and behavior of these rsi(l iial radiO- active ~vast es in I he envirouhil'.iit and wit Ii the geophysical and environtilerit il aspicts of siting. de~igii and con~t rite! ion of react ors and iclated titulear facilit it.~. The decrease in re 1uest ed fiiiidiiig is titade possilk b~ t he aehivii;iint 1)1 Sin) d, tested tnit hods of ~vast e saudi heat ion atil pirinaron t st am g in salt iiiities, by a reduced ziced fur addi t ional work in radioactive residue ~ devilopnietit, and br the cozniilet ion of met ,orologieal st inlis at t lie N at ioiial React or Testing St at ill!. Increases . ttCCoiIiliio(.htt ed wit hin t his budgt elemii'iit provide for the concept ual design and enviroutnetital evalizat ion of the Nat mimi Radioactive Waste Repository planned to he constructed at Lyons, Kansas. The fiscal year 1972 funding request for Engineering Field Tests (LOFT) is $9.9 million, an increase of $i.S million over the current. liscal year 1971 estimate. LOFT fuel fahricatiozm will be initiated in fiscal year 1072. LOFT analytical systems PAGENO="0065" 61 dr~ign has br~r'n rP(Inced but incrPasp~ are necessary in test a'*emhly fabrication fiul fabricat iøii at~(1 op'rat i()t1Z planning. Th~ fiscal yar I ¶)72 funding rqiu~t for l~'actor Safety Ana1v~i~ and Evaluation is $1. I ittillion, a (1(crea-e of $0. I ni illion below the current fiscal year 1971 (sti- mat e. A siiiall comnputer art ivit y for the han(llin g of (lat a on safet y-reiat rd r(aCtor charact erist i r- is .1 iii ng t rrniinat ed, as is tin lii gh Tenij erat tire ( as Reactor Pro- graiti Office. A small iner(ase in funding is requested for the Nuclear Safety In- formation Cent er. The fiscal year 1072 request for Engineering Safety Feat tires is $6.5 million, a decrease of $1 .~ million lalow the cnrrent~ fiscal year 1971 est iniat e. This activity provi(les a jmrograiui for ifiV(St igat lOft an(l d(v(lopm(nt of (ff(ct ive engineered safety feat tires to prevent major accidents and to control t heir consequences in the unlikely event they should ocrur. i nder this 1)udget category, efforts in ``sepa- rate effects'' testing to ~t tidy experiment ally the individual I)ll(noniena contri- hi it in g to react or behavi or under accicl (fit cond it ions have been considerably red iiced front ti-cal year 1971 levels. Analvt cal study of loss-of-coolant accidents amid the standards program have al~o been reduced. The Containment Systems experiment (CSE) has been t ermninat(d. Significant increases over fiscal year 1971 levels are planned in the st tidy of reactor system and containment structural dynamic response to accident condit ions and in hO FT integral experiment Work and radiological studies. \Vork is being completed and closed omit in experiments on initiation of ductile pipe ruipt ire, in evaluation of existing data to describe reactor accidents, and in spray and j)ool absorption technology. A new program t.o st tidy blowdown heat transfer, cooperatively funded with indiust ry, is being mi- tiated in fiscal year 1971 and will be coat mmd in `fiscal year 1972. While the Nuclear Safety Program budget is organized on the basis of the five categories previously described, the descript ion included in the record of this hearing of the program is Provided with reference to l)artictilar applications, and emphasis is placed on specific accomplishments during the past. year. The break- down of the nuclear safety budget for F V 1972 according to these applications is as follows: DollarR in rim illioni Fast breeder reactor safety 11. 1 Light water reactor safety - 16. 4 Environmental effects 4. 0 high temp(ratmmre gas reactor safety 0. 5 Standards and codes 2. 6 Other 1.3 Total 359 (Subsequent. to these hearings, the committee submitted the follow- ing (lu(~slions to the Commission for reply:) Question: ll7ia( type of additional work Would be conducted in (he safety program if (hi' funding 1mel wcre at the (llrision request znst('ad of the requesle(l S35.9' milliont Reply: The nuclear safety ~)rograni, to stay within the ceiling of S35.9 million has undergone serious project redmict ions. Since certain l)roject s req tuire increased support, others must he reduced. If increased fuindiuig. were available, ((Torts would be supplemented in hot h fast and t heriii:il reactor safety. Additional fast reactor safety ((Tort would be undertaken as follows: 1. Acceleration of TREAT modifications to improve testing capability; e.g., converter region. 2. Alternate shutdown system studies and experiments for LM FB R's. .3. St mdv (if l)lault size effects on tM lB It potential safety issues. 4. Accelerated effort on Post accident heat removal studies and experiments. Thermal iltactor Safety programs ~voimld be coiuiplemiteitted as follows: I utiplenieuit at ion of additional l3lowdown I lent `l'raiisftr, euigineering scale (xI)(rimnents' for loss of coolant accident studies applieal)le to P %% lt SV$t(flis. 2. Increase of effort tfl(l acceleration of J3lowdo~vn I feat Transfer, engi- neering seah~ experiuuients for loss of. coolant accident stu(lus ap~)lical)le to lt\~lt Syst(fuis. 3. 1 )evelopmeuit of nit r'grated multidimensional couiiputer codes for analysis of loss of coolant accidents. 4. Acceliration of the PBF program for early initiation of power coolant mismatch and loss of coolant, experiments of irradiated fuel assemblies. 48-721 0 - 79 - 5 PAGENO="0066" 62 5. Acceleration of PWIt Sc1niscale testing of loss of coolant behavior and emergency core coolant injction systems including experiment modifications to re~olvc potential deuiciericics in 1CC coolant delivery. 6. Initiation of containment studies applicable to BWR pressure suppression systems. 7. Exp(rim~ntal inve~tigation of fuel failure modes under simulated reactor coolant hiowdown conditions. - S. Performance of low flooding rate, atmospheric pressure tests in FLECILT PW It geometry. 9. Increase the level of effort related to primary system integrity, specifically, implementation of tasks on stress corrosion, pipe rupture studies, ll('ZtVy Section Steel Technology program and stress indices for piping, pumps and valves. Question: Would you please provide a narrative explanation of the steadily increas- ing operating cost.~ indicated in your 5-year projections from J!Y 1972 through FY 1977 for the nuclear sufty program? Reply: These projections have the following basis: 1. Water reactors built, in the future will incorporate essentially present day major design and engineering features. 2. Although base technology requirements are decreasi ii g, requirements for engineering safety systems offset this to provide a near-terra overall funding peak for water reactor safety. The water system safety program will then phase down to a base level to keep pace with- evolving new technology. 3. The orderly reduction of wator reactor safety efforts will be paralleled by an increasing emphasis of support on advanced reactors. 4. There will be a continuing ernj)hasis on support activities, including work related to small radioactive spill problems, efforts on standards and environmental R&l) in such areas as radioactive waste management and thermal effects. Part of the near-term water reactor safety funding peak can be attributed to the current effort required to resolve uncertainties facing both reactor suppliers and those charged with safety assessment for the ~urge of commercial reactor business which occurred between 1965 and lOGS. It can be l)rediCte(1 that the majority of the reactor safety qirestions will he answered for this reactor type by the time most of these reactors have been granted operating licenses, which i~ l)roiected to occur by 1975, if funding and other resources are made available. In the near term, LOFT and PB F require extensive support from the operating budget in the form of research and development to provide a basis for their design, construction and operation, and to pay for expendable items such as reactor cores and experimental components. Continued funding will be necessary also for the development of safety technology associated with larger-sized water reactors, new applications, higher power densities, reduced design margins, and siting closer to high concentrations of population. It will also he necessary to continue to l)rOvide a technological safety basis for the design, construction, operation and nmaintenance of advanced light water reactor plants, and for their safety assessment for regulatory purposes. - Funding requirements for breeder reactor safety Lt&1) are expected to increase significantly over the period of the next decade. Consistent with the establislimtiit of the L~l 1'Blt as the highest priority program for achieving the breeder objective, mo'~t of the projected funding is directly related to this advanced concept. It should he noted, however, that the safety program will also benefit ot her advanced reactor concepts. For example, some of the test facilities to be l)tLilt. for the L M FB It program could be used for It& I) on of her advanced reactor concepts. These projections in general are based on the ~vi(l(~l)rea(l use of the uranium- 1)1 it oni urn fuel cycle, and could be significant lv altered if in the future it ueeoi,ws necessary from the standpoint of national interest to undertake an increased pro~raIn for use of the t horium-uranium fuel cvtle. `1 he funding ~)roject ion also provides for the continuation of modest R& I) support on the effects of nuclear power on the environment. This work is even more essential now in light of the national concern regarding t he environment. Additional lt& I) on waste management techniques will be required. It is also planned to increase efforts, in concert with other Federal agencies tird industry, on t he control of the discharge of heated till tents from it ticlear po~~'(r plants and the effect- of these discharges on t he tnvironmn(nt. This planned increase is con- sistent with the recormimendation by the JCAE for an increased effort to provide inforinat ion- to answer the questions related to environmental effect~s of nuclear po~~er plant-s. PAGENO="0067" 63 Question: C'ou!d you OlRo di.~cnss the rea.son.~ for the projected cOfl8trUCtiOfl cost increa.se~ in the nuthezr .snfe(y program for FY 1973 through FY 1977? lt(1)lv: `!`he l)rinlary reason for the increase relates to the safety test facility and loops a~ shown below: Safety test facility and loops: Millions Fiscal year 1973 $12 Fiscal year 1974 55 Fiscal year 1975 20 This projection provides for design and construction of new facilities for the conduct of LM FBIt safety experiments, should studies presently underway indicate the need for such facilities. The most. important types of tests will be those in which the experiment (one or more LMFBR-type fuel subassemblies) is first. brought to full power, steady-state conditions and then exposed to an overpower, transient, flow coastdown, flow blockage, or a comparatively slow change in reactivity. Fast insertioas, either from low power or full power condi- tions, also are to he considered and will place different, demands on the facilities. Mr. JOHNSON. Mi. hansen, there is SOlile philosophy ~vithin various quarters that HS reactors get developed and l)ecome CSttlbliSllC(1 and useful, in(Iustry should 1)ick up more of the tal) for keeping on to the safety program. It is a difficult thing t.o do act ually because, as Mr. Shaw 51)1(1, it is not quite the same as testing an airplane. The cost of the. airplane is hahl(lh'd by the manufacturing company and FAA just goes out and (hecks it. and tests it. In this case, we have to build special facilities. I think we are doing about tl)e best we can to get tts much niOne3T as we can to keep the program going. it is difli(Illt to get. more support. than that. Dr. I\AVANAGII. We have been trying very har(I to get more funds lot this juogmam. I think what you have stud in your question is correct. r1lwr(~ ShoUld be more in it. We. are working to get. better coopera (10!) in II~t)CtOI safety piogm ams. This does not menu that out reactors ate not, safe. It. means that we should be speH(ling niece to assure that th(W are safe, to gain added assurance that they are safe and, as Mr. Shaw says, find it possible to extend the operating limits and still maintain safety. (Additional material from Mr. Shaw's prepared statement follows:) FAST REACTOR SAFETY VJ he main an as Of in~ stigition mu tlii fast iea tot `~if( tv program are following the priol it los established in the national LMFBR pro- gram plan, basically developed by detailed analysis of time LMFBR accident sequence diagram, figure 101. PAGENO="0068" 64 Attachment 3 UNITED STATES NUCLEAR REGULATORY COMM$SSION WASHINGTON. D. C. 20555 April 5, 1979 BOARD NOTIFICATION Re: Cherokee 1-3 Docket No. 50-491-2-3 Diablo Canyon 1-2 Docket No. 50-275-323 FNP Docket No. 50-437 Greene County Docket No. 50-549 Jamesport 1-2 Docket No. 50-516-7 Marble Hill 1-2 Docket No. 50-546-7 McGuire 1-2 Docket No. 50-369-70 North Anna 1 Docket No. 50-338-9 Pebble Sorings 1-2 Docket No. 50-514-5 Perkins 1-3 uocket rio. 50-488-89-90 Pilgrim 2 Docket No. 50-471 Seabrook Docket No. 50-443-4 Shearon Harris 1-4 Docket No. 50-400-1-2-3 Sterling Docket No. 50-485 St. Lucie 2 Docket No. 50-389 Three Mile Island 2 Docket No. 50-320 Tyrone Docket No. 50-484 Wolf Creek Docket No. 50-482 WPPSS 4 Docket No. 50-513 Distribution: Copies of a Board Notification dated April 5, 1979, have been served on the following persons. Those whose addresses are at the U.S. Nuclear Regulatory Commission have been served by the NRC internal mail system and others have been served by deposit in the U.S. Mail. One copy has been served on each person even though his or her name appears on more than one service list. In addition to copies served on Atomic Safety and Licensing Board and Atomic Safety and Licensing Appeal Board members identified on the service list, 19 copies of the attachment have been provided to the Atomic Safety and Licensing Board Panel, and 1 copy of the attachment has been provided to the Atomic Safety and Licensing Appeal Board Panel. PAGENO="0069" 65 ,~c7 WflTEO STATES `~ NUCLEAR REGULATORY COMMISSION ~ ~ ~ WASHINGTON. D. C. 20555 SEP 2 5 t978 MEMORANDUM FOR: Milton J. Grossman, Hearing Division Director and Chief Counsel, OELD FROM: D. B. Vassallo, Assistant Director for Light Water Reactors, Division of Project Management, NRR SUBJECT: BOARD NOTIFICATION - SEMISCALE EXPERIMENT S-A7-6 (BN-78-17) The enclosed staff memorandum discusses unanticipated results during recent semiscale tests and I think is self-explanatory in terms of in- formation available to date. Although the memorandum recommends notifying Boards following the avail- ability of additional information and a more detailed staff assessment, I feel that the memorandum, as written, should be provided to appropriate PWR Boards at this time. We will provide the additional information and assessments as soon as they are available, but the enclosed memorandum will serve the purpose of alerting Boards of a potential problem. Our list of PWR cases before Boards in the service list time frame is as follows: Enclosure: Memo, D. Ross-to D. Vassallo dtd. 9/22/78 w/enclosures cc w/enclosure: See page 2 Cherokee 1-3 Diablo Canyon 1-2 FNP Greene County Jamesport 1-2 Marble Hill 1-2 McGuire 1-2 North Anna 1 St. Lucie 2 Pebble Springs 1-2 Three Mile Island 2 Perkins 1-3 Tyrone Pilgrim 2 Wolf Creek Seabrook WPPSS 4 Shearon Harris 1-4 Yellow Creek Sterling D~ B. Vassallo, Assistant Director for Light Water Reactors Division of Project Management PAGENO="0070" 66 Milton J. Grossman SEP 2 5 ~ cc w/enclosure: H. Denton E. Case J. Davis R. Boyd R. DeYoung 0. Eisenhut 1. Engelhardt L. Nichols B. Grimes J. Stolz R. Baer 0. Parr S. Varga IE (7) 0. Ross R. Mattson V. Stello P. Check T. Novak Z. Rosztoczy 1. Murley J. Scinto ~S. Hanauer PAGENO="0071" 67 UNITED STATES NUCLEAR REGULATORY COMMISSION `~. ~~J) ~ WASHINGTON, D.C. 20555. SEP 2.2 1978 MEMORANDUM FOR: D. B. Vassallo, Assistant Director for LWRs, DPM FROM: 0. F. Ross, Jr., Assistant Director for Reactor Safety, DSS SUBJECT: BOARD NOTIFICATION - RECENT SEMISCALE EXPERIMENT S-A7-6 Semiscale experiment Mod-3, S-A7-6 was run on September 12, 1978. It was intended to model an Integral blowdown-refill-reflood scenario for a double-ended cold-leg break. On September 21, 1978 INEL staff provided for NRC a briefing of the results of the test. Some of the results were unanticipated. For example, the heated core simulator was projected (by Semiscale) to quench at 110 seconds. Instead, it dried out again and went through several cycles of dryout and rewet (see enclosed Figure 1). Other portions of the cladding temperature showed similar discrepancies wherein test temperature4 were somewhat below predicted (see Figure 2, 3). During the test the downcomer voided several times in the time span 100-400 seconds. This was not predicted (Figure 4 shows one such void). During the periods of downcomer voiding there was also negative (downward) flow from the heater to the lower plenum. A quick-look report on this experiment will be published about Or.tober 1, 1978. The significance to safety, in the sense of NRR Office Letter No. 19 is in the phrase `whether this information could reasonably be regarded as putting a new or different light upon an issue before Boards or as raising a new issue. The information from the experiment is that nearly complete downcomer voiding occurred after downcomer fill. This is not predicted during EM-Appendix K applications. Also, typical Appendix K calculations do not show successive dryout and rewets over the extended reflood cycle. The present judgment by INEL is that'experimental atypicalities, in particular in the stored heat in the downcomer pipe and in the 1-0 arrangement of the downcomer, have produced an atypical and unanticipated result. In the coming weeks we and INEL intend to further study the issue and find out ans~ers for the questioned experimental atypicality as w,~e1l as the questioned failure of RELAP to have anticipated the result. PAGENO="0072" 68 In my judgment, based on the INEL presentation, this experiment does not put in a new or different light the concept of PWR bottom - flooding FCCS- Neverth&Iess, it does require us to get more information from a source external to the staff.. It is of sufficient importance to seek further information, first from NRC contractors, and perhaps licensees and vendors in due course.. In this event I conclude that it meets the notification test. In NRR Office Letter 19, Enclosure 1, page 6-7, I am supposed to provide you the following: 1. the item for notification; 2. considerations regarding relevancy and materiality; 3. statement on perceived significance; and, 4. relation to. projects. 1. The item This memo and the figures show that an integral experiment intended to simulate many of the PWR LOCA phenomena displayed several unanticipated expulsions of water from the downcomer during what was expected to be a tranquil reflood process. 2. Relevancy and Materiality The experiment is relevant to all bottom-flooding PWRs. I presently doubt that it is material due to perceived atypicality. 3. Significance Current staff positions on this subject are through approval of Appendix K models. If we thought a new phenomenon was discovered, we would alter our staff positions on those models. Until the atypicality issue and the code predictability issue is better documented, we do not propose to reopen PWR vendor model approvals. This position is interim, and based on the expectation that the experiment is atypical and that proof will be available in the order of weeks. * 4. Relation ~t(Projects . This relates to PWRs In general. As far as documentation is concerned, I believe it is preferable to distribute notification of theOctober 1 Quick-Look Report along with a more detailed staff assessment of relevancy, materiality, and significance. PAGENO="0073" 69 We could have this by October 15. If, however, more prompt notification is needed, this memo should suffice. D. F. Ross, Jr., Assistant Director for Reactor Safety Division of Systems Safety Enclosures: As stated cc: R. Mattson V. Stello R. Boyd 0. Eisenhut B. Grimes P. Check T. Novak Z. Rosztoczy T. Murley J. Scinto S. Hanauer PAGENO="0074" Figure I "4 U S L L S E * L * S 4 S I COMPARISON OF ROD CLADDING TEMPERATURES AT CORE HIGH POWER ZONE WITH RELAP4 FOR TEST S-A7-6 I 200 1 C100 600 S (I 400 -100 0 100 200 300 400 500 Tim. A~4.r Rup4ur'. C...) PAGENO="0075" COMPARISON OF MEASURED AND CALCULATED CLADDING TEMPERATURE IN UPPER PART OF CORE FOR TEST S-A7-6 La L 0 L S S E S I- S S * L a U) -50 0 50 100 150 200 250 300 350 400 450 500 Time After Rupture Ce) PAGENO="0076" Fi9ure 2 I' U 0 I. ~ :3Cu) E. I- a 0 0 L (a COMPARISON OF MEASURED AND CALCULATED CLADDING TEMPERAUTRE IN LOWER PART OF CORE FOR TEST S-A7-6 400 -50~ 8 50 1'30 150 .200. 250 300 350 400 450 500 ~1 l~0 ieoo 900 700 500 Tim. Altar Rup~uv~. C.) PAGENO="0077" I' F U C 0 d ) S `U B CALCULATED COLLAPSED DOWNCOMER LIQUID LEVEL FOR TEST S-A7-6 b 5 4 1 50 60 70 80 90 108 110 120 130 140 158 160 170 180 198 200 Tim. A14.r Rup~ur. C.~ PAGENO="0078" 74 Attachment 4 0R~L-NSIC-24 Contract No. W-74O5-eng-26 Nuclear Safety Information Center E~RGENCY CORE-COOLING SYSTE~ FOR LIGHT-WATER- COOLED POWER REkCTORS C. G. Lawson OCTOBER ~968 r7~ OAK RIDGE NATIONAL LABORATORY Oak Ridge, Tennessee operated by UNION CARBIDE CORPORATION for the U.S. ATOMIC ENERGY CO~1ISSION PAGENO="0079" 75 5. CONCLUSION AND RECO~NDATIONS The emergency core-cooling systems of several boiling- and pressur- ized-water reactors, were reviewed, the design basis and backup data were examined, arid the reed for certain additional data was established. Gen- erally, the design approach used by the manufacturers is conservative ~ihen evaluating the energy released or the cladding temperature. Occa- sionally there is an absence of experimental data that is inconsistent with the apparent sophistication of the calculational procedures. The following conclusions and recommendations are made as a result of this review. 5.1 Removal of Energy Sources The emergency core-cooling system is an engineered safety feature designed to prevent a core thermal runaway by removing fission decay and stored energies and by preventing the release of potential energy in the Zircaloy-steam reaction. Lack of control and removal of these energy sources night lead to failure of the outer containment structure. 5.2 Damage to Core During Blowdown The LOFT and the CSE programs are studying the blowdown of pressur- ized- and boiling-water reactors in detail. The questions relating to the mechanical integrity of the core and the piping have been defined and many can be resolved by the designers. The effect of pipe rupture propa- gation time and shock waves on the pressure loadings axially across the core and radially across the core barrel should be determined for short rupture times. The time to reach saturation pressure in the blowdown is about 0.05 sec for a large pipe rupture. Therefore even a propagation time of 0.01 sec is not considered an instantaneous break. Damage to the core internals during the depressurization may adversely~ affect the coolant distribution and core cooling during the blowdown and core re- flooding process. PAGENO="0080" 76 The transient heat transfer from the fuel to the cladding to the coolant should be measured and understood for both pressurized- and boil- ing-water reactors during the quasi-steady-state blowdown. The fuel cool- ing rates during blowdowri can influence by at least 1 mm34 the minimum time required for water addition to prevent fuel cladding melting and/or excessive metal-water reaction. Core damage that wou.ld influence cooling rates should be prevented. The LOFT and CSE programs are studying the amount of water remaining in the pressure vessel and high-pressure system after blowdown, since the water left in the reactor vessel affects both the tine to reflood the core and the potential extent of the Zircaloy-steam reaction. Tests of the amount of water left in the vessel after blowdown have been extended to include determinations of the effect of core internals and the external piping on the amount of water left, since they may act as entrainment separators. There are many computer programs and physical models available for calculating blowdowrx-pressure transients and water inventory. These com- putational methods are being tested by the LOFT and CSE programs. This effort should continue, since all these computer programs need normaliza- tion to data. Much time would be saved if the competence of the individu- als from diverse organizations working on this effort was grouped to form a common source of information. Battelle Memorial Institute has recently initiated such a program at the suggestion of ORNL. 5.3 Spray Cooling of Core _Additional work is required to assure the reliability and effective- ness of spray cooling systems for the high specific power cores currently being designed, particularly for temperatures in the range 2000 to 2500°F. Extensive work by Phillips Petroleum Company is planned on Zircaloy rod bundles. The data published by General Electric Company on the effectiveness of spraying 6 x 6 and 7 x 7 arrays of full-size stainless steel-clad fuel assemblies were obtained under conditIons where the hottest fuel rod was assumed initially to be at 1800°F (representing some time after blowdown). PAGENO="0081" 77 However, in their Browns Ferry reactor, for example, the calculated ther- mal condition of the core fuel rods 30 sec after the break when spraying was initiated would be as follows: Temperature °F Hot spot 1177 2150 l0~ of cladding >948 >1740 25% of cladding >816 >1500 50% of cladding >635 >1175 Some of the core would be at temperatures in the region where the metal- water reaction* rate between Zircaloy and steam becomes significant. The experimental data clearly need to be extended to the temperatures of the accident. Temperature distributions representing the consequences of moderate delays in initiation of emergency cooling should be simulated in some spray tests. Forced- and natural-convection heat transfer between steam and high-temperature Zircaloy should be measured and analyzed. The gas pressure inside the fuel rods should be controlled at levels representative of reactor fuel to get a proper measure of the nature of the cladding failure as the blowdown occurs. The possibility that swell- ing of the cladding may cause blockage of the flow channel should be eliminated if gross swelling occurs. The relationship between the amount of steam-Zircaloy reaction and gas embrittlement should be determined. The condition leading to rod fragmentation upon quenching from high tem- peratures should be determined so that it can be avoided. The possibilities of water-hammer formation by rapid addition of water to hot Zircaloy should be eliminated. The spray system relies on wetting the inside and outside of the fuel channel shroud and thereby pre- senting a radiation sink for the heat from the fuel rods. The Japanese and British data on the sputtering phenomenon, as well as the American work by General Nuclear Engineering Corporation on flooding of hot metal surfaces, show clearly that'the time required for cooling and wetting a hot surface increases rapidly with increases in surface-to-steam tempera- ture differences and decreases with system pressure. This influences the 48-721 0 - 79 - 6 PAGENO="0082" 78 lag time for rewetting the wall and fuel rods and* requires that the rods be cooled by both thermal radiation to steam and steam convection until the walls are wetted. Tests should be~r~m with hot fuel assemblies cooled by water -at the temperature and pressure of the containment and pressure vessel environments following the accident and at heat fluxes correspond- ing to the newer BWR fuel designs. 5.4 Flooding or Immersion Cooliflg The pressurized- and boiling-water reactors are cooled by a rising flood of water as an emergency coolant. The. flooding systems are useful because they provide a uniform distribution of coolant. Current work at Phillips Petroleum Company at Idaho Falls in the FLECHT and SECHT programs is investigating the cooling characteristics of such systems. This work should be extended to parallel channels at different temperatures to as- sure that hot-channel starvation of coolant does not occur in shrouded channels. The effects of boiling in open channels should be determine~4 at cladding temperatures above 2200°F, since this may alter the required liquid level in the pressure vessel for adequate cooling in the postblow- down situation. The use of the pressurized-water tanks on pressurized-water reactors is a practical solution to adding a large quantity of water to the core rapidly. The accumulators relieve the need of emergency core-cooling systems for almost-immediate pump power. These tanks should be desi~~ so that the pressurized gas~ from the accumulator does not drive the water from the core after the initial injection. Design efforts should cont~p~e on both FaRT s and BWR' a to decrease the response time of emergency core-cooling systems, since this may one day be the limiting factor on fuel specific power or on power density. 5.5 Structural Integrity of Core During He~~p Some reactors still use stainless steel cladding on control plates and followers inside the hot region of the core. Since stainless steel PAGENO="0083" 79 and Zircaloy react at temperatures below the melting point of stainless steel, this reaction should be ecolored to make certain it does not inter- fere with core cooling. 5.6 Structural Integrity of Vessel The time required1'2 in a large-rupture loss-of-coolant accident for fuel that is unquenched to melt through the reactor vessel and possibly breach the outer containment vessel has been estimated at 1/2 to 1 hr. Therefore, a design and experimental effort should be initiated to arrive at a method of containing or stopping a vessel melt-through before the containment is breached in the event of the worst case of an inoperative emergency cooling system. 5.7 General Performance and Standards The current reactor emergency core-cooling systems that reflood part of the core within 30 sec after a major break or which start adding cool- ant by spray distribution before the blowdown is complete appear capable of quenching the core and preventing a thermal runaway accident in which the core night melt down and penetrate the reactor vessel and containment shell. The emergency cooling system is an engineered safety feature of prime importance under some accident conditions in protecting the contain- nent shell and controlling the radioactivity release from the fuel. Suf- ficient data should be obtained with heated Zircaloy-clad uranium dioxide fuel rods and water-steam mixtures to establish the physical phenomena that occur at temperature levels between 2000°F and the melting point of Zircaloy. Si~ificant cladding swelling and cracking occur at tempera- tures from 1200 and 1SOO°F in all water-cooled reactors. The effect of these failures, if any, on flow channel blockage or flow distribution is not known. Rapid activation of the emergency cooling system and long-term opera- tion are the most urgent requirements in the event of a large-~cale pri- nary cooling system break. Therefore a continuing effort should be made to develop more rapidly acting systems with even better reliability than PAGENO="0084" 80 systems currently being designed. To this end, systens tests that deter- mine the effectiveness of the hardware acting in concert should be p~ formed in environments designed to simulate an accident situation. There is no other certain demonstration of adequacy. These tests should be performed on a prototype of large scale. The revised LOFT programs21 ~y satis~ this need. The ability to predict system performance analy~ cally could demonstrate an adequate level of understanding~ Consideration of the improbable accidents (sabotage, earthquakes, falling airplanes, etc.) and the potential plant damage requires complete redundancy and pro- tection of cooling systems in order to assure a working coolant-injection system in all circumstances. Finally, the emergency provisions for a loss-of-coolant accident should be examined to determine that the provisions themselves do not create hazards. Specifically, the BWR automatic-relief system and the gas in the F~R water storage tanks could both wors~ the situation by ejecting coolant from the core needlessly under certain circumstances. 5.~ ~ystem Tests The accidents discussed in this report all lead to temperature, pres- sure, and humidity environments far different than those normally prevail- ing. Tests on the emergency cooling equipment for each reactor should be perforrre~~ed to supply assurance that hardware meets appropriate specifi- cations and can survive and perform in accident situations and the result- ing environments. Separate tests to (1) demonstratq hardware reliability and (2) system effectiveness may be sufficient. These are different from the prototype tests. Maintenance and retesting of the emergency cooling system hardware, including power supplies,~__uld~~r0ut].fle and sufficiently frequent to assure availability on demand.57 Results of tests of emergency cooling systems for operating reactors show that emergency power supply avail- ability can be irrrprovedby more thorough preventive naintenance~18 Frequent and routine tests of the availability of emergency equip- ment, such as are proposed in the preliminary design reports, shou3~4~ carried out. The results of ;these tests should supply data that~~~ PAGENO="0085" 81 demonstrate the availability of equipment and the reliability to perform as designed by comparison with data obtained from the protot~e tests proposed in Section 5.7. 5.9 Design Irriorovements Efforts to improve the emergency cooling systems should be continued by design studies for reactors with higher specific power and flatter power distribution. Emergency cooling systems are designed to control the thermal and radioactive energy release from the fuel, limit the damage to the reactor complex, including the containment shells, and thereby help protect the public from gross exposure to radioactivity in the event of a primary coolant rupture and loss of power. The reactor operating variables of fuel specific power, plant thermal output, and to a lesser extent fuel burnup strongly influence economics as well as the emergency coolir.g system design requirements. The factors that improve economics also increase the demand on the cooling system pumps and power supply through increased demands on the time-to-startup margin and flow rates. The design studies would clari~ specific future needs for the nuclear industry and the AEC. The trend toward power flattening within the core of the next gen- eration of water-cooled reactors requires more detailed knowledge of the water-steam-Zircaloy interaction to assess the details of the loss-of- coolant accident. An effort should be started soon to estimate the re- lationship between the power distribution within a large core, the maxi- mum design cladding temperature in the postaccident situation, and the emergency cooling system design requirements in order to assess accurately the adequacy of the no-cladding-melting criteria or other criteria that may be suggested. 5.10 Priorities All the items dicussed above are of prime importance in assessing the safety of a reactor plant. In establishing priorities among the ite~ for effort it is clear that those items that relate to future-generation plants or to plant maintenance may be given a lower priority than cther items. Hoyever, all the questions should be answered before the newer ~ have oDerated any appreciable time. No actu~ priorities may therefore be stated. PAGENO="0086" 82 Mr. MCCORMACK. Thank you, Dr. Kepford. I want to remind the members that we are going to observe the 5-minute rule. I shall try to observe it as well as anyone, and ask all other members to do so, too. I would like to direct my first question to Dr. Levenson, and to ask him-you said we have been unable to identify any new phe- nomena uncovered by the accident. Would that include the produc- tion of hydrogen in the reactor vessel itself? Dr. LEVENSON. Yes; I think that is correct. The matter of the temperatures at which zironium or its alloys, such as zircoloy, react with water to produce hydrogen is a well-established phenom- enon. The rates of reaction and the actual temperatures have been measured in the laboratories many times. The basic design of emer- gency core cooling systems is to keep zironium metal below the temperature at which such a metal-water reaction occurs. If you exceed that temperature, the reaction will occur. It is not a new phenomenon. Mr. MCCORMACK. Dr. Dietrich, I believe it was you who men- tioned the necessity to be able to remove inert gases from the reactor. Would this be easily accomplished with existing power- plants? When they go down, could this be handled, to provide some method for venting reactors? Dr. DIETRICH. I think it would be a fairly straightforward engi- neering job to do this, if one were interested only in the venting. But as I mentioned in my testimony, one has to give careful consid- eration to such changes. For example, it is another path for radio- activity to come from the primary system into the containment building. It is also another potential leakage path. Mr. MCCORMACK. What you are saying is it could be done? Dr. DIETRICH. Absolutely, and it will be done, but I am only saying that we should not go out and say, OK, we are going to do it today, without giving it careful consideration and looking at the design-- Mr. MCCORMACK. Any exhaust system would have to provide for the removal of fission product gases, traps, and scrubbers and so on. Dr. DIETRICH. Right. Mr. MCCORMACK. You also mentioned on page 2: To make less difficult demands on the operator and to be more forgiving of operator errors through minimization of the frequency of occurrence and speed of development of operation of pertUrbations with potential for hazard. Are you sUggesting that we should be building C-47's instead of P-51's here? In other words, are you saying that the plants are too hot to handle; that is, in the sense of being too hypersensitive to transients, and too fast for the operators to respond? Dr. DIETRICH. No. But I think there are things that can be done. For example, I think the fact that the pressurizer appeared to be going solid, as they say, had a great deal to do with the Three Mile Island accident. Maybe we need a somewhat larger pressurizer, so its volume is larger relative to the capacity of the primary system, so that it is not quite so sensitive. Or maybe we need a bigger inventory of PAGENO="0087" 83 water in the secondary system, so that if the feed pumps go off, one is not immediately faced with the steam generators going dry. Mr. MCCORMACK. OK. Very quickly-- Dr. DIETRICH. It is engineering I am talking about. Mr. MCCORMACK. Let me ask you a couple of quick questions.. It would be relatively simple, wouldn't it, to install valve indica- tors on critical valves to tell what the valve is doing, as well as what it should be doing? Dr. DIETRICH. I believe it would be relatively simple in principle. To actually go into the plant and do it would certainly take some time. Mr. MCCORMACK~ Would it be your belief that we should go back and look at the design of some of the valves we have been taking from the shelf, and been using, such as pressure release valves, and explore their design, so that they could be made much more reli- able? Dr. DIETRICH. It is possible. I don't consider myself an expert on valves, but some of the things that we do in the name of safety perhaps haven't been as well thought through as they might be. For example, now, the valve that stuck was the relief valve, whose purpose is really to keep the safety valve from opening. Since the safety valves are put on there, it is always a possibility that-- Mr. MCCORMACK. But the release valve didn't close when it should. Dr. DIETRICH. That is right. What I am saying is if the safety valve sticks open, there is no way to turn it off. There is no block valve. You are not allowed to put a block valve in because of the pressure codes. Mr. MCCORMACK. Wouldn't design and procedures allow you to have a control on the control panel that said open the valve, the valve is open, close the valve, the valve is closed? Dr. DIETRICH. Oh, yes. Mr. MCCORMACK. OK. I don't have any more time. I have some more questions later on. Mr. Goldwater? Mr. GOLDWATER. Mr. Dietrich, I wonder if you could elaborate on a statement you made in your testimony, and I would be interested in Dr. Kepford's analysis of that elaboration. It is on the first page. You say, "While the specific accident sequence was unforeseen, the engineered safeguards used were successful in protecting the public." Dr. DIETRICH. Yes. Mr. GOLDWATER. What do you mean by that? Dr. DIETRICH. Well, very little radiation got out. One of the safeguards is the containment building. If you hadn't had that building there, you would really have been in bad shape. Eventual- ly they did use the safety injection pumps to put water into the reactor. They are part of the engineered safeguards, also. If they had not been there, or if they had failed to operate, you couldn't have recovered from the accident. These are the sorts of things I mean. The equipment was there. When it was turned on it worked. PAGENO="0088" 84 Mr. GOLDWATER. Dr. Kepford, your allegation is that nothing worked. Dr. KEPFORD. No; I didn't say that at all. I think probably much of the equipment worked as well as could be expected considering the designs and layout of the control room, and so on. With regard to radioactive releases, from what I have been told by officials in State government, dozens of curies of radioactive iodine-131 were released, and millions of curies of noble gases. This was a very major release of radioactivity. It was, I am sad to say, largely unmonitored. The largest releases of radiation went unnoticed. At 7:30 Wednesday morning-the director of the Bureau of Radi- ological Health for the Commonwealth of Pennsylvania, Mr. Thomas Gerusky, told a public meeting in Newberrytown, Pa., a couple of weeks ago-the projected dose rate in Goldsboro was 10 roentgens per hour. Now, the wind was heading right toward Goldsboro, from the plant. It is a very small town, a few hundred people, due west of Three Mile Island. Whether or not that dose ever got there, I don't know, but it certainly doesn't show up in any of the calculations or estimations of doses which have been released. There was the release of gases March 30, Friday morning, headed off in the direction of Hershey, Pa. The dose rates were on the order of 100 millirems per hour projected. But again, the .monitoring was so bad that nobody was available to find out. When you look, for instance, between Three Mile Island unit 2 and that compass sector which includes Lancaster, Pa., one of the nearest large population centers, there wasn't a single radiation monitor, and so on. So when people come by and say nobody was hurt from this accident and nobody was injured and the population exposures were very low, I think they are doing one of two things. They are either being very dishonest or they are relying on hopelessly in- competent monitoring. I don't think there is much of an excuse for either. Mr. GOLDWATER. Dr. Levenson, as chairman of the Ad Hoc Indus- try Advisory Group that looked at this accident, do you have any comments? Dr. LEVENSON. Our role did not include the health and safety monitoring, but I would comment in the context of Dr. Kepford's original statement that what is calculated is perhaps less reliable than what is experimental. There were a lot of calculations made on projected doses, assum-~ ing both a level of release and a level of catastrophe that never occurred. We were directly involved only to the extent of monitor- ing at the site and close in to the plant as it affected the recovery operations. Since nothing within orders of magnitude of this level was pres- ent at the plantsite, it is difficult to see how it could have been present miles away. Regarding the question of what is adequate monitoring, with hindsight, like with most things, you never have enough data. But I think that in the data that exists, which came from multiple groups-there was not just one group doing monitoring-there is PAGENO="0089" 85 indeed a very large discrepancy between what has been measured and what some people projected there might be. But this is not my field. Mr. MCCORMACK. Mr. Goldwater's time is up. It is Mr. Lujan's turn. Mr. DORNAN. I wanted to ask a question out of sequence. I have some gasoline shortage experts in my office. We have two crises on each coast. But this is much more serious. I wanted to ask a followup question of Dr. Levenson, with a slight prolog. Those of us who believe in nuclear energy, if we ever underesti- mate the impact on the public of the statements of Mr. Tom Hayden, his wife Jane Fonda, or the Dick Cavetts of the world, the Ralph Naders, we are making a big, big mistake to underestimate the impact they are having on the people. Last night on television, on the Cavett show, Ralph Nader said he was just a little shocked about the timing of the Three Mile Island, that it was inevitable, that he expected a major accident to come closer to the year 2000. But that given the inevitability of the growth of nuclear plants and the numbers involved, that it is just a matter of time and that he thinks the Three Mile Island incident is just that, an incident, and the major castastrophe is just to come. The compelling part of his argument to the average American is there has not been a technological development anywhere where there has not been a catastrophe. For instance, the British Cunard lines built the unsinkable Titanic, and it goes down on its maiden voyage. As a pilot, when I first saw the 747's, DC-10's, and lOll's take to the air, I thought, I wonder if we really have safety systems built in in such a way that there will never be an accident. But a Lockheed 1011 flies into the ground outside of Miami-pilot error. A DC-b loses a door off the rear over France, with a loss of life of over 340 people. Finally, a 747-I am not talking about terror- ists, deliberate destruction-but a 747 crashes in Africa, killing a massive amount of people. Now, Dr. Levenson, in the area of probability, if we weather this storm and nuclear plants continue to grow-and I am supporting them at this point-is Ralph Nader predicting, within the realm of probability, correctly when he says there eventually will be, just by the law of averages, a serious meltdown and a great loss of life? This is disregarding the gentleman's figures on page 12, Dr. Kepford, that he believes hundreds, maybe thousands, will die already because of Three Mile Island. Could you please project your thinking into the future, on the law of probability? Dr. LEVENSON. Well, I am not an expert on the law of probabil- ity, and even less of an expert on public opinion, and how it is influenced. Fairly clearly it is not influenced by technical facts very much. The matter of the type of accident and its consequences is basi- cally about what we are talking. Incidentally, I disagree with Mr. Nader. Three Mile Island was not merely an incident, it was an accident. Anybody trying to say it wasn't an accident is playing games with words. PAGENO="0090" 86 It was an accident, and it was a pretty serious accident. It was not catastrophic to public health. Most of the catastrophic acci- dents are invented by computers. They are not the result of any experimental or factual evidence. As early as 1953, back in the early days of the AEC, reactors were pushed to destruction in Idaho; in the so-called Borax experi- ments, where reactors were actually destroyed to get evidence about what happens. We have a very large amount of evidence from, reactor melt- downs. The first breeder reactor in this country, EBR-1, had a meltdown that destroyed two-thirds of its core. The SL-1, the first military so-called hotrod type of reactor, that resulted in the death of three men represented a destruction by meltdown and vaporiza- tion of a significant fraction of the core. There was also the Fermi reactor. A large number of military accidents have occurred, including bombers, which were carrying plutonium warheads which crashed, where the plane went up in fire and everything else with it. There have been many classified experiments in Nevada in the weapons program. A very large discrepancy exists between the theoretical projections of catastrophe and what the experimental evidence indicates. The probability is such that eventually there will be more acci- dents and that some will be more serious than Three Mile Island. You must compare, from the total public risk standpoint, the number of people killed by various sources of generating electric- ity. It must be on this basis-you cannot say if nuclear power kills 100 people once every 5 years, we don't want it, if the alternatives kill 10 times that many people. It is comparative risk analysis that is conspicuously absent in the statements that you have quoted. There probably will never be an accident absolutely identical to Three Mile Island. Probably there will be some similar accidents, and there probably will be some even more severe. I just don't think there will be any that we could truly call a major catastrophe. If you want to use your analogy of aircraft, we have yet to worry about either a DC-10 or a 747 reaching escape velocity and taking its passengers out into deep space. Equally improbable questions are being asked about nuclear power. Mr. MCCORMACK. Will the gentleman yield? I think there is one portion of the question and answer that needs just one additional bit of clarification. I would like to ask Mr. Levenson to answer it; that is, it is not necessary that anyone be harmed in the event of a meltdown. One could have a meltdown without harming anybody, even inside a plant. You can have a complete meltdown and no one will be harmed inside a plant, is that correct? Dr. LEVENSON. That is correct. We have already had a number of experimental and accidental meltdowns. The function of the con- tainment building and all of the auxiliary systems that are in it is to handle such meltdowns-the recombiners dispose of hydrogen if it is generated, et cetera. PAGENO="0091" 87 There isn't any indication from factual experience that even a meltdown automatically leads to the catastrophic consequences that is talked about. Mr. MCCORMACK. Thank you. Now, did the gentleman from New Mexico wish to yield any more time to the gentleman from California? Mr. GOLDWATER. I will yield the full 5 minutes to the gentleman from New Mexico. Mr. LUJAN. I thank the gentleman. I don't think I need 5 min- utes. Looking over all of the testimony, it seems to indicate, except for Dr. Kepford's, that we ought to concentrate on stopping the small accidents, and that if we do that, that the big accidents will take care of themselves. Maybe not quite as simple as that, but that the priority ought to be on those small accidents. Would you care to enlarge on that? Have I gathered at least the feeling of what the testimony was about? Any of you? Mr. KENNEDY. The answer to your question is yes. The large accident has been pretty thoroughly studied. I personally believe that if one builds a reliable powerplant, it will also be a safe powerplant. That doesn't mean the thing should be ignored, but we spend a tremendous amount of time on the very large accident and not enough on the reliability. Mr. LUJAN. The sequence of events at Three Mile Island shows that within 3 hours, at a time somewhere about 2¾ hours, some- thing like that, there were some 50 or. 60 people running around inside the control room. It leads one to believe that there was just utter confusion in that control room. Maybe my interpretation of it is a little exaggerated, but if that were the case-I have been in that control room-there were just about a dozen of us there at the time, and it certainly was crowded. Because accidents happen with some frequency, is there any group, like a SWAT team of some kind, some group that is put together from laboratories, from industry, from wherever it may be, that can come in, a~d take control of a dangerous situation, and bring it under control? Is there anything like that? If there isn't, should there be some- thing like police SWAT teams to respond to those situations? Dr. DIETRICH. I can say that as far. as my company is concerned we have set up teams of this sort since Three Mile Island. So we have taken action on something we learned. But of course there is no way that we can set it up to use people other than our own. But they are very knowledgeable people. These teams include people who have been our representatives during startup of plants and that sort of thing. So that they are not by any means just theoretical people. They are people who know how to press the buttons and work the valves. Mr. LUJAN. These are trained only in your type of reactors. In other words, they would have no knowledge about reactors de- signed and built by somebody else. Dr. DIETRICH. I think they would be helpful, but of course it would probably be more effective if each manufacturer-- PAGENO="0092" 88 Mr. LUJAN. How would each company feel separately about standardization? It just seems to me-I am not an engineer-that if we had standardized design and construction of plants, that it would make it so much easier. Now, would you submit to a group type of design and construc- tion, or do you think yours is that much better, that maybe you wouldn't want to be dropped into a standardized group? Dr. DIETRICH. Well, I am not really sure how one might imple- ment such a thing. Mr. LUJAN. You design a powerplant, you say this is really the way a powerplant ought to be, this is the standard model, it will have all of the things that you have been talking about, it is earthquake resistant, the valves are good, the pumps are good, all of the different components are good. Therefore, this is the plant that we would build. All we have to do is the foundations, build them up. Dr. DIETRICH. I think that is essentially what I was speaking of in the program that we were recommending. But I did not say to come up with a single design. Mr. LUJAN. Why not? Dr. DIETRICH. Because I just don't know how to do it. I mean, I don't know how to implement it. Now, I am not saying there is not a way of doing it. It is just not my field. It would get pretty complicated on things like antitrust. Mr. LUJAN. On the contrary, it seems to me-even though my time is up-that on the contrary, it would make it so much easier. Here is my powerplant, you go to the NRC, they say, yes, we know all about this plant, and they give you a license. Dr. DIETRICH. I cannot really speak for my company. I would guess my company would certainly participate in such a thing, if there were such a thing. Mr. MCCORMACK. I thank the gentleman from New Mexico. The gentleman from Pennsylvania, Mr. Walker. Mr. WALKER. Thank you, Mr. Chairman. I have questions of a couple of people. So I hope maybe they can be as brief as possible with their answers. Mr. Levenson, in your testimony, I kind of read between the lines that you are saying that perhaps the regulators and the regulated have gotten a little too cozy on this business of watchful- ness over plant design and public safety. Is that a fair assumption that I have drawn from what you had to say? Dr. LEVENSON. No; I don't think there is a coziness at all. What ~I am saying is that the people applying for licenses are reacting to the pressures from the regulators, and that if everybody is preoccu- pied with the wrong thing, it doesn't matter how cozy or how antagonistic they are, you don't address the really significant questions. Mr. WALKER. When you took a look at the situation at Three Mile Island, did it occur to you that perhaps there was kind of cozy relationship, in the initial licensing procedure, the initial proce- dure that brought it on line, to come in under the December 31 date for licensing? PAGENO="0093" 89 Dr. LEVENSON. I have reviewed none of the records and none of the proceedings or testimony for the licensing, so I cannot com- ment on that. Mr. WALKER. OK. You make a statement here in your remarks that the confirma- tory message of Three Mile Island is that we must go back and assure ourselves that we are doing everything that is practicable to reduce the risk to the public and to the plant. I am particularly interested in the public. What is the nuclear industry doing now that Met Ed wants to dump that radioactive waste water into the Susquehanna River? Wouldn't it be wise for the industry to be coming down on the side of doing their very best to protect the public in this aftermath of Three Mile Island? Dr. LEVENSON. I am not aware of any proposal to dump radioac- tive water into the river. I think there is a proposal that after the water has been decontaminated, that the cleaned up water be dumped into the river. That is quite different than dumping the radioactive water. Mr. WALKER. It will still have low levels of radioactivity in it, wouldn't it? Dr. LEVENSON. Everything in the world is radioactive. I have been involved in many cases where the problems were that radioac- tivity in river water that we pumped out for cooling water was greater than the allowable standards to put it back into the river. One has to ask how radioactive, what are the standards. I don't know of any request for an exemption from what are considered acceptable standards. Mr. WALKER. I say to you that the public up there is extremely concerned about dumping that water, and whether or not it meets specific tests and so on. I think the industry, if they are really concerned about the risk to the public over the long term, ought to look into that. Dr. Kepford, I would like to follow up on a couple of statements you made as well. You made the statement that you felt that the NRC lied along the way on this. Do you include Dr. Denton's statements in the fact that NRC was lying to the people of the area? Dr. KEPFORD. I don't know which particular statements you are referring to. Mr. WALKER. Well, in general I think the public accepted much of what Dr. Denton had to say. Was he lying along the way? Dr. KEPFORD. I don't believe so. Mr. WALKER. OK. Fine. You are making the point that the monitoring of the radiatiOn was not very good. Dr. KEPFORD. It was abominable. Mr. WALKER. I think you said radiation monitors only went out 13 miles. Dr. KEPF0RD. The NRC's only went out 13.8 miles, that is correct. Mr. WALKER. I am a little bit confused, then. The studies on which all the calculations have been made on sites that go out as far as Reading, which is considerably further out than 13 miles. PAGENO="0094" 90 Now, all of the studies, all the health effects are out at least that far, Reading, Carlisle, all of the areas had dosimetry monitoring in them. Are you saying that-- Dr. KEPFORD. They are not mentioned in the reports that I have seen. Mr. WALKER. They are part of the health effects study. That is the NRC study-which says that only one or two people will die as a result-of TMI. Those were the dosimetry sites that they used. That is in direct contrast to your statement here that hundreds and thousands are going to die. I mean, these are my neighbors we are talking about. Dr. KEPF0RD. I am aware~ of that.~ This is the report that I am talking about. You can have it if you. want. But measured radiation readings, elevated readings in Reading are not mentioned. Mr. WALKER. I am talking about the Population Dose and Health Impact of the Accident at Three Mile Island nuclear station. Dr. KEPFORD. May 10? Mr. WALKER. Yes. The dosimetry sites in there include Lebanon, Reading, Lancaster, Harrisburg, Carlisle, York, and so on, most of which are further out than 13 miles. Dr. KEPFORD. Where are you reading this? Mr. WALKER. I am back on page 20, where I have the location of the dosimetry sites. It is my understanding that all of those sites were used as a part of the data base. Dr. KEPF0RD. On that map, the only sites that have dosimeters on, for instance, near Harrisburg, 15-G-1, is a dosimeter site. There is one south toward Lancaster, but only about 14 miles from the plant. That is 7-G--1. Closer in is 7-F--i. South of York is 9-G- 1. I think those are the only dosimeter sites there. Mr. WALKER. I was under the impression that the sites also marked at Reading, Lancaster, and so on are also dosimeter sites. Dr. KEPFORD. I am sorry. I was unaware of that. Mr. WALKER. That is my impression. I will have to go back and check it. That was my impression of the data. Dr. KEPFORD. The data in here that I have looked at has only been the NRC data. The Met Ed data has been too scattered for me to do anything with. But in a lot of directions, as you go away from that plant, the dose does not fall off with distance. In fact, in some cases it in- creases with distance. This, in my mind, tells me that neither NRC nor Met Ed had the slightest understanding of what the weather conditions were like, first off, in the lower Susquehanna River valley and secondly in that first week of the accident; that is, there was a relatively static air mass over that area, and the radioactive materials that were released simply did not normally form a plume and dissipate and blow over to somewhere else like they normally do. They were held down by a temperature inversion and slid up and down the Susquehanna River, and off into the surrounding commu- nities. Mr. WALKER. I was out and did a little bit of the monitoring with them when I was on the site. I know they went down river with portable monitors a good deal further than what would be indicat- PAGENO="0095" 91 ed as close in monitoring because I was along when they were doing some of that. I assume some of that data got in. If I could, Mr. Chairman, just one last question. The thing that disturbs me is that you use the figure hundreds and maybe thousands, that you believe are going to die. Those are the kinds of things that make good print in newspaper articles and so on, those kinds of figures. Yet you are, it seems to me, a little bit guilty of the same thing you are accusing the industry of being. You say you can't quantify the number. Yet you come back and say the main problem with the industry is the fact that the industry doesn't have exact experi- ments to show what is going to happen. When you use figures, it seems to me you are using them for political kinds of purposes. Dr. KEPFORD. This again, Congressman Walker, was another ex- periment that was carried out on human beings, where nobody was around to collect the data. It is not my responsibility to collect the data. The NRC and Met Ed and those responsible are supposed to be doing that. What I was saying was that their treatment of the data in my opinion, the NRC data, is dishonest. That is what I am saying. I did a very quick estimation. It could be high, it could be low by a factor of two on the person rem exposure. In here they quote 3,500. I came up with 57,000. That is quite a difference. That suggests to me that the data was simply handled wrong. I would be very glad to go over this with you in person, or go over it here, what I did with the data. Mr. WALKER. But the fact remains that your testimony says, "I cannot quantify the number exactly, but I have reason to believe that the number may be in the hundreds or in the thousands." What I am saying to you is that is exactly the same thing that-- Dr. KEPFORD. Can I go on. This is based partly on the statement of others, including none other than Karl Z. Morgan, who is well known, I am sure, to members of this committee, who stated at the Village Voice teach-in a week ago Saturday that he believed some- where between 60 and 120 people, I believe, would die from this accident. Mr. MCCORMACK. I think we are going to have to terminate this part of the testimony here, Dr. Kepford. Our time is up on it. We are going to have to get on to the next panel because we have to adjourn by 12:00. I am sure that the witnesses will be willing to answer further questions in writing for many of the members of the committee. I want to thank them. I do think there is one thing to be pointed out here; that is- Congressman Walker would be particularly interested in this, and I don't know whether you have done this calculation-based on the cancer deaths in this country, the normal cancer rates, of the 800,000 cancer deaths in this area around Pennsylvania from normal causes; that is, there are 400,000 cancer deaths in this PAGENO="0096" 92 country per year today, and over the next 20 years there will be 8 million cancer deaths in this country. Of that-I beg your pardon. There will be 80,000 cancer deaths in that same population, in the next 20 years. If the NRC report is correct, if it is correct that the average individual dose they quote is 1.5 millirems, then from background it would be 100 times that much. From normal background, and whatever cancer deaths are suggested from the accident, if the NRC figure is correct, then the deaths from background would be 100 times, during this same period, for any one year. Mr. WALKER. I thank the chairman for that. I think one of the worries of the community up there is how much we are beginning to build up when we start dumping the waste water into the Susquehanna, and how much you build on top of that. It is one of the real concerns. Mr. MCCORMACK. I think the concern the gentleman has is very well taken. I think it is a question that we should address to the NRC tomorrow, whether the radiation level of the water released, proposed to be released at Three Mile Island is above or below background, and if so, how much, so we can get some feel for that. That would help you and your constituents. I want to thank the gentleman of the panel very much for appearing today. You are very kind. We have one more panel at this time. The next witnesses are Mr. Saul Levine, Director of the Office of Nuclear Regulatory Reserch for the Nuclear Regulatory Commission, and Dr. Harold Lewis, professor of physics for the University of California. These witnesses can provide us with exceptionally valuable testi- mony. Dr. Lewis, do you want to come up and join us at this time. We welcome you. STATEMENT OF SAUL LEVINE, DIRECTOR, OFFICE OF NUCLE- AR REGULATORY RESEARCH, NUCLEAR REGULATORY COM- MISSION Mr. MCCORMACK. By way of background, and for a better under- standing by the members of the committee, Dr. Levine was very active in the preparation of what is known as the Rasmussen report, WASH-1400, in which an attempt was made to quantify the potential for nuclear accidents involving deaths of indviduals. Dr. Harold Lewis headed up a group that provided some ex- tremely responsible, constructive criticism, at a later date, of the Rasmussen report. Unfortunately, the press seriously distorted the intent of the Lewis review of the Rasmussen report and took advantage of what was perhaps some unfortunate language in the statement of the Nuclear Regulatory Commission in evaluating and accepting the Lewis report. In the press, it appeared that NRC was rejecting the Rasmussen report and as if the Lewis study constituted total rejec- tion of the Rasmussen report. All those involved know this was not the case, but it is important today for the general background of the Members of Congress to help bring this point out, and to help give us some perspective with respect to the safety design philosophy of nuclear powerplants, and PAGENO="0097" 93 the implications of the Three Mile Island accident with respect to nuclear safety in general. Then in addition to that, Dr. Lewis will be testifying on the general safety and statistical analysis of the hazards associated with nuclear powerplants and his report that he made previously. So we are looking forward to this testimony. First of all, the statements of both you gentlemen will without objection be insert- ed in the record in their entirety and you gentlemen may proceed as you wish. Mr. Levine, would you care to go first? Mr. LEVINE. Thank you, sir. I have a brief, oral statement to make, Mr. Chairman, which I hope will be adequate for your purposes. I will cover three subjects, sir-the safety design philosophy for nuclear powerplants, the rela- tionship between the Three Mile Island accident and the reactor safety study and the lessons we have learned from Three Mile Island about additional research needed on the safety of nuclear powerplants. First, nuclear powerplant safety design philosophy. In approaching the safety design for nuclear powerplants, the NRC recognizes that these plants present some potential for acci- dents that can have large consequences. Because of this, we also recognize the need for a comprehensive regulatory process to help insure that no undue risk to the health and safety of the public will arise from their operation. This process involves a well-developed safety design approach, the specification of safety design requirements to implement that approach, and an extensive safety review and licensing process to ensure that plants meet established safety requirements. A key element behind these requirements and procedures is a recognition of the need for redundancy not only in the elements of plant design but also in the review process. The need for redundancy derives from the understanding that in spite of man's best efforts to achieve high quality in design, con- struction, and operation of nuclear powerplants, these goals cannot be achieved; that is to say, no body of knowledge can ever be complete enough to reduce uncertainties and risks to zero. The safety design~ approach used by the NRC emphasizes defense in depth. In nuclear powerplants, a series of physical barriers is constructed between the large amounts of radioactivity contained in the nuclear fuel and the environment. Since it is known that some types of failures in one of these barriers can also cause failure of the other barriers, there are two other important factors involved in the implementation of the defense-in-depth approach. These are, first, the specification of requirements to achieve high quality in the design, construction, and operation of nuclear power- plants to reduce the likelihood of failures that could potentially cause accidents; and second, the use of engineered safety systems, with redundancy when needed, to prevent failures from progress- ing into accidents. These requirements are outlined in NRC regulations, standards and safety guides which are based on sound engineering practices established over the past 20 years, and which are undergoing con- 48-721 0 - 79 - 7 PAGENO="0098" 94 tinuing improvement~ The NRC also sponsors a comprehensive re- search program to provide the technical bases for the confirmation of NRC's safety decisions and for. needed improvements. In summary, 1 believe that while nuclear powerplants, or any other of man's technological endeavors, cannot achieve risk free operation, the current system has provided a sound basis to ensure that nuclear powerplants present no undue risk to the health and safety of the public. Of course, we have learned lessons from Three Mile Island, and have to do some work, which 1 will come to later in my testimony. I would like to say a few words about the Three Mile Island accident and its relationship to the reactor safety study, WASH- 1400. The comments I will make here should be regarded as pre- liminary because although we understand the basic elements of the TMI event, there are many details yet to be filled in. From the viewpont of nuclear powerplant safety design, two principal technical elements are involved in TMI. The most impor- tant is that the plant was configured so that the pressure relief valve on the primary coolant system opened very often due to events such as a failure of normal feedwater flow to the reactor. An important matter in TMI and similar plants is to reduce the frequency of opening relief valves since, if the valves do not open, they cannot stick open and cause a small loss-of-coolant accident (LOCA), as apparently happened at TMI. This has been addressed in the bulletins issued by the NRC which require such actions as the installation of anticipatory signals that would result in earlier plant shutdown, raising the pressure setting at which the relief valve would open, and reducing the pressure at which the reactor is signaled to shutdown. These changes should, in principle, signifi- cantly reduce the likelihood of the valve opening. The second area relates to the reliability of the auxiliary feed- water system. The question of interest is whether the RSS correctly predicted the chance of failure of the auxiliary feedwater system to operate when needed. Certainly the RSS identified that the system could be failed because the output valves of the system would be incorrectly left closed after maintenance, as was done at TMI. The incident at TMI does not give us data as a failure point, because the system did perform its intended function although only after 8 minutes into the accident. However, it was a precursor to possible failure and this suggests that we will have to go back and reexamine the RSS predicted failure likelihood for this system to see if changes are needed. The TMI accident has also indicated areas requiring additional safety research information. While some of these requirements can be accommodated by re- programing and reorientation of ongoing efforts, we believe there will be a significant amount of new work that will require re- sources over and above those contained in our fiscal year 1980 budget request to the Congress. Therefore, we are currently preparing a proposed fiscal year 1980 supplemental budget request for review by our Commission. While I can indicate now the areas in which I believe research will be needed, I cannot go into great detail because we are still developing this information. However, I can indicate that our research needs PAGENO="0099" 95 are generally greater in the study of accidents which can lead to extreme core damage, but which would fall short of actual melting of the core. So far my examination of the TMI accident suggests that re- search is needed both to reduce the likelihood of events of this type and to obtain a better physical understanding of them. As I said earlier, additional resources will be needed to accomplish this work. The following topics need urgent attention: A. TRANSIENT AND SMALL LOCA EVENTS Ongoing research efforts must be accelerated to obtain engineer- ing data on behavior of the fuel, the release of fission products from the fuel, and the thermal hydraulic behavior of the core and primary coolant system during transient and small LOCA events. These data are required to accelerate develoment and testing of analytical models and computer codes needed to give more precise predictions of actual system performance. B. ENHANCED OPERATOR CAPABILITY The accident at Three Mile Island has also demonstrated the urgent need for system improvements to enhance in-plant accident responses. This area of research need was given high priority and addressed in some detail in the NRC's "Plan for Research to Im- prove the Safety of Light-Water Nuclear Power Plants" (NUREG- 0438), submitted to the Congress in April 1978. This work, which needs to be accelerated, includes improved data display and diag- nostic systems to assist the plant operator under accident condi- tions, additional in-vessel and plant instrumentation which will operate reliably under such conditions, enhanced data transmission capabilities to obtain outside assistance during emergencies, system interlocks to preclude plant operation unless all safety systems are in an operable condition, and development of improved require- ments for operator training simulators. C. PLANT RESPONSE UNDER ACCIDENT CONDITIONS Research is required to explore more fully the response of plant safety systems and components during accident conditions in order to understand better the physical processes that can occur so as to help preclude further system failures. Efforts in this area include a detailed understanding of the primary coolant chemistry following fuel failure, hydrogen evolution and behavior in the primary system and containment, and behavior of safety components of the plant, that is, reactor vessel pumps, valves, et cetera, under pro- longed accident environments. D. POSTMORTEM EXAMINATION AND PLANT RECOVERY It is apparent that significant postmortem examination of the TMI core, plant components and the containment will be very useful in obtaining necessary information on fuel behavior, fission product transport and plateout and component operability under prolonged accident environments. These examinations will also be necessary to help define plant recovery requirements and risks. PAGENO="0100" 96 The TMI core must be removed from the reactor vessel in a manner such that important configuration information is not lost. The core should then be shipped to appropriate hot cell facilities where it can be examined and analyzed extensively. These studies will provide significant data on coolability of damaged cores, fuel! clad/coolant interactions, and fuel chemistry under severe heatup conditions. I hope that the views I have expressed here today regarding the safety design philosophy for nuclear power plants and the Three Mile Island accident, including the lessons to be learned from TMI as they relate to our research needs, will be of value to the commit- tee in its considerations of these important issues. I believe signifi- cant regulatory actions are already underway to reduce the likeli- hood of such incidents significantly. For the longer term, I am sure that further improvements will also be effected. The research areas I have mentioned above should be started soon to provide the needed information. Thank you, Mr. Chairman. [The prepared statement of Saul Levine follows:] PAGENO="0101" 97 STATEMENT OF SAUL LEVINE, DIRECTOR OFFICE OF NUCLEAR REGULATORY RESEARCH, NRC BEFORE THE SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION May 22, 1979 Introduction Mr. Chairman, I am pleased to be here today to give you my views on the safety design philosophy for nuclear power plants, relationship between the Three Mile Island (TMI) accident and the Reactor Safety Study (RSS), and the lessons we have learned from the Three Mile Island event about additional research needed on the safety of nuclear power plants. While the Three Mile Island accident was indeed a highly regrettable event, it does give us an opportunity to learn some lessons needed to prevent instances of this type in the future and thus enhance the safety of nuclear power plants. Nuclear Power Plant Safety Design Philosophy In approaching the safety design for nuclear power plants, the NRC recognizes that these plants present some potential for accidents that can have large public consequences. Because of this, it also recognizes the need for a comprehensive regulatory process to help ensure that no undue risk to the health and safety of the public will arise from their operation. This process involves a well developed safety design approach, the specification of safety design requirements to implement that approach, and an extensive safety review and licensing process to ensure that plants meet established safety requirements. A key element behi~nd these requirements and procedures is a recognition of the need for redundancy PAGENO="0102" 98 not only in the elements of plant design but also in the review process. The need for redundancy derives from the understanding that, in spite of mans best efforts to achieve high quality in design, construction and operation of nuclear power plants, these goal,s cannot be completely achieved; that is to say, no body of knowledge can ever be complete enough to reduce uncertainties and risks to zero. NRC's regulatory process has relied and, will continue to rely on the judgment of highly skilled engineers and scientists as the principal basis for its safety decisions. While extensive strides have been made in the development of quantitative risk assessment techniques, and the careful use of such techniques can provide added engineering insights about the safety of nuclear power plants, they have so far been developed only to the point where they can provide a valuable supplement to the other methods and procedures now used by the NRC to form its safety judgments. The safety design approach used by the NRC emphasizes defense in depth. In nuclear power plants, a series of physical barriers is constructed between the large amounts of radioactivity contained in the nuclear fuel and the environment. The fuel is contained in a sealed metal cladding; the clad fuel is contained in a sealed, steel primary coolant system; and the primary coolant system is enclosed in a sealable containment building. Since it is known that some types of failures in one of these PAGENO="0103" 99. barriers can also cause failure of the other barriers, there are two other important factors involved in the `implementation of the defense in depth approach. These are, first, the specification of requirements to achieve high quality in the design, construction and operation of nuclear power plants to reduce the likelihood of failures that could potentially cause accidents; and, second, the use of engineered safety systems, with redundancy when needed, to prevent failures from progressing into accidents. These requirements are outlined in NRC regulations, standards and safety guides which are based on sound engi.neering practices established over the past'20 years, and which are undergoing continuing improvement. The NRC also sponsors a comprehensive research program to provide the technical bases for the confirmation of NRCs safety decisions and for needed improvements. The NRC's regulatory process for nuclear power plants consists of safety reviews by the staff of the Office of Nuclear Reactor Regulation and by the statutorily independent Advisory Committee on Reactor Safeguards. Public hearings of the results of the staff and ACRS reviews are held by an NRC Atomic Safety and Licensing Board. The results of these hearings can be appealled to an NRC Appeals Board and the Commission. Beyond this, appeals can also be made to the courts. These reviews are conducted twice--once before the construction of a plant is allowed to commence and again before operation of the plant is permitted. The reviews also include environmental as well as health and safety considerations. PAGENO="0104" 100 The NRC's Office of Inspection and Enforcement conducts inspections during construction of the plant to help ensure that the plant is being built in accordance with the safety design and quality requirements. Inspections are continued during the operating life of the plant to help ensure that the requirements of NRC's licenses are adequately enforced, that problems arising in operation are well handled, and valuable feedback from operating experiences is incorporated into the safety reviews of additional plants. Furthermore, NRC licenses require utilities to test important safety systems periodically and to report failures of all safety related equipment to the NRC. The results of NRC inspections and reports of equipment failures are routinely made public. In summary, I believe that, while nuclear power plants (or any other of man's technological endeavors) cannot achieve risk free operation, the current system has provided a sound basis to ensure that nuclear power plants present no undue risk to the health and safety of the public. THREE MILE ISLAND AND THE REACTOR SAFETY STUDY I would like to say a few words about the Three Mile Island (TMI) accident and its relationship to the Reactor Safety Study (WASH-l400) which is more commonly called the Rasmussen Report after Professor Norman C. Rasmussen of the Massachusetts Institute of Technology, who directed the PAGENO="0105" 101 work. The comments I will make here should be regarded as preliminary, because although we understand the basic elements of the TMI event, there are many details yet to be filled in. From the viewpoint of nuclear power plant safety design, two principal technical elements are involved in TMI. The most important is that the plant was configured so that the pressure relief valve on the primary coolant system opened very often due to events such as a failure of normal feedwater flow to the reactor. The second relates to the reliability of the auxiliary feedwater system which is needed to remove the heat from the reactor after it has been shut down. For the PWR studies in the Reactor Safety Study (RSS) as well as for most other PWRs, the primary coolant system pressure relief valve would not be expected to open in the event of failure of the normal feedwater system. The difference between those plants and TMI would be that they would automatically be shut down quickly when normal feedwater flow stopped, thus rapidly reducing the amount of heat that had to be dissipated and causing only a small rise in reactor system pressure. In the TMI accident the loss of normal feedwater, in and of itself, caused the relief valve to open very quickly (in 3 seconds). If this valve were to stick open, and valves of this type have about one chance in fifty of doing so, the plant would experience the equivalent of a small Loss of Coolant Accident (LOCA)*. This is what happened at the Three Mile Island plant. *Attachment 1 hereto contains a description of a Loss of Coolant Accident PAGENO="0106" 102' Thus, an important matter in TMI and similar plants is to reduce the frequency of opening relief valves since, if the valves do not open, they cannot stick open and cause a small LOCA. This has been addressed in the bulletins issued by the NRC which require such actions as the installation of anticipatory signals that would result in earlier plant shutdown, raising the pressure setting for opening of the relief valve and reducing the pressure at which the reactor is signalled to shutdown. These changes should, in principle, significantly reduce the likelihood of the valve opening. The second area relates to the reliability of the auxiliary feedwater system. As pointed out in the RSS, the lack of availability of both normal and auxiliary feedwater systems can lead to serious overheating and melting of the nuclear fuel. Although this type of sequence was one that contributed significantly to the accident risks predicted in the RSS, the auxiliary feedwater system analyzed in the RSS was found to be a highly reliable system. At TMI, the auxiliary feedwater did not fail permanently; it was out of operation for only the first 8 minutes of the accident, after which it functioned properly. Plant temperature data indicate that this did not affect the course of the accident significantly; and, although it may have served as a source of distraction to the plant operator, thesystem basically performed its design function. PAGENO="0107" 103 The question of interest is whether the RSS correctly predicted the chance of failure of the auxiliary feedwater system to operate when needed. Certainly the RSS identified that the system could be failed because the output valves of the system would be incorrectly left closed after maintenance, as was done at TMI. In most reactors, even if this were to happen, there would be 30 to 60 minutes available for the operator to correct the situation before any fuel damage would be expected to occur. The incident at TMI does not give us data as a failure point, because the system did perform its intended function. However, it was a precursor to possible failure and this suggests that we will have to go back and reexamine the RSS predicted failure likelihood for this system to see if changes are needed. I should also note here that we are now using the RSS techniques to review the auxiliary feedwater systems of all PWR reactors to determine if any upgrading will be needed. It is my belief that the safety engineering insights and techniques developed in the RSS can be used effectively to study the TMI accident to help determine improvements that may be needed in the safety of nuclear power plants. Such an approach is consistent with the recommendations of the Risk Assessment Review Group Report* and with the policies enunciated by our Commission. * "Risk Assessment Review Group Report" to the U.S. Nuclear Regulatory Commission (NUREG/CR-0400), commonly called the "Lewis Report" after its Chairman, Professor Harold W. Lewis, University of California, Santa Barbara; PAGENO="0108" 104 RESEARCH NEEDS The TMI accident has also indicated areas requiring additional safety research information. While some of these requirements can be acconinodated by reprogramming and reorientation of ongoing efforts, we believe there will be a significant amount of new work that will require resources over and above those contained in our FY 1980 budget request to the Congress. Therefore, we are currently preparing a proposed FY 1980 supplemental budget request for review by the Commission. While I can indicate now the areas in which I believe research will be needed, I cannot go into great detail because we are still developing this information. In general, the recent accident at the Three Mile Island Nuclear Plant can be thought of as emphasizing the need for additional safety research information in the area portrayed schematically in the figure below: Design Basis Accidents* i__I / / / / / / / / / /_j_ Accidents Leading to Extensive Core Damage Increasing Consequences /////i/////// Core Melt Accidents *Design basis accidents are defined in the first paragraph of Attachment 1. PAGENO="0109" 105 Design basis accidents (DBA's) have been studied extensively in NRC's licensing process. A prime example of a DBA is the large Loss-of-. Coolant Accident (LOCA). These analyses and supporting research are performed to ensure that plant safety equipment (emergency core cooling systems, etc.) have adequately defined safety margins to prevent significant fuel damage in the event of a DBA. While we have known for some time that more attention is required for small LOCA and transient events, the TMI accident clearly calls for much more urgent action than has so far been taken. Core melt accidents have been studied extensively in the RSS and ongoing research programs are continuing to better define the physical processes involved in molten fuel and plant materials, the release and transport of radionuclides from the reactor fuel and consequences to the public. Such investigations assign failure probabilities to various safety systems whose lack of operation would lead to core melting. Accidents involving extensi.ve core damage without significant fuel melting were not examined extensively in the RSS because they were not thought to have large public health consequences. The primary application of research about fuel melting to date has been in risk assessment studies which address both the probability and consequence of such accidents. The area which lies in between these two types of accidents has received less emphasis in both our research program and the licensing process. Such accidents, similar to TNT, can occur as a result of partial failure PAGENO="0110" 106 of various systems and may lead to extensive core damage, even without fuel melting. I use the term partial failure here to describe two situations at TMI. The first is the fact that a small LOCA occurred when the relief valve opened and failed to reseat. This was followed by the repeated closing and reopening of the block valve to the relief valve, thus, causing a series of intermittent small LOCA's. Also, I refer to the repeated turning on and off of the emergency core cooling system, as opposed to its either complete operability or complete failure. So far my examination of the TMI accident suggests that research is needed both to reduce the likelihood of events of this type and to obtain a better physical understanding of them. As I said earlier, additional resources will be needed to accomplish this work. The following topics need urgent attention: A. Transient and Small LOCA Events Ongoing research efforts must be accelerated to obtain engineering data of behavior of the fuel~, the release of fission products from the fuel, and the thermal hydraulic behavior of the core and primary coolant system during transient and small LOCA events. These data are required to accelerate development and testing of analytical models and computer codes needed to give more precise predictions of actual system performance. PAGENO="0111" 107 More specifically, current nonnuclear test facilities should be modified to obtain engineering data on the heat transfer and coolant flow conditions in the core and reactor primary system for both PWR and BWR transients and small LOCA's. Investigation of the cooling and behavior of fuel under natural circulation and transient conditions where the core may be uncovered would-also be performed. Small LOCA tests in the Loss-of-Fluid Test (LOFT) reactor should be accelerated to obtain data with a nuclear core and at larger scale than most of the nonnuclear tests. Investigations of the behavior of severely damaged fuel which may result from certain transient and small LOCA events should also be conducted. Flow tests of fuel assemblies which h-aye been allowed to boil dry should be performed to study coolability of damaged cores. Tests should also be conducted to determine the rate and nature of radioactive fission product release from damaged fuel, as well as the transport of these fission products in the reactor primary system and subsequent release to the reactor containment. The development of advanced computer codes to predict mor~ precisely the thermal hydraulic behavior of the core and primary coolant - system under transient conditions should be accelerated. These analytical codes, known as "best estimate" codes, are designed to predict with greater precision actual system performance under various transient and accident conditions, as contrasted to the "evaluation model" codes used in the licensing process which contain significant conserva- tive assumptions in order to put an upper bound on predictions of PAGENO="0112" 108 accident response. The data obtained from the system engineering tests and fuel behavior experiments will be used to upgrade the analytical models and test the prediction capability of the codes. These analytical codes can then be used to analyze a variety of transient and small LOCA events under various failure conditions in order to investigate aspects of plant system design and safety system operation which may require further regulatory attention. B. Enhanced Operator Capability The accident at Three Mile Island has also demonstrated the urgent need for system improvements to enhance in-plant accident responses. This area of research need was given high priority and addressed in some detail in the NRC's "Plan for Research to Improve the Safety of Light-Water Nuclear Power Plants" (NUREG-0438), submitted to the Congress in April 1978. This work, which needs to be accelerated, includes improved data display and diagnostic systems to assist the plant operator under accident conditions, additional in-vessel and plant instrumentation which will operate reliably under such conditions, enhanced data transmission capabilities to obtain outside assistance during emergencies, system interlocks to preclude plant operation unless all safety systems are in an operable condition, and development of improved requirements for operator training simulators. Research should be performed to define requirements for data display and diagnostic systems to better assist the operator under accident PAGENO="0113" 109 conditions. These display and diagnostic systems should also include the capability for outside organizations to provide assistance and advice to the plant under accident conditions. Studies should be performed to define the necessary data transmission and comunication requirements for this purpose. Improvements are needed in instrumentation to measure plant conditions such as valve position indicators and reactor vessel water level. Studies should be performed to define all instruments needed to assist plant operators in the diagnosis of accident conditions, and tests should be conducted to evaluate and improve reliability of such instrumentation under long term accident environments. Requirements should also be developed to improve the use of simulators in studying operator response to accident situations and for related training. Control room and plant protection system design requirements should also be studied to define improvements which will enhance accident response and reduce the likelihood that a plant can be operated when safety systems are not all operational. System interlocks which would preclude plant operation under certain conditions should be further defined; such as, unavailability of the auxiliary feedwater system. C. Plant Response Under Accident Conditions Research is required to explore more fully the response of plant safety systems and components during accident conditions in order 48-721 0 - 79 - 8 PAGENO="0114" 110 to understand better the physical processes that can occur so as to help preclude ~further system failures. Efforts in this area include a detailed understanding ofthe primary coolant chemistry following fuel failure, hydrogen evolution and behavior in the primary system and containment, and behavior of~safety components of the plant, i.e., reactor vessel pumps, valves, etc, under prolonged accident environments. Experiments should be performed to develop data and analytical methods to characterize the complex chemical nature of the primary coolant after a transient in which some fuel has failed. This work would lead to development of computer codes to describe the coolant chemistry following various accidents, and to the development of improved sampling methods to determine the amount of failed fuel from primary coolant analysis. Experimental and analytical research should be conducted to describe the formation and behavior of hydrogen in the primary system in accidents which involve significant fuel failure. Research should also be performed to study and predict reliably the mixing of such gases with the containment atmosphere. Methods for reducing the hydrogen gas in the primary system and in containment after an accident should be investigated to reduce the probability of explosion or fire. PAGENO="0115" 111 Testing should be performed to investigate the integrity of the reactor vessel under thermal shock conditions (cold water on hot vessel) at higher pressures representative of transient and small LOCA events to determine potential for vessel failure. Previous tests of this nature were performed at lower pressures more representative of large LOCA events. Requirements should also be developed for testing of critical plant equipment, pumps, valves, etc., to determine reliability of operation under severe accident environments. D. Post Mortem Examination and Plant Recove~y It is apparent that significant post mortem examination of the TMI core, plant components and the containment will be very useful in obtaining necessary information on fuel behavior, fission product transport and plateout and component operability under prolonged accident environments. These examinations will also be necessary to help define plant recovery requirements and risks. The TMI core must be removed from the reactor vessel in a manner such that important configuration information is not lost. The core should then be shipped to appropriate hot cell facilities where it can be examined and analyzed extensively. These studies will provide significant data on coolability of damaged cores, fuel/clad/coolant interactions, and fuel chemistry under severe heat-up conditions. Examination of the status of the containment building and plant safety components will yield important data on radioactive fission product transport and plateout and provide information on the operability PAGENO="0116" 112 of safety equipment under prolonged accident conditions. This information will be required to establish improved environmental requirements and criteria for requalification of safety equipment necessary for plant recovery. It is expected that these investigations will also lead to development of improved equipment qualification methodology spanning a range of postulated accidents. Concl us ion I hope that the views I have expressed here today regarding the safety design philosophy for nuclear power plants and the Three Mile Island accident, including the lessons to be learned from TMI as they relate to our research needs, will be of value to the Comittee in its con- siderations of these important issues. I believe significant regulatory actions are already underway to reduce the likelihood of such incidents significantly. For the longer term, I am sure that further improvements will also be effected. The research areas I have mentioned above should be started soon to provide the needed information. PAGENO="0117" 113 ATTACHMENT 1 Loss of Coolant Accident (LOCA) In evaluating the safety of nuclear power plants in NRC's licensing process, a series of design basis accidents have been selected. A design basis accident is used to specify sets of conditions which engineered safety systems are designed to mitigate in the interest of protecting the health and safety of the public. The most intricate design basis accident is the loss of coolant accident, called a LOCA which is described in the following discussion. A LOCA is postulated to occur as a result of a break in one of the pipes that comprise the primary coolant system of a reactor.* As a result of the break, loss of cooling capability for the nuclear core would occur and a rise in temperature of the fuel and its cladding could result. Since cooling the fuel and its cladding would be necessary to prevent the release of radioactive fission products, reactors are provided with emergency core cooling systems to keep the fuel covered with water and cooled. A major part of our research effort is devoted to defining the safety margin of emergency core cooling systems with greater precision than is now available. Figures 1, 2, and 3 illustrate a pressurized water reactor and-its associated emergency core cooling system. Figure 1 is a very simplified view of the primary coolant system and the associated steam generating equipment. This shows the reactor core, in its vessel, and the circulation *More generally, any essentially permanent opening in the primary coolant system that can result in significant loss of water inventory can be termed a LOCA. PAGENO="0118" 114 of primary coolant system water through the core, out to the steam generator, and back through the pump to the reactor vessel. The very hot water pumped into the steam generator heats other water in a secondary circuit to make steam, which then drives a turbine and a generator to produce electricity. Figure 2 shows how the single reactor core and vessel can be used with up to four cooling loops, each with a pump and a steam generator. Figure 3 shows how the emergency core cooling system connects to the primary coolant system. The ECCS consists of accumulators, which are large vessels containing water under pressure, and low pressure and high pressure injection pumps shown schematically by the pumps in the figure. If a pipe were to break, as is indicated in the figure, the primary system water would be expelled as a result of its high pressure and temperature. Signals resulting from the loss of pressure in the primary coolant system would initiate operation of the ECC systems. The efficacy of emergency core cooling performance is predicted by calculating the temperature of the hottest part of the fuel cladding in the reactor core to ensure that it does not exceed NRC's safety requirements. - PAGENO="0119" REACTOR UIANIUM 4 WATEI INTAKE -S (55 REACTOR HEAT EXCHANGER TO TURBINE C,' PAGENO="0120" -El to. C ~1 ED 8 ~ 0) PAGENO="0121" 117 Mr. MCCORMACK. Thank you, Mr. Levine. I have a number of questions which I shall save until after Dr. Lewis. By the way, I should mention, Dr. Lewis is a physicist from-where is your home base, Dr. Lewis? Dr. LEwIS. Santa Barbara. Mr. MCCORMACK. You are very welcome. Please proceed with your testimony as you wish, Dr. Lewis. Dr. LEWIS. Very good; thank you, Mr. Chairman. I am of course pleased to be here. You have my written testimony. Mr. MCCORMACK. Yes. Without objection, your written testimony will be inserted in the record at this point, and you may proceed as you wish, Dr. Lewis. STATEMENT OF DR. HAROLD W. LEWIS, PROFESSOR OF PHYSICS, UNIVERSITY OF CALIFORNIA Dr. LEWIS. Very good. I will forego then reading it to you, be- cause that would waste all our time. What I do want to say though is that I have to make my position clear. I did chair the American Physical Society Light-Water Reac- tor Safety Study Group, which resulted in a unanimous report- and therefore I can speak for that group-and the Risk Assessment Review Group which reviewed WASH-1400, which on these mat- ters resulted in a unanimous report, so I think I can speak for that group. I am also, as of 2 weeks ago, a member obviously of the Advisory Committee on Reactor Safeguards, and I can obviously not speak for that group. So I will try to make clear when I am speaking for myself and when I am trying to speak for one or the other of the groups I have been involved with. I have to put that on the record. I would like to go through a few of the things you asked me to discuss, rather specifically the problems that our review group found with WASH-1400, the Rasmussen report, and how they are relevant to the question of reactor safety and what they indicate for us. I think I would, especially in view of your introductory comments, like to go through a few of these things, and reinforce some of the things that you have said. The Rasmussen report, as we all know, was a serious effort to quantify rationally the probability and consequences of a nuclear accident. As soon as it was reported out, it received a great deal of criticism, which was a fairly intimate mixture of rational criticism and irrational criticism, with the result that the entire system became very defensive about the report, and ended up in my per- sonal view defending things that were indefensible along with those that were defensible, and it may be-and we said this in our report-asking too much of people to distinguish among the slings and arrows those which have poison on them and those which are good, clean sharp points. But the group involved did find a certain amount of difficulty doing that. We studied the report on commission from the NRC for about a year, heard testimony extensively, and ended up saying essentially the following: That the report is very hard to read. I think that is not a great discovery for most people. Everyone knows it is a very hard report to read and to follow in some detail. PAGENO="0122" 118 On the other hand, it was a major forward step in making the study of the safety of nuclear powerplants rational. It was a seri- ous, responsible, and honest effort-and we said this-to quantify the probability and the consequences of an accident. Where it fell short, and there were plenty of places that it fell short, these were a consequence of the fact that it was a very difficult job that was undertaken. More specifically, the report used a kind of methodology for the study of nuclear safety, the so-called fault-tree event-tree method- ology, which had come under attack from some critics as being wanting in itself. We found that criticism to be without merit, that is to say, we found that the fault-tree event-tree methodology, which is essentially the application of logical procedures to the analysis of nuclear accidents, is a completely solid procedure. Solid procedures can sometimes be implemented imperfectly, but it is important to distinguish between the quality of the screw- driver and the effectiveness of the carpenter, and we tried to do this. I am making this point fairly carefully, because one of the impor- tant, in my view, recommendations that we made was that this kind of methodology be much more extensively used within the NRC for the orientation of the safety research program, which is under Mr. Levine, and in the regulatory process. That is to say, we said that it is much better to base the things that you do on what knowledge you have than it is to base it on judgment or knowledge derived other than by careful and responsible analysis. It is an important point, and I would like to keep coming back to it. On the specific implementation in WASH-1400, we went through it, and we did find a very large number of things which were not done as well as we would have liked them to be done. One always asks, in this highly charged and passionate subject, whether errors are made-first, one always asks whether they are made on purpose, and we answered that by saying no. Then one asks whether such errors as are made have the conse- quence of :exaggerating or minimizing the likelihood of a reactor accident, that is, in the jargon of the trade, are they conservative or nonconservative? We found that there were a fair number of conservative things, overly conservative things, and I can name a few of them. I will come back to one important one. And there were a fair number of nonconservative ones, that is, things in which the, probability of an accident was understated. There were so many things on both sides of the fence that our group ended up saying that we do not believe that the probabilities stated in WASH-1400 are as credible as they are alleged to be, that is to say, that the error bounds are greater than was stated in the report. But we also were not able to say, and did not say, that the probabilities calculated in the report are either high or low, that is, we did not say the group came out with either an understated or an overstated estimate of the probability of a reactor accident. However, we said that the estimates weren't as good as plus or minus~ a factor of five, which is what was stated in the report, weren't that good, because we found many `things with which we found fault. PAGENO="0123" 119 Thus, we essentially commended the methodology. We said it is a good way to do things. It is better to analyze safety through analy- sis where you can, but that perhaps it was too big a bite that was taken at the time of the Rasmussen report. We urged the NRC to move in the direction of using this kind of analysis on systems which were sufficiently small so that the data base was available, the statistical techniques were available, the ability to describe the system under consideration was there, so that you could do the job in a credible and effective way, that they should be doing that much more than they had been doing so in the past. One example, for example, of that sort of thing is that the Rasmussen report-let me make one other comment. This is a personal comment. When the NRC received our report, there fol- lowed 4 months of Commission meetings about what to do with it. It was too late to reverse time, so they couldn't just throw it away, and after 4 months the NRC essentially accepted all the recom- mendations of our report and directed the staff to move in the direction of using this kind of methodology much more than they had in the past. This was of course accompanied by a press release which was misunderstood. Well, many things were misunderstood. It is in the nature of man that things are misunderstood. But they also asked the staff to report back to the commission whether in fact the Rasmussen report had played a role in any of the licensing and regulatory decisions that had been made in the few years it had been around, and the staff reported back that, with the exception of a few rather minor instances, no, it had not been used, and everyone was very pleased by that, and I have always felt that that was the wrong answer, that in fact in the years between the time the Rasmussen report was given to the NRC and the time in which we found some substantial problems in it, it was the best thing available, and should have been used much more extensively than it was. That is to say, risk assessment methodology is a solid discipline and should be used as much as possible to guide the regulation and licensing of reactors. One specific, which I have pulled out of our report from last September, and I must read this one paragraph to you from the record, was that we noticed that in WASH-1400, whatever you think of it, there was a listing of many of the credible accidents in a plant, and an ordering, that is to say, one could identify in WASH-1400 with less credibility than had been thought before, but still with some credibility, what the most likely accidents were, and we found a problem with the fact that NRC had not been moving in the direction of studying and emphasizing those things which WASH-1400 showed to be most threatening to a nuclear power- plant. We have a paragraph: The achievements of WASH-1400 in identifying the relative importance of var- ious accident classes have been inadequately reflected in NRC's policies. For exam- ple, WASH-1400 concluded that transients, small LOCA, and human errors are important contributors to overall risk, yet their study is not adequately reflected in the priorities of either research or regulatory groups. Now those are the three things that were relevant to Three Mile Island, so there is an obvious lesson which I needn't belabor. In any PAGENO="0124" 120 case, we did recommend using the methodology, pushing it much harder. We found specific fault with WASH-1400, and I think that is really all I need to say. Our detailed conclusions are in our report, and I am happy to answer any questions you may have. [The prepared statement of H. W. Lewis follows:] PAGENO="0125" 121 TESTIMONY OF H. W. LEWIS BEFORE THE SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION OF THE COMMITTEE ON SCIENCE AND TECHNOLOGY OF THE U. S. HOUSE OF REPRESENTATIVES MAY 22, 19T9 I appreciate the opportunity to appear before you today to discuss a number of issues of risk assessment, and of technology developments to en- hance the safety of nuclear operating systems.. As you know, I was Chairman of the American Physical.Society Light-Water Reactor Safety study group, and also of the Nuclear Regulatory Commission's Risk Assessment Review Group, and have only two weeks ago become a member of the Advisory Committee on Re- actor Safeguards. The two former studies resulted in unanimous reports on all the issues to be discussed here, so that I will do my best to speak for the Groups where it is appropriate. In addition, I would like to express a number of my personal views, and will try to distingui~h the two roles as carefully as I can. Clearly, I do not speak for the Advisory Committee on Reactor Safeguards. . . You have asked, in your letter of May 11 that loutline which elements of the Rasmussen report our Review Group judged invalid, and the degree to which the report is still useful as a basis for. decisions by NRC. I would like to somewhat broaden the issue, since the charter of the Review Group was to study not only the Rasmussen report itself, but also the general sub- ject of risk assessment methodology, and many of our recommendations dealt with the distinction between the two. I will try to make all that clear. Probabilistic risk assessment, as epitomized by WASH-l1~OO, the Rasmussen. report, is an effort to make quantitative the risk of an accident (not just in reactors) and the consequences thereof. To do so it is necessary, at the very outset, to construct a detailed model of the operating system, which PAGENO="0126" 122 * must be complete and accurate. Accident probabilities may differ vastly ac- cording to the precise alignment of valves and switches, and generalizations are rarely sufficient for credible accident analysis. Having modeled the plant, there are then a number of techniques for tracing accident paths through the system, all of which are essentially equivalent to the particular form of fault tree/event tree analysis used in .WASH_lI~OO.* If one has sufficient data to determine, for example, the probability that a given valve will be open when it should be closed, one can then compute the probability of any partic- ular accident sequence, leading to an estimate that it will lead to failure of the entire system. Then, similarly, one can compute the consequences of such an accident, and this is the method used in WASH-l~OO. The Review Group asked first whether this was a logically sound technique, and answered in the affirmative. It is extremely difficult, and fraught with complexities I will mention later, but we solidly supported both the nethodoolgy and the objective of making the study of reactor risk as quantitative and ra- tional as possible. Nonetheless, we found faults In* the implementation of the methodology in WASH-l~4OO, which are discussed In some detail in our report. among them are the fundamental difficulties Involved in quantifying conmom cause failures - failures in which presumably independent systems are compro- niised by an event which affects them all, (e.g. an earthquake), a quite in- adequate data base for a number of the things which needed to be calculated, inadequate, and sometimes wrong, statistical techniques in a number of in- portant places, the basic difficulty in quantifying human behavior, etc. PAGENO="0127" 123 Therefore, though supporting the methodolo~r, we found a sufficient number of problems with the implementation of the methodolo~r in that particular study to feel that the error bOunds on the accident probabilities given in WASII-lbOO were substantially understated. It is important to say that this does not mean that we believe that the accident probabilities are either high or low, but only that they are substantially less certain than was stated in that report. This is such an important point that it is worth spelling it out in some detail. We found a number of items in WASII-l1400 which tended to exaggerate the probability of an accident (i.e., were conservative), and a number which tended to understate the probability of an accident (i.e., were non-conserva- tive). Among the latter were the treatment of common cause failures, mentioned above, the treatment of ATWS (anticipated transients without scram) and the handling of human accident initiation. Among the conservative treatments were the pervasive regulatory bias in the group, drawn as it was from the regulatory community, which caused them to always err on the side of conservatism when in doubt, complete omission of constructive and adaptive human response dur- ing the course of an accident, etc. It is because there were so many things on both sides that we were unable to judge whether the probabilities in WASH-l1~OO were high or low, but able to agree unanimously that they were sub- stantially less precise than had been stated in the report. On the other hand, the effort to quantify risk through the detailed analysis of the failure modes of a plant is far more likely to provide rational guidance to safety enhancement than is guesswork. For that reason, we strongly PAGENO="0128" 124 supported the application of this kind of risk assessment nethodolo~ in the regulation and enfor~ement areas, under conditions in which the data base and statistical techniques are up to the job, that is, on subsystems and generic issues sufficiently limited to allow one to. do the job well. In- deed, we said that these techniques should be among the principal methods used to resolve the generic safety issues which afflict the nuclear enter- prise. I an emphasizing these distinctions because our Review Group strongly supported the enhanced use of the nethodolo~ in the regulatory process, while at the same time coming down rather hard on the specific implementation in WASH-lbOO. It seems to me obvious that, where one has* an opportunity to understand the relative importance of different accident modes in the plant, and even, to some extent, the absolute probabilities, it is far better to distribute one's resources accordingly than to rely upon engineering judgment, however competent. Though .the latter is extremely~ important, and represents in some sense the distillation of accumulated experience,it cannot prevail in reliability over competent analysis. We therefore urged, as others have been urging for years, that the RRC move expeditiously into a mode in which probabilistic risk assessment plays an important role in determining the priorities of its regulatory and research efforts. I would like to quote verbatim one of the findings from our report, whose relevance this month should be obvious. PAGENO="0129" 125 "The achievements of WASH-l1~OO in identifying the relative importance of various accident classes have been inadequately reflected in NRC's policies. For example, W~SH~l~4OO concluded that transients, small LOCA, and human errors are important contributors to overall risk, yet their study is not adequately reflected in the priorities of either research or regulatory groups." - This paragraph speaks for itself in the aftermath of Three Mile Island. I believe that the effective use of risk assessment- methodolo~r In character- izing and dealing with the risks in reactors can go a long way toward making them safer, as well as .in helping to assess. their safety for public policy purposes. For this tohappen, the NRC research program must be more respon- sive to the risks as determined by sober analysis, and less responsive to the risks as conceived in other ways. Even the progress already-made in rationally characterizing and understanding risk -has -been very slow to pene- trate the regulatory structure at NRC, and our report recommended~ that "NRC should encourage closer coordination among the research and probabilistic analysis staff and. the licensing and regulatory staff, in order to promote the effective use of these techniques." Despite the statement of the Nuclear Regulatory Commission last January that - it was accepting all our recomraenda- tions, and its instructions to the staff to. move in this direction, I have yet to see much progress. This is not to demean in any way the technical quality of the NRC operation, - but only to say that the conservatism which 48-721 0 - 79 - 9 PAGENO="0130" 126 is entirely appropriate in the regulatory body does not lend itself easily to the absorption of new guidance. Finally, I sin both pleased and sorry that you have not asked me to tell you what lessons I believe Three Mile Island has taught us about all these natters. I am pleased because you have saved me some work, and sorry because I believe that there is so much that we can learn fron experience in general, and from this experience in particular.. Perhaps someone will rise to the bait and ask me a question. Mr. MCCORMACK. Thank you, Dr. Lewis. I want to take this opportunity to congratulate you and~ all the members of the panel that worked on the review. I do not purport to be the wisest person nor the most knowledgeable person on this subject, but I think that your review was an excellent one, and I want to congratulate you on it. I regret that it was misinterpreted by the press. I regret that NRC's press release regarding its action on it was so ineptly writ- ten, I think that your work made a very considerable contribution. I recall previous meetings, public hearings where you and Dr. Rasmussen appeared together, he agreed with that statement, and in the true character of a professional scientist, accepted the criti- cisms, at least a substantial portion of the criticism that you made of his report, and agreed with them. I want to congratulate you also on the professional manner with which you evaluated the report. I think that in the days to come, the Rasmussen report and your analysis of it will both contribute significantly to the better under- standing and better management of our nuclear safety programs. Dr. LEWIS. Thank you, Mr. Chairman. You will make me blush, but it is true that Norm Rasmussen has accepted essentially all the recommendations of our report also, and I give him a great deal of credit for behaving like a gentleman and scholar through this whole thing. Mr. MCCORMACK. Especially a scholar, and without detracting from the gentleman, but especially a scholar. Dr. LEWIS. Yes. Mr. MCCORMACK. I would like to ask you a question now in that context. You said the factor of plus or minus 5 which they used in their error bounds was too narrow. Dr. LEwIS. Right. Mr. MCCORMACK. Do you feel there is a number that you could put on the error bounds that would be realistic? Dr. LEWIS. No, I do not, and we were very careful not to do that. We said substantially understated or greatly understated, and people have tried to pin us down, and particularly Norm Rasmus- sen I think is willing to go another factor of 2 or 3, and we have had conversations that were almost like bartering sessions. If I would go for a factor of 5 perhaps we could compromise on a factor of 4 extra over the 5. The reason we cannot do that is that, in other words, to provide a credible error bound, we would have to do the report over again. PAGENO="0131" 127 We would have to do it responsibly and even better than the Rasmussen group did. In a sense the reason they could not set an error bound that stood the test of time was that they were biting off a very, very difficult job. There are intangibles. There are things we do not know. We really did not know how to quantify human errors. My view of the great conservatism in the report is that we do not know how to quantify constructive human intervention after an accident begins. These are very difficult, and in order to set a credible bound, one would have to do all those things better than the Rasmussen group did. We did not do that. Mr. MCCORMACK. Do you have any feeling for the general im- pression that the casual nonscientific, nonanalytical observer would receive from reading in the Rasmussen report that the po- tential for an individual public citizen being killed from a nuclear accident is extremely small, whether or not we try to quantify it numerically? Dr. LEWIS. Is your question whether I agree that the probability of being killed is small? Mr. MCCORMACK. I do not want to put you in the position of saying "agree," but do you believe, based on your study, that the potential threat of death from a nuclear accident to public citizens is extremely small? Dr. LEWIS. Yes. I am speaking for myself now, just me. Yes, I do, and in fact I have said many times that if I were to be asked personally, not as chairman of the review group, whether I think that the probability of an accident stated in the Rasmussen report is high or low, the thing I carefully avoided saying before, I feel that the probability of an accident stated in that is high, that is to say, that the plants are actually safer than is stated in the Rasmus- sen report. I said that before Three Mile Island and I continue to say it. The reason I say it is that as the people who listen to me know, to their misery, I always make aviation analogies in these things. And the Rasmussen report, in effect, if it were translated into the aviation case, would be like studying the safety of airplanes while leaving out the fact that there is a pilot there who does not want to get killed either, and the fact that constructive human intervention during the course of an accident was omitted is to me a very important conservatism in the report. It is very difficult to quantify, but reactor accidents lend them- selves more easily to constructive intervention than do aircraft accidents, because they happen more slowly. Most of them happen more slowly, the ones that are most threatening happen more slowly, so I do believe that it exaggerates the probability of an accident. Mr. MCCORMACK. One final question. Do you feel that the Three Mile Island accident and the subsequent sequence of events, fit reasonably well into the Rasmussen evaluation of the fault-tree risk analysis? Dr. LEWIS. Yes; they fit into it to some extent-that is, everyone has noticed, that the probability of leaving the two block valves on the emergency feed water system inadvertently closed was con- tained in the report. It was calculated, I believe, in an inexcusably PAGENO="0132" 128 poor way, but it was still in the report, so that up to the point at which the hydrogen bubble formed in the pressure vessel, it was not an unusual sequence of events. By then one was in the position to do a diagnosis and work through what finally happened. I believe it was done reasonably well in the report. Mr. MCCORMACK. Thank you. Mr. Levine, I have one question which I hope will not be miscon- strued. One looks at the Three Mile Island accident in its entirety, the fact that it was a serious accident, that it was extremely unfortunate, and yet one looks at all that we have learned from it. We have learned, for instance, that under the nearly noncredible conditions that existed with respect to the exposure of the fuel, the uncovering of the fuel, we had no cesium release to the coolant water. In short, what we had was a massive LOCA experiment, unintentional experiment. Do you feel that this qualifies as a test for a fuel core that has been lacking because we obviously did not want to do it? Does it respond to the criticism of the LOFT test that they are not big enough? Can we draw experience from this accident and draw knowledge from this accident that will give us a better understanding and essentially say, well, this is for all practi- cal purposes an unintentional LOCA experiment? Mr. LEVINE. I think the answer is partly yes and partly no, and certainly not yet. First of all we are going to have to get the core out of there to understand more precisely than we can now esti- mate, what happened to it, how extensively it was damaged, and then try to better predict what the temperature-time history of that fuel was. Second, I think the idea of trying to analyze an accident in which the auxiliary feed water was turned off and then later turned on, and the emergency core cooling system was turned off and on at random, and the relief valve block valve was opened and closed, giving it sort of an intermittent LOCA, is a kind of sequence that is very difficult to analyze. For myself, at this point I can say that I think, considering what happened at that plant, I am surprised that there was not more damage than we have seen, and I think in that sense, one can say we will have learned a great deal about the ability of these cores to withstand severe conditions. On the other hand, we are learning a great deal from our LOFT program. We have now conducted two nuclear tests, one from two- thirds of the power density of a commercial reactor, and just a few weeks ago, one from the full power density of a commercial reac- tor. We find the peak clad temperatures quite low, and we find our ability to predict what happens to be quite good. Some more refine- ments are needed, but I think we are making great strides in this area. Furthermore, I think we are going to have to modify our LOFT experiments to more urgently look, at small LOCA, as I mentioned in my testimony, as well as transients, too. Mr. MCCORMACK. One final question. You may not have an answer at all to this. I have been continually disturbed by the calculations on the amount of zirconium that was presumably con- sumed. It seems to me utterly inconsistent to talk about as much PAGENO="0133" 129 as one-third of the zirconium consumed, based on the amount of hydrogen that was presumed to be present, and to assume that this came from the top half of the fuel, to assume that there would be a hot spot, shall we say halfway between the surface of the water and the top of the fuel, where more of the zirconium would be reacting. All this happens, and we have one-sixth of the total zirconium consumed, and yet no cesium is released to the cooling water. That strikes me as being very strange, and I wonder if you care to comment on it. Mr. LEVINE. I can only comment on the basis of generalizations at the moment. We think that there was almost no fuel melting in the core, and that you really will not get very much cesium re- leased unless you melt the fuel. On the other hand, the core did reach high enough temperatures to bake out iodine and the noble gases, and there may have been an eutectic formed between the oxide and the cladding, which would in fact have released more than you would get just through the temperature alone. Mr. MCCORMACK. More what? Mr. LEVINE. More of the iodine. Mr. MCCORMACK. And gases? Mr. LEVINE. Yes. Mr. MCCORMACK. Are you suggesting-well, I guess my question is when I see no cesium at all, no significant measurable cesium in the cooling water, I am assuming that there was no contact be- tween the cooling water and the fuel itself. Mr. LEVINE. That may be, but there surely was a large metal water reaction in some parts of that core. Mr. MCCORMACK. Yes. Mr. LEVINE. And it is easy to speculate that there was cladding damage to the point where some fuel should have been exposed. Mr. MCC0RMACK. Should have been, but that is the inconsistency that shows up, and I am raising that point now. Mr. LEVINE. I think in my mind that is still, an open area. We have some differences of view among our experts who have been studying this very carefully, and by the way, the metal water reaction amount was not based just on the hydrogen present. It was based on attempts to reconstruct the time-temperature history of the core. Mr. MCC0RMACK. I see. Thank you. Mr. Goldwater. Mr. GOLDWATER. Dr. Lewis, discussing the WASH-1400 report with Mr. McCormack, you implied that an update should be made on that report. Is that an accurate interpretation? Dr. LEWIS. No; I do not think so. On the specific question of whether WASH-1400 should be updated or redone, I do not think it would be a good idea. There are several reasons. Of course we could do a little bit better with the hindsight we have had, but I am not so sure that we could do enough better to justify doing it. The sense of our review group report was that one should break out the methodology and use it on subsystems for which you can do the job well, rather than on the whole system, for which it may not be possible to do the job well. PAGENO="0134" 130 Mr. GOLDWATER. You implied that there was not enough risk assessment based on transients, small LOCA and human error, incorporated in this study. Dr. LEwIs. Oh, no, no, quite the opposite. It was in fact in WASH-1400. One of the consequences of WASH-1400 was that transients, small LOCA, and human error do play an important role in the generation of nuclear accidents. The place where it is inadequately represented is in the NRC programs which ought to have been more responsive to WASH-1400 in my view, well, in our group's view, than in fact they were. NRC is a slow-moving organi- zation. Perhaps it is proper for a regulatory organization to be slow-moving, but it would be nice to have some of the wisdom which was produced by WASH-1400 including the importance of small LOCA transients, and human error find its way into the NRC research and regulatory structure. It is in WASH-1400. Mr. GOLDWATER. So you feel that the two reports, your review and the WASH-1400, have sufficient standing separately and they don't need to be incorporated? Mr. LEWIS. Our report was a fairly strong critique of WASH- 1400. I have emphasized the positive things we said today, but in fact, we were fairly hard on the report in terms of statistics, data base, scrutability, and such matters. So that we found a great deal wrong with it. When I say that I don't believe it would be worthwhile to do it again, It is just I am thinking of the millions of dollars, man-years, expertise, and effort involved. I think if that same amount of effort and resources were to go into applying the methodology where you can do it well-that is, on subsystems-that would be a better expenditure of our time. Mr. GOLDWATER. What do you believe are the basic lessons that we should or will be learning from the Three Mile Island accident? Mr. LEWIS. Well, I have views on that. Basically, I think I can do this very quickly. I think many people have noticed that there are a wide variety of accidents and that in this particular event there was a surprise-the formation of the gas bubble in the pressure vessel was a surprise. The thing that concerns me about the lessons people are drawing from Three Mile Island is that they tend to be rather specific to the particular sequence that occurred at Three Mile Island; that is to say, the familiar analogy, a horse has escaped from this barn and we are double bolting that particular door. We tend to be fairly narrow in responding to the specific thing that has happened. .1 think any future accidents-and there will be accidents-will also contain surprises. The main lesson I learn, again drawn in part from the aviation analogy, from both Three Mile Island and from Browns Ferry, which was the worst thing up to now, is that in the end it takes constructive human intervention to modify the course of an accident. That happened in both cases, and it will happen again. So I would like the main lesson to be that you provide to the operators the kind of information, training, awareness, and what have you, pay, perhaps, prestige, stewardesses, I don't know, that makes it possible for them to function like airplane pilots, during the course of an accident. PAGENO="0135" 131 There is plenty of time. I think flexible response is the key to keeping an accident from going far enough down the track to threaten the public health and safety. For me, that is the central lesson. Mr. GOLDWATER. You are talking about the quality of the person. Mr. LEWIS. No, the person and the stuff he has available; that is to say, many people have commented on the fact that some of the instrumentation was deficient, the parameter range wasn't large enough to encompass accident conditions, there are no valve indica- tors on specific things. Many of my physicist friends have reacted to the accident by saying that there should be an interlock on the two block valves that were inadvertently left closed so they could not both be left closed, there should be indicators on all the valves in the plant. I don't think that makes any sense, but there should be an analysis of the critical systems in such a way that one provides to the operator the necessary indications to know what to do in the event of an accident. For example, I don't like to second-guess what the operators at Three Mile Island did because I am aware that it is very, very easy to do things well in retrospect and not so easy to do them in real time. But there were some deficiencies in correlating readings and correlating indications which would have told them more about what was happening in the plant than they seemed to have ab- sorbed very quickly. I would like to enhance the capability one way or another by providing the instrumentation and training to make it possible to do that. But I do believe that in the end, people are fairly intelli- gent creatures and you have time in a reactor accident, and if you make the information available you have a great weapon we should use. It is hard toanalyze. Mr. GOLDWATER. Maybe a parallel toward an automatic pilot on an aircraft is a good analogy. An automatic pilot will fly that airline, and does most of the time. But there is adequate instru- mentation to provide the pilot and the engineer with knowledge of what is happening to the aircraft. Mr. LEWIS. That is correct. A good pilot--- Mr. GOLDWATER. However, when there is a problem with an aircraft, say for instance the plane starts to wiggle its wings or something, the pilot tends to kick the thing off and assume manual control. That appears to be what happened at Three Mile Island. I have heard people say if they just let the emergency core cooling system alone, that it would have shut down, taken care of itself. But in fact, a human being intervened, much like the pilot on an aircraft overriding or cutting out an automatic pilot. Now, I am not so sure that is what you are saying, is it? Mr. LEWIS. I am saying that; that is to say, the other thing that the pilot of an airplane learns is to believe his instruments because it is normal human response when an instrument indicates a mal- function to not believe that it is happening to you. He learns to believe his instruments. He also learns to correlate his instruments; that is to say, he doesn't fix his attention on a PAGENO="0136" 132 single instrument. You are right. A good pilot turns off the autopi- lot when he is in trouble. But he correlates all his instruments, he reads them, and he~ infers what is happening and does his best to get out of it. It seems to me that that works pretty well. There is a fairly deep-seated analogy between aviation and nucle- ar power in my view from which a lot of lessons can be learned- because aviation is an inherently risky thing which has become acceptably safe. Mr. MCCORMACK. Mr. Walker? Mr. WALKER. Thank you, Mr. Chairman. Dr. Lewis, you had mentioned in reaction to some questions of the chairman that it was your personal opinion that the chance of death in the general population resulting from a nuclear accident was extremely small. Can I ask you also what your personal opinion would be of the chances of off-site property damage resulting from a nuclear acci- dent? Would that be significantly higher? Is it also relatively small in terms of some sort of calculated risk? Mr. LEwIs. You know, to say that something is small or large is not to say anything meaningful, because smallness and largeness are in the eye of the beholder. What I said in response to the chairman's question I hope is that it is my personal view that the probability of an accident, of a genuine major reactor accident, is lower than is contained in the Rasmussen report. That would carry with it the consequences that the probability of property damage is also lower. But I base that almost entirely on the experience we have had with the two major accidents, plus a fair amount of carryover from aviation, that one will intervene in an accident and keep it from getting too bad. Mr. WALKER. That goes to the point I was going to raise. From your standpoint, then, the Rasmussen study exaggerates the prob- ability of an accident? Mr. LEwIS. That is my personal view. Mr. WALKER. OK. Now, given that background, we had a group of Nobel Prize winners before the committee here a week or so ago-not before this subcommittee, but before the full committee- they were essentially nuclear advocates. One of the things that they mentioned, that might be a good idea, from the standpoint of the nuclear industry would be to repeal the Price-Anderson Act. I bring this up to you because it seems to me the kind of research that the Rasmussen study repre- sents, to some extent your study represents, is also something which applies not only to the nuclear industry, but also to public policy decisionmaking. In large part Price-Anderson and some of these things are built upon that kind of research. So my question to you would be, if we are exaggerating in those studies the foundation on which some of these decisions have been built, would it be reasonable to consider the repeal of Price-Anderson and have the industry assume liabili- ty for any accidents that would involve the public? Mr. LEWIS. I do not claim to be an insurance expert. PAGENO="0137" 133 Mr. WALKER. I am asking you from the research standpoint. Research is the foundation on which the insurance people are basing their calculations. Mr. LEwIs. Of course, I know all your Nobel Prize winners were here. I also remember that Edward Teller at one stage in the proposition 15 debates in California used to complain that if he were immortal he could not get life insurance because there would be no data base for determining the premium, and that was his way of putting it. I am not an expert on that. I would like to see the research directed at the places where there are problems. I would like to see somebody go through all the accident sequences in WASH-1400 and for each one-there are really a finite number-say if this were to happen, do we have the training and instrumentation to know how to keep it from going all the way down to a core melt. Perhaps if one did that, one might be able to put something quantitative on my admittedly visceral feeling that one has exag- gerated the probability of an accident. Mr. MCCORMACK. Will the gentleman yield for one point. I would like to make one point; that is, as a matter of history, the Price-Anderson Act was enacted long before the Rasmussen report was made. It was enacted in the 1950's to protect small contractors, not the big vendors, but the small contractors, so that they would not get caught in second party lawsuits, or third party lawsuits. What it did was require that the utility buy the maximum insur- ance available in a pool. The later modification of the law, of course, specifies that the industry provide contributions up to a total of $560 million. When the Rasmussen report was being done, those persons who were trying to repeal the Price-Anderson law said just wait until Rasmussen comes out, then we will use that to repeal Price-Ander- son. When it came out, reporting as it did, that the possibility of death from a nuclear power accident was very low, then they turned against the Rasmussen report. I just want to get that little point in so we keep in perspective the fact that in reality the Price-Anderson Act precedes by at least a decade any of these studies, and it was there for a totally differ- ent reason than the results brought out. Mr. WALKER. I thank the gentleman for that clarification. What I was simply trying to get at was the fact that the public policy decisions that we are going to be asked to make in upcoming months are very much based upon the kind of research that Dr. Lewis has provided here and that has been provided earlier by the Rasmussen studies. I think it is extremely important that some of the people who have had some experience with the research, and have knowledge of it, give us their perspectives. This would let us make those public policy decisions, maybe, exclusive of what is going on within the technological elements of the nuclear industry. I thank the gentleman. Mr. MCCORMACK. I think the gentleman's point is very well taken and I congratulate him for it. PAGENO="0138" 134 Mr. WALKER. That is all I have, Mr~ Chairman. Mr. MCCORMACK. Mr. Goldwater, do you have anymore ques- tions? Mr. GOLDWATER. I have one more. I didn't quite follow, Dr. Lewis, your. analogy about the probabil- ity of' risk or the risk of nuclear accident versus the risk of an aircraft accident. You were making a point to the chairman.. Is there a higher degree of risk of a major aircraft accident than there is, say, for a nuclear powerplant accident? Is that what you were saying? Mr. LEwIs. I don't remember which specific comment you are referring to. The analogy, as I see it, is that in both cases you have a complex system which. is very hard to analyze from the begin- ning; that is, it is extremely difficult to analyze all possible aircraft accidents from the beginning, too. So that what we have in the case of aircraft that has made the industry acceptably safe, although there is still some residual risk, is a system by which we have a pilot up front who is well trained in upset conditions, with redundant instrumentation devoted to those conditions and with enough training on good aircraft and simulators so that he can cope constructively with the course .of an accident. We also have a bureaucratic procedure in the best sense of the word, not the worst, by which those few things that do continue to happen are then analyzed to death and the learning from them put back into the system. Over the years, that has made aviation acceptably safe. I have in other forums been recommending for years that something like an NTSB structure be applied to the nuclear industry. I might just comment that when this suggestion went over to NRC about 6 months ago, one of their answers was, these people wouldn't have anything to do because there aren't any accidents. Perhaps it wouldn't be the same now.' Mr. MCCORMACK. Thank you. First of all, I want to thank these witnesses, and again thank the witnesses from the earlier panel. The contributions that you have made today, and the specific points that you have made, Mr. Levine, about the need for future research, will be the basis for future legislative action by this committee. We appreciate it. We appreciate what you have contributed and we appreciate again your contribution, and your perspective, Dr. Lewis. I want to also thank the members of the French Parliament who sat in today. We offered them a chance to ask questions, but since none of the members themselves actually speak English, we decid- ed to forego the pleasure, especially since it is getting late. We want to thank them. We know that they will have questions later On. In that regard, I am sure the witnesses will be glad to answer questions in writing, either from us or from the French Embassy. Tomorrow, starting at 9:30, this committee will meet again, and we will concentrate specifically on what happened at the Three Mile Island accident. We are going to see, first of all, a demonstration of a nuclear powerplant, which will be here. It has been manufactured by the PAGENO="0139" 135 University of Florida, and it has a high intensity heater system with cooling systems built in. It is all made of Lucite, so we can actually see standard operating conditions, the way it would be with a partial meltdown, with the emergency core cooling systems functioning and so on. We will actually be able to see it in oper- ation. We will also hear witnesses from Babcock & Wilcox, the vendors for the Three Mile Island plant, from Mr. Herman Dieckamp, president of General Public Utilities Corp., Mr. Harold Denton, Director of the Office of Nuclear Regulation of NRC, Mr. John Conway, president of the American Nuclear Energy Council, and Hon. William W. Scranton, the Lieutenant Governor of the Com- monwealth of Pennsylvania. We will convene tomorrow at 9:30. We thank you all for your attendance today. We stand adjourned. [Whereupon, at 12:15 p.m. the subcommittee adjourned, to recon- vene at 9:30 a.m., Wednesday, May 23, 1979.] PAGENO="0140" 136 APPENDIX I QuEsTIoNS AND ANSWERS FOR THE RECORD C-E Power Systems Tel. 2031688-1911 Combustion Engineering, Inc. Telex: 9-9297 1000 Prospect Hill Road Windsor, Connecticut 06095 ~ .II~ POWER SYSTEMS June 22, 1979 Hon. Mike McCormack Chairman, Subcommittee on Energy Research and Production U. S. House of Representatives Suite 2321 Rayburn House Office Bldg. Washington, B. C. 20515 Dear Congressman McCormack: It is a pleasure to submit further information to the Subcommittee on Energy Research and Production in the form of answers to the questions you asked in your recent letter. The answers are appended. I hope you will find them useful. Sincerely yours, ) ~JJ. R. Dietrich Chief Scientist Nuclear Power Systems JRD:jd Enc. PAGENO="0141" 137 SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION Answers to questions from the May 22, 1979 Hearings on Nuclear Power Plant Safety, by Joseph R. Dietrich In answering questions 1 through 5, I must make it clear that in my testimony on May 22 I was speaking of design reviews and studies, some of which are under way and some of which were merely recommended. The substantive answers to questions 1 through 5 must come from such reviews and studies. My recommenda- tions are, therefore, as to what should be studied. Here I can only give examples of changes that have a potential for enhancing safety. Moreover, as I pointed out in my testimony, any proposed design change of substantial magnitude must be given a very thorough engineering review on a systems basis before it is made, to assure that it does not, while improving safety under one set of circumstances, degrade safety under other circumstances. Ouestion 1 Discuss the design changes or modifications and the procedural changes that you would recommend to minimize the frequency of occurrence and the speed of development of the operational perturbations mentioned in your testimony. Answer This class of improvement would be accomplished primarily by design changes. Some possibilities to be considered might be additional pressurizer volume to sim- plify the maintenance of primary system water inventory; anticipatory reactor trips (e.g. trip upon loss of normal feedwater flow as well as on low steam generator water level); generous water inventory in the steam generators to increase the time available to restore feedwater flow in the event it is lost; and, possibly, multiple relief valves of smaller size, with graduated pressure settings, to minimize the flow out of the primary system if the transient causing a relief valve to open is a minor one. In the latter case the relief valves would of course have block valves in series to be used in the event that a relief valve failed to close at the proper time. I am sure that there are many more possibilities, but they must be sought out by examining each transient that might occur and looking for design changes that would decrease its probability or its severity. Most design changes that would fall into this class would be impractical to implement on existing plants: consequently an investigation of these possibilities would have its major application to new, rather than existing, plants. PAGENO="0142" 138 Answers to Questions - J. R. Dietrich Question 2 What design changes or procedure changes would you recommend to improve the defense against lesser accidents that you referred to in your testimony? Answer This again is a question that can be answered only by extensive study and analysis. For the immediate future my only suggestion is that we give more atten- tion to the lesser accidents in our safety analyses of nuclear plants, and more attention to the possible interactions between the operator and the plant. The initi- ating events at Three Mile Island would have been classified as constituting a small' accident in safety studies in the past, yet they were escalated into a major accident. Greater attention to the possible consequences of "small" initiating events should lead to improvements in design and operator education which will greatly reduce the probability of such escalation in the future. Questions 3, 4, and 5 3) Provide details of the improvements in communications and the man-machine interface that you suggested in your testimony. 4) Provide details of the means of simplifying the interpretation of instrument readings, together with your recommendations for displaying abnormal readings. 5) Discuss and provide recommendations for means of using computers or microprocessors to enhance the power plant operator's ability to recognize abnormalities. Answer Questions 3, 4, and 5 apply to closely related subjects, and can best be dis- cussed together. I could respond at great length to these questions because they cover a specific field in which Combustion Engineering has been carrying out de- velopment for several years. I cannot do that, however, without producing a dis- cussion which sounds like an advertisement for the Combustion Engineering advanced control system, and I believe that to be inappropriate in a document which may appear in the public record of your committee's deliberations. I will therefore answer briefly, and attach, for your further information, a document describing the Com- bustion Engineering development, which was prepared by Mr. John E. Myers, Director of Systems Engineering, Nuclear Power Systems. The operators' performance can be improved by two design techniques: - Human engineering of the operator's interface with the power plant to optimize his comprehension of the status of the plant processes. PAGENO="0143" 139 Answers to Questions - 3. R. Dietrich - Optimization of some of the routine tasks to give the operator more time for concentration on the more important aspects of his job. Human engineering encompasses the reduction in complexity of the informa- tion presented to the operator and optimization of the method of data presentation. Complexity can be reduced by combining several instrument outputs to yield the information which is of direct concern to the operator. For example, reactor power level and power distribution measurements can be combined to present to the operator the maximum linear power density in the reactor fuel, one of the quantities upon which operating limits are imposed. Or reactor power, power distribution, coolant flow, coolant temperature, and reactor pressure data can be combined to determine the margin available to the limit on departure from nucleate boiling. A major step toward optimization of data presentation can be made by the effective use of cathode ray tubes. These displays can take the form of printed statements, numerical data, graphs, or simplified system diagrams. In arriving at the optimum display one must take into account such things as the use of colors, the symbolic format, the physical orientation of the display, the information density, and the techniques for updating the information and displaying trends. A number of routine tasks of the operator can be automated, but perhaps the most important area of automation is in the surveillance of the operability of the plant safety systems. A system can be designed, for example, to monitor the alignment of pumps and valves to assure that a given safety system is always ready to perform its function if needed. Misalignment can be enunciated for the operator and the misaligned components identified. Computer based systems can also be designed to assist the operator in the alignment of pumps and valves for periodic actuation testing, and to assist in the realignment into the "ready" condition after the test has been completed. Question 6 Discuss the need for a "Swat Team" composed of people from industry, the utilities, NRC, etc. Answer I believe that a team of general nuclear experts, available to respond quickly in an emergency, would be very helpful. It should be composed of people chosen for the depth and breadth of their knowledge in the pertinent areas of nuclear plant design and operation, and should serve in an advisory capacity. I do not think it is advisable to have an outside team, whatever its composition, "take over" the oper- ation of a plant that is in trouble. The formation of teams, however, is only part of the necessary preparation for emergencies. Attention must be given to defining the roles of the teams, and to providing those things necessary for the team to do its job: working space; effective means of communication, both with theplant that is in trouble and with the home offices of the members of the team; adequate drawings and other design PAGENO="0144" 140 Answers to Questions - J. R. Dietrich data on the plant in question; reference books, related library facilities; etc. These and other aspects of emergency response are receiving concentrated attention from the Emergency Response Subcommittee of the Atomic Industrial Forum Policy Committee on Follow-Up to Three Mile Island. Question 7 What are the advantages and disadvantages of standardizing the design of nuclear power plants? What would be the attitude of equipment manufacturers and plant constructors to standardization? Answer I believe there are great advantages, with respect to safety, reliability and economy, to standardizing the design of a nuclear system produced by a given manufacturer or constructor. Complete standardization of this kind proves diffi- cult in practice, however, because of changing licensing requirements and because of the problem of interfacing the NSSS design with the balance of plant design, which varies from one constructor to another. Nevertheless, I believe the degree of standardization that has been achieved has proved its value. Standardization in the sense of a common design for all manufacturers and constructors is quite a different matter. With regard to acceptance of the idea by system suppliers and constructors, I can only guess. If the concept had been pro- posed in the very early stages of nuclear power development it might very well have been accepted, but I can see great complications in implementing it today. Each NSSS vendor has spent many millions of dollars developing his designs, and each, no doubt, considers his the best. I believe there would be great reluctance to eliminate competition from the design process. Moreover, in a standard design, some design features would no doubt be selected from one supplier and some from another. How would one ever settle the question of who pays royalties to whom, and how much? My own opinion is that a standard design of this kind would not be a good idea, for the following reasons. - Presumably decisions as to the standard design characteristics would be made by some government agency. The government would, in effect, be designing the plant. I do not believe this is the way to arrive at either an economic plant or the safest plant. - The addition of and improvements within safety systems has been and will continue to be an evolutionary process as designs change and knowledge grows. I am afraid this process would stagnate under the standard design concept. - If all suppliers and constructors worked to a common standard design there would be no incentive to maintain the large, highly skilled design teams that exist today. We would lose our most valuable resource for safe deign and for recovery from accident conditions. PAGENO="0145" 141 Answers to Questions - J. R. Dietrich - The design depends not only on how the components are put together, but on the components themselves: we would have to have standardized component designs as well as standardized system designs. I would expect that the number of sub-suppliers of items like pumps, valves, and motors would decrease if all had to manufacture to a common design. The nuclear business is not large enough for such sub-suppliers to justify re-tooling to a new design. Thus competition would decrease and along with it the pressure to supply reliable equipment. Question 8 Should there be a standard design for control rooms and for the layout of control panels? Answer As is often the case, standardization of control room design and layout would likely be a mixed blessing. However, a certain level of standardization could probably be adopted which would yield most of the desirable effects, while mini- mizing the undesirable ones. It seems reasonable that if the monitoring, control, and protective needs of power plants are similar, then the general layout of instrumentation and controls within the control room should also be similar. The arguments for this conclusion include: If there is a truly optimum design approach it should be used generally. - Given standardizationof general control room layout, more of the various design efforts being pursued would couple synergisti- cally rather than being incompatible. - Operations and other essen.tial workers could more quickly per- ceive the nature of operations within a control room with which they were unfamiliar. - Operator training would be simplified. However, the case for standardization deteriorates quickly when specific design features of the panels and consoles are considered. We are faced simul- taneously with rapid development of electronics-oriented technology, and an information processing task within the power plant which makes use of this tech- nology seem virtually mandatory. One of the clearest lessons from TMI, the need to inform the operator better, is best pursued by the use of advanced electronics technology. Standardization of detailed design features would be extremely diffi- cult to achieve at any point in time, and even if achieved, could be expected to inhibit design improvements. 48-721 0 - 79 - 10 PAGENO="0146" 142 Answers to Questions - J. R. Dietrich In summary some level of standardization of control rooms for similar power plants appears to be a desirable objective. The first step, however, should concern itself with the issue of drawing the line between general layout issues (where gains can be achieved), and specific design issues (where standardization could prevent or delay needed improvements). Question 9 How should the design of the control room be improved? Answer Given the development of generalized control room layout standards as discussed above, the potential for remaining improvement lies principally in two areas: - Presentation of measured data to the operator, and - Correlation and analysis of measured data for the operator. A common objective underlies both areas; i. e., facilitation of an accurate perception of plant status by the operator. Considerable effort over a number of years has been directed toward im- provement in these areas. The promising approaches are those cited in the answers to questions 3, 4, and 5. Question 10 Do you believe that additional water in the steam loop of a PWR would enhance reactor safety, and if so, how much additional volume? Answer Additional water inventory in the secondary loop of the steam generator in- creases the time available to restore feedwater flow once it has been lost. Clearly one will reach a point of diminishing return with respect to safety once the water inventory has been made large enough to forestall the need to restore feedwater flow for several minutes. I believe many of the plants now operating with recircu- lating steam generators have water inventories large enough that further increases would not provide a worthwhile increase in safety. However, I have not yet seen a formal analysis of this question. Once such an analysis is made judgements can be made with respect to individual plant designs. Question 11 Do you believe two steam generators are adequate for a 1000 MWe plant? If not, how many generators would be appropriate to enhance safety? Answer I believe that two steam generators, if properly designed ano constructed, are adequate for plants of capacity up to the maximum licensable under current PAGENO="0147" 143 Answers to Questions - J. R. Dietrich NRC rules (3800 MWt, corresponding to about 1300 MWe). From the point of view of redundancy of shutdown heat removal capability two steam generators are as acceptable on a 1300 MWe plant as on a 600 MWe plant. In absolute terms I believe that this redundancy is adequate, since operation is not permitted if there is substantial degradation of steam generator integrity. The only postulated transient I know of whose amplitude is larger in the case of two steam generators than in the case of a greater number is the steam line break accident. The effect to be countered is an increase in reactivity due to the cooling of the primary system water: this is accomplished by dropping the control rods. The somewhat greater reactivity swing which characterizes the two-steam-generator case is not impor- tant if adequate control-rod reactivity worth is provided, as it is. Again, the power capacity of the plant is not an important factor-a large plant with two steam gen- erators behaves much the same as a small one under steam-line break conditions. Question 12 Although it has nothing to do with TMI, what is your professional opinion regarding the potential for a reactor to run "out of control" if the fluctu- ation in nuclear fission activity should begin to oscillate in sympathy with mechanical vibrations or temperature deformations in reactor components? Answer I believe there is essentially no potential for a reactor to run "out of control" through sympathetic oscillation. The only coupling between reactivity and mechan- ical vibrations or deformations of components outside the core would be by way of the moderator temperature coefficient of reactivity. That coefficient is not large enough to produce large reactivity swings under any circumstances of mechanical vibration or deformation that I can imagine. Moreover, the negative Doppler co- efficient of reactivity provides a very strong damping factor against reactivity os- cillations. Finally, the period of any sympathetic reactivity oscillation would be several seconds long because of the thermal time constant of the reactor fuel and because of the transit time of water around the primary circuit. Consequently the control rods would have ample time to shut the reactor down following a reactor trip on high power level, even if a large amplitude oscillation could occur, and I believe a large amplitude oscillation is impossible except as a result of xenon fluctuations which are extremely slow, with periods of several hours. Question 13 What is your opinion of a reactor control system that could be interrupted with a simulated accident problem without the operators knowledge? (During this period, the reactor would be operated by a computer and if during that time a real problem arose, the simulated problem would be automatically dismissed.) Answer The use of such a reactor control system would lead to undesirable conse- quences. The only benefit would seem to be that new data would be collected on the performance of individual operators under stressful conditions. There are two strongly negative factors: first, operator response to an actual accident might PAGENO="0148" 144 Answers to Questions - J. R. Dietrich be degraded; and second, some degradation in reactor control system reliability would be expected due to the substantial increase in system complexity and equip- ment sophistication. Moreover, operational experience during transient conditions has shown operators to be relatively calm under stress. Errors seem to most often result from either the inability to properly interpret the data presented, or from an im- perfect understanding of the consequences of specific actions. We would expect the error probability to be particularly high during the course of a real accident, if it were to interrupt a `simulated accident' of a different nature-the sequence of simulated and real behavior would be highly confusing to the operator. Question 14 Regarding the man/machine relationship, what are the pros and cons in operating a reactor from a small control console where status and trend data can be read on a terminal on command. Answer Operation of the reactor from a relatively small console is both achievable and desirable. Console size would necessarily be larger than a single terminal to avoid completely unacceptable information density. For example, the master control consoles in some recent C-E plants are U-shaped and sized to mount ten cathode ray tubes. This results in approximately a 14-foot span between wings. Controls for plant operation from hot standby to full power operation are located on this console. During accident situations, total plant status information is available from the console, but auxiliary panels within the control room may house the necessary controls for actuation of appropriate plant equipment. PAGENO="0149" 145 J. E. Myers SYS-A-0l3 June 19, 1979 Page 1 of4 * INFORMATION PERTINENT TO QUESTIONS 3, 4, AND 5 Operation of a commercial nuclear power generating station requires the surveillance of several thousand pieces of instrumented data. The station operators are responsible for providing this surveillance and for making control decisions based upon this data in a safe, economic manner. Technological tools are available within the "state of the art" to reduce the complexity of the operators surveillance tasks and to enhance the operator's comprehension of the data. Technology is not available to replace the operator in the overall plant control/decision making role. The human brain, with its unique abilities to learn and to extrapolate, is required to effectively monitor and control the complex, interrelated processes of a nuclear power plant. There are two key areas where current technology can improve the operators performance: Human engineering of the operator's interface to the power plant to optimize the operator's comprehension of the status of the plant processes. Automation of certain elements of the routine daily tasks to free up the operators time to concentrate on the more important aspects of his job. HUMAN ENGINEERING C-E has performed research on the human-engineering aspects of the oper- ator- process interface. In its studies C-E concentrated on two basic areas: the reduction in the complexity of the information presented to the operator, and in optimization of the method of data presentation to the operator. Reduction in Information Complexi~y~ The goal of reducing information complexity is one of reli~y "condensing several instrumented data points into a single index that provides all of the pertinent information on the actual plant parameter of interest. This goal is achieved in a two-step process. The first step is to systematically analyze the various processes of the plant to determine candidates for condensation. The second step is to impl~ment a scheme to reliably automate the "condensation" process. PAGENO="0150" 146 J. E. Myers SYS-A-0l3 June 19, 1979 Page 2 of4 An example of this condensation process is the Core Operating Limit Supervisory System (COLSS) that is implemented on recent C-E plants. COLSS is an integrated reactor core supervision system that is implemented in a digital computer. COLSS monitors several hundred measured process parameters and condenses these measurements into three easily understood performance indices that are displayed and alarmed to the operator on-line, in real time. AnOther example is the hierarchical display and alarm system that is the major operator interface in C-E's most recent control room designs. In this hierarchical arrangement, all plant systems are categorized in a hierarchy that parallels the operators s hierarchy of tasks. This system is impiemented with multi-color cathode ray tudes (CRTs) and digital computers. The three tier hierarchy has at its top level a monitor display. This monitor display provides a condensation of the status of all subsystems and components in a major plant process. Alarms and anomalies on a lower tier trigger alarm behavior on the monitor level that highlights the affected system, and cues the operator automatically to the next lower tier display that provides greater detail on the alarm situation. On the next tier below the monitor display are the control displays. Each of these displays contain the information required to effect control of a major plant process or component. Data related to the control evolution are also displayed for operator convenience. The control displays also provide a level of information condensation. Component symbols provide alarm behavior based upon the status of a number of measured data points represented at the lowest level of the hierarchy. The operator will receive an automatic alarm cue to the next lowest level if pertinent alarm information is contained there. The diagnostic displays reside at the lowest level of the hierarchy. These displays contain all the information that is monitored on any particular component or subsystem. The operator can maneuver vertically through the display hierarchy, "zooming in on a problem; orlaterall~/ through the hierarchy, scanning related systems and processes. The operator can also jump directly to any display in the hierarchy without traversing the intermediate displays. The operator interface device for display selection is a simple keypad, similar to a pushbutton telephone from PAGENO="0151" 147 J. E. Myers SYS-A-0l3 June 19, 1979 Page 3 of 4 which he can easily traverse the hierarchy, assisted by the automatic computer cueing. Optimization of Data Presentation C-E's research has indicated that a critical element in improving operator performance is in tailoring the presentation of displayed data to human characteristics. Computer technology has provided flexibility in information encoding techniques that allow the presentation of data to be optimized to both the operator and the specific task he is expected to perform. In C-Es studies, color, blink, symbolic format, physical orientation on the display, and information density and update technique are all used to encode display information to in- crease the operators comprehension and performance. The system is designed to highlight color abnormalities and anomalous readings by changing the shape and format of the data when the reading reaches a preset limit. C-E studies have shown that a great amount of information can be condensed into a single display. However, these studies indicate that reduction of all necessary information into one display is not practical with current methodology or technology. A great reduction of necessary display area is possible, and is the cornerstone of our most recent control room arrangements. These state-of-the-art control room arrangements address many human engineering factors in addition to those related to CRT displays. The design methodology includes consideration of criteria on such variables as maximum distance between any two control functions, minimum distance between separate control devices, viewing angles, number of operators ~required (normal operation, startup, shutdown, and accident conditions), and access by non-operator personnel. Panel layout concerns such as functional groupings, symbols, left to right organization (heat source to heat sink in current designs), and color representation have been addressed and standardized where practical. In most of these areas, human engineering factors are adequately defined and may be implemented in a straight-forward fashion. Another area that has received additional attention is that of `seldom used controls". These are the controls the operator might be required to use in an accident or other abnormal operating con- dition. Methods to better guide the operator in these situations are incorporated in the design of the panel layouts and the related data presentation. PAGENO="0152" 148 J. E. Myers SYS-A-Ol 3 June19, 1979 Page 4 of 4 All of these factors must be integrated into the control room design process in order to obtain the maximum advantage from computerized information processing and display systems. AUTONATION The second key area of potential improvement in operator performance is the automation of selected tasks to remove some of the surveillance burden that the operator is required to perform. The most pertinent area of automation is that required for surveillance of the operability of the plant safety systems. ,-E is implementing a system to monitor the alignment of pumps and valves in response to NRC Regulatory Guide #1.147. This system will provide annunciation to the operator if misalignment of an instrumented pump or valve occurs. We are also developing a computer based system to assist the operator in alignment of pumps and valves for periodic actuation testing. This systemprovides positive indication of-correct system alignment for test and positive indication when post test realignment is achieved. Hard copy test documentation is then produced of test results and correct system alignment. C-E has implemented systems that automatically monitor the status and operability of the Reactor Protection System. When problems are detected, annunciation is provided to alert the plant operations staff. However, restrictions placed on the implementation of these systems by interpretations of existing regulations has had the effect of stifling industry impetus to develop these automated monitoring systems. A more realistic approach in the NRC evaluation of the safety significance of.these systems is required. PAGENO="0153" 149 (RI Displays for Power PlanEs M. M. DANCHAK Combustion Engineering, Inc. DISPLAYING POWER PLANT data on multi- colored, computer driven CRTs provides the poten- tial for raising operator-machine interfaces in these plants to new heights. The amount of detail and flexibility inherent in color CRT displays promises better and more timely information. However, the mere existence of such promises adds little to a power plant control room. The critical task is the exploitation of this potential in an intelligent manner. Technology has removed many constraints from the machine portion of the interface. Equal effort must now be placed on the human aspects. Although the eye can sense all the information on a CRT face, the brain cannot begin to act on that amount of detail. Some mental processing must take place before any information can be entered into human memory. This usually involves some form of feature extraction and/or pattern recogni- tion on the operator's part to encode correctly the information for internal storage in short-term memory. Such storage is the initial step in display comprehension. To aid this mental process, a determined effort must be made to keep each display as clean and unobstrusive as possible. This effectively reduces Color CATs with graphic capabilities certainly have complicated the task of display design. De- signers now have to worry about color assign- ments, contrasting, symbols, blinking and a host of other variables. The author offers guidelines for effective color CRT display design, concen- trating on the human factors aspects of various techniques. the noise level of the display and consequently de- creases the human search and processing time re- quired for information detection and comprehen- sion. An effective display should not require any conscious effort for analysis on the part of the oper- ator. He must be able to immediately grasp the situation and take appropriate action. A designer of CRT displays that satisfy these criteria must have a thorough understanding of the power production process, display techniques and, most importantly, the operator. Such total understanding is seldom found in a single indi- vidual. This article offers guidelines that permit users, who are familiar with power plant operation but not specifically knowledgable in display tech- niques, to create effective CRT displays. Performance parameters Optimization of operator performance entails an appreciation of the variables that influence an op. erator and variables that can be influenced by a display designer. Operator performance has been defined (Ref. 1) as a function of several variables: * complexity of information * operator tasks * operator characteristics * environmental factors PAGENO="0154" * type of information displayed * density of information * method of presentation. 150 Although all of these may impact operator perform- ance equally, the degree of influence a display de- signer has on each variable is very subjective. Figure 1 illustrates the grouping of these variables in power plant applications. Typically, the opera- tor is required to monitor large numbers of dis- crete parameters. The complexity of information and operator tasks are predetermined and there- fore not under the control of the display designer. Likewise, he has little or no input in determining operator characteristics or environmental factors. The designer does, however, have a large and often sole impact on the remainder. He must decide what to display, how much of it to display, and the most effective format in which to present it so as to maximize operator performance. Operator tasks Analysis has shown that the operator is involved in three major tasks: monitoring, control and diagnos- tic. Unfortunately, these areas are too broad to base guidelines upon, since each entails many sub- tasks. Five tasks, however, have been identified (Ref. 2) that appear basic to CRT display reading and may be appropriated to serve as generic sub- functions. These five tasks are: identify, search, count, compare and verify. Table I illustrates their meaning in the context of the power produc- tion process and lists them in descending order of frequency. The search task is performed at all times, since an operator is never concentrating solely on the CRT. He must find the target before processing the infor- mation according to one or more of the other tasks. Identify, the simple act of recognizing the target, also is required in all instances. It is often difficult to separate search and recognition tasks, since both are involved in bringing the operator's atten- tion to the correct target. Only after successfully completing these functions can he begin to process the information. Processing then involves the tasks of comparison, verification and counting. This implies that a designer should optimize the display for search and recognition and then satisfy criteria for the remaining tasks. This is a restate- ment of requirements for a "clean" display men- Not under control of display designer htrumented L_ Poramete~~f ~~oity of kerator~~~I ,/ information j ~ / / [~operator I / Icharacteristi~I / I / Ennironmentall factnrs I / [i~hodof I / PmentatIOfsj / / / /_______ ________ / ~Type of* I Eó~nsity Information I of / disptaye~j information J Operator 1 performanc~j Figure 1. Of the seven variables than affect operator performance. only three are under the direct control of the display designer. To generate an effective display, however, the designer must take into account those variables over which he has no control. Under control of display designer PAGENO="0155" 151 tioned previously. Regardless of how important a parameter is, it becomes noise when the operator is looking for something else. Anticipating operator needs is an extremely difficult assignment. One is more inclined to use the saturation approach-dis. play everything. But this is self-defeating in the long run. The primary maxim of effective display design is to give the operator what he needs, only when he needs it. Informative coding Information displayed on a CRT is often coded ac- cording to various schemes. The English alphabet represents a coding scheme in that an entire con- cept may be represented by one or more letters. Numerics is another example of coding in which quantities are depicted by a string of digits. Sym- bology is a third example, where unique arrange. ments of lines and curves depict pumps, valves, transistors and other components. The question here is how to best code information to accomplish a given task. Since the definition of information is "knowledge that was not previously known," many items such as labels do not necessarily qualify at all times. Human factors literature abounds with treatises on abstract coding methods (Ref. 3) that use single letters, digits, shapes or colors to depict complex ideas. While much of this data is directly appli. cable, a large majority must be treated cautiously. A random string of alphabetic characters such as "uppm" may be used abstractly to represent the concept of a device that transfers fluids by suction or pressure. One may use this coding scheme to ob. thin search and identify task response times. A rearrangement of these letters to form the string "pump" would result in quite different times due to operator familiarity. The point is that each area of application has its own convention and coding biases that are not abstract. Human factors re- search provides excellent data that must be judi- ciously extrapolated to individual areas of concern. Such an extrapolation yielded five applicable cod. ing methods: numeric, textual, shape, color and blink. Although these agree in philosophy with basic human factors definitions, some modifica- tions were made. Numerics refers to digital strings representing some measurable value of a parameter such as temperature or pressure. Textual coding connotes alphanumeric strings arranged to form a meaningful word or words common to the power production process. Logical abbreviations of words also qualify under this scheme. Shape encompasses standard power process symbols (pumps, valves) as well as geometric objects (bars, columns). Color and blink have been shown to be most effective when used as redundant codes (Ref. 4-6). This means that color and blink should be used to rein- force information coded by other means, such as blinking a pump symbol in an alarm color. Figure 2 is a summary of recommended coding schemes for power production CRT displays. Each task has associated recommended coding methods indicated by a checkmark. Compare, verify and count tasks are further subdivided into "check" and "read." A check subtask is one that has a dis- -. crete number of status states (on/off, open! closed), whereas the read subtask has variable states, such as the value of a fluid temperature. Reading involves more mental processing since Figure 2. A variety of coding methods are available, but some methods are more suitable for certain oper- ator tasks than others. Recommended coding meth- ods are indkated by an "x", while the asterisk indi- cates redundancy. Table I: Operator Generic Subtasks Subtask Question type Example Search Wherein? Where is the flashing symbol? Identify What is? What does the flash- ing symbol represent? Compare Yes/No Istheflowequal in both coolant loops? Verify True/False The oil lift pump has been actuated Count How many? How many valves are open in the letdown PAGENO="0156" 152 people have a tendency to "vocalize" what they read. Perceiving a status does not require this translation. Test and shape coding should be used for the search and identify tasks. Successful completion of these tasks results in focusing the operator's atten- tion on a specific portion of the CRT-they do not involve processing the information located there. A pump symbol, perhaps with amplifying text, easily allows the operator to find the correct pump on the display. Likewise, the name of a parameter will accomplish these tasks provided the operator knows what he is looking for, as in an operator initiated search. Computer initiated searches occur under alarm conditions, when a parameter has exceeded its accepted value and the operator must be informed. In situations such as this, color and blink are at their best since attention-getting is required. The status checking subtask is similar in compar- ing, verifying or counting tasks. Since only a small number of possible states exist, status checking is quick and requires simple coding methods. A sym- bol that has few possible configurations is ideal in this case, particularly when color is used to rein- force the status message. For example, a circle with the circumference colored may be used to indicate one state while the same circle with both the cir- cumference and interior colored indicates another. A unique color for each state further enhances the concept. Reading subtasks require the acquisition of very specific information from a large number of possi- bilities, such as one temperature out of a possible range of hundreds. Within the context of informa- tion theory, this represents more information than a status check. Hence, one must pay the price of Table II: Recommended color codes more lengthy processing. The only feasible means of coding this information is numerics. Once the information is assimilated, the operator performs his comparison, verification or counting. It should be emphasized that color is not used as a code in relation to these tasks. The color of the numerics may change to indicate an alarm, but this is done to aid the search task. Legibility and contrast are the only color considerations and do not constitute coding in the real sense. Colorful conventions As mentioned earlier, the display designer must conform to conventions in the application area to make coding easier. Numerics, text and shapes should be familiar to the operator. What may seem unnatural in one application may be perfectly logical in another. This is particularly true for color coding. Red and green are often used in the power industry to indicate on and off respectively. This poses a problem for the display designer because he may think of red as a danger color. Does he use red to indicate both conditions, does he select a different color for danger, or does he try to change the con- vention? How does he reconcile this in light of proven human factors data? This problem may be alleviated if he remembers that he too has been biased. Everyday life has programmed him to re- spond to red as danger just as the operator's job has trained him to respond to this color as "on." The operator may function under a double stand- ard, red meaning "on" while operating the plant and meaning danger while driving his car. Chang- ing the convention or using the same color for both conditions will surely introduce confusion. The criteria for alarm colors is that they be unique, logical and fit within existing standards. Color CRTs further compound the problem in that any item drawn on the screen must be in some color to be perceived. Table U represents onesolu- tion for a color CRT that accounts for prior con- ventions, search criteria and legibility require- ments. Black is the unactivated screen color and serves as a logical background. Dark blue lies far below the eye's spectral sensitivity peak and may be difficult to perceive when the eye is stimulated by other colors on the CRT. This is used to advan- tage for labels and other purely advisory status items. If the operator wishes to read the label asso- ciated with a variable, it becomes information. Otherwise it is noise. The poor contrast of blue on black reduces the noise impact but still allows the label to serve as information when the operator focuses on it. Cyan (light blue) has a contrast ratio close to white but avoids the greater stimulus from the longer wavelength components of white. The PAGENO="0157" 153 corresponding legibility of cyan makes it applicable for numerics and alphanumeric text that always contain information. Red and green retain their conventional on/off definitions while white is used as an intermediary between the two. Thus a variable speed pump sym. bol would be colored green when off, red when fully on, and white when partially on. Yellow and ma- genta provide logical alarm colors as well as excel- lent contrast with black for portrayal of necessary alarm information. Also, their uniqueness aids the search task. Blinking should be used only for attention-getting in the search task. A single blink rate between 2 and 5 Hz should be used in all instances and the number of items blinked at a given time must be held to a minimum. The attention-getting value is greatly diminished when more than one display area is blinking. Also, blinking degrades legibility, making value reading difficult (Ref. 7). If the parameter value is blinked for attention-getting, some means must exist to stop the blink prior to processing that value. An acknowledge function satisfies this criterion nicely by allowing the oper- ator to respond prior to evaluating the information. Otherwise, blink the area near the parameter, but not the value itself. Overloading the screen Information density involves determining how much data can be placed on the screen before the amount begins to adversely affect the operator's ability to perform his basic tasks. Ideally, one ex- pects a single information/unit area figure based on a detailed information theory analysis. In the practical world, there are too many variables to make such a figure useful and one must settle for intuitive results tempered by psychophysical data. Advice given in this section assumes a 19-in. (48.26 cm) diagonal CRT located 28 in. (71.12 cm) from the operator. The span between the operator and the CRT is the optimum viewing distance for a CRT of this size (Ref. 8) and within the operator's reach (Ref. 9). The cleanliness of a display determines the opera- tor's ability to successfully perform his search and identify tasks. When he scans the display for a specific parameter or target, all other information on the screen is noise. It is intuitively obvious that an upper limit exists on the amount of active screen area. Quantifying this is another matter. Experience shows that display loading (the per- centage of active screen area) should not exceed 25 percent. This may seem extremely low until one considers that a well-designed page of printed material has a loading of only 40 percent (based on the author's analysis of the journal cited in Ref. 1). An analysis of existing CRT displays that were qualitatively judged "good" revealed a loading on the order of 15 percent. The remaining area consti- tutes "white space" that is essential for clarity in any display. Furthermore, the amount of variable data on these displays never exceeded 75 percent of the total active area. The product of these limits dictates that no more than 18.75 percent of the Figure 3. Textually coded infor- mation should never exceed 12 60 - characters, because it is difficult for an operator to comprehend that much information at a glance. 5C I I Important information, such as 0 2 4 6 8 0 12 4 6 numeric values, should not cx- Number of choroclers ceed four characters. t 80 ~O 70 PAGENO="0158" 154 screen should contain information of continued interest to the operator. Density within the display is also an important coneideration~ One would like to know the maxi- mum number of characters, the appropriate sym- bol size, and proximity to other information areas. The average visual angle for central foveal vision is quoted at 5 deg (Ref. 10). Stated more clearly, when one fixates on a point, one sees information within a 5-deg solid cone to 50 percent accuracy. This 5-deg angle is also called the "span of atten- tion" and is an important parameter that has great impact on display design. Figure 3 illustrates the practical application of this psychophysical fact. The operator's attention span translates to 2.44 in. (6.21 cm) measured on the screen face. A survey of various display vendor data indicates that the average character width, including allowance for character spacing, is ap- proximately 0.2 in. (0.5 cm). When arranged hori- zontally, 12 characters can fit within the 5-deg cone. Hence an operator can see a maximum of 12 characters at a glance. To improve accuracy, tex- tually coded information should not exceed 6 characters, although labels can be up to 12. Numerics usually require more accuracy since they are heavily laden with information. Therefore, numerically coded information should never exceed 4 digits without good cause. This produces an aver- age reading accuracy of 90 percent without being overly restrictive. In all cases, the horizontal ar- rangement of characters is preferred to the vertical (Ref. 11). Since the span of attention defines discrete areas of the CRT, it is advisable to have each area con- tain only one piece of information. One would want to separate fixation points of different parameter values (i.e., pressure and temperature) by 2.44 in. (6.21 cm) so the operator sees one idea with each glance. Likewise, two parameters that are consis- tently compared should both fall within the same span. This explains why the best arrangement for comparison is the columnar form. To minimize the number of characters in a word, abbreviations can be used when necessary. If an accepted abbreviation does not exist, one can be fabricated using the concept of masking and/or vowel deletion. The first and last few letters of a familiar word are seen more clearly than interior characters. This is predominantly due to the proximity of white space on either side of these letters while the interior is effectively masked by other letters. Within the context of the power production process, TEMP is an accepted abbre- viation of "temperature" while masking can be applied to "boiler" to yield BOLR and still retain the meaning. Another technique of abbreviation is to delete vowels, as in "condenser" and CNDNSR. (Caution: Such abbreviations should be tested prior to their use.) A final point deals with the placement of informa- tion on the screen. When the operator turns his attention to a specific CRT, his initial fixation point naturally falls at the center. Does he search the screen from this point in any predetermined manner? It has been shown that search times are significantly faster than the average for targets in the upper right quadrant and slower for those in the lower right (Ref. 12). No difference exists for the left two quadrants. These findings can be used to advantage by placing the most important infor- mation in the upper right quadrant and the least important in the lower right. Recommendations for information density are summarized in Table ifi. Obviously, these are general in nature and should not be used blindly. The display designer must balance them against his experience for each and every display. Selecting a method Method presentation, which deals with organiza- tion of the overall display, is the final variable Table Ill: Recommended Density Values 25% 18.75% 12 characters characters or tess 12 characters 4 characters or less 2 in. (5.08 cm) I in.(2.54cm) Horizontal 2 in. (5.08 cm) Upper right Upper sf1. tower left Lower right Total display loading Maximum: Dynamic display loading Maximum: Text word size Maximum: Recommended: Numeric word size Maximum: Recommended: Symbol size Maximum: Recommended: Word Orientation Word spacing Preferred quadrant (is order of preference) PAGENO="0159" under designer control. All displays can be categor- ized into three major groups: alphanumeric, graphic and representational. Alphanumeric dis- plays use strictly textual and numeric coding and are necessarily dense. Graphic displays contain line or bar charts to indicate trending, history, etc. Some alphanumeric data are required in support. The representational category uses symbols to a great extent and includes mimics and one-line dia- grams. The display designer must decide which general category best serves his purpose and pro. ceed with the design from there. Major operator tasks-monitoring, controlling and diagnostics-can now be used to aid in this decis. ion. Figure 4 shows the recommended category for each area. Monitoring tasks reqUire a broad view of large systems or subsystems. Key parameters that affect overall system operations are displayed and used to evaluate performance. Such displays must be clean and easily grasped, Figure 5. The repre- sentational category satisfies these requirements nicely. Symbols denoting major system compo- nents indicate status and overall functioning. Graphic displays may be used to support this over- view in selected instances. The controlling task involves activation and man- ipulation of specific items of equipment. Informa- tion concerning this equipment must be displayed to allow the operator to perform his controlling task, Figure 6. One expects the level of detail to be greater than that required for monitoring, but not needing every measured parameter. Here again, the representational display functions best while a secondary means is available with the al- phanumeric category. Diagnostics necessitates the greatest amount of detail, but treats a very small portion of the entire system. At this level, symbols are of little value. Alphanumeric displays for diagnostics may con- tain every conceivable parameter related to the problem at hand, Figure 7. Search times will be longer due to the amount of detail, but tins can be tolerated in light of the benefits received. How- ever, there is no requirement for these displays to be arranged in purely columnar form. Groupings of related parameters may be distributed on the screen in a logical manner to enhance search and! or may be interconnected in order to emphasize interrelationships. The display designer decides which category is applicable and then considers the format, coding, density and rates of change. The format deals with the layout of individual pieces of information and how they are related. Coding involves deciding how the individual pieces are best represented, while density requires the application of recommenda- 155 Figure 4. Major operator tasks are best ssr~ed by certain display types, as shown here. After determin- ing the display type, the designer still must decide on the best coding method to employ and the proper level of detail. Figure 5. This representational display of a nuclear steam supply system presents information necessary for monitoring overall operation of the plant. If more detailed subsystem information is necessary, the op- erator may request it. PAGENO="0160" -~ iii ~ ~ A? 2 ~ ~ ~ 555 2.0$ ~ ~ 555 2.5* I is 555 -~ 5. Figure 7. If the motor section of pump 2A has a prob- em, the operator can request a diagnostic disptay which provides all pertinent information in alpha- numeric form. Information on this display is grouped functionatly and interrelationships are shown with connecting lines. tions in Table ifi. Since CRT displays are used to indicate plant operation, dynamic data are of ut- most importance. The designer must now evaluate his display in terms of rates of change and how well these changes can be detected. This procedure is part of a design methodology. Designing displays Determining the purpose of a particular display is the first step in display design. Each variable that will appear on the display should be justified, in writing, on a display form. Display design forms should ask both philosophical questions of the de. signer (purpose, special considerations) and speci- fic questions regarding particular parameters that need to be displayed. Since the determination of specific display param. eters is the end result, it should be specified first. Then, and only then, should the proposed display be analyzed to determine if sufficient data exist to yield the desired result. The input must never de- fine the output. This ensures a fresh look at the system by the user with current technology in mind. Historical reasoning (we always did it that way), while valuable for confirmation, is a poor base on which to build a new design. Filling out design forms defines what is to be done, not how. Detaiis on how the output accomplishes its objective is determined next. Given a defined output, the designer then decides which display category is most applicable. Here the guidelines come into play, as shown by the recommendations of Figure 4. After deciding on a display method, 156 the designer has a number of detailed items to consider: arrangement, size of active display area, color assignments, abbreviations, character size and spacing, level of detail, type of coding, param- eter placement and rates of change, to name a few. Designing effective CRT displays is both a formid. able and confusing task, requiring the designer to gain expertise in unrelated areas of technology. Guidelines are of little use, however, unless the person applying them is intimately familiar with his particular application process. Guidelines pre- sented in this article are intended to provide an experienced user with advice in areas that are out- side his specialty. The level of sophistication of both instrumenta- tion and display techniques has risen rapidly in the recent past and will continue to do so. Man, how- ever, has changed little and is not likely to do so. Therefore, electronic display devices must be tailored to man rather than have him tolerate fancy but ineffectual equipment. References 1. Bitt, W. fl et al "Development of Design Criteria for Inteiligence Display Formats," Human Factors, Vol. 3, 1961, p. 86 2. Hitt, W. D., "An Evaluation of Five Different Ab- stract Coding Methods-Experiment N,,' Human Fac- tors, Vol. 3, 1961, p. 120. 3. McCormick, E. J., Human Factors Engineering, McGraw-Hill, New York, 1970., 4. Anderson, N. S. and Fitts, P. M, "Amount of infor- mation Gained During Brief Exposures of Numerals and Colors," Journal of Experimental Psychology, Vol. 56, 1952, p. 362. 5. Jones, M. R., "Color Coding," Human Factors, Vol. 4, 1962, p. 355. 6. Smith, S. L. and Goodwin, N. C., "Blink Coding for Information Display," Human Factors, Vol. 13, 1971, p. 238. 7. Smith, S. L. and Goodwin, N. C., "Another Look at Blinking Displays," Human Factors, Vol. 14, 1972, p. 345. 8. Dreyfuss, H., The Measure of Man: Human Factors in Design, Watson-Guptill Publishers, New York, 1967. 9. Morgan, C. T., et al, Human Engineering Guide to Equipment Design, McGraw-Hill, New York, 1963. 10. Woodworth, R. S. and Schlosberg, H., Experimental Psychology, Bolt, Rinehart & Winston, New York, 1954. 11. Woodward, R. M., "Proximity and Direction of Arrangement in Numeric Display," Human Factors, Vol. 14, 1972, p. 337. 12. Baker, C. A., et al, "Target Recognition on Complex Displays," Human Factors, Vol. 2, 1960, p. 51. MICHAEL M. DANCHAK is a Principal Engineer for the Instrumentation & Controis Engineering Div. of Combustion Engineering, Inc., Windsor, CT. Article is based on a paper presented at the ISA Power Industry Division Symposium, San Francisco, 1976. PAGENO="0161" 157 THE MAN-PROCESS INTERFACE USING COMPUTER GENERATED CRT DISPLAYS Michael M. Danchak, Supervisor, Display Systems Instrumentation and Controls Engineering Nuclear Power Systems C-E Power Systems Combustion Engineering, Inc. Windsor, Connecticut INTRODUCTION The past few years have seen exponentially increasing interest in the area of human factors by the process control field in general, and the power generation industry in particular. The seventh decade of the 20th century started with a smattering of papers on the subject, as related to con- trol rooms, and expanded to a formal review by the Electric Power Research Institute(l) completed last year. All the literature criticizes the fact that existing power plant control rooms were designed based on the "leftover" policy. This attitude allo- cates functions to the operator only when it cannot be accomplished by hardware. Furthermore, these "leftover" functions received little or no attention by the de- signers, assuming the operator would soon learn to cope with the given system. Al- though this evaluation may be a bit unsym- pathetic towards the previous generations of control room designers, the fact remains that existing systems do not adequately account for the human in that system. Fortunately, most of the publications do not dwell on the deficiencies of the past, but expound the virtues of the systems of the future - - the so-called "advanced con- trol centers." These are radical depar- tures from their predecessors, using recent technological advances to acquire and dis- play information about the power generation process. Computers, multiplexing equipment and Cathode Ray Tube (CRT) displays are becoming the norm rather than the exception. Attendant with these hardware advances are concerns for the operator and his ability to function in this environment. More than words, however, must be expended to exploit the potential of this new technology. Con- trol room designers are currently presented with a rare opportunity in which they may "atone for the sins of the past." This is possible by intelligently accounting for the attributes, both good and bad, of the human operator. Design of the control and display systems must be done with the operator primariT~Tn mind. While the new developments in technology are invaluable, one must proceed with cau- tion. The application of interactive com- puter graphics to problem solving tasks has made great advances in areas such as com- puter aided design. One is immediately tempted to apply similar techniques to power plant control rooms. Systems have been devised that require all interactions between the process and the operator to occur through the CRT display itself(2). Other systems are much more cautious and merely use the CRT to duplicate the func- tions of the many dials and meters pre- viously used for information display, Both extremes have shortcomings due to poor display design. Insufficient experience with display design and knowledge of the functioning of the human operator precludes direct interaction with the screen at this time. Duplication of previous display me- thods does little to aid the operator in di- gesting the voluminous data. This technique also maintains discreteness of parameters rather than integrating them into the over- all process. Controls and displays should remain separated until effective CRT display systems have been developed and proven suc- cessful. The display system design is the quantum jump in the operator interface. Direct operator interaction may easily follow, if deemed desirable, once the dis- play system has been made effective. The major problem associated with displays is two-fold; the display set organization must take an integrated approach to the power generation process and each display page in the set must be based on sound human factors principles. The latter has been touched on(3) and work is continuing on the details of effective display page design. This paper will concentrate on the problem of organization by analyzing the purpose of the CRT display system and posing a solution in the form of a display design methodology. The efficacy of this approach will then be demonstrated using a simple Nuclear Steam Supply System (NSSS) example. 48-721 0 - 79 - 11 PAGENO="0162" 158 MAN-PROCESS INTERFACE The CRT display system is the operators primary means of determining the status of the process he is trying to control. While the popular term `man-machine interface" may be applied to such interactions, the semantics are somewhat misleading. When one enters and receives information in an interactive graphics application, the in- terface is truly between man and machine (computer). However, in the process con- trol field the operator is more interested in interacting with the process than with the computer. The intermediate machine as- pects should be transparent to the operator to establish a man-process interface. One may consider this a trivial difference, but the designer and the user are certainly affected by that difference. Displays must optimize the interface be- -~ tween the operator and the process, rather than the operator and the computer. The computer is merely an information pathway between the two. The display system is the operator's window to the procesi. As the analogy implies, information in this inter- face travels in one direction only. The operator views the process through the CRT screen and uses his separate controls to accomplish changes. In computer terms, the CRT is an output device, as opposed to pro- viding both input and output. The man- process interface must be designed accor- dingly. Establishing the terminology also estab- lished the purpose of the display system: to provide a decision making tool for the operator in relation to the process. The next question to be asked is, How is this done with the displayed information? How does the operator use the window for con- trol? Models of human perfornance(4) indi- cate that the operator maintains his own internal concept of the process and makes adjustments according to this replica. When the operator looks at the screen, he expects to find certain information that matches his model. - According to current theories of the human perceptual cycle,(5) this model is called a schema. It determines the operator's predisposition to finding relevant data under various conditions. The anticipatory schema directs his exploration of the screen, from which he samples data and sub- sequently modifies his mental model. This cycle explains why we often overlook cer- tain aspects - - they are totally unexpected. Another interesting point is that the data itself does not govern the subsequent beha- vior of the operator. It is the schema, or his hypothesis on the source or cause of this data, that determines what he does next.(6~ The exploration of information continues through repeated observations until the operatoris convinced his hypo- thesis is correct, The task of the display designer is to aid the formulation and modification of this schema with relevant data. Displays must emphasize the unexpected and provide a means by which the operator can establish his hypothesis and either confirm or reject it based on related events. This model of the man-process interface verifies the problem areas stated previously. The indi- vidual display pages must be effectively designed to complement the operator's concept of the process and make the unex- pécted obvious. Furthermore the interrela- tionships between the displays must be logically established to allow the operator to make the requisite observations quickly and intelligently. Display hierarchy is more than a convenient means of organization - - it is a vital tool in determining the operator's ability to react successfully. DESCRIPTION OF THE METHODOLOGY The emphasis of the proposed display design methodology is on integration of displays. When assigned to such a task, the designer typically asks the number of display pages to be created and proceeds from there on an individual basis. A better question is, How many displays does the operator need and how can they be logically related to satisfy these needs? Only then should the details of the individual pages be addressed. The methodology is devised to account for the model discussed in the previous section. The progression in detail also provides an inherent documentation package for each dis- play page in the system. Figure 1 illustrates the steps in the pro- cedure. A display hierarchy is established by defining the purpose and function of the display set and each individual display. This should be done on a systems level that deals with major portions of the plant, such as the NSSS, main steam, feedwater, etc. The next step identifies the display param- eters necessary to accomplish the purpose just specified. Note the heavy reliance on operating experience. This is done to ensure that the display system meets the operator's requirements. Once the output is determined, the displayed data is related to the input available to complete the input- output sequence. With this information in hand, the actual design of the individual display page is done according to human fac- tors guidelines. The final step specifies the processing required to update the dis- played data. Appropriate forms should be devised for each step on the procedure to formalize the process and ensure complete- ness and continuity. Each of these steps will be discussed in more detail in the following paragraphs. PAGENO="0163" 159 ~qplay Hierarchy Coincident with specifying the purpose and function of each individual display page, one must establish a concept of how the pages are related according to the opera- tor's schema of the process. A list of display page names must be drawn up and the interrelationships determined. This con- cept, or hierarchy, ensures an integrated approach and also determines the maneuvera- bility between pages, as will be shown shortly. Such a unifying mechanism tests the effectiveness of the display strategy before time and effort is expended on de- tailed page design. Using the hierarchy, operations oriented personnel may postulate actions of the operator and determine where the required information can be found. Such a paper study improves the efficiency of the procedure without sacrificing flex- ibility or wasting engineering hours. The relatively ew field of hierarchical system theory(7) offers a valuable guide in establishing the system structure. One must decompose the system into subsystems, and those subsystems into sub-subsystems and so on, until a convenient amount of detail is reached. Decomposition may be done according to level, time, mode or other means applicable to the system of interest. The information structure is then defined by specifying the amount and type of information available to each com- ponent. Finally, the degree of coordina- tion and data flow between the components must be determined. The basic techniques of hierarchical system theory will be used without resorting to mathematics or com- plex details. A convenient and applicable level decompo- sition has been establiq~çd during the ana- lysis of operator tasksl ). There is a direct correspondence between the monito- ring, controlling and diagnostic tasks, the methods of presentation and the logical maneuvering between displays. Displays will henceforth be categorized as monitor, control or diagnostic. The hierarchy of this categorization is shown in Figure 2. The highest level display treats the moni- toring task that provides an overall view of the system involved. Beneath this are multiple control displays that show major components of the monitor and provide infor- mation necessary to control that component. The diagnostic display contains all instru- mented parameters related to that component, thereby allowing detailed diagnosis of any problem. The amount of detail inherently involved with the last level may require multiple pages of displays. It should be emphasized that detection of anomalies is not restricted to diagnostic displays, only the level of detail is limited. Alarm indications are available at all levels, as described later, Essen- tially the hierarchy defines levels of zoom' for alarms where the operator moves to the level of detail necessary to deter- mine the anomaly. Given a set of displays, one needs a means of retrieving one particular page of the set for viewing. This establishes the maneuvering mentioned in previous paragraphs. An obvious method is to assign page numbers to designate each display and use the desig- nator for retrieval. Assuming a non-trivial number, a directory is necessary to relate these number designators to the actual con- tents. The operator must scan the directory for the desired information, enter the assigned number and view the information on the CRT screen. Using thistechnique, an operator can randomly access any single page of the set rather easily, provded ho knows the designator. Another technique is to move sequentially through the set from some predetermined beginning. A wrap-around feature would dis- play the first page after the last page in the sequence has been viewed. For added flexibility, movement ~through the sot can be in either the forward or backward djrec- tion. Two simple function buttons are all that are required for retrieval. While this does not require a priori knowledge of page numbers, it requires retrieving an average of N/2 pages before finding the desired information, where N is the number of dis- plays in the set, A combination of the two methods is prefer- able. One can randomly access the desired page with the aid of a directory and then move sequentially through the set, as de- sired, This combined approach will b~ re- ferred to as "paging." It retains flexi- bility, while decreasing retrieval times for displays in the vicinity of the page cur- rently being viewed. This represents hori- zontal movement along the levels shpwn in Figure 2. Although one must put the pages in some soquence, the paging concept does not exploit the interrelationships of dis- plays as defined by the hierarchical struc- To take advantage of the inherent logical progression between levels, one should in- corporate a second moans of retrieval called "sectoring." This technique allows the operator to move vertically through the hierarchy with a minimum of effort. Simple operator actions allow him to move from the monitor level to a related display on the control level and still further to the diag- nostic level, following one branch of the tree structure. Equally simple actions allow progression up the structure as well. While sectoring constrains the maneuverabil- ity to a limited number of displays, the allowable pages are logically related to the PAGENO="0164" 160 current display. Furthermore, no directory or memorization is required by the operator if sector indicators are made an integral part of the display. Maneuverability can be incorporated into the hierarchy by drawing boxes to represent each display page and assigning page num- bers to each box, as shown in Figure 3. This number (204) would be listed in a directory with its associated name, and used to randomly access that display. Hori- zontal maneuverability is indicated by the "Page Back To" and "Page Forward To" en- tries, 203 and 201 respectively. These pages are on the same hierarchical level as the current page and are accessed using some forward/back selection mechanism. The sector numbers attached to the interconnec- ting lines represent the indicators that would appear on the display and that would be entered to move vertically in the hier- archy. Selection of Sector 1 or 2 in this example would result in a movement down- ward to a diagnostic display. Selection of Sector 0 would cause movement upward in all The sample hierarchy of Figure 4 will be used in the example of the next section and is introduced here to illustrate the form of a typical organization. The actual con- tents of each display are not necessary in establishing this structure; only the page names, numbers and a general idea of the purpose and function is required. The pur- pose and function of each display should be documented separately. A wealth of infor- mation is available in this figure, since paging and sectoring is already specified via the notations. The results of this first step may be likened to a functional description of the display system. The tree structure and philosophical descrip- tions of each page tell the user (operator) what the system will accomplish as he will see it. The details of each page are then provided in subsequent steps. Output Description Returning to Figure 1, the second step of the procedure identifies the display param- eters necessary to accomplish the stated purpose of each page. This is a natural progression in detail from the philosoph- ical description of step 1. Information at this point should specify the output varia- bin name, the form in which the parameter is to be displayed (numerically, symboli- cally, etc.) and remarks concerning limits, alarm functioning and so forth. No infor- mation should be specified concerning dis- play layout, since operations oriented personnel provide this input. The data should be gathered on a page-by-page basis to ensure continuity of display page docu- mentation. This nay require duplication of information if the same parameter appears on a number of pages. Input Identification Once the output is defined, one must deter- mine the source of this information. The plant instrument lists are the most logical reference for performing this task. How- ever, this step does more than identify the parameter source. The data processing re- quired to change the input to output is immediately implied and the methodology begins to involve computer oriented design- ers. Conversion to appropriate engineering units, off-set corrections and other needed manipulations become immediately obvious and must be accounted for in the computer pathway. Decisions may also be made at this tine on the need for composed points where multiple instrument channels exist for the same parameter. A further, but important, advantage afforded by this step of the methodology is a cross check on the com- pleteness of the instrument list. ~4ppiay Layout The time has come to finally lay out each display as it will appear on the CRT screen. While a vague conception of the layout may have been necessary for guidance in the pre- vious steps, it is best to start anew. Up to this point insufficient information existed to design the page intelligently. Display creation should be approached method- ically, with sound human factors principles as a base. Too often the original concept used for guidance becomes cast in concrete without considering the details of the lay- out. The guidelines necessary for effective CRT display creation are discussed in Reference 3. Although a manual or semi- manual layout (such as a paper grid) may seen crude, it is really the only way to account for design details. Interchanger spacing, display density and loading, as well as other human factors, are difficult to account for without such a tool. Fur- thermore, the effort involved in laying out the display on paper provides more tine to consider the details. Processing Specification The final step in the methodology is done by those intimately familiar with the display system, rather than the process being con- trolled. Decisions and specifications must be made concerning the real-time updating of the displayed data by the computer. Operations such as limit checking and alarm- ing must be included to make the display useful. This step adds dynamics to an other- wise static picture and requires the appro- priate expertise to make it come alive. The end result of the procedure just de- scribed is a set of interrelated display pages designed to optimize the man-process PAGENO="0165" 161 interface. A complete package of documen- tation is also a consequence of these steps. The package provides the necessary infor- mation on the overall organization of the display set and details on each page as it progressed through the design. An example that illustrates the establishment of a sample hierarchy and the effectiveness of the methodology follows. ILLUSTRATIVE EXAMPLE Consider a simplified NSSS as the system to be controlled. Major components of the pri- mary ioop include the pressurizer, two steam generators, four reactor coolant pumps, a chemical and volume control system (CVCS) and all interconnecting pipes. The task is to design a display set that meets the needs of the operator during normal and abnormal power operations. The logic in- volved in establishing the hierarchy for such a system will be discussed and the end results of the methodology demonstrated using sample displays. Since this dis- cussion is only for illustration, there is no attempt to completely describe the dis- play set. Additional pages are required for a realistic system which increases the number and complexity of the set. The design starts by determining the needed displays and specifying their interrela- tionships. The most obvious display is one that presents an overall summary of the NSSS, showing major components. Each com- ponent or subsystem on this summary usually requires operator interaction, hence a dis- play page will be allocated to the pres- surizer, each coolant pump and CVCS. Al- though the steam generators are an integral part of the system, no operator interaction is provided on the primary side. Therefore, the displays for interaction with the gene- rators would be included in the set for the secondary (BOP) side. It is apparent that many parameters are measured that are only of infrequent interest to the operator. This does not imply that they are not impor- tant. They certainly are under certain conditions, but not continually. Such parameters will be relegated to detailed displays that treat only a portion of each component. Restricting the discussion to only the coolant pumps, each pump may be conveniently divided into a motor section and a pump section. Displays are assigned to treat each of these sections for each pump. To randomly access these displays, a directory is needed to relate page numbers and names. A summary of alarm messages is also desirable to consolidate alarms for easy access and action. Figure 4 shows the organization of such a display set. The overall summary of the system is found on page 101, the NSSS Monitor, the directory (100) and alarm summary (102) are also placed at the moni- tor level. The controlling displays for each subsystem are beneath the NSSS monitor. The control displays for the pressurizer and the CVCS are excluded from this figure for simplicity. Detailed information on each coolant pump is found on the diagnostic level. This structure treats progressively greater details as one goes from the monitor level, down through the control to the diag- nostic level. It satisfies the requirement for logical organization and emphasizes the interrelatedness of the displays in all directions, One can also see how paging and sectoring are implemented early in the design process. The numbers at the top of each display box represent the page numbers and indicate the displays obtainable using the forward/back functions. Paging forward from 202 will display page 203, while paging back displays 201. A circular list for sequential re- trieval is also included in this scheme, allowing the operator to move horizontally along each level rapidly. Paging forward from 204 yields page 201, the start of the control level displays. Additionally, the vertical maneuverability is demonstrated by the sector numbers adjacent to the tie lines between sectorable displays. In all in- stances, choosing sector 0 will cause an upward movement to the next higher level. Following the establishment of this hierarchy and the philossphical definition of the pur- pose and function of each display page, specific parameters must be identified. Each page has a data sheet that lists this information and is used to relate the output to the input. The display designer uses this data to create a detailed layout of each display and then passes it on for pro- cessing specification and implementation. Results of this implementation will now be presented to show the maneuverability af- forded by the hierarchy. Actual COT dis- plays have been created for the shaded boxes of Figure 4 and will be used in the example. Maneuvering through the hierarchy is accom- plished using the Page Control Module (PCM) shown in Figure 5. To randomly access a display (paging), the operator presses the PAGE button, enters the three-digit page number and then presses EXECUTE. The se- lected display immediately appears on the CRT. Paging forward and back along a given level is done using the FORWARD and BACK buttons in the figure. Only one keystroke is required to accomplish this function. Sectoring is performed similar to paging. When the SECTOR button is depressed, the sector numbers appear next to the component on the display. The operator enters the one-digit sector number and presses EXECUTE to obtain the desired display from the next level. Monitor displays typically contain informa- PAGENO="0166" 162 nation necessary to assess operation and status of a systen or subsysten. Param- eters used in these displays oust be care- fully selected to reflect the operation of the entire system being addressed. The recommendations of Reference 3 state that representational and graphical methods of presentation are best suited for monitor displays. However, there are exceptions. A directory listing the available displays is functionally a monitor level display, but requires alphanumeric methods of pre- sentation, as in Figure 6. The operator can select the desired page from this dis- play and access it using the paging tech- nique. The arrow in the lower right corner indicates that more information or overflow is continued on a back page and can be accessed using the FORWARD button. The back page, in this instance, would contain the list of available diagnostic displays. Back pages are not included in the hierar- chy because their need is not apparent un- til the display layout phase. The contin- uation symbol is used only when a back page is required for overflow. A more typical monitor level display using the representational method of presentation is shown in Figure 7. All parameters on this display have a great impact in the operation of the NSSS and concisely depict the functioning of this system. If sec- toring is desired from this display, the operator presses the SECTOR button and the sector numbers (Figure 8) immediately appear next to the sectorable components. If one of these sectors is not selected within 30 seconds, the numbers are removed to maintain display cleanliness. Pressing SECTOR again will reinstate the numbers and allow sector selection as described. Assume the operator selected sector 4, the controlling display for Reactor Coolant Pump 2A (RCP2A). He would then obtain the control display of Figure 9. Control dis- plays aid the operator in his controlling task and should contain all the information needed for control. Parameters that must be observed during the controlling task should all appear on the same display, even though they may be parts of other systens. Operator procedures and guides for control- ling the component are excellent sources for determining which parameters to dis- play. This display is also sectorable to obtain either the motor or pump section of RCP2A. Diagnostic displays contain all the instru- mented parameters related to a portion of the component dealt with in the control display. Figure 10 shows the diagnostic display for the motor section of RCP2A. One expects a great amount of detail at this level and must use the alphanumeric method of presentation. Mimic diagrams are of little use when dealing with a large amount of information on one display. If that amount is too great for one page, back- pages may be used to contain the overflow, as discussed earlier. Alarm indicators should be available at all display levels to help the operator find the offending parameter quickly and with no a priori knowledge of page numbers. These indicators complement the dedicated alarm list that specifies the problem parameter and where to find more information. If the operator is currently viewing a display that includes the offending parameter, that parameter is alarmed on the display and the operator can act directly. An alarm condi- tion for pressurizer pressure is illustrated in Figure 11. An alarm message would also appear on the Alarm Summary display. If the offending parameter is contained on a page further down in the hierarchy, the operator must be so advised. This can be done by alarming an appropriate symbol on the display being viewed and turning on the sector number which would guide him to the display containing the alarmed parameter. At this point the operator may go directly to the desired page, as indicated by the alarm summary message, or negotiate the hierarchy to see if the alarm is causing disturbances in other portions of his system. Assume the operator is currently viewing the NSSS monitor display, Figure 7, and excessive vibration occurs in the motor section of Reactor Coolant Pump 2A. Con- sidering the hierarchy structure of Figure 4, he is currently viewing page 101 while the offending parameter is contained on page 300. The pump symbol for RCP2A on the monitor display of Figure 7 would flash in the appropriate alarm color and the number 4, the sector number, would appear next to it. The results of these additions are shown in Figure 12. If the operator chooses to follow the sectors rather than going directly, he presses SECTOR, 4 and EXECUTE on the Page Co~itrol Module to obtain the control display for that pump, page 203 (Figure 13). The motor section of this pump would also be flashing in the alarm color and have the sector number 1 adjacent. Once again he sectors and obtains the diag- nostic display, page 305 (Figure 14), which has the offending parameter in alarm. Thus, two simple actions by the operator bring him to the level he needs to diagnose the problem. Obviously, if the offending parameter is also contained on the control display, he need not perform the second step. This technique aids the operator in finding the source of a problem, but does not interfere with a different strategy he may feel is more appropriate. It does not force him to act in any way, but only advises him of a logical action. PAGENO="0167" 163 Although this example is somewhat straight- forward, a similar hierarchy must be estab- lished for each and every set of displays in the system. Furthermore, the sets must be tied together at the monitor level to ensure proper integration. The designer may often be faced with situations where control and diagnostic displays exist, but there is no associated monitor. This is certainly allowable and merely implies that the operator must page to the controlling display before using the sectoring method. Some monitor displays, such as directories and alarm lists, may not be sectorable. This is precisely the reason for performing this work early in the design process. The establishment of the hierarchy graphically portrays the display system and its inter- relationships and permits easier design of the individual display pages. CONCLUSION The key element in designing successful ad- vanced control systems is designing suc- cessful CRT displays to optimize the man- process interface. The operator maintains a mental model of the process he is control- ling and uses the displayed information to modify his model for the given circum- stances. The display system must be orga- nized to complement the operators schema and allow him to make the necessary obser- vations quickly. The display design metho- dology just presented places great emphasis on the hierarchy and provides a means of creating the display pages within the hier- archy. A documentation package results that traces the design from conception to implementation in a concise and consistent ACKNOWLEDGMENT REFERENCES (1) Human Factors Review of Nuclear Power Plant Control Room Design, EPRI NP- 309-SY, Project 501, Nov. (1976). (2) Netland, K. and Lunde, J. E., `Experi- mental Operation of the Halden Reactor, Utilizing a Computer - and Colour Display-Based Control Room," Proc. of Specialist Meeting on Control Room IEEE 7SCH1O6S-2, 12, July (3) Danchak, M, M., "CRT Displays for Power Plants ," Instrumentation Technology, 29, OctobNi~(f976). (4) Baum, A. S. and Drury, C. G., "Model- ling the Human Process Controller," International Journal of Man-Machine Studies, 8, 1 (1976). (5) Neisser, U. , Co nition and Reality, W. H. Freeman an ompany (1976). (6) Sheridan, T. B, and Ferrell, N. R., Man-Machine Systems: Information, Control and Decision Models of Human Performance, MIT Press (1974). (7) Schweppe, F. C. and Mitter, S. K., "Hierarchical System Theory and Elec- tric Power Systems," Real-Time Control of Electric Power Systems, B. Handschin (ed), Elsevier Publishing Company (1972). Acknowledgment is made to J.G. Brooks, Combustion Engineering, for initial work in establishing the hierarchical levels. PAGENO="0168" DEFINE THE PURPOSE AND FUNCTION OF THE DISPLAY SET AND EACH INDIVIDUAL DISPLAY IDENTIFY THE DISPLAY PARAMETERS NECESSARY TO ACCOMPLISH THE PURPOSE RELATE DISPLAYED DATA WITH THE INPUT AVAILABLE DESIGN THE DISPLAY ACCORDING TO THE HUMAN FACTORS GUIDELINES SPECIFY THE PROCESSING REQUIRED TO UPDATE THE DISPLAYED DATA FIGURE 1, DISPLAY DESIGN METHODOLOGY PAGENO="0169" S S S FIGURE 2. OPERATOR FUNCTION/DISPLAY HIERARCHY PAGENO="0170" 166 PAGE BACK TO PAGE NUMBER PAGE ~F::wAR 0 TO REACTOR COOLANT PUMP CONTROLLING LEVEL 2B V 12 DISPLAY SECTOR NAME NUMBERS FIGURE 3. DISPLAY PAGE MANEUVERING INDICATORS PAGENO="0171" I too tot ~ [ _______ ~Ib02I1~ NSSS L ALARM SUMMARY ..I...~ I. 204 REACTOR COOLANT PUMP 2A 3ó~] MOTOR SECTION I REACTOR COOLANT L ~ FIGURE 14* SAMPLE DISPLAY HIERARCHY PAGENO="0172" 168 L EXECUTEI 1 2 3 4 5. 6 7 8 9 BACK 0 FORWARD FIGURE 5~ PAGE CONTROL MODULE PAGENO="0173" 1813 100 - P4555 DISPLAY DIRECTORY 101 - MONITOR DISPLAY 102 - ALARM SUMMARY I p~ P ui~tr~ 1~Ut~i1UR ~ 201 - RCPIR CONTROL DISPLAY 202 - RCPIB 203 - RCP2A 284 - RCP2P C UThER CUNTRUL I'I5PLA~'5 1 3 FIGURE 6. SAMPLE DIRECTORY DISPLAY PAGENO="0174" NEUT. POWER 7(H) 7(C) TWO PUMPS, OPP. LOOP PWR LIMIT 58 ~ 101 1813:10 jP 2250 g AL 0 L 75 850. FLOL~ 585 lB IRVE 569 LTDN 48 CHG 44 FIGURE 7 SAMPLE MONITOR DISPLAY PAGENO="0175" TWO PUMPS, OPP. LOOP PWR LIMIT 5! ~ 101 1813:1~ SECTOR NUMBER S (BLINKING) I FL O)~ T (C) NEUT LTDN 6 POWER ~ IAi/( 569 CHG 44 FIGURE 8. SAMPLE MONITOR DISPLAY WITH SECTOR NUMBERS PAGENO="0176" TEMP 235 85 125 115 95 FLOW TEMP FLOW 90 200 203. 1~13:1~ PRES 120 F LOW 3ØØ+l 2.00 1.08 2.01 * STATOR I AIR ~ED LP ~HP I 5531(C) IAYE 569 FLOW 559+6 POWER 50 PRESS 2250 FIGURE 9. SAMPLE CONTROLLING DISPLAY PAGENO="0177" 305 1813:20 MRIU OIL LINE TEMP 105 . COOLERS STPRI~ER ~ FLOW ~ TEMP FLOW ~P 2 ~ ~ ~85 2 00 812 PRE5 18 B85 2.00 TEMP II BKSTOP OIL 138 UP RAD BRG 135 PAIP4 OIL TANK AXIAL BRG 148 LEVEL 70 STRTOR 228 PRE5 110 LW RAD BRG 147 I TEMP PRES UP JRN BRG 145 OIL LIFT ~ THRUST BRG 149 5 rUMr LW JRN BRG 151 FLOk 5.08 ___________________________ PRES 50 FIGURE 10. SAMPLE DIAGNOSTIC DISPLAY PAGENO="0178" JE IN ALARM 101 1813:10 NEUT. LTDN 48 POWER CR6 44 TWO PUMPS, OPP LOOP PWR LIMIT ~ 58 t~ 851 FLOL~ 1(H) 585 *7 858 58 "AYE 569 FIGURE 11 SAMPLE MONITOR DISPLAY WITH OFFENDING PARAMETER IN ALARM PAGENO="0179" 181 1813:10 13 SYMBOL ~//(BLINKING IN YELLOW SECTOR NUMBER FOR W"CONTROL DISPLAY +6 £553 (BLINKING IN 559 YELLOW) P1(1)1.. LTDN 40 POWER . CHG 44 TWO PUMPS, OPP. LOOP PWR LIMIT 59 z 850 FLOW TIC) 50 `TAYE 569 FIGURE 12 SAMPLE MONITOR DISPLAY WITH INDICATION OF AN ALARM FURTHER DOWN IN ThE HIERARCHY PAGENO="0180" SYMBOL AIR BLEED ______ LP ~ HP ~ 5531(C) FLOW TEMP FLOW 98 2.11 202 i8i3~ j5 FLOW PRES SECTOR NUMBER (BLINKING IN YELLOW) TE!4P 235 85 125 115 1.88 95 2.88 3.88~ 2.88 12S 1(H) 585 `[AYE FL OW 5'9~ 5,59+6 POWER 50 PRESS 2258 FIGURE 13. SAMPLE CONTROLLING DISPLAY WITH INDICATION OF AN ALARM FURTHER DOWN IN THE HIERARCHY PAGENO="0181" MAIN OIL LINE TEPIP 1,5 FLOw ?.og FLOW 7.00 PRES 10 I MAIN OIL TANK LEVEL 70 PRES 110 .1 OIL LIFT PUMP FLOW 5.00 PRES 50 VALUE IN ALARM 395 1813:20 PIOTOR SPEED 64. VIBRATION 1.8351 TEMP 130 135 140 220 BRG 14? TEMP PRES BRG 145 BRG 149 5 BRG 151 OIL - COOLERS TEMP FLOW A85 2.00 385 2.00 STRAINER ~ -u 2 I. BKSTOP OIL UP RAD BRG AXIAL BRG S TAT OR LW RAD UP JRM THRUST LW JRN FIGURE 114. SAMPLE DIAGNOSTIC DISPLAY WITH OFFENDING PARAMETER IN ALARM PAGENO="0182" 178 ALPHANUMERIC DISPLAYS FOR THE MAN-PROCESS INTERFACE MICHAEL N. DANCHAK, Supervisor, Display Systems Instrumentation and Controls Engineering Nuclear Power Systems Combustion Engineering, Inc. Windsor, Connecticut INTRODUCTION As early as 1949, people working with computers recognized the shortcomings of printing devices for computer output and the potential of cathode ray tubes (CRT's) (1). The speed, bandwidth and flexibility of such a device is ideally suited for dynamic display of computer-generated information. Today the CRT is commonplace in computer terminals, vital to interactive graphics. systems and is being used extensively for display of process control information. In the latter case, the CRT functions as the operators window to the process being controlled (2). This device is rapidly replacing the myriad dials and meters to enhance operator comprehension and make his task more manageable. Alphanumeric displays use alphabetic letters and numeric digits exclusive- ly. They are a major subset of display systems that may include graphic and representational (mimic) ages (3). Color is also implemented in more sophis- ticated systems to add another dimension to improve operator awareness. Regard- less of the level of sophistication, alphanumeric representation is the simplest and most common method of information display. Unfortunately the display techniques used for printers are often carried over to CRTs, with little regard for the drastic change in display medium. This paper attempts to recognize that change and offers suggestions for the intelligent design of such computer output. The basic characteristics of CRT's are surveyed and the attributes of alphanumeric characters discussed from the human standpoint. The characters are then integrated to form display pages that satisfy the operators need for information. Recommendations are made for creating the more traditional lists of alphanumeric information as well as the unusual layouts necessary for process control. All the recommendations are then summarized for easy reference and implementation. CHARACTERISTICS OF CRT DISPLAYS For the uninitiated, the technicalities of the transition from simple printed output to CRT displays is bewildering and frustrating. Terminology has been retained from the television industry, with some major exceptions. The rapid development of the computer-generated CRT display medium without accepted standard definitions and concepts, has resulted in display system vendors using the same terms to mean different things. A short primer on the characteristics of CRT displays is necessary to achieve some level of commonality for sub- sequent discussions. A logical starting point for understanding is the cathode ray tube itself. At the risk of being trivial, basic conoepts must be presented to appreciate the problems. Writing viewable information on the screen face is achieved by accelerating an electron beam and then deflecting it to impact that screen at the appropriate location. Here the electrons kinetic energy is converted to visible light by interaction with the phosphor coating. Deflection of the beam is related to an "address generated by the display system. Since the emission of light from the phosphor decays with time, some mechanism is required to maintain the information on the screen. Storage tubes trace the data only once and depend on another source of electrons to preserve the data. In order to delete information, the entire screen must be cleared and the remainder TIS- 5301 PAGENO="0183" 179 written again. Scanned tubes refresh the data by continually repeating. th'e~tra~e, using one of various scanning patterns. This requires the data to be held in some form of memory for refreshment, but erasing is done simply by deleting the' un~!anted information from this memory. The size of the display area is a parameter that immediately causes confu- sion. As with the home TV, tube sizes are usually quoted in inches of diagonal; 17-inch, 19-inch and so on. English units of measurement will be used for illus- tration, since they are used by tube vendors and are more meaningful in this case. The CRT has evolved with a 3:4 ratio between the dimensions of the ver- tical and horizontal sides. Assuming a rectangle, this yields a nice 3:4:5 relationship between the vertical, horizontal and diagonal measurements, respec- tively. W-ith a 19-inch screen, the sides should measure 11.4 and 15.2 inches. Unfortunately not all this area is avaialable for display, since the tube is not truly rectangular. The parameter of concern, then, is the size of the larg- est complete rectangle that can be drawn on the tube. The nomogram in Figure 1 DISPLAY SIZE SPECIFIED USABLE HORIZONTAL VERTICAL DIAGONAL DIAGONAL 14 25-~--- 23 -1- 18 24± 22 13 23..J1._. 21 17 22-L 4. 20 16 12 21-4--- 4. 19 15 20 11 19 18 19 INCH 14 __________ 17 EXAMPLE 18 10 13 17 16 15 12 9 16 15 14 14 13 8 10 13 12 7 12 11 11 10 8 6 10 5 Fig. 1: CRT Display Dimension Nomogram PAGENO="0184" 180 was devised to alleviate this problem, based on empirical data. One merely selects a specified diagonal and moves horizontally to obtain the dimensions of usable area. For a 19-inch monitor, the usable diagonal is 17.5 inches and the largest rectangle that can be drawn measures 10.5 inches vertically and 14 inches horizontally. These dimensions are extremely important in determining character size, as will be shown shortly. Since various size CRTs can be used with the same display equipment, manufacturers work in resolution units related to the "address mentioned pre- viously. The screen is divided into addressable rectangles called pixels or picture elements, as shown in Figure 2. All patterns on the screen are built Fig. 2: CRT Addressability Levels PICTURE ELEMENT up using one or more of these pixels, whose measured size varies with screen size. Resolution of 256 x 256 (elements x lines) means there are 256 lines on the screen and each line is divided into 256 elements. A pixel may be placed at any one of 65,536 addresses resulting from the combination of 256 locations CHARACTER MATRIX PAGENO="0185" 181 along both the horizontal and vertical axes. For a 19-inch diagonal screen, each pivel would measure 0.055 x 0.0410 (width x height), or 0.050 x 0.037' for a 17-inch diagonal screen. Likewise, resolution of 320 elements x 240 lines (320 x 240) would yield pixels measuring 0.044" x 0.044" and 0.039" x 0.039" for 19-inch and 17-inch screens, respectively. The pixel size, and ul- timately the character size, is predicated on screen size and resolution. Figure 2 also illustrates another variable of character size: the charac- ter matrix. Alphanumeric characters are formed by a suitable arrangement of pixels. It would be extremely tedious to have to build each character every time one wanted to display that character. Therefore, character generators are included in display systems that function as character drawing subroutines. One speci fies a starting location and a code to identify the individual charac- ter. The system then automatically forms the- desired pattern according to a predefined matrix. In this instance, the matrix is composed of 63 pixels (7 x 9), but the actual character uses only 35 pixels (5 x 7). This is often written as a 5 x 7 character embedded in a 7 x 9 matrix; the excess pixels are used for spacing. This involves a critical distinction when computing character size. Using the 19-inch screen and 256 x 256 resolution, the character would measure 0.275" x 0.287". A final characteristic of CRT displays is that of user addressability--- the degree of positioning afforded the user through theTh~it computer. Al- though the display system can address an individual pixel internally,, such precision may not be available to the user. The terms "graphics systems" and "character oriented systems" will be used to distinguish the differences in addressability. Although "graphics systems" implies much more than addressa- bility, its inherent capabilities allow the user to position the start of the character matrix at any pixel location. Thus, the user can vary the spacing and orientation between characters almost at will, as shown in Figure 2. "Character oriented systems" constrain the user to a much coarser grid called a screen matrix, Figure 3. Each element of the screen matrix coincides with a character matrix to form a number of character rows and columns. A "character oriented system" whose resolution is 420 x 405 and uses a 7 x 9 character matrix could display 45 lines of 60 characters each. The user may specify one of 60 locations in the horizontal direction and 45 locations in the vertical direction rather than the full 420 and 405. With this system, all spacing must be embedded in the character matrix unless blank characters are used. With this brief survey one is better prepared to evaluate various systems and weigh the advantages and disadvantages of each. The discussions to follow do not account for such differences and rely on the reader to factor in this information when performing his own analysis. What can and cannot be done with a particular display system is a function of the tradeoffs made by the individual vendor and the market he is addressing. ALPHANUMERIC CHARACTERS In any discussion of alphanumeric (A/N) characters, one must be aware of the impact of charactef4yisibilitY~ legibility and read~bility. Using the defi- nitions of McCormick visibility is the quality of a character that makes it separately visible from its surroundings and treats the pixel level of detail. Legibility is the attribute of A/N characters that makes it possible for each character tq,, be identifiable from others. Readability is the quality that makes possible the recognition of the information content of material when repre- sented by A/N characters in meaningful groupings. Restating the definitions as a series of questions: Can you see it? What is it? and What *does it mean? Since the pixel has been defined to satisfy visibility, this section will deal only with legibility by discussing the ideal character. The proper grouping of characters to form words and sentences is the ultimate goal and is treated in the next section. Assuming adequate contrast and luminance, factors primarily dependent on hardware, one would like to specify an ideal character with which to compare available systems. The form of the character that allows the viewer to distin- guish one from another is determined by character ratio, stroke width, matrix size, font, case and visual angle. Figure 4 illustrates these character attri- butes, their recommended values and representative variations. Character ratio refers to the relationship between the ~dth and height arid infers the square- ness of the character. While the NAMEL( character set specifies a 1:1 ratio (square), reduction to 2:3 may be made without any appreciable attenuation in PAGENO="0186" 182 CHARACTER MATRIX Fig. 3: Character Oriented Display System Addressability legibility (4,6)~ The optimum ratio of the width of each stroke used to form a character to its overall height is given as 1:8 to 1:10(6,7). For self- luminous characters, as found on ç~Ts, the thinner stroke is preferable due to the phenomenon of irradiance (`+J* This accounts for the apparent increase in thickness of a line due to its brightness or contrast. A minimum of 7 vertical matrix locations, or pixels, is required to re- present most letters at a 90 percent recognition rate (6,7). A lesser number results in a significant decrease in legibility, while an increase to more than 10 achieves a corresponding increase in recognition to 95 percent. Given a 5 x 7 pixel matrix as a minimum, it has been found that fewer errors in character recognitj~~ result when a maximum number of pixels is used for the character outline ). Such considerations are very important, since most vendors offer a user definable character set option that could be used to rectify deficiencies in the standard set. Character case has an effect on both performance and preference. Studies indicate that upper ca9~,letters are more legible than lower case and are also favored by the viewer ). Finally, to ensure legibility, the character height must subtend a minimum visual angle of 15-16 minutes of arc (6). The degree of SCREEN MATRIX PAGENO="0187" 183 CHARACTER WIDTH ________ CHARACTER CHARACTER ~ ________ ________ RATIO HEIGHT I I t ________ (W:H2:3T0 1:1) L ~ _______ -~_~-STROKE WIDTH STROKE CHARACTER f________ WIDTH TO HEIGHT _______ _______ HEIGHT I ________ ________ (1:810 1:10) ________ DOT 5X7 ~j~+~j_J 5X5[-~J IX _ _ CHARACTER MAX.NO. ______ MIN. ______ FONT OF DOTS NO. OF ______ (MAXIMUM _______ DOTS _______ NUMBER OF DOTS) ________ CHARACTER UPPER ________ LOWER CASE (UPPER) CASE ________ CASE ________ VISUAL ANGLE (15-16 MINUTES OF ARC) Fig. 4: Alphanumeric Character Attributes subtension must be used as a unit of measure, since the viewing distance may vary for different applications. Conversion to actual character height will be discussed later. One can immediately see that the pixel size has a great influence on the legibility of the individual character. The stacking and arrangement of pixels relative to one another determines all of the character attributes mentioned. While actual character forms will vary with system manufacturer, the ideal character described in Figure 4 will be assumed for the remainder of the dis- cussion. Characters having these attributes will now be integrated into mean- ingful groups to produce readable alphanumeric displays. PAGENO="0188" 184 ALPHANUMERIC DISPLAYS Alphanumeric displays, by virtue of their purpose, tend to contain large quantities of information. It is the designers task to simplify the display by giving the operator what he needs when he wants it. The designer must keep in mind that the operator learns an~ rgmembers, therefore, information about the steady state is often redundant~'°). While a certain degree of redundancy is necessary, the display must be optimized for change detection by the operator. Only by careful consideration of such human factors can the man- process interface be successful. The discussion of this category of displays will follow a list of questions formulated during prior workt3). As shown in Table I, four major areas of concern must be addressed: format, coding, density and rate of change. Each area treats the alphanumeric display in progressively greater detail to produce a readable presentation. Format The format of alphanumeric displays deals with the overall organization of the presentation. Three questions must be answered before considering the individual elements that comprise the display: printed versus flow chart form, arrangement of information, and size of the display area. The majority of alphanumeric displays are lists of messages and/or parameters. However, a sig- gnificant number may involve procedures or guidelines for the operator to follow in specific process control circumstances, such as startup or refueling. Generally it has been found that people misunderstand printed instructions one third of the time (the two-thirds comprehension rule). Under appropriate conditions, significant improvement in comprehension can be achieved using a flow chart scheme. By representing each step or decision in. the instruction sequence\as a separate process in the flow chart arrRngpment, operator compre- hension can be increased to greater than 80 percent ~ ). Therefore, if the A/N display~is used for guidelines or procedures, one should seriously consider organizing the steps in such a form. TABLE I GUIDING QUESTIONS FOR ALPHANUMERIC DISPLAYS FORMAT 1. PRINTED VERSUS FLOWCHART FORM 2. ARRANGEMENT OF INFORMATION CATEGORIES 3. SIZE OF ACTIVE DISPLAY AREA CODING 1. INDIVIDUAL VERSUS GENERIC LABELS 2. ESSENTIAL VERSUS NON-ESSENTIAL DATA 3. MULTIDIMENSIONAL CODING COLOR, BLINK DENSITY 1. NUMBER OF DISTINCT INFORMATION CATEGORIES, PLACEMENT 2. NUMBER OF LETTERS AND DIGITS 3. CHARACTER SIZE AND SPACING 4. WORD AND SENTENCE SIZE RATE OF CHANGE 1. CHANGE OF DATA WITHIN CATEGORIES 2. CHANGE OF CATEGORIES PAGENO="0189" 185 This point is illustrated by Figures 5 and 6. The example deals with a representative procedure the nuclear power plant operator must adhere to fol- lowing a reactor trip. Figure 5 uses conventional printed instruction format to guide the operator through the critical steps. While this traditional re- presentation is adequate, given a sufficient amount of time, there is serious potential for misunderstanding. Figure 6 may improve the comprehensibility of these procedures by using the flow chart concept. The boxes to the right of each branch signify the desirable condition, while the boxes to the left are abnormal and require operator intervention. Although multiple pages are necessary to present the same procedure, search and comprehension times for the entire procedure can be reduced. If the content of the display is such that the flow chart technique is not applicable, one is still not constrained to using a purely columnar orga- nization. The neat lineup of each row of alphanumeric data found in standard lists is valuable for comparison tasks, but adds to the confusion when informa- tion is not related. An implicit line is fpj~qied on the screen by eye motion as the operator scans a row of characters'~ I. If additional but dissimilar data is placed on the same row, there is natural inclination to connect the two groupings. Intelligent rearrangement can avoid such implications and improve comprehension~(Figure 7). While still labeledan alphanumeric display, the information categories are arranged functionally. Information categories are defined as one or more related parameters grouped together. The path from the Oil Lift Pump information category (comprising the related flow and pres- sure) to the Main Oil Tank category (level and pressure) implies a functional relationship between categories but not between the constituent parameters. Spacing and offset tends to interrupt eye movement to negate any implication of interconnection across the screen. * ALL ~CEA'S FULLY INSERTED? (MAN TRIP IF NOT) * REACTOR POWER DECREASING?° * IURB TRIPPED t liEN BKR OPEN? (MAN TRIP IF NOT) $ STM liEN PRES AT 988 PSIA? * FDWTR FLOW REDUCED TO. 5~ FULL LOAD FLOW?. * (HI PRES TRIP ONLY) PZR PWR OPERATED RELIEF YLY OPEN? * (LU STM GEN PRES ONLY) MS ISO YLY SHUT? * (HI CNTMNT PRES/LO PZR PR~S ONLY) SAF INJ INITIATED? * (51R5'4161Y PUS UND y) EMER DIESEL GEN STARTED? $ TWO RCP OPERATING? * PROPER PZR LYL BEING MAINTAINED? (MAN CTRL IF NOT) $ UNIT LOADS XF'RD TO RESERVE SIR SYC XFMR? Fig. 5: Procedures in Traditional ListFormat PAGENO="0190" -~ ~1 0 P~P') mr CD ~1 ..I~ 0 r --i ~ r vi ~ ~ -C ~ I ~ ~-4DcCD~c -~ U ~- vi W-4 I ~ ~ ~ -4 ~ ~ -4 ~C *1 vi ~ r- ~ ~ ~ -4 -n ~ w ~ ~ -v 0 ~ - ~ ~1 ~ m f-- CD 4+ UI -~ ~ ~ P~) ~ Cs) Cs) ~o UI ~4 ~ UI UI ~ ~- -4-J-~ ~-4 -~ ~ uir- (a CD CD -f 0 CO -n 4+ CD -c PAGENO="0191" 187 When explicit lines on the screen are required, such as alarm lists and directories, each line forms its own information category as illustrated in Figure 5. In this case interconnection is not only desirable, but~necessary to form the message string or sentence. Horizontal eye movement must be encouraged by using appropriate spacing between constituent words. Vertical movement must be discouraged by making the sentence a complete thought. More will lie said on this when placement within information categories is discussed. The third point involving alphanumeric displays is that of active display area. The usable display area has been defined in Figure 1. The question now arises as to how much of this area should be covered with information. Margins, forming white space, have long been used in printed matter. But what con- stitutes a margin on a CRT? If one extrapolates from accepted charting tech- niques, an 11 percent margin should be allotted for the longer dimension and a 20 percent margin for the shorter side (13)~ Esthetics is another important, but often overlooked, consideration. Since the operator must view the same set of displays for an extended period of time, a pleasing display would also enhance comprehension. Although it is difficult to quantify esthetics, initial guidance may be obtained from the concept of the Golden Rectangle, which specified a ratio of 0.618034 between active display area borders. This rela- tionship is a naturally occurring phenomenon and appears to be preferred by the majority of viewers(14). Thus the active display area should be a Golden Rectangle that allows sufficient margin without violating the usable display area. A few simple Computations yield a suitable rectangle that meets all of these criteria. As summarized in Table II, the specified diagonal was used to compute the tube size. The horizontal dimension was then reduced by 11 percent and the vertical dimension computed using the golden ratio. The results were rounded to the nearest half inch to define the active display area for representative systems. As seen in Table II, an active display area of 13.5 x 8.5 pro- vides sufficient margin for a lg-jnch screen, approximates a golden rectangle and still fits within the usable screen area. Naturally this is only a starting point and may be violated if layout circumstances dictate. TABLE II REPRESENTATIVE ACTIVE DISPLAY AREA SIZES SPECIFIED COMPUTED SCREEN USABLE SCREEN ACTIVE DISPLAY AREA DIAGONAL SIZE' (Xm xYm) SIZE2 (XA X 1IY' 8.17' x 6.0' 7.36" x 5.05" 7.0" x 4.5" 13" 1O.4"~ x 7.8" 9.57" x 7.18" 9.0" x 5.5" 15" 12.0" x 9.0" 11.03" x 8.28" 10.5" x 6.5" 17" 13.6" x 10.2' 12.54" x 9.39" 12.0" x 7.5" 19' 15.2" x 11.4" 14.00" x 10.50" 13.5" x 8.5" 1. X~ + Y~ = (DIAGONAU2 Xm : Ym = 4 : 3 2. FROM FIGURE 1 3. XA OB9Xm ? ROUNDEDTOTHE YA = O.618XA ~ NEAREST HALF INCH PAGENO="0192" 188 Coding deals with the representation of information categories on the screen. For alphanumeric displays, the coding schemes are limited to characters and perhaps color, blink and intensity, if available. The designer's main concern is the effective portrayal of information using a minimum number of characters to increase comprehension and decrease density. Various techniques will be suggested that attempt to increase comprehension using the available coding schemes. These techniques will have a direct impact on display density. One effective coding technique is the use of generic labels, whenever possible. This is particularly applicable within the context of information categories, as illustrated in Figure 7. The text string MAIN OIL TANK qualifies as a generic label for that category and has two sublabels, level and pressure. While the same information could be listed as MAIN OIL TANK LEVEL and MAIN OIL TANK PRESSURE, the increased density does not add information and therefore represents noise. Furthermore, the generic information category label tends to link the sublabels together, since the sublabels themselves are not sufficient for parameter definition. However, one must ensure that the generic label is readily distinguishable and that the sublabel relationship is obvious; e.g., through proximity. Once the information categories have been defined, the display must be analyzed to place emphasis on the information, rather than the background. It is apparent that labels and sublabels are non-information bearing if they do not change their content during the life of the display. This criterion dic- tates that items such as dimensional units are also non-information bearing. Alphanumeric displays are the easiest to analyze for classification as to in- formation content, provided one keeps the change criterion in mind. Parameter values that may vary qualify as information bearing; items that cannot change are background. This will be slightly modified in subsequent paragraphs to ac- count for alarm conditions when color is available. Color coding is another technque that can be very beneficial when used as a redundant code( 3). Given a seven-col or plus black capability, each col or must be assigned a specific purpose and used judiciously. Reference 3 details the considerations used in making this assignment and Table III lists the TABLE III RECOMMENDED COLOR CODES FOR ALPHANUMERIC DISPLAYS COLOR USE BLACK ~-BACKGROUND BLUE ~-LABELS, UNITS CYAN-~- -PARAMETER VALUES OPERATOR MESS AGES GREEN- ~~~~___STATUSW?RDS WHITE -~---------STATUS WORDS - INTERMEDIATE (ON, OPEN) RED~- - ---------STATUS WORDS (ON, OPEN) YELLOW ~-CAUTIONARY ALARM MAGENTA -~--ALARM - IMMEDIATE ATTENTION REQUIRED PAGENO="0193" 189 standard colors and their associated conditions for alphanumeric displays. As stated above, items ssch as units and labels are non-information bearing and therefore are coded in blue, whereas parameter valses use cyan. Since operator messages such as guidelines and directories are accessed for their content, they too should be coded in cyan. Black is used as the background color in all instances. When the parameter value is a state rather than a numeric, the status word should be coded in either green or red to match the state. An alternative is to code the label in one of these colors and delete the status word entirely. However, this negates the redundancy desired for color and also puts unneces- sary emphasis on certain components due to its label length. A valve whose label happens to be longer than others would attract more attention by virtue of length, which may not relate to its importance. The effects of such varia- tions is minimized by using blue labels. Standard status words such as CLSD, OPEN, ON and OF ensure equal treatment and redundancy with a minor increase in density. When the state is intermediate to fully off and fully on (or closed and open), the status words ON or OPEN should be used with the white color. Additional information may be presented by using a lower intensity white to indicate that the component is currently being maneuvered within the inter- mediate state. A high intensity white would indicate that the component is currently fixed at some point between the state extremes. Adding another coding dimension, such as intensity, increases the information content without an attendant increase in density. Ihen a parameter on an alphanumeric display goes into the alarm state, one should change the color of both the parameter value and label to either yellow or magenta. This applies only to alphanumeric displays because of its density. Such a technique will greatly improve search and comprehension times. For a motor vibration alarm in Figure 7, the label VIBRATION and its value would be colored yellow so the operator can quickly differentiate which para- meter is in alarm and its value. Labels at this time are information bearing. Another coding dimension can be added here by enclosing the alarmed value in a rectangle to reinforce the message. If the system also has a blink capability, it is best to blink only a small portion of the message, such as the rectangle or the value itself. Keep in mind, however, that it is difficult to read characters that blink between full intensity and off. rdeally one should remove the blink as soon as the search task is complete and before the operator ac- tually processes the information. An additional coding recommendation involves indication to the operator of continuation pages. Figure 6 rearranges the data of Figure 5 into flow chart format, but requires more than one display page to complete the presentation. The arrow in the lower right corner of Figure 6 indicates that more information on this subject is found on "the next page." A number is used to maintain opera- tor orientation within a series of such pages(l5). Thus the operator should be made aware of the continuation series and how far into the series he has gone with the current display. Density The neat level of detail to be addressed in Table I is the density of in- dividual in ornation categories. Reference 3 determined that no more than 25 percent of the screen should be covered with data.. The arrangement of con- stituent parameters and the number of characters used are important aspects in designing low density alphanumeric displays. The designer must determine the intended use of the parameter for each category. If a comparison task is in- tended for like parameters, the tabular arrangement is preferred. The operator can quickly compare digits without having to realize the actual values. The temperature and flow values for the two oil cooler loops of Figure 7 illustrate this point. The close proximity and columnar alignment of the two "85" numeric character strings tell the operator that both temperatures are equal. With a little more human processing, he may then realize that "85" is an acceptable value. Tabular arrangement also allows patterns to be detected between like parameters, as seen by the decreasing temperature sequence of the Upper Journal, Thrust, and Lower Journal Bearing entries of Figure 7. In all cases, parameter labels (or sublabels) should be left justified and parameter values right justi fi ed. Since the columnar alignment is so applicable for comparison, one is immediately tempted to deliberately avoid such alignment for dissimilar 48-721 0 - 79 - 13 PAGENO="0194" 190 parameters within the information category. Returning again to Figure 7, why not stagger the constituent parameters to emphasize non-comparison of unlike parameters, such as the level and pressure for the main oil tank. Although this technique seems logical, it also destroys the orderliness of the display and makes it difficult to relate parameters to their information categories. In summary then, while it may be effective to avoid the tabular arrangement between information categories, it is best to use this arrangement for all constituent parameters within the category, regardless of their similarity. Arrangement of the constituents within information categories of tradi- tionalalphanumeric displays is equally as important. While the format of Figure 5 may be improved using a flow chart format, the display as shown is a good exan~le of a traditional representation and illustrates some interesting points. In this case, each line forms the individual information category, and the words that comprise each line are the constituents. As a minimum, one expects---perhaps erroneously---good sentence construction to dictate the placement of words. It is interesting to note that while syntax is precisely defined for computer input, little is said about the structure of computer output. Significant improvement in such output can be made by merely adhering to accepted grammatical principles and accounting for what is known as the serial position effect (16). This effect states that words at the beginning and end of message strings are more easily remembered (recalled) than the words between the extremes. Comprehension and retention of a message can be measurably increased by placing the most important words at these extremes. The lines i~n Figure 5 are concise and descriptive, containing little more than a subject and verb. Lines 6-~ state a particular condition and then an action. If the current situation does not match the stated condition the operator need not read further. Similar techniques can be used to advantage on alarm lists, directories and other alphanumeric displays. The next problem to be addressed in Table I is the number of letters and~ digits used within the information category. The numeric parameter value is read with best accuracy when there are four characters or less (3, 15). Since the status words have already been defined (ON, OF, OPEN, CLSD) to meet this criterion, the designer need only be concerned with numerics and labels. Values that contain only integers pose little problem in that the maximum (gggg) is sufficiently large to account for most situations. Values having fractional portions do cause some concern and can be displayed in modified scientific no- tation. As illustrated by the oil lift pump flow value in Figure 7 (5.00+1), the number of characters can be reduced without losing information by deleting the 10 multiplier of standard scientific notation. Although 6 characters are required, the representation is sufficiently compact so as not to cause un- necessary confusion. When the exponent of this notation is zero (i.e., the value is between 0.00 and g.gg), both the sign and the zero digit should be re- moved to aid the cleanliness of the display. Consideration should also be given to blanking values which read zero and leading zeros should always be suppress- ed. Determining the number of characters for labels is not quite as simple due to the wide range of possibilities. Constituent parameter labels should always contain fewer characters, preferably 5 or less, than their associated information category label. Consistent and accepted abbreviations, such as PRES arid TEMP, should also be used throughout, with all punctuation deleted (i. e., PRES versus PRES.) (15). The number of characters used for the category label should not exceed 12, but still must convey the information to the opera- tor. Accepted abbreviations, mnemonics and acronyms consistent with the data base identifiers can be used to advantage in this case. If more than 12 charac- ters are necessary, it is advisable to divide the string into smaller segments or chunks' (17) using space characters, providing the label is amenable to such division. Punctuation should also be minimized in the message string (15). Character size is another consideration in this display category. Figure 8 illustrates the relationship between character height and maximum recommended reading distance. The criterion for legibility is taken from Figure 4, which specifies a minimum visual angle of 16 minutes of arc. Since the character size in linear units is dependent on the display generator used and its associated pixel dimensions, the designer must perform a simple computation. Figure 8 then gives him the related reading distance. If the operator is expected to read a CRT message at. a specified distance from the screen, the designer must use these relations to ensure such reading is possible. PAGENO="0195" 220 200 180 ~ 160 Vi 140 ~ 120 ~ 100 ~ 080 ~ 060 40 20 0 191 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 CHARACTER SIZE, INCHES Fig. 8: Maximum reading distance for characters of various size Spacing is an important element that has a large impact on the readability of alphanumeric message strings. The optimum intercharacter spacing is 75 per- cent of the character width(1H). This results in a round off value of 4 pixels in the horizontal direction for the standard 5 x 7 character matrix. Care must be exercised in using this value, since the addressability constraints of a particular display system may not allow such spacing. Interline spacing is a function of the information category. Within the category, the lines should be more closely spaced to keep the data within the operator's span of attention. Quoted values of 30-50 percent of character height(6) for printed text are probably minimal for CRTs, due to the irradiance mentioned before. A value of 75 percent character height was chosen as the recommended interline spacing within information categories. For the 5 x 7-dot matrix, this translates to 5 pixels or 71 percent of character height achievable. Various intercharacter and interline spacings are shown in Figure g* Blocks A, B and C have inter- character spacings of 20 percent, 60 percent and 100 percent respectively while blocks 0, E and F have respective interline spacings of 100 percent, 71 percent and 28 percent. Blocks B and E are identical, each having intercharac- ter spacings of 60 percent and interline spacings of 71 percent. These are the best approximations achievable with the display system used. Sufficient space should be allotted between categories to avoid encroach- ment of one category on the span of attention of another. At 28 inches from a 19-inch CRT, the ideal distance between centers of adjacent information cute- gee.4ea4.a~Z~.j~sches, representating a visual angle of 4 degrees. Here again, one must use this value as an initial guide for the display in question. If the display is a simple alphanumeric list such as a directory, vertical movement is constrained by having explicit lines. Hence, the interline spacing may adhere d d"-0.0003 D ASSUME f3 = 16' d 0.0048 D D = ~= 208.33d PAGENO="0196" 192 A B C TEMP TEMP IP~TOP OIL 1~ PKSTOP OIL 131 PKSTOP OIL 131 `~`~ 1~ UP RAD PRG 135 UP RAP IRG 135 ~ 148 AXIAL PRG 148 AXIAL PRG 14. STATOR 228 STATOR 228 STATOR 228 LU~iRG 147 LW RAP PRG 147 LW RAD PRG 147 TEMP TEMP TEMP PKSTOP OIL 138 PKSTOP OIL 130 UP RAP PRG 135 Up RAP PRG 135 PKSTOP OIL 138 AXIAL PRG 148 AXIAL PRG 14S STATOR 221 STATOR 221 LW RAP PRG 14? LW RAP .PRG 147 LW RAP PRG 147 E F Fig. 9: Variations in intercharacter and interline spacing to the 75 percent rule unless a greater distance is desired for emphasis. At no time should the spacing be less than this amount. Rate of ~ Rate of change determines how often the information on the *CRT should be updated. In many instances the data base is modified at a very rapid rate. While the operator needs the most recent information, computer processing speeds are orders of magnitude greater than that of human processors. What does `most recent" mean to a human? The human "now" or psychological present is a time interval between 2.3 to 3.5 seconds(19). Hence, there is a point at which one can saturate the human capacity by presenting data more quickly than it can be comprehended. On alphanumeric displays, saturation for a single parameter is reached when the digits appear to `wheel," i.e., change faster than the human can ad- equately comprehend each discrete reading. This is an increasingly familiar event, considering the proliferation of digital readouts in modern display sys- tems. Another factor to consider is the potential conflict with blink rates as the values change. The display of rapidly changing values could cause the dis- play to appear to blink if the update and blink rates are similar. To prevent both these events, a.e-_iudis~Ldu&L~pLae~ta.r~-upd.ate.ta.te.of 1. Hz or less is tac.oauu~exi.cted. This allows sufficient human processing time between changes and still provides recent information, within the response time of the operator. While this 1-Hz rate is applicable for single parameters, one must be con- cerned with the entire screen update as well. Each parameter update rate may meet the stated criterion, but appear on the screen at slightly different times to cause a twinkling effect which adds confusion. Assume the update rates of PAGENO="0197" 193 parameters A, B, C and D are maintained at 1-Hz each, but sent from the com- puter with time separations of 250 msec. The operators' attention would be diverted from A to B to C to 0, without allowing `im to process each para- meter. This twinkling can be alleviated by undating all the required para- meters at the same time, no faster than once/second. This gives the operator a static picture of the process within the last second, much like the blink of an eye. SUMMARY Although alphanumeric CRT displays have been used to present computer- generated information for many years, the design of such displays has been left to the discretion of computer personnel with little guidance. It is the operator who must use this information. His attributes, rather than the com- puter's, must dictate the design. For the convenience of the display designer, the recommendations concerning alphanumeric displays are summarized as follows: - determine pixel size and evaluate character attributes according to Figure 4 - consider the use of flow charts for procedures and guidelines - avoid explicit or implicit lines when information is not related - keep display density to less than 25 percent - start with the Golden Rectangle - use generic information category labels - labels and units are non-information bearing; values are information bean ng - apply the color code of Table III - number continuation pages - avoid columnar arrangements between information categories unless comparison is desired; retain the columnar arrangement within cate- gories regardless of the task - left justify labels, right justify values - account for the serial position effect - use 4 digits or less to represent numeri cal values; use the modi fied scientific notation if fractions are necessary; suppress leading zeros - information category labels should be limited to 12 characters; con- stituent labels should not exceed 5 and be less than the associated category label - character size should be chosen to subtend 16 minutes of arc at the specified reading distance, Figure 8 - intercharacter spacing of 75 percent character width and interline spacing of 75 percent character height should be used within informa- tion categories - 4 degrees viewing angle spacing should be maintained between adjacent information category centers - update individual parameters no faster than once/second - perform all required updates at the same time, within the one-second rate. PAGENO="0198" 194 REFERENCES 1. Davis, S., Computer Data Displays, Prentice-Hall, Inc., Engle- wood Cliffs, New Jersey, 1969. 2. Danchak, M. M. , `The Man-Process Interface Using Computer Generated CR1 Displays," Instrumentation in the Power Industry, Volume 20 (New Orleans, 1977), Instrument Society of America, Pittsburg, Pennsylvania, 1977. 3. Danchak, H. H., "CR1 Displays for Power Plants," Instrumentation Technology, Vol. 23 (10), 1976, pp. 29-36. 4. McCormick, E. I., Human Factors Engineering, McGraw-Hill Book Company, New York, 1970. 5. United States Military Specification No. MIL-M-18012B (July 20, 1964). 6. Gould, J. D. , "Visual Factors in the Design of Computer- Controlled CR1 Displays," Human Factors, Vol. 10, 1968, pp. 359-376. 7. Sherr, S., Fundamentals of Display System Design, McGraw-Hill Book Company, New York, 1963. B. Maddox, H. E. , Burnette, J. 1., and Gutmann, J. C., "Font Compa- risons for 5 x 7 Dot Matrix Characters," Human Factors, Vol. 19, 1977, pp. 89-93. 9. Vartabedian, A. G. , "The Effects of Letter Size, Case and Genera- tion Method on CR1 Display Search Time," Human Factors, Vol. 13, 1971, pp. 363-368. 10. Cornsweet, 1. N., Visual Perception, Academic Press, New York, 1974. 11. Kammann, R., "The Comprehensibility of Printed Instructions and the Flow Chart Alternative," Human Factors, Vol. 17, 1975, pp. 183-191. 12. Green, E. E. , "Message Design - Graphic Display Strategies for Instruction," Proceedings of the Annual Conference, ACM `76, 1976, pp. 144-148. 13. Enrick, N. L., Effective Graphic Communication, Auerback Publishers, Princeton, 1972. 14. Hoffer, W., "A Magic Ratio Recurs throughout Art and Nature, Smithsonian, Dec. 1975, p. 110. 15. Engel, S. E. and Granada, R. E. , Guidelines for Man/Display Interfaces, Technical Report TR 00.2720, IBM Poughkeepsie Laboratory, Dec. 1975. 16. Murdock, B. B., Jr., "The Serial Position Effect of Free Recall," Journal of Experimental Psychology, Vol. 64, 1962, pp. 482-488. 17. Miller, G. A., "The Magic Number Seven, Plus or Minus Two: Some Limits on our Capacity for Processing Information," The Psychological Review, Vol. 63, 1965, pp. 81-97. 18. Hodge, D. C., "Legibility of Uniform-Strokewidth Alphabet; Relative Legibility of Upper and Lower Case Letters, Journal of Experimental Psychpjpgy, Vol. 1, 1962, pp. 34-46. 19. Miller, R. B., "Response Time in Man-Computer Conversational Transactions," Proc. of the Fall Joint Computer Conference, 1968, pp. 267-277. PAGENO="0199" 195 COMMITTEE ON SCiENCE AND TECHNOLOGY U.S. HOUSE OF REPRESENTATIVES SUITE2S2T'RAYBIJRN HO5SEOFFICEBUILDING WASHINGTON, D.C. 20515 dr. lilton Levenson Director, :luclear Poller )ivision Electric Poller Research Institute 3412 Hillvie, Avenue p.O. 3ox lqll2 Palo Alto, CA 9~3~3 Dear ~r. Levonson: Inank you for nroviding testinony at our subcormittee hearings on lucloar Power Plant Safety on lay 22, 1979. Dunce these hearings you indicated that you would erovide the subcommittee iith responses to a canter of oJestions, tocether with other additional information. Enclosed is list of questions, we oul! aperociate recsivinc your resnonse by June 25, 1E7. Th~nt `iou for your coo'nnratio. Sincerely, ~~El1c~l!ACK Chairman, Subcommittee on Enemy `essarch and Production Enclosure PAGENO="0200" 196 SUBCOM~IIUEE ON ENERGY RESEARCH AND PRODUCTION HEARINGS ON NUCLEAR POWER PLANT SAFETY ADDITIONAL QUESTIONS FOR MR. M. LEVENSON 1. Is there a need for a Swat Team composed of people from industry, the utilities, the NRC, etc.? 2. What are the advantages and disadvantages of standardizing the design of nuclear power plants? 3. What would be the attitude of equipment manufacturers and plant constructors to standardization? 4. Should there be a standard design for control rooms and for the layout of con- trol room instrument and control panels? 5. Discuss and provide recommendations for means of using computers or micropro- cessors to enhance the power plant operators ability to recognize abnormalities. 6. What design changes or procedural changes would you recommend to improve the defense against lesser accidents that you mentioned in your testimony? 7. What are your recommendations for improving the safety of nuclear power plants? 8. What role should your institution play in improviflg nuclear power plant safety? 9. List the research and development programs which you would recommend to im- prove nuclear power plant safety. 10. Should the training of nuclear power plant operators be improved? List your recommendations. 11. Should the control room operators be employed by the utility or should they be employed by some other agency? 12. How can the performance of the NRC be improved? PAGENO="0201" 197 ELECTRIC POWER RESEARCH INSTITUTE July 23, 1979 EPRI The Honorable Mike McCormack U. S. House of Representatives Washington, D. C. 20515 Dear Mike: Your recent letter requested additional information on twelve questions as a follow-on to the Hearings on Nuclear Power Plant Safety. I must apologize for this delayed response which is largely due to my extremely heavy travel schedule. Several of the questions that you pose raise broad issues still under study, but I will attempt to provide you some indication of what my current thinking is: Qi) Is there a need for a `Swat Team" composed of people from industry, the utilities, the NRC, etc.? Al) It is not clear what is meant by a "Swat Team". If the question refers to a group to come in, take control, and operate the plant, it might well be both unsound and unsafe. Each plant is somewhat different, and it is essential that only people familiar with a specific plant in great detail be allowed to operate it. On the other hand, support groups - both technical and non-technical - to provide backup for the plant staff can be very useful. Whether such backup support comes from the utility itself or from a broader group depends upon the size and resources of the utility. Alternative ways of providing such support are under study as part of the current industry overall review and assessment. Q2) What are the advantages and disadvantages of standardizing the design of nuclear power plants? and Q3) What would be the attitude of equipment manufacturers and plant constructors to standardization? A2 & The question of standardization of power plants is extremely complex. A3) When one considers the barriers of the present licensing process, the difference in site requirements (seismic, etc.), the difference in location - (no-frost areas like Florida versus cold areas like Minnesota or Michigan) - and technical differences arising from things like sea water versus fresh water cooling, true standardiza- tion to a single design is probably not possible or even desirable. On the other hand, standardized systems or subsystems are probably quite possible and might be very valuable if the licensing system were revised to make their use practical. If a system design could be licensed so that it could be manufactured in a controlled manner and purchased with an assurance that it was usable in a licensed plant, it might be quite practical. On the other hand, if it Headquarters 3412 Hillview Avenue, Post Office Boy 104t2, Palo Alto, CA 94303 (415) 855-2000 Washington Office: 1750 New York Avenue NW Suite 835. WashingtOn. DC 20006 (202) 872-9222 PAGENO="0202" 198 The Honorable Mike McCormack July 23, 1979 U. S. House of Representatives Page 2 cannot be licensed in advance of purchase, there is little chance that any move toward standardization will occur. A major advantage of standardization is that very extensive analysis and study combined with the learning curve that comes from repetition tends to produce more reliable and cheaper plants. On the other hand, if standardization is carried too far (winter insulation in southern plants, etc. ), the non-optimum feature may override the good - thus the idea of standard building blocks rather than a standard plant. Q4) Should there be a standard design for control rooms and for the layout of control room instrument and controlpanels? A4) If the plants are not identical, the control rooms probably cannot be identical. (The panel of a DC-lU is not identical to that of a 747, etc.) However, better use of Human Factors Design can probably be made in most cases. More important than a standard control room may be a control room designed for off normal as well as normal operations. This might include methods of prioritizing alarm signals, etc. This area is also currently under study. Q5) Discuss and provide recommendations for means of using computers or microprocessors to enhance the power plant operator's ability to recognize abnormalities. A5) The question of data display is extremely complex and currently under study. It isn't yet clear whether more computerization or less computerization is the right answer. For example, in many - cases, old fashioned" strip chart recorders give a clearer picture of what is happening than a computer printout with alarms does.~ The overall system optimization of man-machine interface remains to be done. Q6) What design changes or procedural changes would you recommend to improve the defense against lesser accidents that you mentioned in your testimony? A6) To protect against lesser accidents requires a detailed plant specific review. A review of set points such as building isolation systems, when safety and emergency systems are activated or initiated, are the plant staff trained for lesser events or only "big breaks", do the emergency procedures cover small accidents, is the emergency power supply correct for small accidents, etc. Specific design and procedural changes (if any) will follow from such a plant specific review and are generally not generic. Q8) What role should your institution playin improving nuclear power plant safety? A8) EPRI has underway substantial R & 0 programs whose objectives are improved understanding of safety related issues of nuclear power. Some of these programs will be refocused such as from big LUCAs to smaller LUCAs, etc. However, many of the questions are PAGENO="0203" 199 The Honorable Mike McCormack July 23, 1979 U. S. House of Representatives Page 3 institutional, legal or engineering applications rather than R & D and currently EPRI has a role only in such matters as pertain to R & 0. Q9) List the research and development programs which you would recommend to improve nuclear power plant safety. A9) The TMI accident has not really identified new areas of research, but only indicated some changes of priority. Although I am in the "research business", I would advocate serious review before any extensive new programs are launched in the name of improved nuclear safety. There are a few obvious cases such as improved Human Factor Studies, etc., but a much more urgent need is probably support for basic and applied work in chemistry and materials - support that has largely disappeared since the transition of the AEC into ERDA and then DOE. Problems like pipe cracking and turbine cracking not only affect nuclear plants, but are important in all power plants. Similar problems will arise in pipe lines, synthetic fuel plants, thermal solar plants, geothermal plants, etc. Substantial long-term programs are needed in materials properties, materials aging, stress corrosion, basic corrosion phenomena, fracture mechanics, crack arrest, crack propagation, fabrication effects, non-destructive testing, and all the related aspects of the life expectancy and causes of deterioration of metal components. QlO) Should the training of nuclear power plant operators be improved? List your recommendations. A1O) Operator training should probably be revised. It isn't yet clear what "improved" means. The operator is one part of the system, and more assessment and study is required before it is clear what the optimum training should consist of. The plan being prepared for the industries' new Institute of Nuclear Power Operation (INPO) will be addressing this as a major issue. Qll) Should the control room operators be employed by the utility or should they be employed by some other agency? All) Control room pperators should be employed by the entity responsible for the plant. The idea of non-line organization employees has really never been very successful, especially when serious questions of responsibility are concerned. Q12) How can the performance of the NRC be improved? Al2) Any organization can be improved - few things are perfect. The purpose of improvements is to do a better job or to come closer to achieving an objective. I believe that before changes are made in the NRC, it is necessary to clarify its' objective. At the moment, its' charter seems quite diffuse and possibly so broad PAGENO="0204" 200 The Honorable Mike McCormack July 23, 1979 U. S. House of Representatives Page 4 as to interfere with its primary mission. I believe the function of the NRC should be strictly limited to assuring public health and safety. Questions of need for power are already the domain of state PUC's or similar authorities; a `better site" syndrome can lead to nothing other than administrative paralysis - the question should be only "is the proposed site safe enough?; the review of export hardware can certainly not be significant in the absence of either details or control over the entire system in which the hardware will be used (the NSSS is approximately 10% of the total plant). This does not mean there should not be export licensing - butpolitical objectives and controls should be separated from the NRC role in public health and safety. After the objectives are clarified, then changes can be recommended to improve the probability of achieving those objectives. My personal conclusions are that this should result in a smaller, more streamlined organization rather than an even larger more diffuse organization. Again, let me apologize for the late response. Sincerely, ELECTRIC POWER RESEARCH INSTITUTE y~~(r ;~ Milton Levenson Director Nuclear Power Division ML:pb PAGENO="0205" -~ -103)---1 ~< ~-~(< (< 0~ 33 -~ o ~3-(~<-~. o ~j ~ (3o~33. 0 0-3 (3 p 3 3 P 0-U. ~-( (-( 3 (0 (3 (0(3 (3 _ç~~ ~< -_j 0(0~ (0 ~+~< (-5 0 çn~ x;;i Orn Co Co Sn> (I)Z 1rn C., <2 mo 0 C) U ~ ~ ~ PAGENO="0206" 202 SUBCOi~lITTEE ON ENERGY RESEARCH AND PRODUCTION HEARINGS ON NUCLEAR POWER REACTOR SAFETY ADDITIONAL QUESTIONS FOR HR. KENNEDY 1. What is your professional opinion of the performance of design engineers in general (not related to Stone and Webster)? What are their attitudes regarding dttention to detail, personal responsibility, outside study to maintain techni- cal competence, thirst for perfection, etc.? 2. What is your opinion of design supervisors? Do they check the work of their engineers and designers? How carefully? Are they timid, or do they criticize? Do they develop their personnel into better engineers? 3. If these questions seem out of place, why was there no way of verifying that a major valve was open or seated on the primary loop of Plant 110. 2 at Till when an open valve could, in itself, constitute a LOCA? 4. What is your opinion of the effectiveness of the NRC during the design phase? Do they do complete detailed design reviews? Do they have adequate personnel for this? Are they sincere? Do they interact constructively with the utilities, the equipment manufacturers and design engineers? Are they procedure oriented or plant oriented? 5. What is your opinion of the construction workers? Specifically, do they want to work? For power plant construction, what is the productivity of labor today vs 1969 in such measureable items as inches of weld per hour, number of feet of pipe placed per day, feet of wire pulled, feet of reinforcing placed, yards of concrete poured, and similarly measureable parameters. 6. How stable is the labor force, that is, once employed on a particular project, what is the percentage that leave on their own before completion of their work tasks? 7. In general, how skilled is the labor force and what on-the-job tr~iding is re- quired for welders and others to render a creditable performance? 8. Do construction workers appreciate the difference between working on a power plant and building a warehouse? Are they motivated? Do they care about quality? g. How adequate is construction supervision and management? How many years of supervisory experience does the average foreman, superintendent, project manager have? Do they feel it is enough? What training programs are available to supervisory personnel and how many avail themselves of such training opportunities? 10. How do you find the quality of components, such as valves, instruments, pipe, compressors, etc.? How many rejections are made in the field -- many or few? PAGENO="0207" 203 Add~tjonal Questions Mr. Kennedy Page Two 11. How should the design of the control room be improved? 12. Should there be a standard design for control rooms and for the layout of control panels? 13. What are the advantages and disadvantages of standardizing the design of nuclear power plants? What would be the attitude of equipment manufacturers and plant constructors to standardization? 14. What design changes or procedural changes would you suggest to improve the defense against the lesser accidents that were referred to in the testimony? 15. Discuss the design changes or modifications and the procedural changes that you would recommend to minimize the frequency of occurance and the speed of development of the operational pertubations that were mentioned in the testimony. 16. List your recommendations for research and development activities that would improve the safety of nuclear power plants. 17. What are the present deficiencies in nuclear power plant safety systems? 18. Provide details of the means of simplifying the interpretation of instrument readings, together with your recommendations for displaying abnormal readings. 19. Discuss and provide recommendations for means of using computers or micro- processors to enhance the power plant operators ability to recognize abnormalities. 20. Discuss the need for a Swat Team composed of people from industry, the utilities, NRC, etc. 21. Provide details of the improvements in communications and the man-machine interface that were suggested in the testimony. PAGENO="0208" 204 STONE & WEBSTER ENGINEERING CORPORATION 7315 WISCONSIN AVENUE. SUITE 332 WEST Mr. Stephen Lanes 13 August 1979 Staff Director Subcommittee on Energy Research and Production Committee on Science and Technology Room B-374 Rayburn House Office Building Washington, D. C. 20515 Dear Steve: Enclosed are the responses to the supplemental questions submitted to Bill Kennedy following your hearings on nuclear power plant safety. I apologize for the delay in our response, but I am sure you are aware how busy our people have been this summer. Gerald Fain Assis t Manager - Washi gton Operations Enclosure PAGENO="0209" 205 :~ugu.~t ), ANHWEHS TO ADDITIONAL QUESTIONS FROM SUBCOMMITTE. ON ENERGY RESEARCH AND PRODUCTION HEARINGS ON NUCLEAR POWER REACTOR SAFETY N. J. L. Kennedy 1. Question: What is your professional opinion of the performance of design engineers in general (not related to Stone and Webster)? What are their attitudes regarding attention to detail, personal responsibility, outside study to maintain techrii- cal competence, thirst for perfection, etc.? Answer: Referring to `design engineers" as professional engineers I consider them as a class with the highest professional standards of competency. Non-achievers are weeded out of demanding disciplines, such as nuclear, early and easily. By their very nature, engineers concentrate on details, are proud of their personal design contributions and are always searching for better ways of doing things -- perfecting their work. Many have advanced degrees in engineering and in related fields; many obtained by attending college nights. 2. Qup~tion: What is your opinion of design supervisors? Do they check the w~rk of their engineers and designers? How carefully? Are they timid, or do they criticize? Do they develop their persondel into better engineers? Answer: By "design supervisor," I will refer to lead engineers on projects and engineering supervisors in technical engineering support groups; first line engineering supervision. At Stone & Webster these individuals are responsible for supervising and checking the work of their engineers or designers. Where calculations are long or complicated, they can delegate that responsibility. In any event, the checks made of safety systems are documented and audited. A formal design control program is required by Criterion III, to Appendix B, 10 CFR 20 which establishes the requiremeni~s for company Quality Assurance Programs. Our Engineering Assurance Division documents company procedures and provides periodic and independent audits of the checking and other design control procedures. These audit findings are reported to me directly, and assure us of the supervisory adequacy of first line supervision. In any event, checks are careful and most engineers take pride in finding possible errors or omiesions, and having them corrected. Few engineers are timid or fail to criticize their peers. This intimate working relationship leads to a rapid transfer of knowledge and mutual professional development is a by-product. 3. Quection: If these questions seem out of place, why was there no way of verifying that a major valve was open or seated on the primary loop of Plant No.. 2 at TMI when an open valve cou1a,in itself, constitute a LOCA? Answer: There is no incompatibility between my response to Questions 1 and 2 and the question of pilot operated relief valve (P0Rv) at TNI-2. The engineers 48-721 0 - 79 - 14 PAGENO="0210" 206 recognized that relief valves hav~ a history of sticking open on occasions or leaking. Design improvement has minimized but not eliminated such occurences. Therefore, an indirect valve position indication was provided to let the operators know if power was being applied to the valve - operator (solenoid); furthermore, a remotely operated block valve was provided upstream of the PORV so that the valve could be isolated should it leak or fail to close; last but not least, temperature and pressure measuring devices were placed downstream of the PORV to establish whether the valve was leaking or was in fact open. How the operator used this information and the actions - taken are a matter of training and operational/maintenance quality assurance procedures. Admittedly, we are considering improvements to the quality of our PORV leakage detection devices so that they can give the operator unequivocal information. 4. ~estion: What is your opinion of the effectiveness of the NRC during the design phase? Do they do complete detailed design reviews? Do they have adequate personnel for this? Are they sincere? Do they interact constructively with the utilities, the equipment manufacturers and design engineers? Are they procedure oriented or plant oriented? Answer: The NRC is quite effective during the design phase. However, their reviews are pretty mach confined to assuring conformance with several hundred regulatory guides and regulatory branch positions. TMI-2 demonstrates that the NRC has probably been overconcerned with the maximum credible accident which might never occur, rat1~er than smaller and more likely accidents. Considering that the major initiating actions of the TMI-2 accident stemmed primarily from operations and maintenance shortcomings, this in itself speaks well of NRC involvement during the design phase. Even though the NRC has inadequate personnel to be completely responsive to the schedular requirements of design review, their personnel are qualified and sincere, and they try to act constructively with the utilities, equipment manufacturers, and design engineers. There is a need that NRC design reviewers be more familiar with nuclear plant operation and consider their reviews within that context. PAGENO="0211" 207 5. Question: What is your opinion of the construction wàrkers? Specifically, do they want to work? For power plant construction, what is the productivity of labor today vs 1969 in such rneasureable items as inches of weld per hour, - number of feet of pipe placed per day, feet of wire pulled, feet of reinforcing placed, yards of concrete poured, and similarly measureable parameters. Answer: A cross-section of the construction'workforce engaged on nuclear plant construction would not vary significantly from a cross-section of the work force in general. There are many highly qualified workers who take a great deal of pride in their work; a large portion of the work force are qualified craftsmen who are primarily interested in performing good work for a good wage and a smaller portion of the work force whose performance is less than desired. Unfortunately, the influences outside the construc- tion workers' control such as holding for an inspection, rejection of what the worker considers good work because of `paper work" problems, and changes to installed work, all of which are prevalent in nuclear construction today, have an adverse effect on the best workers. To compare the man-hours per unit of work today vs the man-hours per unit of work in 1969 and call it differences in labor productivity would be unfair to today's work force. The man-hours per unit of work today would be much higher. Some of the major contributors to the increase in today's man-hour rates are: o Increases in inspection activity, including inspection hold points where work cannot continue until released by the in- spector. In construction a work task is normally performed * completely by the sane workers so all inspections disrupt the work process vs manufacturing where frequently the in- spections can be performed between activities in the man- ufacturing process. o Increases in the complexity of installation. For example, reinforcing steel installation to satisfy increased loadings has increased the installation difficulty due to the density of rebar per unit volume of concrete. o Time expended to satisfy requirements for items like weld rod control and random metal products identification Increases the ratio of waiting time to direct work time. o Installation of equipment later than the optimum time because of late delivery affects the difficulty of installation. o Late installation or rework to satisfy regulatory guides and changing codes. For example, pipe whip restraints, jet im- pingement and cable separation. o The addition of systems and expanding existing systems in structures already constructed reduces efficiency because of tight working conditions. PAGENO="0212" 208 Items like the above have increased the man-hours per unit of work by as much as 5 to 10 times, but do not indicate a decrease in labor productivity per se. The increase in scope of work today due to additional systems and expanded existing systems has naturally added many man-hoursto the total craft man-hours and this is often misinterpreted~as reduced productivity. 6. ~~on: How stable is the labor force, that is, once employed on a particular project, what is the percentage that leave on their own before completion of their work tasks? Answer: The stability that does exist in the construction labor force is between the individuals and their union, not between individuals and contractors or individuals and projects. The stability on a given project is very much dependent on the construction marketplace in the project area and to a lesser degree on the rest of the country. - If the work in the area is slow, then obviously the project work force will be very stable. Frequently there is other work available so the workers will switch projects because of such things as extended work week, shorter commute or to get away from the impositions of nuclear work. Due to the length of nuclear projects an individual nay leave and return several times during the life of the project. The percentage of workers that stay through a project would be influenced by the above but 20% would be a realistic number. The turnover of the remaining 8o% can vary from 300% to 900%. Often a nuclear project requires a larger work force than is available in the area. This is especially true in the mechanical and electrical crafts with qualified welders having the greatest shortfall. This short- fall requires the use of travelers from other areas. The turnover in travelers is usually quite great because when work picks up in their home area they return home. This turnover is especially detrimental to overall man-hours when welders are involved because of qualification requirements, that is, time each welder spends in the test booths. There is a small percentage of travelers that move from overtime job to overtime job and will only work a normal work week project waiting for another overtime project to commence. The climatic conditions in the project. area influence the stability of the work force. The more adverse the weather is for construction activities the more stable the work force will be in the latter stages of a project. The structures are normally closed in at this stage and the workers are rarely sent home with just show-up time during bad weather. The Nuclear Power Construction Stabilization Agreement should help to reduce the number of travelers on a project and, therefore, the turnover because of provisions to use nonjourneymen such as apprentices, trainees, helpers or probationary employees. It is expected that these workers will come from the project area and will perform many of the support craft activities relieving the available journeyman to perform the activities requiring the greatest skills. PAGENO="0213" 209 7. Question: In general, how skilled is the labor force and what on-the-job training is required for welders and others to render a creditable performance? Answer: The skill of the work force that comes from the labor organizations is generally very good. The apprentice programs produce competent journey- men. However, the unique requirements of nuclear projects do require special training or orientation for the work force. This training varies from formal classroom type training to informal gang box instructions. An effort is made to ensure that employees attend an orientation program on quality requirements as well as the details on documentation, hold points, etc., in order to obtain support for the programs. Specific training is given in specification requirements to ensure conformance to requirements. The amount of training required will vary with the complexity of tasks to be performed. The shortage of welders experienced on many projects has precipitated various training programs. This varies from on site training to upgrade welders already employed to offsite welding schools to train welders for the project. This is in addition to the programs above which would explain such tasks as inspection interface, weld rod control, and transfer of heat batch numbers. S._ Do construction workers appreciate the difference between working on a power plant and building a warehouse? Are they motivated? Do they care about quality? Answer: Construction workers definitely appreciate the differences between working on a power plant and building a warehouse; - To them, the biggest difference is in inspection and documentation. A weld is still a weld, reinforcing steel 6" on centers is still reinforcing steel 6" on centers, and termin- ating a cable is still terminating a cable. The majority intend to do quality work. They may, however, have developed practices over the years that they felt were acceptable and were not in violation of the specifications to which they were working. The specifications on nuclear work are more detailed and are being interpreted more stringently by the quality control and quality assurance groups. These controls and requirements often result in what the craftsman believes to be quality work being rejected. Using welders as an example, the tendency on nuclear work in the inter- pretation of a radiograph is to reject a weld if there is the slightest question of acceptability. This is understandable on the interpreter's part because the radiograph is subject to interpretation later by others; however, it is very difficult for the welder, who normally performs his own repair, to understand when he believes the weld was good. The negative result of this is that the workers consider that people that do not know their business as well as themselves, namely inspectors and contractor management, are telling them how to do their work. The solution to this of course is the training and orientation programs discussed in Question 7. PAGENO="0214" 210 Again it inunt be remembered that the worker's primary allegiance is to his labor organization and not to a contractor or project. Seniority and cecurity have no special meaning on a construction project. When there is plenty of work in an area, being terminated or resigning from a given project holds no special meaning to a worker who recognizes he can be working on some other project the next morning for the sane wages and conditions. This makes motivation of the worker ~very difficult except by appealing to his personal pride and pride in his workmanship. 9. ~~stion: How adequate is construction supervision and management? How many years of supervisory experience does the average foreman, superintendent, project manager have? Do they feel it is enough? What training programs are available to supervisory personnel and how many avail themselves of such training opportunities? Answer: As the case of the construction work force in general, there is frequently an insufficient number of experienced foremen and general foremen in an area to satisfy requirements on a nuclear project. This is complicated by using travelers as foremen and general foremen causing problems with the local work force and the probability of higher turnover in travelers makes them less desirable in supervisory roles. Contractual agreements frequently do not allow paying more to foremen and general foremen than agreed in the local bargaining agreements. The difference in pay in many cases has not been increased in proportion to the journeymen rate and there is no monetary incentive to take on the added responsibilities. This has been recognized in the industry and is being corrected. Under the Nuclear Power Construction Stabilization Agreement this can be taken care of in the Project Labor Plan. This first level of supervision, foremen and general foremen, has direct contact with the crafts and, therefore, the greatest influence on such items as productivity and compliance with the special nuclear construction requirements. Recognizing the potential shortage of this key element to a successful construction operation, the development of foremen and general foremen must start with the beginning of crafts activities. Even though this may result in a higher than normal ratio of supervision to work force it will allow on-the-job training for foremen and general foremen~ The training coupled with a larger pay differential incentive can be a. positive influence toward a motivated work force. The first level of management supervision historically cane from the crafts. Many now are engineers. The tremendous amount of paper work and document ation required of management supervision is discouraging craft personnel to switch into management. Fringe benefits once considered an incentive to take management positions now being equal to or better in the, labor organizations, will further discourage craft personnel from supervisory positions. Ideally, a mix of former craft and engineers should continue to exist so that hands on experience from the crafts will complement the technical background of the engineers. PAGENO="0215" 211 Site management personnel are often younger than might be expected for projects the magnitude of nuclear projects. These younger site managers entered the nuclear construction era at mid level supervisory positions and have developed through the levels of supervision parallel with the increase complexity and regulatory climate of nuclear construction. Therefore, they are usually well qualified to manage projects. 10. _______ How do you find the quality of components, such as valves, instruments, pipe, compressors, etc.? How many rejections are made in the field -- many or few? Answer: Overall, the quality of nuclear grade components purchasedbyStorie & Webater have been and continue to be good to excellent. The rejects we experience arise for the moat part for the lack of quality assurance records and, in some instances, shipping damage. Very few components are rejected for reasons of non-compliance with codes or requirements of the design specifications. 11. ~~tion: How should the design of the control room be improved? Answer: - The design of many controirooms could be improved by recognizing that most control functions fall into three (3) categories. The day-to-day operations, the seldom operated non-safety controls, and the engineered safety features or emergency controls. The control room layout should be designed along these lines and the control panels separated accordingly. Traditional designs group controls by equipment or fluid systems and as a result the main control boards are often crowded with instruments and devices that are used only under special limited conditions. 12. ~~stion: Should there be a standard design for control rooms and for the layout of control panels? Answer: A completely standardized design is impractical because of differences in reactor types, site specific systems, and equipment details. However, well considered and standardized principles of layout and dasign should be established, so that operators (or observers from regulatory bodies) can quickly feel at home in any plant and reactor plant simulator training can be facilitated. PAGENO="0216" 212 13. ~çstion What are the advantages and disadvantages of standardizing the design of nuclear power plants? What would be the attitude of equipment manu- facturers and plant constructors to standardization? Answer: It is impractical to fl~fl~ standardize the design of nuclear power plants. Each plant site has different requirements that must be met, e.g. size, soil conditions, ambient air and cooling water temperatures exclusion distance requirements, etc. We believe, however, that the current NRCconceptsof plant standardiza- tion are good and Stone & Webster led the engineer-constructor industry by having the first such standard design approved for the balance of plant. Almost all aspects of standardization are advantageous and the advantages include the following o Standard designs provide more time for thought to determine best arrangement and symtem design than is usually available in a custom design. o The design is pre-licensed. Because el the limited number of such designs the NRC review can be more comprehensive, thorough, and timely. o Universal siting. The designs can be suitable for founding on rack or soil in a wide variation of site locations, including seismic and long-term meteorological conditions that envelope most potential U.S. sites. o Shorter project schedule -- this is an economic advantage. o More efficient manpower use by owner and engineer_constructor. Again, the design reviews can be more comprehensive, thorough, and timely. More time can be spent reviewing feedback information impacts from operating plants. o Increased schedule confidence -- this is an economic advantage, however, it permits NRC to better plan its manpower requirements as well. o Increased plant availability. In essence, this stems from increased plant reliability, which is a good measure of improved safety. As your recognize, each reactor manufacturer has recognized the importance of standardizing his own nuclear steam supply system (NSSS) to provide for a minimum number of variations in size. To have all reactor manufacturers conform to a single design would probably violate anti-trust statutes, but more importantly eliminate the competitive drive to achieve product superiority as pertains to reliability and safety, exclusive of cost. With the large variation of balance-of-plant equipment requirements due to site related variables mentioned previously, I believe it would be impractical PAGENO="0217" 213 to standardize components other than those in the NSSS. 11f. ~estion: What design changes or procedural changes would you suggest to improve the defense against the lesser accidents that were referred to in the testimony? Answer: See answer to 15. 15. Question: Discuss the design changes or modifications and the procedural changes that you would recommend to minimize the frequency of occurence and the speed of development of the operational perturbations that were mentioned in the testimony. . Answer: The design approach, and procedures for. examination and implementation, would be to postulate a wide variety of minor failures and then to postu- late what coincidental failures of equipment or judgment could escalate the original failure, and thus illuminate areas where a change in design, greater redundancy, greater separation or isolation of equipsent, would obviate escalation. We can provide no pat formula; it is rather a matter of tedious, exhaustive, and largely repetitive series of examinations. 16. Question: List your recommendations for research and development activities that would improve the safety of nuclear power plants. Answer: - The research and development activities ths~ would improve the safety of nuclear power plants are in the following areas: o Hydrogen generation and behavior under accident conditions. o Visual and acoustical surveillance for reactor containment and auxiliary buildings. o Environmental qualification of instrumentation for a broad spectrum of accident conditions. o Computer simulation of nuclear and non-nuclear systems to provide dynamic response information to postulated challenges to safety - and non-safety systems and components. o Reliability of electrical power supply systems and configurations for emergency power. a Development of human engineering criteria for control room design. PAGENO="0218" 214 o Development of seismic qualificatiOn criteria. o Materials research and development, including the preparation of up to date documentation of the ability of materials and electronic components to withstand radiation exposure. o Improvements in the methodology for the analysis of the relationships between pressure and local effects near high energy pipe breaks. 17. ~q~~on: What are the present deficiencies in nuclear power plant safety systems? Answer: Some deficiencies in nuclear power plant safety systems which should be corrected are as follows: o Control room engineering, including improvements in human engineering the man-machine interface. o Too many alarm indications for an operator to cope with. Consider providing cathode ray tube displays of highest priority information. o Improved control room indication of bypassed and inoperable equipment. o More emphasis on dedicated safety systems with clear separation of interactions between safety and non-safety systems. o More emphasis on the role non-safety systems can play in preventing and mitigating the consequences of small loss of coolant accidents. o Improvements in the environmental qualification of instrumentation for service under a broad spectrum of accident conditions. o NRC seismic restraint requirements impo~e rigidity on components which result in thermal stresses during operation which approach allowable thermal stresses. Thus an attempt to address extremely unlikely seismic conditions increase the probability of failure under normal operating conditions. o NRC insistance on the demonstrated ability to remove iodine from the containment atmosphere of pressurized water reactors introduces caustic additives to the containment spray system. TMI-2 experience indicates that very little iodIne remains airborne. Since caustic sprays are not required and their use degrades safety systems, use of fan coolers should be in lieu of sprays. o Development of design criteria related to single, multiple, and common mode failure. - - o Improvements to instrumentation which assures the reactor operator that the core is covered-at all times. PAGENO="0219" 215 18. ç~estion: Provide details of the means of simplifying the interpretation of instrument readings, together with your recommendations for displaying abnormal readings. Answer: Several means of simplifying instrument readings have been proposed and the ones that appear most promising are as follows: o Design instrument components so that during normal system operation the instrument indicators are all pointing in the same general direction and an abnormal condition is quickly recognized, not by an absolute value, but by the semaphore change of the indicator. o Provide cathode ray tubes (CRT) similar to a TV screen to display instrument information only on demand or automatically when there is a deviation from normal. If system conditions are stable, the CRT should remain blank. To quickly recognize abnormal conditions, the plant annunciator alarm window or light should be adjacent to or part of the instruments that monitor the fault.. 19. ~q~stion: Discuss and provide recommendations for means of using computers or micro- processors to enhance the power plant operator's ability to recognize abnormalities. Answer: Computers have been used by some industries to aid the operators ability to recognize abnormalities but their use has been slow to penetrate the electric utility industry because of early experiences with the high failure rate of solid state devices. To use computers in the nuclear industry it would be necessary to isolate the safety related information from the non-safety related plant computer. The addition of isolators will degrade, to some degree, the reliability of the safety system and the NRC requires a documented analysis to prove that the safety system has not been degraded below an acceptable limit. For this reason the utilities have been slow to adopt computers in safety systems. Furthermore, such computers could not be seismically qualified -- a prime requirement for safety systems. With the rapid improvements and price reduction in mini-computers and micro processors, the industry may now be able to use several dedicated mini-computers and eliminate the need for isolation. PAGENO="0220" 216 20. ~p~ption: Discuss the need for a "Swat Team" composed of people from industry, the utilities, NRC, etc. - Answer: We have participated with industry in the preparation of improved emergency response plans. The attached outline of such a plan was prepared by the Atomic Industrial Forum (AIF) and was just recently released for industry comment. The need for an Emergency Response Team or "Swat Tess," and how such a team fits into updated emergency preparedness concept stimulated by TMI-2 can be best discussed in the context àf the recommended plan. Should you have any further questions on the plan, the Stone & Webster member of the AlE' Emergency Preparedness Subcommittee would be pleased to answer them. 21. Question: - Provide details of the improvements in communications and the man-machine interface that were suggested in the testimony. Answer: The testimony was meant to suggest that the most recent developments of TV be incorporated for remote surveillance of containment and other areas not readily accessed, or which might seem inaccessible. PAGENO="0221" 217 COMMITTEE ON SCIENCE AND TECHNOLOGY U.S. HOUSE OF REPRESENTATIVES 5U1TE2321 RAYBURN HOUSEOFFIcEBUILDINU WASHINGTON. D.C. 20515 Jt!P~$O7147ç~ Dr. Chauncoy Kepford, Director Environmental Coalition on lucisar Power 433 Orlando Avenue State Collene, PA 19901 Dear Dr. Eeoford: Thank you for orovidinq testimony at our subcommittee hearings on Duclear Power Plant Safety on ~lay 22, 1979. During these hearings you indicated that you ~,ould provide the subcommittee with responses to a number of questions, tocether with other additional information. Enclosed is a list of questions; wewould appreciate receiving your responseby June 25, 1979. Thant you for your c005eration, Sincerely~ ~E1~1ACK~Q Chairman, Subcommittee on Energy Research and Production Enclosure PAGENO="0222" 218 SUBCOM~1IUEE ON ENERGY RESEARCH AND PRODUCTION HEARINGS ON NUCLEAR POWER PLANT SAFETY - ADDITIONAL QUESTIONS FOR DR. CHAUNCY KEPFORD 1. What role should your institution play in improving nuclear power plant safety? 2. List the research and development programs that you would recommend to improve nuclear power plant safety. 3. List your recorrrnendations for changes in the design and layout of control rooms. 4. Should there be a standard design for control rooms and for the layout of control panels? 5. Provide a list of recorrrnendations for improving the safety of nuclear power plants. 6. Is there a need to improve the radiation monitoring facilities for nuclear power plants? List your recommendations. 7. In your testimony you stated "I have been lulled into this false sense of security about nuclear reactors. Please provide more detailed background on this statement. 8. Your testimony indicates that until the time of the Three Mile Island accident you felt a sense of security about nuclear power plant operations. Is this correct? 9. Provide a list of the locations at which you believe radiation monitoring equip- ment was installed and the locations at which measurements were made during the Three Mile Island accident. Provide the following reference data: (a) The source of your information. (b) The Agency responsible for the equipment. . S (c) The time and date at which measurements were made. (d) The `end use" of the data. 10. Your testimony indicated that you believe that the Nuclear Regulatory Commission was dishonest in the use of certain data. Please provide references to support your view. 11. In reply to a question by Congressman Walker, you said that you would provide him with calculations that you had made of the potential fatalities caused by the Three Mile Island accident. Please supply these calculations together with an explanation of your treatment of the data in question. 12. Were the relatively long-range radiation measurements, made by helicopter survey, satisfactory? Provide a brief explanation. 13. Did the "fall-off" of dose with distance, suggested by DOE measurements, satisfy you that doses do decrease with distance? PAGENO="0223" 219 SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION HEARING ON NUCLEAR POWER PLANT SAFETY ANSWERS OF DR. CHAUNCEY KEPFORD 1. [What role should your institution play in Improving nuclear power plant safety?] The role of an organization such as the Environmental Coalition on Nuclear Power(ECNP) in improving reactor safety is ambiguous to say the least. This ambiguity stems partially from the belief shared by the vast majority of our members that the only known way to make any nuclear power plant `safe' is to permanently remove all fuel from the reactor so that it can never be made critical. Of course, this does not solve any of the numerous other unsolved problems of the entire nuclear fuel cycle. However, the question addressed only reactor safety. The other aspect is that ECNP feels that we have an obligation to the public that requires us to enter the legal process of the licensing of nuclear power plants: in an adversary role even though we understand from long personal involvement that this licensing process is totally biased; that the rules are created to favor the result that the utility, in conjunction with the NRC Staff, desires; and that this result will be sust~ined by the Licensing Boards, the Appeal Boards, and, on the advice of the NRC Staff, the Commissioners themselves. These parties to ~he proceedings know in advance the outcome of any hearings: the record to date shows a monotonous record of success that is unblemished by the denial of a single commercial licens? application. In spite of this overwhelming bias, we still feel it is our mOral obligation to enter this biased forum and do our best to try to make reactors, and the rest of the fuel cycle, as safe as is possible for this generation of humans and all subsequent ones as well. This latter point has yet to penetrate the consciousness of either the NRC, the nuclear industry, or the supporters of either. 2. [List the research and development programs that you would recommend to improve nuclear power plant safety.] Short of the defueling suggestion made in the answer to question 1, which would require no R and 0 at all, and would have the Onormously bene- ficial side effect of placing a limiton the amount of radioactive wastes to be disposed of in some yet undetermined way; in some yet to be determined place, I would recommend the immediate placing of all operating reactors in cold shutdown until reactor safety becomes an experimentally verified reality. This would require a series of experiments to show that safety systems are capable of carrying out their designed functions under realistic operating conditions. If this verification means that a 1000 MW(e) reactor--or even 2, 3, or 4 or more reactors--must be tested to destruction, then that must be done, in my opinion. If this is too drastic or dangerous a measure for thetotally irrespon- sible nuclear industry,(i.e., not responsible for their accidents, wastes, abandoned facilities, etc.), then this industry should not be allowed to determine its safety record by using the public as a group of unwilling, uninformed, and unprepared guinea pigs, a practice uniformly followed, from uranium mining and milling through radioactive waste management, and, most unconscionably at Three Mile Island. To date there has not yet been offered a rational, reasoned explanationof why the corporations which in reality consist of a file of papers, receive more protection from the failures of PAGENO="0224" 220 nuclear power than do the lives and properties of members of the ptiblic and al1~of their descendants who are affected by the nuclea~-power failures. An area "the size of the state of Pennsylvania" (Working papers, 1964-65 WASH-740 update, document 92, page 4) to be placed at risk of radioactive contamination is far too great a national asset to jeopardize for the alleged marginal benefit of allegedly cheaper electricity. Here I can only repeat the words of Dr. Clifford Beck, chairman of the study groups which prepared WASH-740 and its 1964-65 revision, in a letter to Congress- man Chet Holifield, Chairman of the Joint Coninittee on Atomic Energy, May 18, 1965 there is no objective, quantitative means of assuring that all possible paths leading to catastrophe have been recognized and safeguarded or that the safeguards will In every case function as intended when needed. Here is encountered the most baffling and insoluble enigma existing in our technology: it is in principle easy and straightforward to calculate potential damages that might be realized under such postulated accident conditions; there is not even in principle an objective and quantitative method of calculating probability or improbability of acci- dents or the likelihood that potential hazards will or will not be realized. Nothing has occurredsince 1965 to cast any doubt on Dr. Beck's words. 3. [List your recon~mendations for changes in the design and layout of control rooms.] If the reactors are to be defueled, as I believe they must be, no control room, or control room changes, would be necessary. 4. [Should there be a standard design for control rooms and for the layout of control panels?] Again, no control rooms at all would be necessary if the reactors are to be defueled and conmiercial radioactive waste production terminated. However, even if the decision is made to place public safety in a position subordinate to corporate profits, standardized control rooms would be a difficult goal to realize, because, by~ necessity, the controls for a BWR must be at least somewhat different from those of a PWR, and even among the PWR5 of the three U.S. manufacturers, there would be features found on one type which would not be found:on others. But the problem of standardization is even more complex, because to accept a "standardized" design for even one manufacturer would require the assumption, still not the experimentally determined fact, that all design problems have been identified in advance of standardization and have been remedied. We have no assurance, as should have been learned from the ThI-2 accident, that all such design deficiencies have indeed been identified. Control rooms are, in this regard, just an extension of a hazardous technology not yet understood. PAGENO="0225" 221 5. [Proyide a list ~f recommendations for improving the safety of nuclear power plants() The ~ way to insure that the worst imaginable reactor accidents will not occur is to insure the ppssibili~y of such an occurrence is prevented. The only known, as opposed to estimated, projected, calculated, hoped for, or fantasized, way to do this is to shut them all down, permanently. At the present time, we must assume that the probability that' all design defects in the presently operating nuclear reactors (and their associated control rooms) have been identified is zero. The present method of assuring safety as practiced by the NRC is that of edict and speculation. The edict is in the form of an NRC rule to prevent public interest intervenors, like ECNP, from litigating safety issues in reactor licensing proceedings. The speculation is the extrapola- tive kind of mathematical calculation, model creation, simplification, and approximation necessary, in the eyes of the NRC, to support the edict. An example is the ECCS problem, where litigation of ECCS issues was terminated by the issuance of an edict Incorporated into the rules of the NRC. Such practices, as the issuance of edicts by the NRC, are' effective means of preventing litigation and public discussion of important safety issues, but there is no assurance that the edict, `or the speculation upon which It Is based, is effective at preventing accidents like TMI-2, 6. [Is there a need to improve the radiation monitoring facilities for nuclear power plants?' List your recommendations.] The environmental mOnitoring (and accident monitoring) around nuclear power plants is abominable. It is based on two unsupported assumptions: (a) all utilities operating nuclear power plants can be trusted to furnish accurate and complete monitoring data,and, (b) accidents won't happen. To avoid the classical "fox guarding the chicken house" situation, it would be advisable to have some agency other than the utility or the NRC perform the all-important job of environmental monitoring. Ofcourse, if there were really a serious intent behind environmental monitoring, other than simply having a utility, employee waving data in the air to show that no radioactive materials escaped a particular plant it would begin with a thorough baseline epidemiological study of the people within, say, a thirty mile radius of the proposed facility ~ to the operation of the facility. The TMI-2 accident, if, .nothing else, showed just how poorly agencies of the federal government--even'agencies having three decades of experience with environmental radiation monitoring--can collect data when an accident does happen. About the only way the monitoring could..have been worse would have been for the only monitor~ing to have been that of Metropolitan Edison Company. To resolve these problems, I suggest that some agency not dependent on the continuance of nuclear power--as are the NRC, DOE, AIF, EEl, EPRI, or the particular utility--do the environmental monitoring. A likely car~didate would be some state agency, financed by a state tax on nuclear facilities. 48-721 0 - 79 - 15 PAGENO="0226" 222 This suggestion assumes that the ECNP recommendation of a complete, and permanent shutdown of all commercial reactors is not accepted. Monitoring in the case of accidents should be done with the idea in mind that accidents happen at times when they are not expected. The moni- toring capability should extend out to at least fifty miles, and the monitoring devices should be capable of detecting, on an isotopic basis, beta and gamma radiations from both gaseous and particulate sources. In addition, these, and the normal environmental monitors, should be distributed in numbers in the hundreds,thousands, or even higher numbers, according to population densities, so that the members of the public at risk due to this inherently dangerous technology can be promptly and fully informed of the actual risk they bear and the actual radiation doses they receive. 7. [In your testimony you stated "I have been lulled into this false sense of security about nuclear reactors." Please provide more detailed background on this statoment.] There is little more to be said. Core meltdowns have not occurred on a monthly or annual basis. But the present course of action, which is geared to react only after the fact of an accident,appears to guarantee that someday-- maybe next week, next month, next year, or whenever--an area "the size of the state of Pennsylvania" will indeed be lost. Perhaps this Committee should hold hearings on the economic impact to the U.S. if, say, Pennsylvania had to be evacuated for as long as four strontium-90 half-lives due to a reactor accident. The economic impact of such an accident would be catastrophic to the U.S. economy, perhaps even ~rse than that of a limited nuclear war. Yet this "war" will have come from within, under the guise of "progress" or simply the illusion of cheaper electricity.: 8. [Your testimony indicates that until the time of the Three Mile Island accident you felt a sense of security about nuclear power plant operations. Is this correct? As I stated in my testimony, this false sense of security was in part based on the belief that when a serious reactor accident did happen, it would be in someone else's backyard. I was mistaken. I made a serious mistake. However, I have learned a lot from this tragic experience: None of the assurances of "safe, clean, economical" nuclear power will ever be believed again. 9. [Provide a list of the locations at which you believe radiation monitoring equipment was installed and the locations at which measurements were made during the Three Mile Island accident. Provide the following reference data: (a) The source of your informatiOn. (b) The Agency responsible for the ,equipment. (c) The time and date at which measurements were made. (d) The "end use" of the data. For parts (a), (b), and (c), these pieces of information about which I have been talking in reference to monitoring around TMI-2 during the period of the accident are all contained in the report entitled "Population Dose PAGENO="0227" 223 and Health Impact of the Accident at the Three Mile Island Nuclear Station." by the Ad Hoc Population Dose Assessment Group, May 10, 1979. The "end use" of this data was to present a rosy picture to the American people that the actual numbers of deaths attributable to the accident will be only about one death. However nice such rosy pictures are, in this case, the rosy picture is an enormous fabrication, distortion and misrepresentation of the actual population exposures. The "end use" boiled down to the public relations approach employed with the Reactor Safety Study, WASH-l400. There, the Study was widely hailed as the last word in describing how safe nuclear reactors were. In the end,~its use was far more as a public relations gimick rather than a scientific study. It has now been thoroughly debunked. 10. [Your testimony indicated that you believe that the Nuclear Regulatory Comission was dishonest in the Use of certain data. Please provide references to support your view. I have no "references" to provide such an answer. However, Ido have my own analysis of-the data which suggests that the analysis carried out in the report cited above was seriously flawed. If this were the first time such ananalysis had ever been performed, fundamental defects might be expected. Not only were the data which were used very deficient, but also the analysis used took no account of the serious deficiencies and internal inconsistencies of the data presented. In addition, the Ad Hoc group'presented four analyses of the data and averaged them to arrive at a population dose estimate. Yet no distinction was made at all as to which were the better or the more applicable analyses to the real situation. The data were deficient ma number of ways, at least including the problem that for all time periods discussed in the report, there were far too few dosimeter locations in operation to provide, adequate monitoring data at any distance. But worse yet, there were none reported at distances beyond 15 miles for the Metropolitan Edison locations and none beyond 13,8 miles for the NRC locations. As a result, much valuable data was lost due to the refusal of the NRC to believe that measurable activity levels could occur at distances greater than these. This policy of "protection" by omission must be changed. The Ad Hoc group made no attempt in their report to assess the validity or the quality of the data which they used in their analysis. In particular, 1. The Ad Hoc group failed to see the disparity between the 1978 Met. Ed. background data between the "indicator" and "control" locations. (Table 3-5). Nor did the group see any difference between the Met. Ed. data for the two kinds of.dosimeters (Table 3-5 vs. Table 3-6). This problem was exacerbated by the fact that TMI-l was in operation at this time contributing to the supposed "background." 2. The Ad Hoc group apparently did not notice that many of the dosimeter readings of Met. Ed. March 31, 1979, through April 6, 1979 period (Table 3-3) measured not only much lower levels of exposure than did NRC dosimeters at the same locations for about the same period (Table 3-4) but also many of these Met. Ed. dosimeters recorded exposuresof even `less than background. Yet these zero and negative value~ were used essentially unquestioningly. PAGENO="0228" 224 3. The Ad Hoc group made no assessment of errors, systematic Or otherwise, in its report. Nor was any mention maØ~e, in connection with the many consistently low Met. Ed. TLD readings, of the fact that the Met. Ed., and NRC, TLD's were read by Radiation Management Corporation, which is a wholly owned subsidiary ofPhiladelphia Electric Company. Neither the Ad Hoc group nor the NRC itself apparently saw any inherent conflict of interest in having such a subsidiary of another utility doing environmental monitoring for Metropolitan Edison, in addition to Philadelphia Electric itself. It is difficult to imagine how much more closely the chickens could be guarded by the foxes than here. 4. The Ad Hoc group made no attempt to insure that the dose vs. distance model that was used to calculate radiation exposures to populations outside the range of the available dosimeter* readings actually fit the available data. This serious defect makes the DOE projections of doses in Appendix A of the report utterly meaningless. This is particularly important where, as with certain sectors (South; South West, and North West, North, and North East) the exposures for the period March 31through April 7 (NRC data), simply did not decrease rapidly with distance, as the model requires. In fact, toward the Northwest, toward Harrisburg, the doses increased with distance from ThI-2. This observation is not reflected in the scanty, inconsistent Met. Ed. data. 5. In a meeting before the NRC Commissioners on Thursday, June 21, 1979, almost three months after the initiation of the TMI-2 accident, NRC personnel revealed for the firsttime (publicly) that all of the radiation monitors in the vent stack at ThI-2 went off scale on March 28, 1979. As a result, the Commissioners were told (See Washington Post, Friday, June 22, 1979, page 3) that exposure measurements were inconclusive that day. It truly taxes my mind to expect anyone to believe that that simple fact was not known to the Ad Hoc group when its "study' was being performed. This belated disclosure fuels my contention that the Ad Hoc report is nothing more than an intentionally dishonest, misleading public relations "soother' or `pacifier." 11. [In reply to a question by Congressman Walker, you said that you would provide him with calculations that you had made of the potential fatalities caused by the Three Mile Island accident. Please supply these calculations together with an explanation of your treatment of the data in question. To date, the pressure of other obligations has not permitted me the luxury of sufficient time to carry out this important task. As soon as time does permit, these calculations will be forwarded to this Committee. PAGENO="0229" 225 12. [Were the relatively long-range radiation measurements made by helicopter survey, satisfactory? Provide a briet exptanat~on. ] and 13. [Did the "fall-off' or dose with distance, suggested by DOE measurements, satisfy you that doses do decrease with distance?] I have enclosed two graphs I have drawn using the data published in the Ad Hoc Population Dose Assessment Group report. Graph A is a plot of the total dose for the time period March 31 through April 7 taken from the Ad Hoc Group report, Table 3-4, which contains the dosimeter data of the NRC. Here I have summed the daily exposure recorded for each station for the entire time.period and have plotted that total dose by sector as a function of the distance of the stations from TMI-2. Straight lines were drawn between the stations in each sector.Graph B contains data for additional sectors not shown on Graph A. On both graphs is a curved line which passes through circled points. This curve represents the doses that should have been observed at these distances in accordance with the dose vs. distance model that was used by the Ad Hoc group. The Ad Hoc group applied this model to extrapolate doses to the population in the 50-mile radius, beyond the 13.8 miles maximum distance where the NRC was actually recording doses, that is, where the lines end on graphs A and B. I plotted these curves to see if the data fit the model in the region where recorded data did exist. While some of the lines on Graph A show at least some similarity to the theoretical curve, on Graph B the situation is very different. Here none of the sectors show the expected behavior. These data suggest that the doses did not fall off with distance in at least some sectors as the DOE helicopter data suggest. ~Since the NRC dosimeters were placed ( in principle) at or near ground level, where people tend to be found, these data are preferable to projections which are not supported by data. Lastly, the DOE measurements do not En any way satisfy me that the doses decrease with distance. PAGENO="0230" 27 V 226 ~1k O.$nc~ : 1~' 12 ch~. I d~ ~/31 J//7 /0~ g. * I ~ D~z~a~ ~oc,~4s ~ * a. *~e Ykc.s'e ~oc~it4~ ~ * dose. oat 3/31.-q/, ~ tk~ dc,s~,xe~ers ~4~c.~.'c'* q. * 2 -*,*---~-` I ~ I * * 2. 4 9 I0~ 12. ~l'i PAGENO="0231" .1*.:. w. S Nu) . . So.' SW. . . : . ~ ~ p~47Ls C~ilc~/aj4d a. (d~~a.~e) MadLY. :. 227 I0~ .9, 7. dose, 1$,. m ic, 3. * ~ `~, (~2- `4 * J~~5z~cLnce, y,111es * * PAGENO="0232" C... -~. -~. :. cD L) ~ ~ ~ ~ ~ ~ ~. ~ C. C. ~ .. . -~ ~ (Ji ~ C.~-~* (t H PAGENO="0233" 229 SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION HEARINGS ON NUCLEAR POWER PLANT SAFETY ADDITIONAL QUESTIONS FOR MR. SAUL LEVINE 1. List the lessons learned from the accident at Three Mile Island and provide recommendations or suggestions for rectifying the problems in question. 2. In your testimony you said that many of the details of the accident at Three Mile Island had to be filled in. Did this imply that the Interim Sequence of Events' provided by Mr. Denton on May 23 is incomplete, or that it had not been brought to your attention prior to your testimony? Is this sequence accurate? 3. Please expand upon your comment: "From the viewpoint of nuclear power plant safety design, two principal technical elements are involved in TMI. The most important is that the plant was configured so that the pressure relief valve on the primary coolant system opened very often due to events such as a failure of nor- mal feedwater flow to the reactor." Does this imply an abnormally high frequency of failure of the feedwater supply or a poor design in the plant or equipment? 4. You indicated on page 5 of your testimony that there are significant differences in relief valve behavior between the reactor studies in the Reactor Safety Study and Three Mile Island. It would seem useful to apply Reactor Safety Study tech- niques more broadly to see if other such differences can be found. Are you doing anything about this? 5. On page 6 of your testimony you indicate that the bulletins issued by the NRC should significantly reduce the likelihood of future TMI events. Are you satisfied that these are the only actions needed? 6. On page 7 of your testimony you note that you are going to reexamine the basis for the Reactor Safety Study-predicted failure probability for the auxiliary feedwater system. Do you think that the RSS prediction was seriously in error? 7. On page 7 of your testimony you indicate that the techniques developed in the Reactor Safety Study can be used effectively to help determine improvements that may be needed in the safety of nuclear power plants. Could you elaborate on this matter? 8. In regard to the consequences of the TMI accident, list the work that you said would be in addition to that specified in the FY 1980 budget request. 9. In your testimony you mention the preparation of a supplemental budget request. When will you have this finished and when will you be able to provide a list of the items involved and an indication of their relative importance? PAGENO="0234" 230 Fir. Saul Levine Additional Questions Page Two 10. Is there a need for a Swat Team composed of people from industry, the utilities, NRC, etc.? 11. Should nuclear power plant operators be utility company employees? Are there any reasonable alternatives. 12. Are there any advantages in standardizing the design of nuclear power plants? 13. Co you think that Computer i~odeling could be of importance in improving operator training, or in developing response strategies for multi-failure, multi-error incidents? 14. Is there an adequate data base upon which to develop a good computer model? 15. In your view, is there anything in either the Rasmussen Report, or in the Lewis review, which if implemented would have decreased either the probability of the Three Mile Island accident, or which would have reduced its severity? 16. ist your suggested modifications to the LOFT experiments, and provide details of the transient analysis that you mentioned. 17. List the future reactor research safety programs that you mentioned. PAGENO="0235" 231 ~s REG~ UNITED STATES - NUCLEAR REGULATORY COMMISSION WASHINGTON 0. C. 20555 JtJL ~ ** ~ The Honorable Mike McCormack, Chairman Subcommittee on Energy Research and Production Committee on Science and Technology United States House of Representatives Washington, DC 20515 Dear Mr. Chairman: Enclosed are the responses to your additional questions resulting from Saul Levine's May 22, 1979 testimony before your Subcommittee. We hope the answers provided will add the additional information desired to assist the Subcommittee in its important deliberations. We will be most happy to provide you or your Subcommittee members with any requested additional information or clarification as needed. Sincerely Gossi~~ Executive Director for Operations Enclosure: As stated PAGENO="0236" 232 Response to Additional Questions Relating to the May 22, 1979 Testimony of Mr. Saul Levine to the Subcommittee on Energy and Production Hearing on Nuclear Power Plant Safety l.Q List the lessons learned from the accident at Three Mile Island and provide recommendations or suggestions for rectifying the problems in questions. A. As part of NRC's investigation of the Three Mile Island (ml) accident a task force titled "Lessons Learned" has been set up to identify areas where improvements are needed in plant design, operation, and accident response. The task force is being directed by the Office of Nuclear Reactor Regulation and the main aim of the task force is to make recommendations for changes in the licensing process to reduce the likelihood of severe accidents at commercial nuclear power plants in the future. The task force consists of approximately 22 full-time staff members. The staff members are from various offices of the agency, including the Office of Nuclear Regulatory Research (RES)~. The task force expects to make specific recommendations on the NRC's accident response role and on management, administrative, and technical capabilities necessary to effectively deal with hazardous conditions that may arise at licensed facilities. The task force will review the current practices for accident response, make comparison with TMI events and provide recommendations. The task force will probably last for several months with interim reports given to the Commission as information is developed( 2.Q In your testimony you said that many of the details of the accident at Three Mile Island had to be filled in. Did this imply that the "Interim Sequence of Events" provided by Mr. Denton on May 23 is incomplete, or that it had not been brought to your attention prior to your testimony? Is this sequence accurate? A. I have no doubt that the "Interim Sequence of Events" provided by Mr. Denton is accurate. My statement was meant to cover the possibility that, as additional study of the TMI-2 accident is made, some more significant information might come forth. PAGENO="0237" 233 2 3.Q. Please expand upon your conmient: "From the viewpoint of nuclear power plant safety design, two principal technical elements are involved in TMI. The most important is that the plant was configured so that the pressure relief valve on the primary coolant system opened very often due to events such as a failure of normal feedwater flow to the reactor." Does this imply an abnormally high frequency of failure of the feedwater supply or a poor design in the plant or equipment? A. This does not imply a high frequency of failure of the feedwater supply. All reactors are designed to accommodate transients involving loss of feedwater, that occur several times a year; however, it is clear in the B&W case that the relief valve lifts each time there is a loss of main feedwater and this is an undesirable situation that has been corrected by the bulletins issued by the NRC since the TMI accident. 4.Q You indicated on page 5 of your testimony that there are significant differences in relief valve behavior between the reactor studies in the Reactor Safety Study and Three Mile Island. It would seem useful to apply Reactor Safety Study techniques more broadly to see if other such differences can be found. Are you doing anything about this? A. Reactor Safety Study techniques are already being applied in a broader way and it is our hope that.such quantitative risk assessment applications will increase in the future. For instance, in the Methods Application Program we are studying four plant designs which are different from those in the Reactor Safety Study to further extend our engineering insights into reactor safety. These analyses include a wide range of plant safety systems, components, and operator activities. We are also currently applying the techniques of the Reactor Safety Study to assist the Office of Nuclear Reactor Regulation in a review of the auxiliary feedwater systems of about 30 nuclear plants. In addition, we are presently developing an integrated reliability evaluations program in which event trees will be constructed for all plants having significantly different accident sequences. System logic models will be constructed for the critical systems identified from the event tree analysis. This effort will be performed on a priority basis and will provide an integral view of the input design differences on plant safety. PAGENO="0238" 234 3 5.Q. On page 6 of your testimony you indicate that the bulletins issued by the NRC should significantly reduce the likelihood of future ThI events. Are you satisfied that these are the only actions needed? A. I am satisfied that these were the most imediate actions needed. I believe that additional actions will have to be taken in the future as we digest more of the lessons of the TMI-2 accident. However, these are not as urgent and require some careful analysis before they can be effectively implemented. Some of the general directions that have to be explored are indicated in the research topics included in my testimony. 6.Q. On page 7 of your testimony you note that you are going to reexamine the basis for the Reactor Safety Study-predicted failure probability for the auxiliary feedwater system. Do you think that the RSS prediction was seriously in error? A. We believe that the RSS prediction is not seriously in error. This judgment is based on the fact that each auxiliary feedwater system is tested about 12 times per year and is called on to operate about three or more times per year. Given at least 3000 trials of these systems. over the years, we are aware of only one instance (ThI-2) where the system was completely disabled. We will of course have to do further evaluations as further data become available. 7.Q. On page 7 of your testimony you indicate that the techniques developed in the Reactor Safety Study can be used effectively to help determine improvements~that may be needed in the safety of nuclear power plants. Could you elaborate on this matter? A. Quantitative risk assessment techniques can be used, for instance, to determine the relaUve safety significance of various design features in a plant and among plants. For example, we are currently applying risk assessment methodology to 30 nuclear plants with various designs to look at a wide range of safety systems, components, and operator activities. Also, a number of priority areas for investigation have been identified using risk perspectives in the Improved Safety Program (which was transmitted to Congress in early 1978 as NRC document NUREG-O438). PAGENO="0239" 235 4 8.Q. In regard to the consequences of the TMI accident, list the work that you said would be in addition to that specified in the FY 1980 budget request. 9.Q. In your testimony you mention the preparation of a supple- mental budget request. When will you have this finished and when will you be able to provide a list of the items involved and an indication of their relative importance? l7.Q. List the future reactor research safety programs that you mentioned. A. We would like to undertake a significant amount of important research in FY 1980. We are preparing a FY80 supplemental budget request for FY80 to cover this area. I have attached a copy of the requested budget supplement for FY 1980. All of the items listed in the requested budget supplement are considered to be of high priority. This budget supplement request is still preliminary in that it has not been approved by the Cormnission. Projects for future reactor safety research currently include continuation of much of the work included in the FY 1980 budget and the FY 1980 supplemental budget request. Areas where new programs are likely to be suggested are in improved reactor safety, improved risk assessment methodology, and some areas of exploratory research as suggested by the Advisory Comittee on Reactor Safe- guards (ACRS). lO.Q. Is there a need for a "Swat Team" composed of people from industry, the utilities, NRC, etc.? A. Yes. Regional teams of nuclear experts specially trained to assist during serious accidents at nuclear facilities could be a valuable resource during an emergency. The group would provide expert advice to plant management during an emergency; however, they should not be chartered to take over operation of the reactor; the utility's power plant operators should continue to operate the reactor. ll.Q. Should nuclear power plant operators be utility company employees? Are there any reasonable alternatives? A. Yes, plant operators should be utility company employees. We do not believe that reasonable alternatives exist for using operators who are not employees of the utility company. Under current methods of assigning safety responsibility, the utilities are held accountable for safe operation of the nuclear power plants and the use of other than utility operators would remove this accountability. PAGENO="0240" 236 5 l2.Q. Are there any advantages in standardizing the design of nuclear power plants? A. Many of the initial difficulties faced in coping with the TMI incident would have been reduced had TMI been one of a family of standard plants under a standardization policy implemented with a high degree of discipline; standardization provides a policy and framework for the staff and the industry to know, understand, and model the response of plant systems, and thus, to quickly and effectively analyze differing situations. This suggestion is based upon the assumption that the number of nuclear power plants will continue to expand, perhaps substantially, beyond those presently committed. With the number of reactor vendors, architectual engineers, and site specific needs there will be some difference in design between individual plants. However, the potential benefits such as facilitating licensing review and faster response during emergency or accident situations would indicate a need for standardizing plant designs. l3.Q. Do you think that Computer Modeling could be of importance in improving operator training, or in developing response strategies for multi-failure, multi-error incidents? A. Yes. We are planning to investigate the feasibility of programming a control room simulator to simulate numerous transients (WASH-l400 event trees might serve as a guide) with which control room operators could be trained. Also we are looking at the technical feasibility of using real-time computerized systems to monitor plant status, display information, diagnose upset conditions and prescribe remedial action as aids to nuclear reactor operators. l4.Q. Is there an adequate data base upon which to develop a good computer model? A. A sufficient data base does exist to begin development of a computer model for system response following transient and small LOCA events. However, additional system data will be required to upgrade these models and to test and validate the model application to reactor systems. We expect that the planned tests in Semiscale and LOFT, which we will undertake soon as a response to lessons we have learned because of the Thi accident, will provide much of these needed additional data. PAGENO="0241" 237 6 15.Q. In your view, is there anything in either the Rasmussen Report, or in the Lewis review, which if implemented would have decreased either the probability of the Three Mile Island accident, or which would have reduced its severity? A. The Rasmussen Report noted that the small break LOCA had a potential for a significant contribution to public risk. Also, human factors could determine the direction of events and have the potential to turn a less severe accident into a moresevere accident. It is possible that if more attention had been paid to these areas the accident at TMI-2 would not have been as severe and that the agency would have been better prepared to respond. The Lewis Report contains recoimiendations about the use of risk assessment techniques to improve reactor regulation. However, the period between publica- tion of the Lewis Report and the TMI accident was too short (only a few months) that very little in the way of specific implementation has had a chance to occur. l6.Q. List your suggested modifications to the LOFT rxperiments, and provide details of the transient analysis ~hat you mentioned. A. The LOFT test program which was established prior to TMI was to have continued the large break tests in FY 1980 (simulating loss-of-offsite power and at different power levels). However, our current plan is to delay the large break tests and run three small break tests and one natural circulation test during FY 1980. These tests are more relevant to the TMI-2 accident analysis and therefore have been given higher priority. Prior to the TMI-2 accident the emphasis of the code development program was on developing a multi-dimensional thermal-hydraulic code for large break LOCA's in PWR plants. For small break LOCAs and certain types of non-LOCA transients that are of much longer duration, we need a much faster running code. Fortunately geometrical details are less important in these analyses and can be simplified allowing the codes to run faster. To this end Los Alamos Scientific Laboratory is in the process of producing a code (TRAC-PF1), on an accelerated basis and should be available by the end of this calendar year. 48-721 0 - 79 - 16 PAGENO="0242" 238 DISCUSSION OF RESEARCH NEEDS TO ADDRESS ISSUES RAISED BY THE TMI ACCIDENT The major areas of research needs arising from the TMI accident are discussed below. It is clear that small LOCA, transient events and enhanced operator capability are areas that need additional research resources. In particular, better computer codes are needed (1) to enhance our under- standing of small LOCAs and transients, (2) to allow multitudinous studies to be made of these types of events and the many variations that can occur -in them, and (3) to predict with greater precision than now available the behavior of plants in response to such events. The -development and checking- of these codes will require experiments in - such facilities as LOFT and Semiscale (for PWRs) and TLTA (for BWRs) to provide insights to develop the physical models in the codes and to check their range of applicability. The availability of these same codes will allow studies to be made toward enhancing operator capability. Studies will be made of simulator requirements to enhance their capabilities for training plant operators, analyses of the instrumentation needed by operators to understand and react properly to the full spectrum of potential reactor accidents, and studies of the control room display and diagnostic equipment needed to assist the plant operators in effecting proper responses and insuring that limiting conditions of operation are met. In addition, these same codes will allow us to analyze the startup transient tests already performed on operating reactors and will give NRC the understanding and the basis for s~ecifying additional startup tests that may be needed on operating plants. At the same time, risk assessment tasks to construct event trees are needed to define accident sequences covering severe core damage which the codes must calculate and to guide the research tasks needed to assess the potential impacts of human error on the course of these types of-accidents. In parallel with these studies it is necessary to investigate potential means for improving plant design features such as improved decay heat removal and ECC systems, vented containment concepts, etc. Also of great interest is the need to better understand-the response of plants to accidents of the kind that occurred at ThI. It is clear that we need a better understanding of primary coolant chemistry after severe fuel damage, hydrogen evolution and behavior in the primary coolant system and in the containment, behavior of important plant components under long term, severe accident environments, equipment qualification and testing requirements and structural analysis of important plant components and safety features under accident conditions. Finally, it is important to preserve the data on the amount and dispersion of fission products throughout the plant and to examine the ThI fuel to assess the type and extent of damage to the core. In parallel, it will be necessary to examine safety-related equipment in the plant to assess the extent of damage and to establish criteria for safety requalification of the plant. PAGENO="0243" 239 -2- IDENTIFIED RESEARCH NEEDS (~~j_ FY 80 Supplement - ($ Million) A. Better Understanding of Transient and $13.4 Small LOCA Accidents B. Enhanced Operator Capability 3.8 C. Plant Response Under Accident Conditions 5.1 D. Post Mortem Examination and Plant 2.7 Recovery E. Improved Risk Assessment 3.1 F. Improved Reactor Safety $ 29.8 Each of these research areas is further subdivided into research tasks in the tables below: A. Better Understanding of Transient and Small LOCA Accidents Modifications and Checking of Existing Codes to $ 3.1 Improve their Capability to Handle Transient, Natural Circulation and Small LOCA Accidents in PWRs and BWRs Upgrade Semiscale to Study PWR Transients 3.0 Upgrade TLTA to Study BWR Transients and Small LOCA 2.2 Modify LOFT to Accelerate Small LOCA Tests i.o Separate Effects and Thermal-Hydraulic Tests 1.3 Coolability of Severely Damaged Cores; Release and 2.4 Transport of Fission Products Establish Data Bank for Each Operating Reactor 0.4 for NRC Calculations $13.4 PAGENO="0244" 240 B. Enhanced Operator Capability _________ Develop Improved Control Room Display and Diagnostic $ 1.8 Systems and Improved Requirements for Operator Training Simulators Develop Instrumentation Needs and Improved Status 1.0 Monitoring of ESFs Define Data Transmission Requirements and Review 1.0 Accident Response Procedures $ 3.8 C. Plant Response Under Accident Conditions Improved Understanding of Coolant Chemistry after 0.5 Fuel Failure; Better Sampling Methods Hydrogen Behavior in Coolant and Containment; 1.2 Effect of Hydrogen Explosions Response of Plant Equipment and Structures to 2.1 Accident Conditions Potential Design Improvements for Maintaining 0.5 Containment Integrity under Fuel Melt Conditions Benchmark Testing of Structural and Piping System 0.8 Analysis Codes - $ 5.1 D. Post Mortem Examination and Plant Recov~~y Examine Samples of TM! Damaged Fuel 1.0 Measure Fission Product Chemistry and Plateout 0.6 Data Post Mortem of TM! Safety Related Equipment and 1.1 Estabi ish Requal ification Criteria $ 2.7 E. Improved Risk Assessment Develop Event Trees of Accidents Leading to Severe 1.4 Core Damage and Assess Site Specific Accident Consequences Analysis of Human Error Rates and Impacts of Human 1.2 Errors on Risk Operational Failure Data Analysis $ 3.1 F. ~~p~oved Reactor Safety Improved Containment Concepts $ 0.5 Improved Safety Systems for Coping with Accidents 1.0 Involving Severely Damaged Fuel Improved Value/Impact Methodology $ 1.7 PAGENO="0245" C, 0 ~cn- 0 ri ~co g~z cn 11~»= `i (flZ C, -x mo Cflr 0 6, Ccv) *1 ~+ -S -~ Z 22-n -~ 3 ~S) _~-~ o ~()O2O ~< o~ -~ ~ 3 2 22-us ~< (S (52-3. C) -S 2.2 2 CS -` -u us -~ uu Cu 2 <$ (D-C 52u, CD CC) C.O p ~- ~Jfl ~ PAGENO="0246" 242 SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION HEARINGS ON NUCLEAR POWER PLANT SAFETY ADDITIONAL QUESTIONS FOR DR. HAROLD LEWIS 1. Would there be any advantages in standardizing the design of nuclear power plants? 2. Is there any need for a Swat Team composed of people from industry, the utilities, the NRC, etc.? 3. Should there be a standard design for control rooms and for the layout of control room panels and instruments? 4. List the research and development programs which you would recommend to improve nuclear power plant safety. 5. Expand upon your comment that the NRC has made little use of the Rasmussen Report. 6. List the "substantial problems" that you mentioned you have found in the Rasmussen Report. 7. Expand on your comment that constructive human intervention was required to modify the course of the accidents at Three Nile Island and Browns Ferry. 8. Expand on your comment that a flexible response is a key to limiting the course and the consequences of accidents. What computer aid or assistance would you suggest be provided to nuclear power plant operators? 9. Identify the lessons which have been taught as a consequence of the Three Mile Island accident. Provide recommendations or suggestions for overcoming these problems. 10. Do you think it is time for an updated version of WASH-l400 modified so as to incorporate: your criticism of the risk assessment methodology; and a consideration of transients, small LOCA and human errors as important contributions to overall risk? 11. In your opinion, is there anything in either the Rasmussen Report, or in the Lewis review, which if implemented would have decreased either the probability of the Three Mile Island accident or which would have reduced its severity? PAGENO="0247" 243 UNIVERSITy OF CALIFORNIA, SANTA BARBARA REEL N AN RSID N SEC N FRAN ~ NTA RB BA NT DEPARTMENT OF PHYSICS SANTA BARBARA, CALIFORNIA 93101 27 June 1979 The Honorable Mike McCormack Chairman, Subcommittee on Energy Research & Production Committee on Science & Technology U.S. House of Representatives Suite 2321 Rayburn House Office Bldg. Washington, D.C. 20515 Dear Congressman McCormack, Thank you for your letter asking me to reply to a number of questions intended to amplify my testimony before your Subcommittee, on May 22nd. I'm sorry this is a bit later than you had requested, but I was out of town and slow to receive your letter. I hope this is sufficiently timely. 1. (Would there be any advantages in standardizing the design of nuclear power plants?): Ultimately there will be advantages in such standardization, since it will reduce the number of specific plant designs which require de- tailed analysis. For example, it is apparently so that there are now some 24 separate feedwater systems among pressurized water reactors, since the design of the feedwater system is left to the architect- engineer. However, in my view, it is premature to move toward stand- ardization while there are still so many generic safety issues out- standing. 2. (Is there any need for a "Swat Team" composed of people from indus- try, the utilities, the NRC, etc.?): I do not see a need for such a "Swat Team", provided we work very hard in upgrading the instrumentation and training available to reactor operators, to enable them to cope on-site with a greater variety of accident situations. On the other hand, lists of experts on specific issues, and dedicated communications make sense, just to reduce the lead time necessary to obtain useful advice. As has been said before, the characteristic of a reactor accident is that it takes a long time to develop, so that consultation is feasible. PAGENO="0248" 244 3. (Should there be a standard design for. . control rooms and for the layout of control room panels and instruments?): I don't believe that one could now construct a good standard design for control rooms. There is a great deal of variety, and a greatly enhanced level of study of what is called the "man-machine interface" is necessary, before one can decide which layout of control room panels and instruments is optimal for the widest variety of accidents in which the operator can intervene constructively. 4 (List the research and development programs which you would recommend to improve nuclear power plant safety.): I am reluctant to answer this question, since I am sitting on the Advisory Committee on Reactor Safeguards, which will be reviewing the NRC safety research program. On the other hand, the report of the American Physical Society had very detailed recommendations for the reactor safety research program, and I still support those recommen- dations. I an particularly pleased that Bob Budnitz, who served on that panel, as well as on the Risk Assessment Review Group, is now deeply involved in the formulation of the NRC safety research pro- gram. 5. (Expand upon your comment that the NRC has made little use of the Rasinussem Report.): My principal concern is, as I stated in my testimony, that the NRC response to our criticism of the Rasmussen Report included the asser- tion that it has made little use of it in the past. I believe that the Rasmussen Report, flawed though it was, still represented a major and serious, effort to delineate the principal reactor accident sequences, and that the wisdom thereby provided ought to have been seized upon to orient the research and regulatory programs of NRC. In particular, as an example, the Rasmussen Report should have direc- ted rere attention at small LOCAs and transients, and who is to know whether one might thereby have prevented the accident at Three Mile Island. I personally believe that the NRC overemphasis on large LOCAs has been in part a response to ill-considered intervenor pressure, which has outlived its usefulness. 6. (List the "subsstantial problems" that you mentioned you have found in the Rasmussen Report.): For this you should have our Risk Assessment Review Group Report, but the list included there is, succinctly: statistical errors, an inadequate data base, inadequate ability to quantify common cause failures, an inadequate treatment of human response issues, etc. PAGENO="0249" 245 7. (Expand on your comment that constructive human intervention was required to modify the course of the accidents at Three Mile Island and Browns Ferry.): At Browns Ferry a control rod drive pump was used to cool the reactor in other than the normal mode, and substantial repairs were accomp- lished on failed relief valves. These are simple examples of many places in which the plant superintendant, Jim Green, directed a major human effort to save the plant. One has only to read the chronology to recognize the importance of this. At Three Mile Island, after the initial errors and the consequent core damage, intervention consisted of managing the temperature and pressure of the plant, managing the size of the hydrogen bubble, removing the hydrogen bubble, and generally managing the cooling of the plant. In this case, of course, one can imagine even more con- structive human intervention earlier in the course of the accident. 8. (Expand on your comment that a flexible response is a key to limiting the course and the consequences of accidents. What computer aid or assistance would yu suggest be provided to nuclear power plant operators?): This is a comment which arises from a conviction that any accident sequence that threatens a plant will contain surprises, and that the number of possible accident sequences is sufficiently large that it is not likely that they can all be catalogued. Consequently there is a great premium on ability to understand what is happening inside a reactor during the course of an accident, and on appropriate response. As far as computer aid or assistance, though I have not thought this through, an ideal would be an ability to program pos- sible actions on a simulator to provide some guidance on the conse- quences of those actions. We should, however, be careful not to overstate the ability of a simulator to simulate a reactor under accident conditions, in an area in which the codes which go into the simulator have not been verified experimentally. 9. (Identify the lessons which have been taught as a consequence of the Three Nile Island accident. Provide recommendations or suggestions for overcoming these problems.): My lessons are, in brief, 1) There will be accidents. 2) These accidents will contain surprises. 3) Flexible and informed human response is essential to arresting the course of an accident. 4) Redundant and prolific instrumentation designed to des- cribe the state of a reactor in an upset mode is impor- tant, so that the human response can be informed. 5) Proper training, education, and selection of reactor operators is essential. // / / PAGENO="0250" 246 10. (Do you think it is time for an updated version of WASH-1400 modified so as to incorporate your criticism of the risk assessment method- ology; and a consideration of transients, small LOCk and human errors as important contributions to overall risk?): As I stated in my testimony, I do not think that an updated version of WASH-1400 would be sufficiently better than the current one to justify the effort. I do believe that the risk assessment method- ology, as we said in our report, should be far more widely used on subsystems for which it can be used well, and that it should also be used as a principal means of resolving generic safety issues. That more consideration needs to be given to transients, small LOCA, and human performance is now well known to everyone, and the problem is to get cracking on it. 11. (In your opinion, is there anything in either the Rasmussen Report, or in the Lewis review, which if Implemented would have decreased either the probability of the Three Nile Island accident or which would have reduced its severity?): Again, as I stated in my testimony, I find that both the Rasmussen Report and the Risk Assessment Review Group report emphasized the importance of understanding the issues of transients, small LOCA, and human performance. Attention to those recommendations, which have also been made by others in the past, would very likely have greatly reduced the probability of the Three Nile Island accident. In addi- tion, since problems of this sort have now been found to have occurred in other reactors at earlier times, a more attentive response to operating experience as a means of learning about the weaknesses of reactors, again as has been recommended for a long time, might have averted the Three Nile Island accident. I hope you find these comments useful. Sincerely, E.W. Lewis HWL/jb PAGENO="0251" 247 APPENDIX II ADDITIONAL MATERIAL FOR THE RECORD RON PAUL 1110 NASA 860*0 1 So~i 406 CODg*~ of the ~intttb ~`ttite~ HCoo*so~ 06 ~ou~e of ~.tpvtftntati13e~ (J~_ Ulasbingtun, a.e. 20515 77566 (713)753-1895 May 4, 1979 Honorable Jack Wydler Committee on Science and Technology Suite 2321 Rayburn Washington, D. C. Dear Jack: In response to your letter of May 1 soliciting comaents on nuclear waste, I am enclosing two articles by Dr. Peter Beckznann that I placed in the Record on april 24 and 25. I would appreciate it very much if they were entered into the record of your Subcommit'cee8s hearings. Sincerely, Ron Paul, M.C. * RP/jr Enclosures - -~ PAGENO="0252" PAGENO="0253" to t~. to n 0 z 0 ttj Ct3 03 a Co PAGENO="0254" 250 E 1744 CONGRESSIONAL RECORD - E'~iensioni of Re,,iarks April 24, 1979 I-~::~ PETR BECKMANN ~ ~ land h~s t*~ ~ ~ ~ did ~ ~ th ere~e toz: And the con- . PO\VER o~e leom r!-ocn o~hnt hnppcocd thccc? tolnoocot building. nthlch in enormously .. A. The accident at the Three Olile Inland strong and bs.llt to nlthstnod eren a jet . plant Is uoqucstlou~bly the most serious In plooe croahing Into It. held the codlonctisity HON. RON PAUL the 22-yeor hlsto~y of nuclear po~cr But the just as It should. That to What It ~as built most slgnlflccnt aspect of tbot accident seas to do. .0F . not merely that It produced no deoths. no But then it appears that another huroan IN THE BOUSE OF REPRESENTATIVES injured. no casualties, no Illness. no hctpttai- error was made by pumping rater Irons the a A Ti! 24 1979 laotian; but that the zero caoua fly figure usa . containment building to the suofllaey build- . - oat due to "good luck. The accident pro- log. mhlch held the radloactirlty better than S Mr. PAUL. Mr. Spcaker. energy expcrt duced a gigantic test of the principle of nu- It ~as eapectedto do. It lrm eloborate 011cm Dr. Petr Beckmann was Interviewed last clear safety; octmely the concept of the dc- whIch retoosed eserythlng radlooctlce except week b John Roes in the Review of the fenae In depth In ahlch. there ace many for the noble goses such as oeoco, argon, nod - - layers of compleoieotory and supplementary krypton. These are not retaIned by the body. * . aalety meosuras. Anotber oery Important Q. Then you slew the Three Mile Island Dr. Bcct.raann, pro mac a - potnt lx that It denionotrated the alosaaeuo Incident an proelIag the safety or nuclear Vervlty of Colorado, was born and U~ with whIch a nuclear-plant areldeat hap- poser? cated in Prague. He worked at a research ~eno, allowing plenty of ttoae to select . A. Yes Indeed. Whst we here seen In this institute of the Ccechoslovak Academy ccunteroneaaures, .~ ** cane Is a sequence of ecentu that took place of Sciences until 1963, when he had the Q. What was the nsalfanctlon; that Is, aser many boom, and by that I mean not chance to lecture at the University of bow did the accident occur? * * anly the caxlfsanctlons but also the human I d H r returned to Eastern A. All the details boee not yet been pub- errors. And yet there wan plenty of tIme to lithed, said the Nuclear Regulatory Cam- make testu, discuss end drcide what the best Europe. 55 if OS en a ~ *g mission and ether agencies are still oomph- options were and are, and to tote enuater- the United Scales * log their rrpsrta. Bat, from the available meosures. By coropnrisioo, how macis tlme Dr. Becknsann has Wrltten more than lnfurnsatioa, what happened at Them Mile and shat sort of coentrrmensurrs are araB- 60 scientifIc papers, as well as eIght, Island was a chain of four gigantic loilures. abel when an oil tooler explodes? books, and he publishes and edits Access ten osrchccilcal and two human. A pump An y energy facilily, by Its very nature, to Energy, a monthly newsletter on cireulotlog eccicot acter to the ccci ci she, cantatas a lot of pent-up energy. If that u Ic r power . * reactor foiled. Immediately and aulamatl- energy is retained suddenly It coo be desleuc- In the post-Three Mile Island hysteria, oaily the Emergency Core Cosling system tlce; and as bag an man is fallIble, It con h ed (E.C.C.S.) sea a action as was 55lp happen. In a ship or tanker iiquesed natural Dr. Bee mann . posed to do. Alan Immediately the control gas, a does, an oil tanker or refinery--the calm and xclenttflc. His n rr,iew cc - rode dropped dawn to abut-off the reactor, release of rncrgy Is sudden and disastrous. tams much Information of valor, and , just as they were designed to do. Macever There is Only one mception and that Ia the would like to call it to my colleagues the human errors now came Into play. Valves ease of a auclear plant. There even If the * attention: * * los the E.C.CS. system had teen msnually energy gets~loose asd does what it Is ant sssooos aeon Aesswcns shut by a workose,n, and an water did not supposed to do, such an a mritdso'n, It melto -- li * B - 1 lososed.iately go Into the care. On at Iceut doss into the earth for many is nura and ends * Q.Pro,easorBrr mono,se *~ - tw000casioanhuaoanbeloguworklnglnthe up ins big gloss marble aCCused earth. argumentu from the opponen o - plant tamed off the EC.C.S., allowing the Meanwhile you hare mane possible counter- erfhP~ufmri~hwould carp of the rosatar to be left uocosered by measures, upto and Incladiag evacuating noise nuclear waste or corn plutonium and * Nocethelesu, the built-In safeguards with- P p . .,,.,* - tts an d pet say by tare tog 5~ th Imp b b halo I re I and acrt ~Hrs~aidxrne~i Thr liii II 0? th A. Not really It wauld be mush easter. and solely before a meltdown was likely. y'.~_ A. Len first lurk at the process. Shauld cause vastly great damage. Car tetloriuto tO therm ore even If a meltdown had occurred there be a loss-or-coolant acridrat In a light- throw hood-grenades. or set off high cepln-. most probably there wauld have been no water reactor-that Is, a reactor that uses nives. at a dam above a city than for thorn to cansaitles because the cactcicmeat build- ordinary water, under pressure or stat, to brockisto a nuclear power plact. They would lag would have held the rodiosctlre gases. 0001 the core-the temperature of t~e fuel issue to assemble a vram of tchioaphreciea It rcvrd how steen It was hr withstanding rode may rise to the point where they melt who as the one hand could be gvoisuet or a hydeoeea esplasias sad it could rosily their light metal cladding. VIse heat ormm esperss In a large number of varied diaoip- base withstood stases eapimicas and radio- from the ecesinsulation of radiaaotlse fission lines, and yet on theatherhaodlaet005tu- aetive gases products in thefuelrods. * pid to realize that there are far easier osetis- That Liner-na Core Conltng Bc-stem to the worst possible cane, this material ads a! inflicting griesous injury on the pepsI- which han hers a articulsr ia-get ~g th~ would term a red-hot gao on the floor of the lotion at large. . * * anti-nuclear collies who claImed It could thick steel pressure teasel thnt would slowly plutonium Is of murse toclo, and if you nerer work stormed well under the asast melt through the steel and through the floor breathe plutoalalrn dust you nan get lung re ncl~itloaa, * . * . of the containment buIlding Into the earth misrer. But you will ant get that caaeri' far , * to a depth af noose 25 feet ar 5w where It Ia taco yearn, If at all. only & seep inept tee- The Iac,den at Three. Ic an would dissipate Ito heat. Very probably the rorist would use a weapon that takes years presided a arrere Se test w * as a, maId goo now encased in a glans marble of and ~esrs to kill Better to use finale nub- that the E.C.C.S. will pe. arm sin er fused earth could be remaved, even aslraged, atoners like arsenIc soB other clsemlenI and most adverse and unfa~eseen con ens. * whtlaout major caanplleatlona. Usless It can biological anslas that are diiflcsdt to trace, at he con loosen bu disg can con into an uadergrouad stream and munnged to HadinaetIae material can be detected in lsdi- end accUse gears and coon a hydrogen ox- rent steam Into a blowhole outoide,sll radio- crossly minute quantities, after alt arid so plosina. and, that the deters the sax sep satIre gases would still be rantoined Inside defensire mensuren can be taken ogalast ~ hal g to wh.eb ra the cacitslnmest building a! macrate and F rorseto pock knlf w uld be co re Pti"05i50 a~es th rtadi cure 10 1 ha th m lt site O.e~5 ~~~sas ral tOOk matje alas gases and laden escaped into th tanas- EP ~ dm15 han h d I flit Dr nuclear power plant ha far the p5rpose Of ~ - I I niaguafternucleararal- ry g di dl I p w d f ~ re~d~ t~ h~r~1~ 1~a~ mdf ~ 0 tom Caned han die m Id `t think Q. Could a euolear reaotar at spower plant matlcaliy was that the reaotor wan turned be thnn I:r ~iuidergrouad, shielded by ever' espbadc an that oae moeniag we might --_ a aff. Hawesor, yau easnat prevent the auo ear lying. cork and earth, enclosed to a pocket mustroom cloud looming over the debris fl.saiao products In the fuel rods from ~°~` d ~ - of a devastated power plant? * tlnutag to be hot, When part of the core A The uranium used In the powerplant becanse unmresed as the lerel ef cooling Q. How do the eopossreu to rodiaac V 7 reactors Is nat asflicieatly enriched f or an water dropped, the temperature rose and at the Three Mile Inland plea coiaparetO enplmion to accur. *The danger at the Three the best broke down sonic of the water halo our normal eopmure to background cad a' hIlle Island reactor In Peansybceala wan from Ito oonspoaestu, hydrogen and aoygen. The tb I hrdro en that farmed be ause of heat reactor core was damaged presumably by the A. A radlalogical health expert from the a°ter abe water hovel fell sad es d part oserheatlag. which may have caused meltIng Nuclear Regulatory Cansnslsslan, Frank th r - tar And actuall It now turns or warpIng of the fuel rods that are nue- Cangel, has stated that the cumulathue dose out that hydrogen did explode sad the con- rauaded by a llgbt-welght naelal cloddlag. of radIoactivity for a peroes livIng In the talonsent building witbstaod hIs farce with- Q. What about that so-called `leaking" of closest haune to the plant who bad rensalned out problem, * radioactivity autalde the plant? * out of doors far flee easseeuthoe days con- Q. Prafesnar Seckmsnn, the axaso medIa A. itadhoactlte gas escaped from the re- tlauously, 24 haura-a-day starting at the treatment of the accIdent at Three Mile Ii- - actor Into the asatahnnsent building those of the accident, could have receIved $5 PAGENO="0255" onq; puy patnnq atsq van ~ aa~~ ~a tan; a~ j~i ao; pus aouo q~* fl40 s~ç; ;fl uaa ~ o;~qnd aq; ~a; ;ou pp £aqr~ uoç~ 21a22 aip ?` S)(UB3 flu.zos flO £j;u33a.z ~ u;a~ uos~ndwo3 qtuoq-W03B GZfl 30j sy -v~pe.j ;o-swa.z;t~ OOO~2-stutz C pas;asaz u; u puv 9L61 CL61 UI untq puw apotdxa floltn2n paso~aq .tlaq; Sq Ptfl inim 3U81003 atj; jo atduzss. i a na s 3583BJ a tw~g no szaniq twit t~o an ats ;vq~ op a PUB paddo;s s £~;j; U; UT 3UU~ OqM 3UUId aq; ;v aaU.zoU aqU -U U ; I *sqaaM x~s e puiq tao daaq o~ qow p2U&dU aaMod aq; qq~ sacro aq; an s~toqB 2tqua Bansuaa q aaiq i~patu aur~ v aq; a ; ~ s; n ep B flU JO qaa £aq~ qa~qs u; £;a;ao~ q~noa-au B BJ 2 £111 -nq oooot Btnnq £;pBdBU BUBt%B2aw ooor &IIBa.z £aq; 3BU.A~ aOU sop; ajaq; ~; 2amod flOst aqvn UOflB; pu~a op tasa; ;Bq~ ;y ~ I . ~ B[ Bu pazaua3 pa.xg-flo try paao;B ~ .a;qB;;BtB 30U B; qu;q; £aq~ * qa;q* - * naaauaa U B~ q qanux 0BaBUB aaq £;U;wpa~ v £2.zatza ;c, atto; ;vq; jo ;uawdo;atap aq~ ~O JUSUBUB £;paBq B; Ba;.rnaoo;d og aaataa y . ~ BrtoaaZuBp a~ aaBaZBa o~B n3 WJ ;;BU BSBUB £aq~ *;Bo UBBB2B q B za.Uod `006't Bu;ddoqas B flU PBIBB ~UB ia;;; .iad -;Ban;BBZ ~UB ;;o;Bq; aaqaia pa;ou no~ b napnu 2u;n ~Bnç aaaU £aqj. B3flBUBJ asaq; BUJUUOU;d ~ ~a8 BlaBB £aqB;tn a;;; .zad . - q2Bap aq JB £UBW JO uoflBsflBw ;Bn aq; $OU Bfl ;BBfl (aujpo; 3Bnç ~ou) £2TB;2UBO;PBa ;OBajinUca;d BUUq.zawy p~; pUB 0~ Uaa~;aq UtaaapuoU an aBznoU JO UBaI3 a~ataz q q asnBoa q ;n;q;;Baq * mv; 3UOqB 2U;ABq atflaBo;pax LUBUBaGU aa.aod pa.ap-;~~a ;o UflBUBUaW o~a; aaB;daa aaotaa Zu;aq UB aatod aBa;anU papuawtao B ~;ajj Bap;saq 3Bq3 aa.to £aa3no a;;qnd B; IBB;d aBa;anta B Ztqp;;rtq u; £BIap an aBac -aaa ~UB UU;B;UB BOU o; ~asoddo £aaa aaa.n BU BBs aaaq; ;a& aa3;; aad Ba;aBaUa;d q~q . qaBa ;ng ;BOU qaauq ;BUf 0; UBU ;uop i Caq; ;BanaBadw; aa.nod .zBa;aBu BupB;q; U; Ofi JO s;ata; ;~;-au;p~; $aa;B;Uaa q;;tai ;npaaaBq aq ~ BLUOtU; aaB-auaacdcrauaq aq;; B096t £;aBa aq~ u; qaBq aaUod aBa;aruz Utfl BflB;B U~flBBatflzoN aq; ano U;B.B aq; BBa2 ou;aaBa UUouq ap;xo B~oa~;aa ap;xo;p PaBaddo BLBUB;B UGU aUBq BB;;flBamUoa;s u; BaBUp aaaaBa quaoq WU~B asaaiw pau aqi .BBJLUB-;BUU 2u;uanq wax; Buo;sstaz aa!J~-UaaBa qj no& ;aaaaoa aw p; ~Uapj y TUBa; 3BOUB aq; Baaq.U PB~ qt;w u; a2tzo;B B~ U; aato Laaa4B aq $BnBaa BUaaB BUOtU tpXOaaa S ;aJBBaa UBd aBa;a~~ aq; q~ ~BUM q Ba;anaaa;d U U~ ~ JU ; aaa;B;;a ~ -aUUa PUB*U;U a~ £;qa;q B; q~ BUU USLY UUUU Bqtaaaq aBa;arata q;;.n waq; pa~BUba aABq ~ ;g;-aUpa; Baa flBaU P3U4fBU(U aq I B~U;aBJB £q q;aBa aq; ;a UU;;thuB;p aaup Bq~ saçqaa Eq UB;;daaaq a;aq3 mBa; pasad ~ UU~ aqi aa;rabaa p;n~~ aq pica aUaaa -a.a PflBU aBajaBta ZB;UU ~Bq; Bj ~za;ad acn~ -da Uaaq aaBq BUB;d aaUUd aBa;UUM b - -sa2 aq; `~;pacaa BBBLU aq; U BB;paUaay (3023 30~ £q 3023 oot dq ;aa; ooo) £Uaaua Baood jo BPUBOOOB~ .203 )BB; 0B3 aaood aa~;; sad ao~oo; 02000 aq; aaopoad 03 Papaao 220 00003020 jo aBa;ooo ;na B~3~030a3 3033 B UB04; a.o003 ~ jo Ba;a0003;d ooo3o BU;o;taoo 3000(04 304; q~;o (Ba;;oz 001 dq ;ao; 001 dq 00 UBB 003 ;;o ~UB oo2 00003 333 3ooo 200 ~ ~ dq;;oaqoo SB 0003 30 oo;doono 332) 000 00003 ao;ooooz B) 3B03 03003003d 03 d;0;B3233 03B UBO aA;;B 3000 000&OB OBB43 -003 3043 ;ao;q 0; 34003 300 oaop 3~q aoj pau;oo aq 30002 33233 (003 30 aoao;ot ~03 aaod 320303 0043 0; 3303.003 B 2B43 3004 `BOOpBq; `an;; sad B3300003;d 03 ~BB U; 013.04aq BB.0 -woo O30B.oBSaoB 0o~~q 3 03 OBO(3 B; £;;o;a; P332~ PUB 00 o2 P1003 30 3Bq; pooSa~ `B3BI& (;cl-ao;po;( ao;po; 3Ofl300Ipoa jo ;aoa; 004; -3013 Jo oo;;d0000003 (BaBoon 0,1.033003 o;q,i, poooooq; BIO.030 20j ;ao; B ;o 00100 003 30033 poB(Bj 31100 aaaoo aq; p000IB B01~B2 j;oodw; ;BoaB000a;ooa 0043 3004B B0j30 0z0;oo;o;d pay `wo;oo;o(d ;a2 a~ `ooo;ooao' 3ow-~; 00 U; BOots; da;op ~ BOOS) 0a3d0300 `oo;;o;o 200'( 000(0 pa;qBo;p 03 0303300 30 d~ddoo BlOod 002 200 dot 2o;oaoq 3(32300 ~ 343 03 3040 0030000000 000 `oo(o;o;p - 02(014 u; B.BB((0p 00111104 B d;.OBIU 2u;.Oad 0(- 10 ~0130o; ;ao; 30330 o; 003000 3103 003300332 £30300 `00234 043)0 0034 343 oo;ua~ p(oao~ 2a.%030B;0B3(a300y 303 000300 43140-Ouaoo poB B20030lllapaaaq 000 3.0 33 203(300 o2 `~a PIUBIII2 32B 03300000 ;B;00030000 00 -023.402 (0.03)1) 303 .0031 0303 ~0j 10030(p P10040 0,0 dqao 000012 1303.00) B ;; aaaqj, 3B43 00 03003 B; 0203 30322 PUB `BaA -v 2003 3303ff 010 pl3Oq;1;;B 0210(02 (003 I0000B `130 300;B ;a; `~003 000; 2330343 -. 43; ;,osaop `puo;2 B4;Olp 0000 010 3234; IBId 4303 `BI0003 1003 ;;;;o o; 3( B(B03 00 43(,%j, `BlO((op ;ooo;;;ppo jot p;oadq; 3043 030; ~0B ~ø0) 300 o;o; .a2 oaop B100IB(p ;030300p0; 34; 3B ojoo; poy `0230102 , Bo0(((;oo p00 000(;(;Bo 3003 23314.0 000(30(0 3B0(3 PUB `30013 a1w 31101 1043 BOOS) PI001( 000(0030 20) 0£B~ £31o4001p 391 pUB 0230(00 -232 ;Oawooaaoo2 34; PUB `0300(3 203(300 103 -aS oo.o 0010 aulpo; 3.010300(002 00009 `9 ;B03 203 Blop £;(((q000p gpg'~ 3003 02(20(0; 300(030 30003 o; 1030 P00 040000 3423 dq.o ;oo~opoa 30 PIIP ;oap; `P30000003 322303 3;r~oaja jo s;;oooo2aoo 001; `000110303000030.00330;30)B339,001 340 £q so' -0323 3311.230030; 200 3043 P010003 111.0 £aq; -((00 234 0300(3 203(300 ao; 2o;ojoo 000(0010 P1(330 03003 3230 343 a30doap 00 s; 0140 ~00 0303 0,400(3 1 B(20o0J, `(03002 31003 03(30003 01 0.03 .4(00 300 `5300(3 p11310011-3003 10) 2o; 130 20 1003 0043 103(020033333002 43000 o; 21 203(300.1000300 323002110.0 o010003303ou0 210 -0(00 (003 U( 03011 631 3003 1.0 `p30000003 £ -lOod 3031300 `S(pl(BlJ,, `010303333 1(400000 0143 od'o42a3 `00033230(3 (tao `.131000 03200.0 -31300313 30 oo;o.00aw 00(33(04 31301303 y Jo 000(0(0 343 0030 loapoadap 34 03 3004 0303 0431.0333(000 3004 3033032203(3000 0302; 6 310400000040 P~0' `01 300 030) 030000 p13303 143 3043 BUolto .6( 0043 13(3(33003 003 0031 1(342(30 30sf 0332 300 `palOpold £Baaoa o 3000100 34303 -000(040 3 `RUB 030300,103 Jo 0300(004 100 3)3 `900000, B 4200 23(333(0 01,, `0(00 04.0 131(31. 00(30(32 o; 0430313 30 3340000 3003 01 0130100 101301310 sj;; ~o 02(3203 £oq 03 2o;ooq 300 plB.00p3 `~a 000 31 `13(3(30 343 00 030(0(30003 -32000300 300304(03(0 31(012 002 `(003 0000 01 2o;ooo ;0a12 B BUOIO! 0(02 `.6603(loa000p 2o;ojoooo 31030 £aq; 002123(3(00 3004 0303 0310 000(0010 B01( 10) 10(03 03 ~11U 234 `103003 p13013033 00 003 0300(3 30143 10) 121103 -0033! 001000000203 £looozo2ao 103(2034 300 lB 30 `00(113 2043 0~ 030113(302 U( 0110103 203(300 `1(000339 `0100303 1210( £q 23300 `1(100330 `RUB 30(1 £3133013 B3( 00 031000100 000(003030 B4303p ;q2~a £100 113.0 32141, 3004 01 3; `30233 `0000031 ;01303B 030 ~ .. SB 002121(001011(003(011 Iota 300(3 33.003 y `6001 03 9361 p31313 103( 303 04301) OPI 00.0 60200(3 pasao;o3j;o `UB(d 23.003 201130003030 20(0(113(00.0.114; 3103100102 010(02 (003 o; 1011 4303 0303)13 30 1003 300 0000 314302 `0300(3 20(3031012 0043 31430 4301 02013 00(303)01 11000 30(1312 -30 10003 oot 0003 1100! 3000330 (00033(ppo 10311033(1 P111.0011-303(300 P1(04 03 300.0 1143 20333100 B P104 03(0000) 203(300-10000 3133 03U( 310 03 0(234 0103 300 010) 0(4,1, 3330003 0143 P10340 £63.0 `00010333ff `~0 `01 040 300(3 1.0103 3000310 0)00( 03 0004 I `333 `31q(000330111(003.3l0 ` `2opoa -003 PUB 0100323) 2001 (0033 00(301) 3103002 o; uoo~~aw B 00 PUB 3 330(312 03 o; 401( "342(2311302000( 00(406002 0300 `UOflO(pol JO -323 00011 303 31010303011 £1100090 311.0 p(ooo 2jB `300 033(300(003 000100 002323; BUOllIlIlOlI 61 3000(0 00 010(2 301 1.0 P003.303 ;do(;oo;oo;;~ 143 30 3003 0300(3 31.003 2o;omq P10040 3000314 `21030 00(0 B( 31 `013030133 3000303 00103001002 £3402000302 310 023(14 -~B03 100 3040 P100 3! 30103011002 1011p33 -0013 2142(04 043022 001 3 10003104 303(393 UOT.000( 0130 `0013(3(303 03301 300 001 010(2 300 lq p100113300 11(0032(0 ~00 33(03 ~~ao 32001 23 30 `2003012002 3300013300304314 343 330 00(0(03(3; 30(03 2001. `11(1330043 2o(lop_ 31113 0134 0004 `1601 ~1 £1102 003301301U(010y o; 3043 )00 `20330112130.0 03313000123 303 3303010300 0101) 00130100230 00032111100 01(01 ;oawdo~aoa~ ~U0 43101030 122309 343 £q PUB 2130.0 201(134 3043 4004 03 30111300 ~; 3314 00(1312 aoL 312; 300(111(0 9003-03-30003 P3001112 Q-p993 ;aoda~ `(003 33 4093 0,313 0; q2tooq; £130001 0033 01 4300! Loao paoo B 1403 001 1103014.0 `3003 0003 12034 -y -Bad o; 13.0000 100 `00(3 20(14 300 1033012 30 33.43 P1(43 B o; 1310,1, 603000030 3(403000101 300110130 -saab 343 Bj 30043 33 `P04330! 33430 £oo 0043 `1310(410; 103.5 0201110 304; 000100aBoa3opo13 0; on. 2o;;o~po1 £330030000 320 00 (000020 23300 01 ~;;31~;3~(~ a;o23032 03 12.003 203(300 0; 31031(3 13010310 P00110 B 30010 3 2214.0 B)U(p9004 ~00 `A~o `00303 140 00 poy `9 - 20(00 1243300 93 00(30103 109,1, `3300 30131111 212004300 3014 B 0000 oao2 11(0.0 304 p13(200 `00010103 10)100014 01 001 10 003 £23301 2o;o(ooo; 20(4(034 `y -oaad .00 000330 30040 `0102 `3203 2033032 3230404300013(040 P00 2003 30) 30! 401.0 2o; 43300 343 o; 2130.0 ~01 JO 11020133103; 1030, 010102 -30010 0114 P04 £aq; 3; so 03100;p02 30100140 4 11,003 3011300 3040 01 301011 200,9, 63 3044 3014 3003(32 0040 0)12 (103 o; 00(03012 30040 3o2 300(3 O(000(&03013 343 0335100(3 - `00(3 (0(043 000(0 B 0002) 030003 0010 143 `3020(11 201011 a(11o13 340 09 `019330) 1030210 ~UB -3032 0(043 2031300 301501303 00 0213po0 03 20(3011012 (0312(3311,paIaoJ_3031300 o oq `0102 3;0003 210020001012 43(4.0 1)63(3(0 100 ~; 103 01(011411 30 0100( a3~ £q 1(01000330; 0~ , . `30(4203193 `0330223100123430; 13001;300lpoa 1020300 140 3; B304J, `933-010(0020 30332311 03 4313100 033(213 30043 010230 34~ 00300! 3043 30304 243 301000330 0( 09(3, `00033(33(00 ~ 3o2 ~1~3o~ o; 2033012 30033-31.003 B U; aoj 343 00ff 330po111 03 100 0011304.0 01 23 3101139;) ((Boo 33(03 PUB £11020000 2.0 `2311 I 11143413)3609 `00(33032 0(0043143301233 30,3 `10(0(263 B 00193 0314.0 010300 £q P13043 o; 300 00011(3(90 001 36040 o; 20313(012 -03 343 20030)0 3a4;a2o; P3310) s; 3U60100 -012 o; ~3;3123331a 0300(11 aooood a(ooo-a2.rs; 0P010103 B 10) 116903.011201100100 1031' 0(03233 B 00110036330 000003 00330012 0(043 o;, `;oo(d 312333(aolp,34 B oç" ;daooj -y `L;3a2 631000101 1(113 ~ 0002) 30(00(301 00 U10(~ 0303 `6(1-02010010 0~ 3 JO , 4300(3 231003-311203(1 p22~-(0030 03(100 boon 300 `OfooOoI&oooaj `0(0(1103 0160 ;u111311 06 0043 32010 3049 00 (0(133001 393 0003) ~331P 21 OIOP 000 P00 000(3 13.0011 £(Uo B0((0Q 01201.6 0 000131(3(02 66 412 3(3020 043(101 20 3)1103 30631 no.9 `qoooq 000jUBIO B 101(300 o JO 03(0043101 1003 130 30030 `9 -300 001 `33(3 3101. 1019 o~ `ao'; nod aaaq.n 3400! 0,1, `3(00001000 01 0(3101.0 061-00030020 `B01033;B 00 201001111) 513100 001301002 p000223304 01 110 143 JO 3033133 60 22300 y `a(qooos 000300302 30 ~1P 1(qoqoad UI.s nod `00022 1026300 3003 `101(109 50003 1031 10 1~10203( -004 300 01 40(4.0 6110061U010 01 00010030 (39 3~ `3131003 £03 o; 00132 C 30 0260110002 4030155 14,1 `3000 Lox o; 1,60 paooo(od z s's 04; jo 33332111 (00 `320 03010030 (026300 B 00,1.0 1011 (no o; 01312 9 03 do 30(3331 `00100(032 43000 0(03 no.6 030(2 (o3;d 01 0110643 30 0.001 100, 303000210010101 03 p333(00213 B~ 9301110)1011000 B o; 2331034 -500(0003 102-9 £poq 933(300030 `000(2031003 `apoploa 300 003 300111 aa.ood 101(300 B o; B 500030(00232 131)00 30120(31,0 200 31~00 La `L;;o;33oo~poa 30 0'2031111101 99 00 430004 £~LT a 91';vzua~j Jo ~ 1YNOISSflIONOD CLOT `!& L01dV Tgg PAGENO="0256" PAGENO="0257" 253 University of California LOS ALAMOS SCIENTIFIC LABORATORY Post Office Box 1663 Los Alamos, New Mesico 87545 5051667-5061 In reply refer to: 0-6 Mailstop: 559 June 8, 1979 The Honorable Mike McCorrxack, Chairman Subccerrnittee on Energy Research and Production Corrroittee on Science and Technology U.S. House of Representatives Suite 2321 Rayburn House Office Building Washington, DC 20515 Dear Mr. MaCormack: This letter is in response to your May 18, 1979 letter (received June 5) roguesting rr~r written testimony for the record of the May 22-24 bearings on Nuclear Reactor Safety. You indicated that the Subccmmittee is particularly interested in suggestions for technology developre.nt to enhance the safety of nuclear poser plants including the subject of radiolytic hydrogen in a PWR reactor vessel following a loss of pressure accident. My experience in this area includes analysis of containment hydrogen concentrations resulting frcmt radiolytic hydrogen produced in water on the containment floor after a loss-of-coolant accident and, in addition, analysis of hydrogen concentrations in the primary system of the Three Mile Island plant in the weeks following the accident. Others in the area of nuclear power plant reactor safety research at Los Alanos Scientific Laboratory have direct experience in reactor materials and fission product * chemistry and in Imxleling and analysis of primary coolant system flow for accident conditions. This testimony considers hydrogen in both the PWR reactor vessel (primary coolant system) and in the containment, as produced in the. Three Mile Island incident. The main line of defense always has been and should continue to be prevention of such accidents. However, it seems prudent to improve our understanding of hydrogen production and removal rates, anong other pbenaemna of interest, at the temperatures and pressures of the accident conditions. As an edditional measure, it also seems prudent to consider possible engineer- ing approaches to remove any hydrogen produced during such an incident. For example, a potential engineering approach is to design safety systems to remove hydrogen in either the primary coolant system or the containment. In the primary coolant system, hydrogen might be removed by using scavengers that react with hydrogen and/or by adding en operator-controlled valve at the top of the vessel to permit any hydrogen bubble to be vented into the containment. In the containment system, the hydrogen might be renoved by TWX 910-988-1773 Telex 66-0496 Fascimile 505/667-6937 (automatic)5051667-7176(operator assist) 48-721 0 - 79 - 17 PAGENO="0258" 254 using a rapid hydrogen reo:xrbiner system to eliminate the problem of hydrogen burning in the containimant. Another or perhaps supplarental option sould involve venting the containrrent atmosphere through filters to rerove fission products. Any such systems added to either the primary coolant system or the containrrent would have to be investigated for im- pact on other safety systars and tested for total effectiveness. As a basis for such considerations, additional data are needed to improve the determination of the hydrogen production and reroval rates in the primary coolant system at the ter~ratures and pressures of the accident corx3itions. Areas where research could provide irrproved data inelode: (1) hydrogen production by radiolysis and steen reactions with zirconium (probably the major source of hydrogen in Three Nile Island), (2) hydrogen r~mrval by reactions with zirconium, (3) hydrogen reumrbin- aticm in a radiation field with the oxygen produced by radiolysis, (4) hydrogen dissolving in the water, and (5) hydrogen reroval by scavengers. Since the radiolytic hydrogen production and reumrfrination rates depend partly on the quantity of solid fission products in solution, better data are needed to determine hew much of the fission products go into solution as a function of the arrount of zirconium reacted. ¶fl~e results of investi- gations in these research areas could be crsthined into a primary system coolant chemistry oorrputer code to calculate hydrogen production and re- rroval for various accident scenarios. Additional research is also needed to improve the determinations of the hydrogen distribution in the containxrent resulting fran a concentrated source (caning out of the vessel) plus a distributed source fran ra3iolysis in primary system water released to the contairsrent building floor. A catplter code could be developed that treats these t~m sources plus hydro- gen reroval by remstbiners and/or contairirrant venting. ~Ib sunzrarize, the main line of defense sheuld continue to be preven- tion of accidents. }~ver, it seers prrident to investigate possible engineering approaches to reroving hydrogen if it is produced, and, as a basis for this, research is needed to improve our understanding of hydrogen production and rera~val rates at the tetperatures and pressures of the accident conditions. Please contact ire if you have questions concerning this testimony. Sincerely yours, Qrdon J. E. Wiflcutt, Jr., Ph.D. ¶L~rsmrel Reactor Safety Group, Q-6 Reergy Division PAGENO="0259" 255 THE AEROSPACE CORPORATION Post Office Box 92957, Los Angeles, Californio 90009, Telephone: (213) 648-5000 June 22, 1979 Dr. John V. Dugan, Jr. Subcommittee on Energy Research and Production Committee on Science and Technology Room B3714, Rayburn House Office Bldg. U.S. House of Representatives Washington, DC 20515 Dear Dr. Dugan: In accordance with our telephone conversation, I am sending you a revised copy of my written testimony on "Human EngirieerinsI~luences on the PTö~iance of Nuclear Power Plant Operators" which was prepared for the record of the May 22-2~4 heari~~on Nuclear Reactor Safety. As a result of the tight schedule for submission of the testimony, a few changes have been required in the material which I sent to you on June 8, 1979. The enclosed copy clarifies a few important sections of the material without changing the substance of the conclusions. Again, I thank you for the opportunity of expressing my views on this subject. Sincerely yours, F d C Finla, on, Manager uclear and Geothermal Systems Energy Systems Enclosure PAGENO="0260" 256 HUMAN ENGINEERING INFLUENCES ON THE PERFORMANCE OF NUCLEAR POWER PLANT OPERATORS F. C. Finlayson The Aerospace Corporation El Segundo, California, USA INTRODUCTION Under off-normal operational conditions, operators in nuclear power plants are inundated with an enormous amount of information which must be collected, processed, and evaluated in a logical and timely fashion in order to make appropriate control decisions. The operator's ability to make decisions under stress is primarily influenced by three general factors: (a) control room and control system design; (b) operator physical and emotional characteristics; and (c) formalized plant operational procedures. Human engineering is the science which attempts to harmonize the design and/or capabilities of all three of these areas in order to optimize the operator's performance in the control center. In chis testimony, the author's views are presented with respect to the effects of human engineering on operator performance in the control room. The conclusions have their genesis in the results of a study which was conducted by The Aerospace Corporation for the NRC in late 1976 (Ref. 1). Primary attention has been given to the effects of control room and control system design on the operator. Brief observations on the influences of operator characteristics and operating procedures on performance in the control room have also been presented. In the earlier Aerospace Corporation study, special emphasis was placed on the evaluation of the control room-operator relationships under severe emergency conditions in the power plant. The observations presented below have also been restricted largely to material related to emergency conditions in the control room. In spite of this limitation, it is recognized that human engineering of control systems is at least as important for normal and near-normal plant operation as it is for emergency conditions. The restriction of the comments to emergency conditions has only been used to keep the scope of the conclusions within manageable levels. BACKGROUND Hum~.n errors, and especially operator errors, in nuclear power plants have become an increasingly common source of concern. Operator errors in nuclear power plants have been increasing at a rate which is nearly proportional to the growth rate of the power plants themselves (Ref. 2). On several occasions, of which the Three Mile Island accident is the most recent and most severe, operator errors have contributed to accidents which have had nerve wracking consequences. More specific examples of these experiences will be d.scussed subsequently. It should be noted, however, that there are PAGENO="0261" 257 two principal methods which have been used to evaluate the pOtential impacts of operator errors on accidents in nuclear power plants: (a) probabilistic analyses using fault tree/event tree formalisms; and (b) actuarial statistical evaluations based upon results of abnormal incidents in nuclear plants which have been documented in NRC Licensee Event Reports (LER). The most prominent example of the application of fault tree/event tree probabilistic methods is the Rasmussen, "Reactor Safety Study" (WASH-l1400 -- Ref. 3). One of the major limitations of fault tree/event tree methodology is associated with defining a sufficiently complete set of branching failure paths for the systems being considered. It is generally conceded that it is practically impossible to define an absolutely complete set of event tree/fault tree failure paths. LER statistics, on the other hand, may be equally incomplete -- depending upon the quantity of data available and its applicability with respect to the designs of current and future nuclear plants. Under current circumstances, both event tree/fault tree methods and LER analyses are needed to determine the probability of operator errors in off-normal plant incidents. The relative areas of usefulness of these two approaches in defining the potential impacts of human errors will be discussed in more detail subsequently. Two of the more significant physical factors contributing to operator errors in a nuclear facility are: (a) the prodigious size of the control board; together with, (b) the complexity of the power plant and its safety related systems. Control boards have reached, and exceeded, lengths of 100 feet. Some boards have over 5000 control and display devices, which provide information on about 10,000 functions. In these instances, over 1000 of the functions displayed on the control panels can be classified as presenting information which is critical to plant and public safety for normal and emergency operations (Ref. 1). Simply keeping track of the operational status of all critical equipment components in the plant has become an increasingly difficult problem, especially if a substantial amount of maintenance is being performed in the plant. If the operator is not fully aware of the functional status of all significant equipment components at all times, se.~ious problems can develop in the event of off-normal plant conditions -- as the Three Mile Island accident dramatically demonstrated. Control room designers have concluded that under emergency conditions the size of the control board and the consequent "volume of raw information exceeds the saturation point of the operator" (Ref. 11). The flood of informatio~i delivered under such circumstances places heavy mental and emotional demands on the operator for integration and comprehension of the input data. The operator's problems are exacerbated because the unprocessed data from the plant is presented without prioritization in short periods of time. This excess of information results in conditions of extreme mental stress for the operator. At these times, neither data integration nor memory exercises are easily performed. Under such stressful conditions, mental requirements of these types contribute to operator errors. Yet the concensus of opinion among operators is that, more, rather than less, data are needed on the critical elements of plant status. Operators do not wish to reduce the PAGENO="0262" 258 quantity of information displayed on their control boards. Thus, the elements of a dilemma become apparent: a recognized need exists to reduce operator information overloads which must be balanced against a perceived need for more data on the status of critical plant systems. SOURCES OF OPERATOR ERRORS -- ACTS OF "OMISSION" vs. "COMMISSION" An assessment has been made of the potential sources~ for operator errors in the control room. Engineering analyses (Ref. 14) and empirical data in the form of Licensee Event Reports (LER) results were surveyed in addressing the problem. Table I (abstracted from Ref. 1) presents ~a brief overview of a few of the major accident sequences involving the operator in the control room for which fault trees were developed in the Rasmussen "Reactor Safety Study" (Ref. 14). It may be observed from the results presented in Table I that even though the number of identified operator faults is small in comparison to the potential hardware failures, an apparently disproportionate share of the failure probability is due to the operator. This was largely the result of assumptions made in the "Reactor Safety Study" (Ref. 14) concerning the effects of stress on the limits of operator performance, based upon the postulated stressful conditions of the accident sequence. As indicated, the critical operator error related sequences were primarily associated with Loss-of-Coolant Accidents (LOCA). Moreover, the sequences were dominated by failures of the high-and-low-pressure injection systems, the containment spray injection system, and a few other related Engineered Safety Feature (ESF) systems. Examination of the fault trees in detail indicated that the identified operator errors were generally related to failure to properly manipulate one (or more) motorized valves, which required manual operation from the control room. Comparison of the hypothesized fault tree paths with actual incidents involving operator errors taken from LER data produced some interesting observations. The postulated operator errors in the fault trees were dominated by "acts of omission", i.e., failure to perform some required action, such as changing a valve setting for a coolant supply line from a condition where fluid was being drawn from an external source (a tank which ultimately would be pumped dry) into a recirculatory mode of operation. By contrast, the incidents described in the LERs were dominated by "acts of commission", i.e., gratuitous, unexpected, unnecessary actions which were performed ("acts of God"). By their nature, the variety of operator error "acts of commission" which might occur is partially boundless. As a result, it is impractical to expect to catalog acts of commission completely. Development of a complete set of fault trees identifying all possible acts of this type is beyond reasonable expectations. A classical example of an "act of commission" is found in the reactor trip incident which occurred in the Rancho Seco plant in Sacramento on March 20, 1978. While the plant, a 900 MWe B&W reactor powered facility, was PAGENO="0263" TABLE I. MAJOR OPERATOR RELATED ACCIDENT SEQUENCES PWR~ Critical Systems Identified Faults Sequence Fraction Probability Due to: ~p~rator Hardware Probability Operator Error Hardware Control Bd. Remote - Control Bd. Remote Low-Press. Inj. Sys. (LPIS) 14 5 92 2E-8 .52 .07 .141 LPIS + Contmt. Spray Recirc. Sys. 14 7 1140 2E-1O .51 Negligible .149 Contmt. Spray Inj. Sys. (CSIS) + LPIS 14 7 111 5E-ll .33 .12 .55 Small LOCA Hi-Press. Inj. Sys. (HPIS) 14 17 166 9E-6 .11 .19 .70 CSIS + HPIS 14 19 185 8E-ll .06 .17 .77 *Based upon results of WASH_11400 (Ref. 14). PAGENO="0264" 260 operating at a steady state power level of 70%, an operator removed the translucent cover of a back-lighted push button switch from a panel in the control ~oom in order to change the light bulb. The burned-out bulb was dropped by the operator and fell into the open switch socket on the control board console producing a dead short to ground in the switch. Breakers opened immediately on two 214 VDC power supply circuits causing loss of signals for about two-thirds of the non-nuclear instrumentation for the plant and related control parameter indicators including: pressure, flow, fluid levels iii steam generators and pressurizers, and all reactor coolant system (RCS) teirperatures. Consequent spurious signals from all of the deactivated instrumentation circuits were fed to the Integrated Control System (ICS) for the plant, which caused the main feedwater flow to be automatically reduced to zero. In a manner reminiscent of Three Mile Island, a rapid increase in reactor coolant system pressure occurred when the feedwater flow was cut-off. This in turn automatically produced a reactor trip on the basis of a high-pressure signal to the ICS. Hampered by a lack of instrumentation and an excess of equipment responding automatically to spurious signals, the plant operators had their hands full in trying to maintain reactor control and to prevent substantial damages from occurring to the nuclear steam supply system from a rapid cooldown transient that the reactor experienced. An hour and 15 minutes passed before the operators discovered the location and secondary cause of the power loss in the 214 VDC power supply circuit breakers. Only then were the operators able to restore power to the malfunctioning section of the control panel and regain normal control of the nuclear steam supply system. Nearly two hours passed before RCS pressure and temperature were restored to within permissible technical specification limits. As an example, the Sancho Seco accident is neither unique, nor extreme in its cnsequences. The events of Three Mile Island have indicated that accidents of this type can come perilously close to producing a core meltdown. Moreover, the incident demonstrates how the loss of control and vital instrumentation can turn an apparently trivial incident -- dropping a light bulb - into an unnerving experience. Upon due consideration, it seems very unlikely that a fault tree would have beer identified for an incident initiated by an operator dropping a burned-out indicator light bulb into an open socket with resultant substantial loss of instrumentation and control capability. Thus, probabilistic assessment of the causes of such accidents by the use of fault trees is only effective within a limited framework. This incident serves as a rather classical example of the types of problems associated with establishing the probability and consequent risks of operator errors associated with acts of commission. Perhaps the most meaningful way to attack problems of this type is on the basis of a statistical analysis of operational power plant data through analyses of LESS and other data sources. Certain specific problem areas, such as those associated with valve manipulations, etc., may be amenable to fault tree analysis. As these problem areas are identified, they may be eliminated through subsequent good engineering practices. But in general, the diverse sources for accidents PAGENO="0265" 2~1 involving acts of commission can neither be wholly anticipated, nor entirely eliminated. However, some basic observations can be made with respect to areas where improvements in human engineering can help to reduce opportunities for errors. EFFECTS OF CONTROL ROOM SIZE As noted above, control boards have become extremely large. Nevertheless, operators generally feel that no superfluous information is provided on the boards. In fact, many operators feel that they need- more plant data to aid them during operations. Therefore, elimination of data displays does not appear to be a promising method for reduction in control board size. Soire initial steps have been taken towards an apparently desirable goal of reducing overall control board dimensions through miniaturization of cont?'ols and display devices. A few utilities have already proceeded along lines utilizing this approach. As a consequence, the trend to steadily increasing control board and control room size appears to have slowed (and perhaps even reversed). No very dramatic changes in overall control room dimensions are likely to occur from component miniaturization processes alone. !n the immediate future generation of control rooms we can expect essentially more of the dimensional status quo. Meaningful breakthroughs in control board size must come through application of advanced methods of information processing for plant operators. Computer-supported data retrieval and analysis systems, utilizing cathode-ray tube (CRT) data displays, must be developed and become accepted if this goal is to be achieved. In a computer-supported control room, top-level functional plant information would be pictorially displayed on CRTs as the baseline presentation mode in a hierarchically ordered set of ç~ocessed data displays. Lower priority displays would be subordinated and could be called for by the operator as the need for the information arose. The data retrieval and analysis system would also aid in integration of power plant data into more meaningful formats for the operator which could reduce the oppor-;unities for error on his part. The trend to such advanced systems is clearly in evidence. Several reactor vendors have developed conceptual designs for such systems. However, nuclear plants incorporating the first integrated computer-supported control systems, though under order, are not scheduled to be operational for some time in the future. A clear need exists for development of an advanced, computer-driven information processing system which would be compatible with the concept of retrofittability into existing plants, and which could be included in those to be completed in the near future. Though a retrofitted system would not reduce the size of the control center, it could substantially improve the operator's comprehension of root causes of off-normal conditions and aid in his determination of actions to be taken to alleviate the problems. - PAGENO="0266" 262 CONTROL/DISPLAY COMPONENT SIZES AND LOCATIONS In current practice, control boards are frequently fabricated with extensive, geometrically-regular, rectangular columns and rows of heavy switchgear and large display components. Such large, undifferentiated arrays of similar (or identical) control and display elements, where the primary distinguishing features are small labels on individual board components, do not represent good human engineering practices. The apparent aesthetic appeal of such arrays to the designer is of small benefit to the operator. Universal antipathy was apparent among operators for this widespread practice. Although miniaturized controls and data display components may be the wave of the immediate future, plants of the current generation generally use large, heavy switchgear for controls and big meters for instrumentation readouts. Many of these components appear to have been carried over from fossil-fueled facilities to nuclear power plant control rooms. Their continued utilization is representative of a general utility reluctance to experiment with control elements with which they have little experience, where component reliability has not been well established. It is easy to understand this practice in a nuclear power plant where reliability is so importani. Nevertheless, if progress is to be made in human engineering of nuclear power plant control rooms, smaller controls must be incorporated into the designs concurrently with the development of computer-driven information processing systems. Some trend setting power plants have made progress in the direction of utilizing smaller switchgear and meters. Evidence of another related problem area can be seen in some power plants; ~.e., visual limitations with respect to data displays. When small display devices are used in large control boards, it is possible to be beyond visual limits for displays, especially if they are not closely spatially correlated with associated controls. During the transitional period to utilization of miniaturized components coupled with conveniently located CRT displays, designers will have to utilize great care to avoid problems of this sort. Proper functional organization and grouping of associated controls and displays will be an essential human engineering practice in this period. As computer supported data retrieval and analysis systems with CRT displays become accepted practice in future control room design, the problems of exceeding visual limitations for the operator can be eliminated. Th problem of visual limitations is generally associated with a related problem, the lack of spatial correlation between data displays and control devices. As a rule, there were few glaring examples of poor practice in connection with this problem in the control rooms analyzed in The Aerospace Corporation's study. Functional organizations of the control boards appeared to have been a relatively important consideration in the design of most of the plants visited. However, in some instances, it appeared that retrofitted equipment, after the control board was initially fabricated, might have contributed some problems of spatial discorrelation. Adequate human engineering design practices should assure that potential PAGENO="0267" 263 retrofit requirements are recognized during design and some, well-distributed, extra space incorporated into the plans for control boards and control rooms. Again, the utilization of computer-driven information processing systems, with CRT displays of critical system parameters, can help to resolve problems with such after-the-fact cases of recognition of the need for additional data for plant control. COLOR CODING OF COMPONENTS AND DISPLAYS The use of color on a control board is a very beneficial and practical method for aiding in discrimination between adjacent control systems and their associated components. With care in the choice of colors, even most color-blind individuals can distinguish between adjacent dissimilar color tones as they manipulate controls. With a few notable exceptions, standard color coding is broadly utilized within the industry in indicator lights which show the operational status of systems components. Traditionally, red lights have been used to indicate equipment which is running, valves open, and circuits closed. In plants utiliziog this color-coding system, green lights indicate equipment not in operation, valves closed, and circuits tripped. Under normal operating conditions, control boards in which this color coding concept has been applied look like Christmas trees with red and green lights dappling the surface of the board. Sore facilities have incorporated an alternative color coding concept for indicator lights called an "all green board". This practice, borrowed from the Navy, uses green indicator lights for all components that are in their normal operating status, whether valves or circuits are open or closed. When small deviations from normal operation occur in the plant, red lights appear highlighting any malfunctioning components. The concept is useful for normal and near-normal operation. However, when a serious accident occurs, immense numbers of changes occur automatically in the status *of operational and safety-related equipment in the plant and the color coding concept becomes totally ambiguous. Confronted by an enormous variety of red and green lights initiated by automatic accident control system sequences, where the color of the light no longer indicates either the proper or improper functional status of equipment, the operator would have only his memory and the plant emergency operating procedures to assist him in assessin~, the appropriate status of plant components. Under these circumstances, it appears that operators who are accustomed to operating with the traditional red/green indicator light coding concept would be better prepared to cope with the accident and could interpret the information presented more reliably and with less ambiguity. CONTROL SHAPE CODING With a few notable exceptions, the use of tactile sensory identification mechanisms has been largely overlooked in the current generation of control rooms. Some control operations require close visual PAGENO="0268" 264 attention to displays while related controls are manipulated. Under these circumstances, it is certainly poor human engineering practice to use identically shaped control knobs, levers, or push buttons for dissimilar control functions, especially when the control devices are located adjacent to each other. However, numerous examples of this undesirable practice can be found in the control rooms of operational plants throughout the industry. In more than one case, it was apparent that problems had already been perceived and enterprising operators had backfitted nonconventional control knobs, with clear tactile differences, for these critical components. In the next generation of control rooms using smaller, back-lighted switches (probably in relatively closely-packed arrays), the use of tactile identifiers on switch surfaces could greatly decrease operator error potential. "MIMIC" DISPLAYS FOR CONTROL SYSTEMS Control system mimics (logical schematic displays of system relationships between components, switches, functional status indicators, etc.) have long been recognized as valuable tools in control centers. The control boards of older, smaller facilities indicate that mimics were more widely used then than they are in the current generation of large nuclear power plant control rooms. As time went on and control boards became steadily larger, the use of mimics was increasingly neglected. In most of the currently operational, large facilities, mimics are virtually non-existent. However, because they are so useful as- memory aids, many operators have configured quasi-mimics out of colored tape on otherwise undifferentiated control panels to support decision making processes. In the next generation of control rooms, there will evidently be much more widespread utilization of mimics. Of course, when control rooms are designed around CRTs for data displays, mimics will be natural formats for utilization. FUTURE UTILIZATION OF COMPUTERS AND CRTS An inevitable (and certainly highly desirable) trend to greater utilizat~.on of computers and CRT displays is already apparent in the designs of future control rooms. The debate over computerization seems not to center so much over whether to use computers and CRT displays, but over what the functional interface will be between the operator - the computer - and the control systems. The opinions of advocates of various alternatives range from relegating the computer to a simple data handling system, in which plant control -is exercised in a relatively conventional fashion by the operator, to utilizing the computer to essentially take over complete control of the plant. The most probable application of computers in the control room will no doubt be a compromise between the two extremes, in which computer-aided -- but operator-responsible -- control will be utilized. Under these PAGENO="0269" 265 circumstances, interactive data/control displays may be provided on CRTs by the computer. This appears to be a flexible, reliable, cost-effective, and safe com?romise approaoh to the problem, and one which has great promise. OPERATOR CHARACTERISTICS AND TRAINING On the basis of site visits conducted to a number of operational nuclear power plant control centers, observations indicated that the operatora seemed generally competent, well-qualified in their assignments, and adequately motivated. Regular training programs for both initial operator qualification and continuing skill maintenance were being conducted at all plants surveyed. Within the limits of the brief survey conducted, the training programs seemed reasonably adequate -- especially those associated with normal and near-normal operations -- considering the training methods available to the plant operational staffs. Ho/lever, capabilites for conducting realistic on-site training for emergency conditions in the power plants were virtually non-existent. Operator "walk-throughs" of emergency operating procedures were essentially the only available method for on-site training in emergency conditions. To overcome this weakness, NRC relicensing requirements call for the operators to have hands-on experience in emergency plant shut downs, either from actual in-plant incidents or from simulated events conducted in an adequate control room simulator. This effectively requires operators to have retraining exercises on a simulator, as most operators will not experience a sufficient number of emergency shutdowns of their own plants to meet the NRC requirements. Assuming that infrequent emergency shutdowns are representative of reality, the only practical method for operator training in severe emergency procedures is through hands-on training in a realistically modeled control room simulator. If simulators were conveniently available, more frequent training of this type would be desirable. The bi-annual training sessions required by the NRC are less frequent than desirable for skill retention. Unfortunately, the geographic availability of existing simulator facilities is often too limited to permit training sessions to be conducted with a more desirabl? frequency. Moreover, the total number of available simulators is so limited in the US that fidelity of control room simulation is a problem. Until recently, there was only one END control room simulator in the US, a mock-up of the Dresden 2 unit. In addition to simulating an older plant, with a control board quite dissimilar to those of newer BWRs, the GE-Dresden 2 simulator also employs an "all green board" color coding concept for indicator lights. As previously noted, this color coding concept for indicator lights is not commonly used in most utilities of the US. Although another BIlE simulator is now available, a model of the TVA's Brown's Ferry unit, neither of these two simulators are high-fidelity reproductions of other control centers in general. The numbers, availability, and fidelity of PWR simulators is equally limited. The transferability of experience gained in emergency power PAGENO="0270" 266 plant operations is uncertain for training conducted on simulators with poor fidelity with respect to the physical characteristics of the operator's own plant. This potential problem should present a substantial incentive for either standardization of control rooms, or making relatively high-fidelity simulators more conveniently available to operators in order to assure better training. The effects of control room human engineering on perceived stress levels were reviewed with respect to the operator's performance in an emergency. It is clear that excessive stress can have very detrimental effects on operator performance. However, at this time, it does not appear to be possible to quantify operator stress levels, in emergencies, or even to be able to quantify the specific influences of factors which might produce calamitous effects through excessive stress. The determination of optimal designs for control clustering and ideal ccncepts for information codification to reduce stress levels on operators would be extremely difficult, and would require extensive research and development programs. However, careful application of good human engineering would go far toward eliminating design features which contribute to error-proneness such as mirror-imaged pontrol boards for side-by-side, two-unit control centers; or the location of essential data displays outside of the visual limits of operators, etc. EMERGENCY OPERATING PROCEDURES Emergency operating procedures (EOP) were analyzed to a limited extent for the plants surveyed with respect to their effectiveness in supporting operator actions under emergency conditions. Though the EOPs examined appeared to be reasonably effective tools for near-stable plant operating conditions, they seemed to be too cumbersome for time-critical, emergency conditions. The formal, written procedures were, of necessity, generally voluminous. Detailed indexing of the material covered in the EOPs was rare. Consequently, the formalized procedures seemed to be of limited value as diagnostic tools for evaluating actions to be taken in emergencies where the root problems may be ambiguously defined. In fact, the voluminous size and cross-rererencing inadequacies of the EOPs may reduce the operator to heavy reliance on his memory -- which is quite the opposite of the intended role of the EOPs. In an emergency, most of the required control functions in the plant would be actuated automatically by safety systems which are part of the Engineered Safety Features (ESF) of the plant. Thus, the principal role which has been defined for the control room operator in an emergency is monitoring and verification of the adequacy of automated ESF component performance. However, no evidence was observed of well-defined measures in the EOPs for dealing with one or more malfunctioning ESF components -- if they should be discovered during the monitoring and verification processes. A general reluctance was observed on the part of NRC and plant personnel to acknowledge that malfunctions could occur in ESF controlled equipment. With the complexity of the ESF systems actuation logic and the number of systems PAGENO="0271" 267 involved, performing the task of verification of the functional adequacy of the performance of all components is non-trivial -- and it must be assumed that the assignment is meaningful irrespective of any "single-failure" criterion which may have been used for design purposes. Considering the magnitude of the verification procedures, it is apparent that an operator aid to simplify and expedite the review process is needed. A supplementary "command/response" data display has been recommended for this function. This unit would consist of paired indicator lights which would provide an immediate indication of commands which had been generated by the ESF actuation system and the responses of associated equipment components. With such a system, the operator could tell at a glance whether all actuation system commands had been received; whether the components had function~d properly; and whether final system conditions were consistent with requirements. Most importantly, the "command/response" display system would provide an instant checklist which would minimize mental data integration and EOP memory requirements for the operator and hence opportunities for error. Initial steps have been taken by some reactor vendors to provide the genesis for systems of this sort. For example, a related concept (Valve Position Status Indicatprs) has been developed and fielded by Westinghouse and is currentlj in use in some facilities. In view of the apparent limitations of the EOPs, they may be most useful as source material for operator "walk-through" training exercises in emergency procedures. Though these exercises are not necessarily conducted under real-time conditions, or under stress, they provide the closest simulatin of hands-on emergency procedures that most operators will have the opportunity to experience, outside of a control room simulator facility. OBSERVATIONS AND CONCLUSIONS This testimony has not been prepared with the intention of giving the impression that control cen';er design has been grossly neglected. On the contrary; the evidence indicates that control rooms in nuclear power plants have received a substantial amount of attention and relatively good engineering judgment has evidently been applied in their design layouts. Reasonably good functional relationships were ~evident in the control system layouts of most of the plants visited during the course of the Aerospace study. Nevertheless, as discussed above, there is still room for improvement in the application of good human engineering to control panels and data displays. The needs of the operators have all too frequently been subordinated to the designers' inclinations towards the use of symmetry and regularity in control panel design. As a consequence, large rectangular arrays of columns and files of virtually identical controls and displays are common practice in control rooms today. Though mirror-image control boards for dual-unit plants are not commonplace, they should not be considered acceptable practice for control center design in future (or current) licensing procedures. Moreover, color and tactile coding of control elements should not receive more widespread utilization by designers, as these practices justifiably deserve. PAGENO="0272" 268 With only a few notable exceptions, utilities are reluctant to be innovative in control room design. There was clear evidence of widespread prevalence of an "I don't want to be the buyer of the first model of a new system" syndrome. As licensing/construction periods for plants in excess of ten years have become common, it is easy to understand the desire on the part of utilities for utilization of conservative design technology and components of proven reliability. Utilities simply wish to minimize licensing delays for new plants. They m~y seek to achieve this objective by making as few innovations from plant-to-plant as possible. The problem is further exacerbated by those interveners whose recalcitrant attitudes towards nuclear plants in general, and innovation in particular, promote replication of dated practices. Consequently, movement in the direction of incorporation of advanced control systems into nuclear facilities is, at best, slow. The current lengthy schedules for power plant design and construction induce similar serious problems with respect to utilization of advanced computer systems in control rooms. As planning/construction schedules are stretched, technical obsolescence of control room electronic equipment becomes a painfully real prospect, even before plants become operational. Over a 3O-~O year life span for the plant, even obtaining replacement parts and performing maintenance may be expected to become a problem for the original computer equippient installed in the facility. Nevertheless, current computer and electronic equipment technology is adequate to support the implementation of advanced control room concepts. The materials are available which would allow major improvements in human engineering of these facilities. Initial steps have been taken toward their utilization, but advanced hardware is still a long ways from achieving operability in control rooms. Additional steps need to be taken to encourage the incorporation of computer-supported data analysis and control systems into nuclear power plants in a more rapid and meaningful manner. What steps can be taken to expedite improvements in human engineering in control rooms? For one thing, it seems clear that regulations will be required to assure that fundamental human engineering requirements are al~piyp included in control room designs. Only in this manner can there be an adequate basis for enforcement of good human engineering practices. However, the standards which are being developed for control room human engineering, upon which NRC regulations might be based, have been slow in coming. These processe;~ of standards development need to be accelerated, and higher priorities should be attached to their completion. From the standpoint of expediting advanced control room development, innovative approaches need to be taken for encouraging the incorporation of advanced designs into plans for power plants. As a suggestion for the direction which might be taken, the NRC should provide licensing incentives for adva~~ced concepts. These might take the form of a preliminary Regulatory Guide which would demonstrate NRC support for utilization of advanced design PAGENO="0273" 269 approaches. In addition, some stronger encouragement of progress towards stepwise standardization of control room design could also be given by the NRC. Among other benefits, standardization would reduce the problems of providing sufficient numbers of simulation facilities, with adequate control board fidelity, for operator training. Plant design practices should be reviewed with respect to the problems associated with the rapid rates of technological advances in computers and electronic equipment for use in the control room. The potential for technical obsolescence occurring in electronic hardware over the lifetime of the plant is real. In order to reduce the obsolescence potential, a special attempt should be made to maximize the flexibility of the scheduling of the final s~'leotion of control room computer systems while the plant is under construction. Delaying the final selection of the hardware for the computer-supported systems until the close of the licensing/construction period should permit deployment of equipment which will have substantially greater computational and data handling capacity, relatively lower costs, and fewer maintenance problems. To help overcome the natural reluctance of utilities for developing and debugging the first computer-supported data analysis and control systems, perhaps a joint utility, industry, NRC-supported program might be developed which could assist in overcoming the initial operational system problems. In addition, support should be given to the development of a concept for an advanced information-processing and display system which could be retrofitted into existing nuclear power plants. A system of this sort could take advantag3 of the most recent advances which have been made in computer hardware and the most recent developments in software for the provision of creative and meaningful control system displays. Experimental studies should also be conducted on the effects of incorporating advanced concepts into control rooms on the reliability of operator performance in emergencies. This data would be of evident value in supportthg and evaluating the designs of advanced control systems. Whatever steps are taken in the future with respect to improved reactor safety, advances in human engineering are needed in control rooms. Incorporating them may only increase the standards of control room excellence from what is now an equivalent "B" level grade to an "A", but the efforts to reduce opportunities for operator error and improve plant reliability will certainly be cost-effective in the long run. The problems which occurred in the control center at Three Mile Island have demonstrated the need for greatly improved information processing systems. Improvements are also needed in training which will reduce the operator's transition time under emergency conditions from the automaton level (in which he mechanically performs only prescribed furctions) to that of a creative problem-solver -- the only meaningful level for man's intervention in the control center of a nuclear power plant. 48-721 0 - 79 - 18 PAGENO="0274" 270 REFERENCES 1. FINLAYSON, FRED C., HUSSMAN, JR., T.A., SMITH, JR., K.R., CROLIUS, R.L., AND WILLIS, W.E., "Human Engineering of Nuclear Power Plant Control Rooms and Its Effects on Operator Performance", The Aerospace Corporation, Report No. ATR-77(2815)-l, February 1977. 2. USAEC, "Summary of Abnormal Occurrences Reported to the Atomic Ene~g~~ Commission During 1973", Report No. OOE-OS-OOl, May 19714. 3. US NUCLEAR REGULATORY COMMISSION, "Reactor Safety Studi", WASH-1400, October 1975. 11. COLEY, W.A. AND DARKE, R.S., "Operator Interface Requirements for Nuclear Generating Stations - A Review and Analysis", Proceedings of Specialists Meeting on Control Room Design, IEEE 1975 Summer Meeting, p. 77. PAGENO="0275" 271 UNIVERSITY OF FLORIDA May 17, 1979 Honorable Don Fuqua Cosssittee on Sciences and Technology U.S. House of Representatives Rayburn House Office Building Washington, D. C. 20575 Dear Mr. Fuqua: In response to your letter of Hay 3, 1979, I am pleased to offer my recommendations as to the direction we should take to improve the engi- neered safeguards facilities for nuclear power plants. When it comes to "safety" of nuclear power plants, the number one requirement is safety of the population, and the number two requirement is safety of the plant itself. Hot only is this is required by present regulations, but is the practice that has been followed by the nuclear industry from its beginnings. Title 10, Part 50 of the Code of Federal Regulations specifies conditions the engineered safeguards facilities must meet during the postulated maximum credible accident, that is the "large pipe break" in the primary system. The containment vessel must contain all radioactivity to protect the population and the Emergency Core Cooling System (ECCS) must be capable of keeping the maximum fuel-tube temperature below 2200*F. The ECCS is designed to meet this specification. Other limits are, oxidation of fuel-tube not to exceed 17% of thickness and hydrogen production not to exceed 1% of the amount that oxidation of all the fuel-tube could produce. The adequacy of the containment vessel to contain the radioactivity even with some controversial interference by the operators has been demonstrated by the recent Three Mile Island (THI) accident. The hard fact is that any accident that leads to a partially uncovered core shortly after shutdown from full power operation may cause severe oxidation and mechanical damage to the fuel-tubes releasing fission products into the primary coolant. Fission products in the primary loop can escape into the containment building as at TMI resulting in a costly clean-up and repair situation. We must analyze every existing nuclear power plant to determine its vulnerability to such costly clean-up and repair that can arise from credible scenarios less than the "large pipe break," similar to the TMI FLORIDA'S CENTER FOR ENGINEERING EDUCATION AND RESEARCH COLLEGE OF ENGINEERING hAY 2 1 191S PAGENO="0276" 272 situation. I believe this can be done with an acceptable cost increase in any new plants that may be found to have inadequate protection and at higher costs in any existing plants requiring retro-fitting. Additional briefing and training of operators and limiting their options during emergencies is also in order. A rerote controlled vent line from the top of the reactor vessel, a direct reactor core water level indicator, azong other minor changes, should also be considered. The ongoing loss- of-flow-test (LOFT) program should be of considerable value in providing * data on which to base decisions. I have been in the nuclear business from its beginnings. I am not committed pro or con to nuclear energy; in my view nuclear energy always has had to, and must continue to, prove that it can be utilized safely and it must, of course, be economical. With the above accomplished so that after any failure, recovery efforts and costs will be minimized, the reactor owners and the public will have reason for renewed confidence in nuclear energy as a part of our national energy selfsufficienry strategy. I appreciate this opportunity and hope the above will be helpful. If Icnb of as stanc in anyway pleflfreetOalloflme PAGENO="0277" 273 A.Wm.Snyder Sandia Laboratories Nwlew Feel Cycle Pogra~s Albuquerque, New Mexico 87115 June 8, 1979 The Honorable Mike McCormack Committee on Science & Technology U. S. House of Representatives Suite 2321, Rayburn House Office Building Washington, DC 20515 Dear Congressman McCormack: Please find enclosed the written testimony for your hearings on Nuclear Reactor Safety requested in your recent letter to Dr. D. A. Dahlgren. This material concerns the interaction of molten LWR core material with water and concrete--the subject in which you expressed specific interest. Some time ago Dr. Dahigren undertook another assignment not directly related to this area. The material which we are submitting was compiled by Dr. Marshall Berman who supervises investigations at Sandia Laboratories relating to molten LWR core material interactions with concrete and water and Dr. Glen Otey, the Manager responsible for these activities. Please call Dr. Berman, (505) 264-1545, or Dr. Otey, (505) 264-9945, if we may be of further assistance. Sincerely yours, Enc. PAGENO="0278" 274 Testimony for the Record of the May 22-24, 1979 Hearings on Nuclear Reactor Safety for U.S. House of Representatives Science and Technology Subcommittee on Energy Research and Production By: Marshall Berman, PhD, Supervisor, Reactor Safety Studies Division and Glen R. Otey, PhD, Manager, Light Water Reactor Safety Department Sandia Laboratories Albuquerque, New Mexico 87185 PAGENO="0279" 275 Molten LWR Core Material Interactions with Water and Concrete Introduction The Nuclear Regulatory Commission sponsors research investigations at Sandia Laboratories on the interaction of LWR molten core material with water and concrete. The objectives of the research are to identify, characterize and quantify the physical phenomena postulated to occur in meltdown accidents. The primary goal is to obtain suffi- cient understanding of the safety-related phenomena so that they may be modeled and predicted within reasonably conservative bounds. The concern in meltdown accidents is ultimately with containment failure. The molten core/concrete interaction is a threat in this regard for several reasons. Reactor containment can be breached by erosion of the molten core through the concrete sump. Another threat~ which is possibly more serious to containment integrity, is posed by the gases generated during the melt attack on the concrete. The gases may cause the structural limits of the containment building to be exceeded either by direct pressurization or by the over- pressure due to a detonation since combustible gases are evolved in the chemical processes of melt attack. Steam explosions are considered a threat to containment because of the direct over- pressure associated with this phenomenon and because of the possibility that projectiles launched by the explosion can cause local breaching. PAGENO="0280" 276 If containment is breached radioactive materials may be released to the biosphere in the form of noble gases, low boiling point vapors, aerosol particulates and, in the case of core erosion through the foundation, dissolved species leached from the fuel materials, by groundwater. The discussion provided herein deals with the work underway at Sandia concerning breaching of containment by mechanisms associated with core melt phenomena. The consequences of the containment being breached by these various phenomena is not discussed since it has not been a part of this investigation. Melt/Concrete Interactions The Sandia program has shown that gases liberated from concrete during interaction with molten reactor core materials are responsi- ble, in large part, for the safety related phenomena during a meltdownaccident. These gases alter the mode of melt attack on concrete, transport energy into the containment building, enhance the risk of explosion within containment, cause pressure to build within the containment, and enhance the release of aerosols from the molten core materials. The exploratory studies of melt/concrete interactions under- taken to date have been fairly broad in scope. Detailed information is available on the rate and mechanism of melt attack on concrete and consequently the rate of gas generation. More refined information is needed on the following topics: PAGENO="0281" 277 A) Gas phase reactions that yield explosive or flammable mixtures within containment, B) Aerosol generation by gases passing through the melt, C) Aerosol decay, agglomeration and deposition within containment. Gases liberated from the concrete by the action of a melt are carbon dioxide and water vapor. As these gases pass up through the melt they are chemically altered to carbon monoxide and hydrogen. As these reduced gases cool within containment, they can further react to yield methane and higher hydrocarbons. Such reactions would be considerably aided if materials within the reactor containment act as catalysts. Explosion hazards within containment have traditionally been considered only in terms of hydrogen. The possibility of a methane explosion has received less attention. As gases pass through the melt they accentuate aerosol formation either by sparging particulate from the melt or by creating particulates mechanically. Exploratory information indicates that gas-assisted aerosol formation may be ten times as efficient as thermal aerosol generation. Further, a significant fraction of the aerosol comes from sources other than the reactor fuel. Little information is available onthe details of the mechanisms of aerosol formation from the melts and especially the influence of melt composition on aerosol formation. PAGENO="0282" 278 Once aerosols form they immediately begin to agglomerate. When this agglomeration has proceeded far enough, the aerosol particles will sediment out of the containment atmosphere. Details of these processes with prototypic aerosols are completely unknown. Factors that should be considered include: A) Rate of aerosol agglomeration B) Influence of water droplets or vapor on aerosol behavior C) Impaction and retention of aerosol on surfaces D) Sedimentation of aerosols. A limited program to consider some of these features in the piping system of a reactor is underway at Sandia under NRC sponsorship. A more ambitious program to study aerosol behavior in containment has been initiated in the Federal Republic of Germany. If a core melt erodes the foundation of a reactor, it will come into contact with the soil. Exploratory studies have indicated that the thermal front preceding the melt will dry the earth prior to melt contact. However, once the melt solidifies it will again be innundated with ground water. This water will leach radioactive materials from the solidified melt. Since gas generation during melt/concrete interactions is a source of numerous hazards, a candidate method for improving safety would be to replace concrete as the material lining the reactor sump. Concrete might be replaced by a material which, as a minimum, would not yield gaseous products when exposed to a melt of reactor core materials. Additional safety could be PAGENO="0283" 279 achieved if the material was relatively immune to melt attack or would dilute and cool the core melt. A limited exploratory study of candidate materials to replace concrete has been initiated. Candidate materials may be categorized as: A) Refractories which would contain the~ melt until it had solidified. Examples are MgO, Zr02, U02. B) Sacrificial materials which would dilute and cool core melts. Examples are borax, basalt, and magnetite. These melt retention materials greatly mitigate the safety hazards posed by gas generation. They do not eliminate hazards produced by aerosol generation. In summary, the preliminary information from this exploratory study indicates that: A) There are materials which might be used to line sumps that are very resistant to erosion by molten core material and which would greatly mitigate hazards due to gas generation. B) The erosion resistant materials investigated offer promise as a means for retaining the molten core within containment but do not substantially mitigate aerosol generation. The continued efforts in this program will be directed to im- proving the data base for the above topics as they relate to release of radioactive materials. One area that is not being PAGENO="0284" 280. studied in the current program is the effect of reflooding the melt with coolant. As with the existing data base for melt/concrete interactions, the current program concerning core retention materials is being conducted for the purpose of risk assessment. The results may be useful for identifying possible engineered safety features. Steam Explosions When a hot melt and water come into sudden contact and the temperature of the melt greatly exceeds the vaporization temperature of the water, a violent release of steam may result. This phenomenon, which is believed to be due to the fragmentation of the hot melt allowing a very rapid transfer of heat causing vaporization of the surrounding water, is known as a steam explosion. In a reactor meltdown accident, contact between molten core materials and water could take place in the bottom of the reactor vessel or in the sump beneath it. A steam explosion following a fuel melt accident is of concern since it introduces additional mechanisms for breaching containment. Three such postulated mechanisms are: PAGENO="0285" 281 A) Failure of containment due to the direct overpressure from the explosion, B) Penetration of containment by projectiles launched by the steam explosion, C) Failure of containment due to combustible gas (e.g., hydrogen) detonation initiated by the steam explosion pressure pulse. Sandia is investigating, under NRC sponsorship, various phenomena associated with steam explosions. Triggering of these explosions is being studied in small scale experiments (- lOg) using core melt simulants. Intermediate scale (1-25 Kg) experi- ments have been performed in open geometry to measure the thermal- to-mechanical energy conversion efficiencies. A closed geometry test facility is presently being constructed to extend these efficiency tests to a broader and more representative set of materials and to improve the accuracy of the measurements. Analytic efforts are underway to: 1) model the fragmentation processes; 2) estimate the work efficiencies; 3) develop scaling models; and 4) estimate the probability of containment breaching due to the direct overpressure from steam explosions or from penetration by projectiles launched by steam explosions. The program at Sandia is in an early stage. The results to date indicate that steam explosions may be likely under hypothetical fuel melt accident conditions. On the other hand, PAGENO="0286" 282 the experiments indicate that multiple explosions, which greatly spread the energy release in time, occur frequently. The estimated efficiencies for observed explosions were all at least an order of magnitude less than the maximum theoretical value. Thus, the achievement of maximum theoretical efficiencies in extremely large, coherent explosions appears to be unlikely. These results are, of course, of a preliminary nature. The work planned over the next two years should provide a firm technical basis for assessing the probability of containment breaching by steam explosions. PAGENO="0287" 283 IN REPLY PLEASE ADDRESS: 1901 LStreet,N.W., #711 Washington D.C. 20036 4 AMERICAN INSTITUTE OF CHEMICAL ENGINEERS May 24, 1979 Mr. Ian Whyte Committee on Science and Technology B-374 Rayburn House Office Building Washington, D.C. 20515 Dear Ian: As you requested, the American Institute of Chemical Engineers is pleased to submit the enclosed paper on `Relative Health and Safety Impacts of Coal and Nuclear Electric Power Generation" for the Subcommittee on Energy Research and Production's hearings on nuclear reactor safety. The paper was written by Dr. Walter Meyer, Professor and Chairman of the Nuclear Engineering Department at the University of Missouri-Columbia, and will provide an interesting dimension to the hearing record. ,$nce~l T. J. Hamilton Ocnc~,s-,vt J.YOLOS,WE, s~J.QKNUO$N,,,. ~ PAGENO="0288" 284 RELATIVE SAFETY IMPACTS I would like to examine the safety aspects of electric power generation in the context of the energy resource choices that are available generally in the United States, i.e., coal and nuclear. Unfortunately much of the analysis of nuclear safety issues has not been presented* in the broad con- text of the alternative choices. Frankly, it is necessary tha~ we examine these two alternatives in comparison with one another and fortunately for this consideration a number of such analyses have become available particu- larly in the last ten years. An attempt will be made here to bring a nucber of these a~j~tses together and summarize them for your review. One of the more important recent documents examining nuclear power health and safety in the context of the coal alternative is Nuclear Power Issues and Choices.1 Quoting from this report of the Ford Foundation Nuclear Policy Study Group, The use of nuclear power to generate elec- tricity inevitably results in risks to human health. The extent of these risks is uncertain and the subject of considerable controversy. To be meaningful in connecting the public policy decisions, these risks cannot be considered in isolation but must be compared with the risks associated with coal-fired power plants which are the principal alternative for electric power generation for the rest of this century. I. The Potential Means of Electrical Power Generation The potential means of electrical power generation have to be examined from four different perspectives: first, technical feasibility within the 1Nuclear Power Issues and Choices, Report of the Nuclear Energy Policy Study Group, sponsored by the Ford Foundation, administered by the Mitre Corporation, Ballinger Publishing Company (1977). *Emphasjs added. PAGENO="0289" 285 timeframe in which the added generating capacity is required; second, reliability of the technically feasible means; third, cost of generation by the various means; fourth, the future availability of fuels for the feasible means, and fifth the health and safety iopacts. Here we ~iill limit our explanation to the first ~nd fifth points. A. Present Practical ~eans of Electrical Power Generation Historically, fossil fuels including coal, oil and natural gas offered the technically feasible means of providing energy and generation of electrical power. A recent addition to the technically viable means of electric power generatingincludes nuclear fission. Because of increasingly severe shortaqes of supply and qovernoent r.iandate, natural gas and oil will in fact no lonqer be available for added generation capacity. Coal is the fuel used in generating the major fraction of electrical power in the U.S. today. Larger capacity coal-fired systems employing advanced com- bustion systems in an attempt to achieve improved overall efficiency and reduced pollutant emissions arebeing designed and constructed. The questions of the technical viability of coal concern the practicality of achieving acceptable emission byproduct controls arid containment, estmblishing the necessary trans- portation system between the mines and generating stations, and locating, cpening and operating the necessary mines. Emission and byproduct control, and containment will be discussed in detail here. With respect to the control of emissions from fossil plants the primary objectives of controls up to this time has been directed at relatively large sizes of particulates and sulfur dioxide. Particulates are removed from the stack gases using various types of filters or precipitators. The use of filters 48-721 0 - 79 - 19 PAGENO="0290" 286 RELATIVE SAFETY IMPACTS I would like to examine the safety aspects of electric power generation in the context of the energy resource choices that are available generally in the United States, i.e., coal and nuclear. Unfortunately much of the analysis of nuclear safety issues has not been presented* in the broad con- text of the alternative choices. Frankly, it is necbssary that we examine these two alternatives in comparison with one another and fortunately for this consideration a number of such analyses have become available particu- larly in the last ten years. An attempt will be made here to bring a number of these analyses together and sucrearize them for your review. One of the more important recent documents examining nuclear power health and safety in the context of the coal alternative is Nuclear Power Issues and Choices.1 Quoting from this report of the ord oundation Nuclear Policy Study Group, The use of nuclear po~:er to generate elec- tricity inevitably results in risks to human health. The extent of these risks is uncertain and the subject of considerable controversy. To be meaningful in connecting the public policy decisions, these risks cannot be considered in isolation but must be compared with the risks associated with coal-fired power plants which are the principal alternative for electric power generation for the rest of this century. I. The Potential Means of Electrical Power Generation The potential means of electrical power generation have to be examined from four different perspectives: first, technical feasibility within the 1Nuclear Power Issues and Choices, Report of the Nuclear Energy Policy Study Group, sponsored by the Ford Foundation, administered by the Mitre Corporation, Ballinger Publishing Company (1977). *Emphasis added. PAGENO="0291" 287 is generally limited to small generating stations, 100 IWe or less with the electrostatic precipitators used on large stations. The devices used are generally effective with routine operatinq efficiencies over ninety percent on coals with high sulfur contents (greater than one percent)*. With low sulfur (less than 0.7 percent) coals which also have higher ash contents, precipitators are inefficient. High ash and low sulfur2 content combined with reduced precipitator efficiency significantly increase the cost of.. handling the particulates or fly ash for plants fired with low sulfur coal. Once the precipitator collected particulates are removed from the stack gases, they must still be disposed of. For a 1000 MWe station particulate disposal may amount to a volume of thirty (30) or more 100 ton (nominal) coal cars each day. This material contains lead, telerium, antimony, cadmium, selenium, zinc, vanadium, arsenic, nickel, chromium, sulfur, berrylium and manganese, concentrated in the smallest particle sizes+3, all of which are known to be toxic to man at some low level. However the tolerable body burdens for each of these elements are unknown.2 Disposal of coal wastes will be discussed in more detail later but it would seem prudent that these materials should be disposed of in some type of permanent disposal site that would prevent release of these materials to the biosphere (a clay pit or other disposal site that would prevent leaching of the toxic materials into the It should be noted however that with a 99~ efficient precipitator, a 1000 MWe (2800) WWth) power station would discharge approximately 6,500 tons of partic- glate to that atmosphere each year. Piperno, `Trace Element Emissions: Aspects of Environmental Toxicology', in S.P. Babe, Trace Elements in Fuel, American Chemical Society Advances in Chemistry +Series, ~ 3 The smaller the particle the sore biologically active is the particle. 3R.E. Lee, S.S. Gorandsu, R.E. Ern-ojne and G.B. Morgan, Environmental Science Techno~gy, 6, 1025 (1972). PAGENO="0292" 288 biosphere would be required). The volume of the material to be disposed of in the thirty year life of the plant would be 15,500 acre feet (26 mil- lion cubic yards). The State of Illinois is sufficiently concerned with this problem that state laws controlling solid waste disposal are being interpreted to prevent noncontained discharge of fly ash and bottom ash to the biosphere. The cost and design of the necessary contained disposal sites are just beginning to be estimated. It should be noted that if precipitators are used they will not prevent significant dissemination of the volatile toxic metals, mercury, lead, arsenic, cadmium, vanadium, selenium, antimony, zinc and others to the biosphere. The potential health effects of these materials will be discussed later. It might be expected that the use of a flue gas scrubber system would reduce both sulfur and trace element emission from fossil fueled power sta- tions as compared with plants fitted with precipitators only. However, the lack of proven scrubber technology,4 is preventing the determination of what reductions in trace element emissions might in fact be realized. The effluent from scrubbers still has a similar potential for biosphere contamination as does fly ash. For a 1000 HWe power plant burning 2 to 2.5 percent sulfur coal over a thirty year life, 6100 acres (9.5 square miles) of storage pit five feet deep would be required unless effective means of water drainage can be developed. This acreage would be required in addition to those ap- proximately 22,000 acres that would be necessary for the coal inventory typical of a 1000 fIle coal-fired station.5 ~II. S. Rosenberg, et. al., `Processing SO2: The Status of SO2 Control Systems," Chem. Engr. Prog., 71, 66-71 (1975). 5"Comparative Risk-Cost-Benefit Study of Alternate Soufces of Electrical Energy," USAEC, WASH-1224 (December 1974). PAGENO="0293" 289 Coal fired power stations will also yield sulfur and other volatile trace elements that can be partially controlled with precipitators but the ultimate disposal problem of the precipitated waste still remains. Most analyses of the total impact of fossil fueled electrical power generation stations to date have neglected the environmental impact of disposing of precipitated or scrubbed waste. At the same time extensive efforts have been made to evaluate the impact of nuclear electric power generation including the total fuel cycle. II. Backqround: Public Health Effects and Occupational Fatalities and Injuries from Coal and Nuclear Electric Potter Generation Much has been written about the potential public health consequences of the improbable nuclear meltdown accident but relatively little attention has been paid to a comparison of the health affects accompanyinc the routine operation of commercial fossil fueled stations with the routine operation of nuclear.stations or for that matter with the nonroutine accident situation attending the operation of a nuclear power plant. Several studies of this type, completed by 1973, indicate that a substantial additional cost should be levied against the operation of fossil stations to account for health and environmental effects accompanying routine operation. Following in Tables 1, 2 end 3 are EP1~ 1970 estimates of the damages resulting front air pollutants.6 In terms of the cost of damage alone it is expected that the 1970 costs noted would have to be increased by a ratio of about 220/126 6T.E. Waddel, `The Economic Damages of Air Pollution", Socio-economic Environ- mental Studies Series, Environmental Protection Agency, EPA-600/S-74-Ol2, pp. 130-131 (May 1974). PAGENO="0294" 290 Table 1: Contribution to Air Pollution 6 (*)(+)t by Fuel Combustion in Stationary Sources Total Tons (xlO3) Amount emitted emitted/year by by fuel comb. all sources in stat. sources _________________ 148.7 0.8 26.1 6.8 33.9 26.5 34.9 0.6 22.8 10.0 266.4 44.7 * Derived from Table 20 `Estimates of Nationwide Eceussions 1970 from J.H. Cavendor, D.S. Kirchcr, and A.S. Hoffman, Nationwide Air Pollution Emission Trends lP4O-1978, Publ. Ho. AP-115, EPA; flesearch Triangle Park, January 1973. ~Stationary Sources are defined as public utility and industrial power plants, co~2rcial end institutional boilers, and residential furnances. ~This column does not total to 100 because the values above are for each particular p~ilutant; the total is for all of the pollutants. Poll utcint Carbon Nonoxide Parti cl es Hydrogen Chloride fox Total Percent emitted by fuel comb. in stat. sources 0.54% 26.1% 78.2% 1 .2% 43.9% PAGENO="0295" Table 2. National Costs of Pollution Damage, by Source and ($ billion) Effect, 1970 Effects Transportation Stationary source fuel conbustion* Industrial processes Solid waste Agricultural burning Misc. Aesthetics & soiling 0.2 3.1 2.0 0.1 0.2 0.2 Tbta~ 5.3 Hunan health 0.1 2.2 1.7' 0.2 0.2 0.2 4.5 Materials 0.6 0.8 0.3 * * 1.7 Vegetation 0.2 , * * * * 02 . Total 1.1 6.1 4.0 0.3 0.4 0.4 i2.3 *Megl igibl e *Statjonary sources are defined as public utility and industrial power plants, commercial and institutional boilers and residential furnaces. PAGENO="0296" Table 3. National Costs of Air Pollution Damage, by Pollutant and Effect, 1970 best LOW tiign Best * 3.4 8.2 5.8 ? 1.6 7.6 4.,6 * 1.0 2.4 1.7 * 0.1 0.3 0.2 ** ? ? ? Total 2.8 8.0 5.4 2.7 8.9 5.8 0.6 1.6 1.1 6.1 18.5 12.3 Notes: aAlSO measures losses attributable to NON. bproperty value estimator 0Adjusted to minimize double-counting ?Un known *Negl igible (S billion) Effect sox - Particulate 0~ CO Total * Aesthetics & soilingb~0 Huoan health Materialsc Vegeta ti on Anirals Natural environment Low 1.7 High 4.1 Best 2.9 Low 1.7 High 4.1 2.9 ? ? ? 0.7 3.1 1.9 0.9 4.5 2.7 ? ? ? 0.4 0.8 0.6 0.1 0.3 0.2 0.5 1.3 0.9 * * * * * * 0.1 0.3 0.2 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? .7 ? ? ? ? PAGENO="0297" 293 (ratio of cost indexes in 1978 to 1970) to account just for price increases since 1970. Using the national costs of Table 2 for pollution damage caused by stationary source fuel combustion, the price index corrected value is 10.6 billion dollars in 1978. This estimate does not take into account possible expnsion in the number of pollution sources since 1970 or improvements that might have occurred in pollutant control since 1970. An estimate published by [PA7 in 1974 shows that damage due to SO2 and particulates amounts to 11.2 billion dollars per year in 1974 dollars (or 14.9 billion dollars in 1978 dollars). In Table 4 following is a comparison between the environmental and health effects resulting from the routine operation of coal and nuclear power systems. These results show substantial costs in both dollars and lives if coal is substituted for nuclear po~':er systems. These costs should be accounted for in evaluating the total costs of using fossil fuel systems. Replacing nuclear power capacity with coal fired systems would cost the lives of about 20 to 100 persons each year over those that would be lest if nuclear generating systems were used. These additional deaths would continue for the lives of the coal fired plants, or about 30 years. In addition there would be significant economic losses if the coal alternative were selected. It is also worth noting that many of the fatalities and economic losses would occur to persons who derive no direct benefit from the electric power generated~ i.e., the pollutants would be carried beyond the service area of the persons using the electrical power. 7A.L. Dare, `What's a Scrubber', Office of Public Affairs (A-lO7), U.S. Environmental Protection Agency, Environmental Facts (October 1974). PAGENO="0298" 294 Table 4: Annual Uealth Effects and Occuoationul Fatalities and Injuries Resultini from Electric Poster Productron of 1000 Ole from Coal and Iluclear Fuels Cateciorv of Effect or Injury Industrial Injuries (Deaths) Operations Related Injuries (non- lethal industrial accidents in all parts of thu progran) Pneumoconiosis (Black Lung Disease) -HEll Payments to Black Lung Victims Excess Desths of the Public Due to Atmosp!:cric 02 Effects due to Acid Rain on Buildings, Lend, etc. - Ouclear 12 0.49/year 517 days off/year1° Coal 3.05 11 100 miners totolly~in- capacituted at any given time with 6 new cases! year 4.46 million dollars! year 10,i2 20-100 fatalities/year 10 30 million dollaro,'yc:r year 7,lO,lls *This ns~;bor includes an allowance for the effect on the public of the low probability sticicar calamity, meltdown accident, us well as accidents to workers in nuclear power plents end uranium miners including radiation exposure. Thu majority of these deaths ~ure rinine accidents. EPA reseerch cited in reference (7) indicates thut sulfur oxides and particulates cause $11.2 billion psr year in damage. Rose stafes 61 percent of the sulfur effluents come fret electric power plants.10 11 L.C. Lave and Freeburg, 1.6., `liucleur Safety", Vol. 14, pg. 409 (September-October, 1973). ~ Rose,, `Huclear Eclectic Power', Science, 184, 351-359 (April 19, 1974). PAGENO="0299" 295 Figure 1 following shows the mortality data from chronic respiratory disease prepared by the Environmental Protection Agency and used by the National Academy of Sciences in their 1975 study of fossil fuels.8 The "best judgment' line neglects (probably properly) early London and Oslo data and forms the basis of the hAS and EPA mortality estimates. Acid sulfate levels in eastern U.S. urban areas are 16-19 pg/rn3, which are apparently safe if the best-judgment line applies strictly and if there is a real threshold at 25 pg/m3, as shown. Dr. David Rose of MIT in evaluating these results states however, "But few would feel satisfied to live so close to danger, especially in view of large uncertainties in the data and of environmental fluctuations. `~ Using Figure 1, the EPA has estimated that, if the 1975 SO2 standards were all met, the excess mortality in 1980 owing to SO2 would be very small--in the order of one death, or less, per power-plant-year. This number is comparable to the nuclear-plant hazard. Figure 2 shows an anomaly with respect to suspended sulfates and their effect on cigarette smokers. In general pollutants will act synergisticaly with the cigarette smoke to produce enhanc~d disease effects. This is an apparent exception to that general rule. Rose observes further, "If, however, the 1975 air standards are not met or are significantly relaxed, the numbers of deaths climb spectacularly--to about 4,500 in 1980 or some 20 deaths per 1,000 MW coal-fired plant per year. If the "mathematical best fit" of Figure 1 is assumed to apply instead (a pessimistic assumption), the 1980 deaths jump to about 100 per plant-year from air-quality deterioration alone. Such statistics overwhelm the nuclear risks of every kind." 8Air Q~iality and Stationary Source Emission Control, National Academy of Sciences (1975). 9D.J. Rose, P.1!. Walsh and L.L. Leskovjan, "Nuclear Power Compared to What?" A~erican Scientist, Vol.64, 291-299. PAGENO="0300" 296 30 ~ ~r7jr 0 N~w `t'orlz City. t!;GOs .25 C, L"ndt~n, A O~tc. 1550, ~ j%1dj~flCflt 20 ,~,:*thcrn;itic.;tt bcst fit 15 0 ___L~__O.0 ~ L~._._L 0 5 10 15 20 25 30 35 40 45 24h oUr~USp~J~th'd sull;~tcs, ~g/n~ Figure 1. The percentage of expected excell mortality owing to acid sulfates in the air is estimated from suspended particulates and sulfur dioxide levels in three cities. The mathematical fest fit line is currently considered to be a pessimistic assumption. (Data from EPA, summarized in Ref. 8.) 250 0' 0 no,n~oScr~ 0 / 200 ~ ,/I ~u1f.,~Im' Figure 2. The excess chronic respiratory diseasm expected from acid sulfates has a threshold at 10 pg/rn3 for nonsmokers and 15 ~ for cigarette smokers. The data is based on studies in five areas and on the pooled results from the Community Health and Environmental Survefliance System program for 1970-71. (Data from EPA, summarized in Ref. 8.) PAGENO="0301" 297 With regard to an analysis similar to that in Table 4 completed by Dr. Rose,1° he states as follows: `What are we to conclude? The exact numbers are uncertain but the general trend is clear. Apparently if we continue to burn coal in the same way as in the past, or aggravate the problem by increasing coal production and relaxing environmental standards, we are in for a great deal of trouble. The predicted total excess deaths in 1980 due to this acid sulfate cause alone, vary from a few--under stringent sulfur-removal conditions--to as much as 4,500 according to one EPA estimate, or as much as about 60,000 according to a different source. Those numbers translate to about 20 - 100 deaths per year for each (coal fired) electric power plant--about 20 to 100 times the mortality associated with all phases of nuclear power, as presently judged. In addition, we find vast non-fatal health effects.' An extensive analysis of the total impact of using coal, oil and gas in comparison with light water nuclear reactor power systems is provided in WASH-1224.5 This document shows for example that the costs of pollution abate- ment for coal and oil stations amount to respectively 30 million and 11 million dollars per year in comparison to a cost of 3-4 million dollars per year for a light water reactor station of the same size. Total environmental and health effects of coal plants are noted to be three times more costly than those for nuclear stations while oil is 1.6 times more costly than nuclear. It should be noted that these costs do not include public health effects of air borne fossil Rose, "Nuclear Versus Fossil Fuel Power", Nassachusetts Institute of Technology, Cambridge, flass. (1975). PAGENO="0302" 298 pollutants such as SO2~ NOR, particulateS~ trace metals, etc.* Table 4 shows these latter costs would be very high. The health effects of nuclear posier systems have been studied in detail over many years. However the situation with regard to the health effects of the combustion of fossil fuels is quite different. We have some knowledge of the consequences of the excessive exposure to the conm~on products of combus- tion and even some knowledge of effects of exposure to trace elements resulting from such combustion, but we have not yet, particularly with regard to the trace elements, been able to define tolerable body burdens for these combustion products.1 *As a result of this lack of information we cannot accurately predict the long-term effects of exposure of large populations to combustion products.+ Even short term effects are difficult to define in a consistent manner that different analysts can agree on. Analysis of daily death figures in the U.S. suggest to some that 2 to 3 percent of such deaths are a result of air pollutants. Other analysts using the same data argue that the proper figure is 14 percent of daily deaths.13 There has been debate concerning the effects of all these pollutants. Early reports tended to indicate significant health effects. Later these reports were attacked as exaggerating the consequences of the presence of these materials in the envirnnment. However more recent reports tend to confire the existeece of a substantial basis of concern over atmosphericpollutants (see Chemical Ennineerino News: May 5, 1975, pg. 5; June 9, 1975, pg. 4 and 20; September 1, 1915, pg~TO~ September 29, 1975, pg. 17; and January 26, 1976, pg. 7). +Note EPA has moved to curb air pollutants emitted by new copper lead and zinc sniellers when studies have shown a higher than average numboç of lung cancer deaths among peOple living near arsenic emitting smelters.'3 13Chemical and Engineering News, pg. 7 (January 26, 1976). PAGENO="0303" 299 It must also bc noted that the intrusion of. the products of combustion on our lives is not through the air alone but also through our food and water. The seepage of trace elements from coal and ash piles, scrubber sludge ponds and the fallout of airborne particulates into surface and ground waters and then into the food chain, is recognized as a potential source of degenerative disease in man.' The effort to quantify the effects is however certainly in its infancy. In contrast with this risk in 1975 the American Physical Society published an independent evaluation of the accident risks in commercial nuclear power plants.15 This study shows that for the PWR-2 reference accident, in the words of Dr. Wolfgang Panofsky of the APS study.staff, "As far as an individual in the exposed population is concerned his risk of dying of cancer would be increased by 0.1 percent over the normal 20 percent likelihood".16 This last sentence is particularly important. An individual in the exposed population following an improbable nuclear accident with significant radiation release (theApS study attributes a probability of one chance in 200,000 reactor years to this accident) the probability of developing cancer changes by only 0.1 percent over the normal 20 percent cancer incidence statistics that apply in the U.S. At the same time we simply tolerate a stiuation where 2 to 3 percent to 14 percent of daily deaths in the U.S. are a result of air pollutants. The fraction of these pollutants due to stationary power plants is about 32 percent. Therefore, we ignore a situation where fossil fueled 15"Report to the APS by the Study Group on Light Water Reactor Safety", Reviews of1'odernPivsic~sics, Vol.47, Supplement No. 1 (Summer 1975). 16Lettcr from Wolfgang K. H. Panofsky to Congressman Norris K. Udall (Nay 9, 1975). PAGENO="0304" 300 power plants routinely produce from about 1 percent to 4.5 percent of daily deaths, a figure 10 times greater than the result of the improbable nuclear accident. As noted earlier an important recent study of the relative health and safety risks of nuclear power was provided by the 1977 Ford-Mitre Nuclear Energy Policy Study Group. This study examined all aspects of the health impacts of nuclear power including mining, milling, mill tailings, transportation, conversion and fabrication, normal reactor operation, impact of core melt accidents, reprocessing and recycling of uranium and plutonium and finally waste management. Taking the most pessimestic view of routine reactor operation would produce 1.0 expected deaths per reactor Year. Taking the most pessimistic view of the probabilities and consequences of nuclear power plant mel~ down accidents would be about 10 fatalities per reactor year for a 1000 MWe power plant. But here and I quote from the report, "It is significant that even under such extreme assumptions, the fatalities are less than the high end of the range of estimated deaths associated with coal-fired power plants, discussed below. As the discussion in Chapter 7 stresses, this is not a prediction but a limit to which no probability is attached. It is used solely to give an upper bound on the range of estimates that are possible. "A further important consideration arises if the estimate of health risk is to be used not as an index of present performance of nuclear power plants but as a guide to making a future choice between nuclear and coal or other energy sources for electricity generation. The central average rate-of-loss estimate in WASH-l400 of 0.023 fatalities per reactor year derives largely from about 10 percent of the 100 reactors surveyed. Indeed, more than half its value is probably contributed by only a few reactors whose location with respect to dense populations is such that certain weather conditions at the time of PAGENO="0305" 301 accident could expose very large populations and thereby lead to unusually large numbers of presumptive fatalities. Thus, to the extent that reactors could be located at less potentially risky sites, the average rate-of-loss risk for a particular new reactor could be lowered by a factor of 10 to 100. Therefore, even the higher risk probabilities that could possibly enlarge the WASH-l400 values upward toward an average rate-of-loss of 10 latent cancer deaths per reactor year could be reduced by prudent site selection to average values that are low relative to other contributions of the nuclear fuel cycle.' With respect to coal the Ford-Mitre report states as follows: `For new coal-fired plants meeting new source standards, this analysis indicates a range of premature deaths from occupational and public effects of the coal fuel cycle and the effluents of coal combustion in the range of two to twenty-five per year for a 1,000 MWe plant. These numbers could be reduced by the use of lime scrubbers alone or in conjunction with low-sulfur coal or by the use of other new technology, such as fluidized bed combustion. Despite these large uncertainties, the general conclusion is that on the average new coal-fueled power plants meeting new source standards will probably e~act a considerably higher cost in life and health than new nuclear plants. However, both coal and nuclear power plants built in the rest of this century could have m~ich reduced health risks relative to existing plants. This can be accomplished in the case of coal plants by limiting sulfur dioxide and other emissions in conformity with present or improved air quality standards and by prudent siting; and, in the case of nuclear power plants, by improved siting and safety controls. In the im;nediate future, a major effort should be made to improve the assessments of the health 48~721 a 79 20 PAGENO="0306" 302 effects of the pollutants from coal combustion. The most pressing demand, however, would appear to lie in upgrading the research end develop~iient directed at the reduction of the adverse health effects associated with coal-fueled power plants.' Van Horn and Wilson of the Harvard University Energy and Environmental Policy Center have examined the relative effects of coal and nuclear from the point of view of estimated past impacts. This analysis therefore does not include any allowance for a nuclear accident that would affect the public. There just haven't been any accidents of this type.~7 Table 5 following presents the results of Van Horn and Wilson. These results are based on the generation of 750 x 106 Tlwh of electric power by nuclear power plants operating in the period from 1967 to 1976. The health impact of this nuclear generated power is evaluated and compared with what impacts would be calculated to have occurred if the nuclear generated power had been replaced by a mix of natural gas, coal and oil fired electricgeflerating plants. The power was proportioned between the different types of fossil plants based on the fraction of electric power generated by each type of plant nationally. Again a very significant coal impact is noted compared to nuclear. Van Horn and Wilson state as follows with resr.ect to the figures in Table 5: `In su;woary, largely because of wide dispersal of sulfates, the air pollution fatalities for fossil fuels given in Table 1 are an underestimate by about a factor of three. Consequently, the additional deaths which would have resulted in the United States 17A. Van Horn and R. Wilson, "Will the Past be Prologue?" E~jc~~.1li~i55. L~j°~.1~ February 3, 1977, pp. 43-45. PAGENO="0307" TABLE 5 ESTIMATED U.S. FATALITIES FROM 750 MEGAWATT-HOURS ELECTRIC POWER GENERATION (1967-December, 1976)17 Replacement Fuel Nix 18"The Health and Environmental Effects of Electricity Generation', Biomedical and Environmental Assessment Group, B~L report 20582 (1974). 19L.D. Hamilton, "Health Effects of Air Pollution", BNL report 80743 (July 1975). Wilson and W. Jones, ~y~Eco1ooyan(ithe Environment, i~cade;~iic Press, New York (1974). Natural Gas Fired (180x106 Mwh) 2.5 0.25 0.6 (- ) 3.5 0.119 Fatalities Extraction Transport Processing Transport Electrical Generation (air polution) Waste Disposal Total Fatalities (referenceslB'l9) Total Per Year Per `1000 MWe Plant Total 20 (reference Coal Fired (420xl06 Mwh) 60- 500 (2 )+( 620) 62-1 90 185-6,200 (640) 940-7,500 13.7-109 Oil Fired (l5OxlO6 Mwh) 2.0 1.1 23+(l80-2,500) 1.1 23-2,250 45-2,250 1.84-91.9 Total Replacement Fossil Fuels (750xl06 Mwh) 52-500 25 62-190 210-8, 500 (640) 1,000-10,000 11,300 Total Nuclear Fuels (750xl06 Mwh) 11-31 57 11-91 80-189 0.654-1 .54 PAGENO="0308" 304 from replacing nuclear power by fossil fuel electricity generation up to December, 1976, is in the range of 1,900 to 27,500 deaths, and a little more than twice this worldwide. The low-fatality figure is for exclusive replacement by the lowest sulfur fuels and the high figure is for high-sulfur fuels. If we assume the epidemiology of air pollution is roughly correct, the actual sulfur content of fossil fuels burned in existing power plants indicates that the number of fatalities is likely to have been in the upper half of this range. In 1975 alone, the estimated excess deaths would have been between 400 and 6,000. The numbers we have quoted are only for mortality and do not include morbidity." With respect to morbidity the USEPA reports that the numbers for air pollution morbidity are five times the mortality figures.21 In 1976 the House of Delegates of the American Medical Association requested an evaluation of the health hazards of nuclear fossil and alternative energy generating sources.22These evaluations were to include effects on both employees in generating plants and to the general population. A summary report was released in June 1978. The report observes that despite varying degrees of difficulty, quantitative assessments havebeen made of the mortality-morbidity associated with each of the fuel cycle components. The report draws on some thirteen supporting documents to arrive at its conclusions. The results of the study are summarized in Tables 6 to 10. The data in Table 6 reflect the deaths and injuries in coal mining, including coa~ 21'Wealth Consequences of Sulphur Oxides: CHESS report 1970-71", USEPA, EPA-650/l-74-004, (May 1974). Evaluation of Energy Generating Sources", Report of the AMA Council on Scientific Affairs; AMA House of Delegates, June 21, 1978. PAGENO="0309" 305 * worters pheumoconiosis, train accidents and the mortality and morbidity of air pollution from coal fired generating plants. Similarly Table 7 includes estimates of deaths and injuries in uranium mining as well as fractional death and morbidity estimates for the other components of the nuclear fuel cycle. It does not include estimates of the effects of a catastrophic nuclear accident. The AMA report states, "On the basis of these tabulations, a coal-fired power plant each year results in from 48 to 285 times more deaths than does an equivalent nuclear power generating station, 2-3 times more than an oil-fired plant and 36-1120 times more than one fueled by natural gas." If the upper limit of the nuclear statistics in Table 8 is augmented by the upper limit of 10 deaths for the catostrophic nuclear accident from the Ford-Mitre report~ the upper limit of the death impact of coal is still 28 times higher (a ratio of 314 to 11.1) than that for nuclear. Again we see a very severe relative impact from the routine use of coal fired plants. The AMA report states as follows: "In summary, this brief report provides a range of estimates of the occupational and non-occupational health effects of several predominant modes of electric power production. It appears that cod end nuclear power will be the principal fuels for electric po~:er production in the next 25 years. At the present time, coal has much greater adverse impact on health than does nuclearpower production, and efforts need to be directed toward reducing both the health and adverse environmental impacts of all forms of energy production." Much concern of course exists regarding the catastrophic nuclear accident. But at the same time there is significant and growing concern in scientific PAGENO="0310" 306 TABLE 6: EST1NATES OF HEALTH EFFECTS OF COAL Occupati onal Occupational Injuries and Deaths* Disease* .45 - 1.24 22. - 80. 0.00 - 4.8 0.6 - 48. .055 - 1.9 .33 - 23. .02 - .05 2.6 - 3.1 .01 - .03 0.9 - 1.5 Procedure EXTRACT I ON Accidents Disease TRANSPORT Acci dents PROCESSING Acci dents POWER GENER.4T1 ON Air Polution TO T A L FUEL CYCLE22 Non-occupati onal Deaths* .55 - 1.3 1. - 10. .067 - 295. .54 - 8.0 26. - 156. 1.62 - 306. *Per 1000-NWe per year PAGENO="0311" 307 TABLE 7: ESTIMATES OF HEALTH EFFECTS OF NUCLEAR FUEL CYCLE22 Procedure EXTRACTION Accidents Disease TRANS PORT Accidents PROCESSING Accidents Disease POWER LENERAT ION Accidents Disease TOTAL Occupational Dea ths* .005 - 0.2 .002 - 0.1 .002 - .005 .003 - 0.2 .013 - 0.33 .01 0.00 - 0.1 Occupational Injuries and Disease* 1.8 - 10.0 .045 - 0.14 0.6 - 1.5 1.3 Non-occupa ti onal Dea ths * .01 - .16 .035 - .945 3.7 - 13. .01 - .16 *pCr 1000-MWe per year PAGENO="0312" TABLE 8: COMPARiSON OF HEALTH EFFECTS OF ALTERNATIVE FUELCYCLES FOR ELECTRIC POWER PRODUCTION*22 EFFECT COAL OIL Occupational deaths 0.54 - 8.0 0.14 - 1.3 ~on-Occupationa1 deaths 1.62 - 306. 1. - 100. Total deaths 2.16 - 314. 1.1 - 101. Occupational impairments 26. - 156. 12. 94. NATURAL GAS NUCLEAR 0.06 - 0.28 0.035 - 0.945 --- 0.01 - 0.16 0.06 - 0.28 0.045 - 1.1 4. - 94. 4. - 13. ~èr 1000-MWe PAGENO="0313" TABLE 9: CONPAR1SOW OF HEALTh EFFECTS FOR ALTERNATIVE FUEL CYCLES - -*- **-*-----** FOR ELECTRIC POWER PRODUCTION IN U.S. IN 197522 - Fuel Coal Oil 1975 KWhe x 1O9 844 292 297 168 Occup. 69. - 1024 6. - 57 45 3. - 13 26 0.9- 25 Estimated Occup. Impairments 3330 - 20000 530 - 4100 180 - 1030 100 - 340 TOTAL 1601 243 79. - 1119 251 - 43572 4140 - 25000 Equivalent No. of 1000-~We Plants 128 .44 Gas ~uc1ear Estimated Deaths _______ Non - 0CC U p. 207. - 39168 44. - 4400 0.3- 4 0 PAGENO="0314" 310 TABLE 10: EKHANCED RISK OFDEATH PER YEAR FR0~I ELECTRICITY PRODUCTIOU*22 NORNAL RISK ENHANCED RISK OF DEATH PER YEAR** AGE OF DEATH/YR. Coal & Oil Nuclear 10 1 in 3800 1.38 in 3800 1.0008 in 3800 25 1 in 700 1.07 in 700 1.0001 in 700 45 1 in 200 1.02 in 200 1.00004 in 200 65 1 in 40 1.004 in 40 1.000008 in 40 All ages 1 in 100 1.01 in 100 1.00002 in 100 ~ and Segan~ **Risk of death per year from natural gas as fuel for electric power production is equivalent to the normal risk (column 2) ~C.L. Cower and L.A. Sagan, "Health Effects on Energy Produ~ticn end Conservation', Annual Review of Enero~, ~ PP. 581-600 (1516). PAGENO="0315" 311 circles that tic increasing use of fossil fuels can produce a world wide catastrophy. The J\t'J~ report states as follows: The ~ong-terrn effects of carbon dioxide production from combustion of fossil fuel have not been considered here. Each 1000 flWe coal plant discharges 7.5 to 10.5 million tons of CO2 per year to the atmosphere end the load from hundreds of fossil fuel plants nay be greater tin the atmosphere and the oceans can absorb. Predictions have been made of increased global atmospheric temperatures that might eventually result in drastic changes in climate with unanticipated health. effectS."23 An excellent review of the CO2 problem was provided by Chemical and Engineer- ing News in Oct.nier 1977 (See Figure 3 )~24 The data indicate that the CO2 concentration j~ definitely increasing but what the effects will be is still in question. fact that they are in question of course argues we should be cautious and pmmmdeflt. A rather toned consensus therefore exists that coal produces a generally greater environmental impact than nuciear power. `No mattel mOW you look at it, said John O'Leary, administrator of the Federal Energy /\,iininistratiOn and the ran who will direct coal conversions for President Cartel', a coal-fired power plant is more hazardous to health than a nuclear fired imnt."25 This consn;us also indicates that the uncertainties about the effects of coal are large ,mnd possibly we are in our present efforts at controlling the health effects of coal not attacking the most significant problems at all. ~R.L.Got:hy. "Health Effects Attributable to Coal and Nuclear Fuel Cycle Alternative'" * NtIREG0332 (1977). ~4W. Lepkowskl. "Carbon Dioxide: A Problem of Producing Usable Data", Chcm. En. News (il ober 17, 1977). The Washingt'll Post (ilonday, June 6, 1977). PAGENO="0316" PARTS OF ATMOSPHERIC CO2 PER MILLION PARTS OF AIR 330 320 310 1950 1960 1970 1980 1860 1900 1950 2000 YEAR Year Year Ch~nge in Atmospheric CO2 Leve]s with Time. Figure 3. PAGENO="0317" 313 ill. WhereAreWeGoinqinControll~gCoal_Pollutants The problems of air pollution from fossil fuels in general but coal in particular we have believed in the past to be problems of particulates end sulfur dioxide gas and sulfate sols. The problem of man made particulates dates back to the beginning of the industrial revolution. In 1307 the King of England issued a proclairnation against the use of coal. The proclaimation in part stating as follows: "--we have learned that, whereas previously the makers of kilns in the aforesaid city and village and their neighbourhood were in the habit of using brush-wood or charcoal for their kilns, they are now again, contrary to their usual practice, firing them with and constructing them of sea-coal, from which is emitted so powerful and unbearable a stench that, as it spreads throughout the neighbourhood, the air there is polluted over a wide area, to the con- siderable annoyance of the said prelates, magnates, citizens and others * dwelling there, and to the detriment of their bodily health." As industrialization grew so did the levels of pollution from fossil fuel use. By the 1900's this pollution became a major national problem in the industrialized nations of the world. Today the situation is both better and worse than it was in 1900. Beginning in the 1950's many industries switched from using coal to the clean-burning fossil fuels, oil and natural gas. In many places they were cheaper than coal, easier to handle and clean. Also the use of electrostatic precipitators, cyclone filters, bag houses and scrubbers were introduced.. On the other hand however the worldwhs continuing to industrialize end thus the world ride burden of pollutants is increasing and it is becoming obvious that the pollution does not have to be produced next door to produce a decay in the quality of the local environment. Glacial ice samples in Greenland have yielded lead particles presumably from auto emissions in North America. Lakes in linnesota and on the Canadian side of the border as well as in upstate New York are becoming increasingly acid due to airborne sulfates formed across the tJnited States. The Norwegians are concerned over industrial emissions from great liritian and Western Europe that have lowered the ph in Norwegian stre.:ns to the ~n~nt they will no longer permit the rainbow trout to breed that these wairs were once famous for. [he :resent hiqh costs of oil and gas and their likely fLst~re PAGENO="0318" 314 shortage in the U.S. ore also forcing us to turn away from these fuels and attempt to burn what are essentially dirty fuels if possible in a clean manner. Thus we face a future with probable increasing levels of air pollution and secondary water pollution. At the same time there are growing questions about exactly what pollutants are producing health affects and what the mechanisms of these effects are. Flue gas scrubbers have been developed that willof course reduce the level of SO2 below what it would be otherwise but these systems still are technically flawed. As Chemical and Engineering News reports in a recent 26 review: Whatever else may be said of utilities' switching to coal from oil and gas, there is still only moderate enthusiasm over the ways and means of controlling sulfur dioxide emissions from boilers and other combustors. Scrubbers currently are the most popular way, but by legislation and economics they seemingly have been all but forced into a service for which they may not be at all suited. The original scrubbing systems were based on calcium hydroxide! calcium carbonate slurries to absorb thm sulfur dioxide. Reaction in the slurries yields calcium sulfate precipitate. The precipitate is difficult to handle, causes maintenance problems because of the tendency to plug lines and fittings, and the sludge is difficult to dispose of. Some sodium-based processes have been developed in the laboratory that show poter~tial. Wagnesium oxide wet systems and some other dry systems also are under investigation, but the present technology is dominated by the calcium systems. 2~N~'wScrtbber5 Tackle SO2 [missions Problem', Chem. Engr. Ne, Nov. 6, pg. 24, (1978). PAGENO="0319" 315 `About 90~ of all the systenis in place are based on calcium absorb- ents. At least 10 vendors offer systems. As difficult as they may be to operate, the sldrry systems are generally regarded as the best proven technology." In a recent state of the art report in the utility industry magazine, Combustion, a report of actual scrubber performance shows that as flue gas flow rate increases the SO2 removal rate drops from 73 percent to 60 percent or lower.27 Also the particulate removal rate averages below 99 percent which means that per 1000 Ule plant more than 6,500 tons per year of particulates are escaping and in fact these may be the most dangerous particulates because they fall in the respirable size range, i.e., they will be drawn into the lungs and some will be retained there. Another question has risen about scrubbers. This concerns the disposal of the scrubber .yprod.uct sludge. As a recent article notes:28 `The removal of SO2 and particulates from flue gas converts an air pollutant to a solid waste. In particular, utilities are faced with the treatment and disposal of these wastes. It has bean predicted that 45 million metric tons/v~ar (50 million short tons/year) of fly ash and 24 million metric tons/year (26 million short tons/year) of Flue Gas Desulfurizatjor (FGD) sludge will be generated during 1980-1985. Land disposing this material represents tr.e least expensive and most popular means of removal "Although pumping raw sludge to ponds appears attractive, upon examination the material would utilize approximately 2.5 x l0~ 27K. Green, L. Conrad, J.R. Martin and MM. Kinqston, "Commitment to Air Quality Control", Combustion, 50, pp. 12-18 (October 1978). Goodwin and R. J. Gleason, `Options for Treating and Disposing of Scrubber Sludge", Coambust ion, 50, pp. 37-41. PAGENO="0320" 316 to 7.4 x ~ m3/year (2-6 x ~ Acre-foot/year) duripy 10801935. Furthermore, EPA's present position on land disposal, as stated by former EPA administrator Train, is, "EPA considers permanent land disposal of raw sludge to be environmentally unsound"." Scrubber sludge in addition tp its cumulative large volume has other problems. Thematerial does not settle out of the water used to entrain it to settling ponds. Thus, ponds that were supposed to be useful for the 30 to 40 year lives of power plants may only be useful for 25 percent or less of that life unless some very strong measures are taken. Such measures include vacuum filtration of the sludge. This would add a cost of $2.16 per metric ton of sludge or a cost of $97.2 million dollars per year to the costs of rate payers if 45 million metric tons of sludge are produced nationally per year. Finally there are problems with sludge disposal. The sludge contains portions of the trace elements that were present in the original coal. Some of these are now in a solubleor other transportable form that will remit them t.n enter the biosphere. Water percolating out of sludge disposal conds will carry this material into the ground water and then potentially into drinking water supplies, Because of this growing problem the Envi~onrcmntal Protection Agency is preparing regulations on sc~ubber sludge disposal. The following inforo'ation was reported in the August 1978 issue of, Electric Liqht and Power: 29 `The Environmental Protection Agency is planning to crack down on disposal of sludges generated by flue gas sulfur scrubbers. Right now there are no federal regulations governing sludge disposal and most utilities merelypond or landfill untreated sludge.' "The first move may come this surmner~ warns EPA chemical engineer, Julian Jones, with publication of federal regulations under the 29 EPA Readies Regulations on Scrubber Sludge Disposal", Electric_Li ~ Power, pp. 29-32 (August 1978). PAGENO="0321" 317. Resource Conservution & R[co~'ery Act of 1976. The law requires EFA to regulate cnission of hazaidoi substances not covered by ~zitcr pollution control legislation. `At this point,' says Jones, `flue gas desulfurization waste and fly ash as yet have not been declared hazardous, but they're both suspect." An evaluation from the Office of Solid Waste is due this fall." `[PA has a dozen research projects underway to measure the dangers posed by scrubber sludges and to evaluate control techniques. Tests at the Shawnee station of TVA have already shown that leachate from deposits of untreated scrubber sludges have concentrations of disolved solids that violate drinking water standards. `The agency feels that strict standards are needed because of the booming growth in coal-fired generating ca~acity projected for the next decade and the associated increase in sulfur scrubbers and sludge. Capacity with scrubbers will climb from the current 10,000 11W to 55,000 lW by the mid-80's. By then, 30 million tons of scrubber waste will be produced every year with more than 60 million tons of fly ash, according to Jones. `There is little potential for converting scrubber sludge into useful products, says the [PA engineer, so it has to be dumped somewhere. a few utilities are able to put it into empty mines and some coastal utilities are interested in ocean dumping, he adds, but most of the sludge will have to go into conventional landfills or ponds. The problem facing EPA, says Jones is to develop rules to make sure that sludge dumping is environmentally, acceptable." 48-721 0 - 79 - 21 PAGENO="0322" 318 TEe Electric Po~:cr Research Institute states as ollo~:s with respect to sluclije wastes: There is industry concern that power plant wastes may be classi- ffcdas hazardous under these tests; if the regulations and the tests become final early next year, the cost of disposing of any hazardous utility solid waste might reach $90 a ton. For an industry that churns out 60 million tons of waste a year, the implications are in the multibillion-dollar range. As Kurt Yeager, director of EPRI's Fossil Fuel~Power Plants Department, explains, if all utility wastes are declared hazardous, disposal costs under draft regulations could nearly equal utility fuel costs.'3° Whifë~there have bean no catastrophic nuclear power accidents there have been catastrophic incidents stemming from the burning of fossil fuels. In October 1948 a pall of pollution settled over Donora, Pennsylvania. Before it lifted twenty people were dead and 6000 were ill. Almost half of Donora's population, 43E, c:ere stricken. In London in 1952 a similar event occurred and in this case thousands died and many thousands were riade ill. How can we ignore such events. Other similar deadly events occurred again in London and also Oslo Norway. In each of these cases the culprit was a combination of combustion gases and Earticuistas; a~domhination we call smog or in scientific to-ms an aerosol. Those s:;all particles (0.2 rn or smaller) that bypass scrubEors or electrostatic precipitators and the volatile gases that are unaffected er ~ pass both types of devices are the problem. The problem does not yet have a solution because the technology that may he applicable is just beginning to he developed. 30'Disposal and Deyond," [Pill Journal, 3, pp. 36-41 (1973). PAGENO="0323" 319 Table 11 presents data on particle sizes and concentration of elements found in air samples taken in the vicinity ol the University of Missourj-Coltjnibja power plant.31 It should be noted that a number of elements classified as carcinoginic or toxic are present and the concentrations on particles of a respirable size are large. The health impacts of the deposition of particles of these sizes with these concentratio'ns of trace elements remains to be deternii nod. An element that epitomizes the question marks that exist with respect to heavy metal air pollution is arsenic. Arsenic is of course recognized by many to be toxic and at the same time there, is evidence it may be an essential trace element in man and other animals. However, ttm preponderance of clinical and epidemiologic studies indicates arsenic is a human carcinogen. Arsenic is a component of coal and recent measurements indicate that man made air pollution is the prirary source of arsenic in the air.32 * In the evaluations presented in Table 11 no attempt was made to determine the presence of organic materials that may have been present in the stack gas effluent. It is known that traces of the carcinogenic agent. benzo(a)pyrene are present as are dioxins (including PCB's). The health inpact of this class of co.:- pounds is yet to be determined. Mso present are small annunts of radioactive natei'~.~ including uranium, thorium and their radio decay products. Although the amounts of these radioactive materials are small the estimated amounts are from 50 purcant igher to several times higher for ~he reference coal plant compared to the reference nuclear plants.32 L. Reed, Seleniu:a Airborne Particle Emissions From Coal Fired Electric Generating Plants, A Masters Thesis, University of Missouri-Columbia (August 1978). 32'Pollution Main Source of Arsenic in the Air, Chem. Engr. News, pg. 19 (November 27, 1970). 33J.P. flcRride, R.E. Moore, J.P. Witherspoon and RE. Blanco, `Radiological Impact of Airborne [f fluents of Coal and Nuclear Plant~", Science, 202, 1045-1050 (December 1978). PAGENO="0324" TABLE 11. MULTIPLE £LEME~T CONTEIT AND COSCENTRATIOI PER CASCADE IMPACTOR STAGE S~~'.GE ~ Y A~ ~39 7~ p.~ TI 5~ 2,336 ppm Dr 49~ 13 ppm Mg~ i?~5j 6,319 pPm 13 [ 4,006 ~pm MnIC1 JLp_7Li~~9.L 453 ppm~ 2,411 ppm Ca As ~ T2TTh&O p:m 11 ppm Zn Sb ~ ~ ~ C~ ~_ ~- 2 7~ r~ 29 ~ pp- 33~L5~ ppr~ 3m 2,542 ppm 7i7r"~ 659 ~ 14mm1 85 ppm &~j~ 4,23/ ppm 523 ppm I 3415 ppm 1~Ia1L. 142,3i0 ppm 35L~_ 25 ppm 473r 933 pm [ 3.5 ~ 77 -~ ~- 3 ~_2' ~2~a - 2,~2_p;1 2,941 ppm 265 ppm 3m/i ppm 23 `; B ~~07 - ~: 27,539 ppm 2,242 ppm mO//S ppm ~i9n: ~ ~Ln3~ ~J~9 56 D9~ 1,111 ppm ~-2,PC3 ppm 1,930 ppm mlO.003 ppm 5,14/ ppm 1140_ppm Liss._ 3,9/1 ppm 1/0,530 ppm 1~_ 29 pm: ~.QLo~ T~i2 ppm ::- 6,900 ppm ~L3 ~ 7,222 ppm 21~ 736 ppm ~Lao 4/2 ppm L5~_ 5,1/2 ppm 5,000 ppm 24u~ 02,/sO ppm ~ 22,203 pmm 1 12r: 392rm 41 ppm 1,352 ppm L~o~ ~ ~0 ppm 1,396 ppm ~m 20.: p,- 34 p:- ~- i~: pm- ~2'~_____ [~ cv-, ~ 73 p~m 1 1 `-0.1 m~J ~1 3,573 P;m[~3O ppm T»=46 ppm 0.6~m L3~ -~-~-- 7t23 ppm `~430 ppm 1,060 ppm ml ,lmS ppm ~ m3,030 p~;n 3,24 ppm 235 ppm JLOS 3,333 ppm 203 ppm P~L~~_ ~~L32_ 2,500 ppm ~/ ,000 ppm ~ 3,000 ppm j ~3,300 pp ~5~_ 57 ppm L_o.s_ 90 ppm 370 n: ,3Z2~p 615 r: 7~5O~pm IC.5 -- -~ pp~ 17 ~ip,T I T~ -: s~ ,, l_ 26 mm ~ 1 -c `lliJ P?1 ~.O.2 mm 2i~ P31 j2,613 mm 311I P ml.Gum `\` 300 11 4.7 my mCOU PP 90~ 10.0 y~_ TO/ ppm 1iT 00 PP m3p j~3 bOO P 33~_ 43 - 757 mm 27 mm 913 - j Z - PAGENO="0325" 321 IV. Su;:wry The large scale cc:nbustion of fossil fuels for energy production has been common practice in the industrialized nations of the world for ouny years. The by-products of that combustion, soot, smog and ashus are accepted as a problem but at a nuisance level. We know that the by products of combustion are harmful but we accept them to a large degree because we are simply used to the probles; we believe we can tolerate the situation. The evidence presented bore however shows that this nuisance has on a number of occasions caused catastrophic single events but more importantly it exacts a continuing significant daily toll of death, disease and property damage and we have yet to develop the technological tools to deal effectively with the problem. Comparisons have been provided to show the relative isipacts of the use of coal and nuclear power. A well supported scientific concensus exists ttst shows coal under the best circumstances is only conpetitive with light inter nuclevr po~:er systems in health effects but in general including allo~:anco for tie catostrcphic nuclear plant accident, coal fired power stations produce sigsificartly greater negative health ir.ipacts than do nuclear plants of the same size. Jt is likely that technology to lessen the health iwpacts of coal and nuc~:ar power systews will he further developed in the future. But the technology required is significantly more advanced in the case of the nuclear system with the development of improved coal systems having to wait upon the identificatior of the most significant polluting agents and the c~eans of their control. PAGENO="0326" 322 STATEMENT ON "NUCLEAR POWER PLANT SAFETY AND RELIABILITY" TO THE SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION COMMITTEE ON SCIENCE AND TECHNOLOGY UNITED STATES HOUSE OF REPRESENTATIVES BY HILTON U. BRC~N, III CHAIRMAN, ENERGY COMMITTEE INSTITUTE OF ELECTRICAL AND ELECTRONICS ENGINEERS Institute of Electrical and Electronics Engineers 2029 K Street, N.W. Washington, D.C. 20006 202-785-0017 PAGENO="0327" 323 The Energy Committee of the Institute of Electrical and Electronics Engineers (IEEE) appreciates this opportunity to submit its views to the House Science and Technology Committee Subcommittee on Energy Research and Production on the issue of the safety and reliability of nuclear power plants. As you know, the IEEE has long been on record in support of nuclear power. At the present time about 30% of our nation's fuel consumption is for the purpose of producing electr.ical energy. By 1990 this proportion is expected tobe 37% and to increase to 50% by the year 2000. If the electrical energy produced by nuclear power plants in 1978 had been supplied by oil fired stations, an additional 470 million barrels of oil would have been required, increasing our 1978 oil imports by about 12%. This would have increased our imbalance in foreign trade by over $5 billion. By 1985 the additional imports which would be needed to replace nuclear power are expected to almost triple. The economic penalty without nuclear power is a vital concern to ct%r nation and must be evaluated along with the risks. On May 12, 1979, the IEEE Energy Committee convened a meeting of members with professional backgrounds in the design, manufacture, construction, and operation of nuclear facilities. The purpose of this group was to identify safety and reliability issues which should be addressed. The issues iden- tified and developed do not constitute a comprehensive view of the safety and reliability aspects of nuclear power, but they do summarize the views within their area of competence of a group of professional persons deeply involved in continuing the safe and reliable development of nuclear power. INSTITUTIONAL PROBLEMS The regulatory environment in which the United States nuclear power industry operates generates an adversary relationship between the regulated and the various regulatory agencies. These adversary relationships have occasionally inhibited the incorporation of safety designs recognized as having potential for improving public protection. Safety issues might be better served by a less adversarial role, possibly patterned after NASA. It does not automatically follow that technical cooperation to improve design compromises the integrity of the regulatory agency. The relationship between the regulatory bodies and the various components of the nuclear power industry is an economic, health, safety and reliability- issue which should be addressed. We strongly recommend the identification of an office within the Nuclear Regulatory Commission in which issues concering the safe and reliable operation of Nuclear Power plants can be addressed in an atmosphere of cooperation between the government and industry, rather than under the adversarial relationship which currently exists. THE REGULATOR' S ROLE IN OPERATIONAL MANAGEMENT The relationship between the owner/operator of a nuclear power plant and the regulatory agencies is an issue which needs clarification. The PAGENO="0328" 324 owner/operator's responsibility for, and authority to carry out the normal operations, mAintenance., testing, staffing, training, and operational plan- ning should not be abridged. The responsibility of the regulatory agencies in overseeing the operation and insuring compliance with the appropriate safety standards must be more clearly defined. Overlapping and conflicting regulatory review should be eliminated, as it leads to confused responsibility and inefficient opera~tion, as well as unnecessarily diverting resources away from the most effective application of the "defense in depth" philosophy on which nuclear power plant safety is based. We urge that the current reg- ulatory structure be reviewed in an effort to tailor its requirements to the most cost effective fulfillment of our nuclear safety needs. TEE REGULATOR' S ROLE IN INCIDENT MkMAGEMENT For this purpose, an incident is defined as a situation in which plant safety limits have been exceeded, or where the plant operator judges that the limits are likely to be exceeded, or where the maximum permissible re- lease of radioactivity has been exceeded. Incident management must address four interrelated requirements: (1) Data gathering; (2) Decision making (3) Information dissemination; (4) Assuring implementation of decision. Data Gathering requires that proper instrumentation exists and that it remains functioning during an incident to provide adequate information for decision making. The actions required to assure adequate data gathering include identification of the necessary data, procuring or developing the equipment required to collect this data and qualifying such equipment for accident environments and post-incident conditions. We strongly urge in- creased R&D funding by both the government and the private sector toward developing more reliable instrumentation to assure the proper evaluation of necessary data during the earliest stages of an incident. Decision Making under emergency conditions requires that proper re- sponsibility and authority for decisions be clearly recognized. This in turn requires that affected bodies (utility, NRC, public, etc.) are coordinated through good planning prior to the incident. Each of the involved bodies (utilities, NRC, state and local officials, public information officers, etc.) must understand the decision areas for which they are responsible, and the manner in which they are to coordinate their action with the other involved bodies. We strongly recommend appropriate planning with the full participation of each of the responsible groups, with responsibility for determining the adequacy of this planning fully defined. Information Dissemination requires that a central and adequate spokes- man be utilized. The public as well as personnel involved in the incident must be kept informed. Different levels of information are required for different users, however, all information released must be as accurate and consistent as possible. PAGENO="0329" 325 In incident situations the role of the NRC as direct technical advisor to state officials should be clarified. An approved emergency plan should serve as the basis for -action by state and local officials. The NRC should advise in the continuation or modification of the plan. - The authority and responsibility of the NRC in the review and approval of strategy proposed by plant management during the course of the incident and until the plant is restored to normal operation or is in a cold shut- down condition is a major issue. Assuring ~plementation of Decisions is vital to incident management. Those groups or individuals making decisions must have the authority to assure that they are implemented. Since civil authorities have the power to implement evacuation, for instance, they must be included in the planned decision making process. HUMAN FACTORS The human is the vital link in the design, maintenance, and safe op- eration of a nuclear plant. To reduce the potential for incidents caused or worsened by human factors the adequacy of information systems available to the operator, together with the adequacy of operational procedures should be the subject of continuous review. The degree of plant automation needs to be reviewed to determine the best balance between automatic control and human decision-making. Attention should be focused on the adequacy of initial operator training and certification. Equipment in a power plant is continually modified, and operational procedures are continuously updated, and there is therefore a need for continuing operator retraining and requalification. DESIGN CRITERIA AND DESIGN BASIS FOR SAFETY SYSTEMS The major components of nuclear plants are themselves complex systems. The interactions between these components is a factor in the performance of safety systems. The adequacy and appropriateness of the design criteria and design basis for nuclear power plant safety systems, taking account of these interactions, is an issue which should be reexamined. Many of the safety features of a nuclear power plant are designed to deal with the maximum credible accident. Accidents of much greater prob- ability hut with a much lower potential for endangering the public are not adequately dealt with, and could result in releases of radioactivity. We recommend Systems Engineering studies to identify scenarios which might present a hazzard to the public, including the combined effects of operator error and mechanical failure, which may be a better criteria and basis for safety design. The scenarios developed should identify the need for addi- tional accurate, unambiguous and reliable instrumentation. They may also identify requirements for the more automatic processing and presentation of PAGENO="0330" 326 timely information to guide operator actions. A part of the issue of-the design basis arid criteria for safety systmas is also the qualification of safety related equipment. PUBLIC INFORNATION Misinformation or the lack of adequate information on the part of the public can lead to actions on the part of the regulatory agencies which may be counterproductive in terms of nuclear plant reliability and safety. The public needs help in understanding that all activity involves risks, and that the relative risks associated with nuclear power are acceptably low. The risks associated with restricted future energy supplies need to be made more clear. The facts associated with nuclear power need to be pointed out so as to put nuclear power radiation effects in the proper perspective. The matter of public education is a nuclear power safety issue because a poorly informed public may force energy policy decisions which will be very detrimental to the environment, and to our way of life. Two major points ~nerged from the panel's deliberations. Unambiguous authority and responsibility are primary considerations in the safe develop- ment and operation of nuclear power, and more expeditious ways of addressing safety issues than the present adversarial approach might result in still safer systems at lower cost, in both time-and money. - The members of the panel have considerable depth in the areas which are discussed above, and we would be pleased with an opportunity to expand upon any of these issues if that should prove useful to you. I hope this material will prove useful in the ~ work. PAGENO="0331" 327 NATIONPL, SOCIETY OF PHOFESSIONA~ ENOINE[HS `Putting It All Together For The Engineer" Add~s, R,ply T~: LEGISLATIVE AND GOVERNMENT AFFAIRS IINSPEIP OFFICE OF THE CHAIRMAN r, ~ May 22, 1979 Honorable Mike McCormack, Chairman Subcommittee on Energy Research and Production Committee on Science and Technology B374 Rayburn House Office Building Washington, D. C. 20515 Dear Chairman HcCormack: On behalf of the nearly 80,000 individual members of the National Society of Professional Engineers, I am pleased to present this testimony on the major issues of nuclear energy. NSPE is very interested in the continu- ation of a safe and dependable nuclear power system. It may interest you to know that NSPE, in conjunction with approx- imately ten other national technical engineering societies, has formed a committee to review the work of and cooperate with the President's Commission on the Three Mile Island Accident. Engineers are in a unique position to lend valuable insight into the issues to be raised by this investigation. The new engineering committee would, if you desire, be pleased to meet with you or the Committee. NSPE believes the. questions current surrounding the nuclear indus- try can be solved if the Federal government presents an organized outline of steps to be taken to safely speed up licensing and permanently solves the waste disposal problems. Our technology is capable of answering the questions pre- sented by nuclear energy. Thank you for this opportunity to present our views. We would appre- ciate this statement being made a part of the official hearing record. Very truly yours, 0~ ~ Otto A. Tennant, P.E. Chairman Enclosure 2029 K STREET N.W. . WASHINGTON, D.C. 20006 . 202/331-7020 PAGENO="0332" 328 STATEMENT OF THE NATIONAL SOCIETY OF PROFESSIONAL ENGINEERS ON THE MAJOR ISSUES OF NUCLEAR ENERGY TOTER SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION COMMITTEE ON SCIENCE AND TECHNOLOGY U.S. HOUSE OF REPRESENTATIVES May 22, 1979 The National Society of Professional Engineers welcomes this opportunity to comment on the major issues regarding nuclear energy. NSPE is a nonprofit organ- ization representing nearly 80,000 individual members. from virtually every discipline of the engineering profession. Many of these members are intimately involved with the technical aspects of nuclear energy generation and have been involved since the advent of nuclear energy several decades ago. They are, therefore, uniquely quali- fied to provide the technical expertise necessary for the safe and effective produc- tion of nuclear energy. The recent Three Mile Island accident has raised suspicions throughout the country about the future of nuclear energy as a major energy source. NSPE believes that an effort must be made to reassure the public of the safety of nuclear power generation. In conjunction with other technical engineering societies, NSPE has formed a committee to provide technical assistance and review the findings of the President's Three Mile Island Accident Commission. We hope that the Commission will fairly evaluate nuclear technology and put forth workable solutions which can be easily adapted by the Federal government and the nuclear industry. NSPE is concerned about the present haphazard system of licensing and siting permits which is causing delays in nuclear power plant construction. We urge Congress to carefully review these procedures and eliminate those policies which do not enhance the safety and reliability of power plants but merely add unnecessary time and costs to the process. NSPE emphasizes that extensive technology has already been developed to safe- ly and reliably treat nuclear wastes. All that remains is for the Federal government to make the political decision to proceed expeditiously with the demonstration and implementation of the existing technology of nuclear waste management. The Federal government's responsibility is clear since the bulk of existing wastes and by-products is from Federal military/defense programs. Indeed, without considering commercial reactor fuel, many millions of gallons of liquid fuel and solidified military nuclear waste already exists. The Federal government should immediately select one or more of the existing developed processes and proceed with the disposal of its military/defense PAGENO="0333" 329 wastes. This could be accomplished by a pilot plant scale demonstration of the solidification and disposal of high-level power reactor wastes. Economically, the cost of establishing and operating an effective radio- active waste management system is substantial in terms of today's dollars, but that cost is small in terms of its enormous and essential contribution to our Nation's goals of energy independence. NSPE believes it essential that America lessen its dependence upon foreign energy sources, specifically oil and natural gas. This can be accomplished by devel- oping and utilizing technologies which better utilize our domestic energy resources. For the short range, we must make better use of more abundant resources, such as nuclear energy, by building more nuclear power plants. To do this we must accelerate the licensing of new facilities and establish a Federal policy for the treatment and disposal of nuclear waste. NSPE wishes to assure the Subcommittee of our continued interest in the sub- ject and of our willingness to be of service to the Subcommittee in whatever way possible. We appreciate this opportunity to express our views. PAGENO="0334" PAGENO="0335" NUCLEAR POWERPLANT SAFETY SYSTEMS WEDNESDAY, MAY 23, 1979 HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION, COMMITTEE ON SCIENCE AND TECHNOLOGY, Washington, D.C. The subcommittee met, pursuant to notice at 9:30 a.m., in room 2318, Rayburn House Office Building, Hon. Mike McCormack (chairman of the subcommittee) presiding. Mr. MCCORMACK. The meeting will come to order, please. Good morning, ladies and gentlemen. Today the Subcommittee on Energy Research and Production continues its hearings on the topic of nuclear powerplant safety. This is the second of a series of three hearings. Yesterday we discussed the present philosophy and technology of nuclear powerplant safety systems. During that hearing we heard from representatives of a reactor manufacturer; a nuclear power- plant construction company; from the Electric Power Research In- stitute, which represents the private utilities; from the Environ- mental Coalition on Nuclear Power; from the Nuclear Regulatory Commission; and from Dr. Harold Lewis of the University of Cali- fornia, who among other things was chairman of the panel which reviewed the Rasmussen report. This hearing was informative and provided sound guidance to the subcommittee on various approaches to nuclear energy. The witnesses clearly agreed that a significant amount of addi- tional research and development on nuclear powerplant safety is needed, although the nature and priority of specific tasks remains a matter of opinion. This morning, the theme of our hearing is the Three Mile Island accident, what happened, what are the technological implications. We will address industry, utility, regulatory, and State government perceptions of the accident, with special emphasis on system fail- ures and the extent to which human error played a role in the accident. Our witnesses are Mr. John MacMillan, vice president, Nuclear Power Research Division, Babcock and Wilcox Co., the manufactur- er, the vendor of the nuclear powerplant at Three Mile Island; Mr. Herman Dieckamp, president, General Public Utilities Corp., the operator of the utility; Mr. Harold Denton, Director of the Office of Nuclear Regulation, who assumed management and control for the Federal Government at the Three Mile Island site; the Honorable William W. Scranton III, Lieutenant Governor of the Common- wealth of Pennsylvania; and Mr. John Conway, President of the American Nuclear Energy Council. (331) PAGENO="0336" 332 The subcommittee is, of course, pleased to have these distin- guished witnesses with us today and we are looking forward to their testimony. It is important to understand that this hearing is not a witch hunt. We are not looking for scapegoats but rather for truth and understanding. Our purpose is not to sensationalize or to generate fear or hysteria. The Three Mile Island accident was a serious accident. It raises important questions related to equipment reliability, plant design, training and qualification of operators, and our responsibility on this committee for initiating legislative action to be sure that we benefit from the lessons learned and assure that all existing and future nuclear plants will be even safer than they already are, and that the chance of any similar accident in the future is reduced to an absolute minimum. Before hearing from the scheduled witnesses, we will have a demonstration of a model of a reactor system. This is brought to us by the University of Florida, Professor Schoessow, who is a friend of the chairman of the full committee, the Honorable Don Fuqua. I would like to ask Congressman Fuqua if he would introduce Professor Schoessow and the presentation at this time. This will provide background information before we start our testimony. Mr. FUQUA. Thank you, Mr. Chairman. Long before we ever dreamed that Three Mile Island would happen, I had an opportunity to visit the nuclear engineering school at the University of Florida, where Professor Schoessow demonstrated this model. I commented at that time that I thought it was very illustrative of what really happens inside of a nuclear reactor. For the lay person it provides a better understanding of the operation and I hoped that we would have an opportunity for him to bring it up to Washington and we would have a chance to look at it. It is here now. I think it does a very excellent job of demonstrat- ing, particularly to the lay person, just how it operates. Many had a chance to see it yesterday, and I am very happy at this time to present Dr. Glen Schoessow with his model and his student assis- tants. Mr. MCCORMACK. Doctor, would you like us to come over there? Would you like to address us first? STATEMENT OF GLEN J. SCHOESSOW, PROFESSOR OF NUCLE- AR ENGINEERING, UNIVERSITY OF FLORIDA, ACCOMPANIED BY DR. JOHN G. STAMPELOS ~ FRED DAMEROW Dr. SCHOESSOW. I would prefer, sir, that the committee come down here to get a good look. Mr. Chairman, ladies and gentlemen, we are very glad to be here. We come with our model and our hardware to put on a demonstration which we hope will be helpful. We have a time frame of 15 minutes, which is not very much, but we are going to stay inside of it. This means that we will not deal in lengthy or detailed explana- tions. So it is likely that especially for the experts in the crowd- and there are many, I am sure-we might not cover the system in the detail they would like. You have to bear with us on that. PAGENO="0337" 333 In making this working model, which we call a see-through reactor simulator, because you can see through the system and see what happens, we wanted first of all to be able to show our stu- dents and others what the core of a reactor would look like if we had windows in the big power reactor, so we could look in the core when it is operating at full power. In this demonstration, as it is set up now, the reactor is at full power. The core, which we refer to here, is seven of these immer- sion heaters, a kilowatt each, powered by that extension cord. There is no uranium. We tried to make this core representative of a part of a regular fuel assembly, which we brought along so you could see it. We just took that piece on the side-we took a little piece out of that and put it in here, and we power it with electric- ity, and we make it so we can see through it. Then we have to have the other systems. We have a system which starts with the core, you can see through it. The center one has thermocouple connections on it which are used to measure temperature. We have many other temperature devices which nor- mally go to a data panel, which we didn't bring. We have just taken the hottest spot on the center fuel tube and put it on this recorder so you can see what happens. So having this much, then we need a cooling system. The water comes in, the water gets .hot, it goes back here to a heat exchanger and is cooled because we are putting 7 kilowatts in here, and that is quite a lot of heat. Then the water is recirculated by some pumps back there. Then it comes back though a control panel system which has built into it the steady state flow line, with which we are now operating. We can operate, hopefully if nothing happens, for hours this way, while we are studying the phenomenon going on. The unique feature is that we are using distilled water, going past fuel assemblies, that represent the real fuel assembly, and we can see what is happening. This is not a computer type simulator. You can see what hap- pens. The water does its own thing that nature demands it do, when it tries to cool the fuel assemblies. So the readout we get is what happens, not what we might have programmed into a calcula- tor or an electronic type computer. That is one of the main differ- ences. In addition to the steady flow line, we have what are called the emergency core cooling systems in a large nuclear power plant. In addition to the main circulating pumps, and the main cooling system, which is this system here [referring to the picture-on the- easel] that takes water, puts it into the core, to a steam generator, makes steam, steam goes to the turbine, then to the electric gener- ator, the water is recirculated by this pump, and this circuit here just delivers hot water to a steam generator to make steam to run the turbine. We don't have a turbine, so we just cool the water with our heat exchanger. In the boiling water reactor [referring to picture on easel] there is no steam generator. The steam is made right in the core, goes off the top of the reactor, and goes to the turbine and drives the generator, and then it is recirculated back to the reactor. 48-721 0 - 79 -22 PAGENO="0338" 334 Mr. MCCORMACK. Would it be proper to point out that the outer sleeve there is just for your demonstration, to keep the system cool? Dr. SCHOESSOW. Yes, sir, it would. If we remove this containment for a moment-seeing we are not going to have any accident-we have two parts to this reactor core, this outside piece is a piece of plastic, and the inside piece is pyrex glass. The inside piece con- tains the hot fuel tubes. If we let the core dry out, go all the way down, no water in, those fuel tubes get hot, so we have to be able to cool this inside glass or it would break on us. So the outside jacket of water here is just a cooling device for the inside piece. Mr. MCCORMACK. It is only for that demonstration that you have the outside core. That has nothing to do with the reactor or any portrayal of the reactor? Dr. ScHoEssow. That is correct. Now, we should discuss the emergency core cooling systems and controls. In addition to having the manual controls, we have a control panel which is just a timing unit. In the large powerplants you have three sets of emergency cooling systems. You have an accumulator, which is a big tank full of water-two of them-inside the containment, half full of high pressure nitro- gen, half full of water, just sitting on the line that is putting the coolant normally through the reactor. So if you have a small pipe break in the primary loop, we call it, the reactor loop, you would have accumulators to put water in because the problem is we want to keep the core covered. If we save the fuel tube we save basically everything. The second system is the high pressure injection system, which is a series of pumps that takes the water from outside and puts it into the reactor to cool the reactor. The third system is a low-pressure injection system. So there are backup systems, three of them, to provide cooling for the reactor if something happens, like a small pipe breaks, or a safety valve sticks open, or a crack in a large pipe or break in pipe from pressurizer to reactor or multiple failure of steam generator tubes or-some similar sort of thing that is not supposed to happen, which lets water out of the core. We then have three systems, and each of them are in duplicate. They are redundant systems, so actually we have six systems. For a very small pipe break, any one of them would do the job; that is, keep the core covered with water. For a very large pipe break, all six of them would probably be needed. Now, why do we say so much about the fuel tube and the fuel assembly? This is a one-third size fuel assembly; that is a zirconium tube, zircaloy tube. It looks like this sample tube when it is new, nice and shiny and bright. It is very good material, which we will demonstrate to you. It is oxidized here [in the fuel assembly] a little, like you blue a gun barrel, so it doesn't show scratches, and also protects it a little bit and makes it prettier. There is no uranium in this fuel assembly. If there was, it would be inside of these tubes, hermetically sealed by welding, with some helium inside to prevent oxidation. PAGENO="0339" 335 If we can keep this fuel tube, we call it-it is called fuel rod, fuel pins, fuel tubes-it is a tube, fuel tube. If at any time during the malfunction of any system in the reactors we can keep the fuel tube temperature down, then everything has to stay inside the fuel tube, the fission products, the fission gases, and they cannot even get out into the containment, much less ever get to the public. So our emphasis is on protecting this fuel tube, keeping its temperature down. That is what we are going to try to show you this morning. In our first look here now, we have the reactor running just at normal full power for a ptessurized water reactor (PWR), which means very little boiling in the core, the picture on the left. Mr. Damerow will change the amount of water that is coming up to the center two-inch tube, cut it by a factor of two. Now, then, the fuel rods still have the same heat. So we form a lot of steam right in the core. That is the boiling water reactor (BWR). Now you have a boiling water reactor. The steam is being formed in the core, going up to the top, and then would go to the turbine. Now you are looking inside of a big boiling water reactor. Now we can cut that back to normal PWR mode. Now the fuel temperature here for the normal run, for the boiling water reactor, you see this didn't change, go up or down, it is sitting right at the normal fuel tube temperature, same as for the BWR, which we are operating between 6000 and 700° F. It is not so hot that you can see it glow. It is black to the eye, basically. Now, Mr. Damerow will set the system so that we are going to break a small pipe. This is the core drain on the bottom. When he sets the system, and flips this loss of coolant accident switch this valve will open and the water will drain out of the core and the fuel tubes; it will be on its way to becoming uncovered. That would be very bad; but the emergency core cooling systems here will come on, hopefully, since it has had a long ride from Gainsville, a lot of bumps. Hopefully it will come on just like it should, and the core will not uncover. You will see this fuel temperature will not change. Now, we need a volunteer. Chairman McCormack, just flip that switch, sir, and you will be a little more famous than you are, if that is possible. Now you can see the core, the water is coming down in the core. The reactor has scrammed. When a reactor scrams from being up to full power, the remaining power for some period of time is 10 percent of what it was running at. So you must take out that heat or the fuel will just keep on heating up the fuel tube. Now the water level is dropping, and we are getting just a little bit worried that maybe the system won't come on and stop that water level drop before it gets down below the top of the fuel. This was a small pipe break. A small pipe break could be many different things. I could give you a list of them, but let's just say it is a small pipe break, maybe that big, [indicating about an 6-inch diameter circle with hands] which would be a pretty serious thing if you didn't have something to put water in. The high pressure PAGENO="0340" 336 injection system came on automatically; the water level in the core is rising, the fuel tubes were not uncovered. We are back in a very safe condition. We did nothing manually because this would happen by itself automatically in a reactor plant. You can see the fuel temperature did not rise. It actually went down a little bit because the high pressure injection system takes colder water from outside and puts it in rather than the hot water that has been circulating. Now, Mr. Damerow will reset it back to just where it was before this loss of coolant accident. We will run through it once more. This time we need another volunteer to flip the switch. Where is Mr. Denton? Mr. Denton, you know all about accidents. You know how to cure them, how to fix them. Mr. DENTON. I really don't want to start one. [Laughter.] Dr. SCHOESSOW. When I heard the name Mr. Denton, all I could think of, sir, was the Dentons my three children wore in the crib. So I would never forget Mr. Denton. Now, if you will flip this LOCA switch down, we will repeat the last-- Mr. DENTON. I am really not trained or qualified. Dr. ScHoEssow. We will take a chance on you, sir. Now, he has broken the pipe. He is letting the water drain out. Don't be confused by this outside jacket cooling water. It is the water inside the inside tube around the fuel tubes which you can see is going down. Now Mr. Damerow is going to change the controls, manually, he is going to interrupt the automatic systems and the core is going to uncover. This means the water is going down below the top of the fuel, it is boiling dry, as you can see. This we call an uncovered core. Now the fuel has no water to cool it. It has no choice, except to rise in temperature. You can see on this chart now the very rapid rise in temperature of that center fuel tube. It will keep going on up until Mr. Damerow reactivates the high pressure injection system to reflood the core and reduce the fuel tube temperature. The system was not on automatic emergency core system. Mr. Damerow interfered with that. So the core was uncovered and the fuel tube temperature rose rapidly. It has no choice. It will go up to 2,0000 F, after a scram reactor with all the water out. If you leave the core in this uncovered condition for any length of time, like an hour, then it would go up to 3,000° F. Over an hour it will go up to maybe 3,500°. Very big numbers. So we must not let that happen. That is the reason we have the emergency core cooling systems working automatically with redun- dancy and backup, so it will behave like you saw the first demon- stration. We will demonstrate the effects of high temperature on the fuel tube. We will leave this, and go over to the furnace. We have about 3 minutes left. We will show you what you would see if you could look in a reactor, in which the water is drained out, after it has been operating at full power and scrammed. PAGENO="0341" 337 The. core would be up to to 2,0000 F. There is no question about that number. Any nuclear engineer worth his salt and a lot of others can make that number. It is just the average temperature of all the fuel in the core and the fuel tubes. This is a 2,000° core. [Opens furnace door.] That is what you would see. We didn't let our core go up that high because we didn't want to ruin our tubes, our heaters, for each demonstration. But this is what you would see, the 2,000 for a short period after a scram from full power. Now, what is the significance of this as far as this tube is concerned, in which we are trying to keep not only the fuel but all the fission gases? This fuel tube is zirconium, a zircaloy, a very wonderful materi- al. We have some specimens in here. We will take one out of the furnace, that was new and shiny just like this before we put it in there, about 3 minutes ago. We will take one of these out. We will drop it in the water. In the furnace it is 2,000° probably 1,900° F. by the time I got it to the water. We will take it out of the water, cool it off a little bit more, to make sure we can get out hands on it. Now, what do we have? The center section of this didn't cool as fast as the ends. The center section doesn't look a lot different than this, [pointing to the fuel assembly] but the end sections here which cool the fastest has some white on it. This white, is from the zirconium reacting with the oxygen from the water, making the zirconium dioxide. That frees the hydrogen from the water molecule. The hydrogen gas then is free, and being the very lightest gas we know of, will go to the highest elevation in *the reactor, which will be the top part. Now, this is for one quench. It still looks pretty good. But let me show you here-I need a volunteer, someone that is good with a hammer, not me. Here is a piece of tube. She will hammer on the end of that. That is a new piece of tube. Hit it. More. More. It is very ductile. It can bend, flatten, take a lot of punishment. It is still in one piece, which shows you that it is very good material. Now, we will take this piece here, that has been in the furnace once. John, will you come up and give this a whack. You hit this with a hammer to see if it will behave the same. You see, it does not, it is brittle. It might look the same, but it has been through phase changes, between 1,200° and 1,800° F, and now it is brittle. It is still a pretty good tube sitting there, but it is brittle so you cannot use it again. You have to take it out of the reactor and replace it. That is once it has been up to 2,000°. If the core is uncovered for an hour or more, the temperature of the fuel tube will go up to 3,000°. So we will take one out of the furnace that has been up to 2,000° once, and this is the second time for it, which would be about the equivalent of going up to 3,000 once. We will take it out of here. It is already a little bit damaged. We will drop it in the water, quench it, cool it off a little bit. Now It is all white. A lot of zirconium dioxide powder. It is like an egg shell. If we take this and hammer on it-there-that is what I have left, only powder. So if the fuel tube is allowed to go up to high temperatures, like 2,000°, which it will, if the emergency PAGENO="0342" 338 cooling systems are not allowed to do their thing, we would have problems. If it goes up higher, because the core stays uncovered a longer time, we have more serious problems. Ladies and gentlemen, in closing I would just say this. Emergen- cy core cooling systems, properly built, always on a ready status, with the proper redundancy, and allowed to operate through the cycle, should keep that fuel temperature down to near normal for this accident or any accident like this that could happen. I thank you very much, ladies and gentlemen, for your kind attention. It has been a pleasure to be here. Mr. MCCORMACK. Thank you, Professor. I want to thank you for bringing your demonstration here and sharing it with us. I am sure it has helped us understand better. The Professor has also provided us with some samples of quenched zirconium for the members to examine. Before we proceed further, without objection, I would like to insert into the record a statement provided by Dr. Schoessow to Congressman Fuqua, concerning improvement of engineering safe- guard facilities in nuclear power plants. [Material referred to follows:] PAGENO="0343" 339 COMMFflE~ON-SClENCN~iF~t~GY ~ ~ U.S. HOUSE OF REPRESENTATIVES SUITE23ZI RAYBURN HOUSEOFFJCEBUILOING WASHINGTON DC 20515 - May 3, 1979 Professor G. J. Schoessow 300 N.W. 34th Terrace Gainesville, Florida 32601 Dear Professor Schoessow: Thank you for your telegram of April 3, 1979 concerning the accident at the Three Mile Island Reactor No. 2. Subsequent to your telephone conversation with Mr. Williams of the Committee staff, an effort was made to obtain permission for you to conduct a separate investigation of the accident by contacting the Nuclear Regulatory Commission and Metropolitan Edison. Both organiza- tions appreciate your interest and support, but have requested that you wait until the current investigations have been completed. At that time, I will again attempt to arrange for you to visit Reactor No. 2 so that you can obtain the information necessary to simulate the accident in the "see- through' model at the University. As you know, the cause of the accident and particularly the management of the events which followed, have become.somewhat controversial. There is obviously much work to be done if nuclear energy is to make a significant contribution to our energy future. The Committee will be conducting hear- ings on reactor safety at the end of May and it would be useful to us if you would submit a paper on the subjects of systems redundancy, control systems, or on any subject you feel would be pertinent. In particular, it would be most helpful if you could submit suggestions for improving reactor design. Whatever information you choose to send will be inserted as part of the official hearing records. The reactor safety hearings will begin May 22 and continue through May 24. I would be pleased if you could arrange the time to attend these hearings as I am sure you would find them most interesting. Again, thank you for contacting me and I look forward to hearing from you regarding your submissions for the hearing records. Sincerely, / DON FUQUA Chai man DF:Wgm PAGENO="0344" Date of ~tr: ~~/3 ~, Date recd. in Conin.~3 From: ~ ~~L~~4-w- ~ / THIS IS FROM THE PROFESSOR AT GAINESViLLE FLCRIDA WITH THE SEE THROUGH REACTOR MODEL, ~E ARE TRYING TO MAKE OUR SEE THROUGH MODEL MALFUNCTiON TO REPRESENT THE THREE MILE PLANT. WOULD BE VERY HELMFUL iF YOU WOULD ARRANGE WITH NRC SO I COULD HAVE ACCESS TO THE BRIEFINGSAT THE SITE AND IN THE CONTROL ROOF TO OBTAIN FIRST HAND DETAILS TO ~40RK~WITH, PLEASE ADVISE IF YOU WILL ARRANGE FOR THIS ACCESS TO BRIEFINGS AND CONTROL ROOM, I WAS A SLNICR REACTOR OPERATOR MOW MANY YEARS SO I CC UNDERSTAND THE PROBLEMS. I WILL PAY MY EXPENSES AND BE RESPONSIBLE FOR MY SAFETY AND WILL - HOLD ALL OTHERS MARMLESS, RESPECTFULLY, G J SCHOESSOW 300 NW 3A TERRACE GAINESVILLE FL 32b01 (900)372.3995 U9:17 EST (~~q)_9?L-i~1aL. MGMCOMP MOM iVti& ~ ,~. ~)ç,~- 340 Reply due by ~- If it is not possible to prepare a final reply by the date shown above, an interim reply will be prepared by the above date j~dicatingWhen a final reply may be expected. Please return copy of incoming letter with proposed ML Ill 04-03 0917A ESYPOMA response. 1 DLY BY MGM A~ J ~979 co:z~~:1 S~J'!C --~:~~ `~CGY 4~.) ~ ~t.rJ A0i~ PAGENO="0345" 341 UNIVERSITY OF FLORIDA May 17, 1979 Honorable Don Fuqua Committee on Sciences ahd Technology U.S. House of Representatives Rayburn House Office Building Washington, D. C. 20575 Dear Mr. Fuqua: In response to your letter of May 3, 1979, I am pleased to offer my recommendations as to the direction we should take to improve the engi- neered safeguards facilities for nuclear power plants. When it comes to "safety" of nuclear power plants, the number one requirement is safety of the population, and the number two requirement is safety of the plant itself. Hot only is this is required by present regulations, but is the practice that has been followed by the nuclear industry from its beginnings. Title 10, Part 50 of the Code of Federal Regulations specifies conditions the engineered safeguards facilities must meet during the postulated maximum credible accident, that is the "large pipe break" in the primary system. The containment vessel must contain all radioactivity to protect the population and the Emergency Core Cooling System (ECCS) must be capable of keeping the maximum fuel-tube temperature below 2200"F. The ECCS is designed to meet this specification. Other limits are, oxidation of fuel-tube not to exceed 17% of thickness and hydrogen production nut to exceed 1% of the amount that oxidation of all the fuel-tube could produce. The adequacy of the containment vessel to contain the radioactivity even with some controversial interference by the operators has been demonstrated by the recent Three Mile Island (TMI) accident. The hard fact is that any accident that leads to a partially uncovered core shortly after shutdown from full power operation may cause severe oxidation and mechanical damage to the fuel-tubes releasing fission products into the primary coolant. Fission products in the primary loop can escape into the containment building as at TMI resulting in a costly clean-up and repair situation. We must analyze every existing nuclear power plant to determine its vulnerability to such costly clean-up and repair that can arise from credible scenarios less than the "large pipe break," similar to the TMI COLLEGE OF ENGINEERING FLORIDA'S CENTER FOR ENGINEERING EDUCATION AND RESEARCH PAGENO="0346" 342 situation. I believe this can be done with an acceptable cost increase in any new plants that soy be found to have inadequate protection and at higher costs in any existing plants requiring retro-fitting. Additional briefing and training of operators and limiting their options during emergencies is also in order. A remete controlled vent line from the top of the reactor vessel, a direct reactor core water level indicator, azong other minor changes, should also be considered. The ongoing loss- of-flow-test (LOFT) program should be of considerable value in providing data on which to base decisions. I have been in the nuclear business from its beginnings. I am not committed pro or con to nuclear energy; in my view nuclear energy always has had to, and must continue to, prove that it can be utilized safely and it must, of course, be economical. With the above accomplished so that after any failure, recovery efforts and costs will be minimized, the reactor owners and the public will have reason for renewed confidence in nuclear energy as a part of our national energy selfsufficiency strategy. I appreciate this opportunity and hope the above will be helpful. If I can be of assistance in any way, please feel free to call on me. Res ctfully mitted, I peorof Nuclear Mr. MCCORMACK. At this time I should like to invite the ranking minority member of the committee, John Wydler, to make an opening statement. STATEMENT OF HON. JOHN W. WYDLER, A U.S. REPRESENTA- TIVE FROM THE STATE OF NEW YORK Mr. WYDLER. Mr. Chairman, a lot has been written and said about the March 28 nuclear accident at Three Mile Island. Maybe people are getting tired of this subject because they read about it on such a constant basis. You wonder sometimes what new light is being shed on the whole situation. Yet, Mr. Chairman, little or no attention has been paid to what we can learn from such an accident. I believe that careful analysis of the details of the Three Mile Island accident, in terms of systems failures and human errors, can be a constructive basis for a significant enhancement of nuclear safety systems and procedures. I intend to make every effort to see that this incident becomes for nuclear power what the Apollo. spacecraft fire was for the national space program. As many of my colleagues will recall, the Apollo fire was a tragic incident which took the lives of three outstanding astronauts. How- ever, the National Aeronautics and Space Administration, in team with its industrial contractors, revamped their Apollo systems and upgraded their safety standards in terms of new materials, more stringent operating procedures and additional measures aimed at minimizing human error. This contributed greatly to the program's successes in the years that followed. The nuclear community is faced with a similar situation today as NASA was 12 years ago. However, at Three Mile Island no fatali- ties resulted from the nuclear accident and exposure of the citizen- ry amounted to radiation levels comparable to several chest X-rays. PAGENO="0347" 343 NASA had to enhance the quality of safety in the face of trage- dy, and yet I feel the urgency to address the nuclear safety prob- lem is just as great even though there has been no catastrophe. Mr. Chairman, I think it is generally agreed in the technological community that two major conclusions have been reached so far on Three Mile Island. The nuclear reactor safety systems were tested under conditions so extreme that a saboteur could not have done a better job of stressing the reactor. Probably the demonstration we just saw makes that clearer yet. Yet the system behaved better than anyone had the right to expect. I cannot make the same observation about the Operators performance. Human error combined with the absence of reliable and confirmatory instrumentation obviously played a major role in escalating a normal shutdown sequence into a potentially harmful incident. This has to be avoided in the future. I hope our committee's deliberations are the first step in a meaningful congressional initia- tive to enhance reactor safety by technological improvements, not by adding another layer of regulatory complexity. Thank you, Mr. Chairman. Mr. MCCORMACK. Thank you, Mr. Wydler, for an excellent state- ment. I very much appreciate the most constructive attitudes re- flected in that statement. Our first witness today is Mr. John MacMillan, vice president, Nuclear Power Generation Division, Babcock & Wilcox Co. Mr. MacMillan, please come up and make yourself comfortable at the witness table. Your statement, without objection, will be inserted into the record at this point, along with any supplemental material you may wish to submit. You may proceed with your testimony as you wish. You may wish to introduce Mr. Roy. STATEMENT OF JOHN MacMILLAN, VICE PRESIDENT, NUCLE- AR POWER GENERATION DIVISION, BABCOCK & WILCOX CO., ACCOMPANIED BY DONALD ROY, MANAGER, ENGINEERING, NUCLEAR POWER GENERATION DIVISION Mr. MACMILLAN. Yes, Mr. Chairman. Thank you very much. I have with me today Dr. Donald Roy, who is the manager of engi- neering for the Nuclear Power Generation Division of Babcock & Wilcox. In response to your letter of May 11, I am prepared this morning to discuss the manufacturer's perspective on the events that took place at Three Mile Island, as an introduction this morning. Second, to try to identify what we consider to be significant factors in that sequence of events. You also requested some infor- mation on the characteristics of the B. & W. design, unique charac- teristics, specifically the once-through steam generator. I am pre- pared to discuss that. Finally, some very brief comments relative to the specific im- provements in technology which might be indicated as a result of the Three Mile Island experience. I have submitted a full statement. I appreciate that it will be incorporated in the record of these proceedings. [The prepared statement of Mr. MacMillan follows:] PAGENO="0348" 344 STATEMENT OF THE BABCOCK & WILCOX COMPANY The Babcock & Wilcox Company is pleased to submit its statement before the Subcommittee on Energy Research and Pioduction of the House Committee on Science and Technology. This statement is submitted in conjunction with an invitation by the Subcommittee to Babcock & Wilcox to appear before the Subcommittee on Wednesday, May 23, 1979. At the Subcommittee hearing Babcock & Wilcox will, be presenting a synopsis of this statement. This statement will address first, how a nuclear plant comes into existence beginning with its inception as a planned addition to a utility's generating capacity including partici- pants and their roles; second, to briefly discuss a pressurized water reactor nuclear steam system; third, the sequence of events and the significant factors involved in the incident; fourth, the once-through steam generator and its characteristics; and fifth, the generic technological implications of Three Mile Island. It is appropriate to begin this statement by briefly des- cribing the genesis of a nuclear power plant and the particular roles each of the participants plays. Following a utility's decision that it wants to add a nuclear power generating station to its electricity producing facilities, it will generally employ an engineering firm to begin the process of bringing that decision into reality. Several decisions such as PAGENO="0349" 345 location, desired date of coercial operation, generating capacity, and financial considerations are made. Generally, the engineering firm will prepare bid specifications for the various components of the plant. Eecause of the design and manufacturing lead times required for the nuclear steam system, often these specifications are released to bidders in the early stages of the project. Suppliers, including B&~, review the specifications and prepare proposals for submittal to the customers and their engineering firms. Following what is usually a lengthy evaluation and negotiation period, an award is made and the supplier and the engineer begin to proceed with detailed design, licensing and procurement efforts to support the customer's schedule. Each individual customer~supplier relationship is governed by the respective contract requirements and the requirements imposed by the V~RC. The supplier's responsibility to the utility is to furnish equi~rtent and services in accordance with these requirements. Specifically, the supplier has the responsibility for the design of the equi~nent which it supplies and the responsibility to provide interface design information and criteria to allow the engineer to integrate this equi~nent into the design of the complete plant. The supplier's scope of supply usually includes the complete reactor coolant system, components within major auxiliary support systems and emergency core cooling systems, instrumentation and control systems and other equipment such as fuel handling equipment. PAGENO="0350" 346 Generally that part of the plant which is outside the scope of supnly of the nurlear steam system supplier is referred to as the "balance of plant'. The engineer is responsible for the design and procurement of equi~ent for the `balance of plant'. The nuclear steam system supplier and engineer work together to inte- grate their respective scopes of supply at the interface through the transmittal, review end application of interface information and criteria in the form of drawings, specifications, system des- criptions and instruction. For instance, the nuclear steam system supplier provides the reactor coolant system which is located in the containment. The containment is designed by the engineer. The integration of the reactor coolant system into the containment design is an example of the interplay between the supplier and the engineer. Another key participant in the genesis of a nuclear power plant is the Nuclear Regulatory Cosmission. The NRC's role includes the responsibility for the review of the plant design and the issuance of the appropriate permits. During the early stages of the project the NRC, in accordance with the provisions of the Atomic Energy Act, must issue a Construction Permit based on their acceptance of the design at that time. This permit is necessary before any significant plant construction activity may take place. The NRC must also review the final design of the plant and issue an Operating License before PAGENO="0351" 347 the utility may load fuel into the reactor. This also is required by the Atomic Energy Act. In addition, the NRC is responsible for establishing operator training requirements and for testing and licensing of operators. Once a plant has started operating, the NRC maintains a surveillance function, monitoring plant operation to insure compliance with existing plant technical specifications. A particular engineer or customer may impose their specific criteria on a supplier which nay vary from those imposed by another engineer or customer even though the basic nuclear steam system would be categorized as the same type. Additionally, varying criteria may be imposed by the ~balance of plant" design or by the equipment selected for the "balance of plant". Therefore, even though plants supplied by a particular nuclear steam system supplier may be thought of as being the same, in the specifics of the design they are usually different. It is additionally appropriate to describe the Babcock & Wilcox pressurized water reactor in simplified terms with reference to Figures 1 and 2 in order that one can have a basic understanding of the production of electricity through the use of nuclear power. A pressurized water reactor nuclear plant is essentially made up of three separate and distinct loops. For definition purposes we will call these loops the primary loop, the secondary loop, and the condenser/cooling loop (Figure 1) PAGENO="0352" Block valve FIgure 1 RC Turbine generator Primary High preseure injection tower Condenser/Cooling Secondary Main feed pump PAGENO="0353" 349 The primary loop contains the following major components, all of which are located in the containment building: reactor vessel, steam generators, pressurizer, and reactor coolant pumps. The reactor vessel is approximately 14 feet inside diameter with walls approximately 9 inches thick made of steel with an inner lining of stainless steel. It houses the fuel assemblies which are zircaloy tubes housing slightly enriched uranium. Control rods which contain material which controls the rate of nuclear reaction are also con- tained in the reactor vessel. These control rods move up and down within the fuel assemblies to vary the power from 0% to 100%. The steam generators are pressure vessels approximately 68 feet high with an inside diameter of approximately 13 feet. They contain thousands of nickel-iron-chromium alloy tubes roughly twice the diameter of a pencil. The pressurizer is a high pressure vessel vertically mounted which provides a steam surge chamber and water reserve which can be used to maintain desired reactor coolant pres- sure. The reactor coolant pumps, 2 per steam generator, are very high capacity pumps which deliver reactor coolant flow throughout this primary system. Heat which is generated from nuclear reaction of the uranium contained in zircaloy clad fuel pins is transferred to water circulating through the reactor vessel under high pressure and flow around the fuel pins. This heated water is carried through piping to the steam generators where the heated water passes through the tubes in the steam generator and returns to reactor cool- ant pumps to recirculate it through the reactor around the fuel pins again. The primary system maintains its pressure through the use of 48-721 0 - 79 - 23 PAGENO="0354" 350 the pressurizer. The pressurizer maintains reactor coolant pressure at desired level throuch actuation of the heaters or spray in the pressurizer. This is a closed system. (Figure 2) The secondary system contains the steam generators, the turbine generator, condenser, heaters, and main and awciliary feedwater pumps. As the heated water from the reactor is passing through the tubes in the steam ~enerator different water from the secondary system is pumped around the outside of the tubes arid the heat is transferred through the nickel-iron-chromium alloy material making up the tubes to turn this water into steam which then leaves the upper region of the steam generator and passes through piping to drive the turbine. As the steam is cooled passing through the turbine and further cooled in a condenser, it returns to its liquid state and again begins its return to the steam generator. After leaving the condenser and passing through a condensate system, it returns to the feedwate.r pumps to be circulated through the steam generators again. This is the secondary loop and is essentially a closed system. The third loop contains the cooling towers and condenser which use a water source, such as a river, to cool the steam leaving the turbine-generator through heat transfer in tubes in the condenser and turn the steam in the secondary system back to water for its return through the secondary steam and its reconversion to steam. (Ficure 1) PAGENO="0355" Nuclear steam system CO Cu Steam generator Pressurizer. Figurei2 PAGENO="0356" 352 Recalling the earlier discussion of the division of responsi- bilities between the participants in the design, manufacture, and construction of a nuclear power plant, the following conments are generally applicable with respect to a pressurized water nuclear steem system. First, the major components of the primary loop are the design and manufacture responsibility of the NSS supplier. The secondary loop and the condenser/cooling loop are generally the design responsibility of the engineering firm with specific com- ponent design and manufacture responsibility, laid upon various manufacturers such as the manufacturer of the turbine generator. Additionally, there are split responsibilities and interfaces between the participants. An example of such a split is in the primary system, where the NSS supplier designs and fabricates the major components and specifies certain parameters which must be met within the engineering firm' s design of the containment, and where the engineering firm has full design responsibility for the contain- ment building itself and the location of certain components within the containment. Against this background the following describes the sequence of events and significant factors of the incident at Three Mile Island. First, we will develop an overview of the sequence of events at ThI. Following that, with the overview serving as a context, we will provide our views concerning the significance of the factors in that sequence. PAGENO="0357" 353 Figure 3 (next page) is a diagram of the secondary system at Three Mile Island. Steam from steam generators shown on the right goes up through the main steam lines and is admitted to the turbine, and then into the condenser. Condensate pumps take suction from the condenser and pump through the condensate polishing equipment, through condensate booster znimps, low pressure heaters, main feedwater pumps high pressure heaters, back through feedwater control valves and into the steam generator. In the absence of main feedwater flow,~ three auxiliary feed pumps, two electric and one steam driven, can draw directly from condensate storage tanks or from the main feed system and pump through control valves into the steam generator. What happened in the initiating event at Three Mile Island was apparently the result of work being performed on the condensate polishing equipment. In the process, that equipment was isolated so that the feedwater flow was interrupted. Suction pressure to the feedwater pumps was lost and they both shut off. This interrupted the feedwater flow to the steam generators. In that circumstance, safety systems called for the auxiliary pumps to start automatically and the turbine to trip. Both of those happened as designed. Control valves functioned as required - the operator looked at his. panel arid his debriefing has indicated that he established that there was pressure at the discharge of the feedwater pumps. He, therefore, probably assumed that the auxiliary feedwater system was operating the providing flow to the steam generators. What in actuality occurred was the isolation valves downstream of the of the control valves were closed in violation of technical pro- cedures and they should have been open. The interim sequence PAGENO="0358" Secondary System CA~ FIGURE 3 PAGENO="0359" 355 of events published by the NRC states that operators apparently failed to note the position indication lights of these valves in the control room until about 8 minutes into the transient. These closed valves precluded the admission of auxiliary feedwater to the steam generators for that period of approximately 8 minutes. During this time then there was no feedwater being introduced to the steam aenerator. Figure 4 (next page) is a diagram of the reactor coolant or primary system. Briefly the flow paths in this system are the reactor outlet line going into the steam generator, two lines coming out through circulating pumps back into the reactor vessel. Also shown schematically and not by actual physical elevation is the pressurizer which is connected to one of the reactor outlet lines or hot legs. On top of the pressurizer are two code safety valves and a pilot operated relief valve with an isolation valve upstream of it. All discharge lines from these pressurizer valves go to the quench tank. The quench tank has a relief valve not shown on. Figure 4 and a rupture disc which protect the integrity of the tank if the pressur.e gets too high. These devices discharge into the reactor building, or containment. Also shown on Figure 4 are the various emergency~ core cooling systems. The high pressure injection system delivers water into the reactor inlet, or cold legs of the reactor system. Intermediate pressure injection is provided by two core flood tanks which are maintained at pressure by a gas pressure. If pressure is low enough in the primary system, these tanks dump their contents into the reactor vessel. - PAGENO="0360" ElM RELIEF VALVE STEAM Primary System FEEDWATER RCPUMP (TYPICAL) FROM MAKEUP CONTROL VALVE FIGURE 4 PAGENO="0361" 357 With the feedwater flow to the secondary side of the steals generator having been interrupted, there was limited capacity for removing heat. The steam generator was boiling dry and the reactor coolant system began to heat up and pressure in the reactor coolant system began to increase because of expansion. The pressure in the reactor coolant increased until the pilot operated relief valve opened at about 6 seconds. Pressure continued to increase to the point where the reactor was automatically tripped, or automatically shut down. As a result, the reactor coolant pressure then started to decrease and dropped down to around~ 1300 or 1400 psi. As it decreased, the pilot operated relief valve should have closed. It did not. As pressure dropped to approximately 1600 pounds, the high pressure injection pumps started up automatically by action of the safety system. The pressure dropped to the point where there was flashing or instantaneous creation of steam in the hot leg of the reactor coolant system and that was what was holding the pres- sure up. During that period the pressurizer level fluctuated and started to increase. As the level approached a full. pressurizer the operator apparently cut back on the high pressure injection flow to maintain pressurizer level. As time progressed without additional water entering the reactor coolant system and pressure continuing to drop, primary coolant water began to flash to steam. The reactor coolant pumps then began to operate erratically. Two pumps in the B loop were turned off at 73 minutes and two pumps in the A loop were turned off at about 100 minutes into the accident. After that, with forced circulation terminated and emergency core cooling PAGENO="0362" 358 through high pressure injection reduced by operator action, all the evidence seems to indicate that the water boiled out of the reactor coolant system. This occurred during the period from 2-4 hours after the start of the accident, or from 6:00 AM to 8:00 AM. It was apparently during that time that most of the core damage occurred. There was evidence of very substantial zirconium-water reaction which generated hydrogen and the much publicized gas bubble in the primary system. Ultimately, through a combination of advice from various sources, including B&W, high pressure injection was re-established at a sufficient flow, pressure was brought up in the system and a reactor coolant pump was put back into service. The last of these actions was not completed until almost 16 hours after the accident began. It was at that time that a cooling configuration was estab- lished which was maintained for a matter of several days while everyone concerned looked at the total picture of how to recover from that situation and get into a long term cooling configuration. With this overview of the TMI sequence of events in mind, it is appropriate to move into a discussion of the significance of the factors in that sequence. S First, after the loss of feedwater occurred, two closed isola- tion valves prevented auxiliary feedwater from reaching the steam generators for a period in excess of eight minutes. This eliminated the capab~ility of the steam generator to remove heat from the reactor coolant system, and resulted in a corresponding increase in reactor coolant system temperature and pressure, and diminished PAGENO="0363" 359 the ability of the plant to promptly stabilize reactor coolant system temperature and pressure as designed. * Second, as a result of the initial reactor coolant system pressure and temperature increase, the pilot-operated pressurizer relief valve (located at the top of the pressurizer) opened as designed, but did not reseat properly, thus allowing reactor coolant system pressure to continue decreasing. After approximately 2-1/4 hours, the operators recognized the data from plant instrumentation which indicated that the valve was open (including quench tank rupture at 17 minutes), and closed the block valve in therelief valve discharge line, thus preventing any further loss of primary coolant. * Third, the high pressure injection system, which had auto- matically actuated as designed on low reactor coolant system pressure, was prematurely terminated by the operator even though there were simultaneous indications of an opening in the reactor coolant system pressure boundary, such as increasing quench tank pressure, decreasing reactor coolant system pressure and increasing reactor containment pressure. This led to a diminished capability to cool the reactor core as primary coolant inventory diminished. Subsequent analyses have indicated that there would not have been core damage or significant radioactive contamination and release if the operators had left the high pressure injection pump in service to perform the core cooling function for which they were intended. PAGENO="0364" 360 * Fourth, the containment isolated in accordance with the licensed design. However, this allowed the transfer of radioactive water from which subsequent radiation releases occurred. * Fifth, high pressure injection was evidently manually operated based on high pressure level indication. We have conducted reviews of data from Three Mile Island and performed analyses that lead us to conclude that the indicated pressurizer level was not sig- nificantly in error. We believe that the pressurizer was essen- tially full during a long period of this transient but a portion of the reactor coolant system developed steam voids due to the decrease in system pressure. This conclusion has been supported by an independent NRC study. Consequently, operation of high pressure injection flow should not have been based on the single parameter. of pressurizer level. * Sixth, in addition to two reactor coolant pumps having been shut off at 73 minutes, the remaining two reactor coolant pumps were shut off at 100 minutes after the initiation of the incident. Although shutting off one reactor coolant pump in each loop in response to indications of low coolant flow may be advisable, shutting off all pumps under the circumstances then present is believed to have caused an uncovering of the core and a degrada- tion in core cooling capability. Ultimately, at about fifteen hours after initiation of the transient, the reactor coolant system was repressurized, and at about 16 hours the reactor coolant pumps were restarted. PAGENO="0365" 361 Our analysis of the six factors identified by the NRC has yielded a set of four basic principles which we believe warrant emphasis in considering any future action. First, renewed emphasis must be placed in the near term on administrative controls to assure that plant systems important to safety are not defeated. In the longer term, consideration should be given to whether plant systems to augment those admini- strative controls should be developed and implemented. Second, renewed emphasis must be placed on maintaining the individual operator's focus upon the fundamental physical processes which assure core cooling, and on ensuring that systems complement or increase the likelihood of maintaining that focus. Third, operator training programs must be reassessed and upgraded to emphasize these fundamentals. Fourth, any actions or modifications implemented must be con- sidered in the broader context of total plant safety. Hasty and ill-considered actions, which might be partially responsive to the TMI-2 events, could, in certain cases, produce adverse impacts in other safety systems which were not involved at TMI-2. In response to an additional request of the Subcommittee, the following is a brief description of the Babcock & Wilcox designed once-through steam generator and its characteristics. V PAGENO="0366" 362 As previously indicated, the steals generator is a pressure vessel approximately 68 feet in height and 13 feet in diameter containing approximately 15,000 small diameter nickel-iron- chromium alloy tubes. These tubes are held in a uniform pattern along their length by tube support plates. Reactor coolant, at approximately 600°F and 2200 psi, enters the single inlet nozzle at the top of the once through steam generator and flows downward through the tubes either under forced circulation from the reactor coolant pumps during normal operation or by natural circulation during those emergency operations when the reactor coolant pumps are not operating. The reactor coolant then exits at the bottom of the steam generator through two outlet nozzles. Recalling the early discussion and diagram 1, this is the steam generator's role in the primary system. Secondary system feedwater is introduced into the steam generator through inlet nozzles at the side of the vessel. This water enters tube bundle at the bottom of the generator and then passes upward between the tubes which contain the primary coolant. Heat is transferred through the tube walls from the primary coolant to the feedwater. The feedwater turns to steam and then super- heated steam as it passes upward between the tubes to the top of the generator and exits at outlet nozzles located on the side of the generator. This steam then goes to the turbine generator as previously indicated. PAGENO="0367" 363 The once-through steam generator functions :as an efficient counterflow heat exchanger which delivers superheated steam. The operating characteristics are such that the steam is produced at a constant pressure over the entire operating: range from 15 to 100% full power. Higher plant efficiencies result from these characteristics. The basic difference in the primary system between the once- through steam generator design and the other steam.: generator design used in pressurized water reactor systems, variously known as recirculating or U-tube generators, is that in the once-through design the reactor coolant enters the'generator at the top and the upper tubesheet directs the flow through the tubes toward the bottom tube sheet which allows the reactor coolant to exit the steam generator at the bottom. The recirculating or U-tube genera- tor has its reactor coolant~ enter the generator at the bottom into its single tubesheet and then go upward through the tubes which bend in a U-shape at the top of the generator. The coolant flows through the "U', bends, and returns downward to the bottom of the steam generator through the same tube sheet and exits the steam generator at the bottom. The incoming reactor coolant is kept separate from the exiting reactor coolant through use of a separator. The basic difference in the secondary systems between the once-through steam generator and the U-tube or recirculating steam generator is that in the once-through steam generator the feedwater is all turned to superheated steam on a single trip through the generator while in the U-tube, or recirculating steam generator as the feedwater passes upwards through the tube bundle a part of it PAGENO="0368" &64 turns to non-superheated steam and a part of it remains water which returns down to the bottom of the steam generator to return or "recirculate~ up through the tube bundle again. Simplified diagrams of the two types of steam generators follow as Figures 5 and 6. While the once-through steam generator in combination with the secondary feedwater system are generally similar in all the plants utilizing Babcock & Wilcox nuclear steam systems, there are differences in the actual feedwater systems because of the utili- ties' or their engineering firms' different designs. As indicated previously, the secondary system design and scope of supply in a nuclear plant are not within Babcock & Wilcox's scope of supply. The Babcock & Wilcox input to the utility or its engineering firm with respect to the secondary feedwater system is to specify requirements of the feedwater in quantity and quality of the water. Lastly, what are the generic technological implications of Three Mile Island? While the incident at Three Mile Island was certainly very unfortunate and its seriousness should not be minimized, important lessons have been and will continue to be learned about electric power generation through the use of nuclear energy. Three Mile Island has emphasized the importance of the man- machine interface and the need for translating the designer's concepts into unambiguous information and instructions for plant operation. With the advancements in electronic and computer technology there are three general areas inwhich the man-machine interface can be improved.~ PAGENO="0369" 365 Once through steam generator CTOR COOLANT ThLET ~ LOWER TUBESFEET .REACTOR COOLANT OUTLET AUX7fl~J~y FEEDWATER NflE TUBE ~mr - FEEDNATER I?LET 0 48-721 0 - 79 - 24 PAGENO="0370" 366 Recirculating steam geherator REACTOR COOLANT INLET NOZZLE SHROW C STEAhI OUTLET NOZZLE MOISTURE SEPARATORS NOZZLE TUBE BUNOLE TUBESHEET REACTOR COOLANT WTLET NOZZLE PAGENO="0371" 367 - First, the measurement and display of the actual condition of vital operational equipment and instrumentation. - Second, the display of plant conditions in a format to enhance the operator's awareness of the system condition and trends or directions in which the system is moving. - Third, remote visual monitoring of vital plant equipment to confirm instrumentation indications already available. In addition to providing better display of plant conditions for the operator, recording plant conditions and being able to retrieve these data in graphic display would help with trouble- shooting and subsequent diagnosis of operational problems by the plant engineersand designers. In other words, examine the parameters to be measured or monitored to assure that actual conditions are displayed. Display these conditions to the operator in a fashion which is simple to understand, shows graphically the important data and trends. Assist the operator in diagnosing unusual conditions and suggest appropriate corrective measures. And finally, provide him with back-up remote visual means of confirming the operating status of vital equipment. Some people have called these suggestions "human engineering". The crucial lesson of Three Mile Island is the need to improve the man-machine interface and provide means of assisting the operator in both the operational and~ administra- tive aspects of his job. In conclusion, Babcock & Wilcox continues to be committed to nuclear power as a means of generating electricity to meet our nation's needs. While the incident at Three Mile Island was serious the lessons learned will enable the industry to better serve the nation in future generations, PAGENO="0372" 368 Mr. MACMILLAN. In my full statement, I have spelled out at the beginning the role of the various participants in a nuclear plant- the utility, the NRC, the engineering firm, and the manufacturer of equipment, such as Babcock & Wilcox. As a general rule, the responsibilities of the nuclear steam system manufacturer, are first to design and manufacture, and provide the components of the primary system and the reactor safety system, supporting instrumentation and control, to provide interface information to the engineering firm for the balance of the plant, and to provide licensing and startup support to the utilities. The general responsibilities of the engineering firm or the util~ ity, if they do their own balance of plant engineering, is to coordi- nate the design of the entire plant. At Three Mile Island, Burns & Rowe was the engineering firm on the balance of plant. Their responsibility was to provide the containment design and the design of the balance of plant-that is, that part of the plant which is not a part of the nuclear steam system-and to integrate the various participants work scope in the overall plant design. The NRC, of course, reviews the plant designs. and approves them, issues a construction permit as required by the Atomic Energy Act prior to commencement of any significant construction, issues an operating license prior to fuel loading, following its ap- proval of the final design, establishes criteria and requirements for licensing of the operators, issues operator licenses, and finally mon- itors the operation of those plants once they have gone into service. That very briefly puts into perspective the roles of the major participants in the design, development, construction, initial oper- ation of the plants-the utility being the organization that of course is the ultimate customer and the ultimate operator, ulti- mate licensee of the plant. Now, with that background I would plan to go through a brief description of the sequence of events that happened at Three Mile Island on the morning of March 28, and then review with you after that the significance of these, as we see them. I have brought with me a very simplified chart of the total plant, which is somewhat different than appears in the prepared testimo~ ny. It is a much more simplified diagram. I would like to use this as an outline for the discussion of the events. Mr. MCCORMACK. Good. We can see it very well. It will help us. Mr. MACMILLAN. You will see in blue what we call the primary system of a nuclear plant, with the reactor vessel here in the center, where the reactor core is located. Coolant circulate, through the reactor core, as you have just seen a demonstration, going out to the steam generators-in our case once through steam generator-entering the top of the generators, flowing down through the generator, exiting at the bottom, being circulated back to the reactor vessel by two reactor coolant pumps, two in each loop, and back into the reactor vessel. On the secondary side of the steam generators, feedwater nor- mally is fed into the generator, converted to steam in one pass through the generator, steam then is admitted to the turbine and in the condenser where the steam is cooled and returned to the water state, and then pumped back into the steam generator. PAGENO="0373" 369 In the event where main feedwater is lost, there is an auxiliaiy feedwater system provided as an emergency backup system. It can either take suction from condensate storage tanks or from the main feedwater system, and it is shown here taking suction from the condenser. Auxiliary feedwater pumps pump water into the top of the steam generator, where it can provide for cooling in a natural circulation mode, and provide for the cooling of the reactor coolant system for emergency condition. Shown as a part of the primary sytem is a pressurizer, which has a surge line coming off the hot leg, or the high temperature leg of the reactor coolant system. Normally in that system is a water- steam interface. The water is maintained at saturated temperature, correspond- ing to a little over 2,000 pounds per square inch by. electrical heaters. If the pressure rises to the point of about 2,350 pounds, there is a pilot operator relief valve which will relieve that pressure. That valve discharges into a quench tank wjthin the reactor building, the quench tank not being shown on this diagram. There are also safety valves on the top of the pressurizer which are set to relieve at about 2,500 pounds .pressure. They also vent into or discharge into the quench tank. Upstream of the pilot operator relief valve is a block or isolation valve, put there for the purpose of isolating that relief valve if it should fail to reseat. The safety valves do not have isolation valves. They are pre- cluded from having those by code. The purpose of the pilot operator relief valve is to open and relieve the pressure without challenging the safety valves in the event a transient occurs which requires some pressure relief. Shown schematically here is a high pressure injection system which you just heard about. It pumps water into the reactor cool- ant system at high pressure and provides for emergency core cool- ing in the event that there is a small break in the reactor coolant system and emergency cooling is required through the high pres- sure injection system. The heat from the condenser is taken out by the green system shown here, which is in this case showing the use of cooling towers for the ultimate removal of the low temperature, low energy heat from the nuclear system. Now, that is a description of the system. Let me go through the sequence of events that occurred on the morning of March 28. At about 4 o'clock in the morning, while operating with equip- ment, polishing equipment in the. main feedwater system-that equipment is not shown in this simplified diagram-by a sequence of events which is still under some review, the net impact of which, however, was to interrupt the main feedwater flow. The main feedwater pumps lost suction pressure and under those conditions, as designed, they shut down. That interrupted the feedwater flow to the steam generator and, as designed, in that circumstance, the auxiliary feed water pumps came on. They are two electric driven pumps, one steam driven pump, and all three came on. PAGENO="0374" 370 The turbine tripped, as designed, shutting down the turbine gen- erator. The operator testified that he had checked the discharge pres- sure on those auxiliary pumps and ascertained that the pumps had come on, and there was pressure in that discharge header. Then he went about other activities required in the event of loss of feed- water flow. Interrupting the flow of feedwater to the steam generator, which is a normal cooling mechanism for the reactor system, caused the reactor coolant system to heat up because the reactor is still deliv- ering heat. As the reactor system heats up, it expands, and increases the pressurizer level, the water level in the pressurizer, and that com- presses the steam at the top of the pressurizer. Within a matter of about 4 seconds it reached a pressure at which the pilot operator relief valve opened. The pressure continued to rise after that, since there was still more heat being put into the reactor coolant system than was being taken out in the steam generators, to the point at which the reactor protective system automatically shut down the reactor, scrammed the rods, and stopped the fission process. As Dr. Schoessow said, there continues to be about 10 percent heat energy from the decay products being put into the reactor coolant system. Mr. MCCORMACK. The shut down came at about 9 seconds? Mr. MACMILLAN. About 8 or 9 seconds. The pressure then did turn around and decrease, and reached the set point at which the pilot operator relief valve would normally have reseated. In this particular case, the valve stuck open, this valve here, the pilot operator relief valve, and pressure continued to decrease, and dropped down to a pressure in the range of 1,300 or 1,400 pounds over the next several minutes. When the pressure dropped below 1,600 pounds, the emergency safety systems call for the automatic startup of the high pressure injection pump. In fact that happened. Those pumps came on. They started to pump water into the reactor, the reactor coolant system. Those pumps came on at about 2 minutes into the accident. So we are still very early in the accident sequence. Mr. MCCORMACK. This was tripped by abnormally low pressure. Mr. MACMILLAN. Yes, abnormally low pressure in the coolant system. Normally you operate over 2,000 pounds. If the pressure for some reason drops down below about 1,900 pounds, that is low enough so the safety system will shut the reactor down. The reactor had already been shut down by high pressure in this sequence. When the pressure drops down to 1,600 pounds, then the safety system, recognizing that is an abnormally low pressure, automatically starts the high pressure injection pumps. The system pressure continued to decrease because the relief valve is still open, and still blowing steam, or the combination of steam and water out of the pressurizer, until it reached a pressure around 1,300 or 1,400 pounds. That is the pressure at which you have reached saturated condi- tions in the high temperature leg of the reactor. At that point, you PAGENO="0375" 371 start flashing water in the high temperature leg of the reactor and forming steam in the reactor coolant system itself. Mr. MCCORMACK. That is because the pressure goes down, and the temperature is still what? Mr. MACMILLAN. The temperature in this hot ioop is still up around 575°. Mr. MCCORMACK. So at that temperature, in dropping down to 1,300 pounds, it causes the water to flash to steam. Mr. MACMILLAN. That is correct. In the hot leg of the reactor system. Now, during this time the pressurizer level fluctuated and start- ed to increase. As the level approached the full pressurizer, the operator apparently cut back on the high pressure injection flow, emergency pump operation here, in order to maintain pressurizer level. This is now about 3 minutes into the accident. Mr. WYDLER. I don't understand that. Why would the pressure start to increase? That is still open, isn't it? Mr. MACMILLAN. This valve is still open. But remember, we are still in a situation-I forgot one very important item, I am sorry. The auxiliary feedwater pumps came on, as I indicated, right at the early part of the incident. But auxiliary feedwater was not allowed to flow to the steam generator because of closed block valves. This closed valve right here precluded the auxiliary feedwater from reaching the steam generator. So in the first 8 minutes of the accident there was no auxiliary feedwater to the steam generator. Therefore, there was no means of taking heat out of the reactor coolant system, and the reactor coolant system continues to in- crease in temperature, to increase therefore in volume, continues to pressurize in the reactor pressurizer here, and the pressure was going up. That is when the pilot operator valve opened, pressure decreased, and since this valve is still open, it continues to relieve water from the reactor, steam from the pressurizer. What is happening, and the reason the level apparently is in- creasing, as you form steam in the reactor hot leg you get a steam bubble in the hot leg which forces water up into the pressurizer, and makes it look as though the pressurizer level is increasing. In fact, the pressurizer, from all the evidence we have, was full of water at this point. But there was steam being formed in the reactor coolant system. Mr~ WYDLER. I can understand why it is getting hotter. I don't understand why the pressure was building up. Mr. MACMILLAN. The pressure is not building up. Mr. WYDLER. You just said it did and gave a signal to one of the men in the control room, so that he started another procedure. Mr. MACMILLAN. No. The pressurizer level was increasing. The level at which-- Mr. WYDLER. Not the level of pressure. Mr. MACMILLAN. The level of water in the pressurizer was in- creasing. He was monitoring that pressurizer level. As he saw that pressurizer level go up, apparently he cut back on the high pres- sure injection, in order to keep that pressurizer from becoming full. PAGENO="0376" 372 Mr. ERTEL. If the gentleman would yield for a second. Mr. WYDLER. If you just let me finish this. You say these two- the original pump shut down and the auxiliary pump went on. But even though it was on, it wasn't pumping any water because the valve was closed. But there was nothing to indicate to anybody that no water was going in, right? It just says the pump is running. You have some- thing that says the pump is~ running, but you don't have anything that says water is flowing. Is that the way the system works? Mr. MACMILLAN. Normally, the indication that water would be flowing would be the level of water in the steam generator. You would expect to see as the auxiliary feed water comes on, you would expect to see the level come up in the steam generator. Ultimately, the operator recognized that situation and at that point realized that the block valves were closed and at 8 minutes into the incident, he opened those block valves with operators-- Mr. WYDLER. You said there was water coming in on this side, the blue system, the primary system. You said water was coming in there. Mr. MACMILLAN. There is water coming into the reactor coolant system through the high pressure injection phase. Mr. WYDLER. So it was receiving water. Mr. MACMILLAN. It was receiving high pressure injection water. But it was not receiving any cooling water on the secondary side of the steam generator. Mr. ERTEL. You have two isolated systems. Mr. WYDLER. The blue system puts the water in the reactor vessel, doesn't it? Mr. MACMILLAN. Let me go back again and say this. The blue system is a closed circulation system which circulates water normally at about 2,000 pounds pressure through the reactor core, through inside the tubes in the steam generator, and back into the reactor core. It is a closed circuit. Mr. WYDLER. That is putting the water in the reactor core. Mr. MACMILLAN. Normally that water is circulated through the reactor core by the reactor coolant pumps themselves. Mr. WYDLER. And that system was on. Mr. MACMILLAN. That system was on. Water was circulating through the steam generator and the reactor core. However, there was no water on the secondary side of the steam generator. They had, at one point in the event, essentially boiled dry, and there was no water coming in here so that it could be converted into the steam and remove heat from that steam generator. Mr. WYDLER. The only thing-and then I will yield to the gentle- man-the only thing that I was trying to get clear in my mind was, because we have heard that the core-we are just talking about the core-it was uncovered at some point. Maybe you will get to that. I don't understand that because apparently there was a system on and open which was putting water in the core. Mr. MACMILLAN. OK. I think I will get to that. Mr. MCCORMACK. The gentleman from Pennsylvania? Mr. ERTEL. Thank you, Mr. Chairman. PAGENO="0377" 373 You made a statement that apparently he felt that the water level was going up in the pressurizer and, therefore, believed that there was enough water in the system. Is there any indication of how he could have read that any other way? Would there have been an analysis he could have gone through to determine, in fact, that was not happening, that he was creating steam somewhere in that core or in the leg there up to the pressurizer? Is there any way he could have analyzed that on that basis, at that time, to understand the process that was going on? Mr. MACMILLAN. He has other instrumentation available to him which would have indicated that he had approached saturation conditions in the reactor coolant system, and I think the most significant one is the reactor coolant system pressure itself. The reactor coolant system pressure was continuing to fall during this period and, as I say, dropped as low as 1,300 to 1,400 pounds per square inch, which is abnormally low. Mr. ERTEL. There is no way to read that out specifically what the water level is in the reactor vessel itself? Mr. MACMILLAN. There is no water level indicator in the pres- sure vessel. Mr. ERTEL. In the pressure vessel or you are talking about the reactor vessel? There is a direct readout of the water level in the pressurizer, is there not? Mr. MACMILLAN. There is a direct indication of water level in the pressurizer, but there is no indication of water level measure in the reactor vessel. Mr. ERTEL. So what he has to do is go backward. He has to read the other things, put them together and then determine as a result, a deductive process, what the water level would be in the reactor itself. Mr. MACMILLAN. In a situation where he has sufficient pressure in the reactor system so he has subcool conditions, the pressurizer level is a clear indication of the water level in the reactor coolant system. When he gets to conditions where he has saturated pressure and temperature in the reactor coolant system, such as in the hot leg here, because the pressure has dropped way down, is abnormally low, then that level indication in the pressurizer is no longer a valid indication of the water level in the reactor coolant system. Mr. ERTEL. Were there any written instructions to indicate to him that he should be able to analyze that? Obviously, sitting here doing it very calmly as you and everybody else is doing, it is pretty easy to analyze this series of events. Now, was there any written documentation, any kind of emergency pro- cedure by which he could have put those things together? Mr. MACMILLAN. There are emergency procedures which have been written and which describe the symptoms of a small break in reactor coolant system, and those systems would be similar to those that we-- Mr. ERTEL. That was the next question; is there any difference between the relief valve not reseating and a small pipe break anywhere in the system, especially around the pressurizer, in that area; is there any difference? PAGENO="0378" 374 Mr. MACMILLAN. There are differences, depending on where that break occurs. The small break procedure is intended to cover the break regardless of location. Mr. ERTEL. Therefore, if he followed the small break procedure it may have been different, depending where. In fact, the relief valve had not reseated, because he would* not know where particularly that event took place. The relief valve not reseating is the same thing as a small pipe break; is it not? Mr. MACMILLAN. That is correct. Mr. ERTEL. Therefore, depending on where it is in the system, is there a different procedure to be followed? Mr. MACMILLAN. No, the procedure is the same regardless. Mr. ERTEL. So he should have followed a standardized procedure in~ this event? Mr. MACMILLAN. This event is covered by the small break proce- dure, and in addition to that there is a procedure for the circum- stances where the pilot operator relief valve fails to reseat, and so he had that procedure available also to indicate. Mr. ERTEL. There is a condition when it fails to reseat; how does he know it does not reseat? Mr. MACMILLAN. The indications on the failure of the relief valve to reseat are primarily a thermocouple on the pipe which leads from the relief valve to the quench tank which, when its temperature exceeds 200 degrees he gets an alarm and that is an indication that the valve is open. In addition to that, in the quench tank there are pressure and temperature monitors and alarms which indicate that he is con- tinuing to put energy into that tank and that one of his safety valves-either the safety valve or pilot operator valve-has failed to reseat. Mr. ERTEL. I have gotten the warning we are out of time. Mr. MCCORMACK. I know we could sit here all day and ask questions only of Mr. MacMillan, but we do have quite a number of witnesses and we do have to move along. Mr. MACMILLAN. I believe I was at the* point in the sequence where the operator apparently cut back the high pressure injection flow to maintain pressurizer level. As .time progressed without additional water entering the reactor coolant sytem and pressure continuing to drop, primary coolant water began to flash to steam. The reactor coolant pumps then began to operate erratically. Two pumps in the B-loop, that is the loop shown on the left here, were turned off at 73 minutes and two pumps in the A loop were turned off at about 100 minutes into the accident. After that, with forced circulation terminated and emergency core cooling through high pressure injection reduced by operator action, all the evidence seems to indicate-and this is about 2 hours into the accident-that the water boiled out of the reactor core and that the core temperatures increased at that point caus- ing the zirconium fuel cladding to oxidize and generate hydrogen, which was, of course, the source of the much publicized gas bubble in the primary system. Mr. MCCORMACK. Excuse me. You say boil out. Did it boil part way down, the fuel, do you know? PAGENO="0379" 375 Mr. MACMILLAN. We don't know for sure how far it boiled down. The indications are that the major part of the core was uncovered and it boiled down so that the water level in the core was down in the lower third to lower quarter of the core, and the upper portion of the core was then just sitting in the steam. Mr. MCCORMACK. Steam at 1,300° or pounds pressure? Mr. MACMILLAN. At 1,300°. Actually, the pressure at this time was a little bit lower than that. Ultimately, through a combination of advice from various sources, including B. & W., high pressure injection was re-estab- lished at a sufficient flow, pressure was brought up in the system, and a reactor coolant pump was put back into service. The last of these actions was not completed until almost 16 hours after the accident began. It was at that time that a cooling configu- ration was established which was maintained for a matter of sever- al days while everyone concerned looked at the total picture of hOw to recover from that situation and get into a long-term cooling configuration. That's a brief overview. I would hope it would be a brief overview of the sequence of events, Mr. Chairman. Let me just identify the significant factors as we see them in the sequence, as a wrap-up. First, after the loss of feed water occurred, two closed isolation valves prevented auxiliary feed water from reaching the steam generators; that was the step I left oUt, unfortunately, in the early description of the incident. They remained closed in excess of 8 minutes. This eliminated the capability of the steam generator to remove heat from the reactor coolant system and resulted in a correspond- ing increase in reactor coolant system temperature and pressure and diminished the ability of the plant to promptly stabilize reac- tor coolant system temperature and pressure, as designed. Mr. MCCORMACK. When did the reactor shut down, how far into the accident? Mr. MACMILLAN. About 8 or 9 seconds into the accident. Mr. MCCORMACK. Why was not the steam generator on one side then able to handle the cooling, the one still functioning? Mr. MACMILLAN. Both steam generators were functioning at this time, but the turbine had tripped. Mr. MCCORMACK. But on the other side, ignoring the right hand side, you have shown that on the other side, there was still a completely intact secondary cooling system, haven't you? Mr. MACMILLAN. Well, the auxiliary feedwater system does not show in the diagram. It feeds both steam generators. Mr. MCCORMACK. Does the main system, main feed pump feed both steam generators? Mr. MACMILLAN. Yes. Mr. MCCORMACK. So that failure in the main feed pump then cuts off both steam generators? Mr. MACMILLAN. Yes, sir. Mr. MCCORMACK. So here's an area where we would probably suggest redundancy, separate systems. Mr. MACMILLAN. There are elements of redundancy in the system. There are two feed pumps, there are two feedlines. The difficulty was that between the condenser and feedwater there is a PAGENO="0380" 376 point at which there is one condensate polishing or feedwater treatment system, and that was the source of the initial cutoff of the feedwater flow. Mr. MCCORMACK. Why did the main feed pump fail? Mr. MACMILLAN. It didn't fail; it shut down because it lost its suction pressure, and it lost its suction pressure because the flow from the condenser to that feed pump was interrupted. Mr. MCCORMACK. Why? Mr. MACMILLAN. I am not sure I can answer that in detail. It involved a series of operations that were going~ on at the time in the operation of the condensate polishing equipment which cleans up the water coming out of the condensers before it gets to the steam generator. Mr. MCCORMACK. Some sort of special maintenance? Mr. MACMILLAN. I think you would put it in the class of mainte- nance, yes. Mr. MCCORMACK. In other words, the maintenance operation was the primary cause of the main feedwater system to fail. The first incident, the first malfunction was the main feed pump or the main feedwater system, and that was caused, you believe, by some maintenance, something in the operation that was going on? Mr. MACMILLAN. There is evidence maintenance operations in the condensate polishing equipment was the initiating event that interrupted the feed flow, which subsequently caused the feed pumps to trip off the line. Mr. MCCORMACK. The pump itself did not fail? Mr. MACMILLAN. No, sir. The pump stopped when it lost its suction pressure, which is the way it is designed to perform Mr PEASE Mr Chairman, would you yield7 Mr MCCORMACK Yes Mr. PEASE. I would just like to pursue that point a moment. Was the maintenance work that was being done on the condensate polisher in progress at the time or is it something that had been done jn recent weeks or recent days? Did someone leave a blockage in the pipe, or what happened? Mr.~ MACMILLAN. That was work in progress at the time, just prior to 4 o'clock in the morning on March 28. Mr. PEASE. I see. Thank you. Mr. ERTEL. Mr. Chairman, will you yield on that point? I wonder, you say you have not been able to identify exactly what happened in either the condensate pump or what mainte- nance they were doing. Has anybody other than you? Mr. MCCORMACK. I would like to request we get that question from utility operators. They will he the ones responsible for that part of it. Mr. ERTEL. I am asking if they did do that or somebody has got it. Mr. MACMILLAN. My suggestion is that information should be supplied by the operator. Mr. ERTEL. Do they have it, do you know? *Mr. MACMILLAN. I don't know. Mr. MCCORMACK. The next witness? PAGENO="0381" 377 Mr. WYDLER. Could I just get one thing clear in my own mind: This maintenance was actually in progress at this time, at 4 o'clock in the morning; there was something going on with maintenance? Mr. MACMILLAN. Yes; they were working on the condensate po- lishing equipment just before ,4 o'clock in the morning. I am not trying to dodge the question. I simply don't know the detailed sequences that the operators were going through that was the initiating event which caused the interruption in the feedwater flow, and I am sure that information is available. I just don't happen to have it. Mr. MCCORMACK. Go ahead, Mr. MacMillan. Mr. MACMILLAN. The first item was interruption of the auxiliary feedwater flow that did interrupt flow to both of the steam gener- ators so neither steam generator had feedwater flow going into it. Second, as a result of the initial reactor coolant system pressure and temperature increase, the pilot-operated pressurizer relief valve opened as designed, but did not reseat properly, thus allow- ing reactor coolant system pressure to continue decreasing. After approximately 21/4 hours, the operators recognized the data from plant instrumentation which indicated that the valve was open, and closed the block valve in the relief valve discharge line, thus preventing any further loss of primary coolant from the reac- tor. The third significant factor, the high pressure injection system, which had automatically actuated, as designed, on low reactor coolant system pressure, was prematurely terminated by the opera- tor even though there were simultaneous indications of an opening in the reactor coolant system pressure boundary, such as increas- ing quench tank pressure, decreasing reactor coolant system pres- sure and increasing reactor containment pressure. This led to a diminished capability to cool the reactor core as primary coolant inventory diminished. Subsequent analyses have indicated that there would not have been core damage or signifi- cant radioactive contamination and release if the operators had left the high pressure injection pumps in service to perform the core cooling function for which they were intended. You saw a demon- stration of that a little bit earlier this morning. Fourth, the containment isolated in accordance with the licensed design. That design was such that it permitted the transfer of some radioactive water from the bottom of the containment vessel into the auxiliary building and subsequent radiation released occurred from that source. Mr. WALKER. Mr. Chairman, could I interrupt? When did that occur in the sequence you are talking about? That's where most of the radiation that the public was exposed to came from. Where did that occur and was that a part of a proce- dure that would normally go into operation of your plant? Mr. MACMILLAN. I can get a specific time for you. Perhaps I can look up the specific time and get that answer, but it did occur in the early hours of the incident. The sump pump in the reactor building transfer water from the containment into the auxiliary building when the sump level in- creases to the point where that pump turns on. PAGENO="0382" 378 That sump line ultimately was isolated when the reactor build- ing pressure increased to 4 pounds, and the building containment isolation system came on as designed. Mr. WALKER. So, in other words, this was a part of the inherent design of the plant that allowed the radioactive water to move outside of containment? Mr. MACMILLAN. This particular piece of equipment or pieces of e4uipment performed as designed, and I think the significance~ of this item is the necessity to reassess the containment isolation philosophy, on the conditions under which I would call our isola- tion of the reactor building. Mr. WALKER. Isn't that somewhat of a design flaw we ought to correct to make. sure any radioactive water remains in contain- ment instead of being pumped out? Mr. MACMILLAN. That is something we need to reassess and modify. Mr. WALKER. Thank you, Mr. Chairman. Mr. MCCORMACK. Go ahead, Mr. MacMillan. Mr. MACMILLAN. Fifth, high pressure injection was evidently manually operated based on high pressurizer level indication. We have conducted reviews of data from Three Mile Island and per- formed analyses that lead us to conclude that the indicated pres- surizer level was not significantly in error. There was some discussion early after the accident that there was erroneous pressurizer level indication. Our own investigation would indicate that, in fact, the instrumentation indicated the pressurizer level was, in fact, indicating the amount of water that was in the pressurizer. Consequently, operation of high pressure injection flow should not have been based on the single parameter of pressurizer level. Finally, in addition to two reactor coolant pumps having been shut off at 73 minutes, the remaining two reactor coolant pumps were shut off at 100 minutes after the initiation of the incident. Although shutting off one reactor coolant pump in each loop in response to indications of low coolant flow may be advisable, shut- ting off all pumps under the circumstances then present is believed to have caused an uncovering of the core and a degradation in core cooling capability. Ultimately, at about 15 hours after initiation of the transient, the reactor coolant system was repressurized, and at about 16 hours a reactor coolant pump was restarted. In looking at these six factors we developed a set of four basic principles which we believe merit emphasis in considering any future action. First, renewed emphasis must be placed in the near term on administrative controls to assure that plant systems important to safety are not defeated. In the longer term, consideration should be given to whether plant systems to augment those administrative controls should be developed and implemented. Second, renewed emphasis must be placed on maintaining the individual operator's focus upon the fundamental physical process- es which assure core cooling, and on insuring that systems comple- ment or increase the likelihood of maintaining that focus.: Third, operator training programs must be reassessed and up- graded to emphasize these fundamentals. PAGENO="0383" 379 Fourth, any actions or modifications implemented must be con- sidered in the broader context of total plant safety. Hasty and ill- considered actions, which might be partially responsive to the TMI-2 events could, in certain cases, produce adverse impacts in other safety systems which were not involved at TMI-2. So we need to look at a total system impact of any changes that are made in the equipment. Now, Mr. Chairman, I know we are running way behind sched- ule. I had planned at this point to talk about the steam generator and unique characteristics and compare it with the recirculating generator. I will be glad to do that, but it would take some addi- tional time. Mr. MCCORMACK. Would you mind waiting a little while? If you can stay around until noon we might get back, but we have to hear the other witnesses. Would you mind; we will improvise our schedule. Mr. MACMILLAN. Perhaps I ought to move quickly to the closing observations which are directed at the question of technology impli- cations of the Three Mile Island accident. My comments are ad- dressed primarily at those aspects of the accidents which are in- volved in the prevention, to some extent mitigation, but certainly not recovery. It's too early I think to address the recovery implica- tions of the Three Mile Island incident. While the incident at Three Mile Island was certainly very un- fortunate and its seriousness should not be minimized, important lessons have been and will continue to be learned about electric power generation through the use of nuclear power. Three Mile Island has emphasized the importance of the man- machine interface and the need for translating the designer's con- cepts into unambiguous information and instructions for plant op- eration. With the advancements in electronic and computer tech- nology there are three general areas in which the man-machine interface can be improved. First, the measurement and display of the actual condition of vital operational equipment and instrumentation. We talked earli- er about perhaps the desirability of having a reactor vessel water indicator. That is perhaps an area where there might be some desirable work to be done. Second, the display of plant conditions in a format to enhance the operator's awareness of the system condition and trends or directions in which the system is moving. Clearly, an example would be something which would indicate to him very clearly and very vividly the temperature and pressure conditions in his reactor system, and whether he is approaching a saturation condition that might generate steam in the reactor cool- ant system. Third, remote visual monitoring of vital plant equipment to con- firm instrumentation indications already available. In addition to providing better display of plant conditions for the operator, recording plant conditions and being able to retrieve these data in graphic display would help with troubleshooting and subsequent diagnosis of operational problems by the plant engi- neers and designers. PAGENO="0384" 380 In other words, examine the parameters to be measured or moni- tored to assure that actual conditions are displayed; display these conditions to the operator in a fashion which is simple to under- stand; show graphically the important data and trends; assist the operator in diagnosing unusual conditions and suggest appropriate corrective measures and, finally, provide him with back-up remote visual means of confirming the operating status of vital equipment. Some people have called these suggestions "human engineering." The crucial lesson of Three Mile Island is the need to improve the man-machine interface and provide means of assisting the operator in both the operational and administrative aspects of his job. In conclusion, Babcock & Wilcox continues to be committed to nuclear power as a means of generating electricity to meet our Nation's needs. While the incident at Three Mile Island was seri- ous the lessons learned will enable the industry to better serve the Nation in future generations. That concludes my comments, Mr. Chairman, and I will be happy to stay here if it's your desire to discuss the generator later. Mr. MCCORMACK. With the indulgence of the members, I would like to hold off a discussion of the questions of the design, capacity of the steam generator until after we have heard the testimony of the other witnesses, and then we can have a special discussion on that point alone, because that may take some special time. So I am going to bypass my questions on whether the B. & W. design is too much of a hot rod, whether there is too little water in the system, whether the once-through system is adequate, and so on. Let me ask a couple of other questions very directly, and ask for quick answers, if I may. One of the problems that seems to have occurred is that with the high pressure injection system running we eventually were flood- ing the receiver tank, or whatever it is downstream from the relief valve, this was filling up the bottom of the containment vessel, and this tripped the sump pump and pumped out the water over to the red waste building. Water somehow or other was exposed to the ventilating system in the waste building, getting the Xenon-133 out through the venti- lating system. What I don't understand is why in the world there was not a large enough receiving tank inside the containment vessel to re- ceive the water from the high pressure injection system so it would have all been contained there and there would not have been any need to pump it out of the building. What is the volume? How long can the high pressure injection system run under normal conditions without being interrupted before it overflows the receiving tank inside containment? Mr. MACMILLAN. Well, under normal conditions, of course, the pilot operated or relief valve would have closed~ and that would have kept the pressure up, and there would not have been a necessity for high pressure injection. However, accepting the condition that the pilot operated relief valve stayed open, the quench tank is designed to receive the PAGENO="0385" 381 discharge from that valve or the safety valves and to quench that for some period of time, and I don't know what that period is. Mr. MCCORMACK. Well, given the fact we have had a situation now where we have actually both steam generators off, presumably because we had splashing steam in the system and the pumps were turned off so we were pumping water right through the reactor into a quench tank, it strikes me this scenario calls for re~~evalua- tion of the volume of the quench tank. Mr. MACMILLAN~ Normally what would be done in this circum- stance is that you would pump the high pressure injection into the reactor coolant system, wOuld go into the quench tank and the quench tank can only take so much water, and then it will open up. The intent of the system would be for that water to collect in the bottom of the reactor building and should be retained there. The difficulty in this sequence of events was water was pumped out of the bottom of the reactor building and into the waste tank and ultimately on the floor of the auxiliary building. It is not intended that the quench tank would be able to accom- modate the full capacity of the high pressure injection pumps. For example, a small break may occur some other place in the system which would not have access to the quench tank and the water would then spill out on the floor of the reactor containmnent and again would be expected to be retained there. Mr. MCCORMACK. Yes, Dr. Roy? Dr. Roy. I was just going to add that ultimately that water that is spilled to containment and maintained in the sump and will be recirculated back to cool the core. Initially, the high pressure injection system will take suction from the large storage tank in supplying the water and then ulti- mately when that storage tank is exhausted then the source of supply to the high pressure injection system will be from the sump, the water. Mr. MCCORMACK. Is that clean enough to pump back through the reactor? Dr. Roy. Yes, sir. Mr. MCCORMACK. OK. I have two quick questions. Who trains the operators for B. & W. plants? Mr. MCMILLAN. The operator training program is an extensive program involving classroom training and then simulator training and then on-site training, and we perform a segment of that total training program. Mr. MCCORMACK. You do part of it? Mr. MACMILLAN. We do the simulator training for the operators. We do offer the broader spectrum, but in the case of Three Mile Island it was the simulator training. Mr. MCCORMACK. Then the utility does the rest; is that right? Mr. MACMILLAN. Or someone they would hire to do that; yes. Mr. MCCORMACK. We don't have a standard for training opera- tors in this country? Mr. MACMILLAN. Each utility develops its own training program. Mr. MCC0RMACK. Generally, is B. & W. exploring the possibility of dramatically improving various pieces of equipment, such as 48-721 0 - 79 - 25 PAGENO="0386" 382 those that failed in this particular incident, such as the pressure release valves and those that did not provide adequate or provided confusing information? Is there an attempt now to review the whole concept, first of all being certain that valves will work, that equipment will work, being certain~ that the operators know whether it has worked or not and being certain that the operator has all of the information he needs easily understandable before him, in any sort of an anom- aly? Mr. MACMILLAN. Let me answer that in two parts, Mr. Chair- man. First of all, the piece of equipment which failed to perform was the pilot operated relief valve, and we are working with the sup- plier of that valve to enhance the probability of its performing its function. The other question with respect to the instrumentation and the information available to the operator, yes, we are working on that. We are developing a technique by which we can indicate the actual position of the relief valve or that indicates unambiguously wheth- er it is opened or closed. We are working on other instrumentation systems which will give the operator a clear indication of the temperature and pres- sure conditions in his reactor coolant system and alert him to the possibility that he may be approaching saturated conditions in that system. Mr. MCCORMACK.' Thank you. Mr. Wydler? Mr. WYDLER. You are going to try to have some sort of notifica- tion device to know if the valve is not only opened but that it is closed again, and that will be part of what you are going to do so you know that fact. Is that what you just said? Mr. MACMILLAN. Yes, sir. Mr. WYDLER. I am intrigued with this auxiliary feed pump being shut off. I mean that seems to me like an almost unbelievable thing for somebody to do and leave like that. Yet, I am reading here about something that happened in 1975, apparently the exact same thing took place, some plant operator turned off the very same valves. The manually operated water supply valve, two auxiliary feed- water pumps were shut and they didn't have a supply of water. Because that is a manually operated valve, there was no control panel indication that the valve had been closed. At least the one auxiliary feed water pump must operate to remove heat, and so on. Now, that was the exact same thing that happened here, wasn't it? Mr. MACMILLAN. I am not familiar with that particular situa- tion. ~ Mr. WYDLER. Calvert Cliffs, unit 1, Lusby, Md., December 1975. Mr. MACMILLAN. I would say, as you have read the description of events there, I don't believe it is exactly comparable. The isolation or block valve in this auxiliary feedwater system is indicated in the control room and can be operated from the control room, and was operated and opened up 8 minutes into the incident. So it was not PAGENO="0387" 383 a case of some manual valve having been closed without the opera- tor's awareness. These valves are indicated in the control room and can be opened from the control room. Mr. WYDLER. So you mean to say that everybody knew then-we were told this was something that they found out after a while- that somebody had turned these valves off. Literally they had done it intentionally and it was done and there was a constant indica- tion they were shut at the time the accident took place; is that what you are saying? Mr. MACMILLAN. I don't believe I said they knew they were shut. What I said was the position of the valves are indicated in the control room and the operator did not recognize until about 8 minutes into the accident that they were, in fact, closed rather than being open as they should have been, and at that point he did take the action to open up those valves. Mr. WYDLER. There is one other case here I was reading about, a situation where apparently-have you been shown at any time this report that was written on January 8, 1979? A Commission inspector complained about the Babcock & Wilcox designed nuclear plants, wrote a report about it and insisted that the report be made public. He said that there were basic safety problems with your design. This was a regional inspector; have you ever seen this report? Mr. MACMILLAN. Could you identify it more specifically? Mr. WYDLER. January 8, 1979; I don't know why it's written in these very vague terms, but here's the information I have. A Com- mission inspector, unidentified, wrote a memorandum on January 8, 1979, stating there appeared to be generic safety problems with Babcock & Wilcox designed nuclear plants. The regional inspector asked that his memorandum be forwarded to the Atomic Safety and Licensing Board. Have you ever seen that memorandum? Mr. MACMILLAN. I don't recognize it by that description. Mr. WYDLER. Have you, Dr. Roy? Dr. Roy. No, sir. Mr. WYDLER. I understand it was brought to the attention of the operators of Three Mile Island the day after the accident, which would have been a little late. I am surprised that you gentlemen, even at this date, have never seen or heard of this report. I am told on March 6-that was the date of the accident-finally after a lot of pressure was put on a lot of people, a Commission's Assistant Director for Light Water Reactors also recommended that those atomic safety and licensing boards with jurisdiction over Babcock & Wilcox designed plants be informed of the regional inspector's safety concerns. He specifically recommended that the board for Three Mile Island powerplant be informed. Mr. MACMILLAN. I think I have identified the memo that you are referring to, Congressman. I believe this is a report by a reactor inspector named J. S. Creswell, in a memorandum he addressed to NRC. Mr. WYDLER. You know more than I do. That's probably so. PAGENO="0388" 384 Mr. MACMILLAN. That's why I was having trouble identifying it. This is dated January 8, 1979, and the subject was conveying new information to licensing boards, Davis-Besse 2 and 3 and Midland units 1 and 2. Those four units are under construction and they do incorporate Babcock & Wilcox nuclear steam systems, and we have seen that letter and we have responded to that letter as it is applicable to Three Mile Island. Mr. WYDLER. When did you respond? Mr. MACMILLAN. We ought to get you a more detailed break- down of that. The letter Mr. Creswell wrote referred to a rapid cooldown which occurred at the Sacramento Municipality Utility District at Rancho Seco District, which is the background for which he raised his concerns. I am prepared to tell you, if you want to know, how they would respond to that cooldown and what its applicability was to Three Mile Island. Mr. WYDLER. I am asking when was the report brought to your attention and when did you respond to it? Mr. MACMILLAN. I am not able to identify, Congressman, that this was brought to our attention, this particular Creswell letter was brought to our attention. We were aware of that because it was made public. We recognize that it was referring to the earlier incident at the Sacramento unit. We were responsive to that earlier incident at the Sacramento unit and had alerted our operators to the problem that developed there, and had discussed the implications of that with the people at Three Mile Island. Mr. WYDLER. I am going to have to get off this topic, but I just would like to know, have you a copy of the report? Does your company have a copy of the report? Have they made an answer to it? Mr. MACMILLAN. We have a copy, but I don't believe we have it because it was brought to our attention through the normal licens- ing channels. Mr. WYDLER. In other words, you have never been officially informed of it; is that what you are telling me? Mr. MACMILLAN. I believe that is the case. I can confirm that. Mr. WYDLER. Well, would you and would you make available for the record the copies of the report and any memorandum or an- swers that you made to it? Mr. MACMILLAN. Yes, sir. Mr. WYDLER. And if you would, if it's not apparent on the face of the document, would you give me a time sequence of these items, if it is not otherwise apparent from the documents you are going to supply? Mr. MACMILLAN. Yes, sir. Mr. WYDLER. All right. Thank you, Mr. Chairman. [The information follows:]* Mr. MCCORMACK. Thank you, Mr. Wydler. *This information is provided in Mr. MacMillan's letter to Congressman Wydler of May 29, 1979. A copy of this letter is included in the Appendix "Questions and Answers for the Record", for May 23, 1979. PAGENO="0389" 385 This particular series of questions and answers raises the point that there will undoubtedly be questions submitted~ in writing to Mr. MacMillan, and I assume you will be prepared to answer them. Mr. MACMILLAN. Yes, sir. Mr. MCCORMACK. Mr. Ertel, do you have any questions? Mr. ERTEL. Thank you, Mr. Chairman. Mr. MacMillan, on page 12 of your testimony you indicated as one of the significant events, the second one you said: After approximately 2¼ hours the operators recognized data from plant instru- mentation which indicated the valve was opened, including quench tank rupture at 17 minutes, and closed the block valve in the relief valve discharge line, thus preventing any further loss of primary coolant. Can you give us any reason it would take 2¼ hours if there were proper instrumentation to read out that line was open, why it would take 2~/4 hours to recognize that relief valve had not reseat- ed? Mr. MACMILLAN. I think I commented earlier on one of the questions that the evidence that was available to the operator that the valve was open included a thermocouple on the discharge piping from the valve that goes to the quench tank, the quench tank pressure and level, which is alarmed, and indicated on a panel in the control room. Mr. ERTEL. It indicated it was over-full, did it not, that the water level was high? Mr. MACMILLAN. Yes, sir, and should have been a clear indica- tion that there was energy being discharged and water, steam being discharged, through this tank on a continuing basis. Mr. ERTEL. I guess that the next question would follow on: The simulator which you use, ançl I think you have one at Lynchburg, Va., on which you train the operators, is~there any training there to show that by utilizing both the temperature readout and the quench; thaj. there is too much water, if you want to call it that, in the pressurizer, what you should do? Do you have a training program on it? Mr. MACMILLAN. The simulator in Lynchburg is capable of simu- lating th~ condition of an open pilot operated relief valve and that is one of the equipment failures which we do simulate in the course of the training of the operators. Mr. ERTEL. So you would say that he should check both the temperature and the water level in the pressure? Mr. MACMILLAN. In the quench tank. Mr. ERTEL. So that he would have that training and he should know that, the proper procedure to follow? Mr. MACMILLAN. He had been through that and he had a proce- dure available to him for that purpose, yes. Mr. ERTEL. Do you have any idea how long prior to this accident this operator had gone through that training program with the simulator? Mr. MACMILLAN. I don't know specifically. Mr. ERTEL. I know I have a lot of questions but I want to turn now to page 13, the fourth item: "The containment isolated in accordance with the license design." It's my understanding that the purpose of the NRC, at least some of their ideas are to make sure that there is a contain- PAGENO="0390" 386 ment and none of the radioactive material gets outside of the containment building. Now, is that a policy of the NRC and if so, why would they license a design which would allow for the escape of radioactive material to the atmosphere? Mr. MACMILLAN. Let me say that it is certainly the intent of the containment building to contain the contents of an accident that might develop in a reactor coolant system and keep that radioactiv- ity in the reactor building. As I indicated earlier, clearly the design basis for this containment isolation system needs to be and will be re-evaluated. Mr. ERTEL. I don't think that is really a response to the question. Why would they give a license if their policy is to have a contain- ment? That is what a containment building is for, it seems to me, is to contain and isolate. Then do you know how you got your license application through with a license design which would allow escape into the atmos- phere if the policy says there should be a containment? Mr. MACMILLAN. Well, the containment was designed to isolate when the containment pressure got up to 4 pounds. Now that would normally occur if there were a moderate to large size coolant system break. In this particular case, the break was very small and the pressure did not build up to that level for some time into the incident and it was during that time when the water was trans- ferred. So I think that I would have to speculate that the line of think- ing at the time was that in the event a loss of coolant accident the building pressure will go up to 4 pounds and it would isolate, and there was not a recognition of the potentiality of a very small break creating this situation. Mr. ERTEL. So what you are saying is we have a mistake prob- ably in both the design and the licensing procedures, because they did not consider a small pipe break. Is that what you are saying? Mr. MACMILLAN. That is my opinion, yes, sir. Mr. ERTEL. Thank you. Thank you, Mr. Chairman. I will submit a lot of questions in writing. Mr. MCCORMACK. Thank you, Mr. ErteL We are going to our next witness now. Mr. MACMILLAN. We want to thank you. We have taken, as is usual, attempting to get our feet on the ground, more time with one witness than is really fair to the other witnesses. Maybe we will pick some of that up as we go along, because we have gained a lot of information from this discussion. I want to thank you and ask you if you will stand by for the rest of the hearing? Mr. MACMILLAN. Yes, sir. Mr. MCCORMACK. Thank you. Our next witness is Mr. Herman Dieckamp, president, General Public Utilities Corp. We want to welcome you. I recall seeing you the day after the accident on Thursday, when Mr. Fuqua and I and others from the PAGENO="0391" 387 committee visited you, we are still trying to understand what was going on. Your testimony has been received by the committee and will, without objection, be inserted in the record at this point with all supplemental information. [The prepared statement of Mr. Dieckamp follows:] PAGENO="0392" 388 Testimony by Herman Dieckamp, President General Public Utilities Corp. The accident at Three Mile Island on March 28, 1979 has had a profound and shocking impact on the residents of central Pennsylvania, Met-Ed and GPU, our customers and employees, and on the future of nuclear energy. While nuclear power plant systems and procedures have been designed to accommodate extreme malfunctions of both equipment and personnel, the reality of this accident has had a far greater impact than we could have ever projected. We pledge our sincere support and cooperation in the efforts of this committee to make known and to assess the full meaning of this accident. At the outset we would like to emphasize that we do not in any way wish to minimize the significance of this accident and we seek no excuse from our responsibilities as plant owners and operators. We strongly believe that it is important to understand the factors which contributed to this accident and to the ability of our Company, government agencies and the affected population to cope with it. If this accident is viewed simply as a matter of management or operator failure, the full significance of this experience will be lost. The accident was a result of a complex combination of equipment malfunctions and human factors. The accident departed from the accepted design basis for current nuclear plants. The response of all organizations was influenced by the fact that it was the first accident of this magnitude in the history of the U.S. commercial nuclear power program. It is our hope that this testimony and these hearings can contribute to an understanding of this accident, the many complex factors that led to it, and the critical learning that we are obligated to derive from it. ACCIDENT CAUSES We would like to focus this portion of the testimony on our initial im- pression of the primary causes of the accident. We do not propose today to present a detailed description or sequence of events for the accident. We are in general agreement with the NRC testimony on this subject as previously PAGENO="0393" 389 presented to the U.S. Senate Subcommittee on Nuclear Regulation. We may, however, differ somewhat on the relative importance of the various ingredients of the accident. While extensive data and information have been made available Met-Ed and CPU have not completed a detailed reconstruction of the accident or verified the relative importance of the many ingredients. The following appear to be the major causes of the severity of this accident. a) Shortly (4 sec.) after the turbine and reactor trip at about 4:00 a.m. on March 28, a reactor coolant system pressure relief valve opened to relieve the normal pressure excursion, but the valve failed to re- close after the pressure decreased. The operator was unaware the valve had not closed. An order for valve closure was signaled in the control room. The operator monitored temperature near the valve to indicate valve position. However, the temperature did not clearly confirm the continuing coolant flow thru the valve. The loss of reactor coolant and accompanying reactor coolant system pressure decrease continued for about two hours until the operator closed the block valve which stopped the uncontrolled loss of reactor coolant. b) The operator anticipated reactor coolant system behavior and immedi- ately began to add make-up water to the system. When system pressure decreased to 1600 psi about 2 minutes into the accident the High Pressure Injection (HPI) safety system was automatically initiated. Four to five minutes into the accident the operator reduced injection of water from the HPI system when pressurizer level indicated that the system was full. PAGENO="0394" 390 c) Operator training and experience had emphasized the retention of a steam vapor space in the pressurizer. However, following the rapid depressurization of the system, the pressurizer level indicator inferred a fullness of the reactor coolant system. This level indication led the operators to prematurely reduce HPI flow. The operator apparently did not anticipate that continued depressuriza- tion could lead to steam void formation in hot regions of the system other than the pressurizer and that under these conditions his level or fullness indication was ambiguous and misleading. d) Because of the presence of steam voids in the primary system, indi- cated primary coolant flow decreased. The operator turned off the main coolant pumps in order to prevent damage to the pumps. The plant staff expected cooling by natural circulation. Voiding pre- vented natural circulation and prevented reestablishment of pumping. e) An emergency feed system, designed to provide cooling to the steam generators in case of loss of the normal feed water system, was blocked because of two closed valves. This system would have been available to provide secondary cooling. The operator discovered this condition and initiated secondary system emergency cooling by opening the closed valves 8 minutes after the start of the plant transient. The plant safety system surveillance program had called. for the placing of these valves into the closed position six times during the first 3 months of 1979 for testing of the operability of the pumps or valves. The surveillance program required a verification of valve position twelve times during this period. The last test of the emergency feed system was conducted on the morning of March 26, about 42 hours before the March 28 accident. PAGENO="0395" 391 f) Primary coolant initially vented through the pressurizer relief was pumped into the auxiliary building because the containment design did not require isolation until building pressure reached 4 psi. Continued plant operation required some transfer of fission products to the auxilliary building. The first five of the above factors led to severe undercooling of the reactor core. The fuel became extremely hot and the integrity of the fuel cladding was lost. The first indication of fuel cladding damage and fission product release came with high radiation alarms. An extensive reaction between fuel cladding and primary coolant steam liberated large quantities of hydrogen gas into the primary reactor coolant system. The resulting configur- ation of the reactor core is still the object of analytical attempts to reconstruct the accident. At various times during the day of March 28 as the operators worked to reestablish control of system cooling, the core suffered additional overheating and damage. Forced cooling of the primary system was reestablished at about 8:00 p.m. on the 28th. A summary sequence of events is attached as Appendix A. Performance of the plant operators has been the subject of much specu- lation. Their performance must be viewed in the context of: 1. Ambiguous and contradictory information relating to pressurizer level and relief valve closure. 2. The experience and training underlying the operators' emphasis on maintaining pressurizer level. 3. The operators' awareness of equipment limitations. 4. The time and opportunity to assimilate large quantities of data with varying degrees of physical and chronological availability. PAGENO="0396" 392 The operators on duty at the time of the accident are a qualified and competent group. They performed their functions professionally in a period of extreme stress. Our own investigation and the many other governmental investigations will ultimately attempt to determine the role of operator performance in this accident. PLANT STATUS - CURRENT AND FUTURE The plant is stable and in a cold shutdown state. The fission product decay heat being liberated in the damaged reactor core/fuel is just slightly in excess of 1 Mw thermal (O.04E of full power). This power level is normal for this time after a reactor trip. The core is being cooled by the natural circulation of primary reactor coolant. No primary system pumps are required in this mode of cooling. The average temperature of the primary coolant is about 175°F. As a result of local flow restrictions associated with the physical damage to the core, the highest in-core thermocouple reading is about 3OO~F.. The heat from the reactor is being rejected through one steam gener- ator and the plant condenser. An immediate objective of the activities at the plant has been to establish a redundant heat removal path through the plant's second steam generator and an intermediate heat exchange loop without using the plant condenser. This will enable the transport of the core heat through the plant's two steam generators for ultimate rejection through two independent secondary paths. The objective is to minimize the number of active components that must func- tion in these circuits in order to ensure reliable heat removal. The plant has been in the natural circulation mode since April 27, 1979. The plant's several and original emergency cooling capabilities are available to backup this cooling approach. One of these systems, the plant's decay PAGENO="0397" 393 heat removal system has been the subject of a high priority effort to upgrade the ability of that system to miminize releases to the environment while operating with high primary coolant radioactivity. As part of this effort, work has been under way to enable the installation of redundant backup modules in addition to the two that are part of the plant design. DEVELOPMENT OF UNDERSTANDING The accident differed from the popular perception of common accidents because of the extended time necessary to achieve a full definition of its scope. In this case, the time required to develop areasonably complete understanding of the accident and its result was approximately 2-3 days. It should be stressed that while the full impact of the accident was not fully evaluated, there was sufficient understanding of system conditions to maintain plant cooling stability during this period. There were three key areas in which full evaluation required time: 1. Assessment of the degree of core damage. 2. The generation of hydrogen gas during the accident and a)its potential impact on system heat transfer and b) its implications relative to core damage. 3. The impact of continued operations on the potential for re- lease of radioactive material from the plant. The accident's initiating event was a loss of feedwater flow. During the first few minutes following this event, the plant staff attempted to recover from what they thought was a normal transient. Beyond this time, the plant behavior became inceasingly abnormal. The loss of coolant vis the reactor coolant system relief valve was identified and the valve was isolated around 6:20.a.m. At approximately 6:50a.m. several radiation alarms alerted the PAGENO="0398" 394 staff to possible reactor core damage. In the time period of 5:30-7:30 a.m. the reactor core became uncovered and suffered extensive damage, including significant zirconium-water reaction. During the next 12 hours, the operators attempted a number of strategies to establish dependable core cooling. This objective was achieved about 8:00 p.m. on March 28, at which time the plant symptoms included: a) Some local reactor coolant temperatures were above coolant saturation temperature. b) High radiation levels existed in the reactor containment and the auxiliary buildings. At this point in time the high radiation levels indicated that fuel damage had occurred but the extent was not defineable. The complicating presence of hydrogen gas in the primary system had not yet been detected. A preliminary sequence of events was being extracted from the various plant records by the afternoon of March 28. The data for the 16-hour accident period became available in summary graphical form on the morning of March 29. The probable occurrence of a zirconium - water reaction and the presence of hydrogen gas in the reactor containment building was deduced during the the evening of March 29 from containment pressure records that indicated a pressure spike during the accident. The size of the hydrogen gas bubble in the reactor coolant system was first measured from system data just after midnight March 30. The concentration of hydrogen gas in the containment building was determined from analysis of the first containment gas sample taken about 4:00 a.m. on March 31. The first quantitative data with respect to fission product release and degree of reactor fuel damage became available via analysis of a primary coolant sample taken at 5:00 p.m. on March 29. The data PAGENO="0399" 395 on hydrogen and fission product release provided the bssis for the next level of core damage evaluation. The point of the above enumeration is simply to indicate the time neces- sary to gain insight into the scope of the accident and, in turn, to provide the basis for a meaningful~analysis. In any review of the timeliness of the accident assessment, it must be remembered that the plant management and staff faced immediate, continuing and first priority demands to maintain the damaged plant in a controlled and safe state. LEARNING FROM THE EXPERIENCE As a result of the accident, we can already with hindsight, identify many areas that should be reviewed-in depth, including emergency planning, operator training, reactor design philosophy, man machine interface, financial risk diversification, and crisis management procedures, to name a few. While the list of specific areas is already large and growing, it is still too soon after the incident to define and implement specific actions. The lessons of TMI-2 should be identified and applied only after an objective review of the accident and its aftermath. We must resist pressures to act precipitously. In the following-sections I will attempt to present a general perspective on some things that the nuclear industry and the various government agencies should be reviewing. I shall not attempt to present complete answers to the host of questions raised by the ThI-2 accident or detailed recommendations for changes in nuclear plant design, operations, or regulations. (1) Physical Data The accident at TMI-2 produced a large amount -of technical data relating to the behavior of materials and systems under extreme accident conditions. A major contribution the government can make is to play a leadership role in PAGENO="0400" 396 evaluating the physical data and material resulting from the accident. This should include an examination of the damaged core and an assessment of the damage in relationship to the extreme environmental conditions imposed by the accident. Such data must be of great value in the future evaluation of emergency cooling criteria. The accident has also resulted in a large number of components having been subjected to intense radiation and thus consti- tuting a wealth of information on environmental effects and failure modes. (2) Design Philosophy Among other things, the TMI-2 incident control and recovery activities suggest areas of design philosophy that should be carefully considered. Specific areas that merit attention include: a. An overall review of the complexity of nuclear power plant systems to assure that in the light of required surveillance and increased opportunity for human error, additional systems add incrementally to the safety of the plant. We should seek affirmation that the design criteria are being met by the simplest and most direct approach. b. The design tradeoff between minimizing pressure vessel penetrations to provide assurance of primary system integrity and the ability to accommodate unforeseen needs for additional access to the primary system, eg. for instrumentation or venting, c. The ability to place a stricken plant into a relatively passive and stable mode with minimal reliance on active components (i.e., pumps, instruments, power supplies, etc.) whose reliability may have been degraded by the accident and its aftermath. An example is reliance on natural circulation in the primary coolant system. An envelope PAGENO="0401" 397 of conditions (decay heat levels, pressures, temperatures, equipment integrity, etc.) under which each particular plant may be safely placed in a natural circulation state might be developed, along with operating procedures and operator training in such pro- cedures. Design modifications to enhance natural circulation capa- bility might also be considered. another example is pre planning for operation with minimum instrumentation. d. The ability of electrical components (monitors, controls, pressurizer heaters, instruments), pump seals, and other equipment to survive under post-accident conditions potentially involving abnormally high temperatures, humidity levels, radiation levels, flooding, and emergency usage. In many cases, this ability may be enhanced by hermetic sealing or relocation to places not prone to flooding or collection of highly radioactive liquids or gases. In other cases, additional redundancy and diversity may be preferable. e. Improved ability to assess equipment status and environmental conditions with emphasis on areas of the plant where post-accident access may be prohibited by high radiation levels. Examples include ability to extract primary coolant samples including pressurized samples for dissolved gas analysis, measurement of radiation levels within containment and in other areas where primary coolant dispersal could occur, and measurement of water level within containment. Im- proved methods of ascertaining hydrogen gas concentration and explosion potential in the containment atmosphere would also be helpful. f. Facilitation of emergency modifications, such as special interface provisions for emergency closed loop cooling systems or other pieces of equipment whose temporary installation could reduce the risk of radiation releases and contaminatiaon of permanent plant equipment. 48-721 0 - 79 - 26 PAGENO="0402" 398 (3) Man/Machine Interface A review of the causes of the TMI-2 accident indicates one of the as- pects of nuclear plant design and operation that requires attention is the control room. The design of the control room and the philosophy of provid- ing operators with information needs to be reviewed. The opportunities for improvement in this segment of plant design includes; a. The ability of the operator to quickly and unambigously determine the status of key systems or components. For example, valve closure indications, key system flow rates, etc. b. The ability of the operator to fully determine the operational characteristics of important plant systems, such as the determina- tion of the degree of coolant boiling in the primary system or the actual level of fluid in the primary system. c. A review of the human engineering of reactor control rooms in order that an operator's ~attention is directed and prioritized to malfunc- tioning or prolematical areas of the plant's safety systems. d. The design of the control room should emphasize consideration of accident mode operations. e. - Enhanced ability for communication both inside the control room and within the plant, such that all:key personnel are fully cognizant of plant status at all times. Particular attention should be paid to the problems associated with plant operation when the plant is in a contaminated state. This category also includes the ability to communicate significant plant data to offsite locations. PAGENO="0403" 399 (4) PLant Staffing/Operator Training There are a number of aspects of plant staffing and operator training that should be reviewed. We believe that the on-site presence of more senior nuclear reactor engineers with significant operating experience could be of substantial benefit. The mature judgment of such individuals could complement the ability of the operators to immediately respond to plant difficulties and be immediately available in the event of crisis. In the area of operator training, we believe that additional emphasis should be placed on fundamental principles of plant operations The critical nature of the need for adequate core cooling at all times must be stressed. In this regard, greater attention should be paid to ranking the objectives of operator action in order of priority (i.e., accepting minor equipment damage to reduce risk of major damage, accepting major damage to reduce risk of radiation releases, etc.) Training should enhance operator knowledge of plant behavior under abnormal conditions. Operator qualifications should include such knowledge and the development of the capability of almost instinctive proper reactions through routine simulator experience. Finally, while the adherence to procedures must be emphasized, the ability of the operator to gain knowledge and understanding of situations to determine when combina- tions of procedures are required or when procedures are not applicable should be improved. (5) Emergency Support Team The level of effort to effectively manage the aftermath of a major nuclear accident will always be greater than that required for managing ruotine operations. Additionally, coping with an emergency at a nuclear power plant will require that resources far beyond those normally available at any plant site be assembled and placed into effective action as quickly as PAGENO="0404" 400 possible. Technical and management support are needed to: a) assess and understand the status of the plant and how this status came about; b. identify and provide pre planning and procedures for contingencies. c) identify and evaluate alternative courses of action to improve the plant status and minimize public risk; d) control radioactivity releases and monitor accurately those that are unavoidable; e) reinforce plant systems and equipment to assure safety on a long-term basis. One of the bright spots in the TMI-2 experience has been the support provided by the entire utility and nuclear industries. A wealth of technical and management talent, as well as vitally needed equipment, was provided quickly at our request. This type of support Is vital for rapidly gaining control over emergency situations and for engendering public confidence that the best talent in the world is on the job to *ensure its protection. Con- sideration should therefore be given to establishing, on an industry-wide basis, one or more emergency support teams to provide the needed talent in an even shorter time than it took to assemble the TMI team, and to prearrange the organizational and logistical deployment and direction of such a team at each nuclear plant. This would involve: a) review and, if necessary, extend each nuclear utility's emergency planning to include an emergency organizational structure into which the support team would interface; b) development of criteria for calling the emergency support team into action; PAGENO="0405" 401 c) participation by NRC and other government agencies, not only for their technical contributions, but also to ensure complete and thorough communication with the federal resources and expeditious NRC approval for `off-normal" actions and procedures; d) development of the composition and organization of the team it- self. Functional areas that should be represented include plant operations, existing plant systems design including instrumenta- tion and control systems, emergency modifications engineering and construction, plant operations analysis under abnormal con- ditions, radioactivity contamination and release control, health physics, site logistics, and public information. A separate advisory group may also be desirable. The teams would be as- sembled with utility and vendor personnel, who would, as a team, undergo periodic training exercises and be available on a quick-reaction basis. Let me also emphasize the demanding logistics of assembling and maintain- ing a large emergency support operation site merits advance consideration by each individual nuclear utility. (6) Emergency Equipment Pool Any future nuclear plant emergency will undoubtedly call for rapid on-site availability of equipment that is not normally available. Considera- tion should be given to developing and maintaining, on an industry-wide basis, a pool of such equipment that would be useful in a nuclear plant accident to control radioactivity releases, reduce reliance on existing plant equipment whose reliability may be uncertain because of exposure to stressful environ- mental conditions (heat, humidity, radiation), to handle large volumes of radiation waste. The emergency equipment pool might include: PAGENO="0406" 402 a) filters, demineralizers, etc., needed to control radioactivity re- leases or contamination; b) pumps, piping, heat exchangers, etc., or packaged emergency cool- ing systems; c) respirators, air compressors and other equipment needed to support operations in highly cdntaminated areas; d) tanks for interim storage of large volumes of radioactive liquids; e) containers for radwaste and corttaiminated material, including used filters, resin, tools and equipment, etc. Both short-term on-site storage followed by off-site disposal and long-term on- site storage should be considered in establishing criteria for these containers. This equipment should be available in air and truck transportable pack- ages. In addition to determining what kinds of equipment should be available, consideration should be given to how these equipment items interface with existing plants. (7) Communication The TMI-2 accident emphasized a number of deficiencies in our ability to communicate relevant facts both internal to the GPLJ and Met-Ed organiza- tion and to the public. Internal communication difficulties exacerbated the inherent difficulties in our external communications systems. A major source of interenal communication difficulty was the constrained number of telephone lines in and out of the plant and the control room. Addi- tionally, the scarcity of qualified communicators both inside the plant and throughout our organization led to additional stress on the part of the plant operators who were also being used as communicators. This increased the potential for misinformation being conveyed to the civil decision makers. PAGENO="0407" 403 The experience further emphasises the need for knowledgeable information assumption in all involved organizations. It is clear our external communications, particularly in the early days of the accident could have been improved. The errors in judgment which were made in early, optimistic assessments of plant status, were based upon an incomplete understanding of the then current situation. Later, nuances of difference between various organizational spoke- persons caused the media to highlight discrepancies and thus confuse the pub- lic. Ultimately, we decided the public interest would best be served if we allowed NRC to act as the sole, source of "official' information about the TMI-2 accident. Clearly, the public information aspects of emergency planning merits careful consideration. A fine balance must be struck between giving out too little information, thereby giving an impression of secrecy, and giv- ing Out too much information or giving it out prematurely and conveying an image of confusion and uncertainty. Procedures to disseminate credible and objective information to the public through a single authoritative source, who is identified at the onset of the emergency, should be established. Most importantly, the plant staff needs to balance the demands for factual plant information with the priority demands to maintain the plant in a controlled and safe state. Finally, if we are to utilize nuclear energy for a significant portion of our countries energy needs, we need to convey to the public a much better understanding of the character of this technology including its benefits and risks. PAGENO="0408" 404 CONCLUSIONS The term "learning experience" doesn't begin to describe the ThI-2 accident. Nobody can afford such expensive "lessons', and this may be one of the most important lessons of all. Insights gained from a comprehensive re- view of this accident and its aftermath will need to be implemented in order to eliminate the risk and consequences of a future accident of this magnitude. However, these insights must be applied with care. Wholesale plant modifica- tions, hardware additions, changes in operational procedures, etc., may not provide improvement in real safety. We need to remember that every new piece of hardware brings with it new failure modes that must be analyzed for protec- tion adequacy. Existing designs and design philosophies should not be dis- carded until we are sure that the changes offer real improvements. Two things are needed if nuclear power is to benefit from TMI-2; follow- through on the part of the nuclear industry and its regulators to seek out and apply the lessons of this incident, and a recognition on the part of the public and the utility commissions that it is in everyone's best interest to maintain a viable nuclear program and viable utilities to implement this progrOm. Let us hope that both of these will be forthcoming. PAGENO="0409" 405 Appendix A Preliminary Description of Three Mile Island Unit 2 Accident 1. Normal Operation The Three Mile Island #2 nuclear unit shown schematically in Figure 1 is a pressurized water reactor. The system normally operates with primary sys- tem temperature of about 5800 Farenheit and pressure of about 2150 pounds per square inch. The reactor core (1) is the heat source in a nuclear power plant. It is in this region of the system where the nuclear reaction takes place. The rate at which heat is produced in the core is regulated by the control rods. This is the system that shuts down the nuclear reaction when requir- ed. In normal full power operation 2772 MW of heat is produced in the reactor core. It is important to note that even after the nuclear reaction is stopped, heat continues to be produced by the fission products within the core. Immediately after shutdown from full power this heat is about 100 MW, a week after shutdown 6 MW, and a month after shutdown decreases to 3 MW. The heat which is produced in the reactor core is transferred to the primary reactor coolant (purple) and circulated by the reactor coolant pumps (2) within this closed system through the steam generator (3). The heat which has been produced in the primary system is transferred to the secondary sys- tem (green) through the steam generators where steam is produced (light green). This steam is then circulated to the turbine. The steam turns the turbine (4) which turns the generator (not shown) producing electricity. This steam is then condensed (5) and is recirculated back to the steam gen- erator by means of several pumps and heaters. In the schematic, only the condensate pumps (6) and feedwater pumps (7) are shown. Two thirds of the heat produced in the primary system must be discharged as waste heat and is removed from the secondary cooling system by means of cooling towers. This heat rejection system is shown in blue. A key piece of equipment in the accident was the pressurizer (8). The pur- pose of the pressurizer is (a) to maintain the high pressure in the primary system and to assure that primary coolant is maintained in a liquid or non boiling state and (b) to absorb changes in volume as the primary system heats up and cools down. In normal operation, the only steam present in the primary system is in the pressurizer (light purple). The water level in the pressurizer (9) is in- dicated in the control room by the pressurizer level indicator, If pres- sure in the primary system gets too high it is relieved by the automatic opening of the pressurizer relief valve (11). 2. Accident Sequence on March 28,1979 Approximate Time 4 a.*m. A malfunction in the secondary. system (green) caused a condensate pump (6) to turn off. This resulted in (t = 0) the automatic tripping of both secondary feed pumps (7), which in turned caused the turbine (4) to trip. The tripping of the feed-water pumps caused a reduction of heat removal to the steam generator. PAGENO="0410" 406 When heat removal from the steam generator (9) was reduced, it began to heat up and, in turn, the primary system began to heat up. (t = 2 sec. ) The loss of normal secondary feedwater flow caused the actuation of theemergency feedwater pumps (10). (t = 4 sec.) As the primary system heated up, pressure increased. When it reached 2255 psi, the pressurizer relief valve (11) opened to relieve pressure. In opening to vent excess pressure this valve was operating as expected. (t = 9 sec.) The nuclear reaction occurring in the reactor was auto- .inatically shut off as pressure reached 2355 psi. At this. point in the accident everything has occurred as would be expected and as designed. (t = 12-15 sec.) By venting thru the relief valve, reactor pressure was reduced to 2205 psi; at this point the valve (11) should have closed but it didn't. This was the first abnormal occurrence in the accident (NRC item #2). It should be noted that the operator was unaware that the valve had not closed. An order for valve closure was signaled in the control room. As time passed the op- erator monitored temperature near the valve to indi- cate valve position. However, the temperature did not clearly confirm the continuing coolant flow through the valve. The primary reactor coolant continued to vent through the open valve into the drain tank (12) and pressure continued to drop. ~In response to the anticipated ~normal transient be- havior the~ operators began:to inject water into the system through the make-up system (13). (t = 39-41 sec.) The emergency feed pumps (10) actuated at 2 sec. achieved discharge pressure at 15 sec. were called upon to provide cooling to the steam generator (3). However, the block valves (14) on that emergency feedwater system had been inadvertent- ly left closed (NRC item #1) and the system was unable to function as intended. The relief valve (11) had already opened at this point so that the availability of the emergency cooling system on the secondary side could not have prevented the actuation of this valve which ultimately failed to close. (t = 2 mm.) Pressure decreased to 1600 psi. At this point the high pressure injection (HPI) emergency core cooling system (ECCS) is automatically initiated (13). (t = 2 mm. 12 sec.) The Drain Tank pressure increased to the point where small amount of coolant is released through the drain tank valve (not shown) and begins to collect in reactor building sump (15). PAGENO="0411" 407 At t = 14 minutes 50 sec. the drain tank rupture disc blew due to continued release of reactor coolant thru the failed pressurizer relief valve (11). Large quantities of water begin to spill from the drain tank. (t = 4 mm. 40 sec.) Pressurizer level indication reached 90%. Operator turned off one ECCS pump. Primary pressure was now down to 1400 psi. Following the rapid and continued depressurization of the system the instrument which measures the water level (9) in the pressurizer inferred a high level throughout the reactor coolant system This was due to the production of steam voids elsewhere in the primary reactor system. Operator training and experience had emphasized the retention of a steam vapor space in the pressurizer. The indication of a major decrease in that vapor space led the operators to prematurely reduce ECCS flow. (NRC item #3). The operator apparently did not anticipate that continued depressurization could lead to steam void formation in hot regions of the system other than the pressurizer and that under these conditions his level indication was ambiguous and - misleading. (t 7 mm. 30 sec.) Reactor building sump pump begins to pump water from reactor building to auxiliary building into the radio- active waste storage system (16) (NRC item #4). It should be noted that the operators turned off the sump pump 30 minutes later at t = 37 minutes. This was prior to any major fuel damage occurring. (t 8 mm.) The operators discovered the closed block valve (14) in the emergency feed system, opened it and initiated emergency secondary system cooling. At this point no major fuel damage had occurred. Note at this point that the relief valve (11) is still open and primary cool- ant was still being vented. Steam voids had been generated in the primary system preventing the normal flow of coolant. Due to the ambiguous pressur- izer level readings, the operators were unable to determine the state of the system. The operators made a number of attempts to verify system conditions during the next 30 minutes During this time, indicated flow began to decrease and operators began to note reactor coolant pump (2) vibration which indicated cavitation. (t = 20-60 mm.) System parameters in saturated conditions at 550°F and 1015 psi. Indicated flow decreasing and vibration in- creasing. (t = 1 hr. 13 mm.) The operator turned off two of the four primary reactor coolant pumps (NRC item #6). This action was taken by the operator in order to prevent damage to the pumps. PAGENO="0412" 408 (t = 1 hr. 40 uiin.) The reactor operator turned off the remaining two reactor coolant pumps. At this point, primary pressure had reached 920 psi and there was no forced flow in the primary system. The operators attempted to establish natural circulation in the system. The unknown presence of the very large steam voids in the primary system prevented the operators from accomplishing the natural circulation state. It was at this point that a heat up transient began to occur in the system and in the next hour, the major portion of the fuel damage occurred. The lack of adequate cooling caused fuel temperature to increase to the point where the zircaloy fuel cladding reached a temperature where it reacted with the hot steam and produced hydrogen. This hydrogen gas was released to the primary coolant system. Some of the gas was ultimately vented through the failed relief valve to the containment building. Two points should be noted here: 1. There was never a possibility of an explosion in the reactor pressure vessel- due to the presence of hydrogen in the primary system. - 2. Despite the high temperatures experienced in the fuel, coolant sample data Indicate no fuel melting. (t = 2 hrs. 22 mm.) The operator discovered the presence of the failed pressurizer relief valve (11) and closed - the relief valve block valve (not shown). This cut off further release of steam and water from - the system and closed the primary system for the first time in over two hours. (t = 2 hrs. 45 mm.) Reactor containment building radiation monitor indicates potential for off-site releases. - (t = 2 hrs. 50 mm.) Site emergency declared. (t = 10 hrs.) 28 psi pressure spike occurs in containment building. This was later deduced (evening of 3/29) to have re- sulted from the explosion of a locally high concentra- tion of hydrogen vented from the primary system. (t = 2 hrs 22 mm. The operators endeavored to restore primary cooling to to t = 16 hrs.) the system. However, the presence of large amounts of - hydrogen and steam voids prevented this. After attempt- ing a number of approaches to restore adequate cooling to the primary system, the operators were finally successful in restarting a primary reactor cooling pump at- about 8 p.m., 16 hours after the initiation of the accident. The plant was cooled in this mode for several weeks until the primary reactor coolant pump was shut down and the system was brought to a natural circulation state on 4/27/79. PAGENO="0413" 409 This information taken from US NRC IE Bulletin 79-05A, April 5, 1979 - Enclosure I. NUCLEAR INCIDENT AT THREE MILE ISLAND - SUPPLEMENT Description of Circumstances: Preliminary information received by the NRC since issuance of IE Bulletin 79-05 on April 1, 1979 has identified six potential human, design and mechanical failures which resulted in the core damage and radiation releases at the Three Mile Island Unit 2 nuclear plant. 1. At the time of the initiating event, loss of feedwater, both of the auxiliary feedwater trains were valved out of service. 2. The pressurizer electromatic relief valve, which opened during the initial pressure surge, failed to close when the pressure decreased below the actuation level. 3. Following rapid depressurization of the pressurizer, the pressurizer level indication may have lead to erroneous inferences of high level in the reactor coolant system. The pressurizer level indication apparently led the operators to prematurely terminate high pressure injection flow, even though substantial voids existed In the reactor coolant system. 4. Because the containment does not isolate on high pressure injection (HPI) initiation, the highly radioactive water from the relief valve discharge was pumped out of the containment by the automatic Initiation of a transfer pump. This water entered the radioactive waste treatment system in the auxiliary building where some of It overflowed to the floor. Outgassing from this water and discharge through the auxiliary building ventilation system and filters was the principal source of the off site release of radioactive noble gases. 5. Subsequently, the high pressure injection system was intermittently operated attempting to control primary coolant Inventory losses through the electromatic relief valve, apparently based on pressurizer level indication. Due to the presence of steam and/or noncondensible voids elsewhere in the reactor coolant system, this led to a further re- duction in primary coolant inventory. 6. Tripping of reactor coolant pumps during the course, of the transient, to protect against pump damage due to pump vibration, led to fuel damage since voids in the reactor coolant system prevented natural circulation. PAGENO="0414" TMI-2 Schematic Containment Building Auxiliary (12) Drain Tank CS Line~ Borated Water Storage Tank Condensate Pump Circulating Water Pump (1 D) Emergency Feed Pump (14) Block Valve Condensate Sturag~ Tank H (1 6) Radioactive Waste Storage System ~1:tIfftø Pre~urizer _________ I r31L_!~Q~ Reactor ~ Stea~ Gene~or (2) Reactor Coolant Pump PAGENO="0415" 411 Mr. MCCORMACK. Mr. Dieckamp, you understand the siti~iatic~n the committee is in as far as our time constraints are concerned and the testimony we have just heard. I would like to ask you to aid us by presenting to us such information from your testimony as you feel would supplement or be in addition to what we have learned about the plant today. In other words, if you can, tell us from your perspective what happened and what information you think is vital to this commit- tee; this would help us a great deal. STATEMENT OF HERMAN DIECKAMP, PRESIDENT, GENERAL PUBLIC UTILITIES CORP. Mr. DIECKAMP. Thank yOu, Mr. Chairman and members of the committee. We greatly appreciate the opportunity to appear here today. We certainly want to do everything we can to insure that the accident, its causes and its consequences, are fully understood, and that we, and indeed the entire industry and the world benefit from whatever learning is available. As you perhaps have noted, my testimony includes two things: First, a brief summary of what we see as the major elements or the major contributing factors to the accident. Those do not depart in any significant way from the items that have been enumerated by either the NRC or by B. & W. I suspect, on occasion, our emphasis on individual ingredients of the accident may differ slightly. The testimony then goes on to try to provide a brief and clearly just a beginning identification of some of the kinds of learning lessons that we can see out of the accident and some of the kinds of followup actions that certainly will want to be evaluated. From the discussion that has gone on so far this morning, I sense that there is a considerable desire yet for more knowledge about the cause of the accident, and I would certainly be happy to stop at this point and take any further questions about the cause of the accident to try to continue on that phase of the discussion that was started with Mr. MacMillan. Mr. MCCORMACK. We very much appreciate that, Mr. Dieckamp, so let us ask some questions very quickly. First of all, why were the valves turned off on the auxiliary water system? Mr. DIECKAMP. The point I would like to make about that first is that there clearly was a procedural failure on the part of the plant operators. I would like to add, though, that one of the things that we take on with the large number of redundant systems in the plants is an obligation to survey those systems and equipment routinely to insure that they are in a functioning, ready-to-act mode. With respect to this system, the auxiliary or emergency feed system, it was the subject of surveillance tests 12 times during the first quarter of 1979. That simply indicates the frequency of such testing. Six times during that 3-month period the tests required that those specific valves be placed in the closed or unsafe position in order to per- PAGENO="0416" 412 form the tests. The test, of course, requires that at completion of the test the valve be returned to the open position. I can only surmise that through some human error, oversight, administrative or procedural detail, that final step did not get accomplished as it was thought to have been accomplished. The last testing of that system that put those valves into the unsafe position occurred just 42 hours before the accident during the morning of the day shift on March 26. Mr. MCCORMACK. Was there an indication on the control panel that those valves were closed? Mr. DIECKAMP. There are, indeed, switches and lights on the control panel that indicate the status of those block valves. Mr. McCORMACK. In spite of the fact that there were lights lit on the panel showing that the valves were closed, the plant was operated for a number of hours with those lights on? Mr. DIECKAMP. As best I know, that is correct. Mr. MCCORMACK. That would be a violation of procedures. There is no reason to have them closed during normal operation; it would be a violation of procedures to operate with those valves closed. Mr. DIECKAMP. You get into a technical detail there that I would not really want to argue about as to whether it is or is not a violation to have them closed. They are available for the operator to open or close as is necessary. I think we do agree that they should have been in the open position. With respect to your question of how could they be overlooked, I think one has to think about the control room, the control boards, and visualize a significant array of instruments and indicator lights. Those lights are not of any one all green or all red sort of a status indicator. There is a mixture, and intermixture of red, green and amber lights. The situation is not such that the operator automatically almost has it drawn to his attention that something is in the improper position. Again, I don't present that as an excuse for the situation. I simply say that it is one of the aspects, and I think it goes to Mr. MacMillan's comment about human engineering, which I also touch on in my testimony. Mr. MCC0RMACK. So if we make a broad category, we simply have to say this was an operator or human error? Mr. DIECKAMP. I can provide no other explanation. Mr. MCCORMACK. Why did the primary water system fail, Mr. Dieckamp? Mr. DIECKAMP. The auxiliary feed system? Mr. MCCORMAcK. The primary pump. Mr. DIECKAMP. The main feed system. Mr. MCCORMACK. The main feed system; why did it fail? Mr. DIECKAMP. Yes; a report that I have with me-and let me just read from it, and it is going to be somewhat terse-but it reads as follows: The steam generator feed water pumps were in service-at the start of the accident-condensate booster pumps were in service and condensate pumps were in service. An attempt was being made to clear a clogged resin transfer line in the standby demineralizer. A loss of feed water flow transient started when condensate pump 1- A tripped, resulting in both main feed pumps tripping. The main feed water pump trip caused the main turbine to trip. PAGENO="0417" 413 So I think, going back to the earlier discussion, there was, indeed, some maintenance activity going on in that total feed water train. However, I think we have not yet been able to deduce the exact sequence of events or the exact cause or cause and effect relationships. Mr. MCCORMACK. Two quick questions: Wouldn't it have been proper, wouldn't it be proper procedure to bypass that system while it's being worked on and use the auxiliary or some other; was it not possible to bypass it if you are working on it? Mr. DIECKAMP. I am uncertain as to whether the auxiliary feed pumps are capable of supplying sufficient power for full load oper- ation. Mr. MCCORMACK. Mr. Dieckamp, there is something that bothers me about your answers and that is, it's been now 2 months since the accident and these are critically important questions. Mr. DIECKAMP. I would not want you to think that we have been lackadaisical about looking into the accident. I must say, though, that for the approximately first 4 weeks, we were intensively in- volved in bringing the reactor to the cold shutdown mode. During the next couple of weeks we have been in the process of finishing up those activities. All of the time we have had an activity ongoing to research the details of all of these various factors to bring them together, to coordinate the data, to consolidate it, to begin to be able to deduce the learning that is there. In some cases-I don't think in this one, but in some cases-we are inhibited from that process by the residual radioactivity levels in the auxiliary building, but I would only say to you that it is a monumental task to pull together all of that data and try to make sense out of it. Mr. MCCORMACK. Has anyone interviewed the maintenance per- sonnel who worked on this thing? Mr. DIECKAMP. Yes; operators have been interviewed; mainte- nance personnel have been interviewed. Again, it's a case of our coordinating all of those subjective observations along with the actual records of the plant, the instruments, the recorders, the computer and the like. It will be an extensive job, indeed, to elaborate all of these details. Mr. MCCORMACK. One final question? What are the educational qualifications of your operators? What are the requirements for an operator, education requirements? Mr. DIECKAMP. The requirements for the operators are that they be at least high school graduates. Mr. MCCORMACK. Or their equivalent? Mr. DIECKAMP. I am not sure about that. If that is what the regulation says. Mr. MCCORMACK. I am not certain. Mr. DIECKAMP. I am not certain either about that. A number of our operators, a significant number of them, have nuclear Navy experience. One of the things that I would want to interject is it is my understanding that when we examine the pass-fail record of our operators on the NRC licensing test, that failure record is 48-721 0 - 79 - 27 PAGENO="0418" 414 something like one half of the industry average during the last 4- year time period. The other thing that I might follow up on a prior question, the senior reactor operator present at the time of the start of the accidents, and present during most of the day of the accident, Mr. Zewe, was at B. & W. for simulator training in January of 1979. Mr. MCCORMACK. Thank you. We are going to have to recess to go vote. This is an important vote. We will recess for about 10 minutes. [Brief recess.] Mr. MCCORMACK. The meeting will come to order, please. Mr. Ertel? Mr. ERTEL. Thank you, Mr. Chairman. Good morning, Mr. Dieckamp. Mr. DIECKAMP. Good morning. Mr. ERTEL. Mr. Dieckamp, I have not had an opportunity to read all of your testimony, although I have read part of it. The first part seems to me relates to a series of questions I asked the previous witness concerning the operator training, and in addition to that, identification of what was happening within the system. You seem to take an absolutely opposite position. In paragraph (a), page 2, you indicate that there was no way the operator could definitely know what was happening within the system as far as the pressurizer level gOing up and the need to keep the cooling water, emergency cooling water going in. Would you explain what you think should be done to that system so that a person would be able to identify what is actually happen- ing? Mr. DIECKAMP. Congressman Ertel, I am not sure that I can absolutely do that. I may not even be able to come close to fully doing it. I do think there is no controversy about the apparent fact that the operators responded, giving most dominant consideration to pressurizer level. Their prior training, their prior experience had in some way drilled into them very strongly the importance of not taking the system solid; namely, not filling it completely with water. I think that may well have led to their very strong dependence upon level indicator. I would characterize the level indicator slightly different than Mr. MacMillan. I have no disagreement that the level indicator was indeed indi- cating the level in the pressurizer. The problem is that that level was ambiguous in terms of its normal interpretation; namely, indi- cating the degree of fullness of water in the system itself. When we look at our procedures, we indeed find that the proce- dures called for the operators to lOok both at level and system pressure before making judgments about high pressure injection. For some reason or other that I am unable to explain, they gave their dominant consideration to level. Mr. ERTEL. Didn't you indicate that the operator of this plant had just previously been, in January, to the school that Babcock and Wilcox ran on a simulator-primary operator? PAGENO="0419" 415 Mr. DIECKAMP. The seniOr reactor operator, Mr. Zewe, had been at B. & W. for simulator training in January. Now, I cannot comment in detail on the exact things that the simulator was set up to look at during that session. Mr. ERTEL. Do you rely on Babcock and Wilcox to do most of your training on the simulator and the type of training for emer- gency control in the event of a casualty in the plant? Mr. DIECKAMP. B. & W. has the simulator, and we do indeed work with B. & W., and in a sense depend upon them to assist us with the simulator training. I could not say, though, that the operator training is their prime responsibility. It is our prime responsibility to achieve the training of the operators. Mr. ERTEL. Let me turn to another area quickly because I know that time is limited. The chairman wants to move along. The valves that were closed on the auxiliary feed system were closed for a period of 42 hours. Now, if you run an 8-hour shift on that, that would indicate that you had at least what, either six or five shifts change during the time that those auxiliary feedwater valves were closed. * You said it was indicated on the control panel, that there were lights indicating that they were closed. Do you have any kind of checklist that an oncoming operator must go over, to gO over each and every system, to determine its operability and what state it is in? Have they been signed off by the intervening operators for the 42-hour period, and do they have a checklist that they go through? Mr. DIECKAMP. There is not in use a system turnover or a shift turnover checklist, the kind of device that is sometimes used. it was used during the startup testing period of the Three Mile Island plant. It was not in use since the plant went commercial. It gets down to a judgment of whether one depends upon the surveillance program to routinely assess the status of systems, or whether you attempt to do it on each shift turnover, or each day. The only consideration that I can suggest is that the plant's staff felt that in order to make such a turnover list significant, the number of items that would have to be included on it might cause it to become something of a routine item, and not get the kind of attention it should get. Mr. MCCORMACK. Would the gentleman yield? Mr. ERTEL. I would be happy to yield. I fly an airplane. It doesn't matter how many times I fly that airplane, I go through that checklist every time Mr. MCCORMACK. That is exactly the point I was going to make. Every time that a commercial airliner takes off, the copilot and pilot go thfough a checklist, which they read off, and each one of them repeats the words. Yet we had five shift changes, with those lights on, according to your testimony, at least five shift changes, and nobody noticed it. What happens when these shifts change? Do people just walk in and other people walk out? Mr. DIECKAMP. There are procedures concerning turnover. There are procedures relative to informing the oncoming shift ó.f the status of the plant. I think that the only comments that I would want to make on your analogy is to compare the number of items that would have to be on the checklist and also compare the PAGENO="0420" 416 situation ol pilot and copilot sort of changing in flight and normal operation. Mr. ERTEL. I ran a boiler system in the Navy, same sort of teakettle you did, except it didn't have a nuclear reactor. We had a checklist on each and every watch, every 4 hours. When you came on, you checked visually, and checked it off and signed it off. Each one of my operators did the same. That is a pretty good analogy, I think. Mr. MCCORMACK. How much of an overlap is there between shifts, Mr. Dieckamp? Mr. DIECKAMP. I am not able to say exactly in terms of minutes, Mr. McCormack, but indeed there is an overlap between the shifts; the people do come in-it isn't a case of one guy off the other guy on in just 1 minute. There is a definite overlap. I think the principal overlap function is performed by the shift supervisor, who comes in ahead of time and gets himself briefed on the status of the plant. Mr. MCCORMACK. But there is no ritual of any sort that you go through, in changing shifts? Mr. DIECKAMP. There is that kind of a status review ritual. There was not a detailed turnover checklist that was in operation. Mr. MCCORMACK. Thank you. Mr. ERTEL. I think that is an area that should be examined in good detail. I am also curious about another factor. On page 4 you said that the c9ntainment design did not require isolation until the building pressure reached 4 p.s.i. Now, I asked the previous witness about that, and I asked if a small pipe break would not be the same as the failure to reseat a relief valve, and I think he indicated there wasn't much difference. Would you agree with that? Mr. DIECKAMP. I think in terms of the impact on containment and the anticipated response of the temperature and pressure levels in the containment, they would probably be similar. Mr. ERTEL. Then my question is, in a small pipe break, as well as a failure to reseat a relief valve, you are going to have, under the design of this system, a leak into the atmosphere of containment materials, radioactive water, into the atmosphere. Is that correct? Mr. DIECKAMP. The main difference between the general design basis for the plants and what happened in this accident is~ that it is presumed that pressure levels get to the point of isolating the containment before there has been a significant fission product release. I think that may well have been the case here, had the accident not gone on for such a long period of time. I would like to also comment on the earlier discussion about the water pathway. The sump pumps that transferred water were turned off after 30 minutes. So in terms of the water pathway, there was very likely a high degree of isolation of that. The other comment that I would want to make is that I do not feel-and I think the record will show-that the water pathway was the signiflcant mechanism for impact on the public. The water pathway brought some iodine into the auxiliary build- ing, which subsequently was released. But the major exposures to PAGENO="0421" 417 the public were from the noble gases, and those were released during Wednesday and also during Friday morning. I think largely associated with continued operations of the plant that had to be performed, to keep certain tanks within their proper pressure levels in order to prevent uncontrolled releases. Mr. ERTEL. I guess you have answered my question in a circu- itous manner. I know you didn't intend to do that, but isn't it true that with this plant design, and with a small pipe leak, you are almost accepting a contamination of the outside, until the pressure reaches 4 p.s.i. within the containment building? And if that doesn't build to that point quickly, you have got to release to the atmosphere. Mr. DIECKAMP. Again, I think the important question there is whether or not there has been significant fuel damage in that time period of getting to the 4-pound isolation pressure. Mr. ERTEL. In this case there was a release to the atmosphere before it reached 4 p~s.i. Mr. DIECKAMP. That is right. Mr. ERTEL. Do you know if NRC has a requirement that the standard design is for there to be a containment? Mr. DIECKAMP. The 4-pound isolation requirement met the licens- ing. Mr. ERTEL. At least it passed, it got a license. There is a differ- ence. Thank you. Mr. MCCORMACK. Thank you. Mr. Walker? Mr. WALKER. Thank you, Mr. Chairman. I don't want to take too much time, Mr. Dieckamp, but there is something that I do want to relate to your testimony, and to talk about in terms of some of the present goings on. You refer throughout your testimony to the fact there has been a learning experience and that we are going to learn a great deal about nuclear operation from what happened at Three Mile Island. I would certainly hope that that is going to be the case. I do fail to note anywhere in yOur testimony some of the prob- lems connected with the public, with the public fears that have arisen from this, from the credibility problems, the communication problems. A lot of these are part of the learning experience, too, dealing with plant safety here. In particular, what I am concerned about is the public fear, right now, that the radioactive water that is presently in the auxiliary building and in the containment is going to be dumped into the Susquehanna River, after being treated. In all honesty, the public refuses to accept that that water can ever be treated to a point that they will consider it acceptable as drinking water. They will never consider it acceptable for being dumped into the stream, for sportsmen, and everything else. Aren't there some alternatives that Met-Ed, GPU, can consider, other than dumping that radioactive water into the Susquehanna River? Mr. DIECKAMP. Congressman Walker, on page 16 of my testimony I give passing reference to your introduction to that question, when I say that finally, if we are to utilize nuclear energy for a signifi- PAGENO="0422" 418 cant portion of our country's needs, we need to convey to the public a much better understanding of this technology, including its bene- fits and risks. Now, specifically with respect to the water, we have in the course a meeting that the NRC invited local community leaders and water companies to attend about a week or so ago, we have said that we would certainly consider alternatives. I think there are some alternatives, however, that carry with them potential costs and potential precedents. I think it would be a mistake if we were to somehow bypass the issue of, is that water or is it not of danger to the public. If I could just give you a few, burden you with a few numbers, let me put it this way. During the 6 weeks after the accident, when we had to manage radioactive wastes with respect to our liquid effluents to the river, we discharged less activity, in terms of curies, total curies, to the Susquehanna, than we did during a similar period in 1978 when TMI-1 was under normal operation. Second, with respect to the 500,000 gallons of highly contaminat- ed water in the primary containment building, we think it is important that that water be dealt with and disposed of. We also are confident-and the people that are most knowledge- able about the technology are confident-that the solid or soluble fission products can indeed be stripped out of that water, so that that water can be discharged under conditions no different than those appropriate for an operating nuclear plant. There is one element that I cannot make that statement about, with respect to a pressurized water reactor; that is, the amount of tritium that is in that water. There is estimated to be 2,000 to 3,000 curies of tritium in that water. However, if one were to assume that that inventory of tritium were discharged either in one large slug or uniformly, over a period of 5 years or so, the amount of radiation that a down- stream person drinking the water, eating the fish, swimming, would receive is of the order of a few tenths of a millirem, which is, I would say, almost indistinguishable for that person in relation- ship to the natural background environment that he is receiving- his medical treatments and so forth. Mr. WALKER. I thank you for that. I think, though, that the problem is that your statement reflects the industry's viewpoint, and you need to convey to the public a much better understanding of the characteristics of the technology. I guess my point is, I think the industry better get some under- standing of what the public can mean to the industry. The fact is that your credibility, regarding your ability to clean it up, is practi- cally nil with the public. They consider any level of contamination of that water right now totally unacceptable. From my standpoint, I think your ability to continue to operate nuclear plants is very much based upon the credibility which grows out of your learning experience with regard to TMI. It would be my assumption, right now, that when the first thim- bleful of that water is mixed into the Susquehanna, you will have a revolt on your hands. You will never be able to contain it in terms PAGENO="0423" 419 of putting Three Mile Island back on line. In terms of the nuclear industry being able to point to this as a learning experience, I think the public interpretation at that point will be that you have learned nothing. Mr. DIECKAMP. Congressman Walker, I accept your characteriza- tion of the public attitudes and feelings in that area, that they are indeed as you state them. I would hope, though, that we would all try to convey to the public the facts of the situation, so that their attitudes can be shaped by a better understanding of the* meaning of the kinds of activities that we do need to carry on at the plant. Mr. WALKER. I guess your problem is that-and I will conclude with this-I guess your problem is that the public is being bom- barded with many different sets of facts. We had a panel before this group yesterday in which we had a couple of different extremes, as to how much radioactive release reached the public, and how many millirems members of the public got, and so on. Regardless of whose figures can be confirmed, the fact is that the public is under the impression that there are all kinds of facts, all of which are misleading and doubtful. They don't want further exposure. Thank you, Mr. Chairman. Mr. MCCORMACK. Thank you, Mr. Walker. Mr. Wydler? Mr. WYDLER. Can you tell me who was in the control room when the accident took place? Mr. DIECKAMP. Two licensed control room operators. A Mr. Craig Faust and a Mr. Ed Frederick. In the glassed-in office just adjacent to the controls was the senior reactor operator, Bill Zewe. Mr. WYDLER. Those are the three people that were present at the time the initial breakdown took place; is that right? Mr. DIECKAMP. I know those three were there. I cannot be posi- tive whether there was another one present or another one walked in in a few minutes, or something of that sort. But those are the three that were specifically present. Mr. WYDLER. Hasn't anybody asked those questions yet? Mr. DIEcKAMP. Congressman, as I sit here I don't happen to know the exact schedule of each individual. That is known, though. Mr. WYDLER. At the time that the initial breakdown took place, if I understand what you just said, there were two people in the control room, one in a nearby office, is that right? Mr. DIECKAMP. Nearby means glassed-in within 20 feet of the nearest control. Mr. WYDLER. All right. And for the next 7 or 8 minutes-we have been told the sequence of events here~ During that 7 or 8 minutes, did anybody else come into the control room? Mr. DIECKAMP. I can't be specific in answering that. I think someone else came in on the basis of alarms being heard. But I cannot be specific. We can provide th-at for the record, a detailed chronology of who was in the control room at what time, for the record, if you would like. Mr. WYDLER. I would like that. [The information follows:] PAGENO="0424" 420 GENERAL PUBLIC UTILITIES CORP., Parsippany, NJ., June 5, 1979. Hon. JOHN W. WYDLER, Rayburn House Office Building, Washington, D.C. DEAR CONGRESSMAN WYDLER: During the May 23 hearings of the subcommittee on Energy and Production of the House Committee on Science and Technology, you asked about the occupants and the immediate arrivals to the control room at TMI-2 on the morning of the accident. Attachment 1 indicates the original occupants and the post accident arrival of station personnel on duty at the time of the accident initiation. Attachment 2 indicates the arrival of personnel not on duty at the time of the accident initiation. This information is available for incorporation into the record if you so desire. If you have any further questions please contact me. Sincerely, H. DIECKAMP. Attachments. ATTACHMENT 1.-Unit 2 on-shift operations personnel; initial arrival times' in control room after 04002 until 0700 Name and title: Approx. time3 T. Daugherty-Auxiliary operator 0401 F. Scheimann-Shift foreman 0401 D. Miller-Auxiliary operator 0405 J. Gingrich-Auxiliary operator 0415 D. Laudermilch-Auxiliary operator 0420 S. Mull-Auxiliary operator 0445 1 Based on recollection of operators. 2 W. Zewe, E. Frederick, and C. Faust were in the control room at 0400. `Times given are for initial arrivals in the control room and do not reflect departures or subsequent returns to the control room. ArPAÔHMENT 2.-Senior station personnel arriving on-site Name and title: Time G. Kunder 1_Unit 2 superintendent-Technical support 0445 M. Ross-Unit 1 operations supervisor 0510 R. Dubiel 2_Supervisor, radiation protection/chemistry 0540 J. Logan `-Unit 2 superintendent 0545 B. Mehier-Shift supervisor 0545 D. Shovlin-Maintenance superintendent 0610 G. Hitz-Shift supervisor 0615 I. Porter a-Lead I&C engineer 0625 J. Seelinger `-Unit 1 superintendent 0650 G. Miller s-Station superintendent (approx.) 0705 B.S. mechanical engineering. `B.S. physics, and MS. nuclear engineering. B.S. marine engineering. B.S. electrical engineering. `B.S. and MS. math. Mr. WYDLER. There was a crew working on some part of the cooling system, and it has been theorized that this may have caused the pump to stop. How many people were working on that? Mr. DIECKAMP. I don't know the answer to that. Mr. WYDLER. Well, who would? Mr. DIECKAMP. The plant staff knows that. We can provide that. Mr. WYDLER. From what you have told me, frankly, I am trying to get some picture of a control room operation. I cannot imagine anything more boring in my life than to try to sit in a control room at 4 o'clock in the morning, watching a panel, lights, or anything of that nature. PAGENO="0425" 421 But what I cannot understand is that you apparently have no procedures. I just want to make sure I understand your testimony in this regard, that when a shift came on duty, their first responsi- bility was not to go around and to check each and every control under their jurisdiction, to see how it was operating. Is that or is that not the standard operating procedure in a control room? Or do you just come on and assume if there is no emergency taking place, everything is fine, you sit down and wait for something to happen. What is the procedure in the control room? Mr. DIECKAMP. There is no formal transfer checklist. Mr. WYDLER. I just want to know the procedure. The next two men come on, take their seat somewhere in the control room, and wait for something to take place. Is that really what you are telling us? Mr. DIECKAMP. The shift supervisor comes on in sufficient time to be briefed on what is going on, what is the status of the plant, whether things have changed, what problems they are having, or the like. He transfers that information to the operators that will be with him during that shift. There is not a formal checkoff sheet on positions, switches, valves, instruments. Mr. ERTEL. If the gentleman will yield on that point. Mr. WYDLER~ Let me just finish this. I just want to make sure I do understand. Now, you described the problem of reading this particular dial, which apparently was in a danger position, I pre- sume, since it was shut, had shut the backup system for the cool- ing. It must have been in sort of a danger position. Does it have a red light on it? Mr. DIECKAMP. Are you speaking of the indicator lights or the auxiliary feed valves? Mr. WYDLER. Exactly. Mr. DIECKAMP. Yes; they have indicator lights. Mr. WYDLER. Was there a red light on, on this indicator light? Mr. DIECKAMP. The convention that is used in the control room is that if something is open, the light is red; if something is closed, the light is green. That is applied both to electric systems and to hydraulic systems. These valves had indicator lights on each, just adjacent to the switch, red and green. Since the valves were closed, the lights must have been indicating green when they should have been indicating red. There has only been one suggestion, that perhaps a tag on a controller just above the valves may have obscured one set of lights. It doesn't seem conceivable to me that it could have con- cealed both sets of lights, and also I don't find solace in the fact that that tag might have occasionally concealed a light. But the lights are there. They must have been reading green when they should have been reading red. Mr. WYDLER. But that is just the opposite of what we would expect, isn't it? Wouldn't you expect when something is in a dan- gerous condition, that it would read red, and that when it is in the nondangerous condition, it would be green? PAGENO="0426" 422 I don't understand that system. Why would you put a valve that is shut in a green position? Wouldn't you want to show-shouldn't there be something in the control room, when something is not in its normal condition, red or green, open or closed, doesn't really indicate. What you really want to know as an operator or somebody responsible is is there something wrong. You don't want to know where a valve is open or shut. You want to know is there some- thing wrong with the system. What tells you that? Mr. DIECKAMP. Congressman Wydler, we are back to the question of the human engineering. I think there are areas here that can be looked at. But let me simply say that. there are a great number of valve positions and switches for electrical controls. Sometimes open is safe; sometimes open is unsafe. The designers of the control room adopt a definition or a convention, and the convention that they have used in this case-and I don't know that it is unusual-is that red means open and green means closed. The only other factor that I would add to you is that in varying conditions of, the plant, varying operating phases, from, shutdown to startup, some of those positions are. not the same, as you go from one phase to the other. Thus, it is difficult-I wouldn't want to say impossible, but it is difficult-to conceive of a situation where under all operating modes of the plant you could walk into the control room~.and see all the lights be green, and be assured that it is OK. Mr. WYDLER. No, they are meaningless, I agree with you. The color of the light doesn't mean anything unless you go and exam- ine it in relation to the whole board. But isn't there some system in the control room, this is what I am asking, that tells the operator that there is a danger point in the control room? I would assume that was true. I just found out today it is not true at all, from what you are telling me. Isn't there something in there that tells you there is a danger point here, some light goes on, red, green, yellow, orange or a bell rings and says there is a danger, look at it. There is nothing like that? Mr. DIECKAMP. There certainly is an alarm system which is attached to many of the functions in the control room, which has the purpose of bringing to the operator's attention an improper status of some measurements, some piece of equipment or the like. On these valves there was not that kind of alarm. Mr. WYDLER. Thank you, Mr. Chairman. Mr. MCCORMACK. Thank you, Mr. Wydler. Mr. Ambro? Mr. AMBR0. Mr. Chairman, I just have one quick line of question- ing. We have heard recently that Vepco is in financial trouble. What is the financial status of Met-Ed? Mr. DIECKAMP. The financial status of Met-Ed and, indeed, all of the owning companies of Three Mile Island is at best tenuous. Mr. AMBRO. Is there a relationship between costs and safety? Mr. DIECKAMP. Absolutely not. Mr. AMBRO. In other words, no expense was spared for safety? PAGENO="0427" 423 Mr. DIECKAMP. For all practical purposes, I can subscribe to that statement. We did not, however, cause the cost of the plant to reach infinity. It did have a finite cost. But I know of no case where conscious decisions were made which undercut or reduced safety in the interest of cost reductions. Mr. AMBRO. Now, I recognize that testimony as the result of Three Mile Island comes after the fact. But this committee was fortunate enough to have Dr. Teller and other expert testimony on a theoretical level, and they suggested that in the first place reac- tors themselves could be improved. The line of questioning here proceeds from two other things they said. One, that the operators were ill-trained and that we would be wise if we moved in the direction of training them, much the same as pilots are trained. Check lists of the kind you heard talked about, should have been used. They said as well, and I think I am correct, computers today are sufficiently sophisticated to provide data and information for almost instant action. Now, if after the fact these observations are offered, are we to believe that since they are relatively simple that the same observa- tions were not part of the dialog when one was dealing with the question of safety in these plants? Mr. DIECKAMP. I think all of those questions or all of these topics, training and use of computers, use of procedures and check lists, certainly have been an integral part of the safety of nuclear plants. I must say, though, that there is no absolute truth, and so one makes judgments about how far you need to go in a given area based upon your analysis of the situation, your postulated failure modes or problem areas and your experiences. Mr. AMBRO: Well, I recognize that. I think that this is the way that most things do take form. If there was no relationship be- tween costs and safety, what was it that prompted decisionmakers to turn away from better trained operators, check lists, automatic systems, computer data retrieval and things like that? It seems almost cavalier to look away from that and not develop a variety of worst-case scenarios, even based on the kinds of acci- dents that could never happen, but indeed did happen, in order to come up with these kinds of systems which I would suspect are relatively inexpensive in terms of safety consideration. What would motivate one not to move in the direction of these kinds of procedures? Mr. DIECKAMP. I think there are motivations that cause one to adopt a certain level of sophistication or Oertain level of coverage, and I think I can give you a few examples. In terms of the equipment area, I think if one adopted the approach of continuing to add equipment you would soon find that the plants would become so complex that they became increasingly difficult to understand and operate. Let's talk about the checklist, the problem of the open block valves on the auxiliary feed system, the testing of those, the sur- veillance of testing of those was accomplished with a very specific, very detailed checklist. The check list alone does not prevent human failure. In fact, I might almost suggest that one of the things that has happened to PAGENO="0428" 424 us is we have taken on such an administrative burden of paper- work in the plants that people become somewhat inured to the real meaning of what they are doing. We get to be doing things by the numbers rather than because they are really important. Now, I know that does not sound good, but I think we are dealing with human beings, and if something becomes a paperwork burden, it does not necessarily engender the best possible response. In the computer area, I would be reluctant to decide that com- puters were the solution to the problem because, after all, comput- ers know nothing more than what the man puts into them. To the extent that the computer could be used to expand the man's ability to gain visibility or to assess what the situation is, I think there is an area that should be explored fully. But I would be reluctant to assume that we can just solve the problem by computers. Mr. AMBRO. Well, it seems to me that your response indicates, when you say that an operator would become inured to what they are doing, that check lists alone don't prevent human failure. Further, you would be reluctant to move in the direction of com- puters, there you fly in the face of the testimony of most well- respected scientists. But more than that, you hint at the notion that you are not open, as the result of this accident, to reassessing these very basic concepts and utilizing them for the assurance in the future that they won't happen again. Now, am I reading that right or am I not? Mr. DIECKAMP. I would like to state emphatically that you are reading it wrong. Mr. AMBR0. OK. Mr. DIECKAMP. I am definitly open. I think I would like to hope that the last half of my testimony suggests an openness to consider all of these factors. My comments really are comments to provide additional perspective so that none of us leap to premature conclu- sions. Mr. AMBRO~ I know we have a time constraint, Mr. Chairman, but I must tell you, well, let me just ask you this final question. In your appraisal or reevaluation with respect to the accident, and in terms of these suggestions, costs will not be a consideration in implementing any of these items that your review finds effica- cious in dealing with anticipated problems? Mr. DIECKAMP. That is correct. Mr. AMBRO. All right. Mr. Chairman, we have the opportunity to provide written ques- tions to pursue these further? Mr. MCCORMACK. Yes; indeed, we do, and Mr. Dieckamp, I am sure will respond to any questions in writing. Mr. AMBR0. Thank you. Mr. MCCORMACK. I want to thank you, Mr. Dieckamp. We are going to terminate our testimony with you at this time because we have to move quickly to our other witnesses. But, if you are availa- ble and can stay around for the rest of the hearing, maybe the other members would want to ask you additional questions before we finally adjourn. I want to thank you very much. Mr. DIECKAMP. Thank you. PAGENO="0429" 425 Mr. MCCORMACK. We appreciate your testimony and look for- ward to talking to you again in the future. Our next witness is Lieutenant Governor William W. Scranton of Pennsylvania, and I would like to ask Congressman Walker if he would like to present him to us. Mr. WALKER. Thank you, Mr. Chairman. It is indeed my privilege to present to the committee Lieutenant Governor Scranton. I think we should particularly welcome him because he was on the scene throughout the crisis at Three Mile Island, participated in all of the briefings, and was dealing with the public and with the technological aspects of the crisis. I think he can probably give us more information than practically anybody else who dealt with this problem from a very personalized stand- point. So I thank you for inviting him and I welcome him here. STATEMENT OF HON. WILLIAM W. SCRANTON III, LIEUTENANT GOVERNOR, COMMONWEALTH OF PENNSYLVANIA Mr. SCRANTON. Thank you. Mr. MCCORMACK. Thank you and, Lieutenant Governor Scranton, I want to join in the commendation Congressman Walker has extended. I think that the conduct of the State government and you as Lieutenant Governor and the Governor as well was exem- plary. Mr. SCRANTON. Thank you. Mr. MCCORMACK. We are very proud and pleased and we are very happy to have you here today to testify. Your testimony in its entirety will be, without objection, included in the record, and you may proceed as you wish. [The prepared statement of William Scranton III follows:] TESTIMONY OF L'r. Gov. WILLIAM W. SCRANTON III Good morning. I wish to thank the members of the Subcommittee on Energy Research and Production for the opportunity to express my views and recollections of the Three Mile Island accident. I will keep my formal comments as brief as possible and general in nature to give you an opportunity to focus in on specifics in your questioning. As Chairman of the Pennsylvania Emergency Management Agency (PEMA), I am notified of every accident, disaster, and major emergency that occurs in our Com- monwealth. It was in this capacity that I was notified shortly after 8 am. on the morning of Wednesday, March 28, 1979, of an incident that had occurred at the Three Mile Island Reactor No. 2. From the outset, the thought of an evacuation and the role that PEMA would have to play was paramount in my mind. It is important, I believe, to point out that throughout the entire incident, we took precautions to evaluate our civil defense preparedness through outside sources and that we insisted on the assistance and the approval of such agencies as the Federal Disaster Assistance Administration, De- fense Civil Preparedness Agency, the Nuclear Regulatory Commission, the White House and others in verifying our readiness. I am sure that this esteemed subcommittee, along with the several other House and Senate Committees in Washington, will in their search for bickground informa- tion, question the events and how and why decisions were made. The most difficult obstacle that we who advised Governor Thornburgh during the seven day trial had to overcome was the gathering and evaluation of proper infor- mation. Even with the nation's best minds and resources available, a nuclear incident of this magnitude had never occurred in peacetime, and the ultimate challenge, an evacuation of up to 600,000 people, was a task that everyone prayed would never be necessary and still had to be anticipated. PAGENO="0430" 426 From the first erroneous reports on the extent of the accident to my personal visit to the plant site on Thursday to the appearance of the hydrogen bubble and the disastrous consequences that it portended, the information problem grew. The problems at the site were compounded by loose talk of a "massive" evacua- tion, confusion over how many hydrogen bubbles were in the reactor, and, eventual- ly, that celebrated bulletin on an imminent "explosion"-all of which seemed to originate from sources who had yet to set foot in Pennsylvania, to say nothing of the plant itself. These sources-both official and self-appointed-simply could not appreciate the complexity of what we were facing here. They may have meant well, but they were a burden. As you know, it has been widely reported that even Harold Denton and Dr. Roger Mattson suggested evacuation early in the crisis-although neither of them made such a proposal to me or my staff. What has not been fully understood is that both men were saying these things before they left the Washington area, and both changed there minds after arriving at the plant site. When Mr. Denton left us, he told the press, and I quote, "I guess I've learned that emergencies can only be managed by people on the site. They can't be managed back in Washington." Although Mr. Denton is capable of speaking for himself, I believe his remark applied not only to the fact-finding needs of decisionmakers, but to the technical operations at the plant as well. I feel that this point was, indeed, one of the most important lessons to be learned from the incident. I recommend that it be considered in any revisions to be made in our federal emergency response procedures. Without reenacting the entire process, I would like to give you an account of some of the more significant actions we took in this matter. The moment we learned of the accident, the Governor ordered the acceleration of an appraisal we had begun on the emergency prepardness system developed by the previous Administration in Pennsylvania. It was a workable system, but we did find weaknesses-which we moved as quickly as possible to correct. We also ordered our civil defense and National Guard units to assume an alert status, taking care, however, to aviod a show of helmets and sirens which might, in themselves, have caused a panic. While the plan itself, like all such plans, depended, in the end, on the people behind it, there were some structural problems to which this commission might address itself. The existing federal requirement was for a plan that contemplated evacuation of the area within five miles of the facility. At the time of the incident, there was a proposal on the table related to extending that area to ten miles. There were also some speculation about a twenty-mile evacuation. This speculation made it extremely difficult for our planners to predict the psychological impact of even a five-mile order. They had to consider the possibility, for example, that people twenty miles away-having heard the speculation affecting them-might take to the highways and further complicate movement of people out of the real danger zone-the five mile area. I believe the development of clear evacuation parameters, and the education of the public as to what those parameters should be in any given situation, would greatly aid emergency preparedness officials in the future. We don't want anyone to have to deal with a TMI again. But if it happens, let us see that this particular lesson is not lost to posterity. There are many improvements that can be made to enhance nuclear safety and improve the capability of public officials to deal with a nuclear emergency. I am sure the various special commissions and committees looking into the Three Mile Island nuclear accident will come forth with many necessary changes among which I would hope to be requirements for closer monitoring of nuclear power plants by qualified federal and state agencies as well as a clearly defined state role in ensuring the safe operation of nuclear plants. As a result of Three Mile Island, there should as well be developed clearly defined emergency procedures which are well understood by the populace in advance of any potential incident and a greater effort must be made to arrive at a popular understanding of both the perils and the potential of the fission process. This is particularly important in alleviating the potential of panic and fear which is particularly prevalent in nuclear incidents due to the fact that radiation is invisible and not well understood. PAGENO="0431" 427 It is important, I believe, to review current permissible dosages of radiation and arrive at specifically understood radiation levels whose presence in a nuclear acci- dent would trigger specific actions by civil defense and other state agencies. Fur- thermore, I would suggest that both on-site and off-site readings during an incident be taken and reported by public agencies rather than the utilities themselves as the mere fact of information coming from a utility raises severe questions of credibility in the public's minds, questions that may or may not be warranted but yet inevita- bly contribute to fear and uncertainty. Finally, in any emergency, it is necessary to establish as quickly as possible credible and coordinated sources of public information, sources whose authOrity, equanimity, and veracity will help still the many conflicting voices which often serve more to confound than to enlighten. Mr. SCRANTON. Thank you, Mr. Chairman. Since the testimony in its entirety will be in the record, and I assume most of the members if not all of the members of the subcommittee have had a chance to look it over, in the interest of time I would summarize some of the main points. First of all, I was asked before coming here what on the first page the term "PEMA" meant in the third paragraph. It means Pennsylvania Emergency Management Agencies, which is a new- fangled name for civil defense. I think what my testimony points out are some of the problems that we were involved with, and some of the suggestions that I have, although I am sure there will be more from me and from the Governor as we learn more about this accident, as to how to avoid this or how better to handle it if it should happen again. First of all, many witnesses have mentioned this, and it will be mentioned for a long time to come, there is a very real, definite informational problem both in getting information, reliable statisti- cal information, that reasonable decisions could be made upon, and also in dealing with information that was coming from other sources which tended to be either inflammatory or tended not to be based in fact as it was investigated. A great deal of our time was spent not only finding out what actually was happening but running down misleads we were get- ting from other areas which tended to sap the energies we might have put into finding exactly what was going on. This is important. I don't mean to accuse anybody of anything because I think this is natural. This happens very often in disas- ters. But in a nuclear disaster there are particular dangers of a psychological nature that there are not in other disasters. In a flood or hurricane or fire or such, people can see it, they know where the damage is. They understand it, because it's tangi- ble or they can visualize it. But a nuclear disaster is not the same, and because of that I think the psychological aspect of it is height- ened tremendously, and in dealing with a nuclear emergency we have to be aware of that. Second of all, we at the State level took every precaution we possibly could to bring in outside experts and to evaluate our civil defense capability. That included people from Washington, from the Defense Civil Preparedness Agency, from the Federal Disaster Assistance Agency, and others whom we sent out to the various counties involved, of whom we asked, are there any holes in our civil defense and, if so, what are they, and can you help us plug those holes. PAGENO="0432" 428 It was our posture all along to make sure we were not the only ones that were having a look at how we could respond insofar as civil defense was concerned. Finally, I would like to read the very end of my testimony which outlines to you some of the lessons which I think we learned, at least the beginning of some of the lessons. There are many improvements that can be made to enhance nuclear safety and improve the capability of public officials to deal with a nuclear emergency. I am sure the various special commissions and committees look- ing into the Three Mile Island nuclear accident will come forth with many necessary changes among which I would hope to be requirements for closer monitoring of nuclear power plants by qualified Federal and State agencies as well as a clearly defined State role in insuring the safe operation of nuclear plants. As a result of Three Mile Island, there should as well be devel- oped clearly defined emergency procedures which are well under- stood by the populace in advance of any potential incident. A greater effort must be made to arrive at a popular understanding of both the perils and the potential of the fission process. This is particularly important in alleviating the potential of panic and fear which is particularly prevalent in nuclear incidents due to the fact that radiation is invisible and not well understood. It is important, I believe, to review current permissible dosages of radiation and arrive at specifically understood radiation levels whose presence in a nuclear accident would trigger specific actions by civil defense and other State agencies. As many of you know, this came into question in the middle of the crisis and it's something I think has to be resolved. Furthermore, I would suggest that both on-site and off-site read- ings during an incident be taken and reported by public agencies rather than the utilities themselves as the mere fact of information coming from a utility raises severe questions of credibility in the public's minds, questions that may or may not be warranted but yet inevitably contribute to fear and uncertainty. Finally, in any emergency, it is necessary to establish as quickly as possible credible and coordinated sources of public information, sources whose authority, equanimity, and veracity will help still the many conflicting voices which often serve more to confound than to enlighten. I thank the chairman and the members of this committee and Harold Denton's indulgence in allowing me to precede him in this, and I would be happy to answer whatever questions I might be able to answer at this point. Mr. MCCORMACK. Thank you, Governor Scranton. I might say the members of the committee and our friends here today would be perhaps pleased to know one of the reasons we moved you up is because of the fact that you are anxious about the fact that the stork is fluttering about your chimney at the moment. Mr. SCRANTON. Indeed, it is. Mr. MCCORMACK. For the first time, and so we are all wishing you well. Mr. SCRANTON. Thank you. PAGENO="0433" 429 Mr. MCCORMACK. And we wish your new family, your present and new family well. I have a couple of quick questions. The first one is do you feel that you obtained adequate knowl- edge as to the radiation exposure levels, total amount of radiation release in this instance? In other words, I am not saying what you could do in the future to draw what you might design as an optimum system, but between what you did with your own energy agencies and between what NRC did and maybe what other operators do in ground monitoring stations and helicopter sampling, do you believe that you had adequate information and adequate knowledge of the radiation release and exposure to population? Mr. SCRANTON. Yes; I do. And if we had not, I think the probabil- ity of evacuation would have been much higher. I am not sure we had adequate readings on what was coming out of the plant. I am confident we had adequate readings on what was showing up off- site. The reason I say I am confident about that is because almost at the moment this occurred, we sent out, Metropolitan Edison sent out monitors as part of the nuclear plan or assessment from the Department of Environmental Resources, which quite frankly had a limited ability to monitor, but nevertheless we sent them out. We called in the Department of Energy emergency monitoring team, which came in later that morning as well as a team from the Nuclear Regulatory Commission which came from King of Prussia outside of Philadelphia, the local regional team, and set up almost immediately after site monitoring. Those readings we received tended to fluctuate as radioactivity will in the wind. The highest we received in those first few days was 30 millirems offsite. At one point 30 millirems per-hour but that soon dispersed. I am confident, certainly, that the process of gathering informa- tion could be enhanced, and I would suggest it be. But we never got such conflicting information from those sources that would make us question the credibility of the information we were getting. Mr. MCCORMACK. So you are in general agreement with the Nuclear Regulatory Commission's evaluation of the radiation re- lease and radiation dose levels in the area, in general I mean? Mr. SCRANTON. Yes. Mr. MCCORMACK. You have a general consensus of what the approximate exposure levels of the population were? Mr. SCRANTON. Yes; yes. Mr. MCCORMACK. The monitoring system is made up of a mix of radiation level devices and dosimeters, film packs and so on. Did you feel that these were adequately integrated and that they rein- forced each other? Shall we say for the purpose of your knowledge, do you think that they did integrate and reinforce each other? Mr. SCRANTON. I would like to see more dosimeters. I think our capability of making a determination as to the aggregate radioac- tivity, particularly in the beginning, may have been weaker than it ought to have been. But what we tried to do was take those areas where we were receiving particularly high levels of radiation on a per hour basis.. 48-721 0 - 79 - 28 PAGENO="0434" 430 Mr. MCCORMACK. High being how much? Mr. SCRANTON. The least was 30. Mr. MCCORMACK. Thirty millirem? Mr. SCRANTON. But I would say it was one or two sites, and paying some attention there insofar as the aggregate was con- cerned. I think in the future there ought to be some kind of NRC or federally mandated plan to maintain a dosimeter capability within 5, or whatever miles the NRC decided, radius of the plant in the future. I think it would be more helpful. Mr. MCCORMACK. It's a relatively simple thing to do to put the film packs out. Mr. SCRANTON. Yes. Mr. MCCORMACK. You feel in retrospect that the dosimeter read- ing you get and a monitoring device in operation reinforced each other, in fact? Mr. SCRANTON. Yes, and also, to my knowledge, and I would have to. check this, but to my knowledge there were also dosimeters on- site, and if you can extrapolate to what is occurring, assuming you are going to get a much higher exposure on-site, I think you can assume that, whatever you are getting offsite will be clearly less than that. I think the area where it is critical to have dosimeters are various areas offsite. You can never predict the direction of the wind or the weather conditions. You are always going to have to extrapolate from information based on your experience. But I think if I were designing a system, I would probably put a few more~~ dosimeters around. Mr. MCCORMACK. OK. Now, we had a witness yesterday, Dr. Chauncey Kepford who claimed that the Nuclear Regulatory Com- mission lied to the public, claimed that there were radiation levels, at some distance of 8 as high as 12 rads per hour, and he claimed that there would be from hundreds to thousands of deaths from the accident. Do you have any comment on those statements? Mr. SCRANTON. At no time did we receive information, and we were not only getting it from the NRC, we were also getting it from our Department of Environmental Resources, from the Department of Energy, who was working for the State, and to be fair, even from the utility. Did we receive those kinds of doses? I am not an expert on nuclear radiation, but we were very careful to monitor iodine levels in milk, offsite, "nd to the extent that those large doses would show up in milk I think we showed relatively small amounts of iodine in the milk. Furthermore, we are following up with a very extensive long term health study to determine what deaths may have been related' to this Based on what we knew at the time, we had no information that would corroborate what that witness said. Mr. WALKER. Mr. Chairman, would you yield? Mr. MCCORMACK. Certainly. -. Mr. WALKER. Just quickly,. one of the contentions made by Chauncey Kepford was there were no readings done more than 13 miles offsite. Were some of those readings being done by DER and PAGENO="0435" 431 some of your work being done? Did they go out further than that, say down toward Lancaster or out toward Reading? Mr. SCRANTON. Bob, I don't know the answer to that question. I would have to get that and check the record. Mr. WALKER. If there were some readings done by the Depart- ment of Environmental Resources, would you provide that for the record, please? Mr. SCRANTON. Certainly. Mr. WALKER. I think that needs to be corrected if that were, in fact, the case. Mr. MCCORMACK. What was this that needs to be corrected? Mr. WALKER. I am looking to correct if, in fact, it should be, Dr. Kepford's testimony yesterday that there were no readings of more than 13 miles out. Mr.. MCCORMACK. Yes; I understand, OK. Where was the site where he said the readings were up to 10 rads, what was the location he said yesterday; do you recall? Mr. WALKER. I don't recall. Mr. MCCORMACK. He didn't cite any location. Mr. WALKER. I don't believe so. Mr. SCRANTON. I would also add that the Department of Energy's helicopter, which we called in, whose job is specifically to monitor radiation, followed for the first couple of days the so-called plume. I don't know how many miles out it followed, but continued to follow it and monitor it, which commonsense would indicate would be the highest level of exposure, and never came up with a level that would put the public health in danger. But I will check that. Mr. MCCORMACK. How far is Gouldsboro? Mr. SCRANTON. That is cross the river, a 5-mile radius. Mr. WALKER. 300 yards. Mr. ERTEL. Less than half a mile. Mr. MCCORMACK. OK. Mr. WALKER. On that it would be helpful, and maybe we need to ask the Department of Energy, NRC for this, but those readings where the helicopter went out in the plume further I think would also be very helpful to know what those readings were, because that is really what we are talking about, I think. His contention was that there was an inversion layer as the plume went out which might not have gotten very high readings close into the plant but very high readings further out. Readings taken within the plume I think would be valuable in trying to assess that particular argument. Mr. ERTEL. If the gentleman will yield, I think maybe that would be appropriate to develop in Mr. Ambro's hearings because he is going to be talking about that in June. Mr. MCCORMACK. This subcommittee will be handling low level radiation hearings and we will be discussing that. Mr. ERTEL. Well, the two of you, I guess. Mr. MCCORMACK. Governor Scranton, the NRC says, we had. testimony yesterday, that the integrated dose to the population in the vicinity was an increase of about 1½ m-rem total integrated dose. Do you feel this is a reasonable calculation? Mr. SCRANTON. I hesitate to be pinned down on the specifics because I don't know. What I can tell you is that on the basis of PAGENO="0436" 432 our information that the integrated dose offsite was so low as not to require even a precautionary evacuation except in the case of an advisory precautionary evacuation, which the Governor advised for pregnant women and preschool children. It may have been higher, Mr. Chairman, but I really don't know. It was never at the point that I think it became alarming. Mr. MCCORMACK. Do you think that the Governor would, in retrospect, knowing what he knows now, would he, if he had known it then, have issued the advisory evacuation? Mr. SCRANTON. Yes, yes, I do. Mr. MCCORMACK. OK, thank you. Mr. Walker? Mr. WALKER. I wonder if you might comment, based upon your experience with the public, what your impressions were as you visited them in the refugee centers, and your assessment of the public attitudes today, that have grown out of this, that might be of help to us in evaluating their views of safety of nuclear plants. What do they expect us to do in terms of assuring safety of nuclear plants in your opinion? Mr. SCRANTON. I think that there was at the time of the incident exhibited a great amount of confusion in people's minds, apprehen- sion. Maybe to some extent fear, but not panic. I must say that I was impressed at the calm with which the people of that part of Pennsylvania handled their situation. I think after the tension of the incident was eased somewhat, that the fears and the doubts came more to the forefront and are continu- ing. There is a very real problem of credibility. Whether that prob- lem of credibility has a foundation, there is a very real problem of credibility. I think that people, first of all, want-if I could presume to talk for them-a breather, just to recover. Second, I think they want to know that there are responsible and credible sources of oversight concerned with their health-not just with the operation of the plant, but also with doses that are coming off the plant, that will be frank in how they present that informa- tion. Finally, I think they want some knowledge, some knowns. There has been so much that is unknown and controversial about nuclear power that there is no place to hang your hat. Therefore, public opinion is the victim to some extent of the slings and arrows of the debate. This has a terrifying-not terrifying, that overstates it-it has a very unsettling effect on peoples' lives. I think what they want to know is that they are going to be protected. I think what they want to know is what they do if something like this happens. I think they want to know to the extent this ever happens again, they don't want it to happen there. But I think we want to know what radiation does and doesn't do, and what they can expect. It is a very big desire to fill. Mr. WALKER. Thank you, Mr. Chairman. Mr. MCCORMACK. Mr. Ertel? Mr. ERTEL. Thank you, Mr. Chairman. PAGENO="0437" 433 I am curious about two questions, and they are very brief. One is, evidently recently-and I don't know where-Colonel Henderson indicated that he had recommended an evacuation early in the process. If my recollection is correct, it was on the day of the first occurrence. I really talk about two different occurrences-on the Wednesday and the Friday. I am talking about the Wednesday. Do you have any knowledge of that, and were you there? Is that true? Mr. SCRANTON. Colonel Henderson, first of all, is the executive director of Pennsylvania defense. I believe, Congressman, that- you are talking about Friday morning? Mr. ERTEL. I think Wednesday morning was my information. Maybe I am incorrect. On the first day. Mr. SCRANTON. I have no knowledge of him having advised evac- uation on Wednesday. Mr. ERTEL. OK. How about Friday? Mr. SCRANTON. I do know that he advised the Governor of an evacuation on Friday. Let me give you the background. On Friday morning I received a call from Colonel Henderson at my house saying that he had received a call from an official of the Nuclear Regulatory Commission, a Mr. Collins, I believe, saying that there had been a 1,200 millirem release from the plant, that the plume was traveling down river, and that we should evacuate within a 10-mile radius. I called the Governor. I asked Colonel Henderson how long we had to make a decision on it. His estimation was at that point about half an hour. I did not ask him what his opinion was on evacuation. Mr. ERTEL. May I interrupt you for a moment. You are in charge of civil defense by law in Pennsylvania, or by-- Mr. SCRANTON. By appointment. Mr. ERTEL. Just so everybody understands how your role fits? Mr. SCRANTON. I am the chairman of the Oversight Council. He is the day-to-day executive director. I called the Governor. I told him of the situation. He said had I heard from our Department of Environmental Resources. I said no. I said I haven't talked to anybody about it, it is just the word I received from Colonel Henderson. As we had done all through the crisis-and by this time we had been subject to many conflicting pieces of information-we had to track that down because we felt there were liabilities to evacuating if there were not liabilities to not evacuating. The Governor got on the phone with Colonel Henderson, with our DER and NRC people in Washington. Apparently-I was not there at the time-but Colonel Henderson says, and the Governor agrees-the Governor said is your advice to evacuate. Colonel Hen- derson said, based on what I know, which was the information that came from Mr. Collins, yes. We continued to track that down because we didn't know who Mr. Collins was, and we didn't have any confirmation of that from our people at DER. It became clear to the Governor as he made those calls that there was not substantiating information to require an evacuation, that the downwind readings were not high, the plume was not at PAGENO="0438" 434 the 1,200 millirem, although it was high, and there was not the danger. Mr. ERTEL. Were you there when this was going on? Mr. SCRANTON. No, I was not. I was on my way into the civil defense headquarters. Then later that morning I left civil defense headquarters. and went into the Governor's office. He was on the phone with NRC. Colonel Henderson came with me. Colonel Henderson having found the information that we then knew-and he has said this publicly-indicated that he felt that at that point the Governor was right, and there was no need for an evacuation. Mr. ERTEL. The second question is one that I have received a lot of communications about from people in the area. This is from Swatara Township, which is a very large township, close to the site, within a 3-mile radius. They indicated and wanted to find out five answers to five ques- tions. There is only one you may be able to provide an answer to. I will read it. Mr. Constanza has referred to the complete lack of communication which existed at all levels during the emergency. He has also presented five important and critical questions which have as yet remained unanswered. I guess there are two here you may be able to answer. They said: No cooperation, communication, coordination or decisions as the question of evac- uation, either from Met-Ed, NRC or the Governor's office. All three organizations ignored all local directors in Dauphin County Office of Emergency Preparedness as though they were not in existence. I guess he wants to know-he is the Swatara Township civil defense director and I think he is also the township supervisor. I had the same complaint from the Borough of Royaltown, adjacent to Middletown. I had the same complaint from the director of civil defense there. Probably you could clear that up in the record. Mr. SCRANTON. Yes~ I have admitted this and I will admit it here. I think to sOme degree their complaints are warranted. Let me explain to you how civil defense works in the State because it is important to an understanding of that. The State office of civil defense does not have a great deal of power over the local counties, but it is a coordinating body and a directing body. It is up to the local counties to come up with these kinds of plans. When this accident occurred, as planned Met-Ed notified Penn- sylvania civil defense and the Dauphin County civil defense direc- tor. Pennsylvania civil defense director then notified Dauphin County and the surrounding county directors. It is their job to notify their local municipal directors. To the extent that may or may not have happened, I don't know. Mr. ERTEL. May I interrupt you for a moment. I talked to some- body in Dauphin County, and they were complaining to me they were getting no information, either. Mr. SCRANTON. That is further down the line. This is when the accident occurred. Second, the information that came out of the State Council of Civil Defense, I think, for the first couple of days was pretty good to the extent we knew the information. PAGENO="0439" 435 It is not the job of the Governor's office to communicate with the county civil defense; although I visited Dauphin County on two occasions, one on I believe Saturday and perhaps Sunday morning, and one again Monday afternoon because of this very problem. By that time, Harold Denton was in Harrisburg. We had made an agreement with the President that all technical information, onsite information, information about what was going on at the reactor, would come from Harold Denton. He would come to the Governor's office and talk to us, and then we would take him out, and there would be press conferences. There would once or twice every day, be updates. I think I, and I can only speak for myself, assumed that the local civil defense people were listening to what Harold Denton had to say. I think I probably underestimated the extent to which there `was confusion on that level. I think there was a feeling all along by the Governor's office that ~what was reliably known ought to be made public, and that it ought to be disseminated. But I think as we go back and investi- gate and search over the emergency management aspect of it, I think the communication thing is going to take some looking into. I personally visited Dauphin County on a number of occasions, tried to placate them. I don't know about the local townships. That has to come from the county. But our responsibility is to `the county level. There may have been some lack of communication. There was never at any time a holding back of information on Three Mile Island. That was the important thing. If we ever thought there was a need to evacuate or had we ever thought they were not getting information sufficient to prepare them for evacuation, that would have been remedied immediately. Mr. ERTEL. One other question. I think that is going to be a fuzzy area, that people are going to be looking at for a long period of time, because all I am getting is the aftermath, not getting the information. Dauphin County says they were not getting the information. This keeps spiraling. I suppose as people's recollections fade a little bit it is going to get worse instead of better. Mr. SCRANTON. We kept Dauphin County very closely informed, particularly during the height of the situation, over the weekend. I went down there personally, and kept them informed. Mr. ERTEL. The next question: "What is account No. 1978.323 S.B. 1104, Title 35, Health and Safety Emergency Management Services, enacted 26 November 1978, if the State of Pennsylvania doesn't abide by its contents?" I haven't had a chance to look up that section. Do you know what it is? Mr. SCRANTON. No; I don't. Mr. ERTEL. Then you won't have to answer the question. Thank you. Mr. MCCORMACK. We are going to recess in about 5 minutes, until 1:30. This is at the request of both Congressmen Ertel and Wydler. We are going to come back' at that time and pick up with Mr. Denton. PAGENO="0440" 436 I think you all can appreciate the fact that we are trying to get the inforn~ion out, give~ people a chance to testify, and ask and answer questions. If we have a fault, it is because we have sched- uled so many interesting witnesses all in 1 day. I shall not ask that the witnesses who have testified return at that time, if it is inconvenient for you. That is up to your discre- tion. Please don't feel obligated to come back unless it is conve- nient because I don't want to hold you beyond this time. Now, Mr. Ambro, do you have any questions? Mr. AMBRO. I do not, Mr. Chairman. Mr. MCCORMACK. I have a question. Very quickly, in your testimony, you referred to the State role in insuring safe operation of nuclear plants. This conjures up a great number of problems. Mr. SCRANTON. Yes; I know. Mr. MCCORMACK. If I may interpret that as reflecting your desire to know by examining, shall we say, the procedures, the NRC licensing and so on, that it is being done properly. Mr. SCRANTON. I am not suggesting that another bureaucracy be set up on the State level. I am fully aware of the. dangers of that, and particularly if there develope squabbles, for other the n techni- cal reasons, between state and federal. I do think, however, there was a feeling on the part of those of us in State government, and the people in the area that State govern- ment had a responsibility for the safety of the people, and yet had very little control over what was going on at the plant. I am only advocating in my testimony that State government have more participation. I am not sure at this moment what the extent of that participation ought to be. But I think it is definitely warranted that it have more participation. I don't think a nuclear powerplant, if the regulations of NRC are adequate, should have to go through another State exhaustive search. But I do think there ought to be a presence of the State, and some power by the State to have some control, particularly in an emergency situation. I realize that is very vague. I only say that to introduce the principle. What the specifics of that principle will be I cannot outline here. Mr. MCCORMACK. I appreciate that. I think it is wise to keep it vague at the present time. I sympathize with your problem, but I am sure you recognize the problems it conjures up. Mr. SCRANTON. Absolutely. Mr. MCCORMACK. Let me ask you one final question, if I may. In your role as civil defense director for the Commonwealth of Penn- sylvania, one of the obvious responsibilities that you have, it seems to me, would be to mitigate potential fears that might lead to hysteria, and-hysterical reaction. I had telephone calls coming to my house, from people who lived in Baltimore, wanting to know if they should evacuate because they had 18-year-old daughters and were they safe. I told them the Huns were not coming and the girls were safe. Mr. SCRANTON. From radioactivity. [Laughter] Mr. MCCORMACK. But the problem we run into is this hysterical reaction, which has unfortunately been fanned by a lot of antinu- PAGENO="0441" 437 clear activists-I will he charitable and call them activists-and a large part of the press and media, hysterical and emotional reac- tion, and overdramatization, oversensationalism, associated with the whole question of nuclear energy and radiation exposure. It would seem to me one of the contributions you could make to the ultimate safety of the people of Pennsylvania is a sort of a general appreciation of this, along with many other problems, so that you would not have a hysterical reaction, in case you have an accident. For instance, I find it somewhat interesting that airline stewar- desses get more radiation than any other professional group simply because they fly high, they receive from 50 to 70 millirems of exposure per month, which is more than virtually anybody around the plant, and that is the maximum anybody around the plant could have received, according to NRC calculations. In other words, every airline stewardess, especially flying long flights at high altitudes in jet planes, receives more radiation every month than anybody received in total from the accident, any member of the public around the plant. Yet the airline stewardesses have just, because of their protest, been allowed to fly while they are pregnant. So here they are getting more radiation than anybody could have received around the plant, and insisting that they work while they are pregnant. Now, this is just a little example of the lack of understanding and comprehension about radiation, and its effect and what low- level radiation is. I wonder if it has occurred to you that a contri- bution you might make to the people of Pennsylvania is some sort of education program related to low-level radiation hazards, and lack of hazard, so that they could treat these problems rationally if such a problem should occur again. Mr. SCRANTON. You are right on that. We are currently design- ing a booklet, civil defense booklet, which is very rudimentary, about what you do in a nuclear accident, what basically occurs. Every cloud has a silver lining, and I think there is one here. I think that any reluctance there might have been on the part of populations in the United States to worry about radiation has been swept away. I think we have an opportunity now to impose upon people an education which they otherwise might not have gotten as to what exactly are the differences between radiation that comes from an atomic bomb, a nuclear plant, or cOme from a granite building, or an airplane flight. What are the thyroid hazards and others to pregnant mothers and preschool children. I think that that will be known over time as we investigate Three Mile Island. We are going to push it on the State level, so people, when an accident occurs, know exactly what is going to happen, or what can possibly happen and what can not, so they can worry about what they ought to worry about. A great deal has to do with the feeling of vulnerability out there now. For instance, Europe, which has been vulnerable to wars for several generations, has half again as much higher regard for civil defense, military civil defense, than the United States of America because we never felt ourselves threatened. Just the ability to take precautions in case of an attack was always something that we never took very seriously. PAGENO="0442" 438 I think the same is true of nuclear power plant incidents. We now feel vulnerable. I think that very vulnerability gives us the opening to educate ourselves more as to what is going on. I think that education will take place. To the extent that I or the Civil Defense Agency of Pennsylvania can be helpful in that, we are going to be. Mr. MCCORMACK. Thank you very much. I might say that we will be holding hearings on low level radiation in June, and I would invite you to have some member of your staff come and sit in. They look like they will be very worthwhile. I want to thank you for coming. Especially I want to thank you again for the remarkable responsibility, maybe it wasn't remark- able in your case, but it was an outstanding example of responsible leadership that you and the Governor of Pennsylvania provided. I want to congratulate both of you for it. Mr. SCRANTON. Thank you, Mr. Chairman, very much. [Lt. Governor Scranton provided answers to additional questions for the record. These questions and answers are in the Appendix, beginning on page 1163.] Mr. MCCORMACK. We will recess Until about 1:30. [Whereupon, at 1:05 p.m., the subcommittee recessed, to recon- vene at 1:30 p.m., the same day.] AFTERNOON SESSION Mr. MCCORMACK. The committee will come to order, please. We will resume our hearing on Three Mile Island. Our next witness is Mr. William Denton, who is Director of the Office of Nuclear Reactor Regulation of the Nuclear Regulatory Commission. Mr. Denton covered himself with glory and became a TV star during the days immediately following the Three Mile Island acci- dent. I understand there were T-shirts printed in the Three Mile Island area that said something to the effect that, "Harold Denton can activate me any time he wishes", or something like that. Mr. DENTON. That came after I left. Mr. MCCORMACK. In any event, we are very happy to have you here, Mr. Denton, and we would like to ask you to introduce your colleagues you have brought with you. Your testimony has already been inserted in the record in its entirety. [The prepared statement of Mr. Denton follows:] PAGENO="0443" 439 TESTIMONY OF HAROLD R. DENTON, DIRECTOR OFFICE OF NUCLEAR REACTOR REGULATION BEFORE THE SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION OF THE HOUSE COMMITTEE ON SCIENCE AND TECHNOLOGY WEDNESDAY, MAY 23, 1979 Thank you, Mr. Chairman. I appreciate the opportunity to discuss with the Subcommittee the accident at the Three Mile Island Nuclear Station and'its implications to reactor regulation and to nuclear safety technology. The significant events of the accident have received considerable publicity and have been discussed at some length with various Congressional committees. I will not attempt to recount those events in detail here. However, I have brought a copy of a detailed sequence of events prepared by the Office of Inspection and Enforcement. I would like to submit a copy of that for the record along with several figures that I will be referring to later in my testimony. The details of the accident continue to be extensively investigated. However, based on the partial investigations to date, six main factors have been identi- fied that caused or increased the severity of the accident. The apparent fac- tors include a combination of design deficiencies, equipment failures, and oper- ator error. Specifically, they are: 1. At the time of the initiating event, loss of feedwater, both of the auxiliary feedwater trains were valved out of service. This was a violation of the plant Technical Specifications which are part of the facility's Operating License. PAGENO="0444" 440 2. The pressurizer electromatic relief valve, which opened during the initial pres- sure surge, failed to close when the pressure decreased below the actuation level. The block valve downstream of the relief valve was not used immediately for isolation of the leak. 3. Following-rapid system depressurization, the pressurizer level indication may have led to erroneous inferences of adequate water inventory in the reactor coolant system. The pressurizer level indication led the operators to pre- maturely terminate high pressure injection flow, even though substantial voids existed in the reactor coolant system. 4. Because the containment does not isolate on high pressure injection (HPI) initiation, the highly radioactive water from the relief valve discharge was pumped out of the-containment by the automatic initiation of a transfer pump. This water entered the radioactive waste treatment system in the auxiliary building where some of it overflowed to the floor. Outgassing from this water and discharge through the auxiliary building ventilation system and filters was the principal source of the offsite release of radioactive noble gases. 5. - Subsequently, the high pressure injection system was intermittently operated attempting to control apparent primary coolant inventory losses through the electromatic relief valve, based on observed pressurizer level indication which led to a further reduction in primary coolant inventory. 6. Tripping of all reactor coolant pumps during the course of the transient to protect against pump damage due to pump vibration, led to fuel damage since voids in the reactor coolant system prevented natural circulation. PAGENO="0445" 441 Certain actions have already been identified and are being implemented on operating plants similar to Three Mile Island and on other operating plants to prevent recurrence of the accident. Reviews of these plants are ongoing by the NRC staff. I will discuss these ongoing actions later. In addition to the various Congressional investigations being conducted and the Presidents Commission to Investigate the Three Mile Island Accident, extensive investigations of the accident are being conducted by the NRC, in- cluding the Advisory Committee on Reactor Safeguards. These investigations are to determine the facts, to identify the need for improvements in the de- sign and operation of nuclear plants, to identify the need for changes in regulatory requirements and procedures, incident response capability and emer- gency preparedness, and to identify safety research and development needs. Our initial review of the accident indicates that there are a number of areas where improvements should be made. First, an area that will receive increased emphasis in our staff reviews is on the analyses of anticipated transients and small break loss-of-coolant accidents. Our bounding approach to the analysis of such transients and accidents in the past must be rethought and replaced by a more rigorous approach that includes a more appropriate treatment of equipment failures, system interactions and operator actions. This idealized approach has, in the past, given us a level of confidence in our existing licensing require- ments and procedures that perhaps appears unwarranted in retrospect. Increased emphasis in this area will include an upgrading of the NRC's independent capa- bility to perform calculations for transients and small break loss-of-coolant accidents. PAGENO="0446" 442 A second area is a careful reexamination of. the sensitivity of all plant de- signs based on these transient and accident analyses to determine the need for new safety systems or improved operating procedures. A third area is a substantial upgrading of reactor operator training and staffing. In addition, a hard look at the adequacy of the information available to oper- ators, th~ procedures which operators employ and various aspects of human factors engineering will be undertaken. The objective of such reviews will be to make the operator a more effective recovery agent or incident/accident mitigator. A fourth area, which has already received considerable publicity and discussions is a renewed examination of the emergency response capability of licensees and local, State and Federal officials. We are moving rapidly to install direct and dedicated telephone lines between operating plants, the NRC Response Center and the NRC Regional Offices. We anticipate that the first system will be in- stalled by the end of May and that most facilities will have a direct line by the end of June. In additionto the improvements to off-site response capability, increased priority will be given to the licensee's post-accidentmonitoring equipment. Such equipment will be upgraded where necessary to improve the ability of licensees to determine and advise others as to the magnitude of an accidental release. There are many more areas where improvements will be considered. Requirements for design changes and operational improvements beyond those already being implemented are likely to result from the extensive investigations being con- ducted. These requirements will be reflected in new or revised regulations, changes in review and inspection practices and procedures, new or revised in- dustry standards, and improved and more explicit regulatory guidance. PAGENO="0447" 443 The immediate focus of the staff's activities arising from the TMI-2 accident was three-fold: (1) provide the technical and regulatory support necessary to assure the safe operational shutdown of TMI-2; (2) assure that other reactor ope~'ators, particularly for those plants similar in design to TMI-2, take immediate actions to substantially reduce the potential for subsequent TMI-2 type events and (3) start comprehensive investigations into the potential generic implications of this accident onother operating reactors. This evaluation sequence is shown in Figure 1. Priority of these last two actions was initially on reactors of the B&W de- sign, but as short-term actions on these plants are completed, priority is then shifted to other PWR plants manufactured by Westinghouse and Combustion En- gineering. Activities relating to boiling water reactors, a significantly different light water reactor type manufactured by General Electric Company, are being pursued as a third priority. The preliminary review of the accident chronology identified several events that occurred during the accident and contributed significantly to its severity. All holders of operating `licenses were subsequently instructed to take a number of immediate actions to avoid repetition of these errors, in accordance with bulletins issued by the Coninission's Office of Inspection and Enforcement. The initial bulletins defined actions by operating plants using the B&W reactor system, but as staff evaluations determined that additional actions were necessary, these bulletins were subsequently expanded, clarified, and issued to all operating plants for action. For example, as a result of staff evaluations, holders of operating licenses for B&W designed reactors were instructed by I&E Bulletins to take further actions, including irrinediate changes to decrease the reactor high pressure trip point PAGENO="0448" 444 and increase the pressurizer pilot-operated relief valve settings. A chronology of bulletins issued by the Office of Inspection & Enforcement is shown on Figure -2. In addition, as noted previously, the NRC staff began immediate reevaluation of the design features of B&W reactors to determine whether, and if so, what additional safety corrections or improvements were necessary. This evaluation involved numerous meetings with B&W and certain of the affected licensees, and included the formation of an interoffice evaluation team to review the actions taken by licensees in response to the I&E Bulletins. The conclusion of these preliminary staff studies were documented in an April 25, 1979 status report to the Comission. We found that the B&W designed reactors appeared to be unusually sensitive to certain off-normal transient conditions originating in the secondary system. The features of the B&W design that contribute to this sensitivity are: (1) design of the steam generators to operate with relatively small liquid volumes in the secondary side; (2) the lack of direct initiation of reactor trip upon the occurrence of off-normal conditions in the feedwater system; (3) reliance on an integrated control system (ICS) to automatically regulate feedwater flow; (4) actuation before reactor trip of a pilot-operated relief valve on the primary system pressurizer (which, if the valve sticks open, can aggravate the event); and (5) a low steam generator elevation (relative to the reactor vessel) which provides a smaller driving head for natural circulation. PAGENO="0449" 445 Because of these features, the B&W reactor design relies more than other PWR designs on the reliability and performance characteristics of the auxiliary feedwater system, the integrated control system, and the emergency core cooling system (ECCS) performance to recover from certain anticipated transients, such as loss of offsite power and loss of normal feedwater. This, in turn, requires greater operator knowledge and skill to safely manage the plant controls during such anticipated transients. Also as a result of the work supporting the April 25, 1979 report, the NRC staff identified that certain other short-term design and procedural changes at operating B&W facilities were necessary to order to assure adequate protection to public health and safety. After a series of discussions between the NRC staff and licensees of operating B&W plants, each licensee agreed to perform promptly the following actions (a) Upgrade the performance and reliability of the Emergency Feedwater (EFW) system (b) Implement operating procedures for initiating and controlling EFW independent of the Integrated Control System Cc) Implement a reactor trip that would be actuated on loss of main feedwater and/or on turbine trip Cd) Complete analyses for potential small breaks and implement operating instructions to define required operator action in the event of such small breaks (e) Provide at least one Licensed Operator who has had Three Mile Island Unit No. 2 (TMI-2) training on the B&W simulator in the control room. 48-721 0 - 79 - 29 PAGENO="0450" 446 Actions were initiated by the licensees to shut down the B&W plants and kept them shut down until these actions could be completed and the results reviewed by the staff. In addition to these modifications to be implemented promptly, each licensee also proposed to carry out certain additional long-term modifications to further enhance the capability and reliability of the reactor to respond to various transient events. These actions have been confirmed by a Commission order to each licensee. In the case of the three-unit Oconee station, the necessary short-term actions were satisfactorily completed last Friday (May 18), and the Duke Power Company was given authorization to resume operation. Other sections of the order, however, remain in effect pending completion of the longer- term actions. Review of the actions completed and information submitted con- tinues for the other B&W operating plants, and it is expected that authori- zations to resume operation will be issued as individual plants satisfactorily comolete the short-term actions over the next several weeks. In terms of generic implications,wehave completedthe initial staff study primarily focused uoon B&W reactors. The results of this study have been published in a staff report (NUREG-0560). As shown in Figure 3, this study considered the particular design features and operational history of B&W operating plants in light of the TMI-2 accident and related current licensing requirements. As a result of this concentrated effort, a number of findings and recommendations (Figure 4) resulted which are now being considered in other on-going and future investigations. Similar studies are now well underway for the Westinghouse and Combustion Engineering operating plants. These studies are expected to be completed and published next month. PAGENO="0451" 447 A similar study of the operating boiling water reactors will also be performed as a short-term effort. In addition, because of the importance that operators play in assuring a safe recovery from unexpected transients and continued safe plant operation, the staff has initiated a comprehensive review of current programs for operator training. As noted previously, the staff has concentrated on the imediate and short- term actions necessary to assure the safe operation of ooerating olants. However, basedupon actions already completed, we are aware of a relatively large number of items which warrant serious, careful study. These actions are being documented for detailed assessment as a `lessons learned' activity. Preliminary areas for investigation are identified later in this testimony. This activity, coupled with other ongoing investigations, both within and without the NRC, is expected to result in a number of imorovements in our regulatory requirements, and in the review and inspection process. These efforts are also expected to identify additional technical concerns which should be addressed throuqh new or redirected research programs. For ex- ample, discussions are now underway to conduct some small break LOCA tests at the LOFT facility to obtain a better understanding of small break LOCA phenomen phenomena and to use the results to verify calculational techniques. Other recommendations in this regard will be a specific element of our longer-range studies. The final area that I would like to address is the realignment of priorities and resources within NRR that have resulted from the accident at TMI-2. The accident has and continues to require that a significant number of managerial and technical members of the staff be diverted from their regularly scheduled licensing activities. PAGENO="0452" 448 It is clear that certain tasks that have evolved since the accident require high priority attention. These activities (ThI Direct Support, Bulletins/Orders, and "Lessons Learned") are currently assigned the manpower necessary to support these efforts. This manpower has been diverted from other NRR work and the remaining NRR priorities are the support of operating reactors (including the Systematic Evaluation Program and Safeguards), the resolution of Unresolved Safety Issues and a limited amount of casework reviews. The 1111 support effort includes monitoring, reviewing and approving licensee's core cooling, cleanup and recovery operations to assure that the reactor is maintained in a safe, cold shutdown condition and that occupational and offsite doses are as low asreasonably achievable. This effort will require a total of about 14 professionals and managers assigned to the site and headquarters. Since this task reqiires contiiuing and imediate attentior. and a task force aooroacn appears to be in order ~see ~ 5). This level of effct has decredsed from the approximately 150 staff members that were at or supporting the site shortly after the accident. I would expect that this activity would continue to about the end of this year. The second major ThI related activity that utilize a dedicated task force is the reviews of NRC issued bulletins and orders that were issued to all licensees of cerating plants. This effort has already been discussed and the organization of the approximately 35 managers and professionals is shown in Figure 6. The initial efforts dealing with the shutdown B&~I reactors is expected to be completed by about June 1, after which the task force will PAGENO="0453" 449 assume an analogous role for the other operating plants. It is expected that this group will apoly the results of other ongoing "lessons learned" grouos to those olants under review that are nearing a licensinq decision date. The third and final task force activity related to TMI is the tiRR "lessons ~earned" study. This study will examine the accident at TMI-2 to determine the implications on the technical basis used in licensing to determine what requirements or research are needed to buttress the regulatory process to continue to assure that there is no undue risk to the public health and safety. The range of areas of interest to NRR in which possible regulatory improvements are suggested by the TMI accident, include: (1) Reactor Operator Training and Licensing. (2) Reactor Transient and Accident Analysis. (3) Licensing Requirements for Safety and Process Equipment, Instrumentation and Controls (4) Offsite and Onsite Emergency Preparations and Procedures. (5) Reactor Siting. (6) Licensee Technical Qualifications. (7) NRR Accident Response Role, Capability and Management. (8) Reactor Operating Experience. (9) Environmental Effects. (10) Licensing Requirements for Post-Accident Monitoring and Controls. (11) Post-Accident Cleanup and' Recovery. (12) NRR Engineering Evaluation of TMI-2 Event Sequence. PAGENO="0454" 450 This effort will initially involve about 15 NRR managers and technical staff members (see Figure 7). Some of the evaluations and all of the implementation activities will be coordinated with other NRC offices. In addition to other NRR staff, representatives of other NRC offices will work with other Federal agencies, state and local governments, university, national laboratory and industry groups. The major recommendations of this group will be implemented as they are developed on operating plants and license applications under review. The task force efforts described above to support TMI related activities will divert resources from other NRR tasks. This will be done by realigning current and FY 1980 resources taking into account existing organizational priorities. The other major post-flu priorities that will be briefly dis- cussed are operating reactors, unresolved safety issues and casework (see Figures 8-12 for the organizations perforniing these tasks.) A summary of the impacts on our work will also be provided. We will continue to review operating experience and to take those actions necessary to assure safe operation, review requests to amend operating licenses and implement new or revised regulations or licensing criteria. Included in this effort is the evaluation of five plants that were shutdown in mid-March due to computer errors in the seismic design. Also included is the reactor related safeguards program and the Systematic Evaluation Pro- gram (SEP). The SEP effort involves the review of the older operating facilities with respect to current criteria and documents the results PAGENO="0455" 451 and identifies the need for plant changes. It is felt that these efforts could best be handled by the existing organizational structure and still meet our FY 1979 goals. The next priority area to receive redistributed resources is the Unresolved Safety Issues Program. These items are those generic issues with potentially significant public safety implications that are reportable to Congress in accordance with Section 210 of the Energy Reorganization Act, as amended. This task is to continue to perform those reviews and analyses necessary to complete generic tasks that address `Unresolved Safety Issues" with minimum impact on current schedules. Initially this task will include the 19 generic tasks identified in NUREG-0510 that address "Unresolved Safety Issues." Several of these 19 generic tasks will likely be expanded to address issues identified as a result of the TMI-2 accident. In addition, new `Unresolved Safety Issues" will likely be identified as a result of the TMI-2 accident. This "Unresolved Safety Issues" task will be expanded to include generic tasks to address these new issues as they are identified. As a result of the realignment of resources and priorities, the expected accomplishments in the casework task will be severely limited. The priority of case reviews will be: o Near-Term OLs O Comoletion of CPs in hearinq * Other OLs where comoletion of construction is anticioated by January 1981 o Soecial review considerations of a few CP and OL anolications PAGENO="0456" 452 A preliminary and generally optimistic identification of specific reviews that will be continued is contained in the final document I would like to submit for the record. A final andmore realistic assessment of the expected casework accomplishments can only be made after resour~e allocations to other higher priority tasks and assignments to the Commission investigation have been made. At this point in time the available resources can be matched against the resources required to continue the reviews identified in the above document on a "best-effort basis." It is our expectation that the case- work accorntlishrnents are the most we can expect to accomplish and that it is highly likely that accomplishments in this area would be less than iden- tified. In addition to the identified impacts on casework, the following FY 1979 and FY 1980 efforts will be severely restricted in that these efforts will continue only as available resources permit: * Generic Issues (other than USI's) * Licensing Improvements * Topical Reports *` Contract Management * Research Coordination * Non-NRR Support * SRP Revisions * Audit Calculations * Advanced Reactors* * Standards Assistance * Training In summary, I would note Chairman Hendrie's remarks where he stated: PAGENO="0457" 453 "It is my view, and I am sure it is yours as well, that we cannot have an acceptable nuclear power program in this country if there is any appreciable risk of events of the Three Mile Island kind occurr- ing at nuclear power plants. The Nuclear Regulatory Cocimission must promptly carry out a searching review and evaluation of our own policies and procedures, in addition to our investigation of what has taken place at the Three Mile Island facility. We must find out where our inspection and enforcement of safety-related operating requirements, our design standards, and our reviews of possible transient and accident situations have somehow been inadequate to prevent the Three Mile Island accident. We already have put those elements of the staff that are not irnediately in- volved in dealing with the situation at Three Mile rsland to work on this essential and major effort.~ Mr. Chairman, that concludes my prepared remarks. I will be happy to respond to any questions that you may have. Thank you. Mr. MCCORMACK. You may proceed with your testimony as you wish. Mr. ERTEL. If the Chairman will yield? Mr. MCCORMACK. I will be glad to. Mr. ERTEL. I think the things you said were very apropos of Mr. Denton, and he is one of the bright spots, and in the good sense of the word, at Three Mile Island as far as the people in Central Pennsylvania are concerned, and they certainly appreciate the fact he worked the long hours he did and brought the credibility he did to the situation there. On behalf of those people I want to thank him, too. Mr. MCCORMACK. I must say I agree with the gentleman from Pennsylvania, and I thought Mr. Denton's appearance and precise handling of the matter and especially the way he did not allow the press to put words in his mouth was a singular service to the country. Mr. Denton, please proceed. STATEMENT OF HAROLD DENTON, DIRECTOR, OFFICE OF NU- CLEAR REACTOR REGULATION, NUCLEAR REGULATORY COM- MISSION, ACCOMPANIED BY ROGER MATTSON, DIRECTOR, DIVISION OF SYSTEM SAFETY, NUCLEAR REGULATORY COM- MISSION, AND FRANK CONGEL, ACTING BRANCH CHIEF, RA- DIOLOGICAL ASSSESSMENT BRANCH, NUCLEAR REGULATORY COMMISSION Mr. DENTON. Thank you. I should say at the outset I was supported by a large number of NRC employees and other Federal employees, and I was really a spokesman for the organization there. The Chairman sends his regrets; he has a respiratory illness and cannot be here today. PAGENO="0458" - 454 I am accompanied by Dr. Roger Mattson, who is Director of our Division of System Safety. I have recently appointed him chairman of a special task force to determine what lessons we can learn from the Three Mile Island accident, and incorporate those lessons in our requirements and in our research program. On my right is Dr. Frank Congel, who is Acting Branch Chief of the Radiological Assessment Branch, and Frank spent a lot of time at Three Mile Island. He was one of the coauthors of the report that has been dis- cussed here concerning total man rem and occupational dose off- site. So if we get to questions in that area I will need assistance from him. My testimony covers about three principal areas. First, I have tried to summarize the highlights of the causes of the accident. The second part of the testimony deals with the bulletins and orders we have issued to licensees since the accident and the status of those plants. The final part of the testimony deals with the realinement of priorities and original structures within the organization to deal with the implications of the Three Mile Island accident and the plants for which we have not issued a license. Let me review these, and in view of the time problems we can take questions from the committee. With regard to the first issue, the accident itself, I think a lot of our major points have already been covered. I have attached to my testimony a chronology developed by our Office of Inspection Enforcement. This is based on the results of the investigation of that office. They have interviewed over 100 employees of the company. In the right-hand side of that chronology is indicated the source of the information, whether it's from interviews, charts, logs, computer printouts, and this sort of thing. I guess the only point I would like, or the major point I would like, to add about the accident is the fact that if you get away from what failed during the accident and the operator errors and equip- ment design inadequacy, what was going on was inventory loss in the reactor core that was unknown to the operators. They were losing water and due to the fact that the instrumenta- tion on the pressurizer was indicating high levels of water they turned off the means by which they were adding water and the core continuously lost water. They also lost control of the pressure and the pressure dropped in the system to what is called the saturation point to where voids would form and the core began to uncover, and at 100 minutes into the accident the temperature difference between the water going into the core and the water coming out of the core began to diverge widely indicating flow stagnation. It was at that point that core damage first began, and there were several subsequent times where the core may have been partially uncovered also and further damage occurred. Congressman Walker asked about the time at which water was pumped out of the containment. According to the chronology I have given you, it indicates that the water was first pumped out at about 7 minutes into the accident. It's of some interest to note that the sump of the containment at that time was not arranged so that PAGENO="0459" 455 it pumped water into the normal tank in the auxiliary building, which is a very large tank. The system was alined to a very small tank in the auxiliary building and besides that, the tank had a rupture disc which had blown. This tank was not able to hold very much water and, apparently, water overflowed this tank very shortly. The amount of water that had to be processed in the auxiliary building would have been markedly different if the system had been alined to the more normal tank. Mr. MCCORMACK. I interrupt you just to get some facts straight at this point. You say the pumping from the sump started 7 min- utes into the accident. Mr. DENTON. Yes, sir. Mr. MCCORMACK. What is the scale of the tank that receives the water after it goes through the pressure release valve, the quench tank? The quench tank was already filled? Mr. DENTON. Let me ask if Roger remembers that. Mr. MATTSON. There is some indication that the quench tank relief valve was leaking. The relief valve was opening at a pres- sure, I believe it says in the chronology attached here on the order of 120 pounds, where it was designed to relieve at 150 pounds. So there is speculation at this point-and little hard evidence, but speculation-that there had been some leaking from the quench tank during normal operations. Mr. MCCORMACK. Isn't the quench tank very large, or is it as- sumed it would only be receiving water for a very short time? Mr. MATTSON. No; it's not very large. Mr. MCCORMACK. It's normally expected to overflow or blow the seal in any prolonged operation of pumping water along that path from the high pressure injection system through the reactor through the pressurizer, through the pressure release valve. You then expect the quench tank seal to break in a relatively short time; is that correct? Mr. MATTSON. No; I think that is probably coming at it a little bit wrong. The quench tank is sized to take the expected opening of the PORV to quench the steam that comes from the PORV and neither pop its relief valve nor blow its rupture disk. It does have a relief valve, so for prolonged opening it can relieve some of the steam in a safe manner without rupturing the disk. But then it also has the rupture disk so that for a very long opening of the PORV the rupture disk will go rather than have the tank blow up. Mr. DENTON. The system was designed for many types of tran- sients and the pressure relief valve would open and prevent pres- sure at that point of the system and might open from 15 to 30 seconds. Mr. MCCORMACK. This is for steam, not water. Mr. DENTON. This would be for steam, and it's a very, very small opening in the system, so the quench tank size, I don't know the precise size, but it obviously would be sized to withstand that amount of water. Mr. MCCORMACK. W~s there water overflowing out of the pres- sure release valve or was it always steam? PAGENO="0460" 456 Mr. DENTON. It certainly started as steam, but the pressurizer was very nearly filled at some times. Mr. MATTSON. The pressurizer level indicators were off scale, high. We expect there was some two-phase water flow and some solid water flow. Mr. MCCORMACK. All right. Another question, so we all understand what we are talking about here. When the quench tank overflowed for whatever reason into the sump, it activated the sump pump, and that was at 7 minutes. Mr. DENTON. Yes, sir. Mr. MCCORMACK. That started pumping water then into a small tank instead of a large receiving tank in the auxiliary building? Mr. DENTON. That is correct. Mr. MCCORMACK. That tank had a rupture seal which also rup- tured; is that correct? Mr. DENTON. According to your investigation the rupture disk on the small tank was ruptured prior to the accident and was sched- uled for replacement. Mr. MCCORMACK. So this may be categorized as additional me- chanical failure? Mr. DENTON. Well, I would read it more as a valve alinement question. I am surprised it was aimed to a tank that was leaking. Mr. MCCORMACK. An operational failure. Now, is this the path? We have had some conflicting testimony, and all I want to do is get the facts straight so we all understand this. The primary path for the release of radiation to the atmosphere, that is, from the sump to the auxiliary building and following, and allowing for the fact that the tank in the auxiliary building also overflowed, that the ventilation system in that building then would have picked up the inert gases escaping from the water and they would have gone out through the ventilating system and through the traps and scrubbers and absorbers, and whatever. Is that the path that the radiation release followed? Mr. DENTON. I need to correct my testimony in that regard. I think on~page 2, on item 4, I say that this was the principal source; and I think we thought that at one time. It was a considerable source, it was primarily coolant water which contained gases and iodines and these were certainly evolved, having been spilled in the auxiliary building. However, a lot of gases that were released during the first few days were the result of deliberate let-down flow into the auxiliary building and controlling level inside of the reactor, and because of leaks in the let-down system. This was also a significant cause. So I don't think I can say whether it was the principal cause or not. It was certainly a considerable amount, but which part we have not ascertained. Mr. MCCORMACK. The high pressure injection system uses borat- ed water, doesn't it? Mr. DENTON. Yes, sir. Mr. MCCORMACK. This would take out the iodine, take out virtu- ally all of the iodine, wouldn't it? It's the sodium tetraborate. Wouldn't it pick up virtually all of the iodine in the water? Don't PAGENO="0461" 457 you have an option here that you must choose, if you are getting iodine out, you are not going to the borated water? Mr. DENTON. Well, it certainly should bind it up but nonetheless, there were still amounts of iodine being released from this let-down tank several days after the accident, even in spite of the high pressure injection system being used. So for one reason or another iodine was still being evolved from the primary coolant let-down. Mr. McC0RMAcK. Sorry to interrupt. Mr. DENT0N. I think maybe I have said all I want to about the accident per se. Let me just touch briefly on some of the actions that we have taken since the accident, then we will come back for questions. In reviewing the accident we found B. & W. plants are unusually sensitive to secondary system transients, and on page 6 I identify five factors that make B. & W. pressurized water reactors consider- ably more sensitive to transients than those designed by Westing- house or Combustion Engineering. First, design of the steam generator is such that it operates with very small liquid volume in the secondary side. The amount of water in a B. & W. steam generator is one-third to one-fourth the water in a steam generator of the other types of suppliers, so this means they have less tolerance for upset conditions. The steam generator at TMI boiled dry in 1 to 2 minutes follow- ing the loss of main feed water, and without auxiliary feed water coming in. The other designs have times between 15 and 30 min- utes before they would boil dry, so they have considerably higher tolerance for errors, and to allow time for operator reaction. Second, the B. & W. designs do not trip or scram on loss of feed water or turbine trip directly. The other designs do. The B. & W. plant, as originally designed, tripped only on high pressure, which is much further away in time than tripping on loss of feed water flow initially. Third, B. & W. plants rely on an integrated control system to regulate feed water flow. This controller itself has led to loss of feed water flow transients in some plants and has had the capabili- ty to interfere with the proper operation of the auxiliary feed water system. Fourth, the actuation before the reactor trip of the pilot operated relief valve is unique to B. & W. plants. The other types of designs do not or have not experienced the opening of the pressurize relief valves as often as the B. & W. plants. Last, the B. & W. plant has a smaller driving head for natural circulation. When we realized these features of the B. & W. plant more clearly after the accident we issued orders to all of the B. & W. plants, requiring they make certain changes. We required that they upgrade their performance of the auxiliary feed water system, they divorce the integrated control system from the auxiliary feed system; they install wiring such that they would trip on loss of feed water flow and turbine trip. This reduces the heat generation of the reactor by 8 to 10 full power seconds compared to the situation that existed before. We required that they do detailed analysis for small breaks and that PAGENO="0462" 458 they develop procedures and train operators to cope with these events. I have now permitted one B. & W. plant to go back into oper- ation. That is the Oconee plant in South Carolina. We made a finding prior to that they had complied with the terms of the order. One plant at Oconee did not have to shut down according to the order. The second plant had shut down and the third plant was down for refueling. All of the other B. & W. plants are all shut down. We are reviewing those in a schedule to see when they comply with their orders and allow them to return to operation. Turning next to the longer term issue, we have restructured our organization slightly to deal with the implications of the Three Mile accident. I still continue to have about 20 professionals in- volved in following modifications and cleanup at Three Mile. I have a number of people involved in reviewing the bulletins and orders we have issued to all of the plants. We have created a special lessons learned group that Dr. Matt- son is heading. This has required that I deplete the resources of the staff that formerly would do a case review, so the Commission has approved by deferring action on a large number of plants that we would otherwise be working on during the next 6 months. What we hope to do is to develop a list of those changes that we would like to see made in plants before they receive operating licenses or construction permits in the future. Once we develop this list and have it reviewed by the ACRS we will send it to the licensees and we will review their responses. The impact of this kind of approach means that there is at least one plant, Salem II, which is otherwise ready for an operating license that will not receive an operating license until they have received from us the changes we would like to see. There might be one or two other plants which will be affected in the schedule. Plants which are due to receive operating licenses by the end of the year probably will not be affected if we are able to complete our review of the Three Mile Island implications by that time. So with this brief summary I would be happy to go into detail on any of the aspects and I think perhaps we can take questions. Mr. MCCORMACK. We will have questions for a few minutes and then we have to go over and vote. Mr. Denton, Dr. Chauncey Kepford yesterday in his testimony talked about exposure rates which he said existed or said someone else said existed. He claimed there were radiation levels of 10 rads, said the NRC lied, said that there would be somewhere between hundreds to thousands of deaths as a result of radiation from the Three Mile Island accident. Would you care to comment on that? Mr. DENTON. We have followed radiation levels very closely from the time we arrived. We had some 89 people on site Friday night, about half of whom were involved in monitoring offsite. We in- stalled our own monitoring equipment. I never heard those levels ever reported or approaching those kinds of levels. Mr. MCCORMACK. You heard Lieutenant Governor Scranton's tes- timony just a few minutes ago where he claimed that his figures PAGENO="0463" 459 and your figures agreed. I have forgotten the levels he quoted but they were in the millirems. Mr. DENTON. My estimate of the maximum offsite dose is on the order of 100 millirems and I concur in those numbers contained in the record generated by representatives from NRC, HEW, and a number of other Federal agencies who pooled all of the data availa- ble to us on doses and calculated maximum doses and man rem. Let me ask Dr. Congel, who participated in writing the report, if he would like to comment specifically. Mr. MCCORMACK. Sure. Dr. C0NGEL. The group I was a member of did make use of data that were taken on and offsite, initially by the utility only and subsequently by a number of agencies, including the NRC and DOE. As Mr. Denton pointed out, it's our best estimate that the maximum offsite exposure is less than 100 millirem and in our report we say that the best value we have for it is 83 millirems. This refers to a hypothetical individual. We just chose a point where the dispersion was the poorest and, therefore, the dose would be the highest, and hypothesized an individual being there. Mr. MCCORMACK. And this would take a person having to con- stantly move to wherever the radiation level was highest. Dr. CONGEL. No, sir; this would be at one location and the expo- sure would take place during the time the plume-- Mr. MCCORMACK. So you chose the highest spot outside of the fence? Dr. CONGEL. Yes. Mr. MCCORMACK. And the person there at that point for that period, how long a period of time was that? Dr. C0NGEL. This was for the duration that we covered in our report, and that was from the beginning of the accident through April 7. - Mr. MCCORMACK. So about 10 days? Dr. CONGEL. About 10 days. Mr. MCCORMACK. Now, a person at the maximum exposure point for about 10 days you believe would have received about 83 mil- lirems. Dr. CONGEL. Eighty-three. Because of some trimming of the number we say less than 100, and that would characterize this. This is at a location just offsite, in the east, northeast sector. Mr. MCCORMACK. Do you think anyone actually was in that area to receive that much? Dr. CONGEL. No. The committee's consensus, as well as my own view, is that this is a conservative or overestimation of a true individual dose. Mr. MCCORMACK. What is your belief that the maximum expo- sure to any one person actually was? Dr. CONGEL. Because of some uncertainties in times a person would actually be there, I would say, off the top of my head, that we probably overestimated by a factor of two, maybe more than that. Mr. MCCORMACK. You think the maximum exposure would be 30 to 40, right? Dr. CONGEL. Thirty to forty, right. PAGENO="0464" 460 Mr. MCCORMACK. Millirem? Dr. CONGEL. Millirem, yes. Mr. AMBRO. Mr. Chairman, would you yield just for a second? Mr. MCCORMACK. Certainly. Mr. AMBRO. As I recall the testimony of Lieutenant Governor Scranton, he said Colonel Henderson of the commonwealth was told by Mr. Collins, whoever he is, that the release was 1,200 millirems from the plant. Now, we are not only dealing with re- ality we are dealing with government officials' perception. Have you ever traced that account? Mr. DENTON. Yes, sir. I can clarify that. I was in Bethesda that morning at our incident center and we received a report from our people at the site that a helicopter had measured a plume Over the containment of approximatey 1,200 millirems an hour. We were not sure of the source of the plume and what the chances were of another puff release and, in fact, I think we had been told that another release should be expected in 3 to 4 hours. So, based on that, I and others recommended to the NRC that we advise the Governor that evacuation was recommended. Mr. AMBRO. But later the report turned out to be spurious or false. Mr. DENTON. We had the extreme communication difficulties with people at the site. It was very difficult to communicate with people who had source data and we had failed to establish any contact with one person in the company who could verify certain numbers, and this was understood to be a company helicopter and a company number. By the time we had informed the Commission we had data coming into our incident center that the offsite doses were not anything like what you would expect if you extrapolated that plume, they were more on the order of 10 millirems an hour under the maximum spot, for the plume. Apparently, the 1,200 number could not be verified. So, we had misinformation and, in fact, once I arrived at the site I have never been able to pin down the source of this~ 1,200 mil- lirem that was reported back. So that particular number was one of many, I think, in those early days that in retrospect we cannot confirm. Mr. AMBR0. How fast was the wind moving at that time? Mr. DENTON. Very stagnant, and the data indicated that what- ever plume had been released that morning sort of hung over the site, because the offsite doses, as I recall, were never measured to be very high. Mr. AMBRO. You feel if there had been a high reading you would have found it? Mr. DENTON. Yes, sir. Mr. AMBR0. It would have blown away. I think we should interrupt at this time and go to vote and we can recess for about 10 minutes and take up where we are. [A short recess was taken.] Mr. McCORMACK. The committee will come to order. Mr. Denton, although it is not specifically within the jurisdiction of this committee, I would like to ask you a question about the delay in licensing that you just mentioned in your testimony. PAGENO="0465" 461 Can you tell me how many B. & W. plants there are that have been on the line, that are now down, excluding Three Mile Island II, following the Three Mile Island accident? How many are now off the line and approximately when do you expect them to come back on? Mr. DENTON. Yes, sir. There were a total of nine B. & W. plants licensed to operate before the accident. Three Mile Island unit 1 was down at the time of the accident of unit 2, and both of those units still are shut down. This left seven plants that had licenses to operate. When we decided to issue orders, there were only four plants I believe actual- ly in operation. That was the Rancho Seco plant in California and the three units owned by the Duke Power Co., in South Carolina, the Oconee units 1, 2, and 3. The orders required that Rancho Seco shut down and that one unit of the Oconee units shut down for that weekend. It gave the Duke Power Co. 2 weeks to shut down a second unit, and 3 weeks to shut down a third unit, if by that time they had not made the changes that were required. We focused our attention in reviewing their responses to the order only on Oconee units, and we did complete last Friday a review of the changes made by Oconee, and I found they had complied with the order. So, they did not have to shut down the unit that would have otherwise been required by the order. However, they were not able to start up the second unit because they had not qualified a suffi- cient number of operators in the new required training. Whenever they completed the qualfication of sufficient operators to meet our requirements, they could. put the second unit into operation. I understand they expected to meet that requirement early in this week. So today or tomorrow they may be bringing the second unit back into operation. So they would be the only two units of B. & W. design that would be operating in the near future. We would hope to complete on an approximately one-a-week basis the other B. & W. plants. Mr. MCCORMACK. So in about 6 weeks you would expect them to be back on the line? Mr. DENTON. Those who had completed their refueling. Some of the B. & W. plants were down for other purposes than the order, and they would remain down for whatever the activity was. I understand that Rancho Seco, for example, is making some modifications to the turbine generator equipment that requires them to be down for several more weeks anyway. Mr. MCCORMACK. What about the plants that were closed down because of the uncertainty on the earthquake computer analysis? There were six of those altogether, I believe. Mr. DENTON. There were five. Mr. MCCORMACK. When do you expect them to be back up? Mr. DENTON. We have made very considerable progress on those five, and I anticipate allowing one of those, Maine Yankee, to resume operation this week. At least one other plant is very near completing the analyses, and they show with a few modifications, stresses will be within limits, and perhaps a second one to follow next week. 48-721 0 - 79 - 30 PAGENO="0466" 462 There might be one plant which will take a considerably longer period than the others, but we have come a long way since the original five. Mr. MCCORMACK. The plants that will be delayed getting their licenses, like Salem, because of the general overall workload, and the other plants whose licenses have been delayed because of the overall workload, do you expect they will be on the line by late this year, by summertime? Mr. DENTON. There were six plants expected to receive operating licenses between now and the end of the year. These are the ones that, with the concurrence of the commission, we have said we were not going to issue operating licenses until we have deter- mined what changes they should make as a result of the Three Mile Island accident. We anticipate that will take at least 3 months, starting from today, on each plant. So plants who would otherwise have been ready between now and 3 months will be delayed. But plants such as LaSalle, for example, that didn't expect to complete construction until December, I would anticipate we could review and make whatever changes were necessary in that plant before it would be completed in any event. Mr. MCCORMACK. It looks like we would have about 75 plants on the line by the end of the year if everything goes well. Total in the country. Mr. DENTON. That is approximately correct, sir. Mr. MCCORMACK. Thank you very much, Mr. Denton. Mr. Wydler? Mr. WYDLER. If I can just clear this up in my own mind. You heard the testimony concerning this memorandum of January 8, commission memorandum. You are aware of this memorandum? Mr. DENTON. Yes, sir. Mr. WYDLER. Did this memorandum-it is only described to me as being a memorandum in which a commission inspector stated there appeared to be generic safety problems with Babcock and Wilcox designed nuclear plants. Did it deal with any of the problems that we have been hearing about all day today regarding Three Mile Island? Mr. DENTON. Yes, it did. Mr. Criswell exhibited a good deal of prescience in writing this memo. The events and types of concerns he had were very much on the mark. I think it was reviewed in a regional office f:~ a period of time and I think was transmitted to headquarters on March 6. Mr. WYDLER. March 6, they say the commission's assistant direc- tor recommended that the Atomic Safety and Licensing Boards be informed of it. Mr. DENTON. So the memo was just beginning to get attention and get in the formal chain about the time the accident happened. Mr. Criswell has since appeared before the commission and other bodies and explained the circumstances. In our decision to order down the B. & W. plants, his views played a considerable role and, in fact, we went back and reviewed all the accidents or similar types of events that had occurred in B. & W. plants before the Three Mile Island accident. PAGENO="0467" 463 Mr. WYDLER. Well, I presume, then, what happened is that on March 6 they decided to look at it in any event. You didn't arrive at Three Mile Island until the day after the accident, so you wouldn't have had much to do with that. All of these matters that he has raised, whatever they are, are being incorporated in your thinking regarding the relicensing of the Babcock and Wilcox plants. Mr. DENTON. Yes, sir. Let me ask Roger to be more specific. Mr. WYDLER. All I want is a yes or no. Mr. DENTON. Yes, sir. Mr. WYDLER. Now, what would normally happen? Suppose there had been no Three Mile Island accident and this report had reached the people at Three Mile Island, and the other people with Babcock and Wilcox plants? What would they normally have done with a report of this kind without Three Mile Island? They just read them and file them, or did they actually do something with them? Mr. DENTON. No, sir. Our procedures are as follows. If we have already completed our safety evaluation, and issued it on a plant, and that proceeding is before a board, and we obtain new informa- tion, such as Mr. Criswell's memo, we send it to the board so that it can be included as a part of the adjudicatory record, and be subject to the normal hearing process, since we didn't know that at the time we wrote our SER. We would address those new items that come up before our licensing board for all plants that we had already written an SER on. But for the plants we had not written a report on, we would have taken Mr. Criswell's memo and begun to reflect in our review the kind of things he had brought up. Since it had just reached my office that month, we had not yet formally taken action on it. But the process for new information is that we be sure that the boards know what we know whenever we first get the information. Mr. WYDLER. All right. Now I would like to spend the next few minutes, if I can, just trying to get this clear again in my own mind, picture what was taking place in the control room at Three Mile Island, within the first couple of hours of the accident. We did go there the next day, and frankly, I didn't get any kind of useful information at all from that trip. As a matter of fact, on reflection, I think it was probably harmful for me to go there and get the report I did because it really lulled me into a sense that everything was in pretty good shape. But from what I have heard here today, the real damage to the core took place not in the first few minutes of the accident-and practically all those things we talk about, and spend so much time on, discussing the valve and the pressure valve which didn't open and close, almost seem terribly trivial and unimportant, frankly. They all just seem to me to lead up to what was really done, which was about an hour after the accident. It seems to me that gave somebody the opportunity, the machines an opportunity, to make a terrible mistake. So, I would really almost discount everything that took place in the first few minutes. If everything else had been handled properly, they wouldn't have amounted to much. PAGENO="0468" 464 It would be an incident and not an accident. It would be like these other incidents we have from time to time in nuclear plants. All the trouble seemed to start about an hour or so afterward, when somebody started to take all the water out of the core. That doesn't seem to me to have been done under any great pressure of decisionmaking. That seemed to me to be a situation that arose much later, and somebody was making, it seemed to me, very deliberate decisions on what was going to be done next. Isn't that a fact? The damage really started much after all these first few minutes-that was just a prelude, or set the stage for what really was done wrong. Isn't that a fact? Mr. DENTON. There were plenty of opportunities up to about 100 minutes to take action, to preclude core damage. The instrumenta- tion-- Mr. WYDLER. In other words, there hasn't been any real damage at all of any significant type for a long time-an hour or more, almost 2 hours went by. Then the damage took place. Something started to happen at that time, so that they got almost all the water out of the core. That was done long after the pressures of the initial malfunction and all of these valves misfunctioning. That was all in the first few minutes. This was 1½ hours, 2 hours later, that these dramatic events took place, where the real damage took place, and where the real accident took place. It happened 1½ or 2 hours later. Mr. DENTON. But they had an incorrect impression of the condi- tions in the core, because of those events that did occur. Let me ask Roger to try to explain that. Mr. WYDLER. Before you do-and I will give you every opportuni- ty as far as I am given time-we have been told how there were three people in the control room when the series of events started. We didn't get a clear answer after that, but apparently those three men were there for a while, and other people might have arrived, although we are not sure they did, and if they did, we don't know who they are. But do we know who was in the control room at these controls at the time that the water was all drained out of the core? Mr. DENTON. Yes, we do. Mr. WYDLER. How many men were in the control room at that time? Mr. DENTON. I and E has listed in the chronology, the details on how many people arrived at each time. For example, the shift foreman entered at 2½ minutes before the accident. To set the stage for talking about the number of people, I think it does reveal a deficiency in the way we have approached operator licensing. We have tended to focus our requirements exclusively on those people who are present at the controls of the plant. We have never had any requirements for people who are auxil- iary operators, people who run equipment other than the controls of the reactor. Likewise, we don't have requirements on the super- visors of the operators. At the time of this accident there was not a college level engi- neer in the unit. There is not one required by our regulations. PAGENO="0469" 465 I think we need to look very hard at the staffing of power- plants-not just the operators. They are trained to respond within a certain construct of sequences that one might reasonably expect and write procedures for. But when a situation gets sufficiently far out of hand, then you need engineers who understand the basic phenomenology. So at the time of 21/2 minutes there was not anyone in the control room but high school graduates who had been trained. We have the times listed, as to how many people entered the control room. They called certain of the supervisors who took certain periods of time to arrive. But the first few minutes it was just the three or four people from the units there, and they built up to a very large crew and eventually had to move people out of the control room because of the large numbers of people. But they were under a total misconception of the water level in the reactor vessel because they kept seeing adequate level in the pressurizer. What they didn't realize is that if the water in the rest of the system got 2 or 3 degrees hotter than the water in the pressurizer, it generated a sufficiently high pressure to keep the water in the pressurizer from draining back to the reactor. So what happened during this time is the pressurizer did stay reasonably full of water. Yet the core uncovered more and more and more because they let pressure drop to the point where water was actually boiling in the reactor vessel, but not in the pressur- izer. So they uncovered the core at about 100 minutes and that is when the real damage began to occur in the core. All that time, they thought the reactor core was covered. Mr. WYDLER. And there is no instrument that tells you defini- tively that the water is draining out of the reactor core? I am a layman, but all the demonstrations I have seen here today, every- thing points to one thing-keep the water in the reactor core. That is the No. 1 item. There is no definitive way to know the water is in there? Mr. DENTON. Under normal conditions if you keep the pressure in the system high, so you keep the water from boiling, then it is quite proper to measure the level at the highest point in the system, such as the pressurizer. If it is not boiling somewhere, you know you have water below that point. They let pressure decline in the whole system below the saturation pressure for the water that was in the reactor vessel, and it began to create a steam void and bubble. Mr. WYDLER. Just one more question. What are you doing about the other reactors similar to this, to know in the future that the pressurized water-that there is water in the core? How are we making sure we are going to know that in the future? Mr. DENTON. Our bulletins emphasize that you must keep the pressure of PWR's higher than the pressure at which water would boil for any given temperature. So our bulletins have already rein- forced for all operators of these types of plants, don't rely merely on the level indicator; you have got to look at the combination of temperatures and pressures and keep the pressure at a certain PAGENO="0470" 466 level higher than the boiling point for that water, and a number of other actions. Mr. ERTEL. Will the gentleman yield on that point. You have to interpret the temperature pressure curve, is that correct? Mr. DENTON. You have to stay above the boiling point. Mr. ERTEL. Now you have an interpretation by a reactor opera- tor. What is the time sequence? If that gets out of sequence and you get boiling in there. How soon will you in fact damage the core? How much time does it take? Are we talking seconds? Mr. DENTON. No. If you go to the other type of designs, they can lose all water-- Mr. ERTEL. I am talking about B. & W. Mr. DENTON. B. & W. only had 1 or 2 minutes to start with before we made the changes that came out in the order. Let me ask Roger if he remembers how many seconds we now have as a result of the changes. Mr. MATTSON. I think I understand the Congressman's question to be slightly different. You are asking the question if he has a saturation curve for the water, the operator, and he is comparing the pressure in the reactor vessel versus the saturation curve, and he finds out lo and behold that the pressure has dipped below the saturation curve, how long does he have before he gets into trouble. Three Mile Island of course is one accident sequence. If we stick to the relatively slow moving accident sequences, which seems to be the difficulty we have discovered through the Three Mile Island accident, that is a very slow rate loss of coolant accident, he has minutes to make adjustments of that sort. Clearly the operators at Three Mile Island had tens of minutes while they observed the reactor coolant pumps begin to behave abnormally; that is, to vibrate, and for their flow to go down, even though their power being delivered was constant. That told them that the primary cooling system was voiding; that is, it had become saturated and was generating steam. They also made comparisons with the saturation curve apparently based on their interviews, and had some appreciation of the fact that there was a potential for boiling in the hot leg of the reactor coolant system; that is, for diminishing core flow. What isn't certain today, based on that kind of factual knowl- edge, is why the operators chose to believe one instrument when they had several other indicators which were contradictory to that instrument. Getting back to Mr. Wydler's question, there are indicators. It is not simply because there is no direct level mesurement device above the core, that does not mean that there are not indirect indicators of whether or not there is water in the core. The temperature of the water leaving the core is measured. It is measured in several locations-in the piping, in the reactor system, prior to the water being delivered to the steam generator. It was also being measured in 52 locations 4 inches above the top of the core, all of which were being printed out on the computer. It can be argued that the computer is a little slow and wasn't intend- ed for that kind of immediate hands-on operation. But the tempera- PAGENO="0471" 467 ture indicators in the hot leg were intended for immediate hands- on control and operation of the plant. When they began to indicate higher temperatures-that is, su- perheated steam coming from the core, the direct indication that the core is uncovered-there is no other way to interpret those thermocouples. Mr. DENT0N. The temperature of the water leaving the reactor vessel actually went off scale for a period of about 15 minutes at that time, indicating the core was generating steam, and it wasn't heating water. Mr. WYDLER. We were told the next day that they thought there must have been something wrong with the measurement devices, it couldn't have taken place. Mr. MATTSON. That is another one of the lessons. On several occasions there were indications that were chosen not to be be- lieved. Mr. ERTEL. I think we are going to have to move on, Mr. Wydler. We have two bells. I think we can recess at this time and we will be back, reconvene at 3 p.m. I hope you can stay, Mr. Denton. We have to vote. The committee will stand in recess for 7 minutes. [Brief recess.] Mr. ERTEL. The subcommittee will come to order. Mr. Denton, you obviously are aware of some of the questions I have had, since I have asked the same question of the last two witnesses. If you want me to repeat the question for you, I will be glad to. Well, I will, and then you can answer it. The question is that the containment didn't go into actuation until you had a 4 pounds per square inch of internal pressure within the containment as I understand it. Up to the 4 p.s.i. there was no real containment, is that correct? Is that a design flaw of the plant? If it is, how did that manage to be licensed? Mr. DENTON. At the time it is true that we only required contain- ment isolation on pressure. Before Three Mile Island we focused an awful lot of attention on big pipe breaks, and we put a lot of our resources into what would happen when a major pipe broke. We didn't tend to focus nearly as much on small pipe breaks and what they would do. We did change our design criteria some time ago and required that containment isolate also on activation of the emergency core cooling systems. So that is two diverse signals. There are also radiation alarms which would activate containment isolation, but containment isola- tion is one of the lessons we learned, and we will be changing our requirements in that area I am sure. Mr. ERTEL. If you learned that previously, did you learn it prior to the Three Mile Island incident that you ought to have contain- ment even with a small pipe break? When did you set out some sort of criteria for a containment in that area? Mr. MATTSON. The licensing requirements on containment isola- tion have changed in recent years. They changed in about 1975, when the standard review plan in the Office of Nuclear Reactor Regulations was first issued. PAGENO="0472" 468 The requirements changed from allowing a single actuation signal for containment isolation to a requirement for diverse actu- ation signals. Now, since the standard review plan was put out, any changes in regulatory requirements have to go through a value impact consid- eration. When a regulatory guide changes or a branch technical position changes, you have to assess the safety significance and the impact of the change before you can make a decision by the top management of NRR, as to whether to backfit that requirement to other plants. Now, when the standard review plan was put out no such sys- tematic value impact assessment was performed. Hence, there was only forward fitting, no backfitting, of any new requirements con- tained in the standard review plan. Mr. ERTEL. May I interrupt you for a moment. Mr. MATTSON. The diverse actuation signal was not backfit. In retrospect, it appears it should have been. Mr. ERTEL. Was this actuated when the containment went up to 4 p.s.i. and is that the correct criterion at the present time? Mr. MATTSON. No, in a new plant that alone would not be an acceptable criterion. Mr. ERTEL. When did that change? Mr. MATTSON. About 1975. Mr. ERTEL. When was the approval of this plant? Mr. MATTSON. 1978. Mr. ERTEL. And why wasn't the approval of this plant subject to the criteria which were developed in 1975? Mr. MATTSON. Because of the policy decision in 1975 to not backfit the requirements-- Mr. ERTEL. You are not backfitting. This plant is not built. Mr. MATTSON. I am sorry. I should define what I mean by the period of backfit. The standard review plan was forward fit to new construction permit applications, not operating license application. Mr. DENTON. Now, I might add, Congressman-we now require that plants that receive operating licenses be compared to the standard review plan, and differences from the standard review plan be documented and justified. Mr. ERTEL. So that has been corrected, is what you are telling me. In the future we would not have this situation except possibly for ongoing plants. Do we have ongoing B. & W. reactor plants which still actuate at 4 p.s.i.? Mr. DENTON. I think we do, sir. Mr. MATTSON. But that is one of the lessons learned. I think it is clear to us at this point, as we said in the bulletins immediately following the Three Mile Island :incident, that all operating plants and other people who receive the bulletin should review their containment isolation provisions. Further than that, we would expect to go back and require diverse actuation of containment isolation. Mr. ERTEL. Mr. Denton, you were saying I think that you require that now, that there are plants with a 4 p.s.i. actuation for isola- tion of the containment? Mr. DENTON. What I was trying to say is I think there are plants that don't meet our present standard review plan that are in PAGENO="0473" 469 operation. This is new requirements on containment isolation for all plants and will no doubt be one of the lessons learned-that we backfit. Mr. ERTEL. One lesson I learned in aircraft, if you find a design flaw which can be in fact dangerous, they put out an air worthi- ness directive, and that means change this. They do give you some time. I agree with that. On the other hand, many of those are on an immediate basis. Mr. DENTON. We put out the ones that we felt to be of immediate significance in the order. This other has been flagged in our report as a forthcoming one. Since it is more after the accident than preventive, we did the preventive ones first. Mr. ERTEL. But it certainly has a lot to do with the health of the public. Mr. DENTON. Yes, sir. Mr. ERTEL. I think it is something that I would be very con- cerned about. Second, I have a question based upon Mr. Wydler's statements that he had a report which I think you documented-I wrote it down-transmitted to you on March 6, concerning the problems with B. & W. reactors, the Creswell report. You received that on March 6. I think you said that immediately the information is then given to the board, is that correct? Mr. DENTON. We give it to all the boards which are in place, and for which we have already otherwise completed our safety review. So that when they are considering that application, they will have all the information we have. Mr. ERTEL. I just want to know-I am not sure you can answer this, but it kind of upsets me, having heard that. I wrote a fairly long letter to the chairman of the Nuclear Regulatory Commission on February 9. One of the questions raised in that was, "How will the NRC deal with the types of safety issues raised by the Lewis study and what, if any, improved safety precautions are needed in existing power- plants?" I had talked earlier about powerplants, some of them. The re- sponse I received-I am trying to find the quote, I find to be quite misleading. His letter back to me 1 week prior to the accident stated: The designers, builders, and owners of these plants are required to have effective quality assurance programs and their work is subject to a continuing license inspec- tion processes by the NRC. We believe this regulatory system has served us well. It is an exceptionally rigorous system. Now, it indicates to me, 1 week before this incident, you had a report called the Creswell report, at least at your full staff level. That letter was written to me on March 15. Now, March 28, Three Mile Island went down. How can you explain that response from the commissioner when you had the Creswell report in your files? Mr. DENTON. The original Creswell report was considered in our region 3 Chicago office, and apparently Creswell had been raising these concerns, I believe, for some time. It led to the documenta- tion of his report, and the region in Chicago decided to send it into headquarters. PAGENO="0474" 470 I am not sure how long it had been in headquarters. It was certainly there on March 6. I assume it is just our administrative laggardness in making sure that everyone knew at the time you received your reply. Mr. ERTEL. So there really is no explanation for that. Mr. DENTON. I would be happy to look into the matter. I can't explain it today. Mr. MATTSON. I think it is worth noting that our business is reviewing potential safety questions. That is how the Office of Nuclear Reactor Regulation spends its time. Certainly there is more than one safety question in front of us at any given time. That would be 1 of maybe 100 board notification matters present- ly before the boards raising issues warranting further considera- tion. The Creswell memorandum treats one aspect of the accident at Three Mile Island. It certainly did not forecast the sequence of events, it didn't forecast the equipment malfunction. It spoke to the sensitivity of the machine to the level indicator. It would have been better had that been received, processed, and understood well in advance of Three Mile Island. It simply wasn't. Mr. ERTEL. Well, I take it Mr. Denton indicates five problems you envision with the B. & W. reactor. Basically, whether or not most of those problems or those considerations were known prior to the Three Mile Island accident you were having problems with the B. & W. reactor? Mr. MATTSON. With hindsight we certainly had a lot of precur- sors. Other plants had similar types of events-none that quite involved, the same sequence, but one of the things we are now working on is a much better way of being sure that events which happen at plants which are identically designed are collated and trends looked for, so that these accidents are caught before they turn into big ones. Mr. ERTEL. The other question I have-- Mr. DENTON. Let me elaborate on that one just a little bit. I think we might very well require that the licensees in the future analyze, and diagnose all the events that happen in plants similar to theirs, and propose solutions to us, as to how to keep it from happening in the future. I think perhaps in the past we took on too much of the burden ourselves to review everything that was happening out in the reactor world, and then writing regulations and rules that deal with those, and allowed our licensees to sit back and not make corrections until they were forced to by regulations. Mr. ERTEL. Mr. Denton, I don't want to be critical but in another area-it is my understanding that you issued the license for this plant in March of the preceding year, 1978? Somewhere in that neighborhood? Mr. DENTON. Yes. Mr. ERTEL. Then the plant is really brought on stream-it came on stream just prior to the new year. My understanding further, subject to correction, is that no NRC personnel were at the plant to look it over, bringing this thing up to operating levels. Once you issued the license, you never went back, is that correct? Mr. DENTON. No. Our expected frequency is higher during the startup of a plant than at any other phase, so once we issue the PAGENO="0475" 471 license the plant is turned over to our Office of Inspection and Enforcement, and I am sure it was inspected once a month during that year. But we did not have resident inspectors at that site. We had them in about 20 other sites, but not at Three Mile. Mr. ERTEL. Then how do you explain it? My information is that this plant was trying to be brought on-stream, and it was having tremendous difficulties throughout the trial period, if you want to call it that, before it went into commercial operation. In fact, I think it was down three-fourths of the time because it was having problems and a lot of them were feedwater problems, as I under- stand. Why wasn't that analyzed along with the other information we had on feed water information on other B. & W. plants? Second, how could this get on line just prior to the beginning of the year when, in fact, it did add to Met Ed's certain financial capability? I assume they get an investment tax credit and got additional depre- ciation as a result of bringing it on line, and it was a substantial financial gain to Met Ed, and this question is being asked by a tremendous number of people. Mr. DENTON. It's my understanding-- Mr. ERTEL. Now, we go back and say we have five different things which we are looking at in this particular operation. That we knew or should have known, and I think we do, frankly, and when I say we, I mean the Federal Government, about the design problems. Now we are saying we are going to correct that and in addition we get a statement, you quoted from Mr. Hendrick saying you are going back and review this, and I got the same kind of statement before that saying everything was hunky-dory, and now we are saying there is something wrong with the way the NRC operates. I wonder where is the credibility going to be established here? Mr. DENTON. I guess my own view is maybe subconsciously we had thought we had done enough, and that the process as it was was adequate. I would compare it maybe to launching 300 ships and they all seemed to be sailing fine, and perhaps you get compla- cent about your design and then you have a ship sink and you suddenly need plumbing and we really were not aggressively changing our requirements in these areas before that. I can only say that I hope we now learn, having had this, that things were not nearly as good as we thought they were in a number of areas. Mr. ERTEL. I have the real problem of telling people we have confidence in NRC and we are now going through a self-criticism stage. But we are doing that and we might have had forsight. How do I say to people we will have the foresight in the future? Mr. DENTON. I think maybe we need some different mechanisms. It certainly should not be business as usual. I would hope that in our lesson learned study we can identify not just equipment fixes or a valve here or indicator there, or new instrument, but see if we cannot find ways to make the process totally function better. For example, I think one of the things I learned up at Three Mile was the need for the applicant or licensee to have his own incident center. I think perhaps you mentioned how could things have been managed better in the first few days. PAGENO="0476" 472 Perhaps we should require the licensee have an incident center where their technical staff, our staff, and State staffs can assemble the kinds of information the public needs much earlier. Perhaps we need licensees to produce daily reports for the public to be aware of what is going on, find some way to change the mechanism of how we review plants. Mr. ERTEL. One further question and then I know we have to recess to go vote again, I am sorry. All of the time I was getting reports on Three Mile Island, everybody said this hydrogen bubble or hydrogen problem, was unexpected, that we had no models, we had no anticipation this would happen. Are you still under that impression, Mr. Denton, that we had no studies which would give us any kind of insight into a possibility of hydrogen bubble. I know it's not yours personally, but I am talking about the experts in your group. Mr. MATTSON. We had done no loss of coolant analysis, to my knowledge, prior to Three Mile Island with a noncondensible volume of gas in the primary cooling system. Mr. ERTEL. There was a paper reported in the proceedings of the topical meeting on thermal reactor safety, July 21, to August 4, 1977, at Sun Valley, Idaho, which talks about hydrogen generation in reactor systems. The paper mentions dangers to the integrity of the containment. Mr. MATSON. Perhaps you didn't understand what I said. I said in the primary coolant system there has been none. There has been a lot of analysis of generation of hydrogen in loss of coolant acci- dents with emphasis on the large break loss coolant and the track- ing of hydogen out of the primary coolant system into the reactor containment, and the potential for detonation inside of the contain- ment. That is a routine licensing requirement flowing from appendix K, of 10 CFR part 50. That is what led to the need for recombiners at Three Mile Island in their licensing. It's a different matter to talk about a small break loss of collant type accident as occurred at Three Mile, with the generation of hydrogen during the accident, with the containment of that hydro- gen inside of the reactor coolant system, where it could not get out into the containment building and then to the auxiliary building for burning in the recombiner. So the hydrogen bubble inside the reactor coolant system was a new and novel problem in reactor safety. Now, there have been codevelopment activities over the years, some at Idaho National Engineering Laboratory, as a matter of fact, attempting to treat the movement and effect of noncondensi- ble gases in reactor coolant systems during transients or small break losses, but not from the standpoint of large volumes of hydrogen. They were more concerned with the effect on condensation and heat transfer in the steam generator. Mr. ERTEL. Perhaps I ought to read the first two lines of this to you so you understand what I am referring to. But we will have to recess at this time. However, with the uncovering of the core, it would have been logical to anticipate the formation of hydrogen PAGENO="0477" 473 and it would have been just as logical to expect that hydrogen to rise to the top of the reactor. Since the outlet of the primary coolant is many feet below the top of the reactor, there was every reason to anticipate the accumulation of the lighter weight hydro- gen gas. Whether or not it was a large break in the coolant system or a small break, the fundamental physics is the same; hydrogen was formed, it is a light gas, it rose to the top of the reactor and nothing in the design provided for venting it to a recombiner. Mr. McCORMACK. Before we recess, can I ask how long you can stay, Mr. Denton? Mr. DENT0N. We are at your convenience. Mr. MCCORMACK. Thank you. We will be back in a few minutes. [A brief recess was taken.] Mr. MCCORMACK. We will reconvene the hearing of the subcom- mittee. I will ask Mr. Wolpe if he has questions for Mr. Denton? Mr. W0LPE. Thank you, Mr. Chairman. Mr. Denton, I would like to followup on some of the questions being asked by the gentleman from Pennsylvania for a moment and then move to a more general evaluation. If I understood the testimony that you just gave, it was in at least one respect to the effect that the plant at Three Mile Island was below the standards that have been established by the Nation- al Regulatory Commission at the time it came into operation. But that the reason that that deficiency was permitted was because of a policy decision that those standards should not be imposed in situa- tions in which construction licences had been granted. Was that your testimony? Mr. MATTSON. Mr. Wolpe, I think it was my testimony. It was a decision to not require the newer, more stringent stand- ards for plants already in construction, that is, those that had already received a construction permit. It was a requirement that was being imposed on new applications for construction permits. Mr. Denton went on to say that the standard review plan is used for operating license applications; that is for plants already under construction, but in a different sense, not in the sense of an abso- lute requirement but rather plants are measured against the stand- ard review plan, deviations relative to the standard review plan are identified, and then justification must be made for these devi- ations. But, it is still a little more complicated than that. When the standard review plan was issued in 1975, there were some plants very far along in construction and some that were just starting construction. So for an early group of plants, of which Three Mile Island II would have been one, there was an exemption from the requirement to justify deviations. Now, we are trying to construct a chronology of the licensing process for Three Mile Island unit II to treat this detail and all of the other details we can resurrect from the records. I will speculate that this deviation from the standard review plan was neither identified nor justified in the operating license review of Three Mile Island unit II. Nor would it have been required to be identi- fied or justified. PAGENO="0478" 474 Mr. WOLPE. Why was the policy decision made not to apply the standards that were developed for safety reasons, I presume, to plants under construction? Mr. DENTON. I think at the time the standard review plan was prepared it was recognized that that was the one chance the staff had to get all of its favorite advances into the system and after the standard review plan was adopted it would be more difficult to make changes. So at the time I remember deliberately putting in the standard review plan things that I was not requiring the previous week. But things that I felt would advance safety and would be in the right direction, so the standard review plan was sort of the effort the staff made to say for new plants here's what we think they should meet, recognizing that we had gone beyond what was standard practice when we wrote it. Mr. WOLPE. In other words, you did not believe that additional requirement that was now part of the basic plan, not simply for any newly constructed plants, was that essential to the safe oper- ation of the plants? Mr. DENTON. In this area we apparently didn't. There were some areas in the standard review plan that were perhaps picked up but in the containment isolation one it was one that the staff didn't feel that strongly about or, for plants already under construction or near completion. It was felt to be something that would be desir- able though for new plants. Mr. WOLPE. In the Three Mile Island would you make a different judgment today as to the significance of that particular item? Mr. DENTON. Yes; we have and that is reflected in the bulletins we have sent all of the operating plants. Mr. WOLPE. You indicate in the body of your report three areas of sensitivity in the B. & W. design. First of all, were any of these areas of sensitivity known in advance of the accident at Three Mile, in the same way that this other area of deficiency was known in advance of the accident at Three Mile Island? Mr. DENTON. We have obviously reviewed the B. &. W. design and had approved it for some very early plants. And it had been reviewed by our advisory committee, so we had looked at things such as once-through steam generators. I think at the time we felt that by designing the plant inside the containment to be sort of invulnerable to secondary system tran- sients, that whether it had a lot of water or little water in the steam generator didn't make a great deal of difference. You may recall that the reactor safety study, WASH 1400, im- plied that the staff had focused an excessive amount of attention on large pipe breaks, and that really small pipe breaks and antici- pated transients were more dominant risk contributors and the Lewis committee critique of the WASH 1400 reached the same conclusion and recommended the staff move away from the focus on large pipe breaks into anticipated transients and the staff had done that and was in the process in several areas of looking at anticipated transients, but transients associated with feed water malfunctions was not one we had put high on the list. PAGENO="0479" 475 Mr. WOLPE. So that while you were aware of most of those areas of sensitivity you simply did not, at that point, attach to them a significance they subsequently had. Mr. DENTON. That is correct. Mr. MATTSON. It's fair to say in several of these areas work was ongoing because we were aware of a number of challenges to the safety systems arising from malfunctions in the secondary systems so, for example, the reliability of auxiliary feed water systems was a subject of study. What was failed to be recognized was the urgency of getting on with that kind of work, and that urgency certainly was under- scored by Three Mile Island. But it's fair to say we had anticipated some of these things and work was ongoing in these areas. Mr. DENTON. You may recall Three Mile Island did have redun- dant and diverse auxiliary feed water pumps; it had two electrical- ly driven pumps and one turbine driven pump, so it had three types of pumps. I guess what we had not anticipated was the likelihood of those valves being closed and the consequences that could rapidly flow consequentially. Mr. WOLPE. Are there any respects in which the deficiencies that you have identified in the case of the B. & W. reactors are similar to deficiencies that may exist in the other types of pressurized water reactors, those which are produced or manufactured by Wes- tinghouse? Mr. DENTON. There is a fundamental difference in time available for corrective action between the B. & W. plants and the others. The Westinghouse plants I think have on the order of 30 minutes before the steam generator boils dry upon loss of all feed water flow, and the combustion engineering plants are perhaps 15 min- utes. We are looking at all those designs and have letters to all pressurized water reactors to be sure that in the microscopic view of them, that their auxiliary feed water systems are reliable and that these same sorts of defects don't exist. Mr. WOLPE. You have not issued the same order-- Mr. DENTON. We have issued bulletins which require that they reply to exactly what their situation is in each one of these areas, and we are presently meeting with them one by one. But we have not found it necessary yet to issue an order to any of them to date to require changes. Mr. WOLPE. Because in your judgment the Westinghouse reactors have a different time factor that allows for corrective action to be taken. Mr. DENTON. Yes. I would not preclude as we go down the list we won't find some who maybe for one reason or another require certain changes. But to date the staff has not identified anyone. Mr. WOLPE. A more general question, Mr. Denton. It has been suggested by some that there was an overreaction on the part of the public, on the part of the Congress, and others, to the magni- tude of the problem that occurred at Three Mile Island. I have read with care the material, transcripts that have appeared at least in the newspapers, of your own proceedings in the Commission. I have the distinct impression that you were rather worried at different points by the activities that occurred in that period. I don't want to put words in your mouth, but I would be interested in whether or PAGENO="0480" 476 not that is an accurate assessment of your state of mind at the time. Mr. DENTON. I was quite worried Friday morning back in Bethes- da when this report that proved to be false first came in. And even after arriving at the site, with a lot of my staff, who were able to get in the plant and give me first-hand views, it was evident that a lot of things had to be done and had to be done fairly fast. I mean they were ones that you might take days to do, but you could not let the situation deteriorate. So I was very concerned in that sense, and we had to take a lot of actions. Mr. WOLPE. Had those actions not been taken, or had there not been an appropriate response to the sequence of events that oc- curred, would a meltdown have been a possible event? Mr. DENTON. I think you have to say a meltdown is always a possibility. Mr. WOLPE. Was that one of the events about which you were concerned? Mr. DENTON. That was one. And in fact after a few days, after I had arrived we had developed an action plan in which we said if we lost offsite power, or if we lost all recirculation pumps, we would call an alert, or if we lost all instrumentation due to radi- ation levels in the containmant, we would advise an evacuation. So eventually we were able to put down on paper those plant conditions which if reached would require evacuation. However, the longer the time went, the longer it would have taken a core meltdown to have breached the containment, and the more time there was actually available then to accomplish an evacuation. So the longer we were able to keep the conditions stable, the more time we would eventually have in the event an evacuation was necessary. Mr. WOLPE. Thank you. And I assume further that you would not have even considered the possibility of evacuation were there not some very real concern at the initial phase of. this development. Mr. DENTON. After I arrived at the site and had a much better understanding, I never felt any imminent danger and never recom- mended to the Governor evacuation after that. I did recommend that if we were unable to remove the bubble through the means that we were attempting, and we had to change the basic core cooling mode, that we do that in the daytime, at a carefully select- ed hour, with civil defense fully in a state of readiness, so if things did not go the way they were expected to go, that all the necessary evacuation steps could be taken. But fortunately we never pro- gressed to that stage. Mr. WOLPE. I really very much appreciate your candor and your response to that question. It becomes very important that there be a recognition that there was some basis for a very real concern on the part of those that were closest to the event. I should point out that your testimony directly conflicts with that which we received from eminent nuclear scientists, who I think more appropriately might be described as eminent nuclear advocates, who insisted there was never any basis for concern or alarm in the entire episode. Thank you very much. PAGENO="0481" 477 Mr. MCCORMACK. You are not referring to anybody who testified before this committee, are you? Mr. WOLPE. Yes; I am. Mr. MCCORMACK. Who? Mr. WOLPE. The panel that was associated with Dr. Teller. I don't have all the names in front of me. Mr. MCCORMACK. You are talking about the Teller panel. Mr. WOLPE. That is right. Mr. MCCORMACK. OK. Thank you. That was before the full com- mittee at another time. Mr. Ambro. Mr. AMBRO. I would like to say, Mr. Chairman, that Mr. Denton's calm, clarity and sanity breaking through the babble of confusion gave me a feeling that there was someone onsite who knew what he was doing at Three Mile Island. Having said that, I would like to ask you this. Just two fast questions about those two horrors that we kept hearing about. What my friend and colleague was alluding to was a statement by Dr. Cohen that there would never be a meltdown in the United States except in computer simulations. That was his statement. You said meltdown is always a possibility. Do you want to comment on the conflict? Mr. DENTON. I have not read his testimony. But the studies I have seen are that if you lose all core cooling early in the sequence, when the decay heat is still high in the core, a meltdown is certain- ly likely. Now, as time progresses and there is less and less heat being generated in the core, there is a time at which you can actually lose the bulk of water and perhaps still prevent an actual melt- down, just by cooling, from radiation, thermal radiation means. Mr. AMBRO. With respect to that hydrogen bubble, it would never explode because there was no oxygen, is that correct? Mr. DENTON. Yes, sir. Mr. AMBRO. And it could never burst the containment vessel because there wasn't sufficient pressure, correct? Mr. DENTON. There was a hydrogen explosion the day of the accident. Mr. AMBRO. What does that mean? Mr. DENTON. It was an explosion in the containment, and the recorder indicated a peak pressure pulse of about 28 p.s.i. It was believed-it wasn't recognized by the licensee at the time as a hydrogen explosion. It was thought by the operator to have been a false signal. You may recall that Saturday we were concerned about the explosion of the hydrogen bubble inside~ the reactor vessel. And it did turn out that as we looked into the area in more detail, that the oxygen that was being generated in the water through radiolysis would be combining again with hydrogen dis- solved in the water and oxygen would never actually be present in a free state in the hydrogen bubble. So it took us a number of hours before we came ta the realization that oxygen was not really being added to the hydrogen bubble and there never was a danger of an explosion of the bubble in the reactor vessel, although there had been an explosion in the containment. 48-721 0 - 79 - 31 PAGENO="0482" 478 Mr. AMBRO. Well, could pressure have built to the point where you could have had an explosion in the reactor vessel? Mr. DENTON. In order to have an explosion in the reactor vessel, we would have had to have some means-- Mr. AMBRO. I'm sorry-burst the reactor vessel. Mr. DENTON. No. I think our whole concern over hydrogen explo- sion in the reactor vessel was in retrospect misplaced, because physically you could not generate oxygen and get it into that hydrogen. It would recombine in the water with other free hydro- gen atoms. Mr. AMBRO. What I am getting to is if pressure could build to the point where it would burst the vessel, then you would have inad- vertently, even though pressure would be moving it out, a combina- tion of external oxygen with the hydrogen and a possibility of explosion. Mr. DENTON. No. The hydrogen pressure would never have built just on its own accord to a point where it would have ruptured the vessel. Mr. MATTSON. Once the core cooling was re-established, the gen- eration of hydrogen was stopped. Mr. AMBRO. So the whole business of hydrogen buildup and the possibility of an explosion was totally misplaced. Mr. DENTON. With regard to the bubble in the reactor vessel, that is correct. It was a concern of ours at the time, and we realized about 24 hours later, as we got in touch with other experts and looked at data, that it would not be possible to form a combus- tible mixture in such an atmosphere. Mr. AMBRO. Obviously the press didn't understand or believe you, because day after day we were regaled with the possible horrors of a hydrogen explosion, as I recall it. In any event, let me get to something else far less technical. Are your bulletins mandatory in terms of compliance? Mr. DENTON. Yes, they are. Mr. AMBRO. How do you assure compliance? Do you have a network of inspectors, implementing people running around saying do this and do that? Mr. DENTON. We have an Office of Inspection and Enforcement of about 700 people and they have regional offices. Many plants now have resident inspectors on site, permanently stationed there. In fact, all of B. & W. installations now have resident inspectors. The way we enforce the bulletins is require that applicants write back what they are doing in response to the bulletin. This is reviewed in my office for technical adequacy. And it is reviewed by the Inspection Department for factual adequacy, that this is really the way the plant is constructed and operated. And we determine if it is a correct response. If we don't think the response is adequate, we go back to the licensee to enforce the requirements. Mr. AMBRO. That has to do with construction. What about oper- ation? Mr. DENTON. The same thing applies during operation. Mr. AMBRO. How many people are there in the inspection arm? Mr. DENTON. Approximately 700. Mr. AMBRO. We have about 71 plants on line. PAGENO="0483" 479 Mr. DENTON. They inspect other licensees, other than reactors. But reactors under construction and in operation are probably the largest workload they have. They also inspect users of isotopes for other purposes. Mr. AMBRO. Is there any validity to the notion of keeping or maintaining a resident inspector in a plant on line? Mr. DENTON. The Commission plans to put resident inspectors at every site of an operating plant and in fact have approximately 20 resident inspectors now in place. Mr. AMBRO. If I understand this whole situation correctly, then, from this point of view, TMI met lower standards than other plants for a variety of circumstances. As a result of that, were bulletins issued to bring them up to a higher degree .of safety prior to the accident? Mr. DENTON. No. The bulletins I am referring to were issued to all plants after the TMI accident. Mr. AMBRO. After. Mr. DENTON. Yes, sir. Mr. AMBRO. There were no bulletins or advisories or what-have- you issued in advance of the accident at TMI? Mr. DENTON. Not on the issues that are concerned here. But there have been bulletins on other matters that we routinely deal with. I was referring to bulletins that dealt with the kinds of matters that caused the Three Mile Island accident. Mr. AMBRO. Well, I don't know the terminology. I just use your word. Let me put it another way. Do you have any evidence of noncom- pliance of the kind of safety requirements you saw had to be implemented at Three Mile Island? Mr. DENTON. Well, certainly the fact that the valves in the auxiliary feed water train were locked closed is a violation of the technical specifications. Right at that point if those valves had been open these redundant pumps that I mentioned would have supplied water to the steam generator, as it did in 152 instances in B. & W. plants-- Mr. AMBR0. If the valve was blocked shut for 42 hours, NRC has to accept, because of the lack of onsite inspectors for compliance, a degree of the blame, if you will, for what happened. Mr. DENTON. I think we all feel responsibility for what happened and it is conceivable to me that if we had a resident inspector, this sort of thing might have been prevented. I cannot guarantee that he would have spotted these valves. But perhaps he would have spotted some other valves being misalined and this could have led to a review of shift turnover procedures and procedures for check- ing valve alinement at the start of each shift, which has already been discussed. I was frankly surprised to find that the company did not employ a means so that as every crew comes on there is a requirement that all vital valve positions and conditions such as that be routine- ly reverified. Mr. AMBRO. Well, assigning blame is not an idle exercise if it develops better accountability in the future. The question, though, has to follow, what is the penalty for noncompliance? PAGENO="0484" 480 Mr. DENTON. It varies, all the way from dollar fines to revoc~tion of the license. Mr. AMBRO. Now, you have this situation of noncompliance by virtue of the valve being shut. Have you, in a far narrower sense than the broad picture of what happened, how it happened and so forth, addressed the question as to whether or not there should be some penalty against Three Mile Island for this violation? Mr. DENTON. This matter is the responsiblity of the Inspection and Enforcement Office and they have the ongoing investigation. I guess I would prefer not to speculate until they have completed their investigation and determined what course of action might be appropriate. Mr. AMBRO. So we have mandatory requirements that the utility companies must follow. But we have less than-- Mr. DENTON. We have an audit procedure. Mr. AMBRO [continuing]. Less than timely, though, onsite inspec~ tion, with a variety of penalties that may or may not be imposed. Now, don't you think that whole thing should be tightened up? That is one area where we could provide a great deal more confi- dence. Even in the face of the public perception that there is too much regulation, I think they would agree in this area there should be even more. Who will be looking into that? Mr. DENTON. The Commission is focusing on this entire question. I guess I can say that our office is looking at the question of whether there shouldn't be more technical skills available at the site also around the clock. Bear in mind that the people who are running this station and who are actually present at the time were skilled individuals and following procedures for the kinds of events in which they had been trained. Mr. MCCORMACK. I am going to interrupt at this point. I didn't realize Mr. Walker has not had a chance to ask questions. I want to give him that chance now. Mr. WALKER. Thank you, Mr. Chairman. Maybe I can just get some quick answers here to a number of questions and then go into one matter. You mentioned that one of the ways that radiation is released to the public is because there were leaks in the letdown system. Is that the filter problem that was running-I hadn't heard about leaks in the letdown system prior to this. What kind of leaks were they? Was it an operational problem, another mechanical failure? Just what was this? Mr. MATTSON. Congressman Walker, I think you may recall the puff releases, the first of which occurred on Friday, and then a couple of sporadic occasions therafter. Maybe the terminology of the makeup system doesn't strike a bell. It was the vent header between the makeup tank and the waste gas decay tank, when radioactive gases were being transferred, there was a relief valve that would occasionally pop below its setting and lead to a puff release. Mr. WALKER. Wasn't that still partially a function of the fact that some of the contaminated water had gotten over into the auxiliary building? PAGENO="0485" 481 Mr. DENTON. I think it ~was the fact that they had extraordinary amounts of water meant they had filled up space that otherwise would have been available to deal with the letdown flow. Mr. WALKER. So even so, what we are saying is the mechanical problem, or the design failure that led to all the water going over into the auxiliary building is still in part responsible for the puff releases. Mr. DENTON. Yes. There is certainly a connection between the two. As I mentioned, the relative contribution of one source versus another, I don't think we have completely straightened out. Mr. WALKER. OK. Another question. There has been some ques- tion raised about this exposure point we talked about for individ- uals. One of the witnesses here yesterday who the chairman re- ferred to, Dr. Kepford, mentioned that he felt, that by measuring exposure points that were close to the site, we failed to measure the real problem; because as a result of the inversion layer, the real devastating exposure points were further out. Do you have any information on that? Were there measurements taken out, say, 15, 20 miles, to find out whether people were receiving abnormal levels of radiation at that distance? Mr. DENTON. I know there were a number of instances during those early days where the helicopter did pursue plumes until the readings were essentially at background. So they would track the plume until they could no longer identify it, even with the sensi- tive instruments they had. From a meteorological standpoint, dis- persion continues with distance. Mr. WALKER. Obviously, if the radiation level is going down in the plume, it could not be gathering strength as it drops toward the ground. Mr. DENTON. No. As long as the plume is in the air and has not touched the ground there is a potential that the ground dose might go up slightly as the plume comes down. But certainly no more than a small amount. And in fact, from the kinds of conditions I saw up there, I would be very surprised if there were a lot of-if radiation levels of any magnitude existed beyond the kinds of distances we are talking about. Mr. MCCORMACK. Wasn't Dr. Kepford's statement yesterday to the effect that first of all you had inversions which caused the radiation to accumulate at 15 miles on the one hand. Then they were saying it was highest at Goldsboro. Mr. DENTON. In Gouldsboro the licensee had from day one moni- tors in place that integrated the total dose. And we had other monitors thereafter. Let me ask Dr. Congel if he would like to comment on that. Dr. CONGEL. Right. In the assessment that we prepared for the population exposure we used the detector out as far as 15 miles. And the detectors all showed a decreasing dose as distance from the plant increased. We saw no evidence of the kinds of things that were alleged yesterday. Mr. WALKER. OK. Thank you. Within that 42-hour period when those auxiliary valves were shut off and supposedly there were lights on the panel showing that they were shut off, wouldn't there have been NRC people in the control room during that period of time? Shouldn't somebody PAGENO="0486" 482 from NRC maybe have noticed the fact that the system was not operating properly? Mr. DENTON. That is the 42-hour period up to the accident. Mr. WALKER. Forty-two hours before the accident. I see. QK. I'm sorry. Could the license of Met-Ed to operate this plant be lifted as a result of all of the kinds of failures that took place? Is that one of the possibilities that exists, looking down the pike? Mr. DENTON. It certainly is a possibility. I know the other office has criteria for various discretionary enforcement actions they take. But I am not that familiar with what types of events trigger which enforcement actions. But certainly the Commission has the authority to revoke licenses for good cause. Mr. WALKER. And finally, I would just like to. discuss with you for a minute a topic I know you addressed when you were in the area this weekend, the topic of the waste water dumping into the river. You were here I think before when I talked about the situa- tion. My perception of 4he public viewpoint is that it is not really a question of how wel1~the water can be cleaned up, but rather the public perception that they are not certain that any amount of cleaning of the water is acceptable. The thing that has disturbed me in some of the briefings that NRC has held on this subject, and so on, evidently the talk of options has been really options for treatment, but the final result of it was that the water is going to be dumped into the Susquehan- na River. You know, it is the end product that we are concerned about. We don't want the water dumped into the river. The treatment procedures and so on, we will leave those up to the people technically competent. But it is the dumping of the water into the river which is the problem for many of the sports- men, for the communities involved. Can't other options be explored? Can't we find other ways of doing this? Do we simply have to sit still for the fact, as the utility said this morning, that we are stuck with the economics and the precedents here? The public is not concerned with the economics and the prece- dents. They are concerned with the health and safety questions. Mr. MCCORMACK. Excuse me just a moment. Would you like to have that in writing, Mr. Walker? We are going to be late to vote. Mr. WALKER. Yes. But are there other options that can be ex- plored? Mr. DENTON. This has been raised and suits have been filed. We will try to identify all alternatives. Mr. WALKER. Good. Thank you. [The information follows:*] Mr. WALKER. One further thing. I understand you gave kudos to the performance of Mr. Denton, Mr~ Chairman, when he was at Three Mile Island. I would like to be on public record at this hearing endorsing that wholeheartedly. You did a fantastic job up there, Mr. Denton. The people appreciate it. ThiS information is provided as the response to question 7 in Mr. Denton's "Questions and Answers for the Record" for May 23, 1979. See Appendix I, P. 529. PAGENO="0487" 483 Mr. MCCORMACK. Gentlemen, I want to thank you very much for your testimony and for your patience today. We appreciate it. Mr. Conway, do you want to stay? Mr. CONWAY. It's up to you, Mr. Chairman. Mr. MCCORMACK. Would you like to just submit your testimony for the record? Mr. CONWAY. I will be pleased to do so. Mr. MCCORMACK. Mr. Conway will submit his testimony for the record. I appreciate your patience, Mr. Conway, sitting here all day waiting to testify. [The prepared statement of Mr. Conway follows:] PAGENO="0488" 484 STATEMENT BY JOHN T. CONWAY PRESIDENT AMERICAN NUCLEAR ENERGY COUNCIL BEFORE THE SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION HOUSE CO~'T11UEE ON SCIENCE AND TECHNOLOGY MAY 23, 1979 My name is John T. Conway. I am President of the American Nuclear Energy Council.1 I amhere today in response to a request from your ConTnittee to discuss what happened at Three Mile Island and its tech- nological implications. Obviously, those in government and in industry who are actively involved in analyzing and solving the problems connected with the mishap are best able to describe to you what actually took place. Governor Thornburgh of Pennsylvania - who, along with Lieutenant Governor Scranton had to assume awesome responsibilities during the first several days - has publicly decried the numerous `so-called experts" who had no first-hand knowledge of the situation but who nevertheless were gratuitously offering advice to him and the public, and making dire pronouncements as to the dangers of the situation. The news The American Nuclear Energy Council - established in 1975 - is a nuclear trade association located in Washington, D.C., and it is supported by nuclear steam supply vendors, architect-engineers, nuclear utilities and nuclear fuel and equipment suppliers and others. Currently, more than 100 organizations are members. The Council's principal task is to furnish factual information to the members of the Congress and their staffs, and also to rep- resentatives of the Executive Branch of the Government, including members of the White House staff, on the needs and problems of the nuclear industry and In support of our country's nuclear energy programs, in order to help maintain a strong and viable nation. PAGENO="0489" 485 media, you will recall, were filled with statements by these so-called experts who, despite their lack of knowledge of the factual situations, were quick to make contact with the press and to respond to all sorts of questions pertaining to Three Mile Island. The public, understandably, has been confused and un- necessarily freightened by so much inaccurate information and false speculation. For example, a number of `experts with no first-hand knowledge were before TV cameras in the early days of the accident to speculate on the large number of cancers that would result. Much coverage was given to their speculative figures. On the other hand, little media coverage has been given to calculations by the official Ad Hoc Interagency Group set up to evaluate the health effects. This group of knowledgeable and qualified individuals, including members from the HEW Center for Disease Control and the Food and Drug Administration, as well as the Environmental Protection Agency and NRC, conservatively have concluded that this accident will at most result in one fatal and one non-fatal cancer among the public. I would hope, in the performance of your duties and in the furtherance of your responsibilities, that your Committee and staff will help the public differentiate between fact and fiction - what is known and unknown - and what is speculation, and that in any reports that may ensue from Congressional investigations of the Three Mile Island accident, they will clearly identify these differences for the public. If this is done, I believe it will help the public have a better understanding of the benefits of nuclear power and its relative risk. More important, it will help the American people to intelligently decide the proper contribution nuclear power can make in solving our Nation's future energy problems, for in the final analysis it is they who must make that decision. I would also hope that your Coninittee and other committees of the PAGENO="0490" 486 Congress keep a proper perspective in evaluating the risks of nuclear power compared with other risks we face. On April 8, at a time when it had been determined that no evacuation was required by the Three Mile Island accident, 4,500 to 5,500 persons had to be evacuated from a 300 square mile area of Florida because a freight train carrying harmful chemicals had derailed. A Civil Defense official was contem- plating evacuating 7,000 more persons if a wind shift were to occur. On February 22, 1978, in Waverly, Tennessee, 2,000 people had to be evacuated when a railroad car exploded after a derailment. Fifteen persons were killed and 48 persons were injured by that explosion. On December 28, 1977, 800 people in a ten mile radius had to be evacuated due to a chemical explosion after a train derailment in Goldonna, Louisianna. Over $2 million property damage resulted in that accident which took place at the main street crossing of that town. The Department of Transportation records reveal that in a seven year period, 1971 through 1977, there were 130 derailments or vehicle accidents that resulted in high property damage and/or evacuation of persons due to hazardous chemicals. The 130 accidents resulted in 75 deaths, 1049 injuries and property damage just under $43 million. Of the 130 accidents in that seven year period, 41 required evacuation of people. I mention this because a great deal of discussion is taking place today with respect to evacuation plans in states where nuclear power plants are located. Under the guise of advocating public preparedness, opponents of nuclear power are demanding annual exercises where the population actually would be evacuated out to a given distance. If they were rational in their demand, they would require the same for every town and village through which a railroad passes or through which toxic chemicals are transported by vehicles. PAGENO="0491" 487 Based on experiences to date, evacuation plans are more apt to be put to the test in areas through which railroads and trucks handling chemicals travel than in places where nuclear plants are located. There is no doubt in my mind, nor do I believe there is any doubt in the minds of other knowledgeable persons in the nuclear industry, that some significant changes will result once we have had an opportunity to gather all the facts and thoroughly review them. The Edison Electric Institute - an association of electric companies whose members generate in excess of 77 percent of all electric power in this country - has undertaken a review of the event, including a technical study designed to implement necessary chances in present safety systems and procedures (see attachment 1). This review will augment presently on-going studies initiated by individual electric utilities currently operat- ing nuclear power plants. The Edison Electric Institute has appointed an ad hoc corrmittee of top-level utility executives to oversee and coordinate efforts of the industry to address the impacts resulting from the accident in Pennsylvania. Representati~e~ of public power systems have been asked to participate in the work of this comisittee and have indicated their intention to do so. In addition, the Electric Power Research Institute, an R&D arm of the electric power industry, has undertaken a detailed technical study of the Three Mile Island accident, and a scientific review by recognized experts not associated with the electric power industry is being established to examine the corrective industry response to the safety reviews relating to Three Mile Island. These actions by the industry are in addition to its pledge to fully cooperate with the President, the NRC and other government agencies PAGENO="0492" 488 responsible for investigating the accident. The nuclear industry is most appreciative of the actions taken by President Carter and the White House staff. The visit by President and Mrs. Carter to the site at the Three Mile Island facility on April 1 and subsequent Presidential statements did much to help put the matter in proper perspective, and help alleviate unnecessary fears previously being engendered by irresponsible speculation. The President pointed out that it was too early to make judgements about the lessons to be learned from the nuclear incident, but he assured citizens of Middletown, Pennsylvania and the public at large that there would be a thorough inquiry into the original causes of the events that subsequently occurred. In his April 5 address to the Nation, President Carter noted the concern that the Three Mile Island nuclear accident had caused, and announced the establishment of a fully independent Presidential Comission to investigate: 1) the circumstances leading to the accident and the chain of events as it unfolded; 2) the technical questions which this accident raises concerning the operation of the safety and back-up systems of this plant and design; 3) the nature and adequacy of the response to the accident by all levels of government. Without doubt, when the Presidential Commission has completed its investigation, coupled with the studies being undertaken by the electric utility industry, the NRC and others~, changes will occur in a number of areas, including regulatory activities. Prudence would dictate that premature actions not be taken until completion and a thorough review is made of these studies, unless, of course, a specific safety problem is uncovered during the course of any of these investigations, at which time, immediate corrective action should be taken. As your Subcommittee well knows, there are organizations and individuals in our country that would have our government shut down all nuclear power plants PAGENO="0493" 489 and prohibit all future construction and operation of such plants. Even though the accident at Three Mile Island and apparent meltdown of a portion of the core did not result in any fatalities or injuries to the employees at the facility or to the public, as many anti-nuclear activists claimed would occur with such an accident, they are attempting to use the Three Mile Island accident as justification to deny our Nation the benefits of civilian nuclear power Some have testified and submitted testimony to your Subcommittee and other committees of the Congress in the past, and undoubtedly will con- tinue to do so in the future. We are pleased that your Committee and other committees of the Congress that have had an opportunity to hear their testimony and review their submitted data, have wisely not followed their recommendations. In the United States today, we have 70 nuclear power plants in operation with a rated capacity of 51,000 MWe. As President Carter noted in his April 10 news conference, we now derive between 12 and 13 percent of our electric energy in the United States from nuclear power. The President went on to say, "There is no way for us to abandon the nuclear supply of energy in our country, in the foreseeable future." President Carter reiterated his recognition of the need to speed up the licensing of nuclear plants and said I think it does not contribute to safety to have a bureaucratic nightmare or maze of red tape as licensing and siting decisions are made." We agree and recommend thatin evaluating any necessary changes to regulatory activities resulting from lessons learned at Three Mile Island, the Congress recognize the contribution to safety that could result when PAGENO="0494" 490 technical people are permitted to devote their time efficiently to technical matters and be relieved of unnecessary and time-consuming paper studies. Our installed electric generating capacity from nuclear power today exceeds the entire electric installed capacity as it existed in the U.S. at the end of World War II. It is fortunate, indeed, that this is so when one examines our perilous dependence upon overseas petroleum supplies. Sections of our nation are especially vulnerable to the continued increases in the OPEC oil prices and to the threat of significant curtailment or cut-off of these foreign oil supplies. In 1978, approximately 17 percent of our electric generation in the United States was from oil-fired facilities. In New York State, however, 44 percent of all electric generation was from oil. New York State was fortunate in that nuclear power plants within the New York Power Pool were able to furnish 18 percent of all electric generation, and thus, save the equivalent of'37 million barrels of oil that otherwise would have been required. The New York Power Pool has calculated that nuclear power plants in its system saved its customers $550 million in 1978 - the incremental costs for alternative generation. During the same year in New England, over 30 percent of Boston Edison's customers' electricity was furnished by the Pilgrim Nuclear Unit. Fuel adjustment charges to its customers would have been 29 percent higher if the electricity had been produced by oil. In the Midwest, nuclear power supplied 45.4 percent of the electricity generated by the Comonwealth Edison Company, which supplies electricity to Chicago and surrounding areas, with hundreds of millions of dollars savings to Its customers. PAGENO="0495" 491 We live in a world of innumerable risks to each of us as individuals and to the public at large. We as a nation and the entire western world are facing tremendous risks to our economic well-being, not to mention our national security, by our present dependence upon mideast oil. I need not tell this Comittee how perilous and tenuous that oil supply line between the western world and-Saudia Arabia is, and what the economic and security implications would be were it to be interrupted. Presently, we have 92 nuclear power plants under construction in the United States, representing 100,000 MWs of additional electric generating capacity. Of those 92 plants, 37 presently are under operating license review. Those plants due to come on the line in the near future, together with our existing 70 nuclear plants, can and will make a. significant contribution to this nation in assuring an adequate supply of electricity for our nation in the years to come. Hardly a week goes by that one or more OPEC nation does not announce an additional increase in the price of its oil. Nuclearplants presently operating and those that will be coming on the line in the near future will help insulate our citizens from the economic consequences of those continuing price increases and help protect us from future oil embargoes directed at the United States for political or other reasons. Let there be no mistake, those who advocate the shutdown of our operating nuclear power plants and a moratorium on future nuclear power plants are in fact supporting an action that would constitute an unreasonable risk to the health and safety of the people of the United States. Many of those same people PAGENO="0496" 492 who are against the building of nuclear power plants oppose the construction of coal-fired and hydro electric facilities, which are also essential to our Nation. The electric utility industry in the United States has indicated its continued belief in the future of nuclear power. At its annual convention in Atlanta, Georgia on April 9, the Board of Directors of the Edison Electric Institute passed a resolution reaffirming its faith in the safety of nuclear power, and reiterated its determination to utilize every conceivable caution to prevent accidents. The Resolution restated the industry's concern for the public safety and for the production of safe and reliable electric power for the benefit of the public it serves (see attachment 2). Nuclear power has a safety record second to none. When compared with other alternatives today, and for the foreseeable future, nuclear power, if not fettered and burdened with additional and unnecessary handicaps - be they technical or political - can and will serve this nation well. Nuclear plants can be and are being operated safely today to the economic advantage of our Nation. Their economic advantage will continue to improve in the future as we gain more experience and particularly if fuel oil becomes increasingly expensive as the result of foreign action over which we have no control. The electric utility industry - both public and private - together with all other segments of the nuclear industry, is prepared to help our country solve our energy crisis by providing a significant portion of the electric needs of our nation in a safe, reliable and environmentally acceptable manner. PAGENO="0497" 493 ATTACHMENT 1 ACTIONS OF THE EEl BOARD OF DIRECTORS REGARDING NUCLEAR POWER april 11, 1979 The Institute 1. Has appointed an ad hoc committee of top-~level utility executives that will oversee and ôoordinate efforts of the industry to address the impacts resulting from the Three Mile Island accident and is inviting representatives of public power systems to participate in the work of this committee. 2. Commended the President for the actions he has taken in appointing a fully independent Presidential Commission to investigate the Three Mile Island accident, offered to Cooperate with the President's efforts and those of the Nuclear Regulatory Commission to the fullest extent, and is advising the President of the efforts the Institute is undertaking. 3. Endorsed the agreement reached with the management of the Electric Power Research Institute to undertake as expedi- t~ously as possible, with an augmented staff of experts, a detailed technical study of the Three Mile Island accident. The study will include analysis of the specific incident and identification of the generic safety lessons to be learned from it and also provide recommendations resulting from the EPRI study and from reviews by individual electric utility systems. 48-7210-79-32 PAGENO="0498" 494 4. Will assist the Electric Power Research Institute in raising the necessary funds to finance the technical study described in recommendation No. 3. In providing the assistance to EPRI, Edison Electric Institute will urge all member companies, including those without nuclear programs, to support financially the EPRI effort. 5. It has been agreed that the Electric Power Research Institute will communicate to electric power systems with nuclear programs technical information regarding the Three Mile Island accident which it obtains from General Public Utilities and the Nuclear Regulatory Commission. 6. Urges each member company with a nuclear power program to continue to give the highest priority to its study of the Three Mile Island accident, to identify the generic lessons * to be learned, to implement any necessary changes in safety systems anti procedures resulting from this review and make such findings available to EPRI. 7. Through efforts of the ad hoc committee appointed under recommendation No. 1, will establish a scientific review board of knowledgeable and recognized experts not associated with our industry to examine the collective industry response to the safety reviews relating to the Three Mile Island accident, including the-study which will be under- taken by EPRI. Representatives of public power will be invited to participate in the selection of this technical review board. PAGENO="0499" 495 8. Through the efforts of the ad hoc committee appointed under recommendation No. 1, will provide guidance to an augmented nuclear communications program, coordinating the resources of EEl, AIF, ANEC arid others, which will meet the challenges of the months ahead. 9. Will communicate its over-all program to the American Public Power Association, the National Rural Electric. Cooperative Association, the Atomic Industrial Forum and the American Nuclear Energy Council and urge their support. Mr. MCCORMACK. We will meet tomorrow morning at 9:30 in this room and continue these hearings. We stand adjourned. [Whereupon, at 4:10 p.m., the subcommittee was recessed, to reconvene at 9:30 a.m., Thursday, May 24, 1979.] PAGENO="0500" 496 APPENDIX I QUESTIONS AND ANSWERS FOR THE RECORD Babcock&WiIcox Power Generation Group P.O. Boo 1260, Lynchburg, Va. 24505 Telephone: (804) 384-5111 June 22, 1979 The Honorable Hike McCormack Chairman, Subcommittee on Energy Research and Production Committee on Science and Technology House of Representatives Washington, D.C. 20515 Dear Chairman NcCormack: In response to your letter received on June 12, 1979, 1 am pleased to provide the follow- ing responses to the questions presented. 1. "Would there be any advantages in standardizing the design of nuclear power plants?" I believe that there are advantages to standardizing the design of nuclear steam systems and coupling those nuclear steam systems with standard balance-of-plant designs. While streamlined licensing has been used as - the incentive for standariza~lq~, I believe there are greater benefits to be derived by having available at the beginning of the project, well ahead of construction, design data for early completion of detailed, engineering. By this means, the number of changes required during construction can be reduced, with the corresponding reduction in cost and construction schedule. Secondly, standardization provides a disciplined means of change control in which proposed changes are fully evaluated and engineered in a planned manner before implementation. While I support this type of standardization program, I would be opposed to the selection of a single - power plant design for the total utility industry, believing that such an approach would eliminate the benefits of competitive designs. PAGENO="0501" 497 Babcock&Wilcox The Honorable Mike McCormack June 22, 1979 2. "Is there any need for a "Swat Team" composed of people from industry, the utilities, NRC, etc.?" The Three Mile Island experience indicates the desirability of identi- fying personnel and equipment resources from industry, the utilities and the government to assist an operating utility in the mitigation of, or recovery from nuclear incidents. Work is under way through the sponsorship of EEl and the AIF to identify desirable resources and get commitments to their availability in an emergency. These resources would be intended to reinforce the capabilities of the operating organization and not replace them. The prevention of incidents and the early response must remain the responsibility of the operating utility. 3. "Should there be a standard design for control rooms and for the layout of control room instrument and control panels?" Each plant is different and, therefore, the control requirements differ. However, I believe it would be appropriate for EPRI, or some other industry organization, to standardize certain elements of control room design such as color coding, symbols, shape conventions and display conventions. Each vendor could then develop a reference control room design incorporating these standard design elements. This would be done recognizing the need for certain necessary variations from plant to plant. Future control room designs will also take more advantage of lessons learned in equipment design, human factors engineering and maintainability. In addition to the advantages noted in the response to Question 2, standard elements of control room design would result in fewer design variations to analyze and review and simplified operator training, testing and requalification. PAGENO="0502" 498 Babcock&Witcox The Honorable Mike McCormack June 22, 1979 4. "Should the control room operators or supervisors be employed by the utility or by some other agency?" It is my opinion that the owning agency, in this case the utility, should be responsible for the operation of the plant. Therefore, the control room operators and supervisors should be employed by the utility. 5. "List your recommendations for improving the instrumentation monitoring and control equipment." Several improvements in instrumentation for nuclear plants have already been put in place by the operating utilities and others are under study. Each recommendation should be systematically studied. The listing here is not exhaustive but typical of the industry approach. 1) During operation, provide an improved indication that the Engineered Safety Features Systems are in a ready state. 2) Improve alarm indications by grouping - such as "actions required" and "status indication." 3) Review "survivability" of instrumentation in environment resulting from accident conditions. 4) Increase use of "mimic" boards which show process flow lines as well as process condition. 5) Improve indications of vital functions - for example: a) Flow conditions on any device permitting exiting of primary coolant from the pressure boundary such as the relief valves. b) Indication of approach to saturation temperature or pressure in the primary coolant. c) Water level indication in reactor vessel. d) Water level in the reactor building. e) Indication of readiness of primary systems to go on natural circulation. f) Indication of natural circulation. PAGENO="0503" 499 Babcock&Wilcox The Honorable Mike McCormack June 22, 1979 6) Improved indications of off-normal conditions: a) Increased range of temperature measurements. b) Provide remote visual and audio equipment. c) Provide "flight recorder" data acquisition equipment. 6. "Who designed the instrumentation, control and display panels for the TMI control room? Is the design checked and approved by NRC?" General Public Utilities maintained the final approval rights for the arrangement of the instruments and controls on the control room panels. CPU also had the final say regarding layout of the control room. Detailed engineering on the panels was done either by the architect- engineer, Burns & Roe, or by the panel supplier. B&W provided two panels for the control room. For these panels, we provided a suggested arrangement of instruments and controls. The final arrangement was jointly developed with CPU having the right of final approval. The NRC reviewed and approved the control room design from the standpoint that it met NRC regulations in effect at the time. The NRC did not review the design from the human engineering or man-machine interface standpoint. 7. "List any reasons you may have for believing that the Three Mile Island plant should not have been in operation at the time of the accident." There was no reason, to my knowledge, that TMI Unit 2 should not have been in operation. The plant design and procedures had been reviewed and approved by the NRC and j~ad been licensed to operate. Let me clarify this response, however, by stating that subsequent to the incident, it has come to light that the plant was actually operating in violation of its Technical Specifications, i.e., the auxiliary feedwater system block valves were closed. Neither this plant, nor any other, should operate in violation of approved Technical Specifications. PAGENO="0504" 500 Babcock&WiIcox The Honorable Mike McCormack June 22, 1979 8. "In your opinion, what was the cause of the onset of the Three Mile Island accident?' As I stated before the Subcommittee on May 23, the initiating event of the accident was the interruption of main feedwater flow to the steam generators. I am not personally familiar with the specific events that directly led to this interruption. I understand that the interruption was the result of certain maintenance operations that were under way at the time in the condensate polishing equipment area. 9. "In regard to the pilot valve that failed to reseat, is the position of this valve directly or indirectly monitored? Describe how it is monitored." The position of the pilot operated relief valve is indirectly monitored. This is the case because the position of the main disk of the valve is not accessible to direct detection by means of mechanical linkage. The open or closed status of the valve is indirectly indicated by a light on the main control console which is "ON" when the solenoid is electrically energized. When the valve is functioning normally and the circuit is energized, the valve is open. There are other indirect indications available to the operator, such as, reactor coolant system pressure, quench tank level, pressure and temperature and valve discharge pipe temperature. 10. "In your testimony you indicate that there are emergency procedures to assist the control room operator in analyzing the instrument readings. Who produced this analysis? Please send us a copy of this procedure and the analysis." The emergency procedures which I referred to in my testimony were prepared by Metropolitan Edison. B&W's involvement in the evolution of the procedures for TMI Unit 2 consisted of providing draft procedures or operating specifications for TMI Unit 1. Metropolitan Edison then prepared the Unit 1 procedures. After the Unit 1 procedures were written, B&W reviewed PAGENO="0505" 501 Babcock&Wilcox The Honorable Mike McCormack June 22, 1979 and commented on them. Metropolitan Edison then finalized these procedures and may or may not have incorporated B&W's comments. Metropolitan Edison prepared the ThI Unit 2 procedures based on those that were initially prepared and in place on TMI Unit 1. Since the operating utility prepared the procedures, it would be more appropriate to request copies of them from Metropolitan Edison. 11. "You indicated that the temperature of the "quench tank" was 200 degrees. Was this degrees C or degrees F?" Degrees F. 12. "Please send the detailed description of the maintenance work in progress prior to the accident. Was the work normal maintenance? Was the work done in accordance with any instructions which you may have supplied?" The description of the work in progress prior to the accident should be requested from Metropolitan Edison or General Public Utilities. The condensate polishing equipment was not supplied by B&W and we did not provide any operating instructions or procedures related to it. 13. "What is the volume of the quench tank? How long does it take to fill it?" The TMI Unit 2 Final Safety Analysis Report indicates that this tank has a volume of 1000 ft3 and that it is normally filled with 650 ft3 of water. Assuming the design steam relief rate of the pilot operated relief valve, it would take about seven and one-half minutes to completely fill the tank based on these nominal conditions. Further information related to the specific water volume and times, prior to and during the accident, should be requested from Metropolitan Edison. B&W did not design or supply the quench tank at TMI Unit 2. PAGENO="0506" 502 Babcock&WiIcox The Honorable Hike McCormack June 22, 1979 14. "How frequently had similar maintenance work been done prior to the accident? Is similar maintenance work frequently performed on other B&W power plants? How `frequently?" I do not have specific information related to operation or maintenance procedures for condensate polishing equipment. Although all B&W nuclear units are equipped with condensate polishers, B&W has not supplied this equipment on any of its contracts. Information related to operation and/or maintenance procedures and frequency should be requested from the operating utilities. 15. "Provide a schematic description of the operation of the Condensate Polishing System including the means of ensuring adequate redundancy." This information should be requested from either Metropolitan Edison or General Public Utilities.. 16. "You mentioned that there was a release of radiation while transferring radio- active water from the bottom of the containment vessel to the auxiliary building. At what time did this occur and was this a part of the procedure that would normally go into operation? Does this call for a reassessment of the overpressure design criteria of the containment?" I would like to address this question by briefly going through the sequence of events that led to the spill of fluid in the containment vessel and the ultimate transfer to the auxiliary building. The following times are from the Hay 8, 1979, Interim Sequence of Events published by the NRC. At 3 to 6. seconds into the incident, the pilot operated relief valve (PORV) on top of the pressurizer opened and began relieving steam to -the reactor coolant drain tank. At 2 minutes and 4 seconds into the incident, the high pressure injection system cut on and began to pumpwater into the reactor coolant system. The PORV stuck open and continued to relieve to the drain tank. As the pressure increased in the drain tank, its relief valve opened at approximately 3 minutes and 30 seconds and beganrelieving the contents of the drain tank to the. containment vessel. The water level in the containment somp - increased-until reactor building-sump Pump A started automatically PAGENO="0507" 503 Babcock&Wilcox The Honorable Mike McCormack June 22, 1979 at 7 minutes and 43 seconds on a high sump level. This began trans- ferring fluid from the containment vessel to the auxiliary building. Water level in the containment sump continued to rise until at 10 minutes and 19 seconds, sump Pump B automatically started. Pressure continued to increase in the draink tank until at 15 minutes, the drain tank rupture disk burst. With the PORV stuck open and the drain tank rupture disk blown, there was a direct path for the release of reactor coolant to the containment. Finally at 38 minutes, the operator cut off sump Pumps A and B. This stopped the transfer of fluid out of the containment vessel. This transfer had been initiated automatically by a certain level of water within the containment vessel sump. As I indicated on May 23, these transfer lines would not be auto- matically isolated until the reactor building pressure increased to 4 psi. It is this criteria, the containment isolation criteria, that I indicated is being reassessed. 17. "What is the volume (gallons or cubic feet) of the receiving tank inside the containment vessel? Assuming that the HPIS runs without interruption, how long does it take to fill the receiving tank?" I assume that "the receiving tank inside the containment vessel" referenced in the question is the containment sump which is an integral part of the containment structure. Since the containment was designed by the architect-engineer, information related to its capacity should be requested from Burns & Roe or General Public Utilities. I think it is best to address the second part of this question by stating that the High Pressure Injection System with two pumps running, which is the normal case following emergency actuation, will supply between 1000 and 1100 gpm depending on the pressure PAGENO="0508" 504 Babcock&WiIcoX The Honorable Mike NcCormack June 22, 1979 in the reactor coolant system. The time required to fill the sump depends on numerous parameters, such as, sump capacity, initial inventory, sump inputs and outputs. 18. "It appears that some of the events at ml took place very rapidly. Is this indicative of inadequate thermal capacity in the cooling and heat transfer systems?' No, the B&W design does not suffer from inadequate thermal capacity in the cooling and heat transfer systems. I should clarify that in any large power station, a major upset such as turbine trip or reactor or boiler trip will result in a number of events taking place in a short period of time. The subject of thermal capacity is a very complex one. It involves considerations of such things as reactor coolant system thermal capacity, secondary system thermal capacity, load change requirements and capability, containment design considerations and overall plant safety considerations. B&W's nuclear system design is different from other pressurized water reactors (PWR's) because of the application of the once-through steam generator rather than a recirculating steam generator. As a result, in terms of reactor coolant system upsets, the B&W system contains more thermal capacity than do other PWR's and in terms of secondary system upsets, it contains less. Based on an evaluation of the distribution of thermal capacity and the distribution of upsets, we have concluded that the net effect is a tradeoff. That is to say, our system is more tolerant of some transients and our competitors' systems are more tolerant of others. The B&W design provides certain load follow and operational benefits which I believe are important. It provides these benefits without sacrificing overall plant safety. PAGENO="0509" 505 Babcock&Witcox The Honorable Hike NcCormack June 22, 1979 19. "On page 10 of your testimony you mention three actions taken by the plant operator: "(1) He cut back on the high pressure injection to maintain the pressurizer level. Was this the right thing to do? "(2) He turned off the two pumps in the `B' loop at 73 minutes into the accident. Was this a reasonable thing to do? "(3) At 100 minutes into the accident the operator turned on the two pumps in the `A' loop. Was this a reasonable action? On what basis would you expect these actions to be taken?" Part (1) As I stated before the Subcomnittee on May 23, the premature termination of the high pressure injection flow led to diminished capability to cool the reactor core. This was because reactor coolant system inventory was being reduced by blowdown through the open pressurizer relief valve. The Loss of Reactor Coolant/Reactor Coolant System Pressure Emergency Procedure that was in place on TMI Unit 2 at the time of the accident requires that both the pressurizer level be maintained and that the reactor coolant system pressure be maintained above 1600 psi before the operator may proceed with reduction of the high pressure injection flow. Based on the information that I have, that procedure was not followed because reactor coolant system pressure was below 1600 psi when high pressure injection flow was reduced. This reduction in flow was apparently based on indicated pressurizer level only. Had the procedure been followed and had the high pressure injection system been allowed to continue in operation at full capacity, subsequent anlayses have indicated that adequate core cooling would have been provided, reactor coolant system pressure would have been recovered and it would not have been necessary to shut off the reactor coolant pumps. Therefore, this was not the right thing to do. PAGENO="0510" 506 Babcock&Wllcox The Honorable Mike McCormack June 22, 1979 Part (2) I have stated that shutting off one pump in each loop in response to indications of low reactor coolant flow may be advisable and therefore reasonable. Part (3) I assume you mean that the operator turned off the two pumps in the `A' loop. While turning off the last two reactor coolant pumps eliminated all forced circulation through the core, I cannot fault the operators for taking that action at that point in the sequence. Based on my understanding of the vibration levels and system conditions that existed at the time, I believe the operator acted appropriately in turning off the pumps. I think it is important to point out that although the shutting off of all reactor coolant pumps by the operator may have been a reasonable action for protection of the pump under the circumstances, if the high pressure injection system had not been cut back, the situation would not have deteriorated to the point where this action would have been necessary. 20. `Please comment on the following statement: `From the viewpoint of nuclear power plant safety design, two principal technical elements are involved in ThI. The most important is that the plant was configured so that the pressure relief valve on the primary coolant system opened very often due to events such as a failure of normal feedwater flow to the reactor." The B&W design philosophy has been to provide a runback capability for anticipated transients that occur during plant operation. This includes such transients as turbine trip, load rejection, loss of one main feedwater pump or a partial loss of main feedwater flow, the loss of one reactor coolant pump, frequency variations on the electrical grid and partial or complete drop of one control rod. The objective behind the runback philosophy is to minimize the challenges to the protection and safety systems, thus enhancing overall plant safety. PAGENO="0511" 507 Babcock&WiIcox The Honorable Mike McCormack June 22, 1979 This philosophy is implemented through a system control design concept that incorporates a pilot operated pressurizer relief valve. It is my opinion that this implementation does not lead to a degradation in safety since appropriate means are provided for isolation of that valve, if necessary. 21. "Provide details of the training program giv~en to Mr. Zewe by B&W." Mr. Zewe completed a one-week operator training course on the B&W nuclear power plant simulator in January 1979. This course consisted of 16 hours of classroom time and 20 hours of simulator operations. The detailed list of evolutions performed on the simulator and the classroom and control room schedule are included as Attachments 1 and 2, respectively. In addition, Mr. Zewe completed a refresher course in July 1977 in preparation for his TMI Unit 2 operator's license. That course consisted of 20 hours of classroom time and 20 hours of simulator operations. The detailed list of evolutions performed on the simulator and the classroom and control room schedule are included as Attachments 3 and 4, respectively. Prior to June 1977, it is my understanding that Mr. Zewe was assigned to ThI Unit 1 and was a licensed senior reactor operator on that unit. I hope the above responses will be of benefit to the Subcommittee's continuing investi- gation. Very truly yours, THE BABCOCK & WILCOX COMPMW JHM/mjc John'ki. MacMillan, Vice President Nuc1e~Power Generation Division 4 Attachments PAGENO="0512" 508 SIMULATOR TRAINING SUMMARY SHEET January 15-19, 1979 Mr. Bill Zewe has completed a one week training program consisting of 16 hours of classroom time and 20 hours of simulator operations. The time spent in the simulator consisted of performing the evolutions listed below with the remainder of the time devoted to manual and automatic ICS power operations. Evolutions Performed No. Performed Fail Makeup Pump 1 Defeat Neutron Error Signal from ICS 2 Motor Fault 1 Dropped Rod 1 Stuck Rod 2 Retarded Rod Notion 1 Pail Power Range NI Reactor Trip 7 RC Pump Trip 2 Fail Selected TH Instrument 2 Fail Selected Tc Instrument 2 Fail RC Flow Signal to ICS 2 Fail Pressurizer Spray Valve 3 Fail Pressurizer Level Signal 1 Reactor Coolant Leak Inside Containment Building 2 OTSG Tube Rupture 2 Steam Leak Outside Containment Building 2 Steam Leak Inside Containment Building 2 Turbine Trip 2 Fail Feedwater Pump LiP i Fail OTSG Startup Level to ICS 1 Fail OTSG Operate Level to ICS 3 Condensate Pump Trip 1 Fail Feedwater Flow Signal to ICS 1 Feedwater Pump Trip 3 Load Rejection -8 3 Reactor Startup (Hot shutdown, all rods in, to 10 amps) 1. Reactor Startup (108 amps to 5% power) Reactor Startup (5% power to 15% power) 1 Power Escalation (15% power to 100% power) 1 Plant Reduction (100% power to 15% Power) 1 >10% Reactor Power Change wish Reactor Control in Manual Plant Temperature Change >50 F 1 Reactor Trip without Turbine Trip 2 Failed Tave to 570 in the ICS 2 Failed Main Feedwater Valve Open 1 (Continued) PAGENO="0513" 509 Evolutions Performed Failed "A" Stean Generator Pressure to ICS High Failed "A" Main Feedwater Valve Closed Decreased Condenser Vacuum Failed Reactor Power to 60% in ICS Feed Pump Trip with Neutron Error Defeated in ICS Dropped Rod Group 7 with Diamond in Manual Ejected Rod Group 7 Loss of Both Feed Pumps Failed Turbine Bypass Valve Failed Header Pressure Signal to ICS Degraded HP Heater Reactor Startup (Hot shutdown, safety rods -8 out, to 10 amps) Instructor, Nuclear Training Center No. Performed 1 1 2 1 1 1 1 1 1 1 1 1 Date 48-721 0 - 79 - 33 PAGENO="0514" * ROll Eeoc Sb OroASi.y Jim Moeterc CONTROL ROOM SCHEDULE INSITtDCPORS NUCLEAR TRAINI115 ~rr~ 0.J. (Worry) Weiieeier J.A. (Joho) Liod IL. (Tod) look Vt. (Viooo) Roppol A.V. (Al) While 601-8027-09.00 .SUVLATOR REQUALIFICATION TRAINING GROUP 1 CLASS ROOM SCHEDULE P19 WI. Rap/Date Tim' Seblect Reference Instructor TI~~ T Opinatle. Reference tnitructor 1 R4TNEAY 1/15/79 . 1400 COD REVIEW/OPURAT100IAL PI15OLUIS J,L. 0130 to 1130 ROACTOR STARTUP P115.! ALL RODS IN TO 100% P051.0 REACTOR TRIP 01.065150 TRIP Ta. 1400 ~ IWrECDATED C mIol. OlSON.! 1.5. - - 2 TUIISIAS 1/16/79 1030 1~0 CONTROL DOD DRIVE * JL °~ tO 0)30 PCWTR OPERATIONS WITH tft(AM65IJNCEIJ CASUALTIES ` `~` V.0. AL 1400 to 1600 . * 91160 TIWISPER . * 0.8. ~ 1200 to .!!2.2_. lOWER OPERATIONS WITH IODOGIOIOICED CASUALTIES . 3 WFOIOESIAY 1/17/79 0730 to 0930 OUSt WtVItO/TOIt RUPTURE . . * ~ 0930 to 1130 POSER OPERATIONS WITH 000POIC900CED CASUALTIES * J.L. `i;;; to 1400 POWER lIST. 10)0 WIThDRAWAL LIMITS yR. * to .!±99_ --....-."...... CASUALTIES . J.L. * 4 I}RJDSDAY 1/10/79 0930 to 1130 . POSH POLL oo.soo 0730 to 0930 . POWER OPERATIONS WITH RHARUOSRIERD CASUALTIES * AR (*; 6.0. . to 160) ICS REVIEW/TRANSIDNT RESPONSE TO. tO .1!2!... IThRNA000IOICED CASUALTIES * S PRIIIWY 1/19/79 0930 tO 1130 * . 001 000 Rod Withdr~o~1 & Diet. . * . ro, 0730 to 0930 P0511 OPERATIONS WITH RRA)o0)tJMED CASUALTIES 90 to 1600 REACTOR COOIAJff'pIJSpS 0.0. `u~a" tO 1400 ~ö~'öi~i.~iIoNS ITO UNA(6I007ICED CASUALTIES - 9.0. cii METROPOLITAN EDISON COMPANY Coliltif IAICOCR I WILCOX AT090T27 NUCL(0R 78*10(81 CINTRI LUICHIURI. ((0166(0 ATTACHMENT 2 PAGENO="0515" 511 SIMULATOR TRAINING SUNMARY SHEET June 27~.Ju1y 1, 1977 Mr. W. H. Zewe_ has caipleted a one-week ~airJr~g prcgran consisting ofR3Tc rs 6tc sroat tite axi 20 hours of sirrulator operations. The tirr~ spent in the siruiator consisted of perforning the evolut~tcrs 1~s ted below with tl~ rerair'.der of the tic~ devoted to rx~riua. and autanatic CS power operations. ~1uticrts Perforned ~. Perforr~ed Dropped Rod 2 Stuck Rod 1 Reactor Trip . 3 RCPu~pTrip 1 Fail Selected ~. Instrt~t 1. Fail Selected Ir.smz~rit 2 Fail Pressurizer Spray Valve 1 Reactor Ccolant Leak Inside Cozita.ircent ~.ii1ding . t OtSG. Tube ~ti.~re 1 Fail 1\rrbir~e Bypass Valve 1 Stean Leak Inside CcncaL-xent &iildthg 3 Fail Header ?ressure Si~al to ICS I Ttirbfr.e Trip Fail Feed~:er ?~.ti, .P 2 Fail OTSG Scrup Level to ICS 2. Fail C1~SG Operate Level to ICS . 4 Feed~ster ~ Trip -8 1 Reactor Startup (Fot s1a.edo~n, all rods in. to 10 a~is) 1 Reactor Star-'~ (08 an~s to 5~ pcwer) I Reactor Startup (5~ power to l5~ power) 1 Power Escalaticn (15~ power to 1OQ~ power) 1 Plot 1/~ 1, Failed Main Feed Valve B Opcsi 2 Loss ICS Pc~..er Fail Mi Control Valve 1 ATTACHMENT 3 PAGENO="0516" 1~~i.&~toto-.0ucIe~r Trathint Cont,t J 0. 53.3 Cavnnn ~ Porla C.?.C) Alien ~:~ry, I!ellsnIsr CUSS ROOM SCHEDULE 60l*S027~07~06 PLANT OPERATIONS TRAININO GROUP D CONTROL ROOM SCHEDULE 9111 Zoos 7Sba )~rsNaI1 I.~i.h RY137t I's'lEs,!!!!! t~~S hued - hfsosecs * Ti.. U~sva1s. Issuscs I M~\3NY o 21 77 ` 7:50 to 11:30 cOHTROL ROD DRIVO DIA'Cd7P.U~L*IVI~ * . 4:00 9:30 PL000ED NOZZLE STARTUP PEON ALL RODS IN TO 1000 REACTOR TRIP T000INE TRIP " Cpsoo ~ ~ 2 TUESDAY 6/20/17 . - - 9:30 02:00 t~ 2:00 *EA~OR PROTECTION S STEM IC, REVIEW W* Perks .7. Carson to 4:00 0:30 POWER OrCUATIONS WITH UNANNOUNCED POWER OPERATIONS WITH UNANNOUNCED CASUALTIES ~. P~~5 .1 Carson ` WED. 0129/71 7:30 t 12:00 to 2:30 ICS REVIEW ICS REVIEW .7. Carsos V. Perks 2:00 ER 4:00 POWER OPERATIONS WITH UNANNOUNCED POWER OPERATIONS WITH UNANNOUNCED CASUALTIES .7. Carson W. Perks TH~RSDA ~ E.~ 0750 REVIEW ~. ..!!._ 9:30 CASUALTIES WITH UNANNOUNCED ~. Pork, 7:30 to FRIDAY 9:30 711/77 12:00 to t_*_____~-_- REACTIVITY CHANCES WOL . EOL WEEELT REVIEW H.H.tlseL.r 0. Perks 00 11:30 2:00: 00 REVIEW SELECTED CASUALTIES .7 Carson REVIEW SELPCTED CASUALTIES .7 Carson t-~ lABElER I WILCOI soCilal IOAIOHC CIRTEB 1s~Wl0R5. RIICIR:A ATO7NTZ7 ATT~CHMENT 4 PAGENO="0517" 513 Congressman Mike McCormac'k Babcock &WiIcox Power Generation Group P.O. Box 1260, Lynchburg, Va. 24505 Telephone: (804) 384.5111 May 29, 1979 J~m ~ The Honorable John W. Wydler Ranking Minority Member Subcommittee on Energy Research and Production Science and Technology Committee House of Representatives Washington, D.C. 20515 Dear Congressman Wydler: During my appearance before the Subcommittee on Energy Research and Production of the House Committee on Science and Technology on Wednesday, May 23, 1979, you raised a series of questions regarding a Nuclear Regulatory Commission memorandum dated January 8, 1979, from J. S. Creswell, Reactor Inspector, to J. F. Streeter, Chief Nuclear Support Section 1 (Creswell memo). I regretfully did not have the following information available at that time to respond to your questions but,as I indicated,I would supply a response for the record. The Creswell memo discussed six points that the author raised which he felt should be considered by the licensing boards for license application by Consumers Power Company for its Midland. Units 1 and 2 and Toledo Edison Company for its Units 2 and 3. These units will incorporate Babcock & Wilcox nuclear steam systems. The Creswell memo was an internal memorandum of the Nuclear Regulatory Commission and was not transmitted to Babcock & Wilcox. This is normal for NRC internal memoranda. To the best of Babcock & Wilcox's knowledge, the customers of Babcock 6 Wilcox, Toledo Edison and Consumers Power, did not receive copies of the Creswell memo. Item 3 of the Creswell memo referred to an incident at Toledo Edison's Davis-Besse Unit 1 where off-site power was lost. This incident occurred on November 11, 1977. Babcock & Wilcox worked with Toledo Edison in investigating the incident. We believe Item 6 of the Creswell memo refers to a letter sent by Babcock & Wilcox to Toledo Edison dated August 9, 1978. This letter referred to an incident that occurred at Sacramento Municipal Utility District's Rancho Seco Unit 1 plant on March 20, 1978. This unit also incorporates a Babcock & Wilcox nuclear steam system. Babcock & Wilcox informs its customers having operating units of. incidents. PAGENO="0518" 514 which occur at one of the plants which may provide helpful informa- tion to the owners and operators of its other plants. This was the purpose of the August 9, 1978 letter to Toledo from B&W. Returning to the -Creswell memo, the normal course of events, as we understand it, would be for the NRC to review the points raised and follow the memorandum to a conclusion. In the course of the NRC's investigation of the Creswell memo, the NRC wrote to Babcock & Wilcox on January 31, 1979 and requested a meeting in Lynchburg to discuss items related to an NRC invàstigation of an incident at Davis-Besse. That meeting was held in Lynchburg on February 14, 1979. The discussions were apparently about the points raised in the NRC memo of January 8, 1979, although no copy of the Creswell memo was given to B&W at this meeting or prior thereto. On February 28, 1979, apparently following its own internal procedures, an NRC memorandum was sent from Norman Moseley, Director, Division of Reactor Operation Inépection, IE, to Dudley Thompson, Executive Officer for Operations Support, IE. The subject was "Notification of Licensing Boards" and sent its preliminary evaluation of the six points raised in the Creswell memo~ This Noseley memo stated: "Our preliminary evaluation indicates these items (the six points raised in the Creswell memo) do not appear to be new issues or to puts different light on the issues and therefore, in our opinion, do not meet the intended criteria for Board notification." This memo went on to say that Creswell, upon notification of the Division of Reactor Operations Inspection preliminary findings, requested that the Licensing Boards still be notified and pursuant to the NRC procedures Moseley did so. On March 28, 1979, another internal NRC memorandum was sent from N. C. Moseley to D. Thompson which included the final evaluation of the six items set forth in the Creawell memo. We hope that the above brief chi~onology is helpful and responsive to your question. It is important to again note that the Creswell memorandum and the follow-on NRC memoranda were internal to the NRC and were not sent to B&W. Following the Three Mile Island incident B&W first became aware of the existence of the Creswell memo even though the subject matter had been discussedwith theNRC. On March 29, 1979, B&W first received a copy of the Creswell memo and the follow-on NRC memos. PAGENO="0519" 515 If I can provide you or the Subcommittee with any further informa- tion, please advise. Very truly yours, JHM/mjc Job . MacMillan Vice resident Nuclear Power Generation Division Enclosures: - 1/8/79 Memo J.S.Creswell to J.F.Streeter - 2/28/79 Memo N. C. Moseley to D. Thompson - 3/28/79 Memo N. C. Noseley to D. Thompson enclosing Evaluations of Concerns cc: w/Enclosures The Honorable Mike McCormack Chairman, Subcommittee on Energy Research and Production Science and Technology Committee House of Representatives Washington, D.C. 20515 PAGENO="0520" u?.ItEO STatES NUCLEAR RSGULITORV CC'.tt.tISSICN `I 7~! ~OO1CVt~. a5*~ Ct.E~ (t~t.v~. t.~.OiS IO~37 January 8, 1979 ::~1OANDUN FOR: 3. F. Sereeter, Chief, Nuclear Support Section 1 FRON: J. S. Cresvell, Reactor Inspector SUgJECT: CO~JE?ING N~ INFORIIATION TO LICENSING 3C?RDS - DAVIS-3ESSE UNITS 2 & 3 AND MIDL4ND UNITS 1 & 2 During the course of oy inspect±ons at Davia-Basse, certain issues have cone to ny attention vhich I ~ submitting for ccnsidarstion for forvarding Co the A:cnic Safety and Licensing loan vhich has proceedings pending for the afora~.encioned :acilit~as. This subnictal is n.ade pursuant to Resional ?rocedu:e 1530A (Novenbe: 16, 1978), ste~ 3 and infoctnacion supplied to ne per step 1. The issues for consideration are: 1. During a recant inspection at Davis-Easse tnit 1 infc~stion has been attained vhich indicates that at certain condi:icr.s of resctor - coolant visccsicy (as a funcz.on of tenperature) core lifting nay occur. The licensee infoed the inspector that this issue involues other E&W facilities. The tavis-3esse FSAR states in Secc:on t~.A.2.7: The hydraulic force on the fuel aesanbly receiuing the nost flow is shovn as a function of systec flay in Figure 4-39. Additional forces acting on the fuel assenbly are the asserbly weight and a hold deL-n spr1ng force, vi-.ieh resulted in a net do~nvarf force at all tines during nor~.sl station operati~r.. The licensee states that there is a 500°F interlock for the starting of the fourth reactor coolant p~p. Ncvever, no Technical Specifi- cation :equires that the p~p be started at or above this tanpera- ture. A concern regarding this nacter vould be if asaanblies ncved upward into a position such that control rod nov~nent would be hindered. 2. Inspection Report 5C-3~6/7S-O6, paragraph 4, reported reactivity - paver cscillations in the Davis-lease cork. Those oscillations have also occurred at Oconee and are ac~ributed to stean generator level oscillations. 3&N report EAS-10027 states an a9.2: 516 Docket No. 50-300/501 50-329/330 ~1 PAGENO="0521" 517 The OTSG laboratory nodel test results fndicated that periodic -- oscillations in steso pressure, szean flow, and steangenarator prinery outlet :e:zpar~tu:es could occur under certain conditicns. It was shown that the oscillations were of the type asrociated with the relationships betvven feedvater heatang chanber pros-- - - * sure drop and tube nost pressure drop, which are elininsted or reduced to levels of no. cchsequence (nofaadback to reactor ~.~!en) by adjustnenc of the tube nest inlet resisronce. As a rosult of the tests, an adjustable orifice has been installed * in the dovoccoer section of the stean generators to proviae for adjuscnent of the tube nest inlet resistance and to provide the eear.s for elinination of oscillations if they should develop during the operating lifetine of the generators. The initial orifice setting is chosen ccnset~atively to nininize the need for further adjuatnent during the star:up test prcgrsn.. We also note that the effect on t~e incors detector syston fcr nonitoring cors paransters during the oscillations is no: clear. 3. Inspection ~nd Znforzenent Report 50-346/78-06 docutanted that pres- surizer level had gone offscsla for approxinately fi:e ninutas du:- ing the Novenber 29, 1977 loss of offeite power even:. There are sane indications that other l&W plants nay have prabens naintainirg pressurizer level indications during transients. In addition, under certain conditions such as loss of feedvater a: lOOl power with the reactor coolant p~ps running the pressurizer ~sy void ccnpletaly. A special anal~.'sis has been perfot~ed concerning this event. This analysis is attached as Znclosure 1. Secsuss of pressurizer level taintenance problans the sizing of the pressurizer cay require further revi~v. Also noted during, the. event was the fact that Tcold vent ofiacala (~es ian o20 ) n a~d son st as no en tn~ t~ un ow sonit.oring is. l~ited. to lass than 160 gp and that nnkaup flow cay be sube:~nriaily greater than this value. This info~ation shculd be exooi:ed in l~.ght of the,require~ents of GDC 13. 4. A neno froc B&W. regarding control rod drive syst~ trip breaker naintenance is attached as Znclosure 2. This neno should be evaluated in terns of shutic-n rargin ~intenance and All'S considerations par- ticularly in light of large positive noderator coefficients allowable with 3&~ facilities. PAGENO="0522" 518 5. l~specricn and forceoent F.epor: lC-3L6/7f-17, psr~raph 6 raf.:s to inspec:icn findir.gs re;arding the capability of the inccre derac- .tor systw to da:er~ir~a ~crs:. cisc ths~al c~n:i~ns. The reactor - can be cperated per the Technicil Specifi-~acions vith the center incore string out of service. Lf the peak power lo~atior.s is in the center of the core (this has been the case cc Davis-~esse), fa~cto:s are not applied to conservatively nc~itcr values such as and F delta H. 6. Eo~losure 3 describes an event that occurred at a I&W facility vhich reaulted in a severe theral cran~ient and extrsoe difficulty in controlling the plant. The aforerentioned facilities should be r~vie~ed in li~nt of this inforr~cion for possible safety inplica- clone. -. 1 - .1. S. Cresvell P.aactcr inspector Zoclosures: As stated . cc yb enclosures G. Ziorelli R. C. }Znop T. N.. Ta~bling - PAGENO="0523" 519 tJ?Jt1to s~.r. rEs NUCLEAR REnuLATo~Y Cc:;:.asoioN mASHINCTON. 0. C. ~5S5 EBB 28 T~73 WE;1OR~:wuM FOR: ~)á~I~y Thompson, Executive Officer for Operations Support, IE FROM: florman C. ;loseley, Director, Division of Reactor Operations Inspection, IE SUBJECT: HOTIFICATJON OF LICENSING BOARDS (AITS F30468H2) Enclosed are six items sent in by Region III for for.:arding to sitting Licensing Bcards for cases involving Babcock and Wilcox as the ~uclear Steam System Supplier. Our preliminary evaluation indicates these items do not appaar to be new issues or to put a different light on the issues and therefore, in our opinion, do not meet the intonded criteria for Board notification. The originator ~tas informed, via telephone, of this determination on February 27, 1979. His position was that our evaluation did not provide any information thot he did not already have ~nd his concern was whether or not these items had been considered and resolved on a generic basis for all B&W plants. Because of this he still believed the items should be sent to the Licensing Boards. IE Nenual Chapter 1530 requires that if, after a negative determination, the originator continues to believe that the information should be submitted to the Board(s), the information will be submitted. We therefore request the enclosed items be sent to the appropriate Licensing Boards. We will provide a written discussion and evaluation of each item within seven (7) days of the date of this memorandum. ) ,r~Direc't~r Div.is'ion of Reactor Operations Inspection, rE Enclosure: ilemorandum Creswell to Streeter dated January 8, 1979 cc w/o end: S. E. Bryan E. L. Jordan 0. Kirkpatrick J. C. Stone G. C. Cower R. F. Heishmen, R1II PAGENO="0524" 520 STAT ES £~UCLEAR REGULA1ORY COM:.~SSION JO ON 0 C 2055 1~AR 2 8 1979 t1EI4OP..~DUM FOR: Dudley Thompson, Executive Officer for Operations Support, IE FROM: Norman C. Noseley, Director, Division of Reactor Operations Inspection, IE SUBJECT: ~diOTIFI~ATION OF LICENSING BOARDS On February 28, 1979, six it~tns concerning Babcock and Wilcox designed nuclear plants were sent to you for foi~~arding to the appropriate licensing boards. At that time only a preliminary evaluation had been done. 1~e have completed our evaluation of each. of the items ard that information is enclosed. This additional information should be fonzarded to the licensing boards. Norman C. Moseley Director Division of Reactor Operations Inspection, IE Enclosure: Evaluations of Concerns cc: S. E. Bryan E. L. Jordan R. F. Heishman, Rill J. C. Stone D. Kirkpatrick * LG~C~ Gower V. 0. Thomas CONTACT: 3. C. Stone (x280l9) PAGENO="0525" 521 EXCERPT FRON MD:oRA~;Du~ ENTITLED "CoI;VEYINC ~w INFor~'t;TIoN TO LIC:~Su;G ~OA7~DS - DAVIS-~ESSE U1~ITS 2 & 3 AND NIDU~ND UNITS 1 & 2', DATED JANI~ARY 8, 1979, FED>! J.S. CRES~ELL TO J.F. STREETER 1. During a recent inspection at Davis-Besse Unit 1 information has been attained which indicates that, at certain conditions of reactor coolant viscosity (as a function of temperature) core lifting may occur. The licensee informed the inspector that this issue involves other B&W facilities. The Davis-Besse PSAR states in Section 4.4.2.7: The hydraulic force on the fuel assembly receiving the most flow is shawn asa function of system flew in Figure * 4-39. Additional forces acting on the fuel assembly are the * assembly weight and a hold down spring force, which resulted in a net downward force at all times during not~nal station operation. The licensee. states that there is a 500°F interlock for the start- ing of the fourth reactor coolant pump. However, no Technical Specification requires that the pump be srarted.at or above this temperature. A concern regarding this matter would be if assem- blies moved upward into a position such that control rod move- ment would be hindered. ` -~ ` DISCUSSION A.'~D EVALUATION The `potential for core lifting in B&W plants is a concern which has been previously reviewed by NRR. The concern was first raised in conRection with the Oconee 2 and 3 reactors, where the primary coolant flow `rates were found to be in excess of the design flow rates. For example, the Unit 2 flow rate was found to be 111.5% of the design flaw rate. Since this was very near the predicted core lift flow rate of 111.9%, an analysis was done by B&W to determine what effectcore lifting * ~~ould have on the previous safety analysis for these plants. This analysis (dated Hay 2, 1975) indicated that the potential for core lifting did not result in an unrevieved safety question. *A subsequent review of this B~W analysis by NRR also concluded that an unsafe condition did not exist (letter from R. A. Purple to Duke Power,' dated 9/24/75). It should be noted that the potential vertical displacement of the core is limited to a very small distance by the upper core support structure. Core lifting, at paver would result in a slight reduction in reactivity since the rising fuel would tend to engage the withdrawn control rods to a slightly greater extent than it would in. the bottomed condition. The amount of this change in reactivity is, of course, available for reinsertion should the fuel settle back to its original position. The potential reactivity increase caused by the settling of the .16 centrally located control rod assembly elements (assumed ~o have been subject to lifting in the Oconee 2 reactor) was calculated to be 0.1% 1~ K/K. This value is insufficient to have much effect on the accident and transient safety analyses. * . PAGENO="0526" 522 6An additional concern was thepotential for damage to the fuel assembly end fittings which night be caused by fretting due to repetitive fuel. movement. Consequently, Duke Power was requested by KR?. to make certain e:~aninations of the Oconee 2 fuel during the first refueling to confirm that fuel element c~otion was not occurring. The results of this examination (letter from W. 0. Parker to R. C. Rusche dated 7/21/76) showed that no fuel lifting or other type of notion had occurred during the first cycle of operation. After the core lift concern was identified, B&W developed newer types of fuel holddo~.i-i springs which provide more margin against core lifting than the previous springs did. It is our understanding that the newer types of springs have been installed in all B&W reactors. For these reasons, we believe that there is- presently little likelihood that core lifting will occur during normal pcwar operation. At lower temperatures, there is an increased flow induced lifting force on the fuel due to the hither visccsity of the reactor coolant. gonsequentl)', we view the restriction against 4 pump operation below 500 F as a prudent precaution against fuel fretting. However, since the potential for core lifting has little safety significance and because critical operation below 500°F is not permitted, we have no basis to recommend including this restriction in theTechnical Specifications. PAGENO="0527" 523 EXCERPT ~o~i ~*~o~u~i ENTITLED "co~v~n;c ~;~` I~~FO~iA~ION TO LICENSING BOARDS - DAVIS-RESSE UNiTS 2 & 3 AND 2~lDLA:;D UNITS 1 & 2', DATED JA~ARY 8, 1979, FRO:t J.S. CRESVELL TO J.F. STREETER 2. Inspection Report 50-346/78-06, pa;agraph 4, reported reactivity - power oscillations in the Davis-Besse.. core. Theme oscillations have also occurred at Oconee and are attributed to steom genera- tor level oscillations. B&W report EItW-10327 states in P.9.2: The OTSG laboratory model test results indicated that periodic oscillations in steam pressure, steam flow, and steam g~nerator primary outlet temperatures could occur under certain conditions. It was shown that the oscillations were of the type associa- ted with the relationships between feodwater heating chamber pressure drop and tube nest pressure drop, which are elimi- nated or reduced to levels of no consequence (no feedback to r~ac.tor svs:am) by adjustment of the tube nest inlet resistance. As a result of the tests, an adjustable orifice has been installed in the downconer saction of the sta~m ge~e~ ots to pro~ide for adjust-ien or the tune ne~t'.inle~ resistance and to provide the nrans for chains- tionof oscillations if they shculd developduring the operating lifetime of the generators. The initial orifice * setting is chosen conse~'atively to minimize the need for further adjustment during the startup test program. We also note that the effect on the intore detector system for monitoring core parameters during the oscillations is not clear. DISCUSSION AND m\?t.LUATION Power Oscillations of the order of 1.5% of full power have been observed at all of the Oconee plants and are considered normal. In ]977 the power oscillations experienced by the Oconee 3 reactor increased to a maximum of 7.5% of full power. At that time the problem was reviewed by NRR with the conclusion that there was no significant safety considera- tion at that value (Note to B. C. Buckley from S. D. ~acRay, dated January 27, 1978). it should be noted that the 7.5% power oscillations cause about a 1 F oscillation in core average temperature due to the short period of the oscillations. The important core safaty parameters, which are, the departure from nucleat~ boiling ratio and the average maximum linear heat generation rate are affected very little by oscilla- tions of this amplitude. The primary cause of the power oscillations is believed to be a fluctuation of the secondary water level in the steam generators. This can be minimized by increasing the flow resistance In the dovnconer region of the steam generators. The corrective effort a: Oconee 3 was complicated by the fact that the orifice plate provided for this purpose could not be fully closed. ~owever, the oscillations at other B&W plants have been kept to about 1.5% of full power by appropriat~ adjustment of the downcomer flow resistance. For these reasons, the power oscillations at B&W plants are not considered to-be a significant safety concern. PAGENO="0528" 524 EXCEF~?T FRaN ~i iOF~Ut~t ENTITLED "CCNVEY1N~ NEW INF *L~T1ON TO uc~::sn:c ~DS - D.~VIS-i~ESSE UNITS 2 & 3 AND MIDL!~ND UNITS 1 & 2', DATED J;.N~ARY 8, 1979, FRON J.S. CRESTELL TO J.F. STREETER * lnspect4on and Enforcement Report 50-346/78-06 doc~znented that pressurizer level had gone offscale for approximately five minutes during the November 29, 1977 loss of offsita power event. There are acne indications that o~cher BiW plants cay have prob- * lens maintaining pressurizer level indications during transients. In addition, under certain conditions such as loss of feedwater at 100% power with the reactor coolant p~~ps running the pros- *surizer may yoid completely. A special analysis has beenper- formed concerning this event. TMs analysis is attached as * Enclosure 1. Because of pressurizer level maintenance prob- lems the sizing of the pressurizer nay require further review. Also noted during the event was the fact that Tcold went off- scale (less than 520°F). In addition, it was noted that the makeup flow monitoring is limited to less than 160 gpm and * that nakeup.flow may be substantially greater than this value. This information should be e~mined in light of the require- ments of GDC 13. DISCUSSION *L_ND EVALUATION The event at Davis Besse which resulted inioss of pressurizer level indication has been reviewed by NF~ and the èonclusion ~es reached that no unrevieved safety question existed. The pressurizer, together with the reactor coolant nzkeu~ system, is designed to maintain the primary system pressure and water level within their operational limits only during normal operating conditions. Cooldown transients, such as loss of offsite power and loss of feed- water, sometimes result in primary pressure and volu~e changes that are beyond the ability of this system to control. The analyses of and experience with such transients show, however, that they can be sustained without ccrpronising the safety of the reactor. The principal concern caused by such transients is that they might cause voiding in the primary coolant system that would lead to loss of ability to ade~ quasely cool the reactor core. The safety evaluation of the loss of oifsite power transient shows that, though level ~indicaticn is lost, some water remains in the pressurize: and the pressu~e dces not decroase below about 1600 psi. In order for voiding to occur, the pressure nust decrease below the saturation pressure corresponding to the system ten~eratura. 1600 psi is the saturation pressure corresponding to ~3°F which is also the maximun allowable core outlet temperature. Voiding in *the primary system (excepting the pressurizer) is precluded im this case, since pressure does not decrease to saturation. PAGENO="0529" 525 The safety analysis for more severe cooldown transients, such as the loss of feedvater event, indicates that the water volum~ could decrease to less than the system volume exclusive of th~prmssurizer. During such an event, the emptying of the pressurizer would be follo~,cd by a pressure reduction below the saturation point and the formation of small voids throughout much of the primary' system. This would not result in the loss of core cooling because the voids would be dispersed over a large volume and forced flow would prevent them from coalescing sufficiently to prevent core cooling. The high pressure coolant injection pumps are started automatically when the~primary pressure decreases below 1600 psi. Therefore, any pressure reduction which is suffi~ lent to allow voiding will also result in water injection which will rapidly restore the primary water to nor~al levels. For these reasons, we believe that the inability of the pressurizer and r.ormal coolant makeup system to control some transients does not provide a basis for requiring more capacity in these systems. General-Design Criterion 13 of Appendix A to 10 CTR 50 reqt~iires ir.strumentation to monitor variables over their anticipated ranges for `ar.cicipated operational occurrences".. Such occurrences are specifically defined to include loss of all offeite power. The fact that T cold goes off scale at 520°F is. not considered to be a deviation from this requirement because this indicator is backed up by wide ran'ge tenperature indication that extends to a low limit of 50°F. Neither do we consider the makeup flow monitoring to deviate since the amount of makeup flow in excess of 160 gpm does not appear to be *a significant factor in the course of these occurrences. The loss of pressurizer water level indication could be considered to deviate from GDC 13, because this level indication provides the principal means of determining the prima~' coolant invanto~'. Nowever, provision of a level indication that would cover all anticipated occurrences may' not be practical. As discussed above,, the loss of feedwater event can lead to a momentary condition wheaein no meaningful level exists, because the entire primat3r system contains a steam water mixture. It should be noted that tha introduction to Appendix A (last paragraph) recognizes that fulfillment of some of the criteria may not always be appropriate. This introduction also states,that departures from the Criteria must be identified and justified. The `discussion of GDC 13 in the Davis Besse PSAR lists the water level instrumentation, but does not mention the possibility of loss of water ic-vol indication during transients. This apparent omission in the safety analysis will be subjected to further review. 48-721 0 - 79' - 34 PAGENO="0530" 526 EXCERPT TRO:l I: ORANDUN ENTITLED "CCNVEYIN~ NIl' I u~'.TION TO LIC1NSINO LOA~.DS - D.\VIS-ERSSE UNITS 2 & 3 !~iD MIDLAND u:;ITS 1 & 2", DATED JAN~JArtY 8, 1979, FRO:I J.S. CRESktLL TO J.F. STREETER 4. * A memo from B&W regarding control rod drive system trip breaker maintenance is attached as Enclosure 2. This memo should be evaluated in terms of shticdown martin maintenance and AT~S considerations particularly in light of large positive mocerator coefficients allowable with 36W facilities. DISCUSSION AND EVALUATION Our investigation of the above circuit breaker problems has revealed / that eight failures of reactor scram cir~uit breakers to trip during test have been reported from Babcock & Wilcox (E&W) type operating facilities since 1975. Ineach case, the faulty circuit breaker was. identified as a CE type AK-2 series (i.e., AR-2A-15, 24, or 50). The causes for failure were attributed to either binding within the linkage mechanism of the undervoltage trip device (liv) and trip shaft assembly or an our-of-adjustment condition in the same linkage mechanism. 3~W and GE determiaad that the binding and the out-of-adjustment conditions resulted from inadequate preventive maintenance programs at the affected operating facilities. In addition to the breaker problems experienced at the 36W facilities, three circuit breakers of the aforementioned GE oy~a failed in similar fashion at the Oyster Creek cperating facility on November 26, 30, and December 2, 1973. As in each case above, cleaning and relubricating of the UV/trip shaft assembly within the circuit breaker was required to correct the problem. It is significant to note that during the November 30, 1978 event, both redundant service water pump circuit breakers failed to trip as required during the loss of off-site power test. These failures in turn created ~ potential overload condition~on the emergency busses during the sequential bus loading byeach diesel generator. However, both diesel generators successfully picked up their required bus loads without experiencing aunit shutdo~n~ from an overload condition. With respect to the generic implications and safety significance of this issue, bcth BE.W and GE are in the process of issuing alert letters to their customers. These letters are scheduled for issuance by late ~larch and will describe the causes for failure and provide recormcndaticns to resolve the problem. Based on our study findings and on information obtained in discussions about the breaker problem with the knowledgeable people from E&W, GE and Region II, we plan to issue an IE Circular covering the matter. The thrust of the Circular will be directed toward the need for adequate preventive maintenance programs at all operating facilities. Specific recommendations fr: GE to resolve the above breaker problem will also be mentionee in the Circular. PAGENO="0531" 527 E~:CER?T r~o:~ MENoRA~;DuN E~TITLF.D "co:~VEyt!:~ i;~~ I FOi~ATION TO LIc~:sn:~ EOA?DS - DAVIS-BESSE UNITS 2 & 3 /~D ?I1DL4ND UNITS 1 & 2", DATED J~A?X 8, 1979, FRO:1 J.S. CflESWELL TO J.F. STREETER 5.' Tnspecticn and Enforcement Report 5O-3~6/7S-17, paragraph 6 refers to inspection findings regarding the capability of the incore. detector system to dttermine worst case thermal conditions. The.. reactor can be operated per the Technical Specifications with the center incore string out of service. If the peak power locations is in the center of the core (this has been the case at Davis- Besse), fact~rs are no.t applied to conservatively monitor. values such as F~ ~nd F delta H. DISCUS SION A~D EVALUATION ~e do not believe that there is a valid basis for requiring the center string of incore detectors to be always' operable in E&N reactors. The power distributions for various plant conditions, throughout tha fuel cycle, ~re calculated prior to the cperation of the reactor. The power distribution is verified at the beginning of operation,' and periodically thereafter, by comnarison with the available incore detectors. The power in fuel assenblies that lack detectors (including those with `failed detectors) is derived by using the known power distribution to determine the power ratios between such an assembly and nearby assemblies that have detectors. These ratios cam then be multiplied by' the power in the measured assemblies to derive the power level in any specific'unmoasured assembly. The central assembly is not fundamentally different than any other assembly in this respect. Although this assembly is the highest powered assembly in the Davis Besse reactor at the beginning of the fuel cycle, this is not the case at all reactors. Nor does the central assembly have the highest power, in the Davis Besse reactor, at the end of the first fuel cycle. Since there is some variation between the calculated power distributions and the actual ones, an appropriate margin is assumed for this variation in establishing the allowable power peaking factors. Fixed incore detectors must function in an extremely harsh environment and are subject to high failure rates. In order to ensure that an ade- quate number will survive the fuel cycle, many more detectors are installed than are necessary for the power distributions determinations. To require the central string to be always operable would likely result in unnecessary power restrictions. Neither the standard Technical Specifica:icns (STS) for B~W plants nor the STS for CE plants (which also have fixed incore detectors) require the central detectors to be operable. , . PAGENO="0532" 528 EXCERPT FROM M~~OP~NDUN ENTITLED "cC:~VE?INC INW I:;FoR~ATiON TO ~cE~:sINC - DAV1S-EESSE UMITS 2 & 3 AND MIDL~D UNITS 1 & 2", DATED JANuARY 8, 1979, FROM 3 . S. CRESVELL TO 3. F. S7REETER 6. Enclosure 3 describes an event that occurred at a 86W facility which resulted in a severe thermal transient and extrez~e dif- ficulty in controlling the plant. The aforcnenticned facilities should be r~vi~ued in light of this infornation for possible safety inpli~tions. DISCUSSION AND EVALUATION Following the cooldown transient at ~ancho Seco, NRR evaluated the event and concluded that no structural damage had occurred to the primary coolant system which would preclude future, operation of Rancho Seco. }owever, in their safety evaluations they concluded that positive steps should be taken to preclude similar transients and that the generic implications of this event should be reviewed. In addition, IE initiated a Transfer of Lead Responsibility~ Serial No. IE-P.OI 78-04, dated April 25, 1978, rec~_mending that: 1. NRR perform a generic review of the non-nuclear instrumentation power supplies for cther 06W units, if design changes to the non- nuclear instrumantation. (NNI) pcwer supplies are required at * Rancho Seco~ - 2. NRR evaluate the susceptibility of 36W plants to other initiating events or failures which could cause similar significant cooldown transients. This event is currently being evaluated by NRR. PAGENO="0533" 529 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 The Honorable Mike McCormack United States House of Representatives Washington, D. C. 20510 Dear Congressman McCormack: Enclosed are answers to questions you sent to Harold Denton in connection with his testimony at your subcommittee hearings on Nuclear Power Plant Safety. These answers to your questions are furnished in advance of completion of the work of the various NRC task forces and of the investigations in process within and outside of the NRC concerning the Three Mile Island accident. There will undoubtedly be a great deal more to say on these matters in the future. Sincerel ~ Lee V. Gossick Executive Director for Operations Enclosure: Response to Questions Question 1. Is there need for a "swat team" composed of people from industry, the utilities, the NRC, etc.? ANSWER As a result of our experience at Three Mile Island, it is clear that there is need for an organized, preplanned response ~ accidents. The composition, logistics, authority and responsibilit'es of a response team are subjects of studies now taking place within NRC. We expect that preliminary conclusions from these studies will be available within a few months. PAGENO="0534" 530 QUESTION 2 Is there any advantage in standardizing the design of nuclear power plants? ANSWER The Comission has continued to strongly encourage the use of standardization in the design of nuclear power reactors. An important advantage is the enh~1cement of public health and safety due to the concentratijn of staff and industry efforts on the in-depth review of standard designs. The experience and knowledge gained as a result of the 1141 incident pointed out clearly the widely varying plant designs, differing operating parameters and procedures, and different safety margins to postulated transients and plant conditions, even for plants involving a single NSSS vendor. The combinations of designs, procedures, set-points, response to transients, etc., for all plants, PWR and BWR, is staggering. As a result of this siutation, a number of observations may be made: (a) the staff has detailed knowledge of representative plant systems and predicted responses to transients, but often lacks ready in-depth knowledge and understanding of any specific plant design and performance; (b) generic analysis and predicted plant responses have only limited value - generally, plant-by-plant and case-by-case studies and analyses are required because of specific plant differences; (c) plant simulators us'ed for operator training cannot accurately simulate plant responses and procedures associated with all plants of that NSSS design - and thus, operator training must be~augmented through unique plant specific training; (d) when a problem having public health and safety implications is experienced, there is an inherent time delay as staff and technical support personnel get up to speed, with regard to a particular plant design and anticipated operating characteristics, and the possible impact on other plants from the same problem; (e) irruiediate and long-term corrective action to assure adequate margins for all plants from serious problems are not easily or rapidly determined - generally, a plant-specific analysis must be conducted and a unique plan of action developed for each plant; (f) because of the nature of the competitive nuclear industry and under the present regulatory process, this situation is not likely to be different in the future. As the TMI and the Brown's Ferry accidents make clear, the NRC must be able to move quickly. and decisively for situations having public health and safety implications; PAGENO="0535" 531 (g) because of the NRC role and responsibilities and public and Congressional perceptions of our role in cases involving serious reactor operational problems, one aspect of on-going studies fnclude the procedural and prganization changes which offer potential for the staff to react more quickly for serious operational events; (h) ~any of the initial difficulties faced in coping with the TMI Incident would have been reduced had TMI been one of a family of standard plants under a standardization policy implemented with a high degree of discipline; standardization provides a policy and framework for the staff and the industry to know, understand, and model the response of plant systems, and thus, to quickly and effectively analyze differing situations. When viewed in the context of prevention of and recovery from accidents, such as experienced at NI and Brown's Ferry, disciplined standardization provides a number of distinct advantages,- such as: (1) A uniform system design results in a much greater understanding of the specific design and associated plant response charac- teristics. This Is true for utilities, NSSS vendors, A-Es, ACRS, ASLB's, and the public and staff. (2) Definition and examination of interfaces between NSSS, BOP and site aids in gaining an understanding of system interactions. (3) More complete and effective simulation and R&D are possible when results are applicable to a class of plants whose population is relatively significant. (4) Uniform design, procedures, and setpoints from plant to plant permit efficient feedback of design solutions to minimize recurrence of operational difficulties. (5) Generic reliability studies, FMEA or WASH-l400 analyses can be effectively conducted since applicability is to a class of plants whose population is relatively significant. (6) Operator and maintenance training can be conducted using uniform procedures and accurate simulation. Thus, when investigating and assessing the lessons learned and the corrective actions flowing from the NI accident, the potential * for proper and disciplined application of standardization policies should be recognized for minimizing similar type events in the future and maximizing the ability to react quickly, effectively, and decisively should unexpected serious events occur, having real potential for public health and safety impacts. PAGENO="0536" 532 Question 3. Should there be a standard design for control rooms and for the layout of control room instrumentation and control panels? ANSWER We do not recorrrnend that there be a standard design for control rooms and for the layout of control roc~ instrumentation and control panels. However, to assure that control room operators get clear information on plant status, we do reconinend that additional design criteria and requirements be established for the design and qualification of control rooms, control room instrumentation and control panels. The Lessons Learned Task Force in the Office of Nuclear Reactor Regulation expects to define and recom- mend a program for establishing such design criteria and requirements within the next few months. The need for additional design requirements stems not only from the lessons learned at ThI-2, but also results from control room studies conducted prior to the accident. The results of these studies as well as the lessons learned from TMI-2 will be evaluated prior to establishing control room design requirements. Additionally, the functional capabilities of the state-of-the-art digital computer based displays will be assessed ir. establishing requirements regarding information which should be conveyed in an unambiguous way to the operator. PAGENO="0537" 533 Question 4. Provide recommendations for using computers or microprocessors to enhance the power plant operator's ability to recognize abnormalities., ANSWER Prior to formulating recommendations for computer-based diagnostic aids, we will be assessing the design and qualification of several prototype diagnostic aids currently under development. We plan to define a program for the evaluation of these systems, the establishment of design criteria and reconinendations for computer systems within the next few months. The advantages of a computer based diagnostic system are that it can monitor and evaluate the status of many components and systems much faster than the human operator. Potential disadvantages of such systems are that the plant operator can be mislead if error exist in the stored programs within the computer. Thus, the computer software must be highly reliable if safety benefits are to be achieved. Our program to evaluate the use of computers for status monitoring and diagnostics will include the assessment of three on-going projects. In response to Regulatory Guide 1.47, "Bypassed and Inoperable Status Indication For Nuclear Power PLant Safety Systems" the Tennessee Valley Authority (TVA) has developed a computer based monitoring system. This system uses television monitor-type displays to provide flow diagrams to show the status of main line safety system components. The use of computer technology makes it possible to provide a great deal of data on concise displays to the plant operator. The operator is warned of an abnormal condition by safety system status lights, abnormal indications on the TV monitor diagrams, and by alarm messages on the computer print- out. This design is being modified to also monitor those safety systems that are required to operate i~miediately after an accident. Another type of system that we will study is a computer based disturbance analysis system developed by EPRIand Combustion Engineering, Inc. A prototype of this system has been developed and will be evaluated with the TMI-2 accident scenario later this year. The Nuclear Regulatory Commission has been invited to observe these tests. We plan to observe these tests and to utilize our observations in formulating recomendations for computer based diagnostic systems. The ORNL Instrument and Controls group, currently performing noise diagnos- tic research for NRC, has developed a minicomputer based on-line system for monitoring signals from nuclear plants to provide advanced warning of anomalous conditions. The system is currently being tested at the High Flux Isotope Reactor at ORNL. Some 14 signal channels at HFIR, including power range neutron channels, pressure, loop flows and loop inlet and outlet temperature are being monitored and recorded. We will also study and evaluate this system prior to formulating our reconinendations for Computer based diagnostic systems. Question 5. Should the control room operators be employed by the utility or should they be employed by some other agency? ANSWER Although this suggestion will undoubtedly receive continued attention by NRC and others, we currently believe the control room operators should continue to be employed by the utilities. We have no clear reason ~o conclude that health and safety of the public would be better ser'ad if the operators were employed by some agency of government. Itis highly unlikely that a utility would accept the delegation of responsibility for operation of a billion dollar investment to individuals outside of their control. There is no precedent for such an action and we see no reason to establish one in the case of nuclear power. PAGENO="0538" 534 QUESTION 6 What is the radiation background level of the Susquehanna River water? Provide data for average and maximum readings at several different distances both upstream and downstream from the Three Mile Island power plant. ANSWER The following two paragraphs `Care taken from the licensee's Environmental Report, operating license state (1975), for Unit 2. They describe the radia- tion background levels in the surface water prior to the operation of TMI-2. "Gross beta activities in Susquehanna River water for the preoperational period averaged 16 pCi/l (Met-Ed), 4.7 pCi/l (Teledyne Isotopes [Tele- dyne]), and 6.7 pCi/l DER. For the same time period, EPA measured3.l pCi/l (Average of Conowingo samples). Gamma spectroscopy by Teledyne of water samples showed large variations in the naturally occurring L~OK (from <12 to 500 pCi/l). These water analyses indicated low levels (<9 pCi/l) of nuclear weapons debris such as 60Co, 58Co, 1311, and 137Cs. "Tritium levels in Susquehanna River water are well documented, by the U.S. Department of the Interior Tritium Laboratory (Wyerman, 1970), by EPA (Radiation Health Data 1970-74) and others (Porter, 1973). These tritium levels (primarily due to weapons fallout) peaked in 1965, dropped to ~7OO pCi/l In 1968 and have continued to drop to the present 1974 level of ~300 pCi/l. The Met-Ed January-February 1974 tritium data is too high by an order of magnitude as compared to EPA, Teledyne, Radia- tion Management Corporation (RMC) and DER." The data collected subsequent to initiation of criticality do not indicate any significant changes in surface water radioactivity from gamma emitting nuclides. For example, during 1977 surface water was sampled at six locations, two upstream and four downstream of the plant, for gamma emitting isotopes; specifically, K-40, Zr/Nb-95, and Ra-226. None of the 72 samples that were analyzed were equal to or above the minimum detectable level for those iso- topes indicating that the concentrations at all sampling locations were less than 7 pCi/l for K-40, 0.5 pCi/l for Zr/Nb-95, and 0.9 pCi/l for Ra-226. Some increases in tritium downstream of the plant for the 1977 year were detected but are within fluctuations observed in the past. The following table lists the data for 1977: Concentrations of H-3 in Surface Water - l977-pCi/l Jan-Mar Apr-Jun Jul-Sep Oct-Dec Average 2.3 mi. upstream <200 196 160 100 164 8.7 mi. upstream <200 <200 140 230 193 Upstream average <200 196 150 165 178 0.5 mi. downstream <200 230 600 430 365 1.5 mi. downstream 270 268 720 350 402 4.1 mi. downstream <200 188 100 130 155 15 mi. downstream <200 222 170 190 196 Downstream average 218 227 398 275 ~28O PAGENO="0539" 535 The figure depicts the average H-3 concentration for the last few years. The dashed line depicts the average of the downstream locations and the solid line depicts the average of the upstream locations. While the above data suggest that the downstream values for 1977 are statistically higher than the upstream ones, t~e figure indicates that they are within the range of background fluctua- tion observed over the previous few years. Special samples were taken for Sr-89 and Sr-90 at the following three water treatment facilities: (1) Steelton Municipal Water Works, 8.7 ml. upstream; (2) Brunner Island Water Treatment Facility, 4.1 mi. downstream; and (3) Columbia Water Treatment Plant, 15 mi. downstream. All analyses resulted in Sr-90 concentrations below the minimum level of detection of 0.2-0.6 pCi/l, whereas the Sr-89 concentrations were all below 1.0 pCi/l. The following table gives the quarterly results for each location. Concentrations of Sr-89 and Sr-90 in Untreated Drinking Water pCi/i Sr-89 Sr-90 Steelton, 8.7 mi. upstream <0.7 <0.5 <1.1 <0.4 <3.0 0.6 + 0.5 <1.2 0.4+0.2 Brunner, 4.1 ml. downstream <0.7 <0.5 <1.3 <0.4 <1.3 <0.4 1.1 ±1.0 <0.2 Columbia, 15 ml. downstream <0.8 <0.6 <1.3 0.3+0.3 <2.8 0.29 4- 0.003 <1.7 0.3*0.2 Comparison of the upstream concentrations to the downstream concentrations Indicate that the downstream concentrations are not significantly greater than those upstream. PAGENO="0540" 10 7100*1 1 AVEMEE T*ITIIII COOCINTOATI001 IN 001guE0009A RIVER IN ThE RICINITO or mios 1!174- 1977 4- CHINESE NUCLEAR -~- DETONATION 1974 1971 1974 1977 ~-1. rP 0I TO CD eF ~7R o CAD CD ~1 0 C CD 10 1+ 0 *------` INDICATOR * `CONTROL 1000 900 101-9 INITIAL CRITICALITY PAGENO="0541" 537 QUESTION 7 We understand that there is a proposal to deposit or pump back water that had been irradiated during the Three Mile Island accident into the Susquehanna. What will be the radiation level of this waste water? ANSWER On May 25, 1979 the Nuclear Regulatory Commission issued an orde which stated that, except for t~ discharge of waste water decontaminated by existing EPICOR I system I.') and the discharge of industrial waste water as consistent with the facility operating license, there would be no discharge of radioactively contaminated waste water from Three Mile Island (TMI) Unit 2 until the completion of an environmental assessment by the NRC staff of pro- posals to decontaminate and discharge this water. This waste water, generated as a result of the March 28 accident at TMI Unit 2, consists of intermediate radioactivity level waste currently present in the TMI Unit 2 auxiliary building tanks and high radioactivity level waste in the THI Unit 2 containment building and primary system. There are cur- rently proposals to decontaminate this intermediate level waste water in a newly installed system, EPICOR II, at TMI Unit 2 with potential eventual discharge of the treated waste to the Susquehanna River. However, as part of the May 25, 1979 order, the Commission directed that there would be no decontamination or discharge of this waste prior to the completion of an environmental assessment by the NRC staff of the proposed actions. This assessment is divided into several portions. The first portion of the assessment will deal with the proposed decontamination of the intermediate level waste water in the auxiliary building using the EPICOR-Il system at TMI. The assessment will include discussions of potential risks to the public health and safety, including occupational exposures and the risk of accidental releases, discussions of principal radionuclides to be treated by the EPICOR-Il system and a discussion of alternatives to the EPICOR-Il system. The second portion of the assessment will deal with any proposed discharges from the EPICOR-Il system to the Susquehanna River. This portion will include a discussion of principal radionuclides which have been treated and which would be released and a discussion of alternatives to discharge into the Susquehanna River. The decontamination and disposal of the high- level waste water will be the subject of a subsequent assessment. Therefore, with the exceptions noted above, there is at the present time, no discharge to the~ Susquehanna River of radioactively contaminated water generated as a result of the TMI Unit 2 accident. Furthermore, there will not be any discharge unless and until the completion of the environmental assessment noted above demonstrates discharges are acceptable. Discharges will only be found to be acceptable if the release of radionuclides in the discharge are within NRC effluent criteria. (1) Primarily pre-accident waste water from Unit 1 which has been partially contaminated by water from Unit 2, with an activity level of less than 1 microcurje per ml prior to treatment and with an activity level approxi- mately 10' microcuries per ml in the discharge canal after treatment. (2) Waste water slightly contaminated (approximately lO~ microcuries per ml) due to leakage from secondary plant service support systems. The dis- charge of this industrial waste water is necessary to maintain TMI Unit 2 in a safe condition. PAGENO="0542" 538 QUESTION 8 Provide a list of the ground locations at which radiation monitoring equipment was installed and the locations at which measurements were made during the Three Mile Island accident. Provide the following reference data: (a) The source of your information. (b) The Agency responsible for the equipment. (c' The time and date at which measurements were made. (d) The "end use of the data. ANSWER Attached is a table listing the sampling locations and types of samples required by the TMI-2 operating license technical specifications. This program was in place at the start of the accident (`~ 4:00 a.m., March 28, 1979) and provided data for the duration of the accident. Metropolitan Edison or one of its subcontractors was responsible for data collection, analyses, and reporting. The measurements were used to determine the extent of any contamination, the persistance of the contamination, and the impact on the public from the releases. - Also attached is a copy of the report, `Population Dose and Health Impact ~ of the Accident at the Three Mile Island Nuclear Station." On pages l7-29, data regarding exposure of thermoluminescent dosimeters to the released noble gases are listed. These data were used to estimate population dose and health impacts as described in the text of the report. The Environmental Protection Agency was assigned the responsibility to collect and analyze the environmental data in the vicinity of the TMI site. There is most likely more data in the EPA file than in the NRC file. PAGENO="0543" 539 Attachment 1 to Answer to Question 8 Sampling Locations for Radiological Environmental Monitoring Program In Place At Time of TMI-2 Accident Location c2!!ip!ss Sector N N E SSE NW N SE E NNE N NNE E SSE WSW SE NW SSE NW SE Distance From Plant in Miles 0.4 2.6 0.4 2.3 15. 1.0 1.6 1.0 11. 2.6 0.7 0.4 2~3 1.6 15. 15. 2.8 8.7 15. Iyp~e of Sample Air Samples Air Samples Air Samples Air Samples Air Samples Milk Samples Milk Samples Milk Samples Milk Samples TLD (Radiation Dosimeters) TLD (Radiation Dosimeters) TLD (Radiation Dosimeters) TLD (Radiation Dosimeters) TLD (Radiation Dosimeters) TLD (Radiation Dosimeters) TLD (Radiation Dosimeters) Susquehanna River Water Susquehanna River Water Susquehanna River Water Sampling locations and types are taken from the Three Mile Island Unit 2 Environmental Technical Specifications. PAGENO="0544" 540 __________ Provide a complete list of the radiation measurements made by helicopter survey. The list should include the following: (a) The altitude, position, speed, time and date at which measurements were made. ~b) Wind velocity, air pressure and relative humidity at the time of each measurement. (c) The agency which made the measurements. (d) The final use of the measurements. ANSWER - The tables attached list the helicopter measurements made offsite and onsite during March 30, 1979, through April 12, 1979. The tables give time, date, location, altitude, and reading for each measurement. The following tables list meteorological measurements of station pressure, wind direction, wind speed, temperature, and dew point temperature made at Harrisburg weather station during the period of the helicopter flights. From the latter two measurements the percent relative humidity can be calculated. The set of maps following this table indicate how this information was used to predict the movement and location of the plume. PAGENO="0545" 541 Attachment 2 to Answer to Question 8 NUREG-0558 POPULATION DOSE AND HEALTH IMPACT OF THE ACCIDENT AT THE THREE MILE ISLAND NUCLEAR STATION Preliminary Estimates Prepared by the Ad Hoc Interagency Dose Assessment Group U. S. Nuclear Regulatory Commission 48-721 0 - 79 - 35 PAGENO="0546" 542 Table 3~1. METROPOLITAN EDISON TLD STATION LOCATIONS STATION LOCATION DESCRIPTION* CODE 1S2** 0.4 miles N of site at N Weather Statfón:~. 1C1 2.6 miles N of site at Middletown Substation 2S2 0.7 miles NNE of site on light pole in middle of North Bridge 4S2** 0.3 miles ENE of site on top of dike, East Fence 4A1. 0.5 miles ENE of site on Laurel Rd., Met. Ed. pole #668-OL 4G1~ 10 miles ENE of site at Lawn - Met. Ed. Pole #J1813 5S2'~ 0.2 miles E of site on top of dike, East Fence 5A1*~~ 0.4 miles E of site on north side of Observation Center Building 7F1~ 9 miles SE of site at Drager Farm off Engle's Tollgate Road 7G1 15 miles SE of site at Columbia Water Treatment Plant 8C1** 2.3 miles SSE of site 9S2 0.4 miles S of site at South Beach of Three Mile Island 901 13 miles S of site in Met. Ed. York Load Dispatch Station ~0B1 1.1 miles SSW ofsite on south beach of Shelley Island US1~ 0.1 miles SW of site on dike west of Mechanical Draft Towers 1281 1.6 miles WSWof site adjacent to:Flshing Creek 1453. 0.4 miles WNW of site at Shelley Island picnic area 15G1~ 15 miles NW of site at West Fairview Substation 16S1~ 0.2 miles MNW of site at gate in fence on west side of Three Mile Island 16A1 0.4 miles NNW of site on Kohr Island * All distances measured from a point midway between the Reactor Buildings of Units One and Two. All 20 stations had Teledyne-Isotopes Environmental TLD's. ** Stations with RNC TLD' s. Data obtained with RMC TLD' s at these locations are designated by adding the letter "Q" as a suffl~x to the station code. PAGENO="0547" Location of Metropolitan Edison Dosimetry Sites Within a One-Mile Radius of Three Mile Island Nuclear Station for Period March 28 through April 6, 1979. PAGENO="0548" /~ I I WNW w %AISW Ei~ure 3-2. Location of Metropolitan Edison Dosimetry Sites Within a Five-Mile Radius for the Period March 28 through April 6, 1979. V CJ~ S PAGENO="0549" 0* IJORTU WSW \ \r" Figure 3-3. Location of Metropolitan Edison Dosimetry Sites Outside of a Five-Mile Radius for the period March 28 through April 6, ~g79. 5W'\/~. C;' a C;' by S PAGENO="0550" 0) a) a) a) a) C C) 0) 0) N N N N- 0 N N N 4) in U) U) U) >, in if) >, 0- U) 10 S-.. 4) ~. ~- 4) 0 ~ `0 40 *v- 0. * - 0 0- V 40 C %- V a-a v o-a i CIU V ~ V ~C> `V ~ *.-C V S-I 40 40 CW LU ~ 40 40 40(l) 40400 40 40 <10 40 1- V U~ cU) 00 `OVv-IV 40 04-) v-v-0~ V 40 V~ 0. V C 0 ~ 0 40 11) V 9- 4) 40 ~ -D 40 0 C V ~ 40 ~ Si) (0 ~ V 0 > >, 0)1. 0) 0)V 5-4 40~40 00. 4-).C (0 00) .C+'vlIUD)U 4040 `- i-s 40 OI000L.0-S-WW1-S-40 ..~ Q %s 4' w 400-1 0.~-.- U 40 4) sO S-.' ~ -~ .C > `-` 0 V 4) -v- 4.) 4- .-~4- 1. 4- ~ .04- i ~ 0-) 4.) CU)0 (0 v- ZCv--Wv-->~ v-V4)4)I0 0)v-CWC>C0 OVWW.040v-.0.0 In .-W'-- 0v-- U4.Cv- 0) ~40 W~~~v--lU>1U4-4U 0~W.0.0U))0.4fltflv- LU O.-0 4)40C .C$-u)0 -0-.-IO0~0.0E00 O~-OEU)0U)E4flv-C.~1fl.v-v-0 0 ODO 9-400 4-)WCO 0-v-~P.lO.COC40EE.~0WD)V-C40C4-'V0V404-v-4- .C(-1.0 U) C D C v- 40.4- 1. >, ~ -C 0 0) ~ *v- 0. D).C v- C 4-C C -v- 0 0) 40 Q U) 4-'- .C C ~ ~ 1. ~ 0) 0- 1.. .C Z 0.4-U `-DC 04000 C~4WWv-C-v-U40C1U400U0E040v-'v-400U0CWW(0Wv-'0(0U 0 ~ `-4 I- 9 `5 ~ ~ ~ ~ ~ ~ ~ ~ ~ z LU ~ZZWWZ IflWWWIflL1)U) U)V)~ In ZZZZZZZZZ~ZZZZLULUWWW~~ 40 000000000000000000000000000 00 000000000000000000 (0000 a) v-I 0(00(') U) 0) N ~ N rIO ~ ~ ON LOU) i-I C'.) 00) mOO v-I ~ 0 C') U) U) C'.) N m 00'.) 0'.) U) NO (00'.) (0 U) U) U) ~ U) 0'.) r4 v-I ~ ~ U) 0)0) a) v-I U) ~ C') U) (OW to N NOD (0)00 C.) C.) if) ~ to N N (DO a) v-I Ov-I ~ U) mm mm v-I v-I v-I v-I v-I v-I v-I v-I v-I v-I v-Sv-I 0'.) (`4 C'.) C.) (`4 C'.) C'.) C'..) C'.) C'.) U) c-j mm mm U) LU 40 0 40 40 40 40 40 40 10 10 10 10 40 40 10 40 40 40 E 40 40 10 40 10 40 40 E 10 10 10 10 E E 40 40 40 4040 10 40 E 10 E 40 10 40 40 `U) U) ~ (00 U) 0 rI ~ m to 0000 v-I to N U) ~ 0) ON (0000 ~ m C') U) U) 00 C'..) (0 (1) ~ m ~ U) 0~ 0) ~ (0 ~ C) (0 U) N. U) C'..) C'-.) mm ~ U) N a) v-,~ tO 0 m N ~ ~ N v-I v-I C') mm U) 0) C.) C') COO v-I ~- v-I C-I in N C'-) N U) a) C') C') U) I- 40 OW's- -IC'JU)m~ 10~U)v-4C'JU) so -Ic.)m~d- 0 v-4U)C'J~tfl.QV v-4 v-I v-I i-I i-IC") U) ,~ U) I 5 $ 4 v-I U) m ~ C'4I 4 55 5 5 v-I ,-I C'.) C') 4' 4 4 i 4 C') U) ,-4 U) ~ if)) 4 4 5 4 v-I v-I I- SI S S\4 III ILIJLUUJUJLUI I SI )LUUJLULULULUI III ~ 1411 ~ ~S S In Z Z Z Z Z ~ ~ Z Z ~ Z Z Z LU Li.) LU W LU (1) U) U) U) U) U) (F) (F) (F) U) U) 4/) (F) (1)1/) ~ PAGENO="0551" `I 01 a wsw Figure S PAGENO="0552" ~1~ 0* PJORTR w C,' a S PAGENO="0553" 549 Table 3-3. METROPOLITAN EDISON TLD DATA RADIATION EXPOSURES FOR PERIODS ENDING 04/06/79 Station~1~ Exposure Period 12/27/78 03/29/79 03/31/79 04/03/79 -03/29/79 -03/31/79 -04/03/79 -04/06/79 mR ± std. deviation per exposure period (includes background) 1C1 20.1±1.3 3.2±0.7 1.4±0.4 0.5±0.1 7F]. 24.1±1.8 1.1±0.1 0.5±0.5 0.9±0.1 7F1Q 23.3±0.5 0.8±0.2 1.5±0.2 0.9±0.0 15G1. 18.4±2.0 1.9±0.3 -0.7±0.1 0.5±0.0 15G1Q 17.6±0.6 1.1±0.1 0.8*0.1 0.7±0.2 1281 16.3±0.9 9.4±1.6 0.2±0.3 1.2±0.2 9G1 21.3±1.4 1.4±0.1,3~ 0.1±0.2 0.6±0.1 5A1 18.6±1.0 8.3±2.8~ ` 7.7±2.5 3.0±1.2 5A1Q 16.1±1.3 5.4±1.0 5.2±0.9 2.0±0.6 4A1 20.2±1.3 34.3±8.6 41.4±8.5 2.2±0.4 2S2 43.7±4.4 32.5±5.6 3.4±0.6 0.9±0.2 1S2 97.9±1.9 20.0±3.4 -0.1±0.1 0.6±0.1 1S2Q 95.7±5.0 15.3±3.2 1.3±0.1 0.8±0.1 16S1 1044.2±128.2 83.7*17.5 7.0±0.7 1.5*0.3 1651Q 929.4±90.5 61.6±12.2 5.6±1.0 1.3±0.5 11S1 216.0±24.1 107.1±12.7 45.0±15.2 21.8±7.3 11S1Q 168.5±15.6 75.7±12.7 35.2±3.3 14.2±1.1 9S2 25.0±3.0 25.3±2.6 4.6*1.0 1.8±0.3 4S2 35.5±4.3 124.3±32.7 28.0±9.1 7.9±2.3 4S2Q 31.4±1.6 71.4±13.0 21.3±6.6 4.7±0.4 552 30.5*1.3 49.3±U.2 26.7±5.3 15.5±5.0 5S2Q 27.7±4.0 36.6±0.8 21.2±3.1 11.5±2.4 4G1 17.2±2.1 1.2±0.2 0.6±0.2 0.6±0.1 4G1Q 17.7±0.1 0.6±0.1 1.4±0.1 0.1±0.1 8C1 13.0±0.3 10. 7±1.6 1. 7±1.1 1. 3±0.4 8C1Q 12.6*0.6 8.4±1.0 2.6±0.2 1.1±0.1 7G1 25.8±0.6 , ~ 1.0±0.1 -0.5±0.0 0.8±0.0 15A1 907.7±49.4)~ 45.1±2.1 1.7±1.1 0.9±0.1 453.4±12.2) ~ 14S1 13L2±20.~~~ 48.8±8.6 9.5±4.3 1.5±0.4 148.3±9.7~ ~ 1081 40.6±3.5~2~ 14.9±0.9 0.4±0.3 1.1±0.2 36.6*1.3 / (1) Suffix "Q' indicates RMC data; otherwise data are from Teledyne Isotopes. (2) Results for 6-month exposure period 09/27/78-03/29/79. (3) AdditIonal values for 5A1: 7.8±1.5, 7.4±1.2. PAGENO="0554" Tab1e 3-4. NRC lID DATA-RADIATION EXPOSURES FOR PERIODS FROM 03/31/79 to 04/07/79 (inc'udes background) 3/31-4/1 4/1-4/2 mR mR 4/2-4/3 413-4/4 4/4-4/5 4/5-4/6 4/6-4/7 mR mR inK inR mR Station N-i N-2 N-3 1.0 ± (wet) 1.2 ± .1 .3 .3 .3 .3 .37 ± .08 .45 ± .05 .43 ± .05 .32 ± .08 .40 ± .06 .32 ± .08 .28 ± .08 .33 ± .08 .34 ± .09 .32 ± .04 .48 ± .15 .47 ± .05 .43 ± .40 ± .50 ± .05 .05 .11 N-4 1.0 ± .1 .3 .48 ± .08 .33 ± .05 .37 ± .05 .42 ± .02 .48± .10 N-S (wet) .3 .58 ± .08 .37 ± .05 .35 ± .05 .48 ± .10 .52 ,± .08 NE-i 7.0± 2.1 .2 .45 ± .08 .32± .04. .45 ± .05 .38. ± .04 .45 * ~O8 NE-2 (wet) .3 .48 ± .09 .37 ± .10 .33 ± .08 .47 ± .10 .47 ± ~i2 NE-3 1.6 ± .5 .3 .42 ± .09 .38 ± .08 .37 ± .08 .46 ± .05 .45 ± .10 NE-4 2.ix.~ .3 .37±.05 .38±.04 .33±.05 .40±.09 .43±..05 E-1 25.0±8.1 .4 .53±.1 .32±.04 2.6±.60 .50±.09 .48±.08 E-5(E-la) 8.4 ± 4.6 .3 .73 ± .2 .38 ± .08 1.7 ± .45 1.2 ± .27 .32 ± .04 E2 .E-3 E-4 4.3 ± 2.1 ± 2.5 ± .5 .4 .4 .3 .4 .3 55 ± .7 .42 ± .1 .4 ± .1 .55 ± .10 .40 ± .06 .35 ± .14 .38 1 .08 .50 1 .06 .43± .19 .45 1 .10 .48 1 .08 .42 t .04 .35.± .32 1 .22 ± .08 .08 .04 SE-i 10.1 ± 2.0 .3 9.1 ± 1.6 .43 ± .10 .92 1 .19 ~40 ± .00 .55 1 .06 SE-2 3.5 ± .5 .3 4.4 ± .7 .87 ± .16 .38 ± .08 .35 1 .05 .25 ± .05 PAGENO="0555" Table 3-4. (Continued) 3/31-4/1 4/1-4/2 4/2-4/3 4/3-4/4 4/4-4/5 4/5-4/6 4/6-4/7 aR aR mR mR iaR mR mR Station . SE-3 23±6 3 28±7 57±10 45±05 40±06 25± 05 SE-4 3.0±.4 .3 2.1±.4 .30±.06 .53±.08 .47±.08, .25±.05 SE~5 2.5 ± .7 .3 .13 ± .1 .42 ± .04 .37 ± .08 .62 ± .31 .38 ± .13 S-I 16±1 4 22±4 11±05 37±05 35±05 40± 00 S-2 . 1.0 ± .2 .4 1.5 ± .2 .52 ± .08 .32 ± .10 .35 ± .05 .43 ± .08 S-3 * 1.2±.3 .4 * 1.5±.3 .47±.05 .40±.06 .40±.06* .55±.10 S-4 1.2±.2 .3 1.4±.2 .33±.05 .45±.10 .55±.18 .42±.08 SW-i .9±.i .8 1.2±.3 1.1±.18 ~37±.08 .37±.i0 .45±05 SW-2 9±2 5 13±3 37± 12 30±09 43±08 38±08 SW-3 1.1 ± .3 .4 .78 ± .1 .65 ± .10 .45 ± .10 .38 ± .08 .42 ± .02 SW-4 .9±.1 .5 .75±.1 .62±.10 .45±.14 .50±.14 .50±.09 W-i 3.0 ± 1.9 1.2 1.4 ± .24 1.7 ± .35 1.3 ± .29 .57 ± .10 .48 ± .08 W-2 .9 ± .1 .5 1. ± .1 .62 ± .04 .72 ± .04 .37 ± .08 .38 ± .08 W-3 1.1±.1 .5 .78±.2 1.i±.15 .42±.08 .38±.08 .47±.08 W-4 1.0±.2 .4 .67±.1 .42±.10 .45±.14 .45±.05 .57±.08 W-5 1.2 ± .2 .6 .4 ± .15 .65 ± .12 .60.± .13 .40 ± .06 .57 ± .14 PAGENO="0556" Table 3-4. (Continued) 3/31-4/1 4/1-4/2 4/2-4/3 4/3-4/4 4/4-4/5 mR mR mR mR aiR 4/5-4/6 4/6-4/7 aiR aiR Station NW-i NW-2 NW-3 NW-4 NW-S S-la SE-4a W-3a NE-3a N-ia N-lb N-ic N-id N-le N-if .9±.2 1.7 l.3±.25 *.30±.06 .38±.08 1.2 t .5 .4 .62 ± .08 .40 ± .15. .33 ± .05 l.4±.7 .8 .63±.12 .40±.25 .38±.04 5.5 ± 1.8 .3 .4 ± .06 .30 ± .06 .37 ± .08 4.6±2. .4 .42±.04 .42±.21 .32±.04 Not in Service untIl 4/5/79 ss ii U SI IS II II SI II II SI SI SI II II II U IS II IS U Ii is is is is is ii is u IS ii Si is ii is U ii U ii 55 55 iS .52 ± 12 .35 ± .05 .40 ± .09 .32 ± .04 .48 ± .08 .35 ± .05 .33 ± .05 .65 ± .39 .38 ± .08 .50 ± .19 .40 ± .06 .40 ± .09 .35 ± .05 .40 ± .06 .47 ± .15 .53 ± .04 .38 ± .08 .42 ± .05 .45 ± .10 .45±.05 ~ .43± .25 ± .05 .45 ± .10 .57 ± .08 .47 ± .04 P.50 ± .06 .45 i .08 .50 ± .06 .44 ± .08 ~37 ± .08 ii PAGENO="0557" * ~. > 8') Ui * * I-' < ~ 0 -8 0-4 ".` 8+01 118111$ N) ~ I-I 1-4 I-I -41-4 P-I I-I 1-4 I-I I-I I-I I-i P-I - I-I -`. I-I P-I P-I (-4 P-I Cf -8 Ui Q 03 000000000000000 (`I 00000 -i P-I (00$ O~- (0 IllIllIll I $11 I I ØI 1111$ 0 0 m i-' p-' ~ ~ ui -~ ~-` ~-` ~ (0(0 ui ~ r~ i-' ~ -~ i-' 10-01.1 z -~ ~ flN)Oai>>4UiC)UiUiUUI 0 310)0-n 0$ 01 ID ~0. $-4(0~0)>nnN)N)N)N)N) `i 3~I0)3.4$.3$.J r ~ ~1 0' 3-33.3$~l 3-13-43-1 3-3 0 0 -` -`0 011 ** (`3 - ID `< lAO. 01* 0 01 -`(A A (*3 10$ CID 0$ -`. 0$-~90 1+ 0 1+ -`. ~ ~ (*3 3-' N) .~ ~ 0) N) Ui ~ (4 Ui Ui 0) 0 Ui 0 0 -` - o 0Cf 0 Ui - 40 (~) N) -s -`- (0 ~ $o I~I Ui (000101.01 1-' 00) Ui (~30)0 Os 0 - I-' 01(9 Ui I I Cf 0 Ui 0 `.4 `.4 (~3000 `.4 `.4 `.4000 `.4 `.4 (A CD (*300 `.4 N) Cf (*3 X 14 1+141+141+ 1000 m ~ 1-Ill ~ ~ 00000 I I Ui - 3 3 (*3 - `.4 `.1 ~ -4 ~ ID ~1 0 `-4 N) 0 N) 0 I-' N) N) 8-' N) I-' N) I-' N) I-' 1-' -.4 3-~ $-~ (~3 I-' CO `.1 ID r 0 ID -` PD * 0 0'..jO `.4 `.40 `-4 (*3008,4 (*40(9 (*3 0(40 `--8 UI 0 `0 10.01.01 C 0 ID ~-`< -1> 0 (0 C 3-- (0 0i0)I.0'-.~0)Ui0000Os'.4 -`0)10(01-' 0 0 ~ -I $0 ~ (ON) `-3- 0- - - 3-4 01 (4 P-I fl3 < (*3 0$ 0$ -010) 0$ Ui - - - Ui Ui 000(9 - `.4 0$ (31 - I I C 00 ~< Dl N) (90(~3(~3 `.4 -1-01 N) 0(9 `-40 `.18*3.4 0$ (*3 `.4(9(0 N) Cf N) 0 Z 3-4 * C 8+148+8+8+ 0)0(0 -`- Ui 00000000 00000 I I p+ m 0 0$ 0$ `.4 `.4 IA )(Z IA IA 0 N) 19(9(41-' I-' `.4 0$ 0$ (48*3(9 N) I-~ 0$ Ui 0$ Ui -018*3 00 0) `0 0$ (*30 `.4 `.4 `.18*3 (*10) `.1 `-3 `.4 -4 (400 0 08') Ui 0 . -Ip 0)0 -i CX 3 ~ 01 ~ 0 ~ ~ ~-< 0 Dl Ui 0$ 0$ Os Ui 0$ Ui 01 Ui Os Ui 0$ (31 Ui .01 Ui -1 Ui 0) Ui `.1 0 0 Cf > -- (A -` (0 0) DI -4 Ui $-`0 Ui 3.3 Ui 0(0.1 Ui Ui 3.~0I-' `.10 1-' Ui 0 `.48*3 I I 0 CA 3-~ 0) (4(448*3'.1(*3(9'.J0-.308*3'.4(4(4 (*3'.40..10 (*3CfN) 0. Ui-I I-' 1+ 1+1+ (13 1 N) 8+8+8+8+8+ 0000 DI CA 00000 I I I I ~ 0$ -1 `-i 0. CA ~ 0 (4N)3-3N)N)N)0$4N)N)3-40$p.~(*3$.4 0)N)N)3.40$ 0) (0 1.10 Dl 0 0 O'.t0(9'.400(4'.10'.10W(4(4 (4(40(4(4 3 w-( 0 -~ 0 ".JX 0. Cf 0 0)CA 0$ Cf 1-' 0. 0$ ~`. 0) Ui Di I-' 0 (0 Ui p.01 0111 ~(:015~~ 1 $-~ N) (*33.3 0)3-' 0) alaS Ui N) (aN) (~3 N) 01(010 Ui I I `0 (4 (*30 (*3(90 0'.JO(9(9O `.3 0(9 `.400 N) Cf (*3 CA B ~ ~*~*~~1fI+1+ `.100 Ui -S 0 I I ID - . `.- `.-l 0 01 I-' N) 3-1 N) (-3 N) l-* (93-' I-' N) N) N) I-' Ui I-' (MN) 0) 0) 0 0) -`40 (90'.4 0 `.4(40 `.400 00(9(40 Ui $0 Cf X 01 CA 0 -8 0. CA Dl -i 0$ 0$ Ui Ui Ui Ui (00)0)0) 0$ (7' Ui 0$ Ui 8~1 a~asaCo us 0. 0 - - `-4 Ui (00(9(7' Ui `.4Ui I-' 1-' (9 Ui `.40) N) `.4(4(4 Ui (~1(00 N) 0)00 $3'.40)(0N) 3-411 11-'8,3P-'(,38*31-'N) 00 N) Ui Ui 0)0001- ` - (~3(0 Ui (~3C0 0$ N) (~3 05 (00) as 0$ N) 00)0) N) N) (*3 0$ 0)0)0)0 N) N) 0$ N) 0$ PAGENO="0558" (1) "liDs stolen." (2) "No sample received." (3) Standard month = 30.4 days; originally reported as "mrem/standard month" assuming 1 mrem 1 mR. (4) Originally reported, erroneously, as value for Station "11S2". Table 36. METROPOLITAN EDISON COMPANY: RADIATION MANAGEMENT CORPORATION DOSIHETERS 110 RADIATION EXPOSuRE RATES 1978 Results In Units of mR/standard month 12-30~77 3~29~78 6~28~78 9~27~78 STATION to to to to AVERAGE NUMBER 3-29-78 6~28-78 9-28-78 12-27-78 ± 2a Control Locations TM-IDM-7F1Q 6.15±0.73 7.60±0.67 7.79±0.29 8. 04±0. 45 TM-IDM-4G1Q TM-IDM-15G1Q 4.94±0.52 4.70±0.40 5.95±0.38 5.61±0.38 5.68±0.46. 5.65~±O.45 6.37±0.77 6.47±0.50 Indicator locations TM-IDM-1S2Q 5.71±0.34 5.32±0.31 5.31±0.42 5.82±0.27 TM-IDM-4S2Q 4.91±0.44 5.69±0.24 5.55±0.51 5.05±0.43 TH-IDtl-5S2Q TM-IDM-11S1Q 4.32±0.21 5.35±0.45 5.15±0.56 9.72±0.88 5.47±O.32,A~ 6.75±O.52'~" 5.44±0.44 6.09±0.23 TM-IDM-16S1Q 3.93±0.27 12.09±1.31 6.68±0.75 6.02±0.61 TM-IDM-5A1Q 4.57±0.16 5.18±0.38 4.88±0.28 5.60±0.17 TM-IDM-8C1Q (1) 4.07±0.16 (2) 4.35±0.31 TM-IDM-4A1Q 4.56±0.60 (2) (2) (2) TM-IDM-8S1Q (2) (2) 4.04±0.21 *(2) Average ± 2o 4.91±1.33 6.64±4.96 5.78±2.11 5.93±1.96 ~J1 7.40±1.70 5.74±1.20 5.61±1.45 5.54±0.53 5.30±0.76 S. 1O±LO7 6.98±1.92 7.18±6.95 5.06±0. 88 4.21±0.40 4.56 4.04 PAGENO="0559" 555 B. OFFSITE POPULATION COLLECTIVE DOSE ESTIMATE 1. Introduction The collective dose for the population within 50 miles of the plant was calculated for the time period of March 28 to April 7, using two independent procedures. The first procedure utilized the empirical distribution of TLD dose data within each direction sector. Doses at distances between those locations with measured values were estimated by Interpolation. A power law method-was used to extrapolate when necessary. The second procedure utilized onsite meteorological data in-conjunction with the TLD readings to estimate the distribution of dose within a 50-mile-radius of the facility. The distribu- tionof dose and population were then used to obtain the-collective dose. The population data used for the dose estimates were the 1980 projected offsite population distribution as presented in the Final Safety Analysis Report These population distributions are contained In Tables 3-7 and 38 covering radii of 0-10 miles and 10-50 miles respectively. 2. - Dosimeter Background Correction The TLD exposure data reported In Tables 3-3 and 3-4 include a back- ground due to terrestrial radiation, cosmic radiation and other sources unrelated - to plant releases. In order to estimate the net exposure dye to plant emission, this- background must be subtracted from the total TLD exposure. The background `~~FInal Safety Analysis Report, Three Mile Island Nuclear Station, Unit 2, Vol-i, Chapter 2, FIgures 2.1-5 and 2.1-10. PAGENO="0560" Attachment 1 to Answer to Question 9 ON-SITE DATA Date: 3/30/79 Time (EST) Location Instrument Reading Remarks 0240-0250 Grid S - 900' Met. Edison Co. <0.1 mR/hr gamma Helicopter Grid SW - 800' " <0.1 mR/hr gamma Grid NW - 800' " <0.1 mR/hr gamma 0241 Grid NE - `900' " 0.4 mR/hr gamma Grid E - 900' II 3.0 mR/hr gamma c.11 Grid E - 800' " 1.5 mR/hr gamma * 0243 Grid NE - 900' " 4.0 mR/hr gamma 0257 Grid ENE - 700' " 20 mR/hr gamma ¼ mile from Unit 1 Cooling Tower Grid ENE - 700' " 15 mR/hr gamma between Cooling Tower and stack 0258 Grid ENE - 650' 50 mR/hr gamma between Cooling Tower and stack Grid~1E - 650' " 60 mR/hr gamma 0300-0330 reflight of above locations All readings less at 650' and 1400' than 1 mR/hr PAGENO="0561" ON-SITE DATA Date: 3/30/79 fl~JEST Location Instrument Readj~ Remarks 1000 Over Reactor Bldg. at 600' Met. Edison Helicopter 1200 mR/hr -&s--l--3 mR/lw- 1058 Over Island at 500' " 130 mR/hr 1100 East side of Island at 700' " 0.8 mR/hr c,1 North Bridge at 700' O.,~ mR/hr NW side of Island at 700' " 0.7 mR/hr Warehouse south of Auxiliary Bldg " 2 mR/hr at700' 1135 SW quadrant of plant at 600' " 80-90 mR/hr Ground level reading was 1-3 mR/hr 1700 Goldsboro " 6 mR/hr Offslte data; Ground level reading was 1 mR/hr PAGENO="0562" ON-SITE DATA Date: 3/30/79 Time (ESTI Location Instrument Reading Remarks 1223 North Parking Lot at 500' Helicopter 4.7 mR/hr Note: all helicopter readings are beta-gamma 1223 " " " at 150' " 5.7 mR/hr 1227 Over Screen House at 450' ` 11 mR/hr 1230 " " " at 500' " 10-15 mR/hr 1231 " " " at 450' ` 50 mR/hr 1232 ` " " at 450' " 30 mR/hr C.'l 1234 MCDT at 450' " 40-75 mR/hr 1236 Over Reactor Bldg. at 500' " 50-70 mR/hr 1309 Over MCDT at 600' ` * 5-10 mR/hr 1315 West of MCDT at 600' " 45-60 mR/hr 1309 Over BWST at 500' ` 55 mR/hr 1312 Over BWST to MCWT at 600' 20-75 mR/hr 131a Over pre-treatment at 650' 90 mR/ hr 1:319 " " " at 500' 30 mR/hr 1321 " " at 400' 20 mR/hr PAGENO="0563" Date: 3/30/ 79 Readj~ Remarks 1355 10-55 mR/hr 1358 10 mR/hr 1415 " 0.5 mR/hr 1415 " 100 mR/hr 1415 ` 150 mR/hr 1530 " 5-35 mR/hr 1705 " 18.0 mR/hr ON-SITE DATA Location Instrument Over Unit 1 Cooling Tower North Helicopter at 500' ½ mile north of site at 550' Over south cooling tower at 550' Over RB at 500' Over RB warehouse at 520' Westside of Island at 620' Over Screen House at 600' c)1 Data pt. illegible on report received at Hdqtrs; may be 180 mR/hr PAGENO="0564" ON-SITE DATA Date: 3°30-79 ARMS TIME L0C~]IOtj Reading (mR/hr) 2105 south Unit 2, MDCI, 550 ft. up. 10 2105 south Unit 2, turbine bldg, 550 ft up 10 2105 south reactor bldg., 550'ft up 15 2105 north of Unit 2 reactor bldg., 550 ft up 100 2105 Unit 1 screen house, 550 ft up 10 2105 Unit 2 screen house, 550 ft up 20 2105 north Unit 1 MDCT, 550 ft. up 130 2105 south Unit 1, MDCI, 550 ft. up 100 2105 between reactor bldg., 550 ft up 20 2105 north Unit 1, reactor bldg, 550 ft. up 10 2100 west Shelley Island, 700 ft. up 0.1 2120 Crawford Station 25 ~ .25 ~ 2130 Omstead Plaza 0.5 py ?30() Unit 2 turbine west, 500 ft. up <0.1 2300 Unit 2 MDCI, 500 ft. up 5 2300 west of warehouse, 500 ft. up 18 230(1 west of north tip of island, 500 ft. up 9 2320 Unit 2 reactor bldg., 550 ft up 35 2324 Unit 2 reactor bldg., 550 ft. up 65 PAGENO="0565" ON-SITE DATA 03-31-79 License Heliocopter Data (700 ft altitude) TIME LOCATION READING (MRIHR) 0225 Unit 2 Rx Bldg 3 Unit 2 Turbine 0.5 Unite 1 Rx Bldg 3 PAGENO="0566" ON-SITE DATA R137 Date: 3-31-79 Helicopter readings at 600 feet Time (~fl Location Reading (mR/hr) C)1 1200 West Side of. Island 01 - 0.25 A Cooling Tower 12 N Parking Lot 2 B Cooling Tower 10 1300 East Cooling Tower 4.0 - 5.0 PAGENO="0567" 563 0 (`4 V .CI. `-I EJ 0 (`4 (`4 0 0 44 0 < U) LI) C') LI) LI) LI) IC) C') LU,<. I ~ COO ~O C-S 0300 00 ~O 0000 (`5 U) 0 (`4-0 (`40 (`4 (`4 U) (`S C') C') V V C~4 V V 0) C - - <10 E 000 1-01 0 000 C') 0 NN- C-I 0 5- 41~1~) LUG) I- (0(01(0 - 0 0- 5- (/1 0 00 ~3 - C) 0) 010 U - LO 0 C 0 ,~3 ~3 O 0 ~O 0 030 C C C) 0 4-' LI 4.00)010) - 0) ~O 10 ~4 C.) LI U +3 0 = - 01 C'S 4)44 10 0 1- O 4-' 1- C01CCC C) O (0 C.) 0) ~) 01 0 0 0 0 0- - - - 0 0 .I (0 0 C) 43 ~ 0 0 - C C 0+343+3 ~ (0 - 0 ~ ~) 0 In 0 0 CC ~ .- (0 (001+3 0 00) (0W 5- W - 0 (`4 1003> >> (0 5- -.- 0 C 0) 0- W I 1- - 01 4~) 4- 1- 1-41 (0- 0) +3 01 <+3 ~ 4.3 00 ~ 00 > 0 C 5- 0) 0) 01 3) 0) 0 (0- - 01 100 (0 W 0+3 +300 C 0 0 `U) In U) .0 C C') 04) 00- I- W 0- 4.~ U 10 .0 (0LI +I.0.0.0 ~ 5-fl- 0) (0 COO 0 43 5- 01'..' 01+) 0 U) 10 (0 U 00 0 3) 0)01 4- 00)0)0 01 LI 0 0 (5 +3 < 0 (0 0) ~) UI C'S (0 0, ~ 0 0 +3 05-.- 03 .0 O'-CO'- (0 WLU~ (001,-li 019-14-9- ~- 00 (0 C+)+3+3 CO I CO < F- +1 ~ 0 0 0 .~ CO I- LI UI .- (010 (0+1 0) `-4 $ <5-) +3 0 (`S `- `I- 010+~ (0 0 1-F- 0)5- I 0 (0 C 0) U) 09- (`4+3 +3+30 1- C)- ~- 0) (5 U) 1-)- 0 LI C LI 5- (0k) C 0 U) U) U) 0 0 C I 0 1. 01.0 LI C.) 0) -1 I +30 0 LI .)C .- -.- C U) 0 ~ (0 (001 LI) +3 -.- 0< ~ 00+) Z U~.0~O'-CInC01InC41 0)010) U- S. InZ~1041 O 4~I (0 1- Z I (0~4 ~.0 0 LU 109- (4_ 01 0'4- ,-~) (~ .0 ( .-0J,-J ~CO LI).. (000101010010001(010>.-.- .01 5- C ~ I $~ 03 U .0 LU .-.- ~ LI 5- 0) )~ I I .0 I 3-41 0 >41 0+3 ~ *,. ., ~.3 4.3 .~ w .C ~ ~ +3 (0 LI C'S ~0U) 010 1-01InEEEu)('5~-inEC('so S-S.. O . I LU I ~ 01 LU.0 0) LU 0 (0 (0 I I ((0 01..- C') LU LU 0.I.I -.4 Z~LUOLULU~LU,~(IC~C,J2ZU) 0) N. 5-i C') (1)5 LUl C') LU LU 0 0 ~U)0U)U)N.0O0OLI)OO._LC)0LflW I- X C') C-S ~(5~LI)OO0O,-C')C')(5-10-U)U)U)Lfl000 LI) 10 0303030)0)0)0)0)0)0)0)0'0i0)0)0)000 0 5- . C'JC'JC'S PAGENO="0568" 564 Licensee On-Site Data ~- ~--~ Date: 4/1/79 Helicopter Data R194 Time - Location Reading (MR/HR) Beta Gamma Gamma 1543 800 ft. up, unit two Rx bldg. 3 800 ft. up, utility bldg. 9 800 ft. up, security bldg. 15 800 ft. up, couzit between security and site fence 5 800 ft. up, site fence 3 700 ft. up, 2 mi. south 0.1 2012 500 ft. up, unit 1 warehouse <0.1 500 ft. up, unit 1 screen- house fO.5 500 ft. up, unit 2 screen- house 2.0 500 ft. up, unit 2 collector tanks 4.0 500 ftJ up, south of unit 2, tanks 0.5 500 ft. up, west of unit 2 tanks <0.1 500 ft. up, all other perimeters <0.1 2023 600 ft. up, unit 1 warehouse 0.5 600 ft. -up, unit 2 screenhouse 5.0 600 ft. up, unit 2 collector tanks 4.0 2023 600 ft. up, unit 2 collector tanks 1.7 0.3 600 ft. up, south gate PAGENO="0569" 565 Licensee On-Site Data Date: 4/2/79 Helicopter Data R194 Time Location Reading (MR/FIR) Beta Gamma Gamma 0317 600 ft. up, north gate <0.1 700 ft. up, from north gate to unit 2 cooling tower 0.2 8.3 0.4 0.9 1.5 0345 700 ft. up, vent, cooling tower 2 700 ft. up, unit 2 Rx bldg. 0.5 *700 ft. up, unit 2 cooling tower 1.3 6346 700 ft. up, over TMI 3 700 ft. up, north gate <1 700 ft. up, west above 0.6 PAGENO="0570" 566 Licensee Helicopter On Site Data R-200 `1-~~' 7? __________ Readings (mr/un Time Location Beta Gamma Gamma 1148 North End of Island @ 500 feet 1.5 mr/hr 1230 North End of Island @ 500 feet 0.4 mr/hr 1310 Unit 2 Screen House @ 450 feet 5 mr/hr 1315 Unit 2 Screen House @ 450 feet 1.5 mr/hr 1317 Unit 2 Screen House @-450 feet 4.5 mr/hr 1330 Unit 2 Screen House @ 450 feet 20 mr/hr 1335 Unit 2 Screen House @ 450 feet 14 mr/hr 1340 Unit 2 Screen House @ 450 feet 3 mr/hr 1345 Unit 2 Screen House @ 450 feet 5 mr/hr 1352 Unit 2 Screen House @ 450 feet 2 mr/hr 1400 Unit 2 Screen House @ 450 feet 2 mr/hr 1405 Unit 2 Screen House @ 450 feet 1 mr/hr 1420 Unit 2 Screen House @ 450 feet 12 mr/hr 1445 Parking Lot @ 500 feet <.1 mr/hr PAGENO="0571" Date: 3/30/79 OFF~ ~-SITE DATA Th!~JEST) Location Instrument Re~g Remarks 1000 ½ mi. SW at 300 ARMS . Highest reading in 450 mR/hr. at 600' plume 1030 ½ ml. ESE at 300' ARMS 2 mR/hr. 1045-1145 1045-1145 1045-1145 ¼ mi. ¼ ml. ½ mi. radius radius radius at 300' at 500' at 500' ARMS ARMS ARMS 20-30 mR/hr. 8 mR/hr. 1 mR/hr. Peak in West Quadrqpt Peak in West Quadrq~t Peak in SSE sector 1045-1145 1 mi. radius at 500' ARMS 0.5-1.0 mR/hr. Peak in SW to NNE 1045-1145 1 mi. radius at 1500' ARMS 0.1-0.15 mR/hr. 1045-1145 3 ml. radius at 600' ARMS 0.5-1.0 mR/hr. Peak in SE PAGENO="0572" oF~ SN-SITE DATA Date: 3/30/ 79 Time (EST) Location Instrument Reading Remarks 1230 Over Siqelley Island NW at 550' Helicopter 20 mR/hr. Note: All helicopter readings beta-gamma 1315 East of Island at 600' " 2 mR/hr. 1324 Shelley Island W at ? " 10-20 mR/hr. 1326 Over Shelley Island at 620' " 16 mR/hr. 1328 Over Hill Island at 700' " 7 mR/hr. 1331 Over Hill Island at 850' ` 7.5 mR/hr. 1332 Over Hill Island at 1100' " 2.3 mR/hr. 1333 Over Hill Island at 950' " 10 mR/hr. 1333 Over Hill Island at 750' 6 mR/hr. 1334 Over Goldboro at 700 1.5 mR/hr. 1335 Over North Bridge at 720' " < 1 mR/hr. 1335 ObservatIon Center at 720' 1.5 mR/hr. 1340 Over Hill Island at ? " 1-12 mR/hr. PAGENO="0573" 2 Time (EST) Location Instrument Reading Remarks 1400 Northeas4. Hill Island at 550' Helicopter 2-5 mR/hr. 1405 1½ mi. north of Island at 550 " 2 mR/hr. Iqoç I~Jor~P~ 0F S+ ~ ~ 1410 Over Sunset Go1~ Course at 600' 3 mR/hr. 1410 Over Hill Island at 600' " 5-12 mR/hr. 1410 Over Hill Island(golng from L4Je44o 5-50 mR/hr. ~- ~+ ~ro') 1655 One mile west of Island at 600' 4 mR/hr. 1655 One mile northwest of Island at 600' " 1.5 mR/hr. 1655 One mile northwest of Island at 600' 1.2 mR/hr. 1655 One mile northwest of Island at 600' 0.1 mR/hr. 1655 One mile east of Island at 600 " 0.1 mR/hr. 1713 3/4 mi. west of Island at 500' 20 mR/hr. 1713 West bank at 500' 2 mR/hr. 1714 Over Golsboro at 600' " 2 mR/hr. 1715 One-half `~`west at 500' " 65 mR/hr. 1715 3/4 ml. west at 500' " 20 mR/hr. PAGENO="0574" Off-Site Data 3-30-79 ARMS I~,o() t, Helicopter flight with hand held instruments between 4:00 to 6:00 p.m. today. General pattern- circled at 1/2 and 1 mile radius from plant at an altitude of 300 to 1000 feet. Then radials were flown in highest dose rate directions. Wind speed is slight, wind direction is approximately 115 degrees. Highest reading is approximately 8-10 mr/hr over site. Plant reading in plume is approximately 6-8 mr/hr over Hill Island just north of the site. Elevation of maximum reading at 300-400 feet; top at 800 feet. Plume disappeared after 5-6 miles. Plume appeared to follow the river. PAGENO="0575" -~ OFF-SITE DATA 3-30-79 ARMS - FLIGHT WITH HAND HELD INSTRUMENT BETWEEN 2120 AND 2225 HR 1. Flew circle @ 1 mi radius @ 500 and 1000 ft alt. max. reading on 1 mile was 0.5 mR/hr @ 500 ft. 2. At 3 mi out, at 330°, performed altitude spiral from 1500 to 300 ft. Top of cloud at 1000 ft; max at 500 ft, decreased down to 300 ft where they had to pull up. 3. Tracked on radial at 330 heading; 500 ft. altitude found levels of 100-200 pR/hr all the way out to 18 mi- where had to break off because of a ridge. 4. @ 5 mi out; made 1/2 circle across above radial; plume cut about 30-40 sector. 5. Wind @ 500 ft from 150° @ 10 knots, @ 1000 ft from 200~ 8 20-30 knots. 6. Tlpton said that they will attempt to standardize survey in above format. 7. Tentative schedule is one flight about every 3 hours around the clock for next 12 hours or so. .iJ~j.. PAGENO="0576" OFF-SITE DATA 3-31-79 MET ED HELICOPTER TIME LOCATION READING 0012 Grid N <0.1 3 mi N TMI ALT 600 ft 0013 Grid NE 0 1 ml N TMI 600 ft 0017 Grid NNE . 0.5 Turnpike 1100 ft 0045 Grid Direction Plume 0.5 550 60° 9° Turnpike to Hershey 800 ft PAGENO="0577" OFF-SITE DATA 3/31/79 ARMS FLIGHT TIME 0015-0115 1. Flew at 1 mile radius at 500-1000 ft alt max reading was 1 mR/hr 2. Angular extent and direction 20° wide 010° 3. Wind Condition from 240° speed 10 knots 4. Radial 100 at 500 ft followed the plume to 18 miles 5. Alt spiral at 6 miles from the plant 1500 -300 ft profile. Top of plume 800 ft. Max reading at 300 ft (1.50 iit~/hr) 6, Next flight at 0300. PAGENO="0578" OFF-SITE DATA 3-31-79 ARMS FLIGHT TIME 0300-0400 1. Flew at 1 mile radius at 500 ft alt max reading 1.5 mR/hr In the NE sector. 2. Flew at 1 mile radium at1000 ft alt observed 0.5-0.7 mR/hr at the NE.sector 3. Radius from 550 at 500 ft alt observed 1.5 mR/hr near the plant. This decreased to 100-200 pR/hr at 14 miles from the plant, and tO 50 pR/hr at 18 miles from the plant. 4. Spiral flight at 3 miles from the plant at NE sector (1500-200 ft). Top of the plume was at 600 ft reading 1 mR/hr. 5. Wind direction 180° at 3 knots (25-30 knots at 800-1100 ft). PAGENO="0579" OFF-SITE DATA Date: 3-31-79 ARMS Flight Data for 0600-0715 hrs: At 1 mile radius circled site at 500. Peak readings obtained NE of site were 2-2.5 mR/hr. with a reading of 0.7 mR/hr. at 1000'. Other readings showed less than 1 mR/hr out to 7 miles, 0.5 - 1 mR/hr to 10 miles, and from 10 miles out to 30 miles levels were 0.1-0.2 mR/hr. The plume was 1-1/2 - 2 miles wide the full distance. The max. width was 2 miles at 20 miles out at 500'. A sharp distinction of plume top was noted at 600-700' from 5-30 miles out. At 27 miles out on a heading of 060°, plume top was at 600' and extended all the wasy to ground. Next flight scheduled for 0900 hrs. PAGENO="0580" ofoo /z'/'5 OFF-SITE DATA 3/31/79 ~m 0 Tin~é(9:OO - 10:15 am~~- ARM?~Jãff~collected 3/31/70 0600 - 0715 Still good - ARAC Projection are in good agreement with,j~plume. Source term ? will be attempted - Winds to remain light and variable. This afternoon winds will _______ S-SW, 5-10 knots PAGENO="0581" Date: 3/31/79 0FF-SITE DATA 131c ARMS overflight report for 3/31/79, 1200 to ~5 hours: Essentially no change from earlier two overflights. Plume direction is from 030° to 060°. Maximum readings observed (beta-gamma): 1.5 mR/hr at 1 mile at 500' 1.5 mR/hr at 3 miles at 300' At 3 miles plume top observed at 2,800'. Plume is on the ground at 3 miles. No iodine observed; xenons are the only activity. PAGENO="0582" OFF-SITE DATA R137 Date: 3-31-79 Helicopter readings at 600 feet C)1 Time (EST) Location Reading (mR/hr) 1300 G~i.ge.r Church 0.1 Rte. 230 2 Rte. 283 < 0.2 Turnpike < 0.1 PAGENO="0583" OFF-SITE DATA Date 3/31/79 ARMS Flight data for 1430-1640 hrs: At one mile radius of 500, maximum level was 3mR/hr at i100_1400 (readings with ~M instrument) In an altitude spiral at 3 miles, top of plume was at 1700' with a maximum level of lmR/hr at 500'. Could not fly any lower than 500' because of weather. Due to high variability of winds, plume shifted to south of, plant so above. measurements no longer hold. Raining hard with wind squall situation. Next ARMS flight scheduled for 1800 hours. PAGENO="0584" DATE 3-31-79 OFFSITE DATA R144a-k Helicopter Readings TIME (EST) LOCATION READING (mR/hr) 1533 Geye/s Church Rt 232 Observation Center at 600 0.1 1555 Black swamp, high spot South of Island l.3 (R. Fruit) to Black swamp to substation 1932 East Side Hill Island <0.1 1934 Shelley Island <0.1 1936 Hill Shelley Island at'900' <0.1 2005 Middletown Junct. at 800' 3 2008 1 mile 060 degrees (ENE) at 1000' 4.5 PAGENO="0585" OFF-SITE DATA Date: 3-31-79 ARMS Flight Data for 1843-1945 hrs: Plume extends generally E to ESE One-mile radius flight at 500' showed max of 2 mR/hr at the above direction. At 3 miles out the reading increased to 3 mR/hr at 500' with top of plume at 1000'. At 8 miles out at 500' the level was 1 mR/hr. Wind speed was 4 knots/hr. The ARMS group thought that there was a "puff" at about 1800 hrs based on the higher reading at 3 miles; the higher reading may have been due to return of a "pocket" considering the light and variable winds. PAGENO="0586" Note: Measurements Made With GMSM Not yet standardized with an ionization chamber 1. At 1 mile At 3 mile At 10 miles At 15 miles 2. Altitude spirals At 3 miles At 15 miles 750 feet top of plume 850 feet top of plume Data 3/31/79 Time Between 2100 and 2140 (Air Force Helicopter) Offsite Helicopter Data Location Measured extent and Plume Width at 500 feet B-22 Reading (MR/hr) Max. 0.8 at 045-075 degrees Max. 1 at 070 - 090 degrees Max. 0.15 at 070 - 080 degrees Max. 0.15 at 070 - 075 degrees Wind speed 3-5 k~vfj shifting slowly. next flights 0000 hrs, 0300 hrs, 0600 hrs, 0700 hrs. Reported by John Tifton Arn~s 3/31/79 2300 hour PAGENO="0587" OFF-SITE,~HELICOPTER DATA R148 +J'O~iriE ON-~[/T Date: 3-31-79, 4-1-79 Time Location Reading (mRj~ Beta-Gama Gamma 800-FOOT LEVEL 2045 Unit 1 `A' MDCI 0.3 2045 SE 2 mi. out 0.2 CO 2050 0.5 mi. E TMI 1.4 2053 North Gate 0.01 2053 Unit 1 "A" NDCT 0.05 2055 E Unit 2 NDCT 6.0 PAGENO="0588" OFF-SITE HELICOPTER DATA (Continued) R148 Date: 3-31-79, 4-1-79 Time Location Reading (mR/hr) Beta-Gama Gamma 700-FOOT LEVEL 2320 Unit 2 Turbine Building 20 2334 Middle Substation 10 2325 0.5 ml. E Observation Center 15 0.25 ml. E Observation Center 25 N of Observation Center 0.5 Going S from Observation Center 20 Going S from Observation Center 19 Going S from Observation Center 10 500 K~"Substation (0.5 mi. from Observation Center) 0 PAGENO="0589" OFF-SITE HELICOPTER DATA (Continued) R148 Date: 3-31-79, 4-1-79 - Time Location Reading (mR/hr) Beta-Gama Gamma 700-FOOT LEVEL (Continued) 2340 0.5 mi. E of Observation Center 20 (4-1-79) C.'l 0000 N-S, 0.5 mi. W of Radio Tower 1.5 - 0.2 0005 Middletown Junction N-S £0.1 0010 S of TMI Unit 2 to 500 KV Station (800 feet) 5 0015 0.25 ml. S of TMI and 500 Station (800 feet up) 1 PAGENO="0590" OFF-SITE DATA B-23 Date: 4-1-79 ARMS Flight Data for 0030-0100 hours:. 1. Flew 1-mile circle at 500 feet altitude Cl' Plume width and direction 850_1200 1 mR/hr maximum 2. Few 3-mile circle with a maximum of 0.05 mR/hr 3. lop of plume was at 600 feet Flight terminated - fog PAGENO="0591" OFF-SITE HELICOPTER DATA 8-24 Date: 4-1-79 ARMS FLIGHT - 0145 hours to 0230 hours 1. Flew at 1 mile circle at 500 feet altitude Plume direction east from the plant Maximum 1 mR/hr C.'l 2. At 2 miles at 500 feet altitude Maximum was 1.0-1.2 mR/hr 3. At 4 miles at 600 feet altitude - 50-100 pR/hr Plume from the plant due east 4. Winds are light and variable INFORMATION PROVIDED BY Tom McGuire 0300 hours PAGENO="0592" OFF-SITE HELICOPTER DATA Date: 4-1-79 Time Location Reading (mR/h~ 0223 ¼ mi. E of Op Center 15 ½ ml. E of Op Center 14 Over River E of _______ 11 Final pass 14 mm. circle 4 PAGENO="0593" 589 -I (%4 ~ u,.~1 ~ U) * U) . ~ (~ C~J (~J ~ ~ U) tO (~J C~4 a) o a- a) 4.) 4.3 (a a) U)> > > U 0)0) ~ a) U) ~ Q 0 ~ C *0 ~ 04.' Q 00 0 0),- = > U) U) to 1-43 00 ~ 4.) a) C..) (a 4.) 4.3 4.) (a U 4.) 4.) 4.) LU> (a (a (a 4.3 .0 X )C 4.) 0 U) U) U) U- 4.) 4..' 4.) U) ~~U~OCa (a (a ~Wiflu)u)(a a) .0 0 10) a) a) a) ~J- U) .0.0.0 a) (a C~4 C~J c~j ~ .,.. (a.0 ~ 4.) U)4.34.3a) a) a) 0U)inU) (a `.0+34-) (aU- ~- - 0 ~ .~ .,~ 435>>> ~.U-WE a) a) 5- ~ a) 0> a) ~ U) a) C~J U) 0000 4.' 4-4-9-4-0.0 ~- . 000 0. 0 0 0 0 U) 0 `- I I I * I U) tO) U) 0 a) c-.i o C 4.34.) 4.' 4.) 5. 5- 0. 0. 0. 0.0.5.4-' 43 0 U)U)U)U)a)WC4~ ~ = a)U)U).- >raca 0 a) 4.) WWa)a)00-4-3 4.' 4.' .`4.'0Wa)-*.- ~ (a a) a) a)~ a)a) 4) U ii 1111W a) a) a)a)I III (a a) 0 4- 4- 4- 9-4- 4.3 4.) -.3 0.0.0.0.0.0.0. 0.0.0.0. U) U) 00000000 4.. 4.34.34.34.34.) 4.34) ~3 ~- .,- ~- ~3 43 4.) 4.3 4.3 U) 4- a)Wa)WWa)W 4.' ~3 4.) a)a)a)a) 0 a)wa)a)a)a)a)o(aO'aO(aOOa)a)ww> 4-9-4-4-4-9-4-434-) 4.) 434.34.) 434.34-4-4-4- U) U) U) 00000000.00.00.00000000 0000 LU) U) 00 0 0 0 U) LU) 0000 LU) LU) U) N tO tO N N LI) N U) N U) N tO to 03 N N U) 0~) N U) 0 a) a) 00)0000 tOO 0 N 03 4.' a) ,-- 0 `-~--~ C'.J C4 C~1 C~4 C~J Cl) (a *,- C') (a `4. `4. `4 .4. `4 `4. `4 O 1- 00000000 0 0 000 48-721 0 - 79 - 38 PAGENO="0594" OFF SITE HELICOPTER DATA 2 miles east of observation Center over 500 Ky substation 3 miles east of Unit 1 Rx Bldg 5 miles east of Unit 1 Rx Bldg Disk MILE3 Job B p. 15 R-152 Time 0431-0445 -0445 -0445 -0447 -0448 -0450 -0458 -0458 -0500 -0500 -0501 -0502 -0506 -0509 -0510 Location 700 feet up - 700 feet up - 700 feet up - No altitude - 700 feet up - 700 feet up - 600 feet up - 600 feet up - 600 feet up - 600 feet up - 600 feet up - 700 feet up - 700 feet up - 600 feet up - 700 feet up - Reading (mR/hr) 16 4 1.4 7 7. 25 10 2 18 8 5 6 7.5 4 miles east of 0EV Court over 500 Ky substation SECTUnIt2 East Unit 2 Rx Bldg SE Unit 2 South Unit 2 East Unit 2 between Unit 2 Rx Bldg & 500 KV substation East Unit 2 stack over 500 KV substation 1 mile east 500 KV substation PAGENO="0595" 4/1/79 Offsite Helicopter Data Time Location Reading (Mr/hr) 0610 - 500 feet up and 120 degree 2 to 3 radial at 1/2 to 1 mile C.'l - lop of plume 800 feet clearly defined - at 3 miles out plume edge at 130 degrees and 170 degrees with poorly defined edges. Next flight 0900 or 15 minute notice (?) for gas sample PAGENO="0596" DATE: 4-1-79 OFF-SITE DATA R158 TIME (EST) LOCATION READING (mR/hr) Beta-Gamma Gamma 0833 SE TMI at 700' 8 2 PAGENO="0597" ON-SITE DATA R-159 DATE: 4/1/79 Helicopter Surveys (ARMS) 0900 hours Plume between headings 140 degrees and 165 degrees. Winds 3200_3550 surface to 1000 ft. speed " 5 mph C~TI - At 500 feet altitude max 3 mr/hr 1 mile out - Top of plume 1300 feet, maximum ~ at 200 feet was 0.5 mr/hr 3 miles out - At 10 miles out, had 0.2 mr/hr - Plume broadened at higher altitude and shifted slighly to the West Report by Bob Shipman 4/1/79 1040 PAGENO="0598" 594 Licensee On-Site Data Date: 4/1/79 Time Location Reading (MR/HR) Beta Gamma Gamma 1256 600 ft. up, toward Bainbridge 0.2 0.1 800 ft. up, toward Bainbridge 0.3 0.1 1323 600 ft. up, ~1mouth 0.1 0.05 700 ft. up, Valmouth O?1 0.05 800 ft. up, 1~a1mouth 0.2 1410 700 ft. up, south end of island 1.5 0.4 1420 800 ft. up, S end of island 6 1.5 PAGENO="0599" Disk #MILE1 Job: OFF-SITE DATA ARMS Flight Data fro 1800-1900 hrs: On a one mile radius flight around plant at 500', plume was at 500', plume was at 2200 to 2500 with a maximum reading of 0.5 mR/hr. CY~ On a three mile radius at 500', plume was at 2400 to 2600 with maximum reading of 0.1 mR/hr. at 3 miles, top of plume observed at 600'. All readings with hand-held GM. Visibility dropping; not sure of time of next flight. PAGENO="0600" LICENSEE ON-SITE DATA April 1, 1979 DOE ARMS FLIGHT - 2100 to 2115 HOURS Condition: Rain and Fog Plume from 2700 - 315° At 500 Reading 0.5-0.75 MR/HR Waiting for Better Flight Conditions PAGENO="0601" 597 c'.j S~l El r4 ~l 4~ E~~~00 Joou~ * 00-40c-.j .0. *0 .0.0 `00. ~D 0.00 ~4 T1 000000 v4 C~j W V 0 U) ~J r-f V 0 ~ C'~J ,4 r~ r$ r-I V C~4 V V V o~1 =1 ~l r~ IE 0 OlrtS CC~ r4 C) U) C)C) 0 0) -c I- )- C .0 USC) 0 0.0. r-4 C)C) 5- ~ )( WU)S. C) (~ 0C0 U.) 4-~+~O . ~ US~UC) ~ .- CS~C I- C.-r-10 4.) ~0U)U) 0 LI) .~ -C C 0 C) 1-4 0 .C 4) .- U) VS 4.) 4.) ~- . . .C U) C'4 E C r-4 0 U) . U) LL ~ S.- 0 0 ~- U ~ 0) 5- C .c 0) ~-4 ~-4 U.- 0 0 .~.- C C `- 5- C 0) 0 0 4.) C C) 4.) C) C 0 >~ 0 U) C 5) >~ ~ C .~ 4- 5) ~) 5- ~ C 0 >~- >s ~ W.0C0C)S.-Cfl~ ~- 0~.0 .~S- S-U~~ OS) SS~I5,-C),-C) U.) 0.'- .~.- 0.4-) C C) S. (5 X 0 U U) 5) C) 0 4) 4.) U) ,- C) .C 5)4.) 5- . . -~ .C C .~ ~ 5) S.- 5 ~ 4- C U) 4- E 4-) U) U (5 U) U) U) C 5/) C (5 0 0 4.) 4.) 5- -~ -~ 0. 0 C) C 00 (5 0) C) -.- U) 5/) ~ 0 C C 5- 0. 0 ~- 0. v-S v-S (~4 C) S.. 0)0 r4 ~ S.- C) .C C) ~ C S. c 0. U) C c C C) C 4- .C -~ S C C) C .C .C .C (-4 - ~- 4.) 4) 4.) 4) 4.) C . 4) 4.) 4.) 4.) 4.) 4.) ~ 4.) 5) 5)4.) 4.) ,- .~.) 4) .5.) 4) 4) ~ 4.) 4) LU C v-OC)~000~~OCCOOCC)O.CO.v-(5OC)OO.v-OO = 0 U)U~CUC4)CCU)~.0C04)~~cC)CUU)CEU) 4) (5 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0. U 0 _S 4)4.) 4) ~) ~) 4)4.) 4.) 4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4.) 4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4- 4-4-4-4-4-4-4-4-4-4-4- 00000000000000000000000000000000 0000000000 ~ ~ 0000000000000 a, a, N N N N N- N N- N Lr) U) U) U) U) U) VS U) VS U) U) U) U) 5/) N- N N N N- N N N 0) N 5) 0) C'.) C') C') C?) U) 0 v-S E ~ C'.) C') C?) ~. -~ 0 .- i-I ~ ~ 5-. C'..) C'.) C'..) C'..) C'.) C~ C'..) PAGENO="0602" 598 HELICOPTER OFF-SITE DATA B-33 4-2-79 Arms Flight 0300-0400 hr 1. At 1 mile. Plume WNW, 0.5 mile wide, max. 1.5 mR/hr. 2. The 1.5 mR/hr was observed most of the time. 3. Wind S & D 140° at 15 knots. 4. At 2 miles, max. 0.5 mR/hr, top of plume at 800 ft. PAGENO="0603" 599 HELICOPTER OFF-SITE DATA B-34 4-2-79 Arms Flight 0600-0615 hours 1. Plume direction was NW from plant. 2. Maximum levels reading 1.0-1.5 mR/hr. 3. Wind S&D 1400 at 15 knots. Flight time was limited to 15 minutes due to fog. PAGENO="0604" 600 HELICOPTER OFF-SITE DATA Date: 4/3/79 Datg for distance away from 1141 in the plume. As of 0800 the wind direction was from 270°-325°. Time Distance (Mi) Reading (mR/hr) 0900 0.25 1.7 1.0 0.8 3.0 0.5 5.0 0.4 6.5 0.3 1200 - 1.0 2.0 3.0 1.2 6.5 0.5 PAGENO="0605" 601 OFF SITE DATA B36 4-4-76 ARMS FLIGHT 0000-0100 hours Ceiling at 800 H 1. Circle at 1 mile at 500 feet Plume 2200 to 255° Maximum rate 1.1 mR/hr 2. Circle at 3 miles Plume 215° to 230° Maximum rate 0.5 mR/hr 3. Circle at 6 miles Plume 210° to 2300 Maximum rate 0.3 mR/hr 4. Over river 1/2 mile from plant Plume 185° to 210° Maximum rate 0.8 mR/hr Next flight 0300 PAGENO="0606" B-33 ~1-SITE DATA 4/4/79: ARMS FLIGHT 0300 - 0330 hours 1. Circle at 1 Mile at 500 ft. Plume at 2000 - 220° Max rate 0.3 mr/hr 2. SE at 3 miles at 600-700 ft. Max rate 0.1 - 0.2 mr/hr Did not go cut further since they crossed a ridge at 3 miles and radiation levels dropped to 0.05 mr/hr and plume was undefined. PAGENO="0607" 603 4/4 ARMS 1520 - 1545 flight Narrow plume @ 500' level @ 1 mile "5 x bkgd (`~ .1 rn/rem) @ 2 miles "3 x bkgd C" .06 rn/rem) ____ ~ to~ ~LLWT with a few spikes @ 2900 plume is in sector 270-300° PAGENO="0608" 604 Kotsch Disk # MILE7 Job: H 4/5/79 HELICOPTER DATA ARMS Date: 4-5-79; received 1120 hrs. ARMS flight at 0950 identified plume in sector 1250_1300. Measurements: 1 mi. - .3 mR/hr 3 mi. - .05 mR/hr 10 mi. - .03 mR/hr Radiation measurements made using a portable gamma scintillation survey instrument. PAGENO="0609" 605 BMurray 4-5-79 Ground Survey Results - 4/5/79 MILE7 JOB I 1. NRC Survey per Dan Montgomery (site) 4/5/79 Winds at 2500_3250 Location Radiation Levels* West side of River <0.01 mR/hr East side of River 0.01-0.15 mR/hr 2. ARMS Survey 1430 hrs 4/5/79 Plume at 1100_1200 at 300 feet Distance (miles) Dose Rate 0.1 mR/hr 2 0.1 mR/hr 5 0.05 mR/hr 7 0.05 mR/hr 10 0.03 mR/hr 48-721 0 - 79 - 39 PAGENO="0610" 606 ARM Flight - 4/12/79 - 0938-1016 Reported by Geruskey - State of Pennsylvania Distance Altitude Sector Dose Rate mR/hr 1 mile 700 ft. 3000 bkgd. 1 mile 500 ft. 3l5°~ .030 3 miles 700 ft. 270° .008 4.5 miles ? ? bkgd. Reported 1400 - 4/12/79 Sly PAGENO="0611" 607 PAGENO="0612" SURFACE WEATHER OBSERVATIONS ~*Y*~A~*~ J, 1'~ Y* A7 ~ ~41 GMTLSTJ~J - 3 ~3~j9~'_ - - - 1/ ~ .e-J ~pI~1o~'a~ ~ .1 kJco~b~ 3~jI ~ i ~lj ~~O'1~ r,i / Z4 24p* 2~JO~L H O.~L H ~ ~ ~ 21 D~i/O' I-'! ~ `4' /a~oc /)~$~ 1/ 3i~ A,' 1/ 17i/OL~. 7 1~P~J~4 ~_,*1 ~i/~ii1 A - (( IiVC ~ ~ ± - ~Tj ~2O ( 7/ô ~ ~O f 1/13 / /t 7 ~ it'p ." ~ /~ `t :~ ~ ~j , I'.. ~ L~ d ~ ~L ~ ~ ~ -i ~ 3 //~ .~ a ~e ~ I ~ ~/ ~2j /1~ z~ f~s /./;z- 3c~7 Ic 7; - - ~..yj;y ~gg i /,`,~,/3~3 n ii:: -~ - fl~)J.L - r,i.~. Ij7~ - I /1;' ~ I ~ ~1 - -4 - - H.' - - 7.~ii --7 ~ - `f- ~27 7,~ - - L - - - - - 7j0 - - 1 ` (" ~(/, ii t7~V ~ I *~~/ .~j ii~ ~ 0AL Oil 2W ~L~I ~LJ,L ~j (~L~ ~,o QLQ C!~L I ... . I .*. .~A .1 A'.~ ~ I ..:.. - UAAA~YOF WAY I A~LA~KI WAY LAY L;YrPL LAAVY;;% PAPAYL~AA PAGENO="0613" ~~ST G$T JT~ ~ 2 SU~FACE WEATHER OBSERVATIONS I ~MT_LST~ .sC~,) ~ c - //(O oL~'c: - ;~_~ ~ (,IJC / ,~_ (f_dc ~ `~ (_ _/c. 7 ,~1 1i0; VW1~kk~IOO i~0i `LoT ~o1i 07/ &, ~ Yc7 7t~; ~ ~~ii1'E~ 1~~ - - I S (oc- - / / S7 A~At 7 ( (` I'/(,oI I - -, f:/f)jL__ ~1 t~~' O"C_ 10 "~2. ~(2 /(~ ? ` 120 ~ / ~ c.~ Sr 7~ L~L~ /::~ * 1- `~ i~o ()P'*~~ L~tI cos~ ~~r~ic L~ /;~-~cDv~~ L~ 1- ~S1 IT j/rnj /~,() `~1~/ 1!~ 2- f~ (-*~~ - `I 7 ~~`t7 ~43 --*17~ r/5 4.1//I 3o~OI~~~ H `~t~A~* I, v 3 1 ~cl L31 I JO 14) ~ i~ /.. ~S.' 0 ~ .2_ ~ ~!_ III 2~2-~ I-,; ,,,,, /7/ ~L5 (34) iSl'/I /1) -~ 4) ~-~s~,",VfI/)~)'/' 2~cc~T ~ ~O I (/``O~/c - -~ j~~)O.~>JL~ ~ 3o.c~r e~-~ ot'c-. 2~_~4 E~1 3D~co~7 e'e~~ c~'C. i~ c~/'~O /~,v 2~ - ~) j~~?Jfl - ~- ~ ~7/4I S "- - J~_~3/_) - ~ - , - 1'~/~~T4 - !/4~. ~ - - - `I p. I) `t) 7j. ~- i~ 3~3;7 ~iii~i'~i7i~*- - ~_ -~ ~q ~ ~_c~_____. ~`~O~// f(~( L - c~c~iL p.--- .Y7~_~ 4~~j_ 4~ - - - L i~ t ~J i dn~ OlD «= - ___________ `1 ~Ti~ -. ~iii~i~ /;,; ~z; *1 1' I ~ 1 "2 ,,,..`!tt!f,r!.rt~,._ PAGENO="0614" H1~ ~Li 0(1 I~kf~.oWi~o6 ~Q _E~_1J~4~~JWV*. "it U, F: E'~ F 7f3 I, U~' c'iih ,,~ /e~ LC_ ,.G~T IT~ C~h~ SURFACE WEATHER OBSERVATIONS -*,,~$-,- ~MTLST_1 Ii I ~ - ` ~ - 51~ ~ I ~ 0 (2~J C~- ~t / ~ / / ~j q /t~ ~ -:.` / fr, /`~,V £_ ri'- IF4 T /1 (t1(~ / (( (tiC tI ~- ~.1 L~. UF4 -: / ~ - -~ f (cj' (i/C L f~ ~L - *I5/~ (~i~ (~ I 7~2r0J 72-_ !iøcL_ - I (1) .~ I a,, ~t (~. (iy( (I 1/ F~1 -:~ c~ i.~ ~ A ~ ~/O c'r/C- ~Ji~ 4~iL `I ~4(j~ 4/ A (~rT7 19$] J(' t' I/~ T LI 7 çf 2~6~J 2~ 9231 1 ~ I;',, ,~ 0/4' ~__;- /e'r~', :~: i!/~ /~ ft,..; ~P~5~i J~o o~#c~ ~L ~ 7 I 1531 -7 7; ~ ~/ /~/i&) / I I' ~) (I - 7~; ,J,~_y -~ 1q31 4L_)~tL ?L~L - ~7 ~v.si "UT - f~_ :2 *141 /~i_~~ ~~VJT~ 11. J~jI)/ //` 7 LT4L- ~;iii ~ IO~t~O ~ I ~,-~ 5I~ "i `I) `I I~1 STATION PUISURS COMPUTATIONS :LLLI: :~: ~ ~` ~LL_~ PAGENO="0615" T C IGMT_LST2II SURFACE WEATHER OBSERVATIONS ~ ,`i:::::_~ - L~ )~f~ ~_~~_qi `AJ~5 5Ef~ /~j~ ,~ /f~J~ ~ i~-~ ~~`t__1_' "~"* ~SL `~c~c1 ~c "~iC'~ ~ 1 `0:01: ~_L~?! /Ott)~ O1~DI 4:i~_~ )o'o~ ~ I tp~ I -/ tc ~ ficT~ `P 71 j~bV Fj~ it'd'-" "~"i. ~ `~2~L *~*~ Li' - -- ~, - L~~I t/O &t/C~ L~~oI ,ci~, I'4~ .2__~~ (~~3 ,,,~ LL ~ ~is ~ ~ `_9~~~ ~i~L~t `~i -. - iQ~ o~c Vt' ?~ - - - (s~~fv *`,14. t~c~S~v 2I~- 7i4 ~W~124- ~4o w - ~2~y~!24 ~3i~ - - Ø~1ft/JYLV.4'O! 9L/ - - ~~i~'i)'c' - - go~1&l.2'/i~ i~ø~vv~Y~. siz. - hL~i~lL `~* L__~ I . .iT-t L ~(-~ T1[~ F I - PAGENO="0616" F `3Vs,~A~i~ST ~I~L~LA19X 1A~ - V~ r»=O LI (~ 0 V C~ -~ - I:~'~~ ~?. ~.) !i Ti , jer 2 rrs ~,<,,,, jj~ - ~1i _____________ - Ii ~ I / II9~ii~LIi ? ~JAL `21 lCn! ~* /1 SURFACE WEATHER OBSERVATIONS /`-`-`-i'-~- ~~~-`--~ - ~ * z ,~:; ~ ~L i~tA1'/~' 4c~~t~ d~f ~ ~ ~`_/-~ /77~i$7~3~2~ ~ ~ ~`. A' oV~/ ~ ~j_i- pj~,i~nc~/ ~ I' -- //1/ ~ot w~ / 1)f- iT ~TiFTE~' es ~ ~7 ~ ~9O (WC~~ ~21/ ~(I~ctN'/~, 3 - 4---~--h--' I 1~) /*j t/t - ._ ig 1u~ /0 j~ cmi ~ L)/ ~ J,'leI'Vt/ /4's' li 2o4 ~/Th(r~. -, 3~ ,,- ~ ~jç~~q;~ /0 0, t~ ~LL QE7 0' 1 (fl i~ ~ I0 (-I YI (~Lf~ CLI? /. /i J~/~ T7 ~L /O L& 7J1 ~T L~!/~~ ~ /03 ~ JiI~2~I)41~ ~ ~r2/Vo~$1~ I/v 3 .Ai ~-- ~-~-~--~ ;, ?~ ImTospussuucoM;uT*.ToWs ,~, I' I UMAWKSWOTUANOMI:CELt.ANEOUSPHEHO~E$A .- - PAGENO="0617" /1 ~~ST G~T ~ SURFACE WEATHER OBSERVATIONS ___________________________________________ - MT_LST~ _______ _____________________ _______________________ I k if ~fL ~ (:,1Ct~ ~ (1,,e i: 7 ~~?i ~ I ~_*~f ,2ai~ T" $2. 4 - ~ 1_ ~- 22~~_ - - -~ 7ç ft ,~ ~t)2~ - I- , - - F~'t) Z ~t 0~#'rn~PJfl k~ ~ . ~` A £~ ~ C 4o ~ 1c0 o'c~. £ Jo t~t/C~- ~ii `J f//'~4- ic~. liii N ~ i~';s `C: ( ET (uIZfL(~ ~«=`- RZC Ti: ~? !; I I j~ .1 7 4~ ~ `I M2 4/ vn /~ ~ N2~ ,iye `1 ,~, ~rf.1/ ~. J~4/i t~,i~fflh,F ~ 0/ti I'r~ `-i~'A) 1(1 (iI~1( ,i'J'11'f~A1 /1 ()~/C' /?_// H-V4~1//14~ `~`f~ /~~In'V~i ~ lI~)5//~d"/~ ~ ~-r L~it/~I3~?169II S 42t~ OL/C. f~-) V0 kc (I LL._L. A *` `C (~I. A~ r tá~k~1OY N / i2-I~ W~fJrt~ (// ~K ~ç~'3K,i `It;' CA1C~. `I-, ~i,i ~1r~ ~ ~iI 71~ Q94~ I / ~*C - f I iv) 7n~/C. F S * ~ - f;w! i2~ ~ ~) I ~1ItC~C4~ d~~S~a0 ~I/Oi7~ 177 .1 -- -cr ,t') ~J PAGENO="0618" r2'~ ~ ..~- LST~1 SURFACE WEATHER OBSERVATIONS `~ ~Ji ~`-`.4 / (. - -________ - - - - - - ~ IGMT - - -. I ~ fl p. P ~C 3~ 211 ~ 22 C ~ 33~p~ ~ ~ ~ ~` ;~~i -i~~ f3 2~~b9'_ ~Q ~ ~J *~`YJo2 - ~ ~ ~ ~ ~I$fr4~R 7~.2.3 L~II~4I)~ ,)?~ i~ 3 q'~4o?~ 9~i Jo ~ c jq~ 3~ ~/$ `L J3'~o /~~jj q ,c~ ~ ~c~J~/ `~3 ~i~' ~2L.?I~ ?~~`&`~` ~9O ~ iii : ~ `~ /±~4' ~ `~ L ~b' ci79 o vc.. ~&1cLL~ ~L~s~' ~ ~!i~2 4I~Z ~ ~ ~ ~ ff19pt'L ~7~7 Olic- ,,~//~n'C.- ~) `I 4~'~/ i7~1//~j3A,~/ tJP'(.~ ,vly%MW cc~r- t~1~r9 C~0f1~ a Z ~ ~` /o ~o - - * ~o3 L f3/.~U~'L - ?.Zit 91 .7o~O ~QJ ~L7~ ~L ~ , 11 ` an VIt~ Jk'A/ Li ~ ,`) ~ L~ fju, - ,~) L ~ ~O7 "I ~- ~ r: ; LI34 ~ ~f~so ~ $~ ~3 w~1 ~j i~KiV .~C7 /0 7' 7~ /.S : ~.?C /J(fl - - ~Jft~ aL 111c~ ~ez / ~ ,~, Li.. 3.9iO~1_1/s rnO~1_'v~ ~T,~7V ~ ~ - *;4~- - - - - I'.- - I /7/1.. T. ~. - - ~ç ~i'1,2«= (I ( (L * (~ fl y~ç~t - - ;~ ~i2~ -~.f- . - - - - - - - ~j____ ~~~I[I[IEIIE STATION PRESSUU COMPUTATIONS _________ ~TNISIC.~.T.)I~.. I#I,,~-~ ~ *1 PAGENO="0619" T.~.~ST,.G*T IGMT~IIIJ SUFACEW~HS .`-:I-* C L. ~ LfL 2c~i«= (L~/~H 2c~O c~T op S C~i- 2 o~ cc. T ~e~i3( £~3U Q5~' E 30 `i~~I 5~ o~- ~~,4r~2ç /2 ~C7 ~ C~~L4~_ CULL. ~ ~ ~ LI' ~ 2. ~ ?~ iS J*~ L~ ei_ * JOCI 6~p' ~.i~3iq (I - - -o-~ ~ J - `a ~ Ic FOlD ________ r jS CL& CL~ 1-'? Ic (LaZ . CL(~ I_c 1 C~ti~. 7oSC~T 1~ ~1 !~tt J.L ~ ~ ~f/ ~-- ~T'P/3 r'4p~ ~" ~q~i s.--. ~ - `~`J *3~ -`-~ ~ - ~~~L-'-',-" .2,'/j/;.'' `U'~'~ 1~/9/LCI ~9qy4 w~i'- ."~i/~ 7/,' ~T~J - #~ c~~J `-~6'~Jb 3o4'~~f I ~ .- - 7 i L ~`i-~'~ i~E~IIi I ~?coI - ` ` 2i ~ --______ . -___ ~: `: - ~`:~ -!--1-! ~ .~-*. (N~((~M~s~) I `v'cu~ I ~ I ~-~- I ~-~- PAGENO="0620" G~T C*I~~I1 SURFACE WEATHER OBSERVATIONS - _~ ~MT_LST~ I I ___________________ _____________ ______________________ - - - -71) ~C7 7/~ ~`-~Y -~--- - ~O E~c() 3X~/ - ~ ____________ * I I/~ .7- /~- ~Z~'I~I~1 Fb `!J~, ~I/(~ ~ /j~~ 7? j~ J_i Is' :~ L i.7 .-~ ~ lI~ ci~ *-;.~-~ I . ~`;-~ -. - 12I3~ ~ - ~tjf~ ~/2~ ~ \,/? 7? - , 13~ -~- - c'~x - U-/~ 7'- ~N'WIiIX~6~ 107o1 4/9 ;~:,c~ I~ ¶~- - .~- !~L_ `~ I ~L - /i~ ~- /~ ~J~L ~ c'.~ ic'3 ~75I ? I /~wCL' - `~L `,/oo 41-7 ~ -1 :~:~ ( I-A I ~if~ ~~EFEI~E~ A -4 4 - 7~i ~C~T 7'i cc~T r9o #~&/ 2iS3~iI `9i(~,i2~- ~1q 1/? ~ iq7scl I `ii,) ~) -~ -, -)/ ~ . 1~ ` -`I 2.l ~( 7 7 ,,(i~ ~I/ 7 7#~, 7 CYi / I_U' ) `3 L~) kt~ ] I I IIIMMARY YIP (lAY PAGENO="0621" - f~oO .~ C~T i~ CoI~~~; £DD~~s kMT I~T SURFACE WEATHER OBSERVATIONS I /i'1~'~~iSB"~ C- ~4 CL I~ ~ ~~i~oo ScY - ii -~?~i c-r ~O ~ &~L c.~_ ~er `C- (`it ________________ 4/(~C) /1? ~7~«=iii~i ~t~it~i ~T ~M1 -~ r~ (~JH, ~L' .) ,~`-- ~ ~ /,,)t~, i~'A1 ~ ~ 4/ /~OLI(.- /~`~-I~- /$o cr'c ~ /~, i~i~: i5~~ ~ #~~:; ~ - ~J 2 r1.()t-~A; ~ ,~t,.' ~éo ~k~/ ~? F'1.~,:~,SJ .1 I,~ ~ ~I th' /1.,- ~(7~Mvl~ :ei; ~i731~3L~W4i ~/~`~3~: ~ L4jo6á~ -I. ~J ~,, Cl I .isJC. `2 ~_ i~_ - t~T:) ~ Z21 ;.~j;-~~;: ~r~i~? ~ ~7~ii /~y,,. --`I-. Ii Th /4)~,~#(~' ~`.I'~ j,,, ~ - II ` / H- L c~ tn'C `~ I I''~1~13.I -- - (c~ / 1 4~. - 1I"i!17~;TiI1''~t' (~ - Iliiii'i' ~`i-~i~~ ~ ~ PAGENO="0622" T~ C~I~ 2 SUVONS //,1,('~~is&Ie( ~ £OD~ ~MT_1ST~ 4Y:i~_ :~- ~f.~L& 1) t~ ((j (~~j( fr1~(') ~ !~ ~i I~s:~- .LC~ J~i_ ~_ ~L__ rn~ civ'.~ 1/ /f E1 t.~_E._. ~ ii, ~ u C ~ ti t~L) ji (. jV ~ 11A4 ~ ~ U i/C~- ~3- ~ "S ~ 9 41 ,~/ ~ fi (1 ~/ C~ ~ 2" LU -~ 1~`~` ~17 -~ C3c~ c~1~ 12,1 ~?~`3 ii',- ~i 22'53/ 2 ~o ~) -,9 `/. .i~ic'~ C k; .Z 4~'~i1ii /, -, :1±::~:~~ REMADK$, NOIDS ANN I"~'/-"1misCr. J'c-M,~~'1) ~ PAGENO="0623" rn At SURFACE WEATHER OBSERVAflONS ~ ~ ` & ?~ O(/( L'~ I ~:/~ /0 ~7 ~; (tIC) OVs~ - R5/ /ç,4~~ ~ //,J~. ~ /1) ~ /i,L!rj (It/C ~./~~3~l%'4t. .,~ - - ~ ~: - ~ E«=«= ~k/~ iii TEI ~ /~7 - E 5~' cJVC `~`ia~3f/$1-..~ LL~ - - I /~ ,~ ~ ~ ~ /5 - `v~ 4a':'~_ `~j' F~'~i~ - - * "/~"t'~y -f ` f ~ *`! I (I'. /`~ ~ 1 ( - liii iii VI /~ -Li )(` 1~.?1~1qy3~ ~`Z7 ~ ~ iiiii ~ i~ ,o ~ - - 2- `2~: ~ ~ ~-~«= i2 i~ Ti /i ~-~Im~.il33:,z; ~ ~ 1,~2~7Md~ ~ ~` ~ (~/*~. - 4 - ~*~- ~ - -~ -~ " ~i :c ~.4 -;z~ ~ ~ ~ (~ 7 ~~iq~.~±r( 1/I .2~ -- -- --~-- - ~-- --~-- --,- -. .------ * ~ I `~~" !t\n' (SiiSOI1~/.4ft *L~~!1~ I ~ ~ I I PAGENO="0624" /14 1. /,` ~ ~H: jH ~ `L~ ~2 `*( ,lII~,, I( 2~ ~7 ~ --2 T,~T ., ~ / - - c---- - ~.. , I ! ~ii~i~ il$.a `7' c~ ,*~* - L~ii~ ~_~___,` !~_____~J ~Io~ ~ 11O44~2.~_~1, 2~3i"2 j: 1)11 `1-b' ,:--~ 41 ~T - a b? I ~~2~__________ `I ~ ~ (1/ ~ ~t1 i p721 ~ P5, t-~j 714. ~ I II ZIi-' 2' o30 ~rfyc~'c~qc,,' Jt~i~ -i ~ ,~qi ,~-e,--~-'~--- & #3~~ ~2_ ~ ~` c ~ ~ "S.-. - -; ~` - - - - - - ~ / 7~ L~.IIIiiIL/ ~~c.'..:c,&;,' `~ - - ,` ~ j,S~r~O-~K"~ ~J ~ 2s~ 6~ I~ /~ /*` Z~ - 5 ~ 2ec c~iC- jZ~ci~/~ ~ ~ /S 17_; siiI~!~' .--..--___ ,i~ /0 ..____ 2 72 ~Puo O~ IC) ,o - - 1 -~i~ ~~&~`ri ...~. -. .. I ..., ,,. I !E~**KS, SOTES £SSD ~SCELLASSEOuS PHfSSO~!NA PAGENO="0625" - ~ JG TLS~II1 SURFACE WEATHER OBSERVASIONS ~- ;:" L__ ~-~--~ :~ 7- I- - /4~j ~ 27,~ r~ c'i~ LLI~:'~ !` ri /i~ ~., ;,~;(~ I~iItu o ci~c.. I -~- -,( r s - ~ ,~W-/4 r ~ t~'. ~/ "ii 0 L/ L ~~A-,s1 ~e~cVc~. `I £~~`i 9k~v ~) jSfL 3 ~ ~ 4~&~'~1 ,`coC~~ ~ ~3/CN ~UCIIIL 3«= ~k~',d ~ ~ lo c~r- ~3«= e3r~J ~ o~IC. ~() St-~ I:~ ~, ~p t~~/C. S~ ri-~. 2~ t~k~ ~ 2. 7'~7 `-`/. c!2~ I)? ~; .- !2It~ i T 14- V - i~I `~ - LL~~~__________ /-~ -,., ,~i -- ~iii~I,~ - 9~ ~ ~- 2_ / I ~) ~cr- ~ ~?o Out. ~t -5L E/~'~ /°~` ôC'C-~ ~ /&&(i//C 3 ~L 2!iii P z 11271 t~t~ ~ ~ ~ic ~`- / J~~) / L~ ~ 50 5~7 *~L~ ~ ~i3 ~ 1W )~ 1~C (~L/(-- L : LJc~L~:~ k~$~?) flATION PWEssu:E:o~puT*TioN; J~( ,f. 1. )`~If7T~,J bVi f ~~V~i?~ii/ ;w~ Cs- I -ç V /0 /`iT5Y~ H? Eli ~iJ /1 ~I ii 5~~I C)! ()I/-~ I -:`j-;~j~~, (~1~ ~ 9-1-r~ 2e:~«='J c~'m LJ~ I t ,-~ `I I I-," 11)7 0/1 isif "-`S ,~ 7 I-. PAGENO="0626" 622 APPX SCALE S Miles March 28, 1979 4:30 p.m. Plume in a N to NE direction, about 3O~ sector. Primarily Xe-133. At distance of about 16 miles, radiation measurements in the plume were about 0.1 mr/hr. PAGENO="0627" 623 A~PX SCALE 5 Miles March 28, 1979 8:00 p.m. Plume in a N to NW direction. Primarily Xe-133. Over Harrisburg, radiation measurements in the plume showed about 0.1 mr/hr. At 10 miles from the site, the plume was about 4-5 miles wide; top of plume at about 3000 feet. PAGENO="0628" APPX SCALE S Miles 1979 10:45 e.m. Plume in e N to NW direction. Primerily Xe-133. Redietion measurements in the plume et ebout 10 miles from plant in centerline of plume were 0.2 mr/hr; et 1 mile from plent, about 0.5 mr/hr meximum. 624 Narch 29, PAGENO="0629" 625 March 29, 1979 5:00 p.m. A Residual cloud (Xe-l33) N to NW between Mechanicsburg `~ and Hershey, Pennsylvania. Radiation neasurements in the cloud in the microroentgenho ~ highest readings in cloud center. J3 Ground level measurements on the island indicated a plume in the southerly direction. Radtation measurements at fenceline south of plant were ~ and one-half mile south of fenceline, ~ PAGENO="0630" 626 APPX SCALE 5 Mi 1 es March 29, 1979 8:00 p.m. Survey aircraft circled the site at distance of about 8 miles at altitude of 1000 feet. No detectable plume; `pockets" of residual radioac~yib~ were detected with radiation readings in the range of of 25 - 50 microroentqens/hour. PAGENO="0631" 627 A~'PX SCALE 5 -`- Miles March 29, 1979 1Q:30 p.m. Plume in a NW direction, width about equal to width of river. Plume touches down about 1 mile from plant at Hill Island. Radiation measurements at east shore line at Hill Island, j~~j~; one mile north of Hill Island, j~j~r; and at five miles from the plant, 25-50 microroen~gens/hr. PAGENO="0632" 628 PAGENO="0633" 629 Li ,4,QFnS DI4TA rimE Z3o -~;~o 1'v~t k~E-,4r~#t~: I?C-,flg~1~~ ,/WS1c~ SG»=UA1-~ PAGENO="0634" 630 tX 3/~ ,q~q ~71K/'1& tfr FIç~ht ~ - L)e*&(e-r : &;-~~;,~ -Witd PAGENO="0635" 631 OFFSITE GROUND LEVEL GAMMA SURVEYS performed in the predominant wind direction showed a maximum of 0.6 mr/hr at 500 yards from the plant to a low of 0.06 mr/hr at distances of 2 to 3 miles. An exception was during the collection of a sample from the waste gas decay tank when gamma levels of 3 mr/hr were measured at a distance of 500 yards east of the plant. PAGENO="0636" 632 April 1, 1979 AERIAL SURVEY plume direction and radiation readinga ahown above conducted at 6:00 AN. - PAGENO="0637" 633 Attachment (2) April 1, 1979 AERIAL SURVEY plume direction arid radiation readings shown above conducted at 9:00 AN. PAGENO="0638" 634 - ,4n~ XsJQ~~ ~)`-~ ~ *~YOy,~ 4o~ce~c~ c~~'~'fl ~ The ~ ~7ø~ m~. ~e, ~ ~.`;s a..I~ou~t )~ ~1e ~ ~ ~ fy &.t (oo ~ PAGENO="0639" 635 PAGENO="0640" 636 s9ERIAL sup ygy /2001,r«= `/Ji/~q )~-r~1c~~ 27o°-2W° 0F O~oo ~1r*. PAGENO="0641" 637 Question 10. Is it correct that there were about sixty people in the control room during the early stages of the accident? Are there any operating procedures which should have prevented this congestion? ANSWER At the start of the accident, a normal shift complement (3 to 4) was present in the control room. The number of people estimated to be in the control room between 8 and 9 a.m. grew to 20 to 30. Several days into the accident, when the plant was in a severely degraded con- dition, the number of people in the control room exceeded 80 during some periods. There were instances in which the control room had to be cleared in order for the operators to carry out their responsibilities. As a result of the TMI-2 experience, the Lessons Learned Task Force within the Office of Nuclear Reactor Regulation, expects in the very near future to recommend the adoption of the following position: The licensee shall make provisions for limiting access to the control room to those individuals responsible for the direct operation of the nuclear power plant (e.g., operations supervisor, shift supervisor and control room operators), such technical advisors as may be requested to support the operation and appropriate NRC representatives. Provisions shall include the following: 1. Develop and implement an administrative procedure which establishes the authority and responsibility of the person in charge of the control room to limit access, t.e., permission must be obtained for entry into the control room. 2. Develop and implement procedures which establish a clear line of authority and responsibility in the control room in the event of an emergency. The line of succession for the person in charge of the control room shall be established and limited to persons possessing a current senior reactor operator's license. 48-721 0 - 79 - 41 PAGENO="0642" 638 Question 11. We gather that it was nearly three hours after the accident before the plant operators recognized that they had a major problem on their hands. Please explain how this can be true. ANSWER The operators did not realize they had a major problem on their hands until the first radiation monitor alarm came on, approximately three ~ours into the event. Until that time, they apparently recognized indica~ions of plant conditions which were beyond the scope of training they had uidergone. Knowing what we now know, it is possible to fault their performance, but considering the nature of their previous training, the actions taken by the operators early in the event are reconcilable with the situation they perceived. Later in the event, and before the three hour time frame indicated in the question, it should have been possible for the larger variety of expertise becoming available to the operations decision makers to recognize and correct the problems. Historically, training programs have emphasized certain parameters as being of importance and have attached specific precautions attendant to those parameters. Hence, the operatbrs' apparently emphasized attempts to control pressurizer level in an effort to prevent going "water-solid". Throughout the first few hours the variety of parameter values displayed to the operator caused some confusion about whether the situation was degrading or, in fact, stabilizing. When the radiation alarms came on, the answer became obvious, and a site emergency was declared. Question 12. What type of audio device was used to listen to the steam generators? Would television cameras, at appropriate locations, have been of any benefit? ANSWER Operators have stated in Interviews in reconstructing the sequence of events that they were able to hear the initial flow of auxiliary feedwater into the steam genera~~rs on the vibration and loose parts monitoring system. This system has transducers (accelerorneters)mounted on the steam generator shell very near the top and bottom tube sheet. These accelerometers, along with others mounted on the reactor vessel, were used later in the accident as part of the "noise diagnostics" monitoring effort related to assessing cooling conditions in the reactor system. Television cameras, while not useful in monitoring the steam generators - or other internals of the reactor cooling system, may have been useful in determining such things as the containment water level. Whether or not television cameras could have survived the severe environmental conditions in the containment building for a sufficient length of time to provide a useful monitoring service is a subject requiring further study. PAGENO="0643" 639 Question 13. Why did the control room operators put on protective masks? At what time did they put on these masks? Why did the masks donned by the operators make communications difficult? What type of communications system is used by the operators when they are wearing masks? ANSWER - At or about 10:17 a.m., March 28, 1979, control room personnel went into protective masks at the instruction of a health physicist. Just prior to this action, a radiation detector in the air intake to the control room showed an increase. The detector Is sensitive to particulates, noble gases and iodines. Prompted by this indication, the health physicist counted an air sample using a GM counter and very conservatively concluded that radioactive particulates were above the procedural limit for using protective masks against airborneparticulates. Spectral analysis of an air sample was not feasible because of high background activity in the plant counting room. The masks used at TMI-2 had no provisions for voice amplification. Verbal communications are performed through the masks, although voice resolution is impaired. Practice communications with the masks on is considered valuable. Using the telephone with the masks on is more difficult because of the additional lost resolution. At times during the TMI-2 event, personnel removed the masks in order to more effectively use the telephone. Question 14. The testimony indicates that the valves for the auxiliary feedwater system were both closed about two days prior to the accident; is this correct? What was the exact time that they were closed, and what was the exact reason for closing them? ANSWER The investigation of the events leading up to the accident has not yet been completed, and the circumstances resulting In the closing of the auxiliary feedwater valves have not been completely determined. The valves were closed for a routine surveillancetest of the auxiliary feedwater system on the morning of March 26, 1979. In subsequent interviews, the maintenance personnel who performed the surveillance stated that the valves were opened after the surveillance test and the position of the valves was confirmed by checking the indication in the control room. The opening of these valves is not explicitly included as a step in the surveillance procedure, and a sign-off that the valves were re-opened is not required. No other subsequent closing of these valves has been identified In the interviews and investigation to date. PAGENO="0644" 640 Question 15. Is closure of both valves supposed to take place only when the plant is shut down? ANSWER There are no operating conditions ~allowed by the Technical Specifications under which both auxiliary feedwater injection valves could be closed. One of the two valves could be closed for up to 72 hours to allow for test, maintenance or repair. If not corrected within this time the reactor was to be placed in hot standby, i.e. at operating tempetature and pressure, but with the core subcritical. If not corrected within an additional 12 hours the reactor was to be placed In cold shutdown i.e., low pressure and temperature and subcritical. A general requirement of the technical Specifications would require the reactor to be in the hot shutdown mode within one hour and the cold shutdown mode within 30 hours if both valves were closed. Preliminary information indicates that the original test procedures properly implemented these requirements and specified the closure of one valve at a time during the surveillance test. However the procedure may have been revised to specify that both valves be closed. This revision may have been made to permit testing of the system even though valves In the cross over piping between the two Injection lines were leaking. Qt~estion 16. In light of the Three Mile Island accident and the very obvious deficiencies in plant design, what Is the NRC planning to do with regard to improving Internal design reviews to eliminate such deficiencies as major valves which have no indicator on the con- trol panel to indicate open/seated positions? (Other.design deficiencies seem to include water level indicators on the reactor vessel and reactor gas venting provisions). ANSWER The Comission has established within the Office of Nuclear Reactor Regulation (NRR) a Task Force to review the lessons learned from the Three Mile Island accident. One of the elements of the charter of this task force is to recomend to the Coninission any necessary changes in the licensing review process Including the Cormiission's regulations, the NRR Standard Review Plan and Regulatory Guides. The Task Force Is currently reviewing the information available from the Three Mile Island accident.. In the near future It will issue a report describing short term actions that are considered necessary for licensed reactors and for reactors which are currently under review and scheduled to be licensed in the near future. Several of these recoiiinendations will cover specific areas, such as, direct indication of certain valve positions, instrumentation to indicate the operating status of safety systems and a systems analysis to assess the type and design of additional instrumentation that could be added to assist reactor operation. This includes instrumentation which could be used to indicate water level in the reactor vessel. The potential benefits or drawbacks of making provisions for gas venting need further study before any conclusions are reached. The Task Force will then study the review process and make recomendations that may require longer implementation times for design improvements, hardware modifications, and revisions to the NRR licensing review procedures and methods. PAGENO="0645" 641 Question 17. On March 30, 1979, the NRC was not in contact with its field personnel during the morning hours. What action does the NRC plan to take to organize communication provisions for future emergencies? When will new provisions be available? What will they consist of? - ANSWER As an immediate effort toward improved early communications a Bulletir has been issued that requires licensees to notify NRC within one hour of the time a reactor is not in a controlled or expected condition of operation. The Bulletin also stated that when such notification is made, an open continuous communications channel shall be established and maintained with NRC. To facilitate the requested improvements, we h~v~ ~ad citrect dedicated tele-~ phones installed in the Control Room, reactor supervisors office and other locations at all operating nuclear power plants. These telephones will auto- matically ring at the NRC Headquarters Operation Center when the receiver is lifted off the telephone cradles. This system became operational on June 1, 1979, and is being tested to identify areas where additional features will be helpful and improvements can be made. It should be noted that this new communications system will allow Headquarters and Regional Operations Centers to handle simultaneous calls from a number of facilities. This will allow NRC to respond to simultaneous incidents. A second direct line, which will be dedicated to comunications concerning radiological and environmental information, will be installed at each of these operating facilities within the next few weeks. This will be a dial-up line with several extensions which will be used primarily for continuous communications during an incident. Other future actions to improve communications that are still under con- sideration include: 1. The need for alternate (to telephone) systems, such as satellite communication. 2. Additional mobile units to support NRC Inspection & Enforcement regional offices. 3. Air-transportable pods that contain monitoring & transmission equipment. Question 18, The NRC appears to be well equipped to respond to "design basis" conditions. Now that it is recognized that events can occur out- side the prepared "design basis", what action does the NRC plan to take to implement a broader approach to design of reactors in the future? ANSWER The NRC recognizes the need to corsider a broader approach to the design of reactors. The TMI-2 accident ir~olving design, equipment and human failures, demonstrated a combination of events that was clearly outside the design basis envelope and suggests the need to have additional capability and flexibility to respond to those events. The Lessons Learned Task Force will consider to what extent and for what purpose the licensing process should look beyond current design and operations requirements. Analyses may be required of accidents and transients with multiple failures, core uncovery scenarios and consequences, natural circulation core cooling, etc. It is possible that certain of these conditions would be absorbed into the design basis while others would be used to educate people, Including plant operational staff, to recognize and respond to the wide variety of event sequences that can occur in comparison to the finite set of design basis events. The Task Force expects to make recommendations in this regard within the next few months. PAGENO="0646" 642 QUESTION 19 Recognizing the human error at TMI, what action does the NRC plan to take to improve operator qualifications, training, re-training and re-certification? ANSWER We are presently in the process of preparing recommendations for Comiss~on approval that will address these items in question. Items under consi'er- ation include the following: increasing the educational and experience requirements for an individual to be administered a license examination; specifying the training requirements in more detail; administering NRC examinations at different phases of the training, as well as at the conclu- sion of the training; and requiring more simulator training. In addition, we are considering increasing the scope of our operator licensing examinations as well as increasing the passing grade. There will also be more active involvement in the facility-administered requalification programs. Question 2c1. Is the NRC properly staffed, not in number, but in talent, to provide more effective regulation with respect to nuclear power safety? ANSWER The NRC staff is composed of engineers and scientists for all the major disciplines and with a range of experience in nuclear power plant design, analysis, md operation. In addition the NRC has at its disposal the resources of the n~cional laboratories and other consultant specialists through its research and technical assistance programs. The current staff composition has evolved in accordance with the NRC's regulatory role and prior to the TMI-2 accident was thought to be adequate to fulfill its mission. In light of the TMI-2 accident, changes in the mission and additional emphasis in certain areas; e.g., operations and accident response, are likely to be required, and staff resources would need to be increased. QUESTION 21 The TMI plant was operated with the auxiliary feedwater valves locked closed and this was "operation in violation of technical specifications." List all other operations of the TMI plant, prior to the accident, that were in violation of any operating procedures or specifications. ANSWER The Technical Specifications for TMI-2 require reporting of a variety of situations and events which appear to be in the category of "operations. . . in violation of operating procedures or specifications." These reports include a "Licensee Event Report (LER)" which describes the event, its cause if known, and a description of how the situation was resolved. Attached is a copy of a computer printout of a tabulation of those LER5 on ThI-2 up to the date of the accident which could be considered in the category of such operations. PAGENO="0647" JUN 21, 1979 Attachment to Answer to Question 21 LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2 FROM 1969 TO THE PRESENT OUTPUT SORTED BY EVENT DATE DOCKET NO.1 EVENT DATE/ LER NO./ REPORT DATE/ EVENT DESCRIPTION/ CONTROL NO. REPORT TYPE CAUSE DESCRIPTION FACILITY/SYSTEM, COMPONENT/COMPONENT SUBCODE/ CAUSE/CAUSE SUBCODE/ COMPONENT MANUFACTURER THREE MILE ISLAND-2 05000320 020878 GAS RA.DIOACT WSTE MANAGMNT SYS 78-OO1/03L-0 022878 COMPONENT CODE NOT APPLICABLE 020998 30-DAY SLJBCOMPONENT NOT APPLICABLE DESIGN/FABRICATION ERROR CONSTRUCTION/INSTALLATION ITEM NOT APPLICABLE THREE MILE ISLAND-2 FIRE PROTECTION SYS + CONT COMPONENT CODE HOT APPLICABLE SUBCOMPONENT NOT APPLICABLE PERSONNEL ERROR LICENSED & SENIOR OPERATORS ITEM NOT APPLICABLE THREE MILE ISLAND-2 OTHR INST SYS NOT REQD FR SFTY INSTRUMENTATION + CONTROLS SENSOR/DETECTOR/EL EMENT PERSONNEL ERROR LICENSED & SENIOR OPERATORS ITEM NOT APPLICABLE THREE MILE ISLAND-2 REACTOR VESSEL INTERNALS INSTRUMENTATION + CONTROLS SENSOR/DETECTOR/ELEMENT DEFECTIVE PROCEDURES, NOT APPLICABLE ITEM NOT APPLICABLE DURING INITIAL FUEL LOADING, A SURVEILLANCE (REQUIRED BY T.S. 4.9.9, AND 4.3.3.1 TABLE 4.3.3 ITEM 2.B.1.A AND 2.B.IIA) INDICATED THAT THE REACTO R BUILDING PURGE SUPPLY FANS AND ASSOCIATED PURGE RECIRCULATION DAMPER S YSTEM, WERE INOPERABLE. THIS EVENT PRODUCED NO EFFECT ON THE HEALTH AND SAFETY OF THE PUBLIC. INCOMPLETE CONSTRUCTION. REACTOR BUILDING PURGE FANS AND DAMPERS COULD NOT BE DEMONSTRATED OPERABLE. DO NOT OPERATE TAGS WERE PLACED ON CONTAI NMENT PURGE AND EXHAUST VALVES. AFTER COMPLETION OF CONSTRUCTION SURVEI LLANCE TESTING WILL BE RUN. UNTIL THEN CONTAINMENT PURGE VALVES AND EXU AUST PENETRATIONS WILL REMAIN CLOSED. WHILE IN MODE 116 IT BECAME EVIDENT THAT A CONTINUOUS FIRE WATCH (AS REQU IRED BY T.S. 3.7.10.3) WAS NOT ESTABLISHED, WHEN THE CABLE ROOM HALON SY STEM'S AUTOMATIC ACTUATION FEATURE WAS RENDERED INOPERABLE TO ALLOW CONS TRUCTION WELDING. THIS EVENT PRODUCED NO EFFECT ON THE HEALTH AND SAFET Y OF THE PUBLIC. MISINTERPRETATION BY PORC AND SHIFT SUPERVISOR. ASSUMED HALON SYSTEM OP ERABLE BUT AUTOMATIC ACTUATION FEATURE WAS DE-ENERGIZED. THUS FIRE WATC H NOT ESTABLISHED WHILE AUTOMATIC ACTUATION DEFEATED. SYSTEM REENERGIZE D. PERSONNEL INSTRUCTED. AFTER INITIAL FUELING DISCOVERED 2 FUEL ASSEMBLIES WERE LOADED INTO THE REACTOR VESSEL WITHOUT HAVING SOURCE RANGE AUDIBLE COUNTS IN THE CONTAIN MENT BUILDING AS REQUIRED BY T.S. 3.9.2. BOTH VISUAL AND AUDIBLE COUNTS OBSERVED IN CONTROL ROOM AND CONTROL ROOM PERSONNEL Ill COMMUNICATION WI TH PERSONNEL IN REACTOR BUILDING. NO EFFECT ON PUBLIC HEALTH AND SAFETY. AUX IN-CORE NEUTRON DETECTORS REMOVED TO LOAD FINAL 2 FUEL ASSEMBLIES. THESE PROVIDED AUDIBLE COUNT RATE INDICATION INSIDE CONTAINMENT. SINCE AUDIBLE COUNT RATE INDICATION IN REACTOR BUILDING IS REQUIRED AT ALL TIM ES IN MODE 06, AUDIBLE INDICATION PROVIDED BY PERMANENTLY INSTALLED OUT- OF-CORE DETECTORS. AFTER INITIAL FUELING IT WAS DETERMINED THAT CORE ALTEERATIONS, INSERTIO N OF INCORE DETECTORS, HAD BEEN MADE WHEN CONTAINMENT INTEGRITY HAD BEEN BROKEN AND WHILE DIRECT COMMUNICATIONS WITH THE CONTROL ROOM WERE NOT M AINTAINED. SINCE THE FUEL WAS UNIRRADIATED AND NO ACTIVITY WAS RELEASED THERE WAS NO ADVERSE EFFECT TO THE HEALTH AND SAFETY OF THE PUBLIC. 05000320 021378 78-003/OIT-0 022778 023077 2-WEEK 05000320 021478 78-O04/OIT-0 022778 023078 2-WEEK 05000320 78-006/0 1T-0 020986 021778 030278 2-WEEK PRIOR TO INSERTION OF INCORE DETECTORS IT WAS NOT RECOGNIZED THAT THIS E VOLUTION FELL WITHIN THE DEFINITION OF CORE ALTERATIONS. TO PREVENT PUT URE RECURRENCE, SHIFT PERSONNEL INSTRUCTED THAT INCORE MOVEMENTS CONSTIT UTE CORE ALTERATIONS. FUELING PROCEDURES WILL BE MODIFIED. PAGENO="0648" JUN 21, 1979 FACILITY/SYSTEM' COMPONENT/COMPONENT SUBCODE/ CAUSE/CAUSE SUBCODE/, COMPONENT MANUFACTURER THREE MILE ISLAND-2 FIRE PROTECTION SYS + CONT PENETRATIONS,PRIMRY CONTAINMNT ELECTRICAL DESIGN/FABRICATION ERROR CONSTRUCTION/INSTALLATION ITEM NOT APPLICABLE THREE MILE ISLAND-2 REAC COOL CLEANUP SYS + CONT VALVES OTHER DEFECTIVE PROCEDURES NOT APPLICABLE ITEM NOT APPLICABLE THREE MILE ISLAND-2 CNTNMNT'HEAT REMOV SYS + CONT PUMPS OTHER PERSONNEL ERROR LICENSED & SENIOR OPERATORS ITEM NOT APPLICABLE LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2 FROM 1969 TO THE PRESENT OUTPUT SORTED BY EVENT DATE DOCKET NO./ EVENT DATE' LER NO./ REPORT DATE/ CONTROL NO. REPORT TYPE 05000320 022478 78-008/03L-0 032578 021001 30-DAY SEALS WERE BREACHED DURING COMPLETION OF CONSTRUCTION. FIRE WATCH WAS P OSTED AND SEALS RETURNED TO FUNCTIONAL STATUS. CONSTRUCTION PERSONNEL H AVE BEEN INSTRUCTED AS TO THE NEED TO COMPLY WITH THE REQUIREMENTS OF TE CH SPEC RELATIVE TO FIRE BARRIER SEALS. CONTRARY TO TECHNICAL SPECIFICATION 4.0.5 WHICH INVOKES ASME SECTION XI TESTING FOR CODE CLASS 1, 2, AND 3 PUMPS AND VALVES, THE RIVER WATER PUM P OUTLET AND PRELUBE VALVES, AND THE REDUNDANT RCP SEAL INJECTION VALVES HAD NOT BEEN FUNCTIONALLY TESTED BEFORE THEIR RESPECTIVE SYSTEMS HAD BE EN PLACED IN SERVICE. PRELUBE AND REDUNDANT SEAL INJECTION VALVES WERE NEWLY IDENTIFIED AS BEI HG WITHIN ISI SCOPE HAVING BEEN ADDED BY DESIGN CHANGES. RIVER WATER PU MP OUTLET VALVES NOT INCLUDED IN ORIGINAL IS! SUBMISSION DUE TO MISINTER PRETATION OF THEIR OPERATION. THESE VALVES HAVE BEEN INCORPORATED INTO IS! `PROCEDURES AND TESTED.' 031178 T.S. 3.6.1.3 VIOLATED. ENTERED MODE 4 WITHOUT PROPERLY ESTABLISHING CON 040778 TAINMENT INTEGRITY. SURVEILLANCE ON R.B. DOOR SEALS NOT PERFORMED WITHI 30-DAY N PREVIOUS 72 HOURS. All CONTAINMENT AIR LOCK DOORS WERE IMMEDIATELY TE STED. RB. PERSONNEL HATCH INNER DOOR FAILED TO MEET LEAKAGE ACCEPTANCE CRITERIA. SINCE UNIT HAD NOT YET GONE CRITICAL NO EFFECT ON HEALTH AND SAFETY OF PUBLIC. SURVEILLANCE PROCEDURE NOT SPECIFIC ENOUGH TO IDENTIFY THAT R.B. DOOR `SE AL LEAKAGE TEST MUST BE MET TO BOTH ESTABLISH AND MAINTAIN CONTAINMENT I NTEGRITY. INNER DOOR FAILED DUE TO DAMAGED 0 RING SEALS. THE 0 RING WA S REPLACED AND INNER DOOR RETESTED SATISFACTORILY. PROCEDURES WERE CHAN GED TO CLARIFY TESTING REQUIREMENTS. ENTERED MODE 4 WITH ONLY ONE OPERABLE BUILDING SPRAY SYSTEM SINCE SURVEI LLANCE ON BUILDING SPRAY PUMP 1A WAS NOT CURRENT WITHIN THE LIMITS OF TE CH SPEC 4.0.2.A, 4.0.2.0 AND 4.6.2.1.0. PUMP IA WAS PREVIOUSLY TESTED 5 ATISFACTORILY AND WAS AGAIN TESTED SATISFACTORILY FOLLOWING THIS EVENT. NO EFFECT ON THE HEALTH AND SAFETY OF THE PUBLIC. CLERICAL ERROR. DATE WHICH MUST BE USED TO DETERMINE IF A SURVEILLANCE IS CURRENT IS THE EARLIEST DATA DATE AND NOT THE DATE THE SURVEILLANCE W AS COMPLETED. THE DATE SURVEILLANCE WAS COMPLETED WAS RECORDED ON THE M ODE 4 CHECKLIST. OPERATIONS PERSONNEL WILL BE REINSTRUCTED.. EVENT DESCRIPTION/ CAUSE DESCRIPTION DURING MODE 5, WHILE PERFORMING FINAL TURNOVER INSPECTIONS, IT WAS DETER MINED THAT THREE FIRE PENETRATION SEALS WERE NOT FUNCTIONAL, PER T.S. 3. 7.11. BECAUSE THERE WAS NO FIRE AT THE TIME, AND BECAUSE A FIRE WATCH W AS IMMEDIATELY POSTED, THIS EVENT PRODUCED NO ADVERSE IMPACT ON THE HEAL TN AND SAFETY OF THE PUBLIC. 05000320 030778 78-010/03L-0 040478 021003 30-DAY THREE MILE ISLAHD-2 , 05000320 CHTNMNT ISOLATION SYS + CONT 78-011/03L-0 PENETRATIONS,PRIMRY CONTAINMNT 021004 PERSONNEL ACCESS * DEFECTIVE PROCEDURES NOT APPLICABLE PITTSBURGH-DES MOINES STEEL CO 05000320 031478 78-012/03L-0 041078 021005 30-DAY PAGENO="0649" FACIL ITY/SYSTEM/ COMPONENT/COMPONENT SUBCODE/ CAUSE/CAUSE SUBCODE/ COMPONENT MANUFACTURER THREE MILE ISLAND-2 EMERG GENERATOR SYS + CONTROLS ENGINES,INTERNAL COMBUSTION SUBCOMPONENT NOT APPLICABLE PERSONNEL ERROR CONSTRUCTION PERSONNEL ITEM NOT APPLICABLE THREE MILE ISLAND-2 EHGNRD SAFETY FEATR INSTR SYS PUMPS OTHER DESIGN/FABRICATION ERROR DESIGN ITEM HOT APPLICABLE THREE MILE ISLAND-2 REACTIVITY CONTROL SYSTEMS COMPONENT CODE HOT APPLICABLE SUBCOMPONENT HOT APPLICABLE PERSONNEL ERROR LICENSED & SENIOR OPERATORS ITEM HOT APPLICABLE THREE MILE ISLAND-2 SAFETY RELATED DISPLAY INSTR INSTRUMENTATION + CONTROLS POWER SUPPLY PERSONNEL ERROR LICENSED & SENIOR OPERATORS ITEM HOT APPLICABLE EVENT DESCRIPTION.' CAUSE DESCRIPTION B DIESEL GEN TAGGED OUT OF SERVICE 1445 FOR MAINTENANCE. REDUNDANT DIES EL GEN NOT DEMONSTRATED OPERABLE UNTIL 1805. ADDITIONALLY BREAKER ALIGN MENT REQUIRED BY TECH SPEC 4.8.1.I.1.A NOT PERFORMED UNTIL 1805. NO EFF ECT ON HEALTH AND SAFETY OF PUBLIC. INADEQUATE REVIEW OF TECH SPEC 3.8.1.l.B AND ASSOCIATED ACTION STATEMENT SUCCESSFULLY TESTED REDUNDANT DIESEL GENERATOR AND VERIFIED BREAKER A LIGNMENT IN ACCORDANCE WITH TECH SPEC. PERSONNEL WILL BE INSTRUCTED. IN MODE 3 PERFORMING BUS VOLTAGE VERIFICATION AND OPTIMIZATION STUDY TWO INDEPENDENT NUCLEAR RIVER WATER LOOPS WERE NOT OPERABLE T.S. 3.7.4.1. TWO NUCLEAR RIVER WATER PUMPS IN ONE LOOP COULD NOT BE STARTED. BECAUSE A REDUNDANT LOOP WAS AVAILABLE THIS EVENT PRODUCED NO ADVERSE EF FECTS OH HEALTH AND SAFETY OF THE PUBLIC. THE BURNING OUT OF A SUPERVISORY LIGHT BULB ALLOWED A "SNEAK" CURRENT PA TN TO BE INTRODUCED, PREVENTING RELAYS FROM DE-ENERGIZING AND PREVENTED BOTH NUCLEAR RIVER WATER PUMPS IN A LOOP FROM OPERATING. THE BURNED-OUT LIGHT BULB WAS REPLACED. NUCLEAR RIVER WATER PUMP CIRCUIT DESIGNS WILL BE REVIEWED. WHILE IN MODE 4, IT WAS DETERMINED ONLY ONE BORON SOURCE FLOW PATH VERIF lED OPERABLE PRIOR TO MODE 4 ENTRY, THUS VIOLATING 1.5. 4.1.2.2.B. BECA USE THE VALVE LINEUP FOR THE REQUIRED SECOND FLOW PATH WAS FOUND TO BE U NCHANGED FROM THE PREVIOUS SURVEILLANCE PERFORMANCE, THIS EVENT POSED NO THREAT TO THE HEALTH AND SAFETY OF THE PUBLIC. CLERICAL ERROR. SURVEILLANCE PERFORMED IN ACCORDANCE WITH MODE 5 REQUIR EMENTS. SECOND SURVEILLANCE DONE IN ACCORDANCE WITH MODE 4 REQUIREMENTS PERSONNEL WILL BE INSTRUCTED CONCERNING NEED TO REFERENCE PROCEDURE D ATA SHEETS AND VERIFY CURRENT VALVE LINEUP. IN MODE 3 FAILURE OF AN AMPLIFIER PRODUCED ERRONEOUS READINGS ON ABSOLUT E CONTROL ROD POSITION INDICATOR FOR ROD 5 OF GROUP 8. POSITION OP CONT ROL ROD WAS DETERMINED FROM PULSE STEPPING POSITION INDICATOR AND ZONE R FERENCE INDICATION. MODE 2 ENTERED CONTRARY TO 1.5. 3.0.4. NO ADVERSE EFFECTS ON HEALTH AND SAFETY OF PUBLIC. INCORRECT INTERPRETATION OF T.S. 3.1.3.3.A.2 LED TO VIOLATION OF T.S. 3. 0.4. APPROPRIATE STATION PERSONNEL WILL BE INSTRUCTED AS TO THE CORRECT INTERPRETATION OF T.S. JUN 21, 1979 LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2 FROM 1969 TO THE PRESENT OUTPUT SORTED BY EVENT DATE DOCKET NO./ LER NO.1 CONTROL NO. 05000320 78-013/0 IT-B 021006 EVENT DATE.' REPORT OATE/ REPORT TYPE 031578 032770 2-WEEK 05000320 032278 78-016/011-0 040578 021008 2-WEEK 05000320 032578 78-023/03L-0 042478 021278 30-DAY 05000320 032878 78-019/O1T-0 040578 021009 2-WEEK PAGENO="0650" JUN 21, 1979 FACILITY/SYSTEM/ COMPONENT/COMPONENT SUBCODE/ CAUSE/CAUSE SUBCODE/ COMPONENT MANUFACTURER THREE MILE ISLAND-2 RESIDUAL HEAT REMOV SYS + CONT VALVES NOZZLE COMPONENT FAILURE MECHANICAL ASSOCIATED CONTROL EQUIPMENT THREE MILE ISLAND-2 MAIN STEAM SYSTEMS + CONTROLS VALVES OTHER DESIGN/FABRICATION ERROR CONSTRUCTION/INSTALLATION ITEM NOT APPLICABLE THREE MILE ISLAHD-2 AC ONSITE POWER SYS + CONTROLS ENGINES,INTERNAL COMBUSTION SUBCOMPONENT NOT APPLICABLE OTHER NOT APPLICABLE ITEM NOT APPLICABLE THREE MILE ISLAND-2 CNTNMNT ISOLATION SYS + CONT INSTRUMENTATION + CONTROLS SWITCH OTHER NOT APPLICABLE ITEM NOT APPLICABLE EVENT DESCRIPTION/ CAUSE DESCRIPTION WHILE IN MODE 5, WHILE PERFORMING SPAS TESTING, A NUCLEAR SERVICE CLOSED COOLING VALVE (NS-V83B) FAILED TO OPEN, THUS VIOLATING T.S. 3.7.3.1. B ECAUSE THE UNIT WAS IN COLD SHUTDOWN (MODE 5) AND THE SYSTEM WAS NOT REQ UIRED, THIS EVENT POSED NO THREAT TO THE HEALTH AND SAFETY OF THE PUBLIC THIS EVENT WAS CAUSED BY THE MALFUNCTION OF THE SOLENOID OPERATED PILOT VALVE. THIS SOLENOID OPERATED PILOT VALVE WAS REPAIRED AND RETURNED TO SERVICE. IN MODE I REACTOR TRIPPED FROM 30Z R.T.P. RCS RAPIDLY COOLED DOWN AND D EPRESSURIZED. DURING DEPRESSURIZATION, SAFETY INJECTION WAS INITIATED. RCS AND PRESSURIZER COOLDOWN RATES WERE EXCEEDED (T.S. 3.4.9.1 AND 3.4. 9.2). PRESSURIZER VOL BELOW LIMITS OF T.S. 3.4.4). CALCULATIONS AND RA DIOCHEMISTRY SHOW THAT CORE REMAINED COVERED AT ALL TIMES AND NO RELEASE OF RADIOACTIVE MATERIAL RESULTED. FOLLOWING RX TRIP, MAIN STEAM RELIEF VALVES DID NOT RESEAT AT CORRECT PR ~. ESSURE. FEEDWATER SYSTEM RESPONSE SLOW SINCE INITIAL INTEGRATED CONTROL C~) SYSTEM TESTING STILL IN PROGRESS. COMBINATION OF RELIEF VALVES FAILING TO RESEATAND CONTINUING TO FEED STEAM GENERATORS RESULTED IN RAPID DEP RESSURIZATION AND COOLDOWN. RVS WILL BE TESTED. IN MODE 5, DURING MONTHLY SURVEILLANCE TESTING OF THE "B" DIESEL-GENERAl OR, DIESEL TRIPPED DUE TO HIGH CRANKCASE PRESSURE AFTER RUNNING FOR APPR OXIMATELY 32 MINUTES. T.S.4.8.1.1.2.A.5 REQUIRES A DIESEL BE DEMONSTRAT ED OPERABLE BY RUNNING FOR 60 MINUTES OR MORE. BECAUSE IN MODE 5 AND 01 HER DIESEL OPERABLE, EVENT POSED NO THREAT TO HEALTH & SAFETY OF PUBLIC. DIESEL GENERATOR WAS CHECKED FOR ANY ABNORMAL PARAMETERS BUT NONE WERE F OUND. THE DIESEL WAS RESTARTED AND SUCCESSFULLY PASSED SURVEILLANCE. I N ADDITION, CALIBRATION OF CRANKCASE PRESSURE SWITCHES WILL BE CHECKED A ND AIR EJECTOR WILL BE INSPECTED. PERFORMING MONTHLY REACTOR BUILDING ISOLATION AND COOLING/SAFETY INJECTI ON SURVEILLANCE, THE SETTING OP BS-PS-3260 GREATER THAN ALLOWABLE VALUE OF SPEC 3.3.2.1 BY 0.02 PSIG. SINCE REDUNDANT PRESSURE SWITCHES AVAILAB LE AND WITHIN CALIBRATION, NO EFFECT ON HEALTH AND SAFETY OF THE PUBLIC. BS-PS-3260 ERROR CAUSED B INSTRUMENT DRIFT DURING SURVEILLANCE TIME FREQ UENCY. CORRECTIVE ACTION TAKEN BY ADJUSTING PRESSURE SWITCH TO A VALUE BELOW THE TECHNICAL SPECIFICATION TRIP SETPOINT. NO FUTURE ACTION REQUI RED SINCE MONTHLY SURVEILLANCE WILL BE PERFORMED AS REQUIRED. LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2 FROM 1969 TO THE PRESENT OUTPUT SORTED BY EVENT DATE DOCKET NO./ EVENT DATE/ LER NO./ REPORT DATE/ CONTROL NO. REPORT TYPE 05000320 040478 78-024/03L-0 050478 021277 30-DAY 05000320 042378 78-033/011-0 050878 021273 2-WEEK 05000320 042578 78-037/03L-0 052578 021609 30-DAY 05000320 051278 78-038/03L-0 061278 021608 30-DAY PAGENO="0651" JUN 21, 1979 FACILITY/SYSTEM/ COMPONENT/COMPONENT SUBCODE/ CAUSE/CAUSE SUBCODE/ COMPONENT MANUFACTURER THREE MILE ISLAND-2 FIRE PROTECTION SYS + CONT COMPONENT CODE HOT APPLICABLE SUBCOMPONEHT NOT APPLICABLE DESIGN/FABRICATION ERROR CONSTRUCTION/INSTALLATION ITEM NOT APPLICABLE LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2 FROM 1969 TO THE PRESENT OUTPUT SORTED BY EVENT DATE EVENT DESCRIPTION/ CAUSE DESCRIPTION FLOOR FIRE BARRIER PENETRATION SEAL BETWEEN RELAY ROOM AND CONTROL ROOM DEFICIENT VIOLATING T.S. 3.7.11. NO CONDITION EXISTED WHICH REQUIRED TH E OPERABILITY OF THE FIRE SEAL. NO THREAT TO HEALTH AND SAFETY OF PUBLI C. IMPROPERLY CURED FOAM MATERIAL WAS USED TO MAKE THE SEAL. CONTINUOUS Fl RE WATCH WAS POSTED. DEFICIENT BARRIER REPAIRED AND RETURNED TO FUNCTIO HAL STATUS. THREE MILE ISLAND-2 EMERG GENERATOR SYS + CONTROLS CIRCUIT CLOSERS/INTERRUPTERS CIRCUIT BREAKER DEFECTIVE PROCEDURES NOT APPLICABLE ITEM NOT APPLICABLE 05000320 063078 78-044/03L-O 072478 021936 30-DAY IN MODE 6, 6/29/78, AT 1430, A DIESEL GENERATOR PLACED IN EMERGENCY STAN DBY. 6/30/78 AT 1600, DISCOVERED BREAKER G2-1E2 NOT CLOSED WHEN A D.G. PLACED IN EMERGENCY STANDBY CONSTITUTING VIOLATION OF T.S. 3.8.1.2. UNI T IN MODE 6, AND NO CORE ALTERATIONS OR CHANGES IN REACTIVILTY WERE MADE THUS EVENT DID NOT EFFECT HEALTH AND SAFETY OP PUBLIC. PROCEDURE INADEQUACY. PROCEDURE REVISED TO ENSURE G2-1E2 CLOSED WHEN A DIESEL GENERATOR IS PLACED IN EMERGENCY STANDBY. APPROPRIATE PERSONNEL WILL BE INSTRUCTED ON PROCEDURE CHANGE. THREE MILE ISLAND-2 FIRE PROTECTION SYS + CONT COMPONENT CODE NOT APPLICABLE SUBCOMPONENT NOT APPLICABLE DESIGN/FABRICATION ERROR CONSTRUCTION/INSTALLATION ITEM NOT APPLICABLE THREE MILE ISLAND-2 CNTNMNT ISOLATION SYS + CONT VESS EL S , PR ESSURE CONTAINMENT/DRYWELL DESIGN/FABRICATION ERROR CONSTRUCTION/INSTALLATION ITEM NOT APPLICABLE 05000320 072478 78-048/03L-O 082278 022052 30-DAY 05000320 081278 78-050/OIT-O 082878 022389 2-WEEK DURING A FIRE BARRIER PENETRATION SEAL VERIFICATION INSPECTION, A WALL P ENETRATION WAS FOUND LACKING A FIRE BARRIER SEAL. THIS 12" X 6" PENETRA lION IS LOCATED IN THE SOUTH WALL OF THE SWITCHGEAR ROOM IN THE A EMERGE NCY DIESEL GENERATOR BUILDING. SINCE THIS FIRE BARRIER WAS NON-FUNCTION AL, IT CONSTITUTES A VIOLATION OF TECrI SPEC 3.7.11. LACK OF A FIRE BARRIER SEAL IN THIS PENETRATION WAS DUE TO AN OVERSIGHT ON THE PART OF THE CONTRACTOR. A CONTINUOUS FIRE WATCH WAS ESTABLISHED IN ACCORDANCE WITH TECH SPEC 3.7.11 PRIOR TO INSTALLING THE SEAL AND SUB SEQUENTLY A FIRE BARRIER SEAL WAS INSTALLED USING ANI APPROVED MATERIAL. DURING PERFORMANCE OP THE REACTOR BUILDING PERSONNEL AIRLOCK LEAK RATE T ESTING, THE OVERALL AIRLOCK LEAKAGE RATE EXCEEDED THAT ALLOWED IN THE UN IT'S TECHNICAL SPECIFICATIONS. ALTHOUGH THE UNIT WAS IN MODE 5 AT THE T IME OP THIS TEST, IT HAD ENTERED MODES 1 THROUGH 4 SINCE THE PRECEDING EAK RATE TESTS WERE PERFORMED IN DECEMBER, 1977, AND THUS CONSTITUTES A VIOLATION OF TECH. SPEC. 3.6.1.3.B. LEAKAGE WAS CAUSED BY A 1/4" HOLE DRILLED THROUGH THE AIRLOCK BULKHEAD D URING INSTALLATION OF SUPPORTS FOR THE ELECTRICAL CABLING. A MODIFICATI ON HAS BEEN MADE TO PLUG THE HOLE. THE AIRLOCK WILL THEN BE TESTED AND VERIFIED AS SATISFACTORY PRIOR TO ENTRY INTO MODE 4. DOCKET NO./ EVENT DATE/ LER NO./ REPORT DATE/ CONTROL NO. REPORT TYPE 05000320 060978 78-043/03L-0 071078 021980 30-DAY PAGENO="0652" FACILITY/SYSTEM/ COMPONENT/COMPONENT SUBCODE/ CAUSE/CAUSE SUBCODE/ COMPONENT MANUFACTURER THREE MILE ISLAND-2 REACTOR TRIP SYSTEMS COMPONENT CODE NOT APPLICABLE SUBCOMPONENT NOT APPLICABLE DEFECTIVE PROCEDURES NOT APPLICABLE ITEM NOT APPLICABLE THREE MILE ISLAMD-2 REAC COOL PRES BOWl LEAK DETEC COMPONENT CODE NOT APPLICABLE SUBCOMPONEHT NOT APPLICABLE PERSONNEL ERROR LICENSED & SENIOR OPERATORS ITEM NOT APPLICABLE THREE MILE ISLAND-2 OTHR INST SYS REQD FOR SAFETY COMPONENT CODE NOT APPLICABLE SUBCOMPONENT NOT APPLICABLE DEFECTIVE PROCEDURES NOT APPLICABLE ITEM HOT APPLICABLE THREE MILE ISLAHD-2 REACTIVITY CONTROL SYSTEMS COMPONENT CODE NOT APPLICABLE SUBCOMPONENT NOT APPLICABLE PERSONNEL ERROR RADIATION PROTECTION PERSONNEL ITEM NOT APPLICABLE LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2 FROM 1969 TO THE PRESENT OUTPUT SORTED BY EVENT DATE EVENT DESCRIPTION/ CAUSE DESCRIPTION PERFORMING PSEUDO DROPPED ROD TEST, TP 800/31, DISCOVERED NUCLEAR OVERPO WER TRIP SETPOIHT HOT VERIFIED WITHIN 8 HOURS PRIOR TO USING SPECIAL TES T EXCEPTION 3.10.1 OF THE TECH SPEC AS REQUIRED. SINCE TRIP SETPOIHTS W ERE VERIFIED BELOW 50i(, NO EFFECT ON PUBLIC HEALTH AND SAFETY. PROCEDUR E TO BE MODIFIED. PROCEDURE FOR PSEUDO ROD DROP TEST NOT DIRECT PERSONNEL TO IMPLEMENT T.S 3/4 10.1 PRIOR TO PERFORMING TEST; ONLY INFORMED THEM THEY WERE USING SPECIAL TEST EXCEPTION SECTION. TESTING SUSPENDED AND NUCLEAR OVERPOWER TRIP SETPOINTS VERIFIED WITHIN ALLOWABLE LIMITS. NUCLEAR HEAT FLUX AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTORS OK. PERFORMING SURVEILLANCE PROCEDURE 2301-3D1 ON 10/19/78 DETERMINED THAT CO ACTION B FOR TECH SPEC 3.4.6.2 HOT INVOKED WHEN SURVEILLANCE PROCEDUR E 2301-301 DATA OBTAINED AT 1935 ON 10/16/78 SHOWED UNIDENTIFIED LEAKAGE GREATER THAN I GPM (2.6 GPM ACTUAL). ALL LEAKAGE FROM RCS IS PROCESSED THROUGH RADWASTE TREATMENT SYSTEM AND EVENT DID NOT AFFECT PUBLIC HEALT H AND SAFETY. MISINTERPRETATION OF T.S. 3.4.6.2 AND 4.4.6.2 LED TO PERFORMANCE FREQUEN CY FOR SURVEILLANCE ABOVE THAT REQUIRED BY THE T.S. NOT CLEAR TO PERSON NEL WHICH SET OF DATA CAME WITHIN T.S. REQUIREMENT AND WHEN TIME REQUIRE MENTS OF ACTION STATEMENT WERE APPLICABLE. UNIDENTIFIED LEAKAGE SUBSEQU ENTLY REDUCED TO ALLOWABLE. IN MODE 3 HEATUP PROCEDURE 2102-1.1 WAS BEING PERFORMED WHICH REQUIRED C LOSING OF CRD BREAKERS. AFTER BREAKERS WERE CLOSED DETERMINED THAT INTE RMEDIATE RANGE NEUTRON FLUX AND RATE FUNCTIONAL SURVEILLANCE (2313-SU2) WAS NOT PERFORMED AS REQUIRED BY T.S. 4.3.1.1.1. INSTRUMENTATION WAS PR OVEN TO BE FUNCTIONAL AND EVENT DID NOT AFFECT PUBLIC HEALTH AND SAFETY. WHILE COMMENCING UNIT HEAT UP THE REQUIREMENT IN 2102-1.1 TO INSURE THAT 2313-SU 2 BE COMPLETED WAS INADVERTANTLY MISSED. UPON DETERMINATION OF THIS REQUIREMENT 2313-SU 2 WAS PERFORMED IMMEDIATELY WITH SATISFACTORY RESULTS. PROCEDURE 2102-1.1 WILL BE REVISED TO PREVENT RECURRENCE. ON 01-03-79 IN MODE I DETERMINED SURVEILLANCE PROCEDURE 2304-Wi BORATED WATER SOURCE VERIFICATION SCHEDULED FOR 0 1-02-79 HAD HOT BEEN PERFORMED. THIS IS A VIOLATION OF T.S. 4.1.2.9 AND 4.5.4. SINCE BWST WAS IMMEDIA TELY CHECKED AND FOUND WITHIN ALLOWABLE LIMITS, NO EFFECT ON PUBLIC HEAL TN AND SAFETY. BWST WAS IMMEDIATELY SAMPLED AND ANALYZED FOR REQUIRED CONCENTRATION. NSTRUCTIOH OF PERSONNEL ON SURVEILLANCE VERIFICATION TECHNIQUES HAS TAKE N PLACE TO ASSURE THAT THIS EVENT DOES NOT RECUR. JUN 21, 1979 DOCKET NO./ EVENT DATE/ LER NO./ REPORT DATE/ CONTROL NO. REPORT TYPE 05000320 100378 78-061/03L-0 110178 023079 30-DAY 05000320 101978 78-062/OIT-0 110178 023080 2-WEEK 05000320 120178 78-070/03L-0 122878 023426 30-DAY 05000320 010379 79-006/03L-0 013179 025008 30-DAY PAGENO="0653" JUN 21, 1979 FACILITY/SYSTEM, COMPONENT/COMPONENT SUBCODE/ CAUSE/CAUSE SUBCODE/ COMPONENT MANUFACTURER THREE MILE ISLAND-2 CNTNMNT HEAT REMOV SYS + CONT INSTRUMENTATION + CONTROLS INDICATOR PERSONNEL ERROR MAINTENANCE & REPAIR PERSONNEL ITEM NOT APPLICABLE THREE MILE ISLAND-2 ENGNRD SAFETY FEATR INSTR SYS INSTRUMENTATION + CONTROLS SWITCH OTHER NOT APPLICABLE BARTON INSTRU CO., DIV OF ITT THREE MILE ISLAND-2 STATION SERV WATER SYS + CONT COMPONENT CODE NOT APPLICABLE SUBCOMPONENT NOT APPLICABLE DEFECTIVE PROCEDURES NOT APPLICABLE ITEM NOT APPLICABLE THREE MILE ISLAND-2 RESIDUAL HEAT REMOV SYS + CONT COMPONENT CODE NOT APPLICABLE. SUBCOMPONENT NOT APPLICABLE DEFECTIVE PROCEDURES NOT APPLICABLE ITEM NOT APPLICABLE EVENT DESCRIPTION/ CAUSE DESCRIPTION ON 1/4/79 REVIEWING DATA COLLECTED DURING PERFORMANCE OF 2303-M7 ON 12/1 /78 DETERMINED REACTOR BUILDING PRESSURE HI-HI CHANNEL A FUNCTIONAL TEST NOT PERFORMED VIOLATING T.S. 4.3.2.1.1. SINCE RB PRESSURE HI-HI CHANNE A FUNCTIONAL TEST WAS PERFORMED SATISFACTORILY ON BOTH 11/10/78 AND 1/ 5/79 SYSTEM WAS NOT OPERATING IN DEGRADED MODE AND THERE WAS NO EFFECT 0 N PUBLIC HEALTH AND SAFETY. A SECTION OF SURVEILLANCE PROCEDURE 2303-M7 WAS INADVERTENTLY OMMITED BY TECHNICIAN WHO PERFORMED SURVEILLANCE ON 12/1/78. APPROPRIATE I&C PERS ONNEL WILL BE ADVISED OF THIS EVENT TO PREVENT A FUTURE RECURRENCE. DURING INSPECTION OF EQUIPMENT & CABLES IN CONTROL BUILDING AREA ON 1/17 /79 DISCOVERED SETPOINTS OF 2 FEEDWATER LINE RUPTURE DETECTION PRESSURE SWITCHES (FW-DPIS-7883-1 0 FW-DPIS-7883-2) OUTSIDE T.S. ALLOWABLE LIMITS SPECIFIED IN SECTION 3.3.2.1 (196 PSID VS 192 PSID). NO EVENT OCCURRED SUBSEQUENT TO OUT-OF-TOLERANCE CONDITION OF SWITCHES WHICH WOULD HAVE R EQUIRED THEM TO BE OPERABLE, AND SINCE VARIANCE FROM LIMIT WAS ONLY 2Z N O EFFECT ON PUBLIC HEALTH AND SAFETY. INSTRUMENT SETTINGS MAY HAVE CHANGED FROM INSTRUMENT DRIFT OR STEAM LEAK AGE. CALIBRATION OF THESE INSTRUMENTS WILL BE CHECKED IN FUTURE TO DETE RMINE DRIFT CHARACTERISTICS. PRESENT PLAN IS TO REPLACE SWITCHES DURING FEEDWATER ISOLATION MODIFICATION SCHEDULED FOR FIRST REFUELING. SWITCH ES RECALIBRATED AND TESTED SATISFACTORILY. IN MODE 5 TRAVELLING WATER SCREENS WERE FOUND INOPERABLE DUE TO SIGNIPIC ANT BUILD UP OF DEBRIS CAUSING A HIGH DIFFERENTIAL LEVEL ACROSS THE IDLE SCREEN SYSTEM. BECAUSE NO EVENT OCCURRED WHICH REQUIRED EMERGENCY USE OF RIVER WATER SYSTEMS AND BECAUSE SUFFICIENT FLOW TO THE RIVER WATER PU MP IN OPERATION AT THE TIME EXISTED, THIS EVENT DID NOT HAVE AN ADVERSE EFFECT ON THE HEALTH AND SAFETY OF THE PUBLIC. PROCEDURES DID NOT REQUIRE ONE OF THE SCREENS TO BE CONTINUOUSLY OPERABL E DURING PERIODS WHEN LARGE AMOUNTS OF DEBRIS ARE PRESENT IN THE RIVER. AFFECTED SCREENS WERE CLEANED AND RETURNED TO SERVICE. PROCEDURES TO B E CHANGED TO ENSURE AT LEAST ONE SCREEN REMAINS IN CONTINUOUS SERVICE DU RING PERIODS OF HIGH DEBRIS ON THE RIVER. PREPARING TO ENTER MODE 4 FOUND THAT SURVEILLANCE REQUIRED BY T.S. 3.1.2 I FOR MODE 5 HAD NOT BEEN PERFORMED AFTER MAKEUP PUMPS HAD BEEN TAGGED OUT SUBSEQUENT TO ENTRY INTO MODE 5. BECAUSE NO CORE ALTERATIONS WERE P ERFORMED OR POSITIVE REACTIVITY CHANGES MADE, THIS EVENT DID NOT HAVE AN ADVERSE EFFECT ON THE HEALTH AND SAFETY OF THE PUBLIC. LACK OF CLARITY IN THE SHUTDOWN PROCEDURE WHICH DID NOT ADEQUATELY SPECI FY PERFORMANCE OF THIS EVENT RELATED SURVEILLANCE. THE SURVEILLANCE PRO CEDURE WAS COMPLETED SATISFACTORILY AND UNIT ENTERED MODE 4. THE SHUTDO WN PROCEDURE: WILL BE REVISED TO CLARIFY NEED TO VERIFY VALVE LINE-UP FOR BORON INJECTION FLOW PATH WHILE IN MODE 5. LER OUTPUT ON PARTICuLAR EVENTS FOR THREE MILE ISLAND 2 FROM 1969 TO THE PRESENT OUTPUT SORTED BY EVENT DATE DOCKET NO./ EVENT DATE/ LER NO./ REPORT DATE/ CONTROL NO. REPORT TYPE 05000320 010479 79-001/03L-O 020179 025004 30-DAY 05000320 011779 79-008/03L-B 020979 025504 30-DAY 05000320 012679 79-0O7/03L-B 022679 025343 30-DAY 05000320 013079 79-009/03L-0 022679 025333 30-DAY PAGENO="0654" FACILITY/SYSTEM/ COMPONENT/COMPONENT SUBCODE/ CAUSE/CAUSE SUBCODE/ COMPONENT MANUFACTURER THREE MILE ISLANO-2 REACTIVITY CONTROL SYSTEMS COMPONENT CODE NOT APPLICABLE SUBCOMPONENT NOT APPLICABLE PERSONNEL ERROR LICENSED & SENIOR OPERATORS ITEM NOT APPLICABLE EVENT OESCRIPTION/ CAUSE DESCRIPTION WHILE IN MODE 1 FOUND BORON CONCENTRATION IN TNE BORIC ACID MIX TANK WAS OREATER TMAN THAT REQUIRED BY T.S. 3.1.2.9 AND THAT THE LCD ACTION STAT EMENT HAD NOT BEEN INVOKED. BECAUSE A REDUNDANT SOURCE OP BORON WAS AVA ILABLE AND BECAUSE NO EVENT OCCURRED WHICH REQUIRED BORON INJECTION, THI S EVENT 010 NOT ADVERSELY AFFECT THE HEALTH ANO SAFETY OF THE PUBLIC. THIS EVENT WAS CAUSED BY UNIT PERSONNEL FAILINO TO RECOONIZE THAT THE AC CEPTANCE CRITERIA OF THE SURVEILLANCE PROCEOURE MAO NOT BEEN MET. THE P ERSONNEL INVOLVEO WILL BE COUNSELLEO TO MORE CAREFULLY REVIEW SURVEILLAN CE RESULTS VS. ACCEPTANCE CRITERIA. JUN 21, 1979 LER OUTPUT ON PARTICULAR EVENTS FOR TNREE MILE ISLAND 2 FROM 1969 TO THE PRESENT OUTPUT SORTED BY EVENT DATE DOCKET ND./ EVENT DATE/ LER ND./ REPORT DATE/ CONTROL ND. REPORT TYPE BSOOB32B 021479 79-010/BiT-B 022679 02S334 2-WEEK C) En 0 PAGENO="0655" 651 Question 22. What action is the NRC taking to reassess the design and licensing criteria for containment isolation involving pressures below 4 psi? ANSWER There are 18 operating PWRs for which automatic containment Isolation is initiated only by containment high pressure (2 to 5 psig). The Lessons Learned Task Force expects to recommend shortly that the provisions of Standard Review Plan 6.2.4 `Containment Isolation System" paragraph 1.1.6 (i.e., that there be diversity in the parameters sensed for the initiation of containment isolation) be immediately backfit for those units. All containments have used a positive containment pressure signal for the initiation of automatic containment isolation. The most commonly used diverse (or second) parameter is safety injection demand. Safety injection demand is a safety-grade signal suitable for an early containment isolation demand and is available through the plant protection system. We expect the 18 operating units will incorporate safety-injection demand as their diverse isolation parameter. The Lessons Learned Task Force is also evaluating the advisability of requiring further redundancy in the containment isolation demand, e.g., high radiation level in the containment atmosphere, containment sump and/or process fluids, in addition to signals from containment high pressure and safety injection demand. Paragraph 11.7 of Standard Review Plan 6.2.4 and Branch Technical Position CSB 6-4, "Containment Purging During Normal Plant Operations" require that a containment radiation level also be used to initiate automatic isolation of containment purge and vent lines which may be used during normal plant operations. These requirements are now being imposed for new OL applications and have been used for new CP applications since publication of the Branch Technical Position. PAGENO="0656" 652 Application submitted for construction permit (CP) CP Safety Evaluation Report (SER) issued by NRC staff CP issued Application for operating license (OL) tendered Application for OL docketed Staff SER issued ACRS report issued Start of public hearing SER Supplement (SSER) No. 1 issued Atomic Safety and Licensing Board initial decisions SSER No. 2 issued Operating license issued April 29, 1968 September 5, 1969 November 4, 1969 February 15, 1974 April 4, 1974 September, 1976 October 22, 1976 January 28, 1977 March, 1977 December 19, 1977 February, 1978 February 8, 1978 QUESTION 23 Please provide a complete chronology of the licensing process for the TMI plant. ANSWER Attached is a detailed chronology of the review for the TMI-2 operating license from the receipt of the operating license application to the issuance~of the license. Also attached is a description of the evolution of the operating license from the time of issuance to the time of the accident. For clarity an abbreviated chronology of key events up to issuance of the license is presented below. PAGENO="0657" 653 Attachment `to ~AnsWer to Question~23 APPENDIX A CHRONOLOG RADIOLOGICAL SAFETY REVIEW OPERATING LICENSE REVIEW THREE MILE ISLAND NUCLEAR STATION UNIT 2 February 15, 1974 March 18, 1974 March 19, 1974 April 4, 1974 April 18, 1974 April 25, 1974 April 25, 1974 April 27, 1974 May 6, 1974 May 28, 1974 May 30, 1974 June 3, 1974 June 3, 1974 Application tendered for acceptance review Applicant informed of results of acceptance review and of additional information required. Meeting with applicant to discuss results of acceptance review and additional information required. Application with Amendment 13 to the Final Safety Analysis Report was filed, accepted, and docketed. Letter to applicant accepting application and confirvnnq schedule for required additional information. Letter to applicant on omission of fluid block and penetration pressurization systems. Letter to applicant requesting additional information on seismology, geology, and foundation engineerinq. Letter from applicant on Quality Assurance organizatior Amendment 14 filed. Federal Register notices published on receipt of appli- cation and opportunity for hearing. Letter to applicant on safety review schedule. Amendment 15 filed. Letter from applicant responding to our letter of April 24, 1974 on fluid block and penetration pressurization. 48-721 0 - 79 - 42 PAGENO="0658" June 13, 1974 June 18, 1974 June 20, 1974 July 1, 1974 July 11, 1974 July 12, 1974 July 15, 1974 July 17 and 10, 1974 July 25, 1974 July 29, 1974 August 1, 1974 August 6, 1974 August 6, 1974 August 21, 1974 August 23, 1974 September 4, 1974 Letter fro' applicant acknowledging safety review schedule. Amendment 16 tiled. Letter from applicant submitting P61 diagrams. Amendment 17 filed. Site visit by Accident Analysis and Radiological Assessment branches. Supplement 1 to Industrial Security Plan submitted. Amendment 18 filed. Site visit by Site Analysis Branch. Meeting with applicant to discuss additional informa- tion on containment systems and structural engineering. Site visit by Meteorology section. Amendment 19 filed. Letter to applicant on Quality Assurance personnel authority. Letter to applicant requesting additional information on geology, seismology, and foundation engineering. Letter to applicant transmitting first round questions. Letter from applicant noting delay in responding to some items of our letter of March 18. Letter from applicant submitting schedule for responding to first round questions. Letter from applicant defining schedule for response to our letter of August 6. Amendment 20 filed. Revision 6 to Industrial Security Plan received. 654 September 19, 1974 September 27, 1974 October 4, 1974 PAGENO="0659" 655 October 4, 1974 Letter from applicant submitting schedule for response n anticipated transients without scram. October 18, 1974 Amendment 21 filed. October 18, 1974 Letter from applicant requesting lengthenimq of safety review schedule and noting delays in responses to first round questions. October 29, 1974 Letter from applicant submitting some instrumentation and control drawings. November 4, 1974 Revision 7 to the Industrial Security Plan received. November 19, 1974 Amendment 22 filed. November 29, 1974 Letter to applicant transmitting questions on reactor physics and accident analysis. December 3, 1974 Letter to applicant transmittinq questions on radio- logical technical specifications. December 10, 1974 Letter to applicant transmitting revised safety review schedule. December 11, 1974 Letter to applicant transmitting questions and positions on foundation engineering. December 19, 1974 Letter to applicant requesting responses to open items. December 19, 1974 Amendment 23 filed. December 20, 1974 Letter to applicant transmitting second round questions on operator licensing and industrial security. December 27, 1974 Letter from applicant providing schedule for response to our letter of December 11, 1974. January 3, 1975 Letter from applicant transmitting initial response on anticipated transients without scram. January 6, 1975 Letter from applicant proposing delay in response to questions on technical specifications until standard technical specification review is complete. PAGENO="0660" Letter to apolicant requesting infornation on changes in tendon system. Letter to applicant advising of changes in safety review schedule due to applicant's delays. Letter to applicant transmitting second round questions on reactor fuel. Amendment 24 filed. Letter to applicant advising of open items and inadequate responses and of required schedule. Letter to applicant noting procedures for submittal of industrial security plans. Letter from applicant transmitting revision 7 to industrial security plan. Letter from applicant responding to our letter of December 19, 1974. Letter from applicant stating that no changes are re- quired for anticipated trancients without scram. Response from applicant to our letter of February 6, 1975. Letter to applicant concurring with their analysis of containment prestressing system. Meeting with applicant on anticipated transients without scram. Amendment 25 filed. Letter to applicant transmitting second round questions on reactor systems. Letter from applicant revising open items response dates requested in our letter of February 6, 1975. Meeting with applicant on Materials Engineering Branch items. 656 January 13, 1975 January 17, 1975 January 27, 1975 January 31, 1975 February 6, 1975 February 12, 1975 February 14, 1975 February 18, 1975 February 19, 1975 February 24, 1975 February 25, 1975 February 27, 1975 February 28, 1975 March 10, 1975 March 12, 1975 March 15, 1975 PAGENO="0661" 657 March 19, 1975 Letter to applicant advising of revised safety review schedule. March 25, 1975 Letter to applicant on Quality Assurance questions. April 4, 1975 Amendment 26 filed. April 14, 1975 Letter to applicant on Accident Analysis questions. April 14, 1975 Letter to applicant on questions on industrial security. April 17, 1975 Meeting with applicant on containment isolation. April 23, 1975 Letter to applicant on review schedule revision. May 12, *l975 Hydrology site visit. May 19, 1975 Amendment 27 filed. May 19, 1975 Letter to applicant transmitting second round ciuestions on effluent treatment, containment systems, site analysis, and electrical and control items. May 19, 1975 Meeting with applicant and intervenor prior to ore- hearing confernece. Flay 22, 1975 Prehearing conference. May 30, 1975 Amendment 28 filed. June 5, 1975 Revision 8 to Industrial Security Plan filed. June 20, 1975 Letter to applicant covering second round questions from Auxiliary and Power Conversion, Mechanical Engineering, Materials Engineering, and Radiological Assessment Branches. June 27, 1975 Amendment 29 filed. July 11, 1975 Amendment 30 filed. July 14, 1975 Letter to applicant transmitting requests for additional information. Letter from applicant transmitting drawings on sub- compartment pressurization. July 14, 1975 PAGENO="0662" 658 July 24, 1975 Letter to applicant identifying additional information required ci ev:erqency core cooling system. July 28, 1975 Letter froii applicant respondinq to our letter of April 14, 1975, on industrial security. July 30, 1975 Letter to applicant transmitting request for additional information and staff positions. August 6, 197S Letter to applicant transmittinq Babcock & Wilcox standard technical specifications. August 15, 1975 Amendment 31 filed. August 21, 1975 Meeting with applicant to discuss open electrical and instrumentation and containment system items. September 2, 1975 Letter from applicant transmitting marked up copies of standard technical snecifications sections. September 5, 1975 Amendment 32 filed. September 12, 1975 lleeting with applicant to discuss preoperational testing. September 17, 1975 Meeting with applicant on standard technical specifications. September 20, 1975 Letter from applicant transmitting revised industrial security plan. October 1, 1975 Meeting with applicant on standard technical specifications. October 8, 1975 Amendment 33 filed. October 16, 1975 lleeting with applicant on standard technical specifications. October 30, 1975 fleeting with applicant to discuss steam line break and other open items. October 31, 1975 Amendment 34 filed. November 3, 1975 Letter from applicant transmitting additional marked - up sections of standard technical specifications. PAGENO="0663" Meeting ith applicant on standard technical specifications. Letter to applicant requesting additional analysis on steam line breaks. Amendment 35 filed. Meeting with applicant on subcompartment structures. Letter to applicant regarding transient loadings on reactor vessel supports. Meeting with applicant to discuss open items in the staff review Amendment 36 filed. 659 November 19, 1975 November 21, 1975 November 24, 1975 December 2, 1975 December 9, 1975 December 18, 1975 December 19, 1975 January 6, 1976 January 13, 1976 January 14, 1976 January 19, 1976 January 20, 1976 February 6, 1976 February 19, 1976 February 20, 1976 February 23, 1976 March 1, 1976 Letter to applicant transmitting revised safety review schedule information. Letter from applicant responding to our letter of December 9, 1975, on reactor vessel support loading. Transmittal to applicant of preliminary draft standard technical specifications for Unit 2. Revision II to Industrial Security Plan filed. Amendment 37 filed. Meeting with applicant on open items in staff review. Meeting with applicant on open items in staff review. Amendment 38 filed. Letter to applicant transmitting guidance on meeting Appendix I. Letter from applicant responding to our letter of July 24, 1975, on additional information on emergency core cooling systems. Letter to applicant identifying open items in safety review. March 5, 1976 PAGENO="0664" 660 Meeting with applicant on containment subcompartment codes. fleeting with applicant on open items in staff review. General meeting on Appendix I. Amendment 39 filed. Meeting with applicant on electrical and instrumentation open items. Revision 12 to Industrial Security Plan filed. Letter to applicant stating we will consider model test- ing to satisfy Regulatory Guide 1.79. Amendment 40 filed. Letter to applicant regarding equipment used to nitigate steam line break. Letter to applicant regarding technical specifications dealing with Appendix I. Letter to applicant transmitting revised safety review schedule. Meeting with applicant on open items in staff review. Meeting with applicant on standard technical specifications. Letter to applicant transmitting `Summary of Outstanding Review Items. Letter from applicant transmitting information to be included in Amendment 41. Meeting with applicant on open items. Appendix I response from applicant. Letter from applicant defining schedule for response to open items. March 8, 1976 April 1 and 2, 1976 April 8, 1976 April 9, 1976 April 13, 1976 April 19, 1976 April 20, 1976 April 29, 1976 May 5, 1976 May 10, 1976 May 13, 1976 May 13, 1976 May 25, 1976 June 1, 1976 June 1, 1976 June 2, 1976 June 4, 1976 June 11, 1976 PAGENO="0665" 661 June 11, 1976 Meeting with applicant on open itetis. June 16, 1976 Amendment 41 filed. June 25, 1976 Letter from applicant completing response to `e.~esr for additional information on emergency core coolin~j system. June 30, 1976 Amendment 42 filed. July 12, 1976 Letter to applicant on anticipated transients without scram. July 15, 1976 Letter from applicant transmitting Amendment 43. July 19, 1976 Meeting with applicant to discuss meteorological data, models, and results. July 30, 1976 Letter from applicant on dike repair. PAGENO="0666" 662 APPENDIX A CHRONOLOGY OF OPERATING LICENSE STAGE RADIOLOGICAL SAFETY REVIEW The following updating of the chronology is provided. August 6, 1976 Letter from applicant on dike repair. August 31, 1976 Letter from applicant on reactor vessel support analysis. September 7, 1976 Letter from applicant transmitting Amendment 44. September 8, 1976 Letter from applicant transmitting Amendment 45. September 13, 1976 Meeting with applicant to discuss open items. September 17, 1976 Safety Evaluation Report issued. September 23 and 24, 1976 Meeting of subcommittee of Advisory Committee on Reactor Safeguards. September 30, 1976 Letter from applicant transmitting Amendment 46. September 30, 1976 Letter from applicant transmitting Amendment 47. October 6, 1976 Meeting with applicant on open itmes. October 15, 1976 Meeting of Advisory Committee on Reactor Safeguards. October 22, 1976 Report of Advisory Committee on Reactor Safeguards. November 9, 1976 Meeting with applicant on open items. November 10, 1976 Letter from applicant on information on fire protection. November 15, 1976 Letter from applicant transmitting Amendment 48. November 30, 1976 Letter from applicant transmitting Amendment 49. December 8, 1976 Letter from applicant transmitting Amendment 50. PAGENO="0667" 663 December 20, 1976 Letter to applicant on fire protection. December 20, 1976 Letter to applicant transmitting letter to Babcock & Wilcox on Appendix K evaluation. January 5, 1976 Letter to applicant transmitting request for additional information. January 21, 1977 Letter from applicant furnishing information on Appendix K evaluation. January 24, 1977 Meeting with applicant on change of ownership percentages. January 26, 1977 Meeting with applicant on operating organization. PAGENO="0668" 664 APPEHOIX A CHRONOLOGY February 25, 1977 Letter to applicant re guidance on implementing the new rule re physical security plan Letter from applicant transmitting Amendnent 52 Letter to applicant on secondary system line break Letter to applicant requesting additional information to resolve certain open issues Letter to applicant re fuel handling accident inside containment Letter to applicant requesting additional information on proper selection of instrumentation trip setpoint values Letter to applicant transmitting Supplement 1 to SER Letter from applicant requesting Appeal Meeting January 21, 1977 January 28, 1977 February 1, 1977 February 7, 1977 February 9, 1977 February 11, 1977 February 17, 1977 February 17, 1977 Letter from applicant on ECCS evaluation model Letter from applicant re proposed draft tech specs Letter to applicant requesting information by Systems Analysis Section Letter to applicant acknowledging corrective and preventive actions Letter from applicant transmitting Amendment 51 Letter to applicant on fire in motor control cooler Letter from applicant concerning B&W ECCS reevaluation Letter from applicant on schedule regarding steam line break accident analysis February 28, 1977 March 15, 1977 March 15, 1977 March 18, 1977 March 24, 1977 March 25, 1977 March 25, 1977 PAGENO="0669" 665 March 28, 1977 Letter from applicant requesting extension of construction permit March 30, 1977 Letter from applicant transmitting Amendment 54 April 1, 1977 Letter from Shaw, Pittman, Potts and Trowbridge requesting ainenOment to construction permit April 1, 1977 Memorandum and Order April 11, 1977 Letter from applicant re vital power supply inverters April 13, 1977 Letter to applicant re appeal meeting April 13, 1977 Letter from applicant transmitting Amendment 55 April 22, 1977 Letter from applicant transmitting Amendments 55 & 56 April 26, 1977 Letter to applicant requesting additional financial information April 27, 1977 Letter to applicant on reactor vessel overpressurization May 2, 1977 Letter from applicant on fuel handling accident inside containment May 5, 1977 Letter from applicant re steam line break accident May 11, 1977 Letter from applicant re instrument trip setpoint values May 25, 1977 Letter from applicant transmitting physical security plan June 1, 1977 Letter from applicant re hermetic seals of instrument boxes June 6, 1977 Letter to applicant re open issues June 28, 1977 Letter from applicant re financial information June 29, 1977 Letter from applicant re fire protection program July 7, 1977 Letter from applicant re.f ire protection technical specifications July 20, 1977 Letter from applicant transmitting Amendment 57 July 21, 1977 Meeting with applicant PAGENO="0670" Letter from applicant re fire protection technical specifications Letter from applicant re irradiation of fuel rods Electrical Site Visit Letter from Shaw, Pittman, Potts and Trowbedge requesting amendment to construction permits to change ownership Letter from applicant transmitting Amendment 58 Letter to applicant re fire protection Letter to applicant re low grid voltage Letter to applicant re physical searches of individuals Meeting with applicant on steam generator instrumentation Letter from applicant re reactor vessel supports adequacy Letter from applicant transmitting Amendment 59 Letter from applicant submitting Fuel Densification Report Letter from applicant transmitting Amendment 60 Meeting with applicant on Spray Pump NPSH Meeting with applicant on open items Meeting with applicant on steam generator sleeves Letter from applicant re steamline break accidents Letter to applicant re search requirements Meeting with applicant on open items Meeting with applicant on steam line break Letter from applicant requesting extension of construction permit comple- tion date 666 August 1, 1977 August 1, 1977 August 1-3, 1977 August 23, 1977 August 26, 1977 August 29, 1977 September 19, 1977 September 19, 1977 October 5, 1977 October 6, 1977 October 7, 1977 October 17, 1977 October 31, 1977 November 2, 1977 November 9, 1977 November 22, 1977 November 23, 1977 November 28, 1977 December 8, 1977 December 9, 1977 December 12, 1977 PAGENO="0671" Letter from applicant transmitting Amendment 61 Initial Decision Letter to applicant re fire protection review Meeting with applicant on fire protection Meeting with applicant on open items Fire protection site visit Letter to applicant on technical specifications Meeting with applicant on steamline break Letter from applicant transmitting Amendment 62 667 December 16, 1977 December 19, 1977 December 19, 1977 December 22, 1977 December 28, 1977 January 3-6, 1978 January 6, 1978 January 10, 1978 January 24, 1978 PAGENO="0672" Letter from applicant on fire protection Letter from applicant on steam line break Letter to applicant transmitting order extending completion date Letter from applicant on radiological monitoring program Letter from applicant on containment peak temperature profile Letter from applicant on OTSG, sleeve test program Letter from applicant on construction items and licensing commitments Letter from applicant on open items in tech. specs. Letter from applicant on building spray pump head curves Letter from applicant on makeup tank isolation after LOCA Letter from applicant transmitting revision of security plan Letters from applicant on fire protection items Letter from applicant on electrical terminal blocks in containment Letter from applicant on containment peak temperature and building spray pumps 668 January 11, January 13, January 16, January 24, January 24, January 25, January 25, January 25, January 25, January 26, January 27, January 27, January 30, February 1, 1978 1978 1978 1978 1978 1978 1978 1978 1978 1978 1978 1978 1978 1978 PAGENO="0673" 669 The evolution of the TMI-2 license from its issuance to the date of the accident, March 28, 1979, is described below. 1, Pni~ndment No. 1 , dated March 3, 1978, added paragraph H to Attachment 2, permitting certain hydrostatic testing prior to initial criticality. 2. Amendment No. 2, dated March 10, 1978, revised certain Technical Specifications, deleted and revised license paragraphs, and added a paragraph to Attachment 2, as follows: a. License paragraph 2.C.(3).b was deleted. The licensee provided voltage and frequency variations resulting from a 500 Kw load rejec-. tion from the diesel generators. b. License paragraph 2.C.(3).l.1 was deleted. The licensee provided design details of an automatic water suppression system in each diesel generator room basement as required by this paragraph. (See e. below.) c. License paragraph 2.C.(3).l .2 was deleted. The licensee provided a firewater pipe rupture analysis and noted that design of appropriate water spray protection could not be done until further analysis was completed. (See d. below.) d. License paragraph 2.C.(3).l .3 was revised to assure that design of water spray protection features would be accomplishee at a suitable later time. e. Paragraph G.l2 was added to Attachment 2 to require installation of the automatic water suppression system discussed in b. above. f. Various Technical Specifications were revised to correct typo- graphical and editorial errors. 3. Letter dated March 10, 1978, NRC (Boyd) to Metropolitan Edison (Herbein) noted completion of the construction and test items of paragraphs 8.1 and 8.2 of Attachment 2, and also noted submittal of inforoation to satisfy the fire rating requirements of paragraph G.l of Attachment 2. Authorization was given to proceed to Mode 4 (hot shutdo~). 4. Amendment No. 3, dated March 24, 1978, deleted certain license para- graphs, and added and revised certain paragraphs of Attachment 2, as follows: a. License paragraph 2.C.(3).c was deleted. The licensee provided documentation of their proposal to permit utilization of smaller impellers in the reactor building emergency cooling booster pum~s. b. License paragraph 2.C.(3).d was deleted. The licensee provided documentation demonstrating the adequacy of the NPSH for the reactor building spray pumps. 48-721 0 - 79 - 43 PAGENO="0674" 670 c. License paragraph 2.C.(3).e was deleted. The licensee provided analyses defining the containment temperature response to a stea~i line break, and justifying the adequacy of environmental qualification temperatures of components inside containment. d. Paragraph C.i of Attachment 2 was revised to delete as requirements for entry into Mode 2 three fuel handling system tests and a test of the reactor coolant waste evaporator. Technical Specifications already required equivalent tests of the fuel handling equipment, and newly added paragraph I will provide for the required waste evaporator test. e. Paragraph C.5 of Attachment 2 was revised to clarify equipment align- ment to assure that the HPI pimps will not empty the makeup tank in the event of a LOCA, prior to implementation of paragraph F.l f. Paragraph F.2 of Attachment 2 was revised to correct a typographical error. g. Paragraph I was added to Attachment 2 to require the waste evaporator test discussed in d. above. 5. Letter dated March 25, 1978, NRC (Boyd) to Metropolitan Edison (Herbein) noted completion of-all items in Attachment 2 required to be completed prior to entry into Mode 2 (startup), and authorized entry into Mode 2. Items include completion of test procedures, environmental/administrative procedures, various work list items, and makeup tank hydrogen isolation valves, procedure revision, and equipment alignment in accordance with 4.e. above. 6. Letter dated April 7, 1978, NRC (Boyd) to Metropolitan Edison (Herbein) noted completion of all items in Attachment 2 required to be completed prior to entry into Mode 1 (po~r operation) , and authorized entry into Mode 1. Items required to be completed were: a. optimization of voltage levels at the safety-related bases and verification of such optimization (paragraph 0.1); b. modification of the diesel generator air starting system to provide 10 starts (paragraph D.2); and c. making the intermediate closed cooling water heat exchangers seisnic Category I. 7. Letter dated May 1, 1978, Metropolitan Edison (Herbein) to NRC (Varga), supplemented by letter of ~June 30, 1978, Herbein to Varga, submitting fire protection information required by license paragraphs 2.C.(3).l.3 and 2.C.(3).l.4. Review by the staff and implementation of correctiv2 action was scheduled prior to the end of the first regularly scheduled refueling outage. 8. Amendment No. 4 dated May 19, 1978, revised the Technical Specifications to avoid injection of NaOH into the reactor coolant system during inadver- tent actuations of the ECCS, and to reduce the maximum allowable value of neutron flux tilt in each quadrant. PAGENO="0675" 671 9. Amendment No. 5 dated June 5, 1978, revised the Technical Specifications to require appropriate testing of the fuel handling bridge and associated mast assemblies. 10. Letter dated 1~a.igust 7, 1978, Metropolitan Edison (Herbein) to ~C ~Varga) submitting information as required by license paragraph 2.C.(3),f regarding reactor protection system and engineered safety features trip setpoint valves. This information was originally requested in our generic letter of March 24, 1977, and is being evaluated on a generic basis. 11. Amendment No. 6 dated August 17, 1978, revised the Technical Specifications to: a. permit a more effective method of containment air lock seal leakag~ verification; b. permit operation with higher ultimate heat sink temperatures; c. permit removal of all but two orifice rod assemblies and to permit installation of retainers on the remaining orifice rod assemblies and the burnable poison rod assemblies; d. permit replacement of the 12 dual port main steam safety valves with 20 single discharge port valves; and e. allow other miscellaneous changes. 12. Letter dated August 25, 1978, NRC (Varga) to Metropolitan Edison (Herbein), correcting typographical errors in Amendment No. 6. 13. Amendment No. 7 dated September 5, 1978, revising the Environmental Tech- nical Specifications to satisfy the requirements of license paragraphs 2.E.(2).a, b, c, and d, and deleting those paragraphs. 14. Amendment No. 8 dated December 15, 1978, revised the Technical Specifica- tions to permit specified reduced RCS flow at certain reduced power levels. 15. Letter dated January 12, 1979, Metropolitan Edison (Herbein) to NRC (Varga), noted implementation of fire fighting plans as required by license condition 2.C.(3) .1.5. 16. OlE Inspection Report 50-320/78-38 dated January 17, 1979, found the addi- tional emergency lighting required by paragraph 6.9 of Attachment 2 to be inadequate. Letter dated February 8, 1979, Metropolitan Edison (Herbein) to NRC IE Region I (Carison) notes resolution of this item. 17. OlE Inspection Report 50-320/79-02 dated February 7, 1979, verified core- pletion of the following items in Attachment 2: a. paragraph E.l , requiring installation and test of new impellers in the reactor building emergency cooling booster pulips; and b. paragraphs 6.5, 6.6, and G.7, requiring provision of fire fighting procedures and equipment. 18. Amendment No. 9 dated February 23, 1979, documented implementation of an updated physical security plan. PAGENO="0676" 672 Questiop~. ~You said that the "correction time" for Westinghouse plants is about 30 minutes and for Combustion Engineering plants it is about 15 minutes. What Is the corresponding time for B&W plants? ANSWER The "correction time" for B&W plants is less than two (2) minutes as used in the context of the response during the hearing. This is based on the assump- tion that the plant sustains a total loss of main feedwater and a total loss af auxiliary feedwater. (Ref. - Page 144, of hearing transcript, lines 3426 throught 3431)- PAGENO="0677" 673 Herman Dieckamp Presdent [~ GENERAL 260 Cherry Hill Road PUBLIC Parsippany New Jersey 07054 UTIUTIES 201 2634900 CORPORATION June 26, 1979 The Honorable Mike McCormack Chairman Subcommittee on Energy Research and Production Suite 2321 Rayburn House Office Building Washington, 0. C. 20515 Dear Congressman McCormack: - In your letter of June 14, 1979, you forwarded a list of questions. The enclosed answers to these questions supplement my testimony before your sub- committee on May 23, 1979. I hope the delay has not inconvenienced the sub- committee. If you require any further information, please contact me. lda enclosures PAGENO="0678" 674 ANSWERS TO QUESTIONS BY THE SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION HEARINGS ON NUCLEAR POWER PLANT SAFETY Q - 1. Would there be any advantages in standardizing the design of nuclear power plants? A - While significant NSSS standardization does exist, it is our view that further industry-wide efforts to standardize nuclear plants would be desirable. Standardization would be beneficial to the maturation of the technology and to the assessment of reliability and effective- ness of safety systems. The process of learning through the feedback of operating experience can be greatly aided if there exists a minimum of uncertainty about the applicability of the experience because of equipment and design differences. However, achievement of this objective requires a discipline in the licensing process so that changing regulatory requirements do not eliminate the possibility of design uniformity. Since experience will always lead to the need for design modification for purposes of plant reliability or safety, a standardization program must be accomplished under a licensing program which would approve a block of plants. When the experience is sufficient to justify changes of true net benefit, the criteria for the next block of plants would be changed. The SNUPPS plants are certainly evidence of interest in and support for plant standardization. PAGENO="0679" 675 In the-narrower context of ~he nuclear steam supply (NSS) and critical safety systems, a significant degree of standardization has already -occurred by each nuclear steam supply vendor. All B&W-177 plants, typi- fied by TNI-2, have very similar nuclear systems. Nuclear steam supply systems offered by all vendors offer a considerable degree of standardiza- tion within each of their product lines. It should be noted that aany designfeatures of a power plant relate to the particular site or to the environment in which the plant operates. The type of heat sink can dictate many features of the plant secondary system and equipment selection which are critical to many aspects of the power plant design. Beyond this, the NRC policy has encouraged standardization and the supply industry has responded with "standard" designs. The implementation of this policy has been very difficult by virtue of the tendency to continually seek "improvements" during regulatory review. Certainly improvements of significance should not be overlooked. But, there needs to be a more critical assessment of the true value of intended improvements in relation- ship to the extra complexity and unstandardization they can also produce. The movement toward standard designs has, however, been thwarted by the absence of sales. - - - It is also my firm belief that future standardization would greatly reduce the lead time for nuclear plants not only for licensing but also for construction and that it would significantly reduce construction cost. PAGENO="0680" 676 Q - 2. Is there any need for a "Swat Team" composed of people from industry, the utilities, NRC, etc.? A - The concept of a "Swat Team" which is assumed to mean a trained and available pool of resources to assist in a major nuclear incident, would be desirable. In our view, such a team would not have to represent a dedicated full-time capability, but rather could be a team rapidly formed from members of the utility and nuclear industry and the NRC. The essentials for effective implementation would include: a. Pn identification of anticipated skill requirements and the source of those skills by company and name. b. A pre-defined and thoroughly understood management structure including lines of authority and responsibility. c. A definition of how the team is to be assembled and supported. 4. An inventory of critical materials and equipment. Q - 3. Should there be a standard design for control rooms and for the layout of control room instrument and control panels? A - It is our opinion that significant improvements can be made in overall control room design. Some of these improvements could. take the form of future standardization for example, of the meaning of red and green indication lights, etc. However, a much more important aspect of the overall control room design is the human engineering or instrumentation! operator interface. Information could be displayed to the operator in a more meaningful form; the information display systems must have - priority assignments built in to assure critical data is made available to the Operator, without the Operator being submerged in information of secondary or of a relative unimportant nature. The use of more advanced computer and digital display and control techniques should be expanded. PAGENO="0681" 677 We believe this general area is probably one of the most critical, and deserving of overall industry attention. A higher degree of standardization could be beneficial in enabling increased and more effective simulator use. Q - 4. Should the control room operators or supervisors be employed by the utility or by some other agency? A - From the perspective of nuclear power plant safety, the control room operators cannot be separated from overall plant operations. An organizational interface would be difficult to unambiguously define and could be counter productive to safety. The important consideration is that the operators have the proper technical and educational background, that they are thoroughly trained in the design and operating characteristics of that particular plant and that they are completely familiar with plant and operating proced- ures and they perform in a highly disciplined way. To achieve this high level of performance, there must be properly considered operator selection criteria, continuous training, and thorough and effective evaluation. Q - 5. In your opinion,, what was the cause of the onset of the Three Mile Island accident? The cause of the onset of the TMI-2 accident was unquestionably the fallure.of the power operator relief valve (PORV) on the primary system pressurizer. While the overall turbine and reactor system "trip' was triggered by a signal from the feed system, the plant is designed to handle these "trips" and would have done so in this case routinely except for the failure of the PORV. PAGENO="0682" 678 Q - 6. It appears that some of the events at ml took place very rapidly. Is this indicative of inadequate thermal capacity in the cooling and heat transfer systems? A - We do not consider the rate at which the transient developed at TMI-2 to have been unusually rapid. From studying the incident and the dynamics of the plant response, we do not believe that any reasonable increase in the thermal capacity of the cooling systems would have had any bearing on the end result, given the same equipment failure and operator actions. Q - 7. Please comment on the following statement from the testimony of another witness "From the viewpoint of nuclear power plant safety design, two principal technical elements are involved in ThI. The most important is that the plant was configured so that the pressure. relief valve on the primary coolant system opened very often due to events such as a failure of normal feedwater flow to the reactor." A - The ThI-2 plant is configured so that on certain plant trips the reactor primary system pressure does cause the power operated relief valve to open. This was originally done in the design to minimize reactor "scrams" and allow a much more rapid plant recovery from secondary system trips. While in this case subsequent failure of the~power operator relief valve was a major ingredient of the incident, from a much broader perspective the key question is the assurance of satis- factory performance of all critical equipment within the plant. We believe a very important pert of the plant design be focuzed on critical components and that there be adequate engineering, development, and test programs to verify component performance and reliability. PAGENO="0683" 679 Q - 8. The testimony indicates that there are emergency procedures to assist the control room operator in analyzing the instrument readings. Who produced this analysis? Please send us a copy of this procedure and the analysis? A - There is a written response which details the follow-up action for each of the approximately 1200 alarms in .the Unit 2 coi~trol room. Each alarm has its individual procedure. Additionally,each of the emergency procedures contains a listing of the anticipated alarms for the condition. The emergency procedure contains the appropriate corrective action for the condition. These procedures were prepared by site engineers and consultants reviewed by the Plant Operation Review Committee and approved by the Unit Superintendent. We have not included this material because of its bulk but it will be supplied if the committee wishes. Q - 9. Provide a schematic description of the operation of the Condensate Polishing System including the means of ensuring adequate redundancy. A - Enclosed is a system description and a schematic diagram of the Conden- sate Polishing System. Since the Condensate Polishing System is not a safety system its design does not include complete redundancy. However, there are eight condensate polishing tanks in the system and only seven are required for normal operation. This allows one tank to be removed from service for maintenance or recharging without affecting system operation. Q - 10. Is it correct that there were about sixty people in the control room during the early stages of the accident? Are there any operating procedures which should have prevented this congestion? Provide a list of those present. PAGENO="0684" 680 A - During the early stages of the accident the number of people in the control room cbang'ed from hour to hour. The following is a breakdown for the first few hours of the accident. a) 0400-0500 - The number of people varied from three (3) people at 0400 to about eight (8) people by 0500. These consisted of the operating shift in the control room, Auxiliary operators that came to the control room as needed, and three support people from Unit I. 1) Bill Zewe - Shift Supervisor. 2) Fred Schiemann - Shift Foreman 3) Ed Frederick - Control Room Operator 4) Craig Faust - Control Room Operator 5) Ken Bryan - Shift Supervisor 6) George Kunder - Unit 2 Superintendent Technical Support 7) Various aux. operators in and out 8) Scott Wilkerson - Nuclear Engineer 9) Kevin Harkless - Nuclear Engineer * b) 0500-0600 - The above mentioned people were joined in Control room by additional personnel. 1) Walter Marshall - Ops Engineer .2) Doug Weaver - I&C Foreman 3) Joe Logan - Unit II Superintendent Total people in Control Room during this time numbered less than twelve (12). PAGENO="0685" 681 c) 0600-0645 - During this period more people were arriving including the remainder of the scheduled shift personnel. The total number of people was about 20. 1) Mike Ross_- Supervisor of OPS Unit I 2) Brian Nehler - Shift Supervisor 3) Adam Miller - Shift Foreman 4) Carl Guthrie - Shift Foreman d) After 0645 - After this period a site emergency was declared - and the total number of people in control room rose to about -25 people. A number of the people, listed above, that were in the control room at this time were there as a result of being called to provide assistance. At times later in the day the number of people increased in the control room to about 60 people largely because of the evacuation of the ~sergency Control Station (ECS) from Unit I Control Room due to air borne activity, and establishing ECS in Unit II Control Room. Use of the Control Room as an ECS and the resulting activity was clearly separate from the plant operations and did not hinder in any way control of the plant. We do not have operating procedures that limit congestion in the Control Room but we do have clearly defined areas in the Control Room ~here personnel may go only with permission of the Duty Operations Group. There are large red signs overhead and yellow lines on the floor to indicate these areas, and the Shift Supervisor strictly enforced these areas during and following the accident. PAGENO="0686" 682 Q - 11. We gather that it was nearly three hours after the accident before the plant operators recognized that they had a major problem on their hands. Please explain this. A - The operators knew they had an unusual problem early into the event because of the high pressurizer level and low RCS pressure. During the period the operators were responding to their indications and taking action to place the plant in a stable condition. Two hours and 45 minutes into the event high radiation alarms were received. At this time the radiation level began to exceed the pre established level for the declaration of a "site emergency". Q - 12. What type of audio device was used to listen to the steam generators? Would television cameras, at appropriate locations, have been of any benefit? A - Audio Monitors used to listen to the steam generators were: a. Loose Parts Monitor channel #5 "Steam Generator A Upper tube sheet East." b. Main steam relief valve noise monitor. Television cameras would have been of no use as far as the steam generators are concerned. Q - 13. Why did the control room operators put on protective masks? At what time did they put on these masks? Why did the masks donned by the operators make communications difficult? What type of -communications system is used by the operators when they are wearing masks? A - The control room personnel put on particulate protective masks when the air borne activity in the control room reached 1 x 10-8 uci/cc. PAGENO="0687" 683 Communication is more difficult in masks because they are not equipped with a speaking diaphram or another means of good clear speech transmis- sion. While wearing masks the personnel communicated with each other - face to face, and communicated by telephone. While using masks personnel speak slowly and loudly to insure they are understood. Even with the masks, communication was not seriously impeded. Q - 14. The testimony indicates that the valves for the auxiliary feedwater system were both closed about two days prior to the accident; is this correct? What was the exact time that they were closed, and what was the exact reason for closing them? A - The auxiliary feedwater valves EF-V12A and B were found closed at about eight (8) minutes into the event. At this tine we are unable to document when these valves were shut. However, the EF-V12A and B valves were shut about 42 hrs. before the event during a scheduled surveillance test performed on the emergency feed system. The operators involved have testified that they returned these valves to the open position at the completion of the test. Q - 15. Is closure of both valves supposed to take place only when the plant is shut down? . A - The closure of both EF-V12A and B in performance of the Surveillance test was in accordance with an approved procedure which was not restrict- ed to periods when the plant was shut down. PAGENO="0688" 684 Q - 16. The testimony indicates three actions taken by the control operator(s): a. He cut back on the high pressure injection to maintain the pressur- izer level. Was this the right thing to do? b. Re turned off the two pumps in the ~B~' loop at 73 minutes into the* accident. Was this a reasonable thing to do? c. At 100 minutes into the accident the operator turned on the two pumps in the ~A" loop. Was this a reasonable action? Specify why these actions were taken. Specify who performed each action. Specify who authorized each action. (a) A control room operator cut back on high pressure injection flow to try and maintain pressurizer level. The operators were trained to respond to maintaining pressurizer level, to insure it does not go empty nor completely full. The operator was using approved procedures and responding to the indications available to him. The operator under direction of the shift foreman cut back on high pressure injection. The shift supervisor agreed to this action. (b) The control room operator turned off lB and 2B reactor coolant pumps under the direction of the Shift Supervisor because of excessive RCP vibration, reduced and oscillating Reactor coolant flow and fluctuating amperes on the running RCP'S. Securing RCP'S would preclude severe pumps and motor damage. PAGENO="0689" 685 (c) Answer is same as (b) above for tripping of 1A and 2A RCP. The plan was to rely on natural circulation to provide flow through the RCS. Q - 17. Describe in detail how your company contacted or alerted NRC about the accident. Provide a detailed chronology of these actions together with a list of people involved in the decision to contact NRC. Did you have difficulty in contacting NRC? March 28, 1979 0400 Turbine trip followed by a reactor trip. 0445-0705 Senior station personnel are called at home and arrive at the site. 0650 Radiation monitors in auxiliary building and the reactor (approx.) building dome monitor escalated quickly to alert ranges. * 0655 Senior personnel in the Unit 2 Control Room (J. Logan - Unit Superintendent, C. Kunder - Unit Superintendent - Technical Support, W. Zewe - Shift Supervisor) briefly discussed the situation and reached rapid agreement that a Site Emergency was in effect. Mr. Zewe announced the Site Emergency and started the notifications required by procedure. (See Enclosure (1)). 0702 Pennsylvania Emergency Management Agency (State Civil Defense) notified. * 0704 NRC Region I notified. The answering service was contacted and directed to get in touch with the duty offi~cer.~~ 0720 Remaining notification complete. 48-721 0 - 79 - 44 PAGENO="0690" 686 0724 General Emergency declared. I~his decision was made, by the Station Superintendent (Gary Miller) based on the reactor building dome monitor reaching 8 Rem/hr., one of the specific criteria requiring a General Emergency declaration. * 0750 NRC Region I called the TMI-2 Control Room and established an open phone line. * NRC notification was required by procedure after a Site Emergency declara- tion. Since NRC notification occurred before normal working hours, the NRC duty officer was not in the office and had to be contacted to return the call. Q - 18. Provide a detailed description-of themaintenance work being performed prior to the accident. This should include, but not be limited to, a description of the work being done on the condensate polishing unit at 0400 on March 28, 1979. Was all of this work normal maintenance work? Was the work done in accordance with B&W maintenance instructions? Provide a chronology of the work and a list of those who did it. A Work being done at condensate polishers at 0400 on March 28. Number 7 polisher resin was being transferred to the regeneration receiving tank. This-is a pert of normal operating procedure for regeneration of the system and is not considered maintenance. Resin was * clogged in the transfer line and operator Don Miller and Shift Foreman Fred Schiemann were trying to free the clogged transfer line. This system is not part of the B & W scope. Thetransfer is done with demineralized water. Service air is applied periodically to keep the resin swirling in the vessel. It is believed PAGENO="0691" 687 that the water under higher pressure than the air, backed up through the service air system and got into the instrument air system and causing a loss of signal air to fail closed the condensate polish outlet valves. This resulted in total loss of feedwater, which caused the subsequent turbine trip. Other Shift Maintenace work: Shift Maintenance Foreman: C. Leakway Electrical - K. Ebersole Troubleshooting electrical controls of - L. Cisney Unit 2 Condenser Cleaning System. Q - 19. Provide a detailed description of your operator training programs. Provide the "Pass-Fail' grades of the operators on duty during the period of the accident, and for the prior 48 hours. Operators at nuclear power plants are licensed by the NRC as reactor operators CR0) or as senior reactor operators (SRO) for each individual reactor. Licensed operators undergo both NRC administered tests and Company administered tests. Initial licensing as either an RO or 5R0 requires NRC examinations. Every TMI-2 operator listed in the table below passed the NRC examinations for RO and SRO the first time they were administered. NRC also requires that licensed operators undergo requalification examinations administered by the Company every two years. Met-Ed actually administers these requalification exams every * ~ No operator listed below has failed an annual requalification examination. A number of TNT SRO's are licensed on both Units 1 and 2. Licensed SRO's denoted in the table by an asterisk, first held -SRO licenses on Unit 1. In those cases, the NRC approved and audited a cross-license PAGENO="0692" 688 training program and Met-Ed administered "cross-license" examination prior to aznmending the individuals' license to include Unit 2. ~In one case (noted by a double asterisk) the; individual first held an RO license on Unit 1. He then took the NRC SRO examination for Unit 2 and upon passing, was licensed by NRC as an SRO on both Units 1 and 2. The detailed description of our operator training program is attached as Enclosure (2). The following table gives data on licensing of operators who were on duty during the period of the accident, and for the prior 48 hours. 1 1978 (March) 1979 (February) Unit 2 Requal. Exam Requal. Exam Control Room Operators CR0 License) NRC License Unit 1 / Unit 2 Unit 1 / Unit 2 23 E. Frederick 10/19177 NA/MR NA/Passed C. Faust 10/20/77 NA/MR NA/Passed T. Illjes 10/19/77 NA/MR NA/Passed J. Kidwell 6/23/78 NA/NA NA/Passed N. Coop~r 7/5/78 NA/NA NA/Passed J. Congdon 10/19/77 NA/MR NA/Passed H. McGovern 12/6/78 NA/NA NA/NR E. Hemrnila 12/6/78 NA/NA NA/NR * C. Nell Awaiting results of NRC Exam L. Cermer Not licensed - CR0 in training Senior Operators (SRO License) W. Conaway CR0) 10/19/77, (SRO) 513178 NA/NR NA/Passed *~, Cuthrie 11/9/79 Passed/MR Passed/Passed F. Scheimann CR0) 10/19/77, (SRO) 5/3/78 NA/MR NA/Passed **B. Nehler 10/19/77 Passed/MR Passed/Passed *J. Chwastyk 11/9/77. Passed/MR Passed/Passed *~, Zewe 11/9/77 Passed/MR Passed/Passed *K. Bryan 11/9/78 Passed/NA Passed/NR PAGENO="0693" 689 1 Date initially licensed on Unit 2 based either on NRC examination or Company cross-license examination. 2 Not Applicable - individual does not hold license on this Unit. 3 Not Required - Annual requalification examination by Company not required when scheduled within first six months following NRC licensing. Q - 20. What necessitated thi~maintenance work; that is, was it an emergency, or routine? Had similar maintenance work been performed on this unit before? If so, how often? A - The maintenance being performed prior to the accident other than that. discussed in 18 was routine. Troubleshooting electrical controls of the Condenser Cleaning System is performed routinely, about once in each, one/two month period or as required for a specific problem. Q - 21. How many condensate polishing units are there on Reactor No. 2 at ThI? If more than one, were they both (all) undergoing maintenance at the time the accident was initiated? A - Unit II has 8 condensate polishers. Only one was in the process of having resin transferred to the receiving tank. Transfer of exhausted resin is part of the normal operating procedure required for regener- ation of the units and is not considered maintenance. Q - 22. How many condensate polishing units are required to sustain normal plant operation? A - Normally 7 polishing units are used during operation at full power while the 8th vessel is in standby. Q - 23. Specifically, what occurred on or before 0400 on March 28, 1979 that caused a reduction in net positive suction head to the feedwater pumps? What human errors were made; what components failed? Was there a pipe blockage and if so, what blocked the pipe and why did it occur? PAGENO="0694" 690 A - At 0400 on Narch 28, 1979, net positive suction head on the feedwater pumps was lost because the condensate booster pump tripped. The condensate booster pump trip occurred as a result of the condensate polisher outlet valves closing, interrupting flow to the condensate booster pumps. Valve closure was caused by loss of control air to the condensate polisher outlet valve positioner, which automatically signals the valve to close. We cannot at this time positively identify the cause of the air failure to the valve positioner. A probable cause may have been water induction to the air system while operations were being conducted to clear a pipe blockage in a resin transfer line. The resin transfer lime is not part of the condensate flow path. Because of the resin transfer line blockage, both the fluffing valves and the water sluice valve on the polisher were open for some periods of time which could have admitted some water to the station and instrument air supply system through a leaking check valve. On tests conducted in the plant subsequent to the incident, we have not been able to reproduce condensate outlet valve closure on flooding the instrument air supply to the condensate polisher. Q - 24. Was any other plant equipment involved in the initiation of the accident and if so, what equipment and what was the nature of the contribution? A - We do not consider the equipment identified in answer to question 23 as being part of the ~initiation" of the incident. As previously mentioned, the plant is designed to accommodate loss of feedwater flow. The TMI-2 accident was a result of the failure of the PORV to close on low primary system pressure. PAGENO="0695" 691 Q - 25. Considering normal operations at Plant No. 2TMI and assuming 80% power with no systems (either operating systems or back-up systems) undergoing maintenance or test or otherwise inactivated, how many lights on the control panel would be red? If any, what equipment would they relate to and what would be the significance of the red indication as opposed to green? A - Under normal operating conditions there are about five hundred fifty red lights in the Control Room. The significance of red vs. green depends upon its use.. a. For a valve - red indicates open and green means closed. b. For a motor - red means running and green means off. c. For a breaker - red means closed and green means open. d. For RNS - red light means high alarm. e. For control rod position - red light means control rod position is at full out position. f. On the IC.3 - red means automatic. The significance of an amber light. a. For a breaker or motor control - amber light means disagreement between breaker position and control switch. b. For RNS - amber light means alert alarm. c. For control rod position.- amber light means the rod is out of alignment with its group average. The significance of a white light. * a. Indication of power available. b. On the ICS white means manual. Q - 26. Are there definite written procedures which define specific reasons or conditjons upon which the reactor would be shut down manually. Do PAGENO="0696" 692 these conditions include maintenance of certain equipment? If so, what equipment is included? A - There is no procedure which defines specific reasons or conditions upon which the reactor would be shut down manually. However, the technical specifications list the minimum amount of equipment in various safety systems that must be operational for continued operation of the reactor plant. Where these minimums cannot be met within the required time the reactor is shutdown manually in accordance with Procedure 2102-3.1 - Unit Shutdown. Additionally, Administrative Procedure - Organization and Chain of Command gives the authority to the Control Room Operator to manually shut the unit down for any condition he deems necessary. Q - 27. Why were the auxiliary or emergency feed systems subjected to surveil- lance tests twelve times in the first quarter of 1979? List the reasons together with the dates and the result of the tests. Was ~he last test on these systems 42 hours before the day shift on the morning of Narch 28? A - Technical Specification 4.7.1.2.a requires that each of Unit 2's 3 emergency feedwater pumps * shall be demonstrated operable at least once per 31 days on a staggered test basis." Surveillance test 2303- MI4A/E which complies with 4.7.1.2.a, must be performed nine times during the 3-month period in question, once each month for each emergency feedwater pump, EF-Pi, EF-P2A, and EF-P2B to meet this technical * specification. Technical Specification 4.0.5.a, as required by Sec. II, ASNE Code, states that ASME Code Class 1, 2, and 3 valves in this system be tested at least quarterly, and that the pumps (EF-P2A, EF-P28) be tested each month. Valve test 2303-M27A must be performed at least once during the quarter, and the pump test 2303-N27B, must be run three times, once each month in order to comply with technical specification 4.0.5.a. PAGENO="0697" 693 Requires Surveillance To be p Technical Specification Test Number period erformed during this a total of... 4.7.1.2.a 2303-MJ4A* 1 time 4.7.1.2.a 2303_M14B* 1 time 4.7.1.2.a 2303_M14C* 1 time 4.7.1.2.a 2303-M14D 3 times 4.7.1.2.s 2303-N14E 3 times 4.0.5.a 2303_N27A* 1 time 4.0.5.a 2303_N27B* 3 times *Require closure of EF-V12 A/B Test Name Date Performed Results Reasons Performed 2303-M14A 01-30-79 Performed Satisfactorily Required by 4.7.1.2.a. 2303-M14B 01-30-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M14C 03-09-79 Performed Satisfactorily Required by 4.7.1.2.s 2303-M14D 01-23-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M14D 02-20-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M14D 03-19-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M14E 01-04-79 Performed Satisfactorily Required by ~s.7.1.2.a 2303-M14E 02-02-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M14E 03-02-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M27A 01-03-79 Performed Satisfactorily Required by 4.0.5.a 2303-M27B 01-25-79 Performed Satisfactorily Required by 4.0.5.a 2303-M27B 02-26-79 Performed Satisfactorily Required by 4.0.5.a 2303-M27B 03-26-79 Performed Satisfactorily Required by 4.0.5.a During the period 01-01-79 to 03-28-79, Unit 2 Technical Specifications required tests of the emergency feedwater system to be performed a total of 13 times, an equivalent average of once every 6.69 days. Thirteen tests werein fact performed, each of which met its respective acceptance criteria for satisfactory performance. PAGENO="0698" 694 The last test of the system prior to the March 28 accident was conducted on 03-26-79 from about 1000 to 1230. Q - 28. Provide details of the "shift overlap" prior to the accident. Provide a list of the control room operators, supervisors and others in the --control roam during the accident period and for the 48 hours prior tb the accident. Shift overlap or shift relief is accomplished by man to man turnover. In the control room the turnover consists of each man going over a written up to date list of normal routine work going on and also any unusual work or any other circumstances worthy of note. Also discussed are any events accomplished on previous shift and any events planned on next shift. - List of licensed operators in the Control Room 48 hrs prior to accident. 2300-0700 - 3/26/79 CR0: Edward Frederick CR0: Craig Faust Shift Foreman: Frederick Scheimann Shift Supervisor: William Zewe - 0700-1500 - 3/26/79 - CR0: Martin V. Cooper- - CR0: Joseph R. Congdon - CR0: Earl Hemmila CR0: Hugh McGovern -Shift Foreman: Carl Guthrie Shift Supervisor: Brian Mehler 1500-2300 - 3/26/79 CR0: John Kidwell CR0: Theodore flljes - PAGENO="0699" 695 CR0: Charles Nell Shift Foreman: William Conaway Shift Supervisor: Joseph Chawastyk 2300-0700 - 3/27/79 CR0: Craig Faust CR0: Edward Frederick Shift Foreman: Frederick Scheimann Shift Supervisor: William Zewe 0700-1500 - 3/27/79 CR0: Earl Hemmila CR0: Hugh McGovern Shift Foreman: Carl Guthrie Shift Supervisor: Brian Mehler 1500-2300 - 3/27/79 CR0: Charles Nell CR0: John Kidwell CR0: Theodore Illjes Shift Foreman: William Conaway Shift Supervisor: Joseph Chawastyk 2300-0700 - 3/28/79 CR0: Edward Frederick CR0: Craig Faust Shift Foreman: Frederick Scheimann Shift Supervisor: William Zewe In addition to the licensed operators, (others are periodically in the control room but no record is kept). PAGENO="0700" 696 Q - 29. Give a detailed description of "changing shifts" * Describe the formal procedures and provide copies of documentation or reports for the shift changes prior to the accident. A - ~anging shifts is addressed in Administrative Procedure 1012 - Shift Relief and Log Entries, a copy is attached. There.is no formal documentation other than log books. The relieving individual will discuss the plant status, operations in progress and special instructions with on duty personnel so that he is adequately informed prior to assuming his shift duties. These reviews are accomplished by going over a written up to date turnover sheet. Q - 30. In your testimony you indicate that the control room operator "sent the control signal" to close the pressurizer relief valve. Does this imply that the relief valve indicator in the control room only indicates that the signal has been sent and not that the operation has been performed? Describe and discuss the control and monitoring of the relief valve. A - Yes, the relief valve indicator in the control room only indicates that the signal has been sent and not that the operation has been performed. The pressurizer relief valve is a DC operated pilot actuated valve. The only indication available on Control Console is a red lamp that is * lit when an open command signal is ordered to the valve. The red lamp goes out when the open command signal is taken away. - The relief valve can be operated in manual from the panel either open or shut. In auto position, the valve is set to open on RCS pressure of 2255 psi and close when pressure raduces to 2205 psi. PAGENO="0701" 697 ENC. 1 X~AL LPA.F SYST~4 DESCRIPTION (Index No. 43) -. CONDENSATE POLISHING SYSTEM * (B&R Dwg. No. 2006, Rev. 13) JERSEY CENTRAL POWER & LIGI~ COMPANY THREE MILE ISLAND NUCLEAR STATION UNIT NO. 2 Issue Date Septéxr~ér, 1975 Prepared by. A. D. Pullin Burns and Roe, [nc. 700 Kinderkainack Road Oradell, N. J. 07649 PAGENO="0702" 698 TABLE OF CONTENT~ FOR DE~SATE POLISHING SYSTEM Section 3.0 .P3~R0Dt~T10N 1.1 System Functions 1.2 Summary Description of the Syst~ - 1.3 System Design Requirements 2.0 DETAILED DESCRIPTION OF SYSTEM 2.1 Components 2.2 Instruments,. Controls, Alarms and Protective Devices 3.0 PRINCIPAL MODES 0P 0PEPATION~ 3.1 Startup 3.2 Normal Operation 3.3 Shutdown 3.4 Specialor Infrequent Operatiän 3.5 Emergency 4.0 ~ARDS AND PRECAUTIONS Page 1 1~ .5. 9 .9 .23 26 * 26 * 27 28 * 28 * 29 29 PAGENO="0703" 699 APPENDIX Title ~~1e No. Influent ~Condensate Water Analysis 1 Effluent Condensate Water Quality 2 Condensate Polishing Tanks 3 Mixed Bed Resin 4 Regeneration Tank 5 Mixing and Storage Tank 6 Hot Water Tank 7 Acid Storage Tank 8 Acid Polisher Pumps 9 Caustic Storage Tank 10 - ~ Caustic Polisher Pumps - Aqueous Ammonia Storage Tank*.* . . 12 Aqueous Ammonia Pumps . 13 Sodium Suiphite Feeder & Storage Tank 14 Sodium Suiphite Pumps 15 Condensate Polisher Regeneration Sump and Pumps 16 Ammonium Hydroxide & Hydrazine Feed and . -. :. Measuring Tanks** 17 Anunonium Hydroxide and Hydrazine Feed Pumps 18 Ammonium Hydroxide Mix Tank .~ . 19 Ammonium Hydroxide Mix Tank Pump - - * 20 Panel-Mounted Annunciator Inputs 21 PAGENO="0704" 700 CaWENS~TE POLISHING SYST~4 I C ~NTRODUCTI0N $~$t~Itt FUflCtiOflS The prLnary function of the Condensate Polishing system .is to reduce the level of suspended and dissolved impurities in the Peedwater and Condensate system to acceptable levels, and thereby eliminate im~urit that could cause corrosion of steam generator tubes. In addition, the system can regenerate its exhausted resin beds in periodic stages and transfer the regeneration wastes for treatment and disposal, The system a.s designed to treat the discharge of the condensate pumps before it enters the feedwater heaters and steam generators~: Polishing the condensate minimizes buildup of scale on the heat transfer . surfaces of the feedwater beaters and steam generator tubes~ which would reduce their heat transferability and result in a lower. thermal efficiency of the power plant. In addition the Condensate Polishing System provides axcanonium hydró~~ and~ hy~razine feed to the Condensate and ~ed~ater Sy for maintaining feedwater pH and scavenging oxygen respectively. The Condensate Polishing System has an interface with the following systems: . I (Drawing numbers refer to Burns and Roe flow ãiagrams.) .. a. Peedwater and Càndensate . .. (D4g. No. 2005) b Makeup Water Treatment (D~4g No 2006) c. Demineralized Service Water .. (1)4g. No. 2007) d. Service Air . . .` (mpg. No. 2014) e. Secondary Plant Sampling (D4g. No. 2015) f. circulating Water (Deg. No. 2023) -. g. Radwaste Disposal R.C. Liquid (Dwg. No. 2027) ..l- PAGENO="0705" 701 h Radwaste Disposal Solid (Dwg No 2039) ~. Radwaste Miscellaneous Liquid (Dwg No 2045) ~ Suxnp Pump Discharge (Dwg No 2496) k. Radiation Monitoring 1.2 Summary Description of the System (Refer to B&R Dwg. No. 2006, Rev. 13, and L*A Water Conditioning Co. Dwgs. No. D-4519 D & D - 4522?) The Condensate Polishing System norma~ly processes and chemi. cally feeds the discharge flow of two out of. three condensate pumps, except for the flow to the turbine exhaust hood sprays. The condensate pumps discharge flow can bypass the condensate polishing tanks through valve CO-V12 (reference S.D. No. 4?., Feedwater and Condensate, for description of condensate polish-S ing system bypass The c 4ense~. passes throegI~ seven polisYtfng tanks operating in a parallel flow arrangement. An eighth polishing, tank is in standby to be used when the mixed bed resin in any of the * other seven polishing tanks is exb~austed. A resin bed is * exhausted when a predetermined measured total flow has passed through a polishing tank, a high pressure drop occurs across t~he system and/or resin trap, or when the conductivity of a polishing tank effluent exceeds a predetermined allowable level Each condensate polishing tank contains a mixed bed of cation and anion exchange resins. Dissolved impurities in the water are in the form of positively charged ions called cations and negatively charged ions called anions. As these ions pass through the polishing tanks mixed bed resin, the cations are -2- 48-721 0 - 79 - 45 PAGENO="0706" 702 ionically bonded to the cation resin in exchange for. an arnmqnium ion (NH~) which had been previously intentionally bonded to the cation resin during the axrmioniation process in -. regeneration. The anion-s are ionically bonded to the anion resin in exchange for a hydroxide ion (OHI which had previously been intentionally bonded to the anion resin. This ion exchange is the means by which the dissolved impurities are removed fron the condensate. - The resin bead diameter is small, in the range of 20 (0 .84 usa) to 40 (0.42 nmmi'mesh. As water flows through the bed, suspended impurities are removed from the condensate by the resin acting as a filter. - - - - - - For regeneration when a mixed bed resin is exhausted, the ~xhauste~ xesin frcm the polishing tank is transferred~ to the ~egen- eration tank and a spare resin bed is transf~rred from the mining -an~.storage tank t~ the- erupty polisbi task,.. 1:.* ~. Regeneration now begi~us by the induction of ~bemicals. The exhaus resin is first cleaned with sodium suiphite (f~7a2sa3) from the - sodium sulphite storage tank. The porpose 4 chemically cleaning the resin with sodium suiphite is t+ remove from the rest iron impurities that had been removed from tile conderi sate. The mixed resin bed is then backwasheá to separate the cation and anion resins which are of differe~mt densities. The anion resin bed is then regenerated by injeching the bed with - diluted caustic (NaOH). The caustic regener4ition pump takes sodium hydroxide from the caustic storage .ank and. meters the caustic into a blending tee where1 a controlled -flow of prenixed hot water from the hot water-tank and sluice water frbm the demineralized water storage tank is blended with the caustic fordilutiop, The diluted caustic is then injected into - the anion resin bed. During anion regeneration, the negative -3- PAGENO="0707" 703 impurity ions bonded to the anion resin during the polishing cycl.e are removed and replaced with hydroxide ions. After re-. generating the anion resin bed, the cation resin bed is regen- erated. First the bed is injected with diluted sulphuric acid. (H2S04). The acid regeneration pump takes sulphuric acid from the acid storage tank and meters acid into a blending tee where a controlled flow of sluice water from the demineralizdd water system is blended with the acid for dilution. The diluted acid is then injected into the cation `resin bed. During this re- generation step, the positively charged impurity inon, bonded' to the tion resin during the polishing cycle, are removed and replaced with hydrogen ions. Next, the cation resin bed or the'.exltire. bed, is animoniated by the injection of diluted aqueous ammonia (NH4OR). The aqueous ammonia pump takes aqueous axumoni~ from the ~ ~mini~,j~ etarage tank and meters ammonia into a blend- ing tee where a controlled flow of sluice wat~r is blended with the ammonia for dilution. The diluted ammoni4 is then injected into the cation resin bed. The amtnonium ions I(NH~) replace the hydrogen (H+) ions from the previous steps of ~regeneration. The reason for ainxnoniating the cation resin iE~ so that the cation resin will not remove ammonia from the ~condensate. The condensate contains ammonia for the purpose o~ controlling the condensate pH. The resins are next rinsed and transferred to ~the mixing and storage tank where the beds are intermixed. ¶~he regeneration cycle is then completed and this spare mixed 1ed is ready to transfer to a polishing tank as required. -4- PAGENO="0708" 704 The sluice water and chemical wastes are directed to a drain pot and then to the condensate polisher regeneration sunip, to th9 neutralization tank, Or to the miscellaneous waste * holdup tank depending on chemical concentrations and/or * radioactivitY levels. Blank tees are provided for resin removal or refill. The Condensate and Peedwater chemical feed consists of two chemical solution `tanks, two chemical solution measuring tanks, an axrunonium hydroxide mix tank, two chemical hand pumps, arid. four chemical feed pumps. Chemical addition of ammonia and bydrazine is injected as determined from stream samples of the feedwater for pH control and to remove dissolved oxygen in the feedwater The system is provided with the Condensate polishing controL Panel No. 304 in the Turbine Building. The control panel haS. a dyàtem flOw c?tagram Wh±dr gives e graphic repr.e.mtatiom the process The action of all the active components of the system is indicated by lights on the panel to. show the step of any cycle in progress. The transfer of resin is initiated from the control panel. The resin regeneration -cycle can be manually or automatically controlled from the control panel. The bydrazine and ammonium hydroxide feed is controlled automat- idally by the Recorder-Analyzer Panel 310: (refer to System De- scription for Secondary Plant Sampling, Index No. 12) and man- ually shutdown from Panel 305. - * * 1.3 System Design Requirements - The condensate polishing system is designed to handle the con- densate discharge from two out of three condensate pumps to a niaximun flow rate of 17,400 gpm and maximum shutoff head of 200 psig. This maximum flow rate is to be disttibuted:-through sev 5 PAGENO="0709" 705 polishing tanks arranged in parallel flow with an eighth tank as standby to be put in operation when the resin in any of the seven operating polishing tan~s is exhausted The flow rate to be handled by one polishing tank is 2 487 gpm which is 50 gpo per square foot of resin bed area in the directiQa of condensate flow. The design temperature of the polishing tanks is 1350F The design pressure is 200 psig The maximum pressure drop across a mixed resin bed is 50 psi Each polishing tank has an underdrain designed to withstand a differential pressure of 200 psi~ A resin trap is located in the outlet of each polishing tank to prevent resin from entering the feedwater system Based on influent conden.-. sate water analysis (Table 1) the condensate polishing sys- tem will deliver effluent condensate water quality as given in Table 2 for normal operation During in.ttia]. and subse-. quant. startups~the polishers will reduce all suspended and dissolved solids to 50% of the irrfltrent concentrati~ o~ 60 ppb whichever is greater During periods of condenser leakage (1 gpo) the polishers will, reduce total dissolved solids to not more than 50 ppb and wi]]. reduce suspended matter to 10% of influent concentration or 25 ppb which-.. ever is greater The minimum condensate volume treated by each continuous oper-. ating cycle of a polishing tank during normal operation is at least 160,000 gallons per cubic foot of resin. The capacity of a unit when handling normal condensate during extended operation is equivalent to appro~cimate].y 30 days per polish- ing tank at 2500 gprn. The expedted capacity of a unit during startup, bnsed on startup condensate water analysis (Table I.) before cleaning is required will vary with influent quality LuL ,~1iou1d ~v~r~gc 32 000 g ]lo, per cubic' fo-~ of rec~n -6- PAGENO="0710" 706 This will exhaust a mixed resin bed in about 24 hours of continuous operation at 2500 gpm . Foll~iing periods of ex~ tended shutdown, corrosion product contamination of the de- mineralizers will be substantially greater, requiring store frequent sodium sulphite soaking and backwashing but not more* frequent chemical regeneration. A sodium suiphite soak and backwashing of each dernineralizer will be required after pro.. cessing at least 32,000 gallons per cubic foot of resin. Such backwish requirements may extend for a period of u~ to a month following an. extended shutdown. The cation and anion. resins are, stable under design requirements. Mechanical de-. gradation of the resin will occur from transferring the resin and will require replacement of the resin at a future time. A hydrogen regeneration cycle, consisting of sFxlium sulphite~ acid, and caustic treatment, used during stari~up takes approxj-. n&te~y! ~4O~ min~t.... An `~~~oeAate.d regeneration cyoia conaist-~-~ ing of a hydrogen cycle and axnmoniation, used ~uring normel operation, takes approximately 600 minutes. ~re total amount of sluice water required for a hydrogen regeneration cycle is - approximately 20000 gallons. For an aemoniat~d regeneration cycle, the total amount is approximately 40,000 gallons. The * peak rate demanded is 200 gpm. The regeneratij~rt sluice water source comes from the water treatment demineraljzers or from the 1,000,000 gallon demineralized water stor~ge tank. The seismic design classification of the eg1ip~nent is Class 11. Equipment is designed for Zone 1 loads. The condensate main imfluent and effluent head~ers and piping to each polishing tank are carbon steel. T~te main resin pipe is rubber.-lined carbon steel. Thm regeneration and mixing arid storage tanks, the resin pipi:ig, sluice wz,Lcr piping, over- I]o~;, and drain-line branch piping is rubber-lined carbon PAGENO="0711" 707 steel. The dilute and strong acid piping is alloy 20. The dilute and strong caustic piping is stainless steel. The ammonium hy. dro~ide and hydrazine chemical feed lines are carbon steel. The piping is designed, fabricated, inspected, and erected in accord- ance with ANSI Standared Code for Pressure Piping B3l.l.O. Two positive-displacement, acid-natering pumps and two positive- displacement, caustic-metering pumps are -furnished. One acid and one caustic pump are required to operate in a regenerating cycle and the other acid and caustic pumps are stanmy pumps. The acid system is specially designed to prevent backflow of dilution water into the strong acid line and vice versa * This special design incorporates a program contact which opens the dilution valve starting flow of dilution water only When this dilution flow is established to proper amount, the flow switc»=* contact makes, startin, the acid pump, and at the same time opens the two acid block valves and closes the acid line bleed valve. The procedure is reversed darxi~ sbutd~ Bulk ateae~ eC. 93% sulphuric acid W~so4 and 504 sodium hydroxide (Naoa) is provic~ed by two 6400-gallon tanks Dilution of acid to 8% and caustic to 4% takes place in mixing tees,~ where the chemical and sluice water are blended. The dilution water for the caustic is temperature regulated by blending sluiàe water and hot water from the hot water tank. A 5000-gallon capacity - - storage tank for 28% aqueous ammonia (N54ou), and three metering pumps are provided for the resin asurioniating regeneration cycle Two pumps are required to operate during the anunoniation cycle. - Dilution, of the ammonia to 6/ ta~es place in a blending tee A dry sodium su-lplTrte feeder with solu.tion chanher provides liquid sodium ~uphite (Na2S9~) There are twn sodium sulphite centrifugal pumps of which one must be in operation during, the `regeneration - cycle. Dilution of the sodiun-sulphite to.4% takes place `in~a.. blending tee Selector switches and indicating lights are provided PAGENO="0712" 708 pumps and valves controlled from the Condensate Polisher Control Panel. Interlocks are provided to that resin cannot be transferr~ fr&n a polishing tank to the regenerating tank while a resin bed is ~eing regenerated. Another interlock prevents the initiation or terminates a resin regeneration cycle when the neutralizing tank level is high. The condensate and feedwater chemical additi~ subsystem is designed to add a.'~raonium solution to maintain the feedwater pH at 9.4 to 9.5 and to add hydräzine to maintain ~ feedwater oxygen level at 0.0 to 0.005 ppm maximum at 8.7 million p~~S per hour. The hydrazine is effective at a temperature range of 1800F to 400°F The air pressure requirements are 80 peig ~nAnumum and 125 psi.g maximum. The maximum air temperature is 150°F. The service air requirement per regeneration cycle is approximately 5 000 * standard cubic feet with a peak flow rate of 180 standard cubic feet per minute. The air lines are provided with pressure gages,~ regulators, and filters for niixing and motive air supplies. Thej compressed air system provides a 250 cubtc feet aLz~ receiver process air to the Condensate Polishing System (reference S D 1 No 10 Instrument and Service Air) The condensate Polishing System is designed to automatically divel radioactive regeneration wastes to the miscellaneous waste ho1d-.~ tank (refer to Radwaste NiscellaneOus Liquid System Descriptiàn~ Index No. 45A).. The Condensate Polishers~ Regeneration Station, lO7Unit Cation Sample Columns, and the Regeneration Sump are shIelded, with a 12-inch thick concreke wall to the top of the Condensate polishers to reduce the dose level to 0.5 mr/hr (max. in the Turbine Building when the radiation buildup in these comp ents exceeds the allowable level from a primary to secondary sys' leakage of 10 gal. per day with 0.1% failed fuel. Area radiatio: monitors are providedwithin this shielded area to alarm abnoumat radiation levels. DETI\ILED DESCRIPTION OF SYSTE__ Cornoonents -9-- PAGENO="0713" 709 j.1 Condensate Polishing Tanks, CO-K-lA, lB. 1C.1D~, in, ip, 1G. 111 The eight Condensate Polishing T~nks (Table 3) are vertical cylindrical tanks skid mounted `~ ith four polishing tanks per skid, arranged for parallel flow. Each tank is designed for 2,487 gpo and a pressure of 200 psig. Each tank material is carbon steel-lined with 3/16 inch thick rubber and contains a mixed bed of resin (Table 4) which is used to remove dissolved and suspended impurities from the condensate. Seven tanks are normally in service with a total flow capacity of 17,400 gpo. One tank is held in stan~y to replace exhausted resin beds. - The tank internals consist of stainless steel header with lat- erals for the inlet, a stainless steel line for the resin inlet, and a steel header with stainless steel 50 mesh screening for the under-drain, Limes are provided for condensate influent aria sampl-. ing resin in air in venting condensate effluent and sampl.. a.u,. resin out sluice water addition and bypass to the con- denser * A 12-inch diameter carbon steel strainer is provided in the * discharge piping of. each polishing tank rated for a differen- tial pressure of 200 psig. The pressure drop across the strain- * er is less than.5 psig when clean ata flow rate of 2,500 gpo. Ea~ch tank is alsoprovided with local influent and effluent pressure gauges. . The Condensate Polishing tanks are located in the Turbine Build- ing at elevation 281' - 6". * 2.1.2 Regeneration Tank, CO-T-2 The regeneration tank (Table 5) is a vertical, cylindrica' tank, ~kic1--mountcd. it is used to receive and regenerote the c>thaust- -10- PAGENO="0714" 710 `ed mixed bed resin front a polishing tank. The tank is designed for 100 psig and a temperature of 1200?. The tank material is carbon steel-lined with 3/16 inch thick rubber and can regenerate one mixed bed at a time. Lines- are provided for resin in, air in, sluice water in, diluted chemical addition, venting, draining and resin out. The tank contents can be sluiced to the mixing and stor-. age tank. The tank internals consist~, of an alloy 20 header with laterals for chemical injection and an .underdrain with~ stainless steel laterals and screens. The tank is provided with two glabs sight ports with lights and a blank tee for resin refill or~ removal on resin inlet piping. The Regeneration Tank is located in the Turbine Building at elevation 281' - 6". .1. Y ~ &tes~aqs Tank, CQ-T-3 I The mixing and storage tank (Table 6) is a vez!tical, cylindri- cal tank, skid-mounted. It is used to receiv~ regenerated resin, air mix i~t, rinse it, and store the re5~in. The tank is designed for 100 psig. The tank material S!~s carbon steel-lined with 3/16 inch thick rubber and can accept on~ regenerated mix- ed bed at a time. Lines are provided for resi'n in, air in, venting s3uice water in, draining, and resin transfer1 A spare ninth mixed resin bed is stored in this tank, to be dluiced to a pol- ishing tank as required. *The tank internals lonsist of an underdrain with stainless steel laterals and $0 mesh screens. The tank is provided with two glass sight ports with lights and a blank tee for resin removal on the resin tr~nsfer piping. The mixing and storage tank is located in the Turbine Building - ~ e1cv~tLiurt 281' - t. -1 1- PAGENO="0715" 2.1.5 Acid Storage Tank. WT-T-7 . . . ( The acid storage . tank (Table 8). is a horizonta * cylindrical tank used for storage of concentrated 93% su1p~turic acid (H2S04) The tank provides acid in)ection to ~~oth the makeup water treatment system and the condensate polishing system The tank capacity is 6 400 gallons and is des4ned for attnos- pheric pressure The tank material is carbon kteel-lined with 6 mils of Keysite *100 Lines are provided fo!~ external fill- ing breather with desiccating cylinder vent with check valve and suction plus relief return for each of four acid pumps A liquid level indicator with alarm switches .i~ mounted on the tank with an air connection The acid storage.tank. is located in the. Coagulator Building. -12- 711 2 ~ 4 hot Water Tank CO-T-4 The hot water tank (Table 7) is a vertical, cylindrical tank, `~ skid-i unted. It is used to heat sluice water for caustic dilution. The tank capacity is approximately 900 gallons and is designed for a pressure of 100 psig. The tank material is carbon steel-lined with Apexior. The tank internals include a 480v, 50KW electric immersion heater used to heat the demineralizecl. water from 400F to 1800F. Lines are provided for demineralized water inlet, heated water outlet, and relief. The tank is pro-S vided with local temperature indicator, . level switch, and thermostat for temperature control.. . . .. . The hot water tank is located in the Turbine Building at elevation 281' - 6~. - .. . . . .. .. . . PAGENO="0716" 712 2.1.S Acid Polisher Pump. WT-P-l4 The acid polisher pump (Table 9) is a simplex diaphragm type pump w~Lth a capacity of 130 gph at a rated discharge pressure of 30 psi. It is equipped with an external relief valve set at 40 psi, suction strainer, manual suction and discharge valves, and a discharge tap with surge chamber and pressure gauge. The purpose of the fump is to transfer concentrated sulphuric acid from the acid storage tank either to the regeneration tank after passing through a mixing and dilation tee or to the neu~ tralization tank. A spare acid pump CWT-P-~3l) is provided for both the makeup water treatment system and condensate polishing system (refer to the Make-Up water Treatment System Description, Index No. 4c). -: The pump is driven by a 1/2 hp inotor~ Pump control and indica- tion is from the Condensate Polisher Control Panel * The pump is pàwered fr~ 14CC 2-311). - The pump La located in tb.e Coagula I tor Building on top of the acid storage tank* 2.1.7 Caustic Storage Tank, WT-T-8 The caustic storage tank (Table 10) is horizontal, cylindrical tank used for storage of 50% sodium hydroxide (NaOH). The tank provides caustic injection to both the makeup water treatment - system and the condensate polishing system. The tank capacity is 6,400 gallons and is designed for atmospheric pressure. The tank material is carbon steel lined with 12 mils of Keysite #740. Lines are provided for external filling, vent, and suc. tion plus relief return for each of four caustic pumps. The tank internals have a 5KW electric heater to maintain the -13- PAGENO="0717" 713 caustic:solution heated to ~ Aliquid level: indicator with alarm switch a temperature indicator and a temperature controller including a low level cutoff for heater control are mounted on the tank. The caustic storage tank is located in the Coagulator Building. 2.1.8 Caustic Polisher Pump, WT-P-13~ The caustic polisher pump (Table 11) is a simplex diaphragm type pump with a capacity of 160 gph at a rated discharge pressure of 30 psi. It is equipped with an external relief valve set at 30 psig suction and discharge isolation valves and a discharge tap with surge chamber and pressure gauge. The purpose of the pump is to transfer caustic from the caustic storage tank either to the regeneration tank after paSsiag~. t2~romgb~ a. mixing. and ifilution tee or to the neutrali- zation tank A spare caustic pump (WT-P-.l2) is provided for both the make up water treatment systen and condensate pol-. ishing system (refer to the Make-Up Water Treatment System Description Index No 4C) The pump is driven by a 1/2 hp motor. Pump control and mdi-. cation is from the Condensate Polisher Control Panel The pump is powered from MCC 2-31D. The pump is located in the Coagulator Building on top of the caustic storage tank 2.1.9 Aqueous Ammonia Storage Tank, AN-T--6 The aqueous ammonia storage tank (Table 12) is a horizontal, cylindrical tank used for storage of 28% aqueous ammonia. -14- PAGENO="0718" 714 * The tank provides ammonium injection for the condensate po].~ ishiz~g system regeneration cycle. The tank capacity is 5,000 gallons and is designed for atmospheric pressure. The tank material is unlined steel. Lines are provided for ~i1lIng, vent, and suction plus relief return for each of three aqueous ammonia pumps. A liquid level indicator with alarm switches is mounted on the tank with an air connection. The aqueous ammonia storage tank is located in the yard area on the south side of the Coagulator Building. 2 * 1.10 Aqueous Ammonia Pumps, AM-P-4A, 43, and 4C The aqueous ammonia pumps (Table 13) are positive displacanent type metering pumps with a capacity each of J~9gph at a rated discharge bead - of 40 fit. They are ecpdpped with exter- nal relief valves set at 50 psig.,suction strainer, manual suc- tion ari& discharge isolation valves, aed a diLcharge tap- with ~ surge chamber and pressure gauge. - The purpose of the pump is to transfer comcen at~d aqueous ammonia from the aqueous ammonia storage tank to the regenera- tion tank after passing through a mixing and ~ilution tee. Two pumps are operated during the regeneratioi cycle with the third on standby. The pumps are driven by 1/2 hp. motors. Pmnpt control and in- dication is from the Condensate Polisher Conti~o]. Panel. The pumps are powered from MCC 2-31D. The pumps ~re located in the yard area on top of the aqueous ammonia storage tank south of the Coagulator Building. * -15- PAGENO="0719" 715 2.1.11 Sodium Sulphite.Feeder and Storage Tank, WT-M-l and W~~-T-3.1 The sojlium sulphite feeder and storage tank (Table 14) in- eludes a dry sodium sulphite storage hopper, a notor driven dry feeder, and a solution chather with mixer. The dry sodIum- sulphite is mixed with demineralized water from the demineral- ized water storage tank into a saturated solution. The sodium suiphite solution is used to remove iron impurities during the regeneration cycle. The tank capacity, is 50 gallons and is designed for atmospheric pressure. The tank is carbon steel~ Lines are provided for denineralized water addition, overflows drain, and suction to the two sodium suiphite pumps. The tank internals include a make up water float valve and portable 1/4 hp motor driven mixer. The sodium sulphite feeder and storage tank are located in the Coagulatoiz ~u;ld1ng- 2.1.12 Sodium Sulphite Pumps, WT-P-l5A and 153 The sodium ~u±~J~te pumps (Table 15) are centrifugal type pumps with a capacity each of 6 gpn at a discharge pressure of 30 psig.. They are equipped with manual suction and discharge isolation valves, discharge check valve and a discharge rotoneter, rate . setter, and flow gauge. The purpose of the pumps is to transfer sodium sulphite from the sodium sulphite storage, tank to the regeneration tank after passing through a mixing and dilution tee. -16-. PAGENO="0720" 716 The pumps are driven by 3/4 hp motors Pump control and inch- cation is from the Condensate Polisher control Panel. The - pumps are powered from MCC 2-311). The pumps are located in the Coagulator Building. - 2.1.13 Condensate Polisher Regeneration Sump end Pumps, WT-P-19A andB The condensate polisher regeneration sump is a stainless steel lined concrete vault used to receive the liqaid wastes from either the Condensate Polisher System (if pH within limits) and/or from the Control Building Area and/or the Turbine Building flopr drains (if radioactivity in these sumps exceeds limits). The camp dimensions are 10' x 10' x 3'-G" deep with, a capacity of 2600 ~allor~ The purpose of the sump is to route radioactive liquid wastes to the Miscellaneous Waste Hold-Up Tank The two condensate polisher regeneration sump pumps (Table 16) are vertical duplex type sump pumps Each pump is rated at 200gpm at a total dis-. charge head of 80 feet Each pump is driven by a 10 hp motor Costrol and iadicat.ion is provided locally Pump W~~-P-I9A is powered from MCC 2-3Th and pump VT-P-19B is powered from MCC2~.71A 2.1.14 Ammonium Hydroxide and Hydrazine Feed and Measuring Tanks, AM-T-l. 2, 4, 6 The amrnonium h~rdroxide and hydrazine feed and. measuring tanks. (Table 17) are vertical, cylindrical tanks, skid mounted. The tanks are used for feedwater chemical treatment.. The feed tanks. have a capacity'of 150 gallons each and the measuring tanks approximately 6 gallons. The tank material is 1/8 inch stainless steel. - Lines are providea for manual pump filling, chemical pump suction, relief return, venting, overflow, draining, measur- ing tank interconnection and demineralized water addition. The amtnônium hydroxide feed tank only has a chemical injection line. The tanks include local level gauge, and level switches. -17-- PAGENO="0721" 717 The anusonium hydroxide and hydrazine feed and measuring tanks are located in the Turbine Building at elevation 281 -6" 2 * 1.35 Ammonium Hydroxide and Hydrazine Feed Pumps * AM-P-lA, 15 and 2 The anmcniuin hydroxide and hydrazine feed pumps (Table 18) are simplex diaphragm, positive displacement type pumps of cast-iron and 316 S .5. respectfully, with a capacity of 15 gph at 180 psig. Each pump is equipped with an external relief valve set at 250 psig, pneumatic stroke adjustor, suction strainer, manual suction and discharge valves. The hydrazine feed pumps (AM-P-lA and 15), supply hydrazine. to the Condensate and Peedwater System (refer to System Description, Index No. 7A) for oxygen control and the ammoniun hydroxide feed pump (AM-P-2) supplies anmonium hydroxide for pH control by transferring these chenicals from their respective feed tanks to the feedwater at the effluent line of the condensate polishers The pumps are 5rfven hy Z/4~ ?ip notors~ Pemp controls are auto- matic from a Recorder Analyzer Panel. 310 (refer to Secondary Plant Sampling System, Index No. 12). Nanual shutdown control and indication is provided from the Control Panel 305. The pumps are powered from MCC 2-31D. The pumps are locá'ted in the Turbine Building on top of theirrespective feed tanks. 2 1 16 Ammonium Hydroxide Mix Tank ATI-T-7 The axnmonium.hydroxide mix tank (Table 19) is a vertical,, cylin- drical tank used as a spare source of ammonium hydro,cjde for feedwater chemical treatment if the ammomium hydroxide feed tank (AM-T-l) and/or the ammoniurrt hydroxide feed pump (z~1-p..2) are out of service. The tank has a capacity of 60 gallons and is designed for atmospheric pressure. The tank material is :3/16 inch stainlesssteel. Lires are provided for aqueous ammoni injection, venting, draining, demineralized water for dilution, samplinc~ and chemical discharge. The t~1~ is provided with local level cjaugc. -17a~- 48-721 0 - 79 - 46 PAGENO="0722" 718~ The ammonium hydroxide mix~ tank is located in the Turbine Build-S ing at elevatiOn 281 - 6" 2 1 17 Amrnonium Hydroxide Mix Tank Penn AM-P-3 The axnmoniUm hydroxice mix tank pump (Table 20) is a simplex diaphragm, positive displacement type pump with. a capacity of 10 gph at 275 psig. The pump is equipped with manual suction and~ discharge valves and a discharge check valve. The purpose of the pump is to transfer anmtonium hydroxide from the ammoniun hydroxide mix tank to the condensate polishers effluent piping. The pump is driven by a 1/6 hp motor Peep control and indica. tion is local. The pump is powered frcsa NPT-1A. A local "ON-OFF" control switch with overcurrent trip is provided. The pump is located in the turbine Building at elevation 28].'-6~. 2 1 18 Major~$ysten Valves Condensate Polishing Tanks_Influént Valves M81 and ESiny through--i N~l and MI1BY for Tanks CO-K-lA through CO-K-fl! Each condensate polishing tank has a 150#ASA Influent double acting air motor operated 12" butterfly valve and 1 bypass diaphragm operated ball valve. The bypass valve is opened first to equalize the pressure across the larger.valve. These valves are controlled. locally from the Condensate Polisher Control Panel. Air is supplied from the Service Air System. The influent valves fail as-is on loss of power or air and the bypass valves fail open. Condensate Polishing Tanks Effluent Valves M82 through Ml2 * For Tanks CO-K-lA through CO-K-1H *.. Each condensate polishing tank has a 150 #ASA effluent pneu-* -. )t~')! or~ratr~1 12 hutte~fly valve wlt~i positi&~er IndIcation -1)b- PAGENO="0723" 719 "used to balance the condensate flow These valves are controlled locally or from the Condensate P0L.&zer Control Panel Air is supplied from the Service Air System. These valves faiI~ as-is on loss ofVpoweror air. * Condensate Polishing Tank Recyclin~ Valves, 1486 through Ml6 for-Tanks CO-K-lA through C0-K-1H and MC-Z Each polishing tank has a 150 ~ASA pneumatic motor operated 8" balI. * valve which is used to recycle high conductivity condensate flow* through the polishing tanks back to the condenser. Additionally, a pneumatic motor operated 3" ball valve is - provided to isolate the condensate polishing system from the "H condenser These valves are controlled locally or from the Condensate Polisher Control. Panel. Air is supplied from the Service hir System. These valves fail as-is on loss of power or 3.oss of air Coade~sat~. Eo1ishin~ Tank Resin Transfer Valven, M83, M~5, 1488 hnd 1489 through 1413 1414 MiS 1418 and 1419 for Tanks CO-K-lA through C0-K-lH - Each polishing tank has the following pneumatic ball valves to transfer resins to the regeneraticrt tank (C0-T-2) and receive resin from the mixing and storage tank (C0-T-3) * (Typical for Tank CO-K-lA) - a. Tank Vent - 1483, 2" - b Transfer air - 1484 2 c. Resin in -. 1485, 2½" - - d Sluice Water - 1488 2 e. Resin out -1489, 2½" - Local and Condensate Polisher Co~trol Panel controls are provided for nanunl or automatic regeneration transfer cycle. Air is sup- plied from the Servièe -Air Sye~o~-. These va~1ves fail fis-is -on loss - of power or air. - -3M- PAGENO="0724" 720 * Regeneration Tank Resin Regeneration Valves, Cl, C2, C3~ç~, C6, C~7, C8, C9, dO, Cli, C14, Cl5, C16, and C17 The regeneration tank has t~ following 1254k diaphragm double act- ing operator to transfer and. regenerate resin: a resin in - Cl 2½" b. resin return - C15, 2½" (from mixing and storage tank) c air in -CII 1½" andC6 2" d sluice water - C16 1½ C14, 3" and C5 3" C7,2' e ammonia injection - C17 1½" and C2 1½' f dilute caustic in - C9 2 g dilute acid in - C3 2" h. resin out C8, 2½" i sodium sulphite in - ClO 3 I These valves are controlled from the: Condensate Poifs?iér Con-. trol Panel and can be manually or autonat3.c~lIy actuated for a regeneration cycle Air is supplied from the~Service Air System. These ualves are air toopen and cloE~e~ ~ and Storage Tank Resin Transfer Va1vès.~ Si, 55, S7, SB and S9 The mixing and storage tank has the following 125# diaphragm double acting operator valves to rinse, mixand tra$fer resin: a. air in -SI, 1½', S7. 2" b. siuice water in - S5, 3", S9, 1½" c. resin out - S8, 2½' These valves are controlled frort the Condensate Pplisher Control pnn-j ~`1 nnhe mar~u~tl1y or auto~aticnlly actuated for a final -19- PAGENO="0725" 721 rinse cycle AIr is supplied fron the Service Air System These valves fail closed on loss of power or air. - Chemical Injection Valves, RiP through R12P The chemical injection, lines teed to sluice water lines have 125# diaphragm double acting operator control valves either to dilute and route chemicals to the regeneration tank (Co-T-2) or to route concentrated chemicals to the neutralization tank' (wT-T--9). The fo].lowing groups are associated with each chemi- cal in3ection a * Acid injection, RiP through R4P, . .. b. Cai~m tic injection, R5P through R8P c. Sodium sulphite injection, R9P through RiO? d. Ammonia injection, Rh? and R12P These valves are controlled from the Condensate Polisher Control Panel and can be manually or automatically `actuated for a regeneration cycle. Air is supplied from the Service Air System. These valves require air to open' and close except `for R3P and R7P which are spring to open and `air to close an~ R5P, R6P, and B8P, which are air to open and spring to close. Liquid Waste Discharge Val~~, C4, Cl2., Cl3, ~, S4, ~ SlO, Xl, and X2 , `. ` The regeneration liquid waste have the following l25~ diaphragm double acting operator control valves to route these wastes to. - either the drain pot or to the high conductivity regeneration waste discharge line: -`U- PAGENO="0726" 722 a. air to drain pot C12 2". and S2, 2~ b. regeneration tank wastes - ~l3, 3" and C4, 3" c. mixing and storage tank wastes S4. 3" and 56, 3" d. sluice water *. Sb. .2" e. drain pot transfer valve Xl, 3" f. regeneration waste transfer valve - X2, 3" These valves are controlled from the ~ndensate Polisher Control Panel and can be manually or automatically actuated for a regeneration cycle. Air is supplied from the Service Air Systen. These valves require air to open and air to close. Regeneration Waste Effluent Valves w'r-v-iis and ~qT-v-l1g * ~ 3:*TT~!,.. }5e.}.~ PINSI, 200PP, diaph*a~ operated- two.-poei-. tion valves are used to route regeneration waste with high conductivity * to the neutralization tank (WT-V-llS) or to the miscellaneous waste hold-up tanks (WT.V-1l9) if radio- * activity level of the solution is high. These valves are con- trolled by a radiation detector (WT-R-3894) which monitors the radioactivity level of the regeneration waste. If the radioactivity exceeds the set pOint, the radiation monitor ccntrol will shut valve WV-V-lbS and opes valve ~T-V-fl9. * A local control switch is provided to~ override the radja-. tion monitor and open or shut either valve. These valves fail closed on loss of power or air. * -21- - PAGENO="0727" 723 Regenerant Sump Effluent Valves WT-V-115 and WT-V-l2l Two 4 pinch, 150 lb J~NSI, 2000F, diaphragm operated, two posi- tion valves are used to route the discharge from the Conden- sate Polisher Regeneration sunp pumps either to the mechani- cal draft cooling tower. (WT-V-1l5) or to the miscellaneous waste hold-up tank (WT-V-l2l), if the radioactivity level of the solution is high. These valves are controlled by a radia- tion detector (WT-R-3895) which monitors the radioactivity level of the regeneration sump pump discharge. If the radio- ~- activity exceeds. the set point, the radiation monitor con-S trol will shut valve WT-V-llS and open valve WT-V-l21. A local control switch is provided to override the radiati on monitor and open or shut either valve. These valves fail closed on loss of power or air. Miscellaneous Valves Valve I'IC-l is a 2½ inch pneumatic actuated valve used to drain. the condensate polishing tanks to the condensate polisher re- generation sump. . Valve BV-l is a 2 inch pneumatic actuated valve controll~d by thernostat (CS-TE) and used to regulate the sluice water temperature @ l200F for dilution of concentrated caustic. Valves PR-i & 2 are 2 inch pneumatic pressure controlled valvea used to regulate the air supply lime header pressure @ 15 psig to pass 140 SCFM to the condensate polishers and regeneration station. -27-- PAGENO="0728" 724 Instruments, Controls, Alarms, and Protective Devices Instri%entation is provided locally and at the Condensate Polisher Control Panel for monitoring the operation of the system. Full control of all functions in the condensate polishing system is possible from the Condensate Polisher Con- trol Panel, which also contains process control instrumentation and a graphic representation of the process. Each pump and pneumatic valve has indication and control from the control panel Condensate Pollb u.ng Tames Instrumentation The condensate polishing tanks flow rate, pressure drop, and water quality influent and effluent conductivity is continuous- lyrnonitored with the system in service. Flow orifióes (rn-FE and O1!-F~, ~low trirnsmittem (lB-PT andOIL-PT~, a.f]~m *~:~ recorders (lB-FR and OR-PR) indicate and integrate the flow rate of the system. The pressure drop is measured and recorded with instruments (H-DPT and H-DPR) and local indicator gauges (H-PIl and 2) provide influent and effluent pressures. Sam- ples are obtained in the condensate influent and effluent pip- ing and routed to the cation column (CO-G-l) for conductivity* measurement. Each condensate polisher is equipped with a solenoid enclosure which is a local control panel for valve indication and control. Each valve controlled from the panel has an "OPEN-AUTO-CLOSE" Control Switch. This allows local control of each condensate polisher tank. -23- PAGENO="0729" 725 A mixed ~bed resin bed, as previously mentioned, is exhausted when a predetermined measured total flow has passed through a polishing tank, a high pressure drop occurs across the sys-. tern, or when the tank effluent coiductivity exceeds a pre-. determined allowable level. Each condensate polishing tank has a flow orifice, transmitter, and recorder point to inea-. sure, indicatie, totalize, and record. the flow rate of each tank. Each tank has a sample connection, routed to the cation column (CO-G-l), on its discharge line for conductj-.. vity measurement. Additionally, each tank has local pres-. sure gauges on influent and effluent piping and differential pressure gauges across the resin traps to monitor tank and trap pressure drop. . Resin Transfer and Regeneration Cycle Control The mixing and motive air supply is provided with flow mdi-.- cators (RS-FI l&2) to pass 140 SCFM ® 80 psig, filters, plus local (RS-PI l&2) and remote pressure gauges (RT-PI & ST-pi). The sluice water supply is provided with flow orifices and indicators to monitor locally the flow to the polishing tanks (RS-FX-6), locally the total flow for the regeneration cycle (RS.-Fx-3) remotely the flow for dilution of caustic (Cs-FE, FT & FSIR), and remotely the flow for dilution of acid (AS-FE, FT, & FSIR). Local indicators for caustic, acid, and sodium sulphite lines are provided to monitor flow. -24- PAGENO="0730" 726 The two pen conductivity recorder, with three points for each pen, ~`~` on the Condensate Polisher Control Panel indicated the conductivity:.: of chemical waste in the regeneration and mix and storage tanks An identical two pen recorder is provided - for conductivity indication in the dilute acid and dilute caustic lines. ~. . The regeneration waste conductivity instrument controls the diversion1 of chemical waste (high conductivity), to the neutralizer tank, and other waste water (low conductivity) to the water. treatment suap :" through the, operation of two pneumatically operated valves. *` The controls of the regenerating station of ~ATC" Timers, re3.aj!s and pneumatic solenoid valves. The length of each step in the regeneratE sequonce (which can be fully automatic except for resin exchange)' is determined by adjustable individual step timers At the end of th~ allotted tine for an individual step the timer energizes the next timer for the following step Temperature control of caustic dilution water is mainta~i.ned by a thermesta.t. pisond. in. the hot water tank and a temperature element ~ (cS-TE) monitoring the dilute caustic and"controlLing the bieni valve which mixes the hot and cold water to maintain llO°p. Condensate Polisher SUmP Pumps Control . . Level control of the suinp pumps is provided by local "OFF-AUTO-STARe control switches (spring return to ATJrO). In "AUTO", level switches (WT-LS-3884-l, 2 &3) monitor sump level and start a lead pump on big~ level. A high high level starts the standby pump and alarms on Pane~ * 304. Low sump level stops all running pumps~ Status of lead `and" stand-by pumps is automatically interchanged for every cycle of ` operation. - ` - Condensate and Feedwater Chemical Feed - Control - . -. The automatic controls for the amzrtonium hydroxide and hydrazine subsystem are provided from the Secondary Sampling System (Refer to S.D. Index No. 12). A pneumatic to electric converteris -25- PAGENO="0731" 727 provided in the Makeup Water Treatment Control Panel and a `HANL~-OFF-AUTO" control switch for pump controls except for ammonium hydroxide nix tank pump (AM-P-3) which is locally controlled with an "ON-OFF" swiich. -. Radioactive Waste Discharge Control A radiation monitor is provided in the discharge waste line from the Condensate Polishing Regeneration Station to the Neutraliza- tion Tank tWTR-R-3894) and from the Condensate Polisher Regen. eration Swap discharge line to the Mechanical Draft Cooling Tower Blowdown (WT-R-3895). The radiation monitors provide input s3.gnals to the 2.ndlcatlng controllers (WT-Rr & FES-3894 *& 3895) to reposition control valves WT-V-l18/].19 & 115/121 to route the waste effluent to the Miscellaneous Waste Hold-Up Tank on exceeding 10 mr/hr. The alarms provided on the Condensate Polishe~ Contràl Panel are listed in T~ble 21. There is a conason alj~rm "Condensate Polishing System Trouble" annunciated in the control room on turbine auxiliaries monitoring Panel 17 that ~.s ~nnuncjated by the actuation of any alarm on the Condensate k~olisher Control Panel.. - Protective Devices The hot water tank is equipped with a 3/4" high pressure relief valve PSV-3 set ® 100 psi. A 2" high ~pressure relief valve (PSV-l) set @ 100 psig is provided for ~the resin outlet from polishers line and for the resin inlet to polishers line. The positive displacement chemical pumps are fitted with dis- charge r~eli.ef valves set at 40 psig. -2~a- PAGENO="0732" 728 Area radiation monitors adjacent to the polishers are provided as an early indication of a radioactive build-up in the p01- ishers due to primary to secondary leakage in the steam gener- ator tubes. Radiation mon.itors monitor radioactivity levels in the regeneration wastes lines to the neutralization tank and from the condensate polisher regeneration sump discharge line. 3 0 PRINCIPAL MODES OF OPERATION 3 1 Sta~~p To start up the condensate polishing system chemically charge the mixing bed resins The regeneration tank is filled with a resin bed and regenerated twice to bring the resin to full capacity After all eight polishing tank resin beds and the spare resin bed in the mixing and storage tank have been mi- tially charged line up the influent and eff'uent valves on seven polishing tanks for parallel flow frcea!a condensate pump die z~e~ to the outlet of the th~r~ etjge feeda~ater ?~ heaters FW-S-6A/6B (reference Feedwater and londensate System Description Index No. 4A) and recirculate bac{k to the con- denser Initially, with the given startup influent co~ndensate water~ analysis (Table 1) a polishing unit will ave~age 32,000 gallons per cubic foot of resin before chemical cleaning will be re- quired. The resin transfer will them be inantially initiated to the regeneration tank and the spare resin ~bed is manually transferred to the empty polishing tank. Th~ automatic re- - generation seg~zence may not be initiated for fsodiu~n sulphite addition, soak, rinse and backwash. At this~point, an alarm annunciates completion of this portion of the regeneration cycle. The resin is now transferred to the mixing and storage tank for air mixing, rir.ting, and storage as a spare resi.n bc'~. -26- PAGENO="0733" 729 The condensate and feedwater chemical feed is àtartec~ up by turning on a hydrazine and aamoniuxn hydroxide pumps on AUTO. The chetnical feed tanks are first filled including the measur- ing tanks. Thepumps are controlled from Recorder-.- Analyzer Panel 310 (refet to Secondary Plant Sampling System Description Index No. 12). 3.2 Normal Operation ** During normal operation, the condensate polishing . system de-, mineralizes the discharger flow from two condensate pumps with seven polishing units in service. The eighth polishing -unit is in standby to replace an exhausted resin bed as required. with the assumed normal influent condensate water analysis (Table 1) a polishing unit will average 160.000 gallons per cubic foot of resin before chemical cleaning and chemical regeneration W±~1 ~be requized~ Manual tr~&fer of the~ rea*u and sodium sulphite soaking is performed as described in Section 3.1. After conpletion of the sodium sulphit& portion of the regeneration cycle, automatic pushbutton selection is available for caustic injection, rinse, acid - injection, and displace- * merit. At this point, the operator may select partial or full. bed ammonia injection and displacement followed by resin tt~ansfer to the mixing and storage tank for air mixing, - - rinsing and storage as a spare resin bed The hydrogen regeneration cycle consisting of sodium sulphite acid and caustic treatment takes approximately 400 minutes. An anmoniated regeneration cycle, consisting of a hydrogen cycle and aminoniation, takes approximately 600 minutes. Either regeneration cycle can be normally Performed automatically as selected. . . -27- PAGENO="0734" 730 The total amouritof sluice water required for a hydrogen re- generation cycle is approximately 20,000 gallons; for an aminon- iated regeneration cycle, the total amount is approximately 40,00Q gallons. The peak rate demanded is approximately - 200 gpo. The condensate and feedwater chemical addition subsystem is * normally in-service with one of two hydrazine pumps on and the arimonium hydroxide feed pump on with both controlled from the secondary plant sampling system. A hydrazine and an - ainmonium hydroxide nix tank pump are available for manual backup. 3.3 Shutdown The condensate polishing units are in operation as long as a condensate pump is in operation. ~Then all condensate/Conden- sate booster pump pairs have been stopped, th~ influent arid effluent valves to the condensate polishing t'anks are closed. The -~a~ are .ã~ne~ incad~sg the rege~e~t~Lon and. ~,j3-~g.: arid storage tanks plus the system piping. The condensate and feedwater chemical additio subsystem is in operation as long as a condensate pump is in When all condensate/condensate booster pump p Formal operation. sirs, have been * stopped, the hydrazine and ammonium hydroxidechenical feed pumps are stopped. 3.4 Special or Infrequent Operation 3.4.1 Resin Removal and Replacement - The demineralizing ability of the polisher resin diminishes through, continuous use and through mechanical abrasidp fran transfer of the resin during regeneration. When a resin bed is no longer capable of demineralizing the condensate efficiently, it is re- moved through a blank tee at the regeneration tank and disposed of via the TMI I soI~id radwaste disposal system. A new resin bed ir; eddc~3 Lhrouqli the same tee connection. -28- PAGENO="0735" 731 Emerg~y If an underdrain screen breaks in a condensate polishing tank, the resin will be trapped in a resin trap which prevents the resin fx~orn getting into the feedwater and condensate system. An alarm for high differential pressure across the resin trap will sound when sufficient resin has been carried into the trap. The polisher is to be taken out of service immediately and the underdrain screen must be repaired. 4 * 0 HAZARDS AND PRECAUTIONS . When the conductivity of the effluent from a condensate polishing tank or from the condensate polishing system reaches a preset level, an alarm is actuated. The conductivity of the effluent o~ a conden- sate polisher, or of the condensate polishing system, must be reduced to an acceptable operating level immediately because the high conduc. tivity effluent will contaminate the Condensate and Feedwater System. Hazards associated with this system are those encountered with clemrcar sorutions CautiON nt~t be takezr 1.~eit work*zTg~ wit~r eaustie or acid These chenu.cals cause burns wi.th skin contact Adequate protection mu~t be provided and any bodily contact must ~e immediately flushed with fresh water and medically checked. The nominal heat tracing temperature for 50% caustic lines must remain below 100°F to preclude caustic stress corrosion cracking of piping. Th~ maximum caustic concentration in the C~austic Storage Tank (wT-T-. 8) will be about 52%. At such a concentration, caustic soda water solution starts~ to crystallize at approximately 700?.. Precautions should be taken so that the temperature of the tank and piping remains above 75~F and below lO0~F. -29- PAGENO="0736" 732 TABLE 1 INFLUENT CONDENSATE WATER ANALYSIS EXTENDED NCRNAL OPEBATION (pp~) STARTUP (ppb) Fe (Soluble) 5 40 Fe (insol.) 20 1000 Cu (Soluble) 5 50 Cu (Insoluble) 10 500 Heavy Metals 0 - - - Cl 5 5 55; 100 Si02 10 500 pH 9.5 ~* 9~5* CQ4i~ctL~tt.ty L~hQa1 10 -- - 10 Total Solids 60 - S -~ (Normally 200) - S 1-~ -30- PAGENO="0737" 733 TABLE 2 EFFLUENT CONDENSATE V~ATER QUALITY. Total Dissolved Solids, ppb 25 Total Suspended Matter, ppb * 25 Dissolved Silica,~ppb 5 Total Chloride (As Cl), ppb 5 Total Iron (AS Fe) ppb 10 Total Copper (AS Cu), ppb 2 Total Heavy Metals, ppb 0.0 Sodium, ppb 20 48-721 0 - 79 - 47 PAGENO="0738" 734 Identification Number installed Vendor Design pressure, psig * Design temperature, Design flow rate, gpzn Size, diameter x height Lining, rubber, in. Material Thickness, in. Manhole, I.D., in~ Design Code Co~ ~~amp Number Size shell, in; inlet, in. outlet, in. Material Screen size, mesh Design Pressure, psig Design Pressure Drop Clean, psig Classification Code Cleanliness Quality Control * TABLE 3 POLISHING TABKS CO-K-IA to CO-K--1H eight LeA Water Treatment ~oznpany 200 200 2,487. 8*X5s 3/16 - Carbon Steel 11/16 * 21 .. Section VIiI, ASME Code for Unfir~ - Pressure V~ssels 18 12 12 Carbon 50 200 5 CONDENSATE Yes STRAINER 8 I Ste~ *1 C B 4. 11 -32-- PAGENO="0739" 735 * ... ** `I~BLE4 MIXED BED RESIN No. of Charges Total Volume/Charge, ft3 Cation Resin 3 Cation Volume, ft Resin Size, mesh Regenerants . - Introduction Strength Anion Resin.* 3 Anion Volume, ft Resin Size, mesh Regénerants Introduction. &t~tb Temperature Max., Operating Temperature, Reducing Agent Introductioh Strength 9- 147 - 200 C Amber].ite 81 40 ~2~°4' NH4 ~ ~4 .900 C Amberlite 66 40 Na 0~I; H4 ~ NaOH; ~ NE4 140 135 Na2SO3 4% Na2Sp3 PAGENO="0740" 736 TABLE 5 REGENERATION ThN1~ Identification Number Installed Manufacturer Design pressure, psig Design Temperature, Size, diameter x height Lining, rubber, in. Material Thickness, in. Manhole, I.D., in~ I~es1~Tr Ca~ Code Stamp Classification Code Cleanliness Quality Control S~ismic C0-~T-2 one- Calif. Tank & Nfg. corp. 100 .- - - 120 S'6~ x lO'6~ -: 3/16 - Carbon Steel 57l6~ 18 ~ect~Lcm.VT.II, ASME Code~~ Icr :~e~~e ~v Yest - :1 4 II .34. PAGENO="0741" 737 TABLE 6 ~XING'AND STORAGE TANK - -. Identification Number Installed Manufacturer Design Pressure, psig Size, diameter x height Lining, Rubber, in.. - Material Thickness, in. Manhole Size, X.D., in. Design Code Cot~e- Sta~p~ Glassification Code Cleanliness Quality Control Seismic CO-T--3 one Calif. Tank & Mfg. Corp. 100 5'-6" x lO'-9" 3/16 Carbon Steel 5/16 18 Section VIII, ASME code for unfrred pressure vessels Yes~ :1 4 1 II : PAGENO="0742" 738 TABLE 7 HOT WATER TANK CO-T-4 one L*A Water Treatment Co. 936 4'-6 x 7'-3' * Carbon Steel ~rapbitie Carbon 1/4 180 * 100 * .012 * ASME~ Section VIII & X~; Yes Identification Number Installed Manufacturer Capacity gallons Outside diameter length Shell Material Lining Material ck, mils Shell thickness, ~ V Design Temperature, °F. Design pressure, psi V Corrosion Allowance,- V~fl~ I~esign Code **V~ V Code Stamp required V Heater V Manufacturer V V V Type V V Model No. V V V V capacity, kw V Power Requirements V V Power Source V Classification V V V V Code Quality Control Seismic Cleanliness chrc~alox V V insertion V 43-SST-854 V V * 480V, 3~, 6OHz~ V - MCC 2-3lD V V V V Level V V 4 V * ii: B PAGENO="0743" 739 TABLE 8 ~ID STORkG~ TANK Identification Vendor Capacity - gallons Installation Outside diameter length Shell Material Lining, Key site #100, mile Shell Thickness, ~ 0 Design Temperature, F Design pressure, psig Corrosion allowance, inc. r7~s~gTT C~ Code Stamp required Classification Code Quality Control Seismic Cleanliness WT-T-7 L*A Water Trea~trnent Co~ 6,400 One x l51_O~1 Carbon Steel 6 3/8 & Ix 10 ASIiE~ Sections viii Noj LeVJ -37-- PAGENO="0744" 740 TABLE 9 ACID POLISHER PU~ ~ Detai~ Identification - WT-P~1 Number Installed one Manufacturer chen~con Model No. fl6O-A20~135 Type Simplex, diaphragm Rated Speed, strokes/mm. 135 Rated Capacity, gph 130 Rated Discharge Pressure, psig 30 - * Design Pressure, casIng, psig 50 P1es1~9P~ Tes~perat~rQ-,- Lubricant/Coolant Oi11~'luid Mm. Plow Requirements. gprn 0 Motor Details Manufacturer G.E. Type - Induction Enclosure DP Rated Horsepower 1 Speed, rpm * 1,72s Lubricant/Coolant Oil/Air Power Requirements 480V,3%, 60Hz, 3 amps (Pu] Load Current) Power Source MCC 2-31D -$8- PAGENO="0745" 741 *~i~BLEl0 ~USTIC STORAGE TANK. Identification Vendor Capacity - gallons Installation Outside diameter x length Shell Material Thickness, in. Lining, Keysite #740, mils Shell Temperature, Design pressure, psig Corrosion allowance, in. Design code eo~ Stamp req~ire~. Heater Manufacturer Type Model No. Capacity, Kw Power Requirements Power Source Classification Code Quality Control Seismic Cleanliness WT..T~.8 L*A Water Treataent Co. 6,400 one 8'~0" ,c l5'-~O" Carbon Steel 3/8 12 10 ASME, Sections VIII & IX No Chromalox * Immersion TM SS-3O6OSSLT * 5 480V, 30. 60 Hz NCC 2-31D * Le~re1 * C 4. II D PAGENO="0746" 742 * -. TABLE 11 ~r~r retr~~ Identification Numbei~ Installed Manufacturer - Motor Details Manufacturer Type Enclosure Rated Horsepower Speed, rpm Lubricant/Coolant Power Requirements Power Source )~T.-P-13 1 Chemcon 1l6O-'3l6S~..13~ Simplex diaphragm l35~ 160 50 - QilfttIuid: 0- ~PUMP~ Model No. Type Rated Speed, strokes/mm. Rated Capacity, gph Rated Discharge Pressure, psig Design Pressure, Casing, psig Design Temperature, 0F idt/~ant -~ Mm. Flow Requirements, gpm G.E..1 Induc!tion 3/2! 1.80q --- *~ Oil/24ir : 480v) 3% 60Hz, 3 Amps- (Fu1~. ]oad current) ?ICC `-31D -40- PAGENO="0747" 743 TABLE 12 AQUEOUS AMMONIA STORkGE TANK Identification Vendor * Capacity - gallons Installation Outside diameter & length Shell Material Shell thickness, in. *Design temperature, 0p Design pressure, psig Corrosion Allowance, in. Design Code Code Stamp* required Classification Code Quality Control Seismic Cleanliness AM-T-6 L*A Water Treatment Co~ * 5,000 one 8*Owx l2'-0~ ~arbon Steel 3/8 10 ASME, Sf ctions VIII a ~C No Level C 4 II. * D -41- PAGENO="0748" 744 TABLE l3~ AQUEOUS AMMONIA PUMPS Pump Details identification AM-P-4A, 4B, and 4C Number installed 3 Manufacturer . Chemcon Model No. ll60-~CI-l35 Type Positive displacement Rated Speed, strokes/mm. 135 Rated Capacity. gph 159 Rated Total Dynamic Head, ft. 40 Design Pressure, Casing, psig 50 0 Design Temperature, F Oil/fluid Mm, Flow Requirements, gpm 0 Motor Details Manufacturer Type Induction Enclosure TEFC Rated Horsepower, hp ¼ Speed, rpm 1,725 Lubricant/Coolant Oil/Air Power Requirements 480V 3Ø~ 6OHa Power Source NCC 2-31D PAGENO="0749" 745 TABLE 14 SODIUM SULPHITE FEED~ AND STORAGE TANK Identification WT-M-1. & WT-T-.U. Number installed Manufacturer Wallace & Tiernon Model A-728 Capaaity, gallons/tank 50 cubic feet/feeder 13 Size, diameter x height 3'-~O" x 3'.~0" & 2I.~6u x 21..ON x 3S.~8M Feed rate, cu. ft.fhr.' 18.1 Mixer Type . Induction. Rated Horsepower, hp 1/4 EncIoS~N~. ~.. ~ P Power Requirements 11OV, l~, 60 Hz Feeder Motor Type Induction Rated Horsepower, hp 1/4 Enclosure D.P. Power Requirements llOv, 1%, 60 -- Speed, rpm 1,725 Classification Code.. . C Cleanliness Class D Quality Control . . level 4 Seismic .. Class II -43- PAGENO="0750" 746 TABLE 15 SODIUM SULPHITE PUMPS ~p Detai~ identification WT-P15A, WTP15B Number Installed 2 Manufacturer . Worthington Model No. 3/4 CN~-4 Type Centrifugal Rated Speed, rpm 3500 Rated Capacity, gps 6 Rated Discharge Pressure, psig 30- Design Pressure casing ps-±g~ Design Temperature, 0F Lubricant/Coolant . Oil/F1~jd Mm. Flow Requirements, gpin Motor Details Manufacturer TS,pe Induction Enclosure DP Rated Horsepower, hp 3/4 Speed, rpm 3500 Lubricant/Coolant Oil/Air Power Requirements 480V,3J~, 60Hz Power Source MCC 2-3lD -44-- PAGENO="0751" TABLE 16 CONDENSATE POLISHER REGENERATION SUMP PUMPS Motor Details Manufacturer .Type Enclosure Rated `Horsepower Speed, rpm Lubricant/Coolant Power requirements Classif icat ion Code Quality Control Seismic Cleanliness 747 * Pump Details Identification Number' Installed Manufacturer Model No. , , Type Rated speed, rpm Rated Capacity, gpm Rated Total Dynamic Head, ft. Design Pressure, Casing, psig 0 Design Temperature, P Lubricant/coolant Minimum Flow Requirements, gpo WT-P-l9A & B Two Crane - Denting 3ND Vertical, duplex 1745 `` * . * 200 , 80 Oil/fluid. Inducticw~ * DP 10 1800 Oil/Air * 480v, 3ff, 60 Hz Level C 4 II * D -4;- PAGENO="0752" Identification - Ammonium Hydroxide - Hydrazine Vendor No. Installed Capacity, gallons Installation Outside diameter & Length Shell material Shell thickness, in. * 0 Des.gn temperature, F Design pressure, psig Design Code "Qde Stamp required 748 Feed A!1-T-l AN-T-2 L*A Water Two 150 Vertical 2'-6 x 4'-3 - 304 S.S - - AM-T--4 AM-T-5 L*A Water Cond. Co Two - 6 Vertical. l2~xl2~'.. -. 304s.S. ( TABLE 17 HYDRAZINE FEED AND MEASURD~G TANKS Corid. Co Classification. Code Quality Control Seismic Cleanliness *.3I8 * --1/8 Atocaspheric ?~SME No Level C .4 - Ix - D -46- PAGENO="0753" 749 i~n?4o'~Iur1 HYDROXIDL Z~ND IIYD~AZINE FEED PUMPS flg~1s IWORAZINE ~ HYDROXIDE Identification . AN-P-lA, B AMP-2 Number Installed Manufacturer Model No, Type Rated Speed,strokes/injn Rated Capacity, gph Rated Total Discharge Pressure, psig Design Pressure, casing, psig Design Tcmper~ture, Op Lubricant/Coolant Flow RegMirements, ~m., Motor Details Manufacturer type Enclosure Rated Horsepower Speed, rpm Lubricant/Coolant Power Requirements. * Two One thiemcoh.. - * ll3O-316SS-90 l130-cx--90 Simplex. 90 180. 250 91l/Fluid 0 ~eliance * - induction 1/4 1725 * *O~]1Air.. llOv, 1 0, 60Hz -47- 48-721 0 - 79 - 48 PAGENO="0754" Classification Code Quality Control Seismic Cleanliness 750 Level C .4 II D -48-- TABLE 19 A ( MIMONItJM HYDROXIDE MIX TANK ~1c1cntification . AM-T-7 ~Vo~dor B&W Number Installed One ~Capacity . 60 Xr.stallation Vertical Outside diameter and length - * 24~x30 Shell material * - Type 304 5.6. Shell thickness. in. -- -. 3/16 Manufacturer Buffalo Tank Des.gn Temperature 150 -iesign pressure, psi~. .. Design Code - - NOfl Code -. Stamp Required - PAGENO="0755" 751 TABLE 20 AMMONIUM HYDROXIDE MIX TANK PUMP Deta Identification . Nun~er Installed One Vendor B&W Manufacturer Model No. -- LS~5 Type . -. ~`ositive displacement Rated Speed, strokes/rain. 44 Rzited Capacity, gpm 1.0 Rated ~pischarge Press., psig. 275 Design Pressure, casing, psig ~_5OO Design Temperature, 0F. - 7O-~-120 Lubricant/Coolant Oil/FlUid Mm. Flow Requirement, gpm ..*. 3 Motor Details Manufacturer -~ - Baldor Electric Co. ~ype IfldUCt.tOfl Enclosure - TEFC Rated horsepower . 1/6 Speed, rpm. . .. . . 1725 ~Lubricant/Coolant ,. . . - oil/Air ~?ower Requirements l2Ov~ 3. 0 60 ~z Po~zer source }~PT 11 -49- PAGENO="0756" PANEL-MOUNTED ANN CIATOR flWUTS C0-G-1 0-5MM/cm CO-6-1 0-5MM/cm DPI ~WC O-l5Opsi C0-G--1 0-5MM/cm DPI-WC O-l5Opsi .C0-6--3. 0-5MM/cm ]WX-WC 0-150p13i C0-G-1 0-5MM/xm DPI-WC 0-l5Opsi CR-WC 0-10CM 100)MM/cm. FR1-WC 0-10% (H2S04) C0-G-1 0-5MM/cm. DPZ-'WC 0-l5Opsi C0-G-1 0-5MM/cm. DPI-WC 0-l5Opsi C0-G-1 0-5MM/cm. DPI-WC 0-lSOpsi C0-G-1 0-5MM/cm DPI-WC 0-iSOpsi C0-G-1 0-5MM/cm NOTE: AllAlarins are annunciated'o~i the Condensate Polisher Control Panel No. 304 and ~.~cornmon alarm annunciates in the Control Room "Conden~pte Polishing System Trouble" on Turbine Auxili.zLes Panel 17, Alarm Input Variable W4*y~-~w M~nured V~riRble. Units ~S~et~ointa Source Range - 1-1 1-2 1-3 1-4 1-5 1-6 1-7 1-0 1-9 1-10 1-11 1~-12 1-13 1-14 1-13 1-16 1-17 1-16 1-19 1-20 Influent High Conductivity Field Set 2A-Polisher High Conductivity, Micromhos 0.12-0.15 2A-P'~1.isher High Pressure Drop Resin Trap1 5+ psig 25-Polisher High Conductivity 0.12-0.15 25-Polisher High Pressure Drop Resin Trap,psig 5+ 2C-Polisher High Conductivity 0.12-0.15 2C-PoLi~Thcr High Prcs~urc Drop Rosin Trap,psig 0+ 2D-Polishcr High Conductivity 0.12-0.15 2D-Polisher High Pressure Drop Resin Trap,psig 5+ Receiving Tank High Conductiyity, Micrciuhpe 40 Acid Concentration Fault 6%lo-~10%ht. 2E-Polisher High Conductivity, Micrombos 0.12-0.15 2E-Polisher High Pressure Drop Resin Trap,p.ig 5+ 2F-Polisher High Conductivity, Micronhos * 0.12-0.15 2F-Polisher High Pressure Drop Resin Trap,psjg 5+ 20-Polisher High Conductivity, Micromhos 0.12-0.15 20-Polisher High Pressure Drop Resin TraP,pstg 5+ 2H-Polisher High Conductivity, Micrombos 0. 12-0.13 2H-Polisher High Pressure Drop Resin Trap,psig 5+ Effluent High Conductivity Field Set C)1 PAGENO="0757" ~c~dôw M~sur~d ~7~i~b1~ * Alarm Input Variable ~st~,nint~ ~ôurcs ~ set DPR-WC FR1-WC FT-WC FR1-WC FT-WC FR1-WC FT-WC FRI-WC FT-WC CR-WC 2-1 High Differential Pressure, psi 45 2-2 . 2A-Polisher Low Flow, gpm Field 2-3 2A-Polisher Exhausted 2-4 2B-Polisher Low Flow, gpm 2-5 2B-Polisher Exhausted 2-6 2C-Polisher Low Flow, gpm 2-7 2C-PoIisher Exhausted .. 2-8 2D-Polisher Low Flow, gpm : * 2-9 2D-Polisher Exhausted 2-10 Mix & Storage Tank High Conductivity, Micromhos 1.0 . 2-11 Caustic Concentration Fault 2-12 2E-Polisher Low Flow, gpm * Li FR1-WC 1 ~ 2-13 2-1,4 2E-Polisher Exhausted 2F-Polishor Low Flow, gpm . FT,WC FR1-WC 2-15 2F-Polisher Exhausted FT-WC 2-16 2G-?ol.isher Low Flow,gpm * FR1-WC 2-17 2G-Polisher Exhausted . . FT-WC * 2-18 2H-Polisher Low Flow ,gprn *. FR1-WC ~` 2-19 2-20 2IT-~lisher Exhausted Condensate Polisher Suinp Level ~High, top of sump) S.n.(fro~n 16 FT~WC WT-LS-3884 0-31" 4% lo-6% hiFfll-WC fie] 1 set 0-100 psi 0-30 (XlOO) gptt~ 0-960 counts 0-30(Xl00)gpm 0-960 counts' 0-30(XldO)gpm 0-960 counts 0-30 (X100) gpm., 0-960 counts 0-5MM/cm 0-10%(NaOH) 0-30 (XI00) gpm 0-960 counts 0-30(X100) gpm 0-960 counts 0-30 (X10)~)gpm' 0-960 countS 0-30 (X100) gpm 0-960 counts * Reference L*A Water Conditioning Co. flow dLag~anw P453.9 and D4522. PAGENO="0758" PAGENO="0759" .755 TRAINING & CERTIFICATION OF NDTROPOLITAN EDISON CO~~rPANY THREE NILE ISLAND UNIT 2 LICENSED PERSONNEL The following is a summary description of the training and certification relevant to Three Nile Island Unit II operation for personnel in the following job classifications: ______________ License Requirement Reactor Operator CR0) Senior Reactor Operator (SRO) Dual Unit Senior Reactor Operator (SRO) Senior Reactor Operator (SRO) *Senior Reactor Operator (SRO) The information provided is based on documentation retained by the ~I Training Department. The extent of an individual's participation in the various programs outlined may vary according to the individual's previous experience,prior academic/technical training, and date of selection or appointment to a particular job classification. *Unit Superintendents are not required by regulation to hold SRO Licenses, however, it is Company Policy for individuals assigned to this position to obtain an SRO License. I. II. III. IV. V. Classifjcatjbn Control Room Operator - Shift Foreman - Shift Supervisor - Supervisor of Operations - Unit Superintendent - PAGENO="0760" 756 INDEX I. Control Room Operator (CR0) Training and Certification l.A Auxiliary Operator Training I.B "Cold" License Training I.C `Hot" License (Replecement Operator) Training I.D Control Room Operator Certification I.E Reactor Operator Requalification 2 3~ 4 8 12 13 IV. Supervisor of Operations - Unit II 26 V. Unit Superintendent V.A Unit Superintendent: Certification and Training 27 V.B Unit II Superintendent - Technical Support: Certification and Training 28 Attachment 1 - TMI-2 TSAR, Section 13.2 "Metropolitan Edison Operator Requalifi- cation Program" Attachment 2 - 10 CFR 55 `Operators' Licenses" Reference 1 - ANSI H18.1-1971 "Selection and Training of Nuclear Power Plant Personnel' Reference 2 - ANSI/ANS-3.1-1978 "Selection and Training of Nuclear Power Plant Personnel" II. Shift Foremsn Training and Certification* 14 II.A Previous TNI-l SRO Licensees 15 11.5 SRO Licensees from Other Reactor Facilities 18 II.C Selectees From Initial TMI-2 CR0 staff 21 III. Shift Supervisor Training and Certification 23 -1- PAGENO="0761" 757 I. Control Room Operator (CR0) Training and Certification Certification of CR0 qualification is achieved through NRC examinations, successful completion of which results in operator licensing by the NRC. Training to ensure operator qualification prior to application for operator licensing will include Auxiliary Operator training and either "Cold' (prior to initial core fuel load) or "Not" (subsequent to initial criticality) operator licensing programs. Replacement operator training is also accomplished using the "Hot" license training program. Operator proficiency and certification are maintained through the licensed operator requalification program and periodic (annual) requal- ification examinations. -2- PAGENO="0762" 758 l.A Auxiliary Operator Training With but 1 exception, all of the initial Control Roots Operator staff at TMI-2 were graduates of the U. S. Navy nuclear training program with several years of operating experience on naval nuclear propulsion plants. All were initially employed as Auxiliary Operators-A-Nuclear. In this classification they participated in a tranining program which typically included the following: 1. Mathematics (160 hours) 2. General Science (80 hours) 3. Atomic & Nuclear Physics (240 hours) 4. Reactor Physics (200 hours) 5. Radiation Protection (160 hours) 6. Core Performance (80 hours) including: a. Thermodynamics b. Fluid Plow c. ~Core Thermal Performance d. Reactor Materials 7. Plant Chemistry (80 hours) 8. Instrumentation and Control (40 hours) 9. Plant Operation (80 hours) This training was conducted using the "Nuclear Power Preparatory Training" progran developed by NUS Corporation of Rockvill, Nd. Initial Auxiliary Operator training also included approximately 200 hours of training on TNI-l systems. -3- PAGENO="0763" 759 1.8 "Cold" License Training The content of a "cold" license training program is defined by ANS 3.1 (formerly ANS 18.1) with additional guidance and classification provided in section 13.2 of the TNI-2 FSAR. The initial TMI-2 staff "cold" RO license traning program was reviewed with and approved by the Operator Licensing branch of the NRC with respect to compliance with the estab- lished standards. The requirements were met by participation in the following programs: : - 1. Unit II CR0 Training Program a. Math Review (24 hours) conducted by TMI Training Department. b. Reactor Theory (104 hours) conducted by TMI Training Department. c. TMI-2 Systems (144 hours) conducted by TNI Training Department. and TNI-2 Shift Foremen. d. TMI-l Control Room Observation (160 hours) 2. Penn State University Training Program a. Console experience, startup experience and experimentation at the PSU TRICA research reactor facility (40 hours). 3. TMI-2 Cross-License Training a. TMI-2 Systems (75 hours) 4. TMI-2 On-the-Job Training for CR0 Candidates Guided self-study on TMI-2 systems and their respective sections of: a. Burns & Roe System Descriptions b. TMI-2 FSAR c. TMI-2 Standard Technical Specifications -4- PAGENO="0764" 760 d. TMI-2 Procedures e. Burns & Roe Drawings & Prints (Totaling 300 hours per individual) 5. Babcock & Wilcox Simulator "COld" License Training a. Classroom instruction (180 hours) (1) Plant fluid systems and components (2) Heat transfer (3) Reactor physics (4) Control/protective systems (5) Instrumentation (6) Normal and emergency procedures b. Simulator Operation (100 hours) (1) Plant startup/shutdOwn (2) Power operation including load changes (3) Abnormal and emergency procedures (4) Plant operation with unannounced casualties c. Examinations (40 hours) (1) Start-up exams (2) Operating and oral exams (3) Simulated NRC written exam 6. Technical Specification Review Program (40 hours) a. Review of updated TMI-2 Standard Technical Specifications b. Abnormal/Emergency procedures c. Instrument/Control review d. Case History of other plants -5-, PAGENO="0765" 761 Babcock & Wilcox Simulator Refresher Training a. Classroom instruction (20 hours) (1) Plant control and response b. Simulator Operation (20 hours) (1) Start-up (2) Turbine/Reactor Trip (3) Power Operation with unannounced casualties 8. Independent Audit of Operator Qualification General Physics Corporation, Columbia, Maryland was contracted to perform an independent audit of potential licensed operator weaknesses through in-depth oral examination on an individual basis. ~ny weak areas identified could then be emphasized In the Pre-License Review Program. 9. Pre-License Review Program (80 hours) a. Reactor Theory b. Instrumentation and Control c. Standard Technical Specifications d. Fuel Handling e. Normal/Emergency Procedures f. Environmental Technical Specifications g. Safety/Emergency systems h. RCS chemistry 1. Health Physics review j. Radiation Emergency Plan -6- PAGENO="0766" 762 10. Additional In-Plant Experience In addition to the formal classroom and On-the-Job training programs already discussed, TMI-2 operations personnel have received signi- ficant experience through participation in the following: a. System testing and turnover to~1atropolitan Edison Company from General Public Utilities Service Corporation. b. TMI-2 Hot runctional Testing c. TMI-2 Low Power Core Physics Testing d. TMI-2 Escalation to Power 11. COmpany Administration Examinations These included both oral and written comprehensive examinations similar in nature to those administered by the NRC. The results of this final check of operator qualification were used in recommending individuals to the NRC for examination and licensing. PAGENO="0767" 763 I.C "Hot" License (Replacement Operator) Training 1. "Hot" license trainIng and experience requirements are also- specified in ANS 3.1 (formerly ANS 18.1) and the TMI-2 FSAR. Candidates for "Hot" licensing programs are selected either from the fully qualified Auxiliary Operators-A-Nuclear at the station or from off-site appli- cants with the requisite experience and qualifications. In either case, the "Hot" license replacement operator candidate will have a minimum of two (2) years of operating experience at a nuclear reactor facility. Once designated as a "Hot" license candidate and assigned to the position of Control Room Operator (CR0), the individual enters a training program. This program consists of: a. Specific self-study assignments b. Oral checkouts in which the Individual actually performs or simulates performing certain evolutions c. Written examinations d. Oral examinations and e. Classroom sessions 2. The replacement operator program provides in-depth coverage of all areas specified in ANS 3.1 and the TMI-2 FSAR over a nine (9) month period. (Note: This program is comparable to the TMI-l Replace- ment Operator Program). These areas include: - a. Reactor Theory b. Features of Facility Design c. General Operating Characteristics -8-- PAGENO="0768" Instrumentation and Control Safety and Emergency Systems Standard and Emergency Operating Procedures Radiation Control and Safety 3. Adminsitrative guidelines for the conduct of this program to ensure operator proficiency prior to application for NRC licensing are as follows: a. Upon being advanced to CEO, the individual will fall immediately into the Shift organization as it exists at the time. Two (2) hours, as a minimum, of each day on shift will be specifically devoted to training. The individual will be provided with a desk or other suitable place to study in the Control Room area. The two (2) hour period will occur at a definite time of each day on shift insofar as practical. b. While on shift, the individual receives a series of preprogrammed written assignments. The individual is administered written and oral examinations evary 3 and 6 weeks respectively. The written tests will be corrected and returned. Errors snd weak areas will be covered with the individual, and reassigned. Weak areas on written and oral examinations will be covered with the individual. Failure of a written exam or oral exam will be discussed with the individual and a retest will be administered on the material. c. Additionally, the CR0 will be required to complete a Practical Evolutions Sheet. This sheet will be completed either during the individuals' daily training period, or during other times 764 d. e. f. g. - 9~ - PAGENO="0769" 765 while on shift as situations dictate. Nost of the items involve performing evolutions, simulating performing evolutions, and understanding and being able to explain while simulating or performing. The individual's Shift Supervisor, Shift Foreman, an SRO Licensed individual, or (in specifically designated cases) the licensed Training Coordinator may sign the practical evolution sheet. Assignments detailed in paragraph b. above, on which written and oral tests will be given, will cone largely from items on the Practical Evolution Sheet, with some assign- ments specifically intended to obtain signatures on this form. Checkouts for items on the Practical Evolution Sheet which must be simulated will be conducted in front of the Control Room Consoles and Panels, with the individual being required to point to specific items and controls. The checkout must be satis- factory prior to a signature for the evolution. The evolutions are assigned a point value to track the piogress of an individual through the nine (9) month program. d. To aid the individual in the training assignment completion, the CR0 may come off shift to attend lectures on specific topics, listed below, as determined by the Supervisor of the Training Department and the Supervisor of Operations. (1) Reactor Theory - 1 day - 1 week (2) ICS Review - 1 day - 1 week (3) Simulator - 1 week - 2 weeks (4) Health Physics Review - 1 day - 1 week (5) Refueling Review - 1 day - 1 week - 10 - 48-721 0 - 79 - 49 PAGENO="0770" 766 * These off shift lectures should aid the individual in obtaining signatures on the Practical Evolution Sheet. e. The first 90 days of the CR0 Training Program are designated as a Probationary Period during which the individual will be evaluated. At the end of this 90 day period, the Shift Supervisor, Supervisor of Operations and the Supervisor of Training will recommend whether or not the individual should continue in the program. f. Prior to the completion of the 9 month tine period for the pro- gram, the CR0 will be given a comprehensive written examination approved by the Supervisor of Operations and the Supervisor of Training. The results will be available for review by the CR0. Additionally, within the Training Program tine period, the CR0 will be given a comprehensive oral examination by an SRO licensed individual designated by the Supervisor of Oper- ations. ~ny examination failed, written or oral, will be reviewed with the CEO. g. If the CR0 has not successfully completed the program within 9 months, and fails either the written and/or the oral examin- ation, the individual will be returned to the position held prior to being advanced to CR0. If the individual successfully completes the training program within 9 months, and fails either the written or oral examination, a re-exam will be considered based upon an evaluation by the Supervisor of Oper- ations and the Supervisor of Training. If the individual successfully completes the training program within the nine (9) months and passes the final comprehensive written and * oral examinations, that individual may be recommended for examination by the NRC and subsequent RO licensing. - 11 - PAGENO="0771" 767 I.D Control Room Operator Certification The 1~RCs issuing of Reactor Operator Licenses constitutes official certification of Control Room Operator personnel to operate. the reactor facility on which the RO license was achieved. - 12 - PAGENO="0772" 768 I.E Reactor Operator Requalification The philosophy, content and conduct of the training program designed to maintain licensed operator qualification and proficiency is described by the TMI-2 FSAR, Chapter 13, Section 13.2.2 "Metropolitan Edison Operator Requalification Program". This is provided as Attachment 1. - 13 - PAGENO="0773" 769 II. Shift Foreman Training and Certification As with the reactor operator level training and certification dis-. cussed in Section I of this report, certification at the senior reactor operator (SRO) level is also achieved through satisfactory completion of NRC examinations. Certification is maintained by participation in the operator requalification program and satisfactory completion of the annual* evaluation examination. Training to ensure SRO qualification prior to application for operator licensing is accomplished through the administration of programs which comply with the requirements of ANS 3.1 and the TMI-2 FSAR, and which have been approved by the NRC. Personnel selected who currently fill shift foreman positions for TMI-2 can be classified as having come from any of three slightly different backgrounds. - A. Individuals who had achieved and maintained SRO licenses on TMI-l B. Individuals who had achieved SRO licenses on other reactor facilities C. Individuals selected from the initial group of TMI-2 Control Room Operator trainee's The training, qualification and certification of each of these groups is discussed in this section. - 14 - PAGENO="0774" 770 II.A Previous TMI-l SRO Licensees 1. These individuals were typicafly graduates of the U. S. Navy nuclear program. They had been initially employed by Net-Ed aa Auxiliary Operators-A--Nuclear and as such had received training as outlined in section l.A of this report. 2. They had been promoted to shift foremen on TMI-l and had all achieved and maintained 510 licenses on that unit. 3. Upon assignment to TMI-2, they participated in the following portions of the "Cold" license training program: a. Unit II CR0 Training Program (270 hours) (participated as systems instructors - program as described in section I.B.l of this report) b. TMI-2 Cross-License Lectures (75 hours) (as described in section I.B.3 of this report) c. TMI-2 On-the-Job Training for SRO Candidates (300 hours) (essen- tially as described in I.B.4 but modified to SRO level) d. Technical Specification Review Program (40 hours) (as described in I.B.6 of this report) e. Babcock & Wilcox Simulator Refresher Training (40 hours) (as described in I.B.7 of this report) f. Pre-Licensed Review Program (98 hours) as described in section I.B.9 of this report with the following additional training (18 hours) for SRO candidates: (1) Departure from Nucleate Boiling (DNB), DNB Ratio (DNBR) and hot channel factors (2) Soluble poison control - 15 - PAGENO="0775" 771 (3) Liquid and gaseous radioactive releases (4) Administrative procedures (5) Standard Technical Specifications g. Additional In-Plant Experience (1) Development of TMI-2 normal, abnormal and emergency pro- cedures (2) TMI-2 system testing and turnover (3) TMI-2 hot functional testing (4) TNI-.2 low power core physics testing (5) TMI-2 escalection to power h. Company Administered Examinations (1) `Both oral and written examinations at the SRO level, similar in nature to those administered by the NRC but emphasizing comparisons and differences between THI-l and TMI-2. (2) Results of these examinations were used in recommending individuals for final examination and subsequent cross-licen- sing by the NRC. 4. Certification a. Accomplished by Company administered examinations as outlined below: (1) Comprehensive written examinations developed, administered and graded by the Company. These were SRO level examinations similar to those administered by the NRC which emphasized comparisons end differences between TMI Units 1 and 2. (2) The examinations, grading of the exams, and final results were reviewed end approved by the NRC. - 16 - PAGENO="0776" 772 (3) NRC atninended their SRO licenses to include Unit 2 b. Certification is maintained by participation in the licensed operator requalification program and satisfactory completion of the annual evaluation examinations as discussed in Attach- ment 1. - 17 - PAGENO="0777" 773 11.8 SRO Licensees from Other Reactor Facilities 1. These individuals were typically graduates of the U. S. Navy nuclear program. 2. Subsequent to naval service and experience thay had achieved SRO level certification (licensing) at other commercial power reactors. 3. Upon selection and assignment to TNI-2 they participated in the fol- lowing training programs: a. Unit II cold license pre-simulator training (80 hours) including formal classroom instruction in the following areas: (1) Integrated Control System (2) Control Rod Drive (3) Non-Nuclear Instrumentation (4) Reactor Theory (5) Electrical Distribution (6) Reactor Protection System (7) Standard and Technical Specifications (8) TMI-2 Fluid Systems b. Babcock & Wilcox Simulator Training (80 hours) (1) Classroom instruction (a) Reactor Theory (b) Instrumentation/Control systems (2) Simulator operation (a) Plant start-up/shutdown (b) Power operation with unannounced casualties (3) Start-up Certification - 18 - PAGENO="0778" 774 c. TMI-2 Cross-License Training. (75 hours) (1) TMI-2 systems classroom instruction d. TMI-2 On-the-Job Training for SRO Candidates (500 hours) (1) Essentisily as described in I.B.4 but modified to SRO level e. TMI-2 Standardized Technical Specifications (40 hours) (1) As described in I.B.6 of this report f. Babcock & Wilcox Simulator Refresher Training (40 hours) (1) As described in I.B.7 of this report g. Pre-License Review Program (98 hours) (1) As described in II.A.3.f. of this report h. Additional In-Plant Experience (1) TNI-2 normal, abnormal and emergency procedure development and review (2) TMI-2 system testing and turnover (3) TMI-2 hot functional testing (4) TMI-2 low power core physics testing (5) TMI-2 escalation to power 1. Company Administered Examinations (1) Oral and written examinations at the SRO level similar to. those administered by the NRC. (2) Results of these examinations were used in determining whether individuals would be recommended for NRC licensing examinations. 4. Certification a. Certification was achieved through successful completion of - 19 - PAGENO="0779" 775 NRC licensing examinations and subsequent issuing of SRO licenses to operate TMI-2. b~ Certification is maintained through participation in the licensed operator requalification program and successful completion of the annual evaluation examination as described in Attachment I. - 20 - PAGENO="0780" 776 Il.C Selectees Prom Initial TMI-2 CR0 staff 1. These individuals had complet~d the following training previously outlined in this report: Section l.A. - Auxiliary Operator Training b. Section I.B. - "Cold" License Training 2. Typically, they had been certified to operate the plant by successful completion of NRC licensing examinations at the RO level. 3. They had maintained this certification through participation in the licensed operation requalification program as described in Attach- ment 1. 4. These individuals also attended a Senior Operator Review Program which provided additional training at the SRO level in the following areas: - a. Procedure Review (40 hours) b. Realth Physics Review (40 hours) c. Plant Characteristics (40 hours) d. Pland Design Review (40 hours) e. Reactor Theory Review (40 hours) This program was administered primarily through guided self-study augmented by classroon instruction as necessary to achieve SRO level qualification. 5. SRO level qualification was checked by Company administered examina- tions as discussed in Section II.B.3.i. of this report. - 21 PAGENO="0781" 777 6. Certification was achieved through satisfactory completion of SRO level examinations administered by the NRC and subsequent issuing of SRO licenses to operate TMI-2. 7. SRO qualification and certification are maintained through parti- cipation in the licensed operator requalification program as described in Attachment 1. - 22 - PAGENO="0782" 778 III. Shift Supervisor Training and Certification Shift Supervisor must be certified at.the Senior Reactor Operator (SRO) level for both TMI-1 and TMI-2. This is achieved through satisfactory completion of NRC approved examinations. Certification is maintained by participation in the operator requalification program and satisfactory completion of the annual evaluation examination (Attachment 1). Personnel selected for the position of Shift Supervisor held SRO licenses for Unti I or Unit II or in the case of one individual, held a current dual SRO license. In addition, many of these individuals had graduated from the U.S. Navy Nuclear Power Program, and in all cases their experience met or exceeded the requirements of ~NS 3.1. For initial dual unit staffing, a cross License Training Program was administered to obtain Unit II SRO licenses. The Shift Supervisors received the following training or the equivalent: 1. One hundred (100) hours of Cross License Training 2. One (1) week of Unit II Standardized Technical Specifications Training 3. Twenty (20) hours of Turbine Controls Training given by Westinghouse Electric Corp. 4. One (1) week of Unit II Simulator Training at B&W's Training Center in Lynchburg, Virginia. 5. Two (2) weeks of Pre-License Review Training 6. Unit II O.JT Program 7. Unit I Requalification Training Program (67 hours). Periodic tests were given throughout the program to monitor the students' level of knowledge. At the conclusion of the program, a mock NRC examina- tion was administered with emphasis on Unit II Systems and differences between the Unit I and Unit II Nuclear Steam Supply Systems (NSSS), Secondary and Balance of Plant Systems. Following successful completion 23 - PAGENO="0783" 779 of the above program and tests, a final company prepared qualification exam was administered. The program documentation, exam and exam results were forwarded to the NRC for approval. - This culminated in those applicants already SRO licensed in Unit I having their license amended to include an SRO on Unit It. Subsequent to "Cold" Licensing, a "Hot" Cross License training program was developed by the Training Department to cross qualify SRO License holders from either unit. This program is approximately 400 hours In length and is predominantly a* self-study course with periodic written and oral exams to monitor the individual#s progress. Listed below are the major topics contained in the program. 2. Technical Specification Training Unit Systems with emphasis in unit differences a) Turbine Generator & Auxiliaries b) Solid, Liquid & Gaseous Waste System c) Steam Systems (Ham, Auxiliary, & Bleed) d) Cooling Water Systems (Primary and Secondary) e) Electrical Systems (Balance of Plant, Vital Power, and Diesel Generator). f) Emergency Safeguards Systems g) Reactor Coolant System h) Primary Volume Control Systems I) Secondary Water Systems 3. On-the-job training (oral checkouts by a Shift Supervisor of various plant evolutions). 4. Administrative controls. - 24 - PAGENO="0784" 780 5. Operator Requalification Program (Attachment 1) The program culminates with the individual taking a written exam adminis- tered by the Training Department. The exam and results are reviewed and approved by the NRC. Approval by the NRC will then result in the mdi- vidual's SRO license being anmended to include the other unit. - 25 - PAGENO="0785" 781 IV. Supervisor of Operations - Unit II This individual is a graduate of the Navy Nuclear Power School. Following his service obligation, he graduated from college as a Chemical Engineer. His commercial power plant experience commenced as a Staff Engineer at the Saxton Experimental Corporation. During his tenure there he was awarded a Senior Reactor Operators license. Mter transfer to TMI, he initially held the position of Nuclear Engineer- Unit 1. His next appointment was that of Supervisor of Operations Unit 1. He participated in a Cold License program and achieved an SRO license on Unit 1. The general outline of this training program was as follows: 1. Presaurized Water Reactor Technology Course by Babcock and Wilcox Co. - 1969- (320 hrs.) 2. Shift Foremen Review Seminar - 11/24/71 (2 hra/wk) 3. Pressurized Water Reactor Simulator Orientation Course by BabcOck and Wilcox - 1973 - (32 hra.) -~ 4. PWR Simulator Training Program by Babcock and Wilcox Co., - 1973 - (80 hra.) 5. Pre-licenaing Review Program by Babcock and Wilcox Co., General Physics and N1JS Corp. - 1973 - (204 hrs.) 6. Various vendor familiarization programs (38 lire.) He was then appointed to his present position of Supervisor of Operations Unit II. In this position he participated in the Startup and Test Program and achieved a "Cold" SRO license on Unit II by participating in training similar in scope to that detailed in Sections II and III. This person's total nuclear power plant experience is in excess of fifteen years. - 26 - 48-721 0 - 79 - 50 PAGENO="0786" 782 V. A. Unit Superintendent: Certification and Training This individual's experience greatly exceeds the requirements of ANS 3.1. He is a U.S. Naval Academy graduate with twenty years in the Navy Nuclear Power Program. This service included command of a nuclear submarine. Certification of the Unit Superintendent position was achieved through successful completion of NRC examinations which culminated in the receipt of a Senior Reactor Operator License. This training program was a modified "Hot" License Training Program. The program was specially tailored to the needs of the individual, with special emphasis on those areas in which the individual did not have prior experience, or expertise. Specific areas of the program included but were not limited to: a. Specific self-study assignments 1) Systems Training 2) Reactor Theory - 3) Integrated Control Systems 4) Radiation Protection 5) Fuel Handling Training 6) Technical Specifications b. Simulator Training (280 hrs.) c. Oral checkouts within the plant performing or simulating performance of the evolution d. Written examinations e. Classroom lectures Approximately 900 hours were spent in formalized training in the above program. - 27 - S PAGENO="0787" 783 B. Unit II Superintendent - Technical Support: Certification and Trainin~ This individual has been an employee of Met-Ed for a period of ten years. He is a graduate Mechanical Engineer and a registered Profes- sional Engineer. He has ten years power plant experience and has been involved in various engineering duties at TMI over the past nine years. Previous positions held at TMI include Operations Engineer, Supervisor of Operations and Unit 1 Superintendent - Technical Support. During the period of his assignment as Operations Engineer, he achieved a `Hot" SRO license in Unit 1. This was accomplished through a training program similar to that described in Sections I and II of this document. He has maintained his license current by meeting the requirements of the Requalification Program (Attachment 1). During his assignment as Unit I Superintendent - Technical Support he served as chairman for the Unit 1 Plant Operations Review Committee. Following his appointment to Unit II Superintendent - Technical Support, he entered a program to achieve a dual unit SRO license. - 28 - PAGENO="0788" 784 AIIAcH2~ENT ~ METROPOLITAN EDISON OPERATOR RE~U~ ICATIOM PROGR~! 13.2.2 The Metropolitan EdiCon reqyialification program, as set forth in this document, applies to the Three Mile Island. Nuclear Station. All licensed personnel will participate in the applicable portion of the regualification pro- gram. The basis of the requalificatioh program is the need to maintain operator competence and proficiency in the quest for continued sate operation. The guidelines for the requalification program are found in 1OCFR55 Appendix A~ In addition, the implementation of this program conforms to 1OCFR5O. I. Program Schedule - II. Pre-planned Lectures III. On-the-job training IT. Annual Evaluation Examination V. Records VI. Accelerated Requalification Program VII. Pour Month Absence Program VIII. Nevly Licensed Operators IX. Requalitication Program Administration 13.2.2.1 Program Schedule The requalification program described herein will be implemented at a specified date within 90 days after receipt of an operating license. March 1, and subsequent anniversaries of this date, will be considered to be the start- ing date of each snnuaj)- cycle of requslification. program operation. The Metropolitan Edison Requalification Program consists of four inter- related segm.enta which, run. concurrently. These segnsnts are: 1) Operational Review Lecture Series (OR) - 2) Fundamentals and System Reviev Program CFSR) 3) On-The-Job Training 1~). Annual Evaluation Examinations - The OR Series is a classroom lecture presentation which provides licensed personnel with the details of operational information related to the Three Mile Island Station. As part of the OR Series, selected PSR topics are presented. FSR topics are selected in areas where annual operator and senior operator written examinations indicate that emphasis in scope and depth of coverage is needed. OR lectures are scheduled for a minimum of 60 hours par year for all single end dual License holders. On-the-job training is designed to insure that all licensed personnel operate reactor controls and participate in major unit evolutions. Records of all on-shift performance are maintained and reriodieslip reviewed by supervisory personnel. - The annual evaluation examinations simulate the written and oral exazsination~ administered by the Nuclear Regulatory Commission. Performance on these annual. evaluation examinations determine the extent of the tSR program during the fol- lowing twelve month requslification period. 3-Annual, as referred to in the Operator Reaualification Program, is 12 months, not to exceed 15 months, in order to accommodate unit operations. 13.2-6 Am. 6I~ (4-T-T8) PAGENO="0789" 785 Each license holder will complete all applicableOR and FSR requirements on an annual cycle. The On-the-job tra~ning is conducted throughout the two year term o~ the individual's license. All recyired on-the-job training will be completed prior to license renewal. A statenent of Reaua.lification Program participation will be submitted with each license renewal application. The requalification program is designed with fixed performance standards end specified remedial actions. The program results and. record.s are fully auditable. l3.2-6a An. 6~i (1~-T-T8) PAGENO="0790" 786 13.2.2.2 Pre-Planned Lectures 13.2.2.2.1 Operational Review (OR) Lecture Series During each year, personnel shall attend the Operational Review (OR) Lecture Series on the following batis: . - (a) Licensed station administrative and technical ~ersonne1 will participate in the OR Lecture Series as either students or instructors, except to the extent that their normal duties preclude the need for specific re- training in particular areas. -- - (b) OR Lecture Series attendance is required of all licensed operators and senior operators who are normally on shift assignments. The following top~cs shall be covered as a minimum during the OR Lecture Series each year: (a) Reportable Occurrences - (b) Unit Nodifications (c) Operating History and Problems (d) Procedure Changes (e) Abnormal And ~hergency Procedure Review - (f) Technical Specifications (g) Major Operational Evolutions (such as refueling) (h) Applicable portions of Title 10, Chapter I, Code of Federal Regulations ; (i) FSR Program Material Additional topics which may be presented include: (but are not limited to) (a) Operational QIA (b) Standing Orders (c) Operating -Experiences - Reactor Safety and other pertinent SEC publications. Lectures shall be held on a continuing basis and consist of a minimum of 60 scheduled hours per requalification program cycle. Credit for the classroom portion of the simulator training program relating to either T~tE Unit 1 or II may be credited toward the 60 hours of OR Lecture. Attendance of all licensed personnel will be recorded. Absences will be made up by reviewing lecture naterials and/or discussions with on-shift supervisory personnel or the technical staff. The program for each session will be determined by unit operations or pro- jected operations. Records of the topics covered in each session will be maintained by the Training Department. Periodic evaluation quizzes covering the content of the OR lecture caries will be administered. The quizzes nay be administered in either the closed book or open book format, as classroon or on-shift quizzes. If an unsatis- factory grade (less than 80%) is received, makeup sessions with assigned instructors will be conducted. The makeup session will conclude when en oral evaluation is satisfactorily completed. The content of the quiz will be different for RO and SRO license holders and will reilect the topic areas and degrees of responsibility needed by the licence holder. Examoles of 2These lectures nay be given on-shift by- Shift Forenen or Shift Supervisors 13. 2-T Am. 6l~ (k_T-78) PAGENO="0791" 787 the materials to be used during the OR lecture series are: (a) Unit records and logs (b) Pertinent cossunications to and from the NRC Cc) Unit procedures and changes Cd) Test results * (e) Applicable training program materials 13.2.2.2.2 Fundamentals and System Review (FSR)P~p~~ During each year, licensed personnel shall participate in the Pündsmentals and Systems Review (FSR) Program based on their annual written examination scores as identified in Section IV - Evaluations. The FSR Program may consist of preplanned lectures, self-study- assignments, possible tutorial sessions with designated technical instructors, arid evaluation quizzes. The study assignments and preplanned lectuims will be in keeping with the license level of the individual license holder. Individual, study assignments, films, and video tapes will consist of no more than 50% of the FSR Program. Preplanned FSR lectures shall be scheduled in those areas where annual operator and senior operator iiritten examinations indicate that emphasis in scope and depth of coverage is needed. Any or all of the following topics may be included in a Particular year's FSR Program: (a) Principles of Operation (b) Features of Facility Design Cc) General Operating Characteristics Cd) Instrumentation and Control Ce) Safety and Duergency Systems including unit/station protection systems * (f) Normal and Raergency- Operating Procedures ". (g) Radiation Control and Safety For Senior Operators the FSR Program will also include: * (h) Reactor Theory * Ci) Radioactive Material Handling, Disposal, and Hazards (j) Specific Operating Claracteristics (k) Fuel Handling and Core Parameters (1) Administrative Procedures, Conditions and Limitations Performance of FSR assignments will be determined through written evaluation cpiizzes. These quizzes will be specifically directed toward RO and SNO Iniowledge requirements. The quizzes nay be administered in either the closed book, or open book format, as classroom or on-shift quizzes. A satisfactory grade on the FSR evaluation quiz villbe 80%. It a grade below 80% is achieved by a license holder, a deficiency is assigned and the li- cense holder will be assigned an accelerated recualification program as per Section VI. 13.2-S Am. 6~, (`i-T-T8) PAGENO="0792" 788 *13.2.2.3 On-The-Job Training * During the two-year term of his license, each, licensed operator shall * participate in on-the-job training which has the following goals: (a) Each licensed reactor operator or senior operator shall participate in a ninimum of 10 reactivi~y manipulations as defined in this sec- tion of the reoualification progrem. Reactor operators or senior operators licensed on both T~ Units cam perform or supervise these reactivity manipulations on either unit. (b) Each licensed reactor operator or senior operatOr shall participate as appropriate, in applicable surveillance testing, system checkout and equipment operation based on license level and relevant to the area of license responsibility. Cc) Each licensed reactor operator or senior operator shall review procedure changes, unit notifications, technical specification changes, reportable occurrences and incidents, either on-the-job or during sessions of the OR Lecture séries.3 Each licensed reactor operator shall manipulate the unit controls to effect reasonable reactivity changes. Each licensed senior reactor operator shall either manipulate or direct the manipulation of the unit controls to effect reasonable reactivity changes. Reactor operators or senior operators * licensed on both T~I Units can perform or supervise these manipulations of unit controls to effect reasonable reactivity changes on either unit. Reactivity manieulations which demonstrate skill and or familiarity with reactivity control systems and which are credited to meeting On-the-job training will include, but are not limited to: 1. Power change of greater than 10% full power with the reactor control station in manual. 2. Control rod manipulation from subcritical condition to point of adding nuclear heat. - 3. Boration and deboration maneuvers involving control rod manipulation. 1~. Turbine startuD and shutdown. 5. Reactor trips and subsequent actions. - The participation of licensed personnel in the on-the-job program will be reviewed quarterly by appropriate supervisors to insure that opOrators - participate in ~ variety of evolutions. If diversity of operations is lacking, specific assignments may be nade to ensure wide operator experience. Included in the following list are examples of additional operations which nay be considered in this category. These samples are not to be considered for reactivity manipulation credit. 1. - Surveillance testing including a. Containment spray system b. Safety injection c. Tuergency Diesel Generators d. Chemical addition system 2. Makeup and Purification System Operation 3. Decay Heat Reunval System Operaticn 14~ Feedwater System Operation 3Only those changes, incidents, etc., which are selected by the Supervisor of Operaticns or Supervisor of Training as peroicent to unit operation. l~.2-9 ~,, ~I n .~ PAGENO="0793" 789 5. Reactor Coolant System 6. Turbine Valve Testing 7. Pressurizer Operation 8. Incore Monitoring System Operation 9. Control Room Calculations including a. Neat balance b. Quadrant tilt/imbalance/Rod withdrawal index c. Reactivity balance 10. Portable HP Instrument use. Licensed personnel, whose job assignments are not dfrectly related to unit operations will actively participate in control room operation am average of ~ hours per month. During this period these licensed personnel will H participate in whatever activities are in progress.. Reactor operators or- senior operators licensed on both TMI Units will actively participate in either unit's control room operation en average of 1~ hours per month. A simulator may be used in meeting the reciuirements of this section. The - use of a simulator to meet the on-the-job training section of the program - also has been previously-reviewed by the NRC. - The following standards apply to the evaluation of on-the-job performance. 1. Quarterly review of operator participation will be made by the - appropriate supervisors. The review must indicate a diversity of experience. If this is not demonstrated, the operator vii]. be scheduled for additional operating experience. 2. Quarterly review ot reactivity control manipulations CR0) or direction - (SRO) must show satisfactory progress toward the minimum of 10 oper- ations as defined in this section. If satisfactory progress is not indicated, an operator will be assigned additional control room operations or may accomplish the required reactivity changes on a simulator. - 3. ~nnual review of licensed personnel whose job assignments are not directly related to unit operations must show a minimum of 1~8 hours - of unit operation assignments per year. If this is not complete, personnel will be assigned to active control room duty until the time is made up. A simulator may be used to complete control room time. Reactor operators or senior operators licensed on both TMI Units 1 and 2 must show a minimum of b8 hours of operations assignments per year between the two units. - 13.2-10 An. 6~ (`~-7-78) PAGENO="0794" 790 l3.2.2.~ Annual Evaluation Examination Evaluations `will be conducted on an. annual basis as follows: (a) An annual written evaluation exanination will be given to all licensed oxarators and senior operators prior to th~ completion of each annual cycle. ~ (b) An annual oral, evaluation will be administered to all licensed operators and senior operators prior to completion of each annual * cycle.~- The annual written evaluation examination will be administered to all licensed personnel as set forth in the following guidelines: 1. The examination will simulate the. examination normally administered by the Ituclear Regulatory Commission. 2. Reactor Operators will take Sections A through U of the examination while the Senior Reactor Operators will take Sections H through L end answer selected ajiestions in Sac- tions A through U. . 3. The examination, examination answers and a grading key `will be prepared in advance. 1~. The examination results will be used to identify specific P55 lecture series topics to be covered by each licensed, individual during the subseQuent annual reQuelifications program cycle. 5. The examination will be administered and graded by a member of the station technical staff, station management staff, training department supervisor; or consultant. . 6. The persons responsible for the preparation of the examinations and answers will be given credit for passing the examination. The annual oral evaluation examination, using a checklist, will be administered to all licensed personnel. The oral examination will cover the following areas:, (a) action in event of abnormal conditions (b) action in event of emergency conditions Cc) response to unit transients (d) instrumentation signal interpretation (e) procedure modification (f) unit modification (g) Technical Specifications (h) Exergency plans ~`Reactor operators or senior operators licensed on both TMI Units will be given a single ennual'written and oral evaluation examination which covers both T~'U Units. l3.2-ll * fin. 6~ (b-i-i8) PAGENO="0795" 791 The following standards apply to the annual evaluation examination: 1. A license holder who scores higher than 80~ in all sections of the annual written çvaluation will not be req~iired to participate in the TSR program. 2. If a license holder scores less than 8o5~ o~ any section of the annual written examination, the license holder will participate in the FSR ~ro- gram. related to failed sections. 3. If a license holder scored below 80% on two or more sections of the annual written examination, the license holder will be given an oral examination and evaluation by the Supervisor of Operations, Supervisor of Training, or other suitably qualified persons designated by the Unit Superintendent. This examiner will, based on the results of his examination, make a recoin- mendation in writing to the Unit Superintendent that the operator either (1) be relieved of his responsibilities and enter an accelerated training pro- - gram or (2) be permitted to remain on shift while participating in the appropriate requalification TSR program with suitable tutorial assistance. ~ An unsatisfactory evaluation on the annual oral examination will require that discussions of deficienciestake place between the license holder and either the Supervisor of Operations, Supervisor of Training, or other suitably qualified parson designated by the Unit Superintendent. A second oral evaluation examination will be administered. If performance is again * unsatisfactory, the license holder will be relieved of responsibilities and placed into an accelerated requalification program. * 5. If an individual recieves a. grade of less than 70% overall on the annual examination it will- be mandatory that (1) he be relieved of his licensed duties and (2) enter an accelerated requalification program. Upon (1) - successfully passing a second written and oral examination and (2) certif- ication of satisfactory rating being sent to the ~(RC, the individual will -. be returned to his licensed duties. . 13.2-ha * ~n. 6l~ (~-T-78) PAGENO="0796" 792 13.2.2.5 Records - Records of licensed personnel parformance on all written evaluation examinations and quizzes shell be available for NRC examination fo.r the previous two annual reque.lification cycles. These records shall include: 1. Examination and quiz questions 2. P_nswer sheets and grade keys 3. Examination papers and work sheets Records of participation in all OR lectures and DEE programs will be available for DEC review for the Drevious two annual requalification cycles. These records shell include: 1. Attendance records - 2. OR lecture content 3. FSR assignment 1~. Absences end. makeup sessions 5. Assignment check off lists 6. Document review lists. Records of annual oral evaluation examinations shall be made available for NRC review for. the previous two annual requalification cycles. Records of all on-the-.job activities shall be available for NRC review for the. two years prior to license renewal application. These records shall include: 1. Reactivity control manipulation 2. Equipment operation 3. Sinulator participation Requalification records covering the previous two annual cycles will be removed from the files following license renewal. -. A summary record will be maintained on each license holder for the duration of his employment. 13.2-12 p~ 61~ (!...T.78) PAGENO="0797" 793 13:2.2.6 Accelerated Reaualifjcatjon Program - An operator who does not clear de~iciencies assigned due to performance below standards on either the annual written or oral evaluation will be relieved of responsibilities and enter a full time accelerated requaljfjcaej~~ program. The program duration and content will be dictated by the nature of the deficiency. Program duration will be determined by individual performance. When the license holder is (1) able to satisfactorily pass en ecuivalent written or oral examination and(2) certification of his satisfactory rating is sent to the NRC, he shall resume his on-shift responsibilities. During the period of accelerated requalification, attendance at the OR lecture series is required. If the license holder is off-shift for more than 4 months, Section 13.2.2.1 dealing with lengthy absences applies. 13.2.2.1 Pour Nonth Absence ?rogr~ * If a licensed person has not actively carried out the functions of his license for a period in excess of four months, he shall: (a) review all material presented or scheduled to have been presented in the OR lecture series for the period of inactivity (b) be given am oral examination on the applicable Section of the OR * lecture series and current unit status If performance- on the- oral evaluation is unsatisfactory, the individxal will be placed in an Accelerated Requalification Program in accordance with Section 13.2.2.6. Upon receipt of a satisfactory rating, the licensed person shall be * certified by the Supervisor of Operations, Supervisor of Training or other suitably qualified person designated by the Unit Superintendent. * The certification of satisfactory rating will be transmitted to the :. NRC and only after approval by the NRC shall the operator be returned to normal licensed duties. 13.2.2.8 !~!~i Licensed Operators Newly licensed operators shall enter the program and participate in the annual program cycle upon receipt of their license. New operators receiving their NRC license less than six months prior to the nnnual evaluation examination will be required to attend the appropriate OR and FSR Programs but will be excused from taking the current annual evalua- tion examination. However, he will be responsible for taking all other annual evaluation examinations. 13.2-13 An. 61 (!t_7_7~ PAGENO="0798" 794 13.2.2.9 Requalification Program Administration The Supervisor of Training and his staff are responsible for: 1. Assigning. initructors for the OR lecture series 2. Determining FSR assignments for individual operators 3. Maintaining and revieving all records 1&. Assigning deficiencies, determining appropriate action to clear deficiencies and clearing deficiencies upon satisfactory con- pletion of assigned action 5. Arranging accelerated requelification programs as nay be necessary 6. Defining oral evaluation procedures 7. Scheduling necessary simulator tine 8. Prepare license applications forlicense reneval The Supervisor of Operations, Supervisor of Training, or other suitably qualified person designated by the Unit Superintendent is responaiblè for~ 1. Evaluation of on-the-job ~erformance of all license holdera 2. Meeting vith license holders who recieve unsatisfactor~r annual evaluation examination grades 3. Certifying operator qualification when returning from a fou±~ month absence from operation b. Constructing annual written evaluation examination, ansver~ end grade key 5. Grading of the annual written examination 13.2-lb Pm. 6b (14-7-75) PAGENO="0799" 795 ATTACHMENT 7.1 * UNITED STATES NUCLEAR REGULATORY COMMISSION * RULES and REGULATIONS TITLE 10. CHAPTER 1, CODE OP FEDERAI.REGUUflONS-..ENEROY GENERAL PROVISIONS SeE 35.1 Psspote. 55.2 ScOpe. 55.3 Liceeuqsene,t,. 55.4 Dunn,. 55.5 ~icutions. 55.6 Intopuet,tinn,. EXEMPTIONS 55.7 SpeOiROnespflOnL 52.0 Additienst eeqaieveeu. 55.9 Enevptuon, frlicnn,n. LICENSEAPPI,ICATIOSS 55.10 CnvtevtT3pptiont. 53.11 Reqcisstenet,Tc~th.appentnt.pptics1ino 35.12 Re.uppl~tunvs. WRITTEN EXAMINATION AND OPERATING TESTS 35.20 Sscpe of usuixns. 53.21 CoVent efn~,z~,tne shOne 35.22 .CcnteV of seviee opee~tne etittee 55.23 Scope or npee,tae ned snOjOt eperutne epe.~t1vgtnsts. 35.24 W,ineu of e,,nin,tinn and 1,31 requr,. 55.25 Adeinisnoti 1 cp,tatiel tens ptln?Inln. itiaIc.ituu,titj~ LICENSES 53.30 I,scsnun uf IscenSel. 55.31 Covditievsnf the licensen. 53.32 Eepieatlnn. 52.35 Rnnrmtortkennen. MODIFICATION AND REVOCATION OF LICENSES 55.40 Moditic,tinv cud eeettsatinn niticenses. 55.41 NotiEcation of dss~bit~ty. ENFORCEMENT 33.30 VMntinnt. CERTIFICATEOFMEDICALEXAMINATION 33.60 Ec,vtue,tinn Intttt APPENDICES Appeedis A-Reqsutsfic*tinn Penleuetu foe LicesndOpn.utotsnfP.ndontnn~edUtltu. * AUTHORITY~ The peonlduttiet this Fuel 55 luand sndee sect. 107. 161.61 Stat. 939,940:42 U.S.C. 21 37, 2201. Foe the psrpous nf sea. 223, 65 St,t.95t.u,anendnd:42U.S.C.2275,l55.Sinxnd 504335,0. I6IL6OSt,t.949t42U.S.C.22SI(i).tee. 35.4Oissaedxnd,rcuc,. 116. 107.GOStu'.955;42 U.S.C. 2236. 2237. Seen. 252. 2S6.PobI. I... 93.435, lISten. 1244, 1246;42 U.S.C. 5842,5146. thereto. (b) "Comnsission" means the Nuclear Regulatory Conunissiots or its duly authorized representatives.. (c) "Facility" meaps any production facility or utilization facility as defined in Part 50 of Ittis chapter. (d) "Operator'3 is any indivIdual who manipulates a contrql of a facility. An individual isdeensedto reanipulatea control if he directsanother to manipul- ate a control, (e) "Senior, operator" is any in- div~dual designated by a facility licensee under Part 50 of this chapler to direct 08 the licensed activities of licensed opera- (f) "Controls" when used with to respect to a nuclear reactdr means ap.. paratus and mechanisms the manipula- tion of which directly affect the reac- tivity or `power level of the reactor. "Controls" when used with respect to any other facility means apparatus and mechanisms the manipulation of which could affect the chemical, physical. metallurgical, or nuclear peocessof the facility in such a manner as to affect the protection nfhealth and safety against radiation. (g) "United States" when used in a geographical sense, includes all territo- ries and possessionsof the United States, the Cunal Zone and Puerto Rico. fl 55.5 Communics~ions. Except where otherwise specif~ all communications and reports concT~ing the regulations in this pare, and applies- tions filed under them should be ad. dressed to the DirectorofNucleat-Reac- r tor Regulation or the Director of Nuclear Material Safely and Safegshrds.. as appropriate. U.S. Nuclear Regulatory Commission, Washington, D.C. 20555. Communications, reports, and applies- tions may be delivered in person at the Commission's offices at 1717 El Street, N.W., Washington, D.C. orat 7920 Nor- GENERALPROVISIONS § 55.1 Purpose. The regulations in this part establish procedures and criteria for the issuance of licenses to operators, includingsenior operators, of facilities licensed pursuant to the Atomic Energy Act of 1954, as amended, or section 202 of the Energy Reorganization Act of 1974 and Part 50 ofehischapter; and providefor theterms and conditions upon which the Commis- sion will issue these licenses, 1552 Scp., The regulations contained in this part applyto any individunlwho msnipulates the controls of any facility licensed pur- suant to Part 50 of this chapter and to any individual designated by a facility licensee to be responsible for direc'cing the licensed activities of licensed opera- tors. 55.3 License requirenseols. (a) Noperson may perform the func- tion of an operator asdefined in thispnrt `except asauthoeized by a license issued by the Commission; (b) No person may perform thefunc- - lion of a aenior operator as defined in this part except as authorized by a license issued by the Commission. § 55,4 Definilions, As used in this part: (a) "Act" means the Atomic Energy Act of 1954 including any amendments I PART OPERATORS' LICENSES * * F ~ 554 April 29. 1976 PAGENO="0800" 796 PART 55 * OPERATORS' LICENSES Ltotk Avenue. Bethesda, Md. W~~hisgtita, D.C., or 7920 Norfolk LAvenue, Bethesda Md. § 55.6 interpretations. Except as specifically authorized by Each application the Commission in writing, no in- e~ for a license shall contain the following terpretution of the meaning of the information: -. regulations in this part by any officer or i- - - employee of the Commission other than (1) The full name, citizenship, age, a written interpretation by the General address and present employment of the Counsel will berecognized lobe binding applicant; upon the Commission. - (2) The education and pertinent ex- perience of the applicant, including ExtatPrloss detailed information on the extent and nature of responsibility; § 55.7 Specific exemptions. (3) Serial numbers of any operator * _. . :. and senior operator licenie issued by the The Commission may, upon applica. Commission to the applicant and the cx- lion by an interested person, or upon its piration date of each; own initiative, grant such exemptions (4) The specific facility for which the from the requirements of the regulations applicant seeks an operator or senior in this part as it determines are operator license; - authorized by law and will not endanger (5) The written request of an life or property and are otherwise in the authorized representative of the facility public interest. -license that the operating test be ad- ministered to the applicant of the ~ § 55.8 Additional requirements, facility. * - (6) Evidence that the applicant has a. The Commission may,by rule, regula- learned to operate the controls in a tom- tion, or order, impose upon any licensee petrol and safe manner and has need for such requirements in addition to those an operator or a senior operator license- established in lht regntationsin this part, in the performance of his dseies. The as it dtdms appropriate or necessary to Commission mayaccept asproofofthisa protecchealth and to minimize danger to certification of an authorized represnn. i life or property. Inline of the facility licensee where the applicant's serviceswill be utilized. This. § 55.9 Exemptions from license. ~ certification shall include details on "courses of instruction administered by Nothing in thispart shall be deemed to a. the facility licensee, number of course cequire a license for: hours, number of tapurs of training and (a) An individual who manipulates nature of training received at the facility. the controls of a research or training and for reactors, the startup and shut- reactor aspartofhistraining as astudest down experience received. in a nuclear engineering cotirse under (7) A report of a medical exasnina- the direction and is the presence of a don by a licensed medical practitioner. licensed operator or senior operator; is one copy in the form prescribed in (b) An individual who munipulates § 55.60. the controls of a facility as a part of his (b) The Commission may at anytime training to qualify for an operator after the filing of the original applica- licensz under this part under the direc- lion, and before the expiration of the don and in the presence of a licensed license, require further information in operator or senior operator. order to enable it to determine whether the application should be granted or LlcchscAtPLICATIONS denied or whether a license should be revoked modified or suspended: 55.10 Contents of applications. (c) An applicant whose application has bred denied because of his physical (a) Applications for licenses should coxdition orgeneral health maysubmit a be filed in triplicate, except for the further report of medicnl examination at report of medtcat examination, with the any time as a supplement to his original Director of Nuclear Reactor Regulation a lication it or the Director of Nuclear Mat~riat (d) Each application and statement ~ Safety and Safeguards, as appropriate, shall contain complete and accurate dis- U.S. Nuclear Regulatory Commission, closure as to alt matters and things re- Washington, D.C. 2055~5. ~ommunica- -qaired to be disclosed. All applications lions, reports, and applications may be and statements, other than the matters delivered in person at the Commission's required by items 5 6 and 7 of offices at 1717 H Street NW., paragraph (a) of this section shall be signed by the applicant. .~ -. § 55.11 Requirements for the ap- proval of application. An application for a license pursuant to the regulations in this part will be ap. proved if the Commission finds that: (a) The physical condition and the general health of the applicant are not such as might cause operational errors endangering public health and safety. (I) Epilepsy, insanity, diabetes, hb. pertension, cardiac disease, faintin5 spells, defective bearing or vision or a other physical or mental condition whic might cause impaired judgment or moteej coordination may constitute sufficient cause for denial of an application. .. (2) if an applicant's vision, hearing and general physical condition do not meet the minimum standards normally considered necessary, the Commission may approve the application and include conditions in the license toaccommo- date the physical defect. The Commis- sion will consider the recommendations of the facility licensee or holder of an authorization and of the examining physician on Form NRC-396 in arriv- ing at its decision. (b) The applicant has passed a writ- ten examination and operating test as rosy be prescribed by the Commission to determine that he has learned to operate and, in the case of a senior operator, to operate and to direct the licensed ac- tivities of licensed operators in a compe- tent and safe manner. (c) The applicant's service as a licensed operator or senioroperator will be utilized on the facility for which he - seeks a license or on a similar facility within the United States. * - - - - § 55.82 Re.applieaiions, - - - -(a) Any applicant whose application for a license has been denied because of - failure to passthewritten examination or operating test or both may file a new ap- plication for license two months after the daleofdenial.Any newapplication shall be accompanied by a statementsigned b~' as authorized representative of th~~ - facility licensee by whom the applicaef will be employed, stating in detail thd~" extent of additional training which the.. applicant has received and certifying that he is ready for re-examination. An applicant may file a third application six: months after the dale of denial of his se- cond application, and may file further successive applications two years after the date of denial of each prior applica- (b) An appticaat who has passed eithertlse written esamination or operat-. April 30, 1975 - 55-2 PAGENO="0801" 797 H ing test and failed the other may request In a new spplicalioá that he be excused from re-rumination on the examination or test which he has pawed. The Cóm. missios may is its discretion grant the reqaest if it determines that sufficient justificAtion is presented ceder all the Weirrora EXAMINATIoNs AND 000RAT. INGTE5TS § 55.20 Stage of examinaliona, ThA written coaloiaatioo and operal- log test for a license as an operator ora sesior operator are designed to test the applicant's understanding of the facility design and his familiarity with the coo- Irols and operating procedures of ohe - facility. The written, examination is based in part on information in the ffmal5 safety analysis report, operating manuals, and license for the facility, § 55,2g Conlenl of operator wrillen The operator written examination, to the extent applicable e the facility, will include questions on: (a) Faodamrssals of reactor theory, including fission process, neutron multiplication, source effects, control - rod effects, and criticality indications. I (b) General design features of the core, including core structure, fuel ele- ments, control rods, core instrumenta- tion, and coolant flow. (c) Mechasital dAsigo fealuresoflhe reactor primary system. (d) Auxiliary systems which xffrel the facility. (e) General operating charac- teristics, including causes and effects of temperature, pressure and reactivity changes, effects of load chaAgm, and operating limitations and reasons for them. (1) Dmign, components sod fuoc- lions of reactivity control mechanisms and instrumentation. (g) Desigs, components sod fuoo. F lions of safety systems, including ioslru- meslatino, signals, isterloeks, automatic and manual fcolsres. (h) Compoersts, capacity and fuec- lions of roseroe asd emergency systems. (i) Shielding, isolation and coolaio- merit design features, including access 0) Standard and emergency operal. log procedures for the fxtilisy and plane. (k) Purpose and operation of radia- lion mosiloriog system, including alarm and survey equipment. `Avoedrd 33 FR 12774. (I) Radiological safely principles qod § 55.22 Coolest of senior operalor wrilles examisation, The senior operator written exsmisa- lion to the extent applicable to the facility, will include qsmeioos 00 the items specified in § 55.21 and 10 addi- tion on IhI following: (a) Conditions and limiextiossin the facility license. (b) Design and operating limitations in the technical spreificaciods for the facility. (c) Fatility licensee procedures re- quired to obtain authority fordesign and operaliog changes 10 ehl facility. (d) Radiation hacards which may arise during the performance of experi- ments, shielding alterations, mainle- ounce activities and various costamisa- lion conditions. (e) Reactor theory. iecludiog details of fission process, neutron multiplies-. tioo, source effects, control rod effects, ond criticality indications. (I) Specific operating characteristics, including coolsse chemistry and causes and effects of temperature, pressure and reactivity changes. (g) Procedures and limitations in- volved in initial core loadisg,alteratioos in core configuration, control rod programming, determination of various F internal and external effects on core reaclioily. - (h) . Puel hsodliog focilities and pro- (1) Procedures sod equipment available for handling sod disposal of radioactive materials and effluents, § 55.23 Smpe of operator soil seems' operator operating tests. The operating tests sdminiscered to applicants for operator and senior operator licenses sregesersltysimilxr in scope. The operating lest, to the extent applicable to the fatilily requIresehe up-. plicast to demonstrate sod understand-. leg of: `(a) Pre-slarl-up procedures for the facility, including associated plant equipment which could affect resteivity. (b) Required manipulation of coo- sole controls to bring the facility from shutdown to designated power levels. (c) The source sod significance of soouocislor signals sod condition-in- dicating signals sod remedial action responsive thereto. (d) The ioslrumeelalion system sod the source and sigoifienoceofrexceoris. strument readings. (e) The behavior ehsracreriseies of the facility. (1) The control manipulation re- quired to obtain desired~ operating results during oormal, abnormal sod emergency situations, (g) The operation of the facility's heal removal systems, including primary coolant, emergency coolant, sod decay heal removal systems,sod the relaeionof the proptf operation of these systems to the operation of the facility. ~- (h) The operation of the ~xcility's auxiliary systems which coul4,. affect reactivity. (I) Thb use sod function_of the facility's radiation monilbring'bysltms, - locluding fixed radiation monitors, sod slarms, portxblesurvey iostrumiitn,sod personnel monitoring equipment. 0) The signifiesoce elf radiation hazards, including permissible levels of radiation, levels in excess of those authorized and procedures to reduceex- cessive levels of rsdiation sod to guard against personnel exposure. (k) The emergency plan for Ike facility, including the operator's or sroior operator'srespontibility todecide whethernhe plan should be executed sod the duties assigned under the plan. (I) The oeeessity for a careful op. proach to the responsibility associated with the safe operation of the facility. § 55.24 Waiver of examination sod leol eequiremenls. * On spplicution, the Commission may waive soyor all ofeherequiremeotsfors wiitlenesimiostion sod operating ttsrif it feds that the spplicsoc: (a) Has had extensive sctual operac- log experience at s comparable facility within two years prior to the dale of op- plicxeion. (b) Has discharged his respon- sibilities comptlenlly sod safely sod is capable of continuing to do so. The Commission may sceept as proof of the spplicsol's past performance s certifies- lion of so sutborired representative of the facility licensee or holdeghof so authorization by which the spplicaocwm previously employed. The certflQ'stion shall contain a description of thw.appli- caot'soperaeiog experience, ioclu3liogsn approximate number of hours eheappli- cant operated Ihecootrols of the facility. the duties performed, sod the extent of his respoosibility. (c) Has learned the operating pro- cedure for sod is quslified to operale compeeentiy and sofelythe facility desig- nated in his spplicstion. The Commis- sion may accept as proof of the appli- cant's qualifications a certification of so authorized representative of the futility licensee or holder of so authorization 55-3 April 30,1975 PART 55 * OPERATORS' LICENSES 49-721 0 - 79 - 51 PAGENO="0802" 798 PART 55~. OPERATORS' LICENSES where the applicant's services will be cept as evidence, a cerlitfcation by art an application in proper fo 1 t d th d p t I of th I I ty ew I f awl se th t g § 55.25 Adm I teat n pe s ~z [mpI~jei~ wh oh th I has beast h xp I Ith ppl 1(f) S h th d as th b f fly d t em colby th Comm The Commission may administer a - Commission may impose to protect ~ ) Tb r II is dr mltdp tgttt ppl I `llthotmm dgtlfo~t~~~ fdtht tS t I t catty f wr tt q est ~ ~ (I) Tb phy 1 d I rid th by th d p me I I of th § 55.32 E p rat g I Sc t s.~ ty ~ dth ~ ent lb oh Cons ~a h pe d se op t [0d wIt It mgh d g p bI h (a) There in an immediate need for license shall expire two years after the ` the app!icant's services.~ -- date of issuance. I'~' (2) (1) Thelicensee has been activ~ly (b) The applicant has had extensive and extensively engaged as an operat,or -. actual operating experience at a corn- § 55,33 Renewal of licenses. or asa senior Operator underhisexistink parable r.vactor. - en license, has discharged his respob, (c) The applicant has a thorough ~ (a) Application for renewal of a sibilitien competently and safely, and is knowledge of the reactor control system, ~ licensh shall be signed by the applicant capable of continuing todo so. instrumentation and operating pro- and shall contain the followine inforena- (ii) The licensee ha~ completed ire- cedures under normal, abnormal, and lion: qualificalion program or is presently emergency conditions. (I) The full name, citizenship, ad- erenrolled in a requalification program if (d) The reactor control mechanism dress and present employment of the ap. ii. the completion of the reqaalification and instrumextalion are in such condi- plicant program will occur after the expiration tion as determIned bythe~ommission to (2) The serial number of the license of his license as provided in sub- permit effective administration of a for whichrenewal is sought; paragraph (a) (4) of this section. simulated operating test. (3) The experience of the applicant I (iii) Iftherequirementsofparagraph under his existing license, including the 1(c) (2) (i) and (ii) of this section are not Ltccssos: . approximate number of hours during I met.theCommission may require the ap- m which he has operated the facility 1 plicant for renewal to take a written cx- § 55.30 lsuaaace of licenses. . Lamination or anoperating text or both.. - (4) Astaternentthat during the effec- Os deterrnisixg that an application tive term ofhiscurrent license the appli- (3) There is a continued need for a meets the requirements of the Act and cant has satisfactorily completed the cc- license to operate or direct operators at the regulations ofthe Commission, the qualification program for the facility fol the facility designated in theapplication. Commission will issue a license in such which operalor or senior operator form and containing suchconditions and license renewalis sought. In the case of MODIFICATION At-iD REVOCATION OF l~rnitations as it deems appropriate and an application foclicense renewal filed LlccNsEZ ess y w th two y 11 S pt mb 17 1973, if the facility licensee has not im- § 55.40 Modification and revocation § 55.31. Condilinna of the lieensest. ~ plemented the requalificatiox program . otlicenses. -~ a. requirementsin time for the applicant to - - - Each license shall contain and is sub- complete an approved requalification (a) The terms and conditions of all ject to the foll&~'ing cosditionn,whether program before the effective term of his licenses shall be subject to amendment, stated in the lice'lsse or not: current license expires, the applicant revision, or modification by reason of (a) Neither th~ljcense nor any right shall submit astatement showinghiscur- amendments to the Act, or by reason of under the license xholl be assigned or I rent enrollment in an approved re- rulesregulations or orders issued in ac- otherwise eransfered. \ . I qualification program and describing ,, cordance with the Act or any amend- (b) The license `is `limited to the I those portions of the program which he meats thereto. fability for which it is issshcl. had completed byehe date of his applica- ~ (b) Any license may berevoked, sos- (c) The license is limited to those LIon for license renewal. U- pended or modified, in wholeor in part, controls of the facility specified in the . ~ for any material false statement in tite license. -. - I(S) Evidence that the licensee has application or any statement of fact cc. (d) The license is subject to and Ihe discharged his license responsibilities quired under section 182 of the Act, ~4' licensee shall observe, all applic'able competently and mfely.The Commission because of conditions revealed by such-i' rules, regulatinesand orders of the Com- may accept as evidence of this a cerlifi-- application or statement of fact or ady mission cute of an authorized representative of report, record, inspection or othc1~ - xi the facility licensee or holder of an means which would warrant the Corn- r (e) If a licensee has not been actively ~-.authorization by which the licensee ha~ mission to refuse to grant a license on an performing the functions of ax operator u. been employed; -. original application, or for violation ofp or senior operator for a period of four ,.~ ((6) A report by a licensed medical orfailure to observe any oftheterms and months or longer, he shall, prior to pra~lilioner is the form prescribed in `bonditions of the Act, or the license, or ec resuming activIties licensed pursuant to 4 55.60. of any rule, regulation or order of the Ihispart.demoostratetothe Commission (b) In any case in which a licensen Commission.orany conduct determined that the knowledge and understanding of not less than thirty days prior to the cx- by the Commission to be a hazard to safe facility operation and administration are piration of his existing licensn has filed, operation of the facility. - satisfactory. The Commission may cc- ~ ~ 22221. - April 29, 1975 55~4 PAGENO="0803" 799 PART 55 * OPERATORS' LICENSES 1'~ 55.41 ~otifleattoe of etisabtlity. The licensee shall notify the Director or of Nuclear Reactor Regulation or the Director of Nuclear Material Safety and Safeguards, as appropriate. U.S. Nuclear m Regulatory Commission, Washtngton, °` D.C. 20555. withIn fifteen (15) days after Its occurrence of any disability referred I to in I 55.llta) (1) which occurs oIler I the submission of his medical examirta- Ltion form. - EsFoecestENT § 55.50 \`inlalionu. An injunction or other cosirt order may be obtaioed prohibiting any viola. lion of any proeision of the Atomic Eoergy Act of.1954, as amended, or.Ti- tIe It of the Energy Reorganization Act of 1974, or any regulation or order issued thereunder. A court order maybe obtained far the payment of a civil a penalty imposed pursuant to section 234 of the Act for violation ofsection 53,57, 62, 63, 81, 82, 101, 103. 104, 107. or 109 of Ike Act, or section 206 of the Energy Reorganization Act of 1974, or any rule. regulation, or order issued thereunder. or any term, condition, or limitation of any license issued thcreucdcr, or for any violation for which a license may be revoked under section 186 of the Act. Any person who willfully violates any provision of the Actor any regulation or order issued thereunder may be guilty of a crime and, upon conviction, may be punished by fine or imprisonment or both, as provided by law. TCERTIFIC,vTg OF MEDICAL ExAictIsiA. TION § 55.60 Examination form. (a) An opplicant shall complete and sign Form NRC-396, `Certificate of ~ Medical Examination." U. (b) The examining physician shott complete and sign Form NRC-396 and shalt mail the completed form to the Director of Nuclear Reactor Regulation or Director of Mactear Material Snfety and Safeguards, as appropriate, U.S. Nuclear Regulatory Commission. Washington. D.C., 20555. NOTE: Cnpirtcf Fear NOC-396 any be nb t,ioad hyc.eiIirO oAr Diaslv olNaalerr cccclvr ceyctsrivn or Direcrveof Nccleur t.tolrricl «=cfcly rod Salrgsardr. cc apywprsclr. 05 Osoloer RcgaTcl.ry' Czvvricrivv. Wa,h:r~lco. DC.. 21553 § 55.61 IDetelel 41) FR 1774.1 ~a. Inane-The reteocetno oat emard lrteptng ecqutreavents funtxloed to thIn purt 5,Aae beets apprnverl by the Deareal AnnouncIng 021cc scoOts' 3-100225 (RntOS), (55359). rrardnodarxchichdesce,,,.... APPfS0IXA harado.rrtorqs.srhro,acfctersnideaapesundz,' vds~dsut cady a or us aooapr.rblzsubairucotra REQIJALIFICATI0N PI105RASIS FOR LlCE~5SED OPERATORS OF PRODtJC- o...t,.,..y ,,joj,r'. The requstiuicaci..,, TION AND IJTII.IZATION FACILtT1ES rt'd~~5~a0 valc.I~ rm.rhe.iahrraiute~s.,thur a. burr tvvsct r.pae.~rocr4 pc'dca~nc, lrrr.Icc,cn ar'treal'.ot.rclay coaoipulatasrbcptanrrsuor..ts,,nd arch toocravi scrc.rrpoeav.realxor crursprslacas the Sconce 50.3Sf IOCFR Pair OOreqsieoxrhur h~. 02tr0,b0,rdhcuot,,itj~5,,t,nd,~ttu5ts,turing d:oiductrchorsnipalalavonlc.leolpovdac,iosuv,t p?.ctro.oiic.t raspctalomsdcccgrhotcsn,.f rho),. cAcaOs fasiliies be licoorod opotalorx by ho motor. are ee.l..c .pze.mtoerand se000,.preat,,or, Coonir,irm aol that iralicidactr cli, direst ha thxonmaopalsc..rr shalt marcia at rt cart It) roar- liceoreat ccclviii,, of inset cpeouloea by liozocod taOs cartel rmavtpubooceu a any o,cottisari,,e of uswoo.rr.pershcr iraaavrdascooith ioCFe part rca~r..r c.cc,np%. eaact..c thartleseuteolitotc..nrml 53. Sosti.,c 55.33 cl In CFR Parc 53 ccqciozc thur mamctpstal,..sc ahs~h doot.o,reale ArtS amt!cr cash licensed ivdiuids:cI dcowrcaate hit ovtivmard f.cntrt,uco tlh macicily ocelot syctemsu. ovompecarceesccyrcmc years corder fee his morse I'. Each tarried aperacte and sector operator cmcboermnaemt.Cnmpelnnaecocybrdeomoosirsred,)n hacttoo.,ecrmumod samisfuamory amdmescnrdregisf rho Imcacteerccroiortioc.hysuoirruoccryocwplcninenfa `qouirt o.e,A oIl upparolus oat emeoleseisoos and roqucliflnatior progravr ohich ho bert reninoeci kn..c~ 11cc npcmorhr~ peocadueas in eaab ares (ct sod uppeoned by the Cooocircna. -butt hc a ttcrvcat. Periodic eeqaatilicalimmc icr alt cpeealort ant ~ ~ arrant opar.aoe ned terdra "preset is creio operators cf pmt.dcccimcr ned uliliouricet ecgnteuer .1 lusty dnougmt ohannos. (Cranium,. facilities isreoecuaey ti~~ the perrcvmrol cc nuirtuin changes. nod famIly Icorrachueges. ommpaterco. purticaterly to carport to, chooeoout sI E.o.t, lcovccct rprrar.te ned can't "pOtato, neil rmerg000yritaalioec. The acomplecity efrtcsigms e.otOmstlhc corers f all chooenalanIoccergeeuy rod oporaciog codes of pmo.lacticc sod stiliracitrc percattccecs rca a cc~ataely rutrertaled boris. facilities eeqaiee that crgcirg conprcheoriarre. a. A smnalulir riry ho xrecl in eceotlvg the q'.aalitmoctioe progmums ho cmrcluolectfor all mooted qacmrmccomis of par.rgeuplrn Su'aart 3b'iirlrosin,otue r.paratoes sod senior cporalcrt u,aecuttcr rot sand ropn.dasrs rho ucrarat operarim churastoriarcns of priociple uod practice. a rho facility nnelcod. and rheaerungocecrr of rho in- liaersed operarors aod senor operates of pro.. s's dcccior amid aliliralive tasititiot oho hare lace an- tiamlyond rrtoeticety000anectascparacorrcras ~ remoerpeercoer shall parlicipare it eeqaatiftnatmce lr. pocgrstonrmrnlic~rhrerqaieenevlrufchisAppeedin. todtoidaals aho oulolaimt oporalor Or Sroioc oporu- ticeores foe the parp.csa nf presiding backup orpubtiryro hr cpecalivg stul null pcrtioipccr ii, rhereqcaulmnoal:or p000ravrnerneptrclheeclorc hoc their contest dalier pooctade rho erect far specilsa retcaoirg in puccicalac areas. Liarceed opcrcloerrc scrmocoprrcroetnhocclicorsesrecoeditiomcdra picnic cturips?cliac 1 rpcailc centrals orly null partiolpate In hare ptteticvr of rime eeqsulitoatins progron apprnpciurc a rho dutiotrhey prefarn. Tho eequati5oalinr po.gravr roqair000enor o~emcompalcli.orlamc:mmo.mlcomaebvpcrmi.tomndr.v rho facility fOr chich the postal is liaeorctt. }tactoee he nsa of a rioalomarottpaciEed Or Pacagraphs)e ard Sd cf this appendin is pceniuibto asS sash ccc it ercoamagact. Requrtincutico PctOcaoc Reqaircmeetts I. Soimecfmmlc. The toqarliEnomine poonmuoc shutt be etmrtttasted Inca onrtieammur pctiod Oct tic uunaett roe coo~r. sod cpncn caratc,ioo shalt he prcnprty cretsim, paragraph ao.rho,totutc,nc,cauaacucstrry fclh.mocd.partauotroootmvriosmmastchrdate.hysan- ropc.atorocho..poracioucbac.ocoecaicrocthofcc.ti,y rerriceerqaotilisatit.o prt.g0000s toc'.tcoctaod rheooca~mgemectefrheieaeramcetoties 2. Ltcecrre. Tioc crqautitioolicmc prouroer shalt sod a..rer,mls oF the smnmatutor shalt closely parallel mestacle preptaroed cocat 000eetatae cod ate- t or.. rho (aattmty ,ccntord. ciociog basis thecmsghmmsm the ticeono pvoimct in hoe ~ Pctmma,nmtcrs mr aaott Itconoted operator acid arms oh err ,oocct tqoomoimmr rod sroicr operator semro.rr.peramar to parttccpote Ic an acoeteroceej rr. moeilleoecaomioalicor iodioaie thscrnphasisio sanyo qmaalmtcoaie.e pommoravt cheer perfoenooor osatau- crddepmhefctcoeraseisreadodiolheFallooiegsaah. mc5Oooattcm:adPccccomttnp000lcsphsilaths.aOh Theooyrodprirciylrcoit.yaatioe. I" bGomreral sod rpaomCc porn 0021ti05 crac. a. ~tt of nbc tctguatlftoatloa PeocTetta PItol mcii uhalt ho eonlmstslned for a period of two years Plant pmcmrcm~mc sytlon.; so oars, from the dame of 0cc recorded count to donu- m~~eut the purtlolpatlon of csnh tieenaed op. S y pea eq pro'.' rn Tb : lie, ~tl ~ R I d I Etal' nc -s gl bytlu Tccomoosprammoommmmoc. roalucctloec nod clsnuoceatcttoo of a-- ad Applicoble pcai.mnc ml Tub 10. Chrprrr 1. ttcoat truleclog odccnl.tstateced las ao~ca tot Otto cf Fadoost Rctctmticvr wlctnh arc oporatoc or oonlos' operator Inset Othrc trulctrg mccheqcrr montadteg frtntt, emcoclhleeddmnolectnlcs. cidcmtnprcand tmmhcc ofiaaticc liriolegaicttnoy oha b. Rerords whIch etcouct bo cnatontstnrd pur- ha used, scoaect to thIs oppcndlc tncp be ttno ortutnas tedinidsutsiady mr lhn punt of rash opamamoestrult U repiomluord copy or minuotoccac If xuuns he cno.tarugod Itcc.oner. uorqcnlifioonico pmogecrr `Ammmonclad Ti FR 2b354 Oeuarentarittcondcm,occols,tfthrsinalrt,.ri,nmitsr In' ihuscf the funility irsolord. .1 Earm!tmccmmmte TlmecequatiOcarimtisprcrgrarr cacati urea Ic `rhich rrtraieie~ is rcedert Ic apmlcscjo Oscnced r.pcramnm' nod soeic,r opemolor tase.lrslcle. h. Wriltee Ot000iesticrcs itlrich drnorominr tiootccad cqcnrslnms' cod soeitmc cprcslncc'bcot.tcdpo of suhjmcrr oncrrcct is the eoqnali5curitsc prrgrarc, redprtroidrabcsicfmoeoatasniogrhcickeasclactge,tf otmem.cccc,t nod moaefeecyprocedacrn. Syscaooocic .htrmcotioe seal meulculine, of rhr prof mom aeoo sed s.mnrpeocrcy of torecact oprrnccmrs aed tacit rmpcraltrrs by cspcm'oisten oed:co tcsimciem scarf rmremlcarsiocladmnl ooctusmicte of ootitrcL tnttne cclmtheraboedcnivgaatuattmcsiotalrtcjuhromocrt aoslncmaeceooycm,eclimioon. d SiomsialiootmIcmccgeesyreaheocmnlemcctc;.. ticmcnttmar emay he oconmeptished byarinOrhcaonmecl psnctt.fshcfacitimyio.olncnj,ccbysnicgasiemxtsr,,, Omborer Iha ncotnr,l paect of the Fanilirp is scat ftcr silrslutjmec. the adios takes rtc to he abet far thr encrgonoot.eobrmmcnutooediciersb,llbedmscstsa.3 actaat couaipstnlimmn mt the pboetoonlcols noes ce. qaimcd.lfocmnclaormrisnaselircmerlirotheecqaieco. 55.5 May 20,1977 PAGENO="0804" 800 PART 55 * OPERATORS' LICENSES reproduced copy or microform is duly au- thenticated by authorIzed peroonnel and the microform to capable of producing a clear and legible copy after storage for the period re specified by Comxritsolon regulations. c. If there Is a conflict between the Corn- ee mission's regulations in this part, license condition, or other written Commission ap- , provai or authorization pertaInIng to toe retention period for the same type of record, w the retention period specified in the regula- I tlons in this part for such records shah apply unless the Conunirsloo, pursuant to 55.7, I has granted a specific exemption from the I record retention ceoutrements specified in Lths regulations In this part. r&Ar~;ni~ser~oiee. neniscrihisappendia naybeonesbyreqsaialicotkno prcgcoens credoceed by persoos esleer duo the raoility lireesee fsssh reqoaiiflcaiioe pregrarns are shnilor Sc the progeus desor*beoi is paaigropho 1 thrcagh 5.aod iheolteerailee pregrorn boa bees op ~ prcceslbyiheCenmissIfs. 7. Appliroisli'y in rro.nes* ned ens rrcroro end ci eest.rrtcler foeilirirs. To aocennocdaie specialized If eooIcscfcpraiicsooddilfereocosioaeoirot.eqsip. once, nod perolcr skills ood bceoiedge, the en- ~ qosliticaticopergeam foreaohiicensedaperatcrand ~ pe~sle at a researcher test ezoctcr cc afa I ees.eosctoefaciiiiyshallccoei.rengeeerollybsieeed cot be idootioal Is the reqsalilieatios psegraro cal. lineal in paragraphs I Ihreagh 6 ef this appoods. ~ Hcsaecee. sigeilicaoi donistiros Iron the reqsire. I mcntsctthisappendiashallbepoeotittesleoiyifssy- and apprenesl by the May 21. 1976 55-6 PAGENO="0805" 801 UNITED STATES NUCLEAR REGULATORY COMMISSION RULES and REGULATIONS TITLE 10, CHAPTER 1. CODE OF FEDERAL REGULATIONS-ENERGY [~A~i1 1 ~ 39 FR 35571 Feblished 10/15/74 Coexeent Period expires 11/29/74 Pseeeenxtio,s ofReco~-d.e;MdxeeesoeceRe- qott~JorLicexsees eedAppticanex See Fart 20 Proposed RuleMaking. OPERATORS'LICENSES PROPOSED RULE MAKING 55-7 April 30,1975 PAGENO="0806" Unit 1 Staff Recommends Approval Approval_______________ Date_______ Cognizant Oept. Head Unit 2 Staff Recommends Approval Approval________________ Date Cognizant Dept. Head Unit 1 PORC Recommends Approval Date_____ ` PORC comments of (date) Date_________ Unit 2 PORC Recommends Approval ~ ~ Date_____ j/~Chairm~nofP0RC PORC comments of__~~~ included (data) By__________________________ Date_________ Approva1_~~ Date______ Approval 4 2'~ ~ DateL~,//~/177 Hgr., Get. ual 1 Assurance tation Superantenden UnitSuperinrencfent TM - 11~ (~7 1-: -:»=~-~~~._ ~ 802 1012 Revision 8 11/04/77 ENC. 3 THREE MILE ISLAND NUCLEAR STATION MASTER COPY STATION ADMINISTRATIVE PROCEDURE 1012 SHIFT RELIEF AND LOG ENTRIES DO NOT REMOVE Table of Effective Pages CONTROLLED COPY Date Revision ~ Date Revision ~ Date Revision 1.0 08/11/75 3 2.0 11/04/77 8 2.1 11/04/77 8 3.0 01/12/77 6 4.0 08/11/75 3 5.0 08/11/75 3 6.0 03/11/75 3 7.0 08/11/75 3 8.0 08/11/75 3 9.0 11/16/76 5 10.0 06/20/77 7 11.0 06/20/77 7 PAGENO="0807" 803 08/11/75 Revision 3 THREE MILE ISLAND NUCLEAR STATION ADMINISTRATIVE PROCEDURE #1012 SHIFT RELIEF AND LOG ENTRIES Table of Contents 1.0 GENERAL 1.1 Purpose 1.2 Scope 1.3 References 2.0 RESPONSIBILITIES 2.1 Station Superintendent/Unit Superintendent 2.2 Supervisor of Operations 2.3 Shift Supervisor/Shift Foreman 2.4 Control Room Operator 2.5 Supervisor-Quality Control 3.0 REQUIREMENTS 3.1 General 3.2 Hourly Log 3.3 Control Room Log 3.4 Control Room Log Prior to Initial Criticality 3.5 Shift Foreman Log 3.6 Radio Log 3.7 Shift Relief 1.0 PAGENO="0808" 804 1012 Revision 8 11/04/77 1.0 GENERAL 1.1 Purpose This procedure establishes the requirements for shift relief and for recording station operating activities in logs or other controlled documents on a shift basis. 1.2 Scope This procedure outlines the responsibilities of the on-duty and the on-coming shift personnel during shift relief. It also describes the various shift records and logs involved and the instructions required to maintain these records to conform to Technical Specifications and to assure the adherence to the requirements of FSAR. 1.3 References a. Metropolitan Edison Technical Specification Section 6.5. b. Appendix A, N.R.C. Safety Guide 33, Section A. c. F.S.A.R. Volume 4 - 12 - 10 (Unit 1), 11, 12, 13 (Unit 2) d. Hourly Log (Form 3042379) e. Control Room Log f. Shift Foreman Log g. Radio Log - Form 00:4-ME h. Met-Ed Co.'s Operating Instructions & Procedures applying to the use of the Mobile Radio System. 2.0 RESPONSIBILITIES 2.1 The Station/Unit Superintendent shall be responsible for the implementation of the recording of all data relative to the testing and operational status of the ThI Nuclear Station. 2.0 PAGENO="0809" 805 1012 Revision 8 11/04/77 2.2 The Supervisor of Operations shall be responsible for the review, approval and storage of the logs and records; The supervisor of Operations (or his designee) shall review the 2.1 PAGENO="0810" 806 1012 Revision 6 01/12/77 Control Room Logand the Shift-Foreman's Log a minimum of once per week and document the-review by initials or signature. The Supervisor of Operations shall institute action where necessary to correct any deficiencies in the recording techniques or significant operating abnormalities adverse to quality and determine the cause of such significant operating abnormalities which have occurred since his last review of the shift foreman's log. Significant abnormalities are defined as plant conditions which have potential for affecting the health and safety of the public. 2.3 The Shift Foreman shall be responsible for the review and sign off of the Shift Foreman's Log at the completion of each shift. He shall also make all the detailed entries in the Shift Foreman's Log. 2 4 The Control Room Operator shall be responsible for maintaining and signing off the Control Room Log. The control room operator shall be responsible for maintaining the Radio Log. (per par. 3.6). 2.5 The Supervisor-Quality Control shall be responsible for the surveillance and audit of all the subject documents. 3.0 REQUIREMENTS 3.1 General 3.1.1 Shift records are defined as Hourly Log, Control Room Log, Shift Foreman Log, Check off Lists, Recorder Charts and Computer Printouts that .describe or record operating information and events. *These records comprise the information that is necessary for evaluating operations or for analysis of previous operations. - 3.0 PAGENO="0811" 807 * ~0l2 08/11/75 Revision 3 3.1.2 All log entries, reports, chart notations, etc., must be legible, a~curate, understandable and written in ink. 3.1.3 Upon assuming the duty, the operator(s) will record the time and date and make the appropriate notation indicating his knowledge of the plant status, e.g. a. Hot Shutdown - as before b. Cold Shutdown - as before c. At Power - as before d. Hot Standby - as before 3.1.4 All log entries shall be prefaced (in the left hand margin) with the time of entry in (24) twenty-four hour notation (e.g.-0800, 1300, 2400, etc.). 3.1.5, The individual responsible for maintaining logs must sign and date the portion or portions of the log which cover their shift assignment. 3.1.6 Upon completion of the duty, the operator will sign the log. 3.1.7 Each recording instrument shall be checked on the 11 to 7 shift for correct timing and legibility of marking. 3.1.8 Each chart shall be marked with the date, time, and instrument recorder name when replacing the chart paper. In addition, the variable speed recorder charts shall be marked to indicate any change in the chart speed. 4.0 PAGENO="0812" 08/11/75 Revision 3 3.1.9 If it becomes necessary to make any corrections whatsoever in the various logs, erasing is prohibited. A single line will be drawn through the incorrect information and the corrected information shall be recorded adjacent to or in a space available with reference to the deleted information. The individual making the entry shall initial the lined out information. Log This log will reflect plant parameters on an hourly basis. It will normally be prepared by the plant computer but can be manually prepared by the control room operator in the event that the computer is not functioning. If manual preparation is necessary it will be performed by the control room operators and auxiliary operators. Room Log This a. b. log will contain the following types of information: Information concerning reactivity. Alarms pertaining to reactor core conditions with detailed explanation. c. Any abnormal condition of operation. d. Releases of radioactive waste, gaseous or liquid. This log is an official document required by F.S.A.R. and cannot be removed from the Control Room unless authorized by the Supervisor of Operations. 808 3.2 Hourly 3.2.1 3.3 Control 3.3.1 5.0 PAGENO="0813" 809 08/11/75 gp ]012 Revision 3 3.3.2 The 11 to 7 shift shall initiate their Control Room Operator's Log on a new page. It shall be prefaced with a brief description of the plant status, e.g. a. At (80) Eighty Percent Power - MWT-/MWE b. Rod Positions c. Statements regarding unusual evolutions or alignments. d. The following equipment is out of service (list). 3.3.3 All alarms that involve reactor core conditions shall be recorded by the operator along with an explanation:or reason for the alarm e.g. Tave, Reactor Coolant System, pressure, flow, or power. 3.3.4 All reactor startups - record time, Tave, rod positions, primary pressure and boron concentrations (all normally taken at lO8 amps on the Intermediate Range). 3.3.5 Reactor Shutdown - Record rod position, Tave, time, Boron Concentration and reactor power prior to inserting rods for shutdown. 3.3.6 Plant Startup - Record the major events and time of occurrence, e.g., starting RCP's, starting turbine warmup, etc.. 3.3.7 Plant Shutdown - Record the major steps in shutdown and the associated times. 3.3.8 Each system startup, significant status changes, and shutdowns shall be recorded. Also, record major 6.0 PAGENO="0814" 810 ~AP 1012 08/11/75 Revision 3 unit status changes such as opening of primary system, flooding of fuel transfer canal, etc. and the time of the event. 3.3.9 Equipment Malfunction - List the equipment and problem and any restriction placed on the plant. 3.3.10 Abnormal operation - Record any condition that causes principle primary or secondary parameters variation from normal. 3.3.11 Reactivity Changes - Reco~-d the addition or dilution of RCS Boron Concentration, assignment of rods to different groups, power changes, etc. 3.3.12 Reactor Trip & Turbine Trip - Record the conditions prior to the trip, cause of trip (if determined), corrective action taken and time of the events. 3.3.13 All significant power level changes in the power range shall be recorded. 3.3.14 Start and stop of any radioactive gaseous or liquid releases shall be recorded in the Control Room Log along with the release permit number. 3.3.15 Any abnormal valve line ups and equipment out of service, or returned to service shall be recorded. 3.3.16 Changes of position of any `defeat', or "by-pass" switches shall be recorded. 3.3.17 Accomplishment of testing - Record title and number of the test performed, and the start and completion times or time of suspension of the test. The perfor- mance of all periodic tests and inspections required by the Technical Specifications shall be recorded. 7.0 PAGENO="0815" 811 ~O8/11/75 AP 1012 Revision 3 3.3.18 The above sections are not meant to.be all inclusive but merely indicates the type of entries that should be made. When doubt exists, enter it in the log. 3.4 Control:Room Log Prior to Initial Criticality The following operations shall be recorded by the control room operator. 3.4.1 Execution of switching orders - Record order number and time as indicated on the switching order. 3.4.2 Placing equipment out of service or returning equipment to service Log the name and alphanumeric designator of the equipment, time of shutdown or return to service and reasons for shutdown or nature of work completed. 3.4.3 Accomplishing Test Function - Record the test number, title and time the test was started and completed. 3.4.4 Operating systems under direction of startup - List the system with a brief description, e.g., Jogging S.R. valves SR-V-2 and SR-V-6 for position indication checks. 3.4.5 Major Plant Status Changes - e.g., Filled C.W. Basin for Tower 1A, Filled Borated Water Storage Tank, De- Energized D.E.S. 4160 Bus, etc., also record the time of the event. 3.4.6 Completion and Turnover of Systems - e.g., Acceptance of a system by Met-Ed - Record the date with a description of the System and Systems' Boundaries. 8.0 PAGENO="0816" 812 1012 Revision 5 11/16/76 3.5 Shift Foreman Log 3.5.1 This log will contain a summary of the station operation and major events that occur on each shift. Significant abnormalities which occur will be explained in greater detail than would be expected in the control room log. 3.5.2 The left hand side of the log should be reserved for changes in status of E.S. components, and major plant status changes at the discretion of the Shift Foreman. 3.5.3 When equipment covered by Tech Specs. is taken out of service, the reason, time, Tech. Spec. requirements and sample results (if applicable) will be noted on the left hand pageof the Shift Foreman's Log. Additionally, all requirements for running, sampling and/or testing will also be noted, delineating times, when above must be accomplished. (i.e.) 7/31/75 1100. Ran SP #1303-4.16 on 18 Diesel generator to prove its operability, removed 1A DG from service for oil ring inspection and repair. lB DG must be tested daily until 1A DG is returned to service. 8/1/75 1100. Tested lA DG in accordance with SP #1303-4.16. Test satisfactory. When the equipment is returned to service the time/date shall also be noted on the left hand page of the S.F. Log. 9.0 PAGENO="0817" 813 1012 Revision 7 06/20/77 3.5.4 Upon assuming the duty the Shift Foreman shall record in his log the plant conditions ~hich exist. a. Temperature (RCS) b. Pressure (RCS) c. Boron Concentration (RCS) d. MWe Net e. Rx Power f. Control Rod Positions 3.5.5 Upon being releived the Shift Foreman will, note that fact along with the time and sign his section of the log. 3.6 Radio Log 3.6.1 This log will contain the data which must be recorded to meet the requirements of the (FCC) Federal Communications Commissions Rules and Regulations, such as (1) Log any contact with another base station and (2) Log entry made and signed by technician performing maintenance on the radio unit. 3.7 Shift Relief , 3.7.1 All shift operations personnel shall be responsible for maintaining their duty station until properly relieved. The Shift Supervisor, Shift Foreman, Control Room Operators and Auxiliary Operators shall be relieved by qualified personnel only, e.g. those personnel who are properly licensed and properly informed of the plant status, operations in progress, and any special instructions which may be applicable. The relieving individual will discuss the plant status, operations in progress and special instructions with on-duty personnel so that he is adequately informed prior to assuming his shift duties. 10.0 48-721 0 - 79 - 52 PAGENO="0818" 814 1012 Revision 06/20/77 3~7.2 The Control Room Operator will acknowledge his understanding and awareness of the changes in the plant status since his own last entry by signing the Control Room Log prior to assuming the shift duty. 3.7.3 During his shift the relieving individual shall insure adquate review of station logs, records, special instructions, etc., which have been generated since his last shift. The logs and records to be reviewed should include: 1. Shift Foreman Log 2. Control Room Log 3. Hourly Computer Log 4. Tagging Application Book 5. Equipment and Fuel Status Boards 6. TCN and SOP Books 7. Standing Order Book 8. Operations Memo Book 9. F~reventative Maintenance Schedule Books 10. Revision Review Book 11.0 PAGENO="0819" 815 Herr#an Dieckanip PresdeEt AUG 1 U 1919 GENERAL 260 Cherry Hill Road PUBLIC Parsippany New Jersey 07054 UTIUTIES 201 263-4900 - CORPORATION August 7, 1979 The Honorable John W. Wydler I~oom 2308 Rayburn House Office Building Wabhington, D. C. 20515 Dear Congressman Wydler: * In response to your letter of July 31, I am enclosing a copy of the answers to questions trans- mitted to us by Congressman McCormack in mid-June. Your specific questions concerning Control Room occupancy is addressed in the answer to Question 10 on pages 6, 7 and 8 of the enclosure. If I can be of any further help, please feel free to contact me. mck Enclosure Jersey Central Power & Light Company/Metropolitan Edison Company/Pennsylvania Electric Company PAGENO="0820" 816 ANSWERS TO QUESTIONS BY THE SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION HEARINGS ON NUCLEAR POWER PLANT SAFETY Q - 1. Wou.~ there beany advantages in standardizing the design of nuclear power plants? A - While significant NSSS standardization does exist, it is our view *that further industry-wide efforts to standardize nuclear plants would be desirable. Standardization would be beneficial to the maturation of the technology and to the assessment of reliability and effective- ness of safety systems. The process of learning through the feedback of operating experience can be greatly aided if there exists a minimum of uncertainty about the applicability of the experience because of equipment and design differences. However, achievement of this objective requires a discipline in the licensing process so that changing regulatory requirements do not eliminate the possibility of design uniformity. Since experience will always lead. to the need for design modification for purposes of plant reliability or safety, a standardization program must be accomplished under a licensing program which would approve a block of plants. When the experience is sufficient to justify changes of true net benefit, the criteria for the next block of plants would be changed. The SNUPPS plants are certainly evidence, of interest in and support for plant standardization. - PAGENO="0821" 817 In the narrower context of the nuclear steam supply (NSS) and critical safety systess, a significant degree of standardization ha~ already occurred by each nuclear steas supply vendor. All B&W-177 plants, typi- fied by TMI-2, have very similar nuclear systess. Nuclear steam supply systems offered by all vendors offer a considerable degree of standardiza- tion within each of their' product lines. It should be noted that many design features of a power plant relate to the particular site or to the environment in which the plant operates. The type of heat sink can dictate many features of the plant secondary system and equipment selection which are critical to many aspects of the power plant design. Beyond this, the NRC policy has encouraged standardization and the supply industry has responded with "standard" designs. The implementation of this policy has been very difficult by virtue of the tendency to continually seek "improvements" during regulatory review. Certainly improvements of significance should not be overlooked. But, there needs to be a more critical assessment of the true value of intended improvements in relation- ship to the extra complexity and unstandardization they can also produce. The movement toward standard designs has, however, been thwarted by the absence of sales. It is also my firm belief that future standardization would greatly reduce the lead time for nuclear plants not only for licensing but also for construction and that it would significantly reduce construction cost. PAGENO="0822" 818 3. Q - 2. Is there any need fot a "Swat Team" composed of people from industry, the utilities, NRC, etc.? A - The concept of a "Swat Team" which is assumed to mean a trained and ava~able pool of resources to assist in a major nuclear incident, would be desirable. In our view, such a team would not have to represent a dedicated full-time capability, but rather could be a team rapidly formed from members of the utility and nuclear industry and the NRC. The essentials for effective implementation would include: a. An identification of anticipated skill requirements and the source of those skills by company and name. b. A pre-defined and thoroughly understood management structure including lines of authority and responsibility. c. A definition of how the team is to be assembled and supported. d. An inventory of critical materials and equipment. Q - 3. Should there be a standard design for control rooms and for the layout of control room instrument and control panels? A - It is our opinion that significant improvements can be made in overall control room design. Some of these improvements could take the form of future standardization for example, of the meaning of red and green indication lights, etc. However, a much more important aspect of the overall control room design is the human engineering or instrumentation! operator interface. Information could be displayed to the operator in a more meaningful form; the information display systems must have * priority assignments built in to assure critical data is made available to the Operator, without the Operator being submerged in information of secondary or of a relative unimportant nature. The use of more advanced computer and digital display and control techniques should be expanded. PAGENO="0823" 819 We believe this general area is probably one of the most critical, and deserving of overall industry attention. A. higher degree of standardization could be beneficial in enabling increased and more effective simulator use. Q - 4. Should the control room operators or supervisors be employed by the utility or by some other agency? A - From the perspective of nuclear power plant safety, the control room operators cannot be separated from overall plant operations. An organizational interface would be difficult to unambiguously define and could be counter productive to safety. The Important consideration is that the operators have the proper technical and educational background, that they are thoroughly trained in the design and operating characteristics of that particular plant and that they are completely familiar with plant and operating ~roced- ures and they. perform In a highly disciplined way. To achieve this high level of performance, there must be properly cotisidered operator selection criteria, continuous training, and thorough and effective evaluation. Q - 5. In your opinion, what was the cause of the onset of the Three Mile Island accident? A - The cause of the onset of the TMI-2 accident was unquestionably the failure of the power operator relief valve (PORV) on the primary system pressurizer. While the overall turbine and reactor system ~trip" was triggered by a signal from the feed system, the plant is designed to handle these trips and would.have done so in this case routinely except for the failure of the PORV. PAGENO="0824" 820 Q - 6. It appears that sotneof the events at TMI took place very rapidly. Is this indicative of inadequate thermal capacity in the cooling and heat - transfer systems? A - We do not consider the rate at which the transient developed at TMI-2 to have been unusually rapid. From studying the incident and the dynamics of the plant response, we do not believe that any reasonable increase in the thermal capacity of the cooling systems would have had any bearing on the end result, given the same equipment failure and operator actions. Q - 7. Please comment on the following statement from the testimony of another witness "From the viewpoint of nuclear power plant-safety design, two principal technical elements are involved in DII. The most important is that the plant was configured so that the pressure relief valve on the primary coolant system opened very often due to events such as a failure of normal feedwater flow to the reactor." A - The TMI-2 plant is configured so that on certain plant trips the reactor primary system pressure does cause the power operated relief valve to - open. This was originally done in the design to minimize reactor "scrams" and allow a much more rapid plant recovery from secondary system trips. While in this case subsequent failure of the power - operator relief valve was a major ingredient of the incident, from a much broader perspective the key question is the assurance of satis- factory performance of all critical equipment within the plant. We believe a very important part of the plant design be focused on critical components and that there be adequate engineering, development, and test programs to verify component performance and reliability. PAGENO="0825" 821 Q - 8. The testimony indicates that there are emergency procedures to assist the control room operator in analyzing the instrument readings. Who produced this analysis? Please send us a copy of this procedure and the analysis? A - There is a written response which details the follow-up action for each of the appro~imately i200 alarms in the Unit 2 control room. Each alarm has its individual procedure. Additionally, each of the emergency procedures contains a listing of the anticipated alarms for the condition. The emergency procedure contains the appropriate corrective action for the condition. These procedures were prepared by site engineers and consultants reviewed by the Plant Operation Review Committee and approved by the Unit Superintendent. We have not included this material. because of its bulk but it will be supplied if the committee wishes. Q - 9. Provide a schematic description of the operation of the Condensate Polishing System including the means of ensuring adequate redundancy. A - Enclosed is a system description and a schematic diagram of the Conden- sate Polishing System. Since the Condensate Polishing System is not a safety system its design does not include complete redundancy. However, there are eight condensate polishing tanks in the system and only seven are required for normal operation. This allows one. tank to be removed from service for maintenance or recharging without affecting system operation. - 10. Is it correct that there were about sixty people in the control room during the early stages of the accident? Are there any operating procedures which should have prevented this congestion? Provide a list of those present. PAGENO="0826" 822 7. A - During the early stages of the accident the number of people in the control room changed from hour to hour. The following is a breakdown for the first few hours of the accident. a) 0400-0500 - The number of people varied from three (3) people at 0400 to about eight (8) people by 0500. These consisted of the operating shift in the control room, Auxiliary operators that came to the control room as needed, and three support people from Unit I. 1) Bill Zewe - Shift Supervisor 2) Fred Schiemann - Shift Foreman 3) Ed Frederick - ontrol Room Operator 4) Craig Faust - Control Room Operator 5) Ken Bryan - Shift Supervisor 6) George Kunder - Unit 2 Superintendent Technical Support 7) Various aux. operators in and out 8) Scott Wilkeraon - Nuclear Engineer 9) Kevin Narkless - Nuclear Engineer b) 0500-0600 - The above mentioned people were joined in Control room by additional personnel. 1) Walter Marshall - Ops Engineer 2) DougWeaver - I&C Foreman 3) Joe Logan - Unit II Superintendent Total people in Control Room during this time numbered less than twelve (12). PAGENO="0827" 823 c) 0600-0645 - During this period more peopie were arriving including the remainder of the scheduled shift personnel. The total number of people was about 20. 1) Mike Ross - Supervisor of OPS Unit I 2) Brian Mehler - Shift Supervisor 3) A~ciam Miller - Shift Foreman 4) Carl Cuthrie - Shift Foreman d) After 0645 - After this period a site emergency was declared and the total number of people in control room rose to about 25 people. A number of the people, listed above, thatwere in the control room at this time were there as a result of being called to provide assistance. At times later in the day the number of people increased in the control room to about 60 people largely because of the evacuation of the Emergency Control Station (ECS) from Unit I Control Room due to air borne activity, and establishing ECS in Unit II Control Room. Use of the Control Room as an ECS and the resulting activity was clearly separate from the plant operations and did not hinder in any way control of the plant. * We do not have operating procedures that limit congestion in the Control Room but we do have clearly defined areas in the Control Room where personnel may go only with permission o~ the Duty Operations Group. There are large red signs overhead and yellow lines on the floor to indicate these areas, and the Shift Supervisor strictly enforced these areas during and following the accident. PAGENO="0828" 824 Q - 11. We gather that it was nearly three hours after the accident before the plant operators recognized that they had a major problem on their hands. Please explain this. A - The~perators knew they had an unusual problem early into the event because of the high pressurizer level and low RCS pressure. During the periodthe operators were responding to their indications and taking action to place the plant in a stable condition. Two hours and 45 minutes into the event high radiation alarms were received. At this time the radiation level began to exceed the pre established level for the declaration of a "site emergency". Q - 12. What type of audio device was used to listen to the steam generators? Would television cameras, at appropriate locations, have been of any benefit? A - Audio Monitors used to listen to the steam generators were: a. Loose Parts Monitor channel ~5 "Steam Generator A Upper tube sheet East." b. Main steam relief valve noise monitor. Television cameras would have been of no use as far as the steam generators are concerned. Q - 13. Why did the control room operators put-on protective masks? At what time did they put on these masks? Why did the masks donned by the operators make communications difficult? What type of communications system is used by the operators when they are wearing masks? A - The control room personnel put on particulate protective masks when the air borne activity in the control room reached 1 x j~8 uCi/cc. * PAGENO="0829" 825 10. Communication is more difficult in masks because they are not equipped with a speaking diaphram or another means of good clear speech transmis- sion. Wh~e wearing masks the personnel communicated with each other - face to face, and communicated by telephone. While using masks personnel speak slowly and loudly to insure they are understood. Even with the masks, communication was not seriously impeded. Q - 14. The testimony indicates that the valves .for the auxiliary feedwater system were both closed about two days prior to the accident; is this correct? What was the exaci time that they were closed, and what was the exact reason for closing them? A - The auxiliary feedwater valves EF-V12A and B were found closed at about eight (8) minutes into the event. At this time we are unable to document when these valves were shut. However, the EF-V12A and B valves were shut about 42 hrs. before the event during a scheduled surveillance test performed on the emergency feed system. The operators involved have testified that they returned these valves to the open position at the completion of the test. Q - 15. Is closure of both valves supposed to take place only when the plant is shut down? A - The closure of both EF-V12A and B in performance of the Surveillance test was in accordance with an approved- procedure which was not restrict- ed to periods when the plant was shut down. PAGENO="0830" 826 11. Q - 16. The testimony indicates three actions taken by the control operator(s): a. He Cut back on the high pressure injection to maintain the pressur- izer level. Was this the right thing to do? b. He turned off the two pumps in the "B" loop at 73 minutes into the accident. Was this a reasonable thing to do? c. At 100 minutes into the accident the operator turned on the two - pumps in the "A' loop. Was this a reasonable action? Specify why these actions were taken. Specify who performed each Specify who authorized each action. (a) A control room operator cut back on high pressure injection flow to try and maintain pressurizer level. The operators were-trained to respond to maintaining pressurizer level, to insure it does not go empty nor completely full. The operator was using approved procedures and respónding to the indications available to him. The operator under direction of the shift foreman cut back on high pressure injection. The shift supervisor agreed to this action. (b) The control room operator turned off lB and 2B reactor coolant pumps under the direction of the Shift Supervisor because of excessive RCP vibratioh, reduced and oscillating Reactor coolant flow and fluctuating amperes on the running RCI"S. Securing RCP'S would preclude severe pumps and motor damage. PAGENO="0831" 827 12. (c) Answer is same as (b) above for tripping of IA and 2A RCP. The plan was to rely on natural circulation to provide flow through the RCS. Q - 17. Des~ribe in detail how your company contacted or alerted NRC about the accident. Provide a detailed chronology of these actions together with a list of pe~ple involved in the decision to contact NRC. Did you have difficulty in contacting NRC? March 28, 1979 0400 Turbine trip followed by a reactor trip. 0445-0705 Senior station personnel are called at home and arrive at the site. 0650 Radiation monitors in auxiliary building and the reactor (approx.) building dome monitor escalated quickly to alert ranges. * 0655 Senior personnel in the Unit 2 Control Room (J. Logan - Unit Superintendent, G. Kunder - Unit Superintendent - Technical Support, W. Zewe - Shift Supervisor) briefly discussed the situation andreached rapid agreement that a Site Emergency was in effect. Mr. Zewe announced the Site Emergency and started the notifications required by procedure. (See Enclosure (1)). 0702 Pennsylvania Emergency Management Agency (State Civil Defense) notified. * 0704 NRC Region I notified. The answering service was contacted and directed to get in-touch with the duty officer. 0720 Remaining notification complete, PAGENO="0832" 828 13. 0724 General' Emergency declared. This decision was made by the Station Superintendent (Gary Miller) based on the reactor building dome monitor, reaching 8 Rem/hr., one of the specific criteria requiring a General Emergency declaration. * 0750 NRC Region I called the TMI-2 Control Room and established an open phone line. * NRC' notification was required by procedure after a Site Emergency declara- tion. Since NRC notification occurred before normal working hours, the. NRC duty officer was not in the office and had to be contacted to return the call. Q - 18. Provide' a detailed description of the maintenance work being performed prior to the accident. This should include, but not be limited to, a description of the ~~ork being done on the condensate polishing unit at 0400 on March 28, 1979. Was all of this work normal maintenance work? Was the work done in accordance with B&W maintenance instructions? Provide a chronology of the work and a list of those who did it. A - Work being done at condensate polishers at 0400 on March 28. Number 7 polisher resin was being transferred to the regeneration receiving tank. This is a part of normal operating procedure for regeneration of the system and is not considered maintenance. Resin was clogged in the transfer lime and operator Don Miller and Shift Foreman Fred Schiemann were trying to free the clogged transfer line. This system is not part of the B & W scope. The transfer is done with demineralized water. Service air is applied periodically to keep the resin swirling in the vessel. It is believed PAGENO="0833" 829 14. that the water, under higher pressure than the air, backed up through the service air sys'~em and got into the instrument air system and causing a loss of signal air to fail closed the condensate polish outlet valves. This resulted in total loss of feedwater, which caused the sul.*equent turbine trip. Other Shift Maintenace work: Shift Mainten"ance Foreman: Electrical - `K. Ebersole - L. Cisney Q - 19. Provide a detailed description of your operator training programs. Provide the "Pass-Fail" grades of the operators on duty during the period of the accident, and for the prior 48 hours. A - Operators at nuclear power plants are licensed by the NRC as reactor operators (RO) or as senior reactor operators (SRO) for each individual reactor. Licensed operators undergo both NRC administered tests and Company administered tests. Initial licensing as either an RO or SRO requires NRC examinations. Every TMI-2 operator listed in the table below passed the NRC examinations for RO and SRO the first time they were administered. NRC also requires that licensed operators undergo requalification examinations administered by the Company every two years. Net-Ed actually administers these requalificatiön exams every ~. No operator listed below has failed an annual requalification examination. A number of TNT 5R0's are licensed on both Units 1 and 2. Licensed SRO'sdenoted in the table byan asterisk, first held SEQ licenses on Unit 1. In those cases, the NRC approved and audited a cross-license C. Leakway Troubleshooting electrical controls of Unit 2 Condenser Cleaning System. 48-721 0 - 79 - 53 PAGENO="0834" 83O~ 15. training program and Met-Ed administered "cross-license' examination prior to amsiending the individuals' license to include Unit 2. In one case (noted by a double asterisk) the individual first held an RO license on Unit 1. He. then took the NRC SRO examination for Unit 2 and upon passing, was licensed by NRC as an SRO on both Units 1 and 2. The detailed description of our operator training program is attached as Enclosure',(2). The following table gives data on licensing of operators who were on duty during the period of the accident, and for the prior 48 hours. Unit 2 Control Room Operators (RO License) NRC License E. Frederick 10/19/77 C. Faust 10/20/77 I. Illjes 10/19/77 .7. Kidwell 6/23/78 N. Cooper 7/5/78 .7. Congdon 10/19/77 H. McGovern 12/6/78 E. Hemmila 12/6/78 C. Nell Awaiting results of NRC Exam L. Germer Not licensed - CR0 in training 1978 (March) Requal. Exam Unit 1 / Unit 2 2 3 NA/MR NA/MR NA/NR NA/NA NA/NA NA/MR NA/NA NA/NA 1979 (February) Requal. Exam Unit 1 / Unit 2 NA/Passed NA/Passed NA/Passed NA/Passed NA/Passed NA/Passed NA/HR NA/HR Senior Operators (SRO License) W. Conaway (RO) 10/19/77, (SRO) ~ Guthrie F. Scheimann (RO) 10/19/77, (SRO) **B, Nehier *J. Chwastyk *%q~ Zewe *K. Bryan 5/3/78 NA/HR NA/Passed 11/9/79 Passed/HR passed/Passed 5/3/78 HA/HR NA/Passed 10/19/77 Passed/HR passed/Passed 11/9/77 Passed/MR passed/Passed 11/9/77 Passed/HR passed/Passed 11/9/78 Passed/HA passed/HR PAGENO="0835" 831 16. 1 Date initially licensed on Unit 2 based either on NRC examination or Company cross-license examination. 2 Not Applicable - individual does not hold license on this Unit. 3 Not Required - Annual requalification examination by Company not required when scheduled within first six months following NRC licensing. Q - 20. What necessitated this maintenance work; that is, was it an emergency, or routine? ~Tad similar maintenance work been performed on this unit before? If so, how often? A - The maintenance being performed prior to the accident other than that discussed in 18 was routine. Troubleshooting electrical controls of the Condenser Cleaning System is performed routinely, about once in each, one/two month period or as required for a specific problem. Q - 21. How many condensata polishing units are there on Reactor No. 2 at ThI? If more than one, were they both (all) undergoing maintenance at the time the accident was initiated? A - Unit II has 8 condensate polishers. Only one was in the process of having resin transferred to the receiving tank. Transfer of exhausted resin is part of the normal operating procedure required for regener- ation of the units and is not considered maintenance. Q - 22. How many condensate polishing units are required to sustain normal plant operation? A - Normally 7 polishing units are used during operation at full power while the 8th vessel is in standby. Q - 23. Specifically, what occurred on or before 0400 on March 28, 1979 that caused a reduction in net positive suction head to the feedwater pumps? What human errors were made; what components failed? Was there a pipe blockage and if so, what blocked the pipe and why did it occur? PAGENO="0836" 832 17. A - At 0400 on March 28, 1979, net positive suction head on the feedwater pumps was lost because the condensate booster pump tripped. The condensate booster pump trip occurred as a result of the condensate polisher outlet valves closing, interrupting flow to the condensate booster pumps. Valve closure was caused by loss of control air to the condensate polisher outlet valve positioner, which automatically signals the valve to close. We cannot at this tine positively identify the cause of the air failure to the valve positioner. A probable cause may have been water Induction to the air system while operations were being conducted to clear a pipe blockage in a resin transfer line. The resin transfer line is not part of the condensate flow path. Because of the resin transfer line blockage, both the fluffing valves and the water sluice valve on the polisher were open for some periods of time which could have admitted some water to the station and instrument air supply system through a leaking check valve. On tests conducted in the plant subsequent to the incident, we have not been able to reproduce condensate outlet valve closure on flooding the instrument air supply to the condensate polisher. Q - 24. Was any other plant equipcent involved in the initIation of the accident and if so, what equipment and what was the nature of the contribution? A We do not consider the equipcent identified in answer to question 23 as being part of the initiation of the incident. As previously mentioned, the plant is designed to accommodate loss of feedwater flow. The 1111-2 accident was a result of the failure of the P01W to close on low primary system pressure. PAGENO="0837" 833 18. Q - 25. Considering normal operations at Plant No. ~ TNt and assuming 80% power with no systems (either operating systems or back-up systems) undergoing maintenance or test or otherwise inactivated, how many lights on the control panel would be red? If any, what equipment would they relate to and what would be the significance of the red indication as opposed to green? A - Under normal operating conditions there are about five hundred fifty red lights in the Control Room. The significance of red vs. green depends upon its use. a. For a valve - red indicates open and green means closed. b. For a motor - red means running and green means off. c. For a breaker - red means closed arid green means open. d. For lOIS - red light means high alarm. e. For control rod position - red light means control rod position is at full out position. f. On the IC.3 - red means automatic. The significance of an amber light. a. For a breaker or motor control - amber light means disagreement between breaker position and control switch. b. For lOIS - amber light means alert alarm. c. For control rod position - amber light means the rod is out of alignment with its group average. The significance of a white light. a. Indication of power available. b. On the ICS white means manual. Q - 26. Are there definite written procedures which define specific reasons or conditions upon which the reactor would be shut down manually. Do PAGENO="0838" 834 19. these conditions include maintenance of äertain equipment? If so, what equipment is included? A - There is no procedure which defines specific reasons or conditions upon which the reactor would be shut down manually. However, the technical specifications list the minimum amount of equipment in various safety systems that must be operational for continued operation of the reactor plant. Where these minimums cannot be met within the required time the reactor is s'nutdown manually in accordance with Procedure 2102-3.1 - Unit Shutdown. Additionally, Administrative Procedure - Organization and Chain of Command gives the authority to the Control Room Operator to manually shut the unit down for any condition he deems necessary. Q - 27. Why were the auxiliary or emergency feed systems subjected to surveil- lance tests twelve times in the first quarter of 1979? List the reasons together with the dates and the result of the tests. Was the last test on these systems 42 hours before the day shift on the morning of March 28? A - Technical Specification 4.7.1.2.a requires that each of Unit 2's 3 emergency feedwater pumps . . . shall be demonstrated operable at least once per 31 days on a staggered test basis." Surveillance test 2303- MO4A/E which complies with 4.7.1.2.a, must be performed nine times during the 3-month period in question, once each month for each emergency feedwater pump, EF-Pi, EF-P2A, and EF-P21 to meet this technical specification. Technical Specification 4.O.5.a, as required by Sec. II, ASME Code, states that ASME Code Class 1, 2, and 3 valves in this system be tested at least quarterly, and that the pumps (EF-P2A, EF-P2B) be tested each month. Valve test 2303-M27A must be perfbrmed at least once during the quarter, and the pump test 2303-M27B, must be run three times, once each month in order to comply with technical specification 4.O.5.a. PAGENO="0839" 835 20. Requires Surveillance To be Technical Specification Test Number period performed during this a total of... 4.7.1.2.a !303_M14A* 1 time 4.7.1.2.a 2303_M14B* 1 time 4.7.1.2.a 2303_M14C* 1 time 4.7.1.2.~ 2303-N14D 3 times 4.7.1.2.a 2303-M14E 3 times 4.0.5.a . 2303~N27A* 1 time 4.0.5.a 2303_N27B* 3 times *Require closure of EF-V12 A/B Test Name Date Performed Results Reasons Performed 2303-M14A 01-30-79 Performed Satisfactorily Required by 4.7.l.2.a 2303-N14B 01-30-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M14C 03-09-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M14D 01-23-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M14D 02-20-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M14D 03-19-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M14E 01-04-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-N14E 02-02-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-M145. 03-02-79 Performed Satisfactorily Required by 4.7.1.2.a 2303-N27A 01-03-79 Performed Satisfactorily Required by 4.0.5.a 2303-M27B 01-25-79 Performed Satisfactorily Required by 4.0.5.a 2303-M27B 02-26-79 Performed Satisfactorily Required by 4.0.5.a 2303-M27B 03-26-79 Performed Satisfactorily Required by 4.0.5.a During the period 01-01-79 to 03-28-79, Unit 2 Technical Specifications required tests of the emergency feedwater system to be performed a total of 13 times, an equivalent average of once every 6.69 days. Thirteen tests were in fact performed, each of which met its respective acceptance criteria for satisfactory performance. PAGENO="0840" 836 21. The last test of the system prior to the March 28 accident was conducted on 03-26-79 from about 1000 to 1230. Q - 28. Provide details of the `shift overlap~ prior to the accident. Provide a list of the control room operators, supervisors and others in the control room during the accident period and for the 48 hours prior to th~accident. Shift overlap or shift relief is accomplished by man to man turnover. In the control room the turnover consists of each man going over a written up to date list of normal routine work going on and also any unusual work or any other circumstances worthy of note. Also discussed are any events accomplished on previous shift and any events planned on next shift. List of licensed operators in the Control Room 48 hrs prior to accident. 2300-0700 - 3/26/79 CR0: Edward Frederick CR0: Craig Faust Shift Foreman: Frederick Scheimann Shift Supervisor: William Zewe 0700-1500 - 3/26/79 CR0: Martin V. Cooper CR0: Joseph R. Congdon CR0: Earl jlernmila CR0: Hugh McGovern Shift Foreman: Carl Cuthrie Shift Supervisor: Brian Mehler 1500-2300 - 3/26/79 CEO: John Kidwell CEO: Theodore Illjes. PAGENO="0841" 837 - 22. CR0: Charles Nell Shift Foresan: William Conaway Shift Supervisor; Joseph Chawastyk 2300-0700 - 3/27/79 CR0; Craig Faust CR0: Edward FredCrick Shift Foreman: Frederick Scheimann Shift Supervisor: William Zewe 0700-1500 - 3/27/79 CR0: Earl Hemmila CR0: Hugh McGovern Shift Foreman; Carl Guthrie Shift Supervisor: Brian Mehler 1500-2300 - 3/27/79 CR0: Charles Nell CR0: John Kidwell CR0: Theodore Uljes Shift Foreman: William Conaway Shift Supervisor: Joseph Chawastyk 2300-0700 - 3/28/79 * CR0: Edward Frederick * CR0: Craig Faust Shift Foreman; Frederick Scheitsaun * Shift Supervisor: William Zewe In addition to the licensed operators, ~others are periodically in the control room but no record is kept). PAGENO="0842" PAGENO="0843" NIUCLEARPOWERPLANT SAFETY SYSTEMS THURSDAY, MAY 24, 1979 HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION, COMMITTEE ON SCIENCE AND TECHNOLOGY, Washington, D.C. The committee met, pursuant to notice, at 9:40 a.m., in room 2318, Rayburn House Office Building, Hon. Mike McCormack (chairman of the subcommittee) presiding. Mr. MCCORMACK. Good morning, ladies and gentlemen. Today the Subcommittee on Energy Research and Production concludes this series of hearings on the subject of nuclear powerplant safety. During the first day of these hearings, we discussed the philos- ophy and technology of nuclear powerplant safety systems, receiv- ing testimony from a variety of utility, industry, regulatory, and other witnesses. Yesterday, we discussed the Three Mile Island accident in detail, and heard from the utility who owns the plant, the equipment manufacturer, the Nuclear Regulatory Commission, the Lieutenant Governor of the Commonwealth of Pennsylvania, and the president of the American Nuclear Energy Council. Yester- day's hearings provided a close look at the operation of the Three Mile Island powerplant during the period immediately following the accident. It drew my attention, and the attention of other members of the subcommittee, to the need for improved operating procedures in our nuclear powerplants. The topic for today's hearings is "Perspectives on Nuclear Power- plant Safety," and we are very pleased to have a particularly distinguished group of witnesses from outside the U.S. commercial reactor program. These people will advise the subcommittee on the operating philosophies and safety approaches of several organiza- tions-the U.S. space program, the nuclear submarine program, and a foreign nuclear operation. Our first witness is Dr. Ingmar Tirén, manager of nuclear safety and licensing for the Swedish Reactor Manufacturing Co., ASEA- ATOM. Dr. Tirén will be introduced by Dr. Lars Larsson, who is technical and scientific attaché to the Swedish Embassy here in Washington, D.C. I wish to thank Dr. Tirén for coming from Sweden to give us his testimony. After hearing from Dr. Larsson and Dr. Tirén, we will receive testimony from Dr. George Low, president of Rensselaer Polytech- nic Institute. Prior to becoming president of Rensselaer, Dr. Low was Deputy Administrator of the National Aeronautics and Space Administration, with particular responsibility for the Apollo pro- gram. Dr. Low's testimony will be of special interest because he (839) PAGENO="0844" 840. was responsible for the design of the flight control room and for emergency situation programs in Apollo. Our final witness will be Adm. H. G. Rickover, Deputy Com- mander for Naval Propulsion of the Naval Sea Systems~ Command. Admiral Rickover will describe the Navy's reactor operator train- ing methods, and the means wher.eby the Navy has ensured reactor safety at sea. Before I ask the witnesses to come to the witness table I would like to ask our ranking minority, member, Congressman John Wydler, if he would like to make an opening statement. Mr. WYDLER. Yes. As I stated yesterday, I strongly believe that this accident must become the "Apollo Fire" for the nuclear indus- try. That tragic incident served as a constructive basis for technol- ogy development and improved procedures to enhance spacecraft safety systems. On this theme, Dr. George Low, the former Deputy Administrator of NASA, is a most appropriate witness for the subcommittee this morning. I am looking forward to hearing Dr. Low's philosophy and perspective on safety systems and ways of improving the man/machine interface. I believe that his testimony should be particularly valuable for us in developing legislative initiatives for DOE programs in safety technology. I am also delighted to see our good friend, Adm. Hyman Rickover, head of the naval nuclear propulsion program. Admiral Rickover's single-minded dedication, high standards, and unique managerial approach have produced an outstanding track record for naval nuclear power vessels. His methods for selection and training of nuclear operators is a benchmark of quality at which the nuclear industry should aim. It is also worthwhile pointing out the outstanding low occupational radiation exposure levels which have been achieved in the admiral's program. I am also pleased that we shall hear from the Swedish atomic industry and obtain a different national perspective on nuclear powerplant safety. I have always found on my oversight trips that dialog with other countries on energy issues is extremely valuable. Today, Mr. Chairman, we shall obtain three unique perspectives. I believe we should derive valuable insights from them as to how operating safety systems and procedures and training programs should be improved in the civilian nuclear power sector. We can do nothing short of this since the stakes involved are the future of nuclear power in this country and our ultimate energy indepen- dence. Mr. MCCORMACK. Thank you, Mr. Wydler. Dr. Tirén, Dr. Larsson, welcome. Would you please come to the witness table and make yourselves at home. Without objection, Dr. Tirén, your formal testimony will be in- serted in the record at this point, and you and Dr. Larsson may proceed as you wish. Dr. Larsson, do you wish to start off? [The prepared statement of Dr. Tirén follows:] PAGENO="0845" 841 1979-05-21 IDENTIFYING AREAS OF DEVELOPMENT THAT MIGHT ENHANCE NUCLEAR POWER SAFETY A Swedish Manufacturer's Perspective by Ingmar ~Tirén, AB ASEA-ATOM, VHster&s, Sweden Introduction The nuclear program in Sweden is based on light water reactor power plants. The first unit, Oskars- hamn 1 (440 MWe), was ordered by a private Swedish utility, Oskarshamnsverkets Kraftgrupp AB (0KG) in 1965 and began its commercial full power operation in 1972 (see Figure 1). Since that tine, three different utilities are building nuclear power stations in Sweden. At present, there are six units in operation, corresponding to a net electric rating of 3750 MWe, and six additional plants are in the course of construction. During 1978, nuclear energy contributed about 25% to Sweden's total generation of electrical energy. The Swedish supplier, ASEA-ATOM, has manufactured nine of the twelve plants in Sweden and has also won the contracts for two 660 MWe units for Finland. One of these is now in operation and the other one is in the commissioning phase. PAGENO="0846" 842 ASEA-ATOM is an independent supplier of boiling water (BWR) power plants. There have never been any licensing ties with other pompanies. Two of the BWR plants delivered by ASEA-ATOM are turnkey orders. Figure 2 illustrates the location of the plants in Sweden and Finland. As you can see, all plants are sited on the coast. Three of the four units at Ringhals, built by the Swedish State Power Board, have been delivered by Westinghouse. Thus, ASEA-ATOM, the domestic manufacturer, has no monopoly status in Sweden, but must compete with other companies on the international scene. 2 Licensing Authorities The principal nuclear licensing authorities in Sweden are the Nuclear Power Inspectorate and the Institute of Radiation Protection. These are relatively small organizations. Traditionally, the Nuclear Inspectorate employs the USNRC rules and regulations as a basis for its licensing requirements. Our designs are based on the requirements of the U.S. General Design Criteria as well as the USNRC Regulatory Guides. In our design work, we also closely study the acceptance criteria of the USNRC Standard Review Plans. In 1974 the Swedish Nuclear Power Inspectorate and the former U.S.A.E.C. signed an agreement for the mutual exchange of technical information and cooperation in develop- ment of standards. This agreement has facilitated our understanding of the concerns reflected in many U.S. documents. I wish to take this opportunity to say that the well-documented safety regulations and guides of the NRC have been a fundamental and invaluable basis for any serious nuclear program. Today, as a manufacturer's spokesman .1 might add that we sometimes wish the documents were not quite as many. PAGENO="0847" 843 Although the regulatory process has naturally become more formalized as the number of plants has increased, a reasonably effective regulatory process still prevails. From time to time, we have the benefit of informal and open-minded discussions with the authorities and the utilities on various safety issues. There may be a risk, though, that a more formalized licensing process could, curb the incentive for innovation, without necessarily resulting in safer nuclear power plants. 3 European Safety Requirements During the evolution of nuclear power in Sweden, the Nuclear Inspectorate has established a few specific Swedish rules. The most important ones are shown in Figure 3. The earliest and probably most significant one is the `30 minute rule". This rule requires that all actions that have to be taken in the nuclear power plant in order to avoid excessive release of radioactive substances after an accident must be automatic, if the action is needed within 30 minutes after the postulated initial event. Another rule has been established to the effect that a single failure of a passive component in emergency cooling fluid systems must be assumed to occur 12 hours or more after the postulated initial accident. A third requirement which `was adopted~ss far as 1972, in conjunction with the construction permit for BarsebEck No. 2 unit, concerns the pressure relief system of the BWR pressure vessel. This rule sets out that the pressure relief system, i.e. the safety valves, must be sized so that a pressurization transient is limited to 110% of the design pressure, even if reactor scram fails completely. I must add, however, that the Swedish authorities have not hither- to pursued other aspects of the ATWS issue that are so heatedly debated here in the United States. PAGENO="0848" 844 Some safety-related developments that have had an appreciable impact on the design of recent Swedish plants have, to some extent, a European flavor. Two important items are shown in Figure 3. The first item is the N-2 criterion. In sonewhat simplified terms, the N-2 criterion assumes that a safety- related system is divided into N subsystems or "trains". Now, after a postulated initial event that requires this system to operate, the designer must assume one sub-system to be defective and one sub- system_to~be unavailable due~ to repair or maintenance. Hence the N-2 designation. The result of this criterion is to require enhanced redundancy of safety-related systems. The other item deals with the protection of the plant from external events, particularly man.-induced hazards. This item, as well as the concern with regard to fire hazards and other types of common cause failure, leads to enhanced requirements to separate physically the redundant safety systems. In this context, "physical separation" means locating the safety systems some distance apart and separating them by means of strong barriers. As far as the Swedish Institute of Radiation Protection is concerned, one characteristic of their activities is their emphasis on the limitation of population doses and collective doses as a supplement to individual dose limits. Current work within the Institute of Radiation Protection includes the development of collective occupational dose limits for plant personnel and emergency planning for post-accident conditions. With regard to doses, the stated goal is to limit the annual occupational dose burden to 0.2 nanrem per MWe. The situation inSwedish plants is, in fact, quite favourable in this respect, as shown in PAGENO="0849" 845 Figure 4. The occupational doses expressed in annual manrems are plotted for each year and are compared with those reported for U.S. plants. The low values achieved in Swedish plants can be attributed to a series of factors, including spacious layout, conservative shielding design, good water chemistry conditions and material selection as well as suitably and carefully selected, work instructions. 4 Safety features of current Swedish BWR5 Now, let me briefly illustrate some of the safety features of Forsmark 3, the latest ASEA-ATOM 1000 MWe BWR plant. The building layout is illustrated in Figure 5. The reactor building is at the centre, surrounded by the `control building, the turbine building and auxiliary buildings. The figure illustrates the division of the entire plant in separate fire zones. Each fire zone is divided into a number of separate fire cells. Figure 6 shows the boiling water reactor located inside the prestressed concrete containment. The reactor is characterized by its internal recirculation pumps (Figure 7). Another safety-related feature is the use of two ``"`i~ndépendent means for inserting the control rods. Fast scram is achieved in less than 6 ~ means of a hydraulic system. As a back-up to this function and for the purpose of normal control rod adjustments, an electric motor provides the means for continuous motion of the control rods. By means of the electric system, which is conpletely independent of the hydraulic system, the control rods can be inserted into the reactor core in 4 minutes from the fully withdrawn position. 48-721 0 - 79 - 54 PAGENO="0850" 846 The emergency core cooling systems (ECCS) include a high pressure coolant injection system, an autonatic depressurization system, and .a low pressure injection and spray system. The emergency shutdown cooling system, including the entire cooling chain to the ultimate heat sink, is also regarded as an emergency cooling system satisfying safety requirements equivalent to those applicable to the ECCS. Each of the emergency cooling systems is divided into four subsystems (Figure 8) Each of the subsystems A, B, C, and D is independent and physically separated from the others. On-site power is distributed from four separate. diesel-generators, each feeding one set of the four emergency cooling subsystems. Safety-related control equipment is located in four separate relay rooms surrounding the control room. Communication between the control panels and the relay rooms is arranged by means of fibre optics, in order to avoid electrical di~sturbances between the separated control divisions. The control room can be galvanically isolated from the automatic control processes actuated in the relay rooms. The same consistent separation into four trains also applies to safety-related cables and piping. 5 suggested Areas of Nuclear Power Plant Safety Development In the presentation so far, I have described some of the safety and licensing activities in Sweden. I would now wish to outline some areas of further work that 1 believe nay help to maintain the high safety record that is such an outstanding charac~ teristic of nuclear power plants. My comments relate mainly to measures that may reduce the probability of serious accidents. This emphasis may be regarded as reflecting thedesigner's main ambition with respect to safety which is accident prevention. PAGENO="0851" 847 The most important item in my mind is to make use of experience of malfunctions and incidents that have occurred in nuclear power plants. I am convinced that if we analyse carefully their causes and the sequences of events, and if we also take action to prevent their recurrence, this feedback process will ensure that the nuclear reactor core melt probability will decrease as experience is accumulated. Secondly, we should focus our attentionon likely initiating events and related safety precautions. This is a conclusion based on the USNRC Reactor Safety Study as well as on experience. I believe that a period of reflection and digestion is~ desirable, rather than one of introducing further new safety requirements. We shall then be able to evaluate the real merits of the requirements now enforced and implemented in current designs. It is necessary to concentrate our efforts on the safety problems of everyday life in the nuclear power plant, rather than to distract from these realities by further debating probability levels of 10-6 or lO~. Thirdly, it is quite clear that the plant crew is important in the prevention of accidents as well as in mitigating the consequences of an accident. The USNRC Reactor Safety Study provided a good starting point for studies of human error. This work should continue. In addition, the operating staff should be highly qualified and be given responsibilities, training and working conditions that provide a solid basis for their qualification. On this point, I believe that the present situation may be different from one plant to another. I do not mean to say that the processes and develop- ments I have suggested are new. It is more a. - matter of emphasis. PAGENO="0852" 848 As regards post-accident conditions, environmental qualification of safety-related ectuipment is an important item which has also received increased attention during the last couple of years. Finally, the Three Nile Island indicent clearly demonstrates the need for improved in-plant accident response. Actually, this item was given a high priority in the 1978 USNRCIp1an for research to improve the safety of light-water nuclear power plants. Thank you. Attachment: Biography PAGENO="0853" 849 PAGENO="0854" 850 Figure 2 SWEDEN NORWAY land II PAGENO="0855" 851 Figure 3 SWEDISH SAFETY REQUIREMENTS 30 minute rule - Passive single failure in ECCS fluid Eomponents - Reactor pressure relief without scram EUROPEAN SAFETY REQUIREMENTS (examples) - N-2 criterion - External events (man - induced) PAGENO="0856" ASEA-ATOM BWR CS! P. m a - OCCUPATIONAL RADIATION EXPOSURE Average exposure per reactor unit and: year Comparison with US LWR 1969 1970 1971 1972 1973 1974 1975 The average is based on all reactors which have been in commercial operation for at least one year. RFC OY-1,03.1979 AS EA-ATOM PAGENO="0857" BWR 75 - VENTILATION 3YSTE' IS Fire~ zones 121 Reactor building 122 Turbine buiiding 123 Condensate cleanup system building 124 Auxiliary systems buildings A, B 125 Entrance bi~ilding 126 Control building 127 Diesel buildings A, B, C, D 128 Waste building 129 Active wor~5* 1954 508 9 3 5 3 0 528 64 1955 2563 80 25 6 3 2 2679 344 1956 2834 20 5 2 0 1 2862 162 1957 3473 97 31 1 2 4 3608 495 1958 5766 165 46 10 4 7 5998 779 1959 10388 221 133 78 49 23 10892 1864 1960 12047 198 97 22 4 0 12368 1158 1961 13383 198 91 44 14 3 13733 1241 1962 14411 642 366 247 146 108 15920 5222 1963 19164 446 159 71 34 28 19902 2725 1964 24044 804 445 215 144 41 25693 5678 1965 22630 2306 1314 814 618 525 28207 15829 1966 29490 2352 1623 1057 1139 513 36174 18804 1967 29853 2388 1563 1096 733 1 35634 13908 1968 30159 1344 773 496 279 0 33051 8719 1969 25672 1790 1080 753 375 0 29670 11077 1970 21182 2127 1382 740 492 0 25923 13084 1971 20041 1928 1066 650 240 0 23925 10616 1972 17514 1692 849 139 5 0 20199 7002 1973 13036 1403 604 203 6 0 15252 6083 1974 12587 1464 745 311 50 0 15157 7206 1975 12825 1116 598 82 42 0 14663 5285 1976 13042 1268 633 30 0 0 14973 5310 1977 13835 1277 586 25 0 0 15723 5199 1978 13700 1016 268 0 0 0 14984 3680 Note: During 1978,verifications were made of data in a similar table in ref (9) which had been obtained from summaries rather than directly from original medical records. Corrected data above differs from that in ref (9). Exposures from Nuclear Regulatory Commission or State licensed radiation sources have been excluded as far as practicable. Total man-rem was deter- mined by adding actual exposures for each individual during the year. * Limit in the Naval nuclear propulsionprogram was changed to 5 rem per year in 1967. PAGENO="1012" 20,000 4 15,000 LU 0~ LU z 4 ~1 4 I- 0 ~000 10,000 -J 4 LU > 0 z Il) I In LI.. 0 LU D z YEAR ~o0 FIGURE 2 TOTAL RADIATION EXPOSURE RECEIVED BY SHIPYARD PERSONNEL FROM WORK ASSOCIATED WITH NAVAL NUCLEAR PROPULSION PLANTS 1958-1978 PAGENO="1013" 1009 TABLE 4 SHIPYARD, SHIPS, TENDERS, AND SUBMARINE BASES DISTRIBUTION OF PERSONNEL RADIATION EXPOSURE Average Rem Per Year Person Monitored Fleet S hipyard 1954 .22 .12 1955 .25 .13 1956 .41 .06 1957 .20 .14 1958 .17 .13 1959 .18 .17 1960 .14 .09 1961 .14 .09 1962 .18 .33 1963 .15 .13 1964 .18 .22 1965 .27 .56 1966 .19 .52 1967 .14 .39 1968 .10 .26 1969 .11 .37 1970 .11 .50 1971 .12 .44 1972 .10 .35 1973 .10 .40 1974 .11 .48 1975 .12 .36 1976 .14 .35 1977 .14 .33 1978 .10 .24 Average .13 .35 NAVYWIDE .25 AVERAGE Percent of Personnel Monitored Who Received Greater Than 1 Rem Fleet Shipyard 0 3.8 10.9 4.3 11.5 1.0 2.7 3.7 2.4 3.9 4.7 4.6 7.5 2.6 2.9 2.5 4.3 9.5 2.7 3.7 4.4 6.4 7.5 19.8 4.6 18.5 2.5 16.2 2.0 8.8 2.7 13.5 2.9 18.3 2.7 16.2 2.3 13.3 2.3 14.5 2.0 17.0 2.0 12.5 2.4 12.9 2.3 12.0 1.4 8.5 2.8 12.2 0 0 0 0 0 8 0 0 9 2 3 5 6 3 0 0 0 0 0 0 0 0 0 0 0 Number of Personnel Who Exceeded 3 Rem/Quarter 8.0 PAGENO="1014" 1010 operate a nuclear propulsion plant is about 1 rem. These radiation exposures are much less than the exposure the average American receives from medical diagnostic X-rays during his working lifetime. Table 5 provides information on the distribution of lifetime accumulated exposure. This table includes all shipyard employees who at some time during 1978 were monitored for radiation exposure. Also shown in this table is the distribution of lifetime accumulated exposure for every person monitored In one shipyard since radioactive work started. For ships the data was obtained by sampling selected ships. Federal radiation exposure limits allow accumulating 100 rem in twenty years of work, or 200 rem in forty years. The fact that no one shown in Table 5 comes close to having accumulated this much radiation exposure is the result of deliberate efforts to keep well below the lifetime accumulated radiation exposure limit. - TABLE 5 DISTRIBUTION OF TOTAL LIFETIME OCCUPATIONAL RADIATION EXPOSURE ASSOCI- ATED WITH NAVAL NUCLEAR PROPULSION PLANTS Percent of Personnel With Lifetime Accumulated Radiation Exposure in the Radiation Range Range of Accumulated Ship Personnel All Shipyard One Shipyard- Lifetime Radiation Monitored in Personnel Non- All Personnel Exposure (REM) 1978 itored in 1978 Ever Monitored 0- 5 99 75 87 5-10 1 12 6 10-15 0.1 : 6 3 15-20 .03 3 1 20-25 0 2 1 25 - 30 0 1 Less than 1 30 - 50 0 Less than 1 Less than 1 Greater than 50 0 0 0 Table 6 provides a basis for comparison between the radiation exposure for light water reactors operated by the Navy and commercial power reactors licensed by the Nuclear Regulatory Commission. The 1977 data in this Nuclear Regulatory Commission table covers 65 licensees with a total of 32,731 man-rem (ref 10). The average annual exposure of each worker at commercial power reactors was 0.46 rem. Licensees of commercial power reactors reported 141 overexposures to external radia- tion during the years 1971 through 1977. Numbers in excess of 5 rem are not necessarily overexposures since Nuclear Regulatory Commission regulations permit exposures of 3 rem each quarter up to 12 rem per year within the accumulated total limit of 5 rem for each year of a person's age beyond eighteen. PAGENO="1015" TABLE 6 PERSONNEL RADIATION EXPOSURE FOR LIGHT WATER REACTORS LICENSED BY U.S. NUCLEAR REGULATORY COMMISSION SUMMARY OF ANNUAL WHOLE BODY EXPOSURE BY INCREMENT I. YEAR TOTAL MONITORED NOT ~ 0-1 1-2 2-3 NUMBER OF INDIVIDUALS NUMBER EXPOSURE INCREMENT - REM OF OVER- >10 EXPOSURES 3-4 4-5 5-6 6-7- 7-8 8-9 9-10 1969 2854 2607 144 70 26 5 2 0 0 0 0 1970 7518 6953 184 175 92 102 11 1 0 0 0 1971 10269 9660 328 146 107 17 11 0 0 0 0 2 1972 15730 14783 536 205 114 47 23 10 6 6 0 16 1973 35918 20717 10249 2449 1585 432 237 117 71 38 16 7 0 19 1974 38379 20240 13455 2491 1375 470 226 86 30 6 0 0 0 43 1975 45659 20188 18277 3892 1903 707 426 169 60 24 12 0 1 14 1976 61151 25704 26636 4880 2354 789 487 188 70 26 11 5 1 20 1977 70904 27671 33252 6174 2838 1130 569 141 66 36 21 6 0 27 SOURCES: 1969-1976: NUREG-0323 Occupational Radiation Exposure at Light Water Cooled Power Reactors 1976 1977: NUREG-O463 "Occupational Radiation Exposure" Tenth Annual Report 1977 `7 PAGENO="1016" 1012 INTERNAL RADIOACTIVITY Policy and Limits The Navy's policy on internal radioactivity for personnel associated with the nuclear propulsion program continues to be the same as it was more than two decades ago, to prevent significant radiation exposure to personnel from internal radioactivity. The limits invoked to achieve this objective are one-tenth of the levels allowed by Federal regula- tions for radiation workers. The results of this program have been that no one has received more than one-tenth the Federal annual internal occupational exposure limits from internal radiation exposure caused by radioactivity associated with Naval nuclear propulsion plants. The basic Federal limit for radiatiOn exposure to organs of the body from internal radioactivity has been 15 rem per year. There have been higher levels applied at various times for thyroid and for bones, however, use of these specific higher limits has not been necessary in the Naval nuclear propulsion program. Fifteen rem per year is the limit recommended for most organs of the body by the U. S. National Committee on Radiation Protection in 1954 (ref 1), by the U. S. Atomic Energy Comission in the initial edition of ref 3 applicable in 1957, by the International Commission on Radiological Protection in 1959 (ref 2), and was adopted for Federal agencies when President Eisenhower approved recorrinendations of the Federal Radiation Council May 13, 1960. Although the International Commission on Radiological Protection revised its recomendations in 1977 (ref8) to raise limits for most organs,the Naval nuclear propulsion program has not changed its limits. Source of Radioactivity Radioactivity can get inside the body through air, through water or food, and through surface contamination via the mouth or skin or a wound. The radioactivity of primary concern is the metallic corrosion products on the inside surfaces of reactor plant piping systems. These are in the form of insoluble metallic oxides, primarily iron oxides. Ref (11) contains more details on why cobalt 60 is the radio- nuclide of most concern for internal radioactivity. The design conditions for reactor fuel are much more severe for warships than for cornmerical power reactors. As a result of being designed to withstand shock, Naval reactor fuel elements retain fission products including fission gases within the fuel. Sensitive measurements are made frequently to verify the integrity of reactor fuel. Consequently, fission products such as strontium 90 and cesium 137 make no measurable contribution to internal exposure of personnel from radioactivity associated with Naval nuclear propulsion plants. Similarly alpha emitters such as uranium and plutonium are retained within the fuel elements and are not accessible to personnel operating or maintaining a Naval nuclear propulsion plant. PAGENO="1017" 1013 Because of the high integrity of reactor fuel and because soluble boron is not used in reactor coolant for normal radioactivity control in Naval reactors, the amounts of tritium in reactor coolant are far less than in typical power reactors.. The small amounts that are present are formed primarily as a result of neutron interaction with the deuterium naturally present in water. The radiation from tritium is of such low energy that the Federal limits for breathing or swallowing tritium are one hundred times higher than for cobalt 60. As a result radiation exposure to personnel from tritium is far too low to measure. Similarly the low energy beta radiation from carbon 14 does not add measurable radiation exposure to personnel operating or maintaining Naval nuclear propulsion plants. Control of Airborne Radioactivity Airborne radioactivity is controlled in maintenance operations such that masks are not normally required. To prevent exposure of personnel to airborne radioactivity when work might expose radioactivity to the atmos- phere,~ contamination containment tents or bags are used. The areas inside these containments are ventilated to the atmosphere throuqh hicih efficiency filters which have been tested to remove at least 99.95 percent of particles of a size comparable to cigarette smoke. The occupied area outside these containments is required to be ventilated through high efficiency filters any time work which could cause airborne radioactivity is in progress inside an area such as a reactor compartment. Airborne radioactivity surveys are required to be performed regularly in radio- active work areas. Any time airborne radioactivity above the limit is detected in occupied areas, work which might be causing airborne radio- activity is stopped. This conservative action is taken to minimize internal radioactivity even though the Navy's airborne radioactivity limit would allow continuous breathing for forty hours per week throughout the year to reach an annual exposure to the lungs of one-tenth the Federal limit. Personnel are also trained to use masks when airborne radioactivity is detected, however, masks are seldom needed and are not relied upon as the first line of defense against airborne radioactivity. It is not uncommon for airborne radioactivity above the limit to be caused by radon naturally present in the air. Atmospheric tempera- ture inversion conditions can allow this buildup of radioactive particles from radon. Radon can build up above the limit in sealed or poorly ventilated rooms in homes or buildings made of stone. Most cases of airborne radioactivity above the limits in occupied areas in the Naval nuclear propulsion program have been caused by radioactive particles from radon, and not from the reactor plant. Procedures have been developed to allow work to continue after it has been determined that the elevated airborne radioactivity is from naturally occurring radon. PAGENO="1018" 1014, Radon also is emitted from radium used for making dials luminous. There have been a number of cases where a single radium dial such as on a wristwatch has caused the entire atmosphere of a submarine to exceed the airborne radioactivity limit used for the nuclear propulsion plant. Radium in any form has been banned from submarines to prevent interfer- ence with keeping airborne radioactivity from the nuclear propulsion plant as low as practicable. Control of Radioactive Surface Contamination Perhaps the most restrictive regulations in the radiological control program are established in the requirements for the control of radio- active contamination. Work operations involving potential for spreading radioactive contamination are planned using containment to prevent per- sonnel becoming contaminated. The controls for radioactive contamina- tion are so strict that precautions sometimes have had to be taken to prevent tracking contamination from fallout and natural sources into nuclear areas because the contamination control limits used in the nuclear areas were below the levels of fallout and natural contamination occurring outside in the general public areas. Anticontamination clothing, including coverall, hood to cover the head, ears and neck, shoe covers, and gloves, is provided when needed. However, the basic approach is to avoid the need for anticontamination clothing by containing the radioactivity. As a result, most work on radioactive materials is performed with hands reaching into gloves installed in containments, making it unnecessary for the worker to wear anticontamination clothing. In addition to providing better control over the spread of radioactivity, this method has reduced radiation exposure since the worker can usually do his job better and faster in his normal work clothing. A basic requirement of con- tamination control is monitoring all personnel leaving any area where radioactive contamination could possibly occur. Workers are trained to survey themselves and their performance is checked by radiological control personnel. Personnel monitor before, not after, they wash. Therefore, washing or showering at the exit of radioactive work areas is not required. The basic approach is to prevent contamina- tion, not wash it away. Surveys for radioactive contamination are taken frequently by trained radiological control personnel. Results of these surveys are reviewed by supervisory personnel to provide a double-check that no abnormal conditions exist. The instruments used for these surveys are checked against a radioactive calibration source daily and prior to use and they are calibrated at least every six months. Control of Food and Water Smoking, eating, drinking and chewing are prohibited in radioactive areas. Aboard ship drinking water is distilled from seawater by using steam. However, the steam is not radioactive because it is in a secondary piping system separate from the reactor plant radioactive water. In the event radioactivity were to leak into the steam system, sensitive radioactivity detection instruments which operate continuously would give early warning. PAGENO="1019" 1015 Wounds Skin conditions or open wounds which might not readily be decontaminated are cause for disqualification from doing radioactive work. Workers are trained to report such conditions to radiological control or medical personnel, and radiological control technicians watch for open wounds when workers enter radioactive work areas: In the initial medical examination prior to radiation work and during subsequent examinations skin conditions are also checked. If the medical officer determines a wound is sufficiently healed or considers the wound adequately protected, he may remove the disqual ifi cation. There have been only a few cases of contaminated wounds in the Naval nuclear propulsion program. In most years, including 1978, none occurred. Examples of such injuries have included a scratched hand, a metallic sliver in a hand, a cut finger, and a puncture wound to a hand. These wounds occurred at the same time the person became con- -taminated. Insoluble metallic oxides which make up the radioactive contamination remain primarily at the wound rather than being absorbed into the blood stream. These radioactively contaminated wounds have been easily decontaminated. No case of a contaminated wound is known where the radioactivity initially present in the wound was as much as one one-thousandth of that permitted for a radiation worker to have in his body. Monitoring for Internal Radioactivity The radioactivity of most concern for internal radiation exposure from Naval nuclear propulsion plants is cobalt 60. Although most radiation exposure from cobalt 60 inside the body will be from beta radiation, the gammas given off make cobalt 60 easy to detect. Corn- plex whole body counters are not required to detect cobalt 60 at low levels inside the body. For example, one millionth of a curie of cobalt 60 inside the lungs or intestines will cause a measurement o~ two times above the background reading with a standard radiation survey instrument. This amount of internal radioactivity will cause the instrument used to monitor personnel for radioactive contamination on their body to reach the alarm level. Every person is required to monitor his entire body every time he leaves an area with radio- active surface contamination. Monitoring the entire body is a require- ment in the Naval nuclear propulsion program; monitoring just hands and feet is not permitted. Therefore, if ~. person had as little as a millionth of a curie of cobalt 60 inside him, it would readily be detected. Swallowing one millionth of a curie of cobalt 60 will cause internal radiation exposure of about 0.06 rem. The radioactivity will pass through the body and be excreted within a period of a little more than one day. PAGENO="1020" 1016 One millionth of a curie df cobalt 60 deposited in the lungs as a result of an inhalation incident is estimated to cause a radiation exposure of about 3 rem to the lungs over the following year based on standard calculational techniques recommended by the International Com- mission on Radiological Protection, (ref 12). These techniques provide a convenient way to estimate the amount of radiation exposure a typical individual might be expected to receive from small amounts of internally deposited radioactivity. These techniques account for the gradual removal of cobalt 60 from, the lungs through biological processes and the radioactive decay of cobalt 60 with a 5.3 year half life. However in an actual case, the measured biological elimination rate is used in determining the amount of radiation exposure received. In addition to the control measures to prevent internal radio- activity and the body monitoring frequently performed on those who work with radioactive materials, more sensitive monitoring is also performed during radioactive overhaul work. Shipyard procedures for monitoring internal radioactivity use the type of scintillation detectors which will reliably detect an amount of cobalt 60 inside the body that is more than one hundred times lower than the one millionth of a curie used in the examples.above. Shipyards typically monitor for internal radioactivity as part of each radiation medical examination, performed before an employee initially performs radiation work, after he terminates radiation work, and periodically in between. Shipyards also monitor periodically during the year groups of personnel who did the work most likely to have caused spread of radioactive contamination. Any person who has radioactive contamination above the limit anywhere on the skin of his body during regular monitoring at the exit from a radioactive area is monitored for internal radioactivity with the sensitive detector. Also any person who might have breathed airborne radioactivity above limits is monitored with the sensitive detector. Results of Internal Monitoring in 1978~ At the nine shipyards performing work associated with Naval nuclear propulsion plants a total of 11,701 personnel were monitored for internal radioactivity in 1978 using sensitive scintillation detectors. Equipment and procedures provide detection level,s at least one hundred times lower than one millionth of a curie. Two persons were found with internal radioactivity in their lungs, above this level. One had 0.05 millionths of a curie. This person received his internal radioactivity from separate radioactive work performed outside the Naval nuclear propulsion program. The other person received internal radioactivity at a support facility. He had 0.03 millionths curie in hi's gastrointestinal sys- tem. Based on his actual' biological elimination rate, he received 0.1 rem to the lower large intestine, and he will receive about 0.04 rem to the lungs in the year following this exposure. PAGENO="1021" 1017 EFFECTS OF RADIATION ON PERSONNEL Control of radiation exposure in the Naval nuclear propulsion program has always been based on the assumption that any exposure no matter how small involves some risk; however, exposure within the accepted limits represents a risk small compared with normal hazards of life. The basis for this statement was presented in the previous Navy report on radiation (ref 9). More is known about the effects of radiation than almost any industrial hazard to humans. More money has been spent to learn the effects of radiation on humans than for any industrial hazard. The effects of radiation have been put in the form of risk estimates which can be compared with risks from normal hazards of life. Risk estimates have been made by the United Nations Scientific Comittee on the Effects of Atomic Radiation (ref 13), the International Commission on Radiological Protection (ref 8), and the U. S. National Academy of Sciences Committee on Biological Effects of Ionizing Radiation (ref 14). All these organizations have developed comparable risk estimates which can be summarized in the following; this will be referred to subsequently as the standard risk estimate: In a large population group (such as 100,000 people) receiving an annual total of 10,000 man-rem year after year, the increased risk from this radiation appears to be in the region of about one fatal cancer case each year in excess of the normal numbers of cases. Every fifth year this cancer case will be leukemia. For comparison the eventual cause of death of about 16,000 of a typical group of 100,000 people in the U.S. will be cancer from causes other than this added radiation. The preceding standard risk estimate can be used to develop risk estimates for personnel exposed to radiation associated with Naval nuclear propulsion plants. In all shipyards there have been a total of about 100,000 personnel monitored for exposure to radiation and their average exposure rate over twenty five years has been 6100 man-rem per year. Therefore according to the above standard risk estimate, * there should be less than one excess fatal cancer per year and less than one excess leukemia case every five years among the total 100,000 shipyard personnel who have ever been monitored for radiation associated with Naval nuclear propulsion plants. Radiation exposure received by Naval personnel assigned to nuclear- powered ships and their support facilities has averaged one third of the total exposure to shipyard personnel. Therefore according to the above standard risk estimate, * there should be less than one excess fatal cancer every three years and less than one excess leukemia case every fifteen years among the approximately 100,000 Naval personnel who have ever been monitored for occupational *exposure to radiation associated with Naval nuclear propulsion plants. PAGENO="1022" 1018 Three highly controversial studies have challenged this standard risk estimate as being too low (these are briefly summarized in the previous Navy report on radiation, ref 9). One specifically states the risk estimates are as much as a factor of ten low. Even if the standard risk estimates were increased ten times to meet these challenges, the risks from radiation in the Naval nuclear propulsion program would not be greater than from other normal hazards of everyday life for this same group of personnel. In contrast, large numbers of scientists believe that the standard risk estimate is too high for gamma radiation at low dose rates under conditions comparable to those in the Naval nuclear propulsion program (ref 15). Essentially every radiation study on animals has shown that damage caused by gamma radiation at low doses is less per rem than from high doses from which the standard risk estimates above is derived. One explanation frequently used is that at low dose rates the body has a chance to heal the damage from gamma radiation more than at high dose rates. Other examples may also be used to help put into perspective the amounts of radiation exposure received by personnel in the Naval nuclear propulsion program: * Theaverage radiation exposure of all those monitored in the last 25 years received from radiation associated with the Naval nuclear propulsion program is 0.25 rem. This is only slightly greater than the average radiation exposure received in the U.S. each year from natural background and medical X- rays. (Derived from ref 16) * The average lifetime occupational radiation exposure of 1.5 rem for shipyard personnel is about one tenth the amount of radiation exposure these same personnel will average over their lifetimes from natural background and medical X-rays. (Derived from ref 16). * This 1.5 rem average lifetime Occupational radiation exposure can also be compared very roughly to the 5 rem received in a year from smoking one pack of cigarettes per day. This compari sion is not exact because it requires more lung exposure from natural radioactivity in tobacco to cause the same amount of risk as whole body gamma radiation (ref 17). * The risk of dying from an automobile accident is 30 or more times higher than the risk of fatal cancer for the average worker with 1.5 rem lifetime radiation exposure. PAGENO="1023" 1019 * The total occupational radiation exposure of 3700 man-rem received by all shipyard personnel from the Naval nuclear propulsion program in 1978 can be compared to the many other sources of radiation exposure received by the U. S. population. Examples follow: - 20,000,000 man-rem to the population of the U. S. each year from natural background radiation (ref 16) - 17,000,000 man-rem to the population of the U. S. each year from medical and dental radiation (ref 16) - 625,000 man-rem to the population of the U. S. from radioactivity in natural gas used for cooking (ref 17) - 100,000 man-rem the one million inhabitants of Denver could save each year if they moved to a region such as Washington, D. C. with lower natural background radiation levels (Derived from ref 16) - 12,000 man-rem total to passengers in jet airplane flights in the United States from increased cosmic radiation at the higher altitudes used by jets (ref 18) Thus, the total occupational radiation exposure received by all shipyard personnel in 1978 is less than one ten thousandth of the total radiation exposure received by the U. S. population from all sources. PAGENO="1024" 1020 CLAIMS FOR RADIATION INJURY TO PERSONNEL Personnel who consider they have or might have had occupational injury are encouraged to file claims. The compensation systems make allowance for the long latent period for radiation-induced cancer. Naval shipyard personnel are employees of the U. S. Government and therefore file claims with the U. S. Department of Labor's Office of Workmen's Compensation. Shipyards hold no hearing on injury claims. They are not handled in an adversary procedure. The Navy has no rights to present a case to the Labor Department. The claim does not even have to be filed through the shipyard. The shipyard is not permitted to appeal a decision but the employee may appeal. The primary consideration in the Federal laws and procedures set up for injury compensation is to take care of the Federal employee. The program to compensate Federal employees is well publicized as shown by more than 25,000 claims being paid for Navy employees in 1978. Over half of these claims were filed by shipyard workers. As noted below, however, only a few were related to radiation exposure. In private shipyards injury compensation claims *are handled under the Longeshoreman's and Harbor Workers' Compensation Act. The claim may be handled through the shipyard's insurance carrier or by a U. S. Department of Labor claims examiner. Either the employee or the employer may appeal. Claims for military personnel concerning prior duty are handled through the Veterans Administration. There have been a total of 58 claims filed for injury from radiation associated with Naval nuclear propulsion plants. Fifty- five originated from employees of the six Naval shipyards, three from one private shipyard, and none that the Navy is aware of from Navy personnel. These claims are summarized in Table 7 and in more detail in the appendix. A number of claims have previously been listed by the Navy as radiation-related because radiation was mentioned as one of a large number of possible causes of an injury. Those which have been handled by the Department of Labor as other than radiation claims have been removed from the Navy list. Two suits have been filed in court alleging injury from radiation. Neither person claims cancer. They are not summarized in this report since these cases are in litigation. Three claims have been awarded to employees, one for leukemia in 1968 and two for cataracts of the eyes in 1971 and in 1977. The Navy considers all three of these awards were incorrect: * The leukemia case developed within two years of the occupational exposure of 5.38 rem. This is too short a latency period. The claimant had received hundreds of rem in medical radiation exposure for adenoids. If radiation were to be selected as the cause of this leukemia, then the occupational exposure could not have been more than a tiny part of this total radiation. PAGENO="1025" 1021 * The two cataract cases each had total lifetime radiation exposures of about 3 rem, which is hundreds of times smaller than needed to produce cataracts in the eyes. From the radiation injury claims filed to date, the Navy has been unable to draw any conclusions concerning radiation injury to personnel occupationally exposed to radiation associatedwith Naval nuclear ~ropulsion plants. TABLE 7 CLAIMS FOR RADIATION INJURY TO PERSONNEL Claims Injury Claims Claims Rejected Claims Claimed Filed Awarded or Deferred Active Leukemia 8 1 3 4 Cancer Other 11 0 6 5 Than Leukemia Other 39 2 26 11 Total 58 3 35 20 48-721 0 - 79 - 65 PAGENO="1026" 1022 AUDITS AND REVIEWS Checks and cross-checks and audits and inspections of numerous kinds have been shown to be essential in maintaining high standards of radiological control. First, each worker is specially trained in radiological control as it relates to his own job. Second, written procedures exist which require verbatim compliance. Third, radiological control technicians and their supervisors oversee radioactive work. Fourth, personnel independent of radiological control technicians are responsible for personnel radiation exposure records. Fifth, a strong independent audit program is required covering all radiological control requirements. In all shipyards this radio- logical audit group is independent of the radiological control organization and its findings are reported regularly to senior ship- yard management including the shipyard commander. This group performs continuing surveillance of radioactive work. It conducts in-depth audits of specific areas of radiological control. This group checks all radiological control requirements at least annually. Sixth, the U. S. Department of Energy assigns to each shipyard a representative who reports to the Director, Division of Naval Reactors At headquarters. One assistant to this representative is assigned full time to audit radiological controls, both in nuclear- powered ships and in the shipyard. And seventh, the Naval Sea Systems Command also conducts periodic inspections of radiological control in each shipyard. Similarly, there are multiple levels of audits and inspections for the other Navy shore facilities, tenders, and nuclear-powered ships. PAGENO="1027" 1023 ABNORMAL OCCURRENCES It is a fact of human nature that people make mistakes. The key to a good radiological control program is to find the mistakes while they are small and prevent the combtnations of mistakes that lead to accidents. The preceding section on inspections supports the contention that more attention is given to errors and their prevention in the Naval nuclear propulsion program than to any other single subject. Requiring constant focus on improving performance of radiological work has proven effective in reducing errors. In addition, radiological control technicians are authorized and required to stop anyone performing work in a manner which could lead to radiological deficiencies. A deficiency, of course is failure to follow a written procedure verbatim. However the broadest interpretation of the term "deficiency" is used in the Navy's radiological control program: anything involved with radiation or radioactivity which could have been done better is also a radiological deficiency. Radiological deficiencies receive management attention. But there is a higher level of deficiency that is defined as a radiological incident. Incidents attract a great deal of notice, including the personal attention of the Director, Division of Naval Reactors at headquarters. Improvement programs over the years have constantly aimed at reducing the numbers of radiological incidents. As improvements occurred, the definition of what constituted an incident was changed to define smaller deficiencies as incidents. These changes were necessary so that the incident reporting system would continue to play a key role in upgrading radiological controls. As a result it is not practicable to measure performance merely by counting numbers of radiological incidents or deficiencies. There is a reporting system that has been nearly constant over time and therefore can be used as a basis for comparison. The Department of Energy and its predecessors have used these levels of severity to define radiological occurences (ref 19). Examples of radiation exposure incidents in each type follow: * Type A - external radiation exposure over 25 rem in one incident * Type B - external radiation exposure over 5 rem in one incident * Type C - external whole body radiation exposure over 3 rem in one quarter year The Nuclear Regulatory Commission also has criteria defining abnormal occurrences. The Navy regularly evaluates radiological events using these criteria for comparison; results are reported in Table 8. PAGENO="1028" 1024 TABLE 8 ABNORMAL OCCURRENCES IN THE NAVAL NUCLEAR PROPULSION PROGRAM Year Number of Abnormal Occurences* 1974 0 1975 0 1976 0 1977 0 1978 0 *Abnormal occurrences are reported here if the Navy evaluation determines they meet either the Department of Energy criteria for Type A incidents or the Nuclear Regulatory Commission criteria for quarterly report to Congress as abnormal occurrences The policy of the Navy is to provide for close cooperation and effective communication with state radiological officials involving occurrences that might cause concern because of radiological effects associated with the ships or shore facilities. The Navy has reviewed radiological matters with state radiological officials in the states where Naval nuclear-nuclear powered ships are based or overhauled. Although there were no occurrences in 1978 which resulted in radio- logical effects to the public outside these facilities or which resulted in radiological injury to residents of the states working inside these facilities, states were notified when inquiries showed public interest in the possibility such events had occurred. PAGENO="1029" 1025 REFERENCES (1) National Council on Radiation Protection and Measurements Report 17, "Permissible Dose from External Sources of Ionizing Radiation," including April 15, 1958 Addendum "Maximum Permissible Radiation Exposures to Man" (originally published in 1954 as National Bureau of Standards Handbook 59) (2) International Commission on Radiological Protection Publication 1, "Recommendations of the International Commission on Radiological Protection" (Adopted September 9, 1958), Pergamon Press 1959 (3) Code of Federal Regulations Title 10 (Energy) Part 20, "Standards for Protection Against Radiation" (4) Federal Radiation Council, "Radiation Protection Guidance for Federal Agencies" approved by President Eisenhower May 13, 1960, printed in Federal Register May 18, 1960 (5) International Commission on Radiological Protection Publication 9, "Recommendations of the International Commission on Radiological Protection" (Adopted September 17, 1965), Pergamon Press 1966 (6) National Council on Radiation Protection and Measurements Report 39, "Basic Radiation Protection Criteria" January 15, 1971 (7) Department of Energy Manual Chapter 0524, "Standards for Radiation Protection" (8) International Commission on Radiological Protection Report 26, "Recommendations of the International Commission on Radiological Protection" (Adopted January 17, 1977), Pergamon Press 1977 (9) U. S. Navy Report, "Occupational Radiation Exposure from U. S. Naval Nuclear Propulsion Plants and Their Support Facilities - 1977," N. E. Miles, NT-78-2, March 1978 (10) U. S. Nuclear Regulatory Commission, "Occupational Radiation Exposure - Tenth Annual Report 1977," NUREG-O463 October 1978 PAGENO="1030" 1026 (11) U. S. Navy Report, Environmental Monitoring and Disposal of Radioactive Wastes From U. S. Naval Nuclear-Powered Ships and Their Support Facilities - 1978," M. E. Miles, G. L. Sioblom, and J. D. Eagles - NT-79-l January 1979 (12) International Commission on Radiological Protection Report 10, "Evaluation of Radiation Doses to Body Tissues from Internal Contamination Due to Occupational Exposure," Pergamon Press 1968 (13) United Nations Scientific Committee on the Effects of Atomic Radiation, "Sources and Effects of Ionizing Radiation," 1977 (14) National Academy of Sciences - National Research Council, "The Effects on Populations of Exposure to Low Levels of Ionizing Radiation,' Report of the Advisory Committee on the Biological Effects of Ionizing Radiations, 1972 (15) National Council on Radiation Protection and Measurements Report 43, "Review of the Current State of Radiation Protection Philosophy," January 15, 1975 (16) Environmental Protection Agency,"Estimates of Ionizing Radiation Doses in the United States 1960 - 2000", ORP/CSD 72-1 August 1972 (17) National Council on Radiation Protection and Measurements Report 56, "Radiation Exposure from Consumer Products and Miscellaneous Sources," November 1, 1977 (18) U. S. Nuclear Regulatory Commission, "Final Environmental Statement on the Transportation of Radioactive Materials by Air and Other Modes," NUREG-0170, December 1977 (19) Department of Energy Manual Chapter 0502, "Notification, Investigation and Reporting of Occurrences" PAGENO="1031" * 1027 APPENDIX SUMMARY OF CLAIMS FROM RADIATION EXPOSURE ASSOCIATED WITH NAVAL NUCLEAR PROPULSION PLANTS ALL CLAIMS FR(~ RADIATION EXPOSURE ASSOCIATED WITH NAVAL NUCLEAR PROPULSION PLANTS Claims Claims Claims Claims Shipyard Filed Awarded Rejected or Deferred Active Portsmouth Naval Shipyard 9 0 3 6 Electric Boat Division of General Dynamics 3 Q 2 1. Norfolk Naval Shipyard 2 1 * 0 Newport News Shipbuilding and Drydock Company 0 0 0 0 Charleston Naval Shipyard 3 0 2 1 Ingalls Shipbuilding 0 0 0 0 Mare Island Naval Shipyard 25 2 13 10 Puget Sound Naval Shipyard 13 0 12 1 Pearl Harbor Naval Shipyard 3 0 3 0 TOTALS 58 3 * 35 20 PAGENO="1032" 1028 LEUKFI'ILA CLAIMS FRCIVI RADIATION EXPOSURE ASSOCIATED WITh NAVAL NUCLEAR PROI~JLSION PLANTS Claims Claims Claims Claims Shipyard Filed Awarded Rejected or Deferred Active Portsmouth Naval Shipyard 1 0 0 1 Electric Boat Division of General Dynamics 0 0 0 0 Norfolk Naval Shipyard 2 1 0 1 Newport News Shipbuilding and Drydock Company 0 0 0 0 Gharleston Naval Shipyard 0 0 0 0 Ingalls Shipbuilding 0 0 0 0 Mare Island Naval Shipyard 1 0 0 1 Puget Sound Naval Shipyard 2 0 1 1 Pearl Harbor Naval Shipyard 2 0 2 0 TOTALS 8 1 3 4 PAGENO="1033" 1029 * :*..~ CANCER (OTHER THAN LEUKEMIA) CLANS FRC~~1 RAI)IATION EXPOSURE ASSOCIATED WITH NAVAL NUCLEAR PROPULSION PLANTS Claims Claims Claims Claims Shipyard Filed Awarded Rejected or Deferred Active Portsmouth Naval Shipyard 5 0 2 3 Electric Boat Division of General Dynamics 1 0 1 0 Norfolk Naval Shipyard 0 0 0 0 Newport News Shipbuilding and Drydock Company 0 0 0 0 Charleston Naval Shipyard 1 0 0 1 Ingalls Shipbuilding 0 0 0 0 Mare Island Naval Shipyard 3 0 2 1 Puget Sound Naval Shipyard 1 0 1 0 Pearl Harbor Naval Shipyard 0 0 0 0 TOTALS 11 0 6 5 PAGENO="1034" 1030 CLAIMS OTHER THAN CANCER OR LEUK~vIIA FRC~V1 RADIATION EXPOSURE ASSOCIATED WITH NAVAL NUCLEAR PROPULSION PLANTS Claims Claims Claims Claims Shipyard Filed Awarded Rejected or Deferred Active Portsmouth Naval Shipyard 3 0 1 2 Electric Boat Division of General Dynamics 2 0 1 Norfolk Naval Shipyard 0 0 0 0 Newport News Shipbuilding and Drydock Company 0 0 0 0 Charleston Naval Shipyard 2 0 2 0 Ingalls Shipbuilding 0 0 0 0 Mare Island Naval Shipyard 21 2 11 8 Puget Sound Naval Shipyard 10 0 10 0 Pearl Harbor Naval Shipyard 1 0 1 0 TOTALS 39 2 26 11 PAGENO="1035" INJURY CLAIMS FRCM RADIATION EXPOSURE ASSOCIATED WITh NAVAL NUCLEAR PROPULSION PLANTS PORT~0UTH NAVAL SHIPYARD Ocç~ip~ation Date Filed -- Status* Bone Cancer REJECTED Lynphosarcoma REJECTED Cryptogenic epileptic condition Cancer of Rectum Lung Cancer Cancer of Rectum Leukemia Polyp on Rectum Cataract *AWJtJ?DED means Department of Labor concluded injury was job related and compensation paid. REJECTED means Department of Labor concluded injury was not job related. DEFERRED means Department of Labor concluded claimant did not provide sufficient justification that injury was job related and that claimant has not replied to Department of Labor requests for more information. ACTIVE means claim is being evaluated by the Department of Labor. Lifetime Radiation Injury Claim Exposure-Rem Machinist Shipfitter Metals Inspector Welder Caulker/Chipper Caulker/Chipper Welder Shipfitter 10/60 11/73 11/73 3/78 5/78 6/78 8/78 10/78 1.855 2.326 7.381 0.419 0.544 4.290 1.530 8.258 Marine Mechanic 12/78 REJECTED ACTIVE ACTIVE ACTIVE ACTIVE ACTIVE 35.483 ACTIVE PAGENO="1036" ELECTRIC BOAT DIVISION OF GENERAL DYNAMICS Lifetime Radiation Exposure-Rem Status* 0.010 REJECTED by State Workmen Compensation. However, State paid for psychiatric examination. Overexposure; 0.068 DEFERRED by insurance company. Removal of Cancer of Lip lip cancer paid by insurance company. Loss of Eye 0.234 ACTIVE Occupation Welder Date Filed Injury Claim 2/74 Radiation and Ilead Injury Shipping Carpenter 1967 Health Physicist 4/78 Monitor NORFOLK NAVAL SHIPYARD Boilermaker 3/67 Acute Myelogenous 5.38 AWARDED The Navy disagreed with this award. Leukemia The basis of the Navy disagreement was that (1) his occupational exposure was small compared to his medical exposure, and (2) the leukemia occured only 2 years after his first occupational exposure which is a too short a latency period. Electrician 6/78 Leukemia 0 ACTIVE NEWPORT NEWS SHIPBUILDING AND DRYDOCK CCMPANY NC~4E CHARLESTON NAVAL SHIPYARD Sheet metal worker 11/66 Impaired Vision 4.173 REJECTED Shipfitter 9/71 Cataract 10.156 REJECTED Shipfitter 12/78 Cancer of Colon 3.370 ACTIVE PAGENO="1037" Lifetime Radiation Occuj)atiOfl Date Filed Injury~Cl~ai~ri~* Exposure~Rem Stat~ MARE ISLAND NAVAL SHIPYARD Machinist 4/63 Skin condition 0 DEFERRED Helper electrician 4/64 Blackouts 0 REJECTED Chemistry Technician 6/65 Cataract 2.961 AWARDED in 1971. The Navy disagrees with this award because the individual's - radiation exposure was well below the level considered necessary to produce cataracts. Experts gen- erally agree that many hundreds of rem are required to cause cataracts. Crane Operator 6/69 Cataract 0 ACTIVE Janitor 2/70 Partial vision 0 REJECTED loss, skin condition Radiation 4/70 Tumor caused ann 11.760 REJECTED Technician amputation Rigger 12/70 Cataract 0.160 REJECTED Crane Operator 12/70 Cataract 0.080 REJECTED Crane Operator 1/71 Cataract 0 REJECTED-PRESENTLY IN APPEAL Marine Machinist 7/71 Cataract 0.580 REJECTED PAGENO="1038" MARE ISLAND NAVAL SHIPYARD (Continued) Lifetime Radiation Occupation Date Filed Injury Claim Exposure-Rem Status* Shipfitter 9/71 Cataract from 3.441 AWARDED in 1977. The Navy Disagrees steam generator with this award because repair work radiation-caused cataracts generally start in the posterior part of the lens. The claimant's cataracts started in the anterior portion of the lens. In addition the claimant's radiation exposure was well below the threshold level considered necessary to produce cataracts. Crane Operator 1/72 Cataract 0 REJECTED Sand Blaster 3/72 Hearing Loss 0 REJECTED Rigger 5/73 Eye Trouble 1.015 REJECTED-PRESENTLY IN APPEAL Electrician 2/74 Skin problem on 0 ACTIVE hand Component cleaner 3/74 Radiation face burn 26.213 ACIIVE Pipefitter 5/75 Eye trouble 0.060 ACTIVE Industrial cleaner 1/76 Internal injuries, 11.430 REJECTED blood changes Laborer 2/76 Heart Condition 0 ACTIVE Health Physicist 11/76 Chest cancer 2.331 ACTIVE PAGENO="1039" MARE ISLAND NAVAL SHIPYARD (Continued) Occupation Painter Lagger 2/77 Security guard 4/77 Insulator 6/78 Optical Instrument 11/78 Technician PUGET SOUND NAVAL SHIPYARD Welder 6/71 Radiation monitor 9/71 Metal inspector 9/72 Cement finisher 4/74 Shipfitter Sheet Metal Worker 12/74 ACTIVE REJECTED-PRESENTLY IN APPEAL ACTIVE ACTIVE Date Filed 12/76 Lifetime Radiation Iniurv Claim Exposure-Rem Status* ACTIVE Claustrophobia and 0.330 Mental disorder Lung disease 7.003 Brain tumor 0.016 Heart Attack 3.671 Leukemia 0 Leukemia Stomach cancer Cataract Emphysema-many causes including radiation 0.079 10.566 29.655 0 0 10/74 Lung ailment-many causes REJECTED REJECTED REJECTED REJECTED REJECTED-PRESENTLY IN APPEAL REJECTED Bronchitis, emphy- 0 sema-nany causes Bronchitis-many causes Pipefitter 12/74 0.064 REJECTED PAGENO="1040" PUGET SC*JND NAVAL SHIPYARD (Continued) Lifetime Radiation Occupation Date Filed Injury Claim Exposure-Rem Status* Pipefitter 12/74 Epilepsy - 9.548 REJECTED many causes Machinist 3/75 Cataract 0 REJECTED Materials Engineer 1/76 Lung injury- 0.037 REJECTED many causes Shipfitter 12/75 Stress from radio- 5.247 REJECTED and logical written 7/76 examinations and nuclear work Radiographer 1/77 Lymphocytosis 16.529 REJECTED Shipfitter 11/77 Leukemia 0.059 ACTIVE INGALLS SHIPBUILDING NONE PEARL HARBOR NAVAL SHIPYARD Leukemia 0.020 REJECTED Pipefitter 2/70 Electronic Mechanic 8/73 Upset metabolism 0.180 DEFERRED Mechanic 11/74 Leukemia 6.140 REJECTED PAGENO="1041" 1037 Admiral RICKOVER. As identified in the document, since 1967 no civilian or military personnel in the Navy's nuclear propulsion program have exceeded the quarterly Federal limit of 3 rem or an annual radiation exposure limit of 5 rem. The average annual exposure of shipyard workers in 1978 was one quarter of a rem. This document also outlines many of the measures implemented to achieve the record of occupational radiation exposure we have attained. I believe both reports will be of value to the purpose of this hearing, because they convey something of the kind of care and attention to detail we have taken in order to maintain a level of assurance that both the public and the people in the program are protected. THREE MILE ISLAND INCIDENT Since the incident at the Three Mile Island site, I have been asked by many people to comment. There are several reasons why I have not done this. First, all the facts are not in, and it would be presumptuous on my part to make judgments on such a highly complex subject when I do not have the facts. Second, there are significant differences between the design and operation of naval reactors and plants such as the Three Mile Island plant. I want to weigh all aspects of the incident and see if there is anything from it I can learn and incorporate into the naval pro- gram. This is the way I have always operated. Another important aspect is the legal issue involved. It is yet to be decided who will pay all the various costs for the incident. It would not be appropriate for a Government employee such as myself to be issuing pronouncements on the incident when there may be litigation. One thing I can assure you of, Mr. Chairman, it is a bonanza for the lawyers of this country. This is the greatest thing that has happened to them in a long time. BASIC PRINCIPLES OF NAVAL REACTORS PROGRAM There are, however, a number of facts which have been released by the Nuclear Regulatory Commission regarding Three Mile Island. These facts seem to me to reinforce many of the underlying basic principles of the naval reactors program. Over the years, many people have asked me how I run the naval reactors program, so that they might find some benefit for their own work. I am always chagrined at the tendency of people to expect that I have a simple, easy gimmick that makes my program function. They are disappointed when they find out there is none. This reminds me many years ago when the space program was in full tilt, an Air Force general telephoned me from California and said he was coming to duty with the space program in the Air Force in Washington, and he wanted to stop by for a half hour to talk to me about how I ran my program. I said what you want is to learn how to be emperor in a half hour; I think you are just going to waste your time and you already know more than that anyhow. He never called on me. By the way, 48-721 0 - 79 - 66 PAGENO="1042" 1038 he was put in charge of the Air Force program, without any benefit from me. Any successful program functions as an integrated whole of many factors. Trying to select one aspect as the key one will not work. Each element depends on all the other elements. That is a very important factor; you have to consider the whole ball of wax. It has to be concentrated altogether or it will not work. You cannot point to any one fact and that is what people are trying to do. They think there are simple solutions to complex problems. There are none. It's like when you first come to Congress and you go to one of.the older Members and ask him for the secret. The real secret is to get re-elected. It's not what anyone can tell you. Mr. MCCORMACK. Admiral, would you excuse me, please? We have to go vote and I would like to declare about a 10 minute recess and we will come back. Admiral RIcK0vER. Yes, sir. Mr. MCCORMACK. Thank you. [A short recess was taken.] Mr. MCCORMACK. We will resume with the testimony of Admiral Rickover. I believe, Admiral, you were on page 7, were you not, in your testimony; is that correct? Admiral RIcK0vER. I am at the bottom of page 6. You stand corrected, sir. Mr. MCCORMACK. I stand corrected. Admiral RICKOVER. May I continue? Mr. MCCORMACK. Please do. Admiral RICKOVER. I recall once several years ago an admiral whose conventionally powered ships were suffering serious engi- neering problems asked me for a copy of one specific procedure I used to identify equipment which was not operating properly. He believed that would solve his problem, but it did not. That admiral did not have the vaguest understanding of the problem or how to solve it, he was merely searching for a simple answer, a checkoff list, like that laundry list, that he hoped would magically solve his problem. I cannot overemphasize the importance of this thought in your current deliberations. The problems you face cannot be solved by specifying compliance with one or two simple procedures. Reactor safety requires adherence to a total concept wherein all elements are recognized as important and each is constantly reinforced day after day. That is just like the mother who has to get up every morning and take care of the children every day. She has to feed them, clothe them, send them off to school. People think there is some magical aspect of modern technology, all you have to do is put in a complicated system and it does not require that same daily care over and over again, and this is the speech I make to all of the people in my nuclear program regularly. I refer them to what their wives have to go through. Every day they have to do the same job over and over again. Then just about the time the children grow up and go away, they have some new ones. Excuse this homely philos- ophy. There really is not much difference in nuclear power than there is in any other aspect of life which is handled properly. Mr. MCCORMACK. If itheips us understand. PAGENO="1043" 1039 Admiral RICKOVER. I do not think it helps you understand about children. [Laughter.] I assume you would already know about what your wife really does. You are over here getting a lot of credit and getting in the newspapers and she has to take care of the kids. If she does not do it right then she will get in the newspapers. I see I find some favor with one of the female Congresswomen. She just winked at me, Mr. Chairman. [Laughter.] TECHNICAL COMPETENCE One of the elements needed in solving a complex technical prob- lem is to have the individuals who make the decisions trained in the technology involved. A concept widely accepted in some circles is that all you need is to get a college degree in management and then, regardless of the technical subject, you can apply your man- agement techniques to run any program, including the Presidency, Congress, or the Vatican. This has become a tenet of our modern society, but it is as valid as the once widely held precept that the world is flat. Properly running a sophisticated technical program requires a fundamental understanding of and commitment to the technical aspects of the job and a willingness to pay infinite atten- tion to the technical details. I might add, infinite personal atten- tion. This can only be done by one who understands the details and their implications. The phrase, "The devil is in the details" is especially true for technical work. If you ignore those details and attempt to rely on management techniques or gimmicks you will surely end up with a system that is unmanageable, and problems will be immensely more difficult to solve. At Naval Reactors, I take individuals who are good engineers and make them into managers. They do not manage by gimmicks but rather by knowledge, logic, commonsense, and hard work and experience. RESPONSIBILITY Another essential element is that of responsibility. In the begin- ning of the naval program it was apparent to me that due to the uniqueness of nuclear power and its potential effect on public safety, a new concept of total responsibility had to be established both within the Navy and the then Atomic Energy Commission- AEC. It would not work if one person was responsible for nuclear powerplants in the Navy, and a different person responsible in the AEC. Similarly, it would not work if there was one person in the AEC responsible for the naval program with a different person responsible for the AEC laboratories doing the work for the Naval Reactor Program. It would not work in the Navy if five or six different admirals all had charge of different pieces of the pro- gram, as is often the case in other areas. It would not work if there was one person responsible for research and development, someone else responsible for construction, and another responsible for train- ing and operation, and still another for repair work. This is all compounded by the way our military works, because the people who generally get put in these jobs are there to get the brownie points checked off on their records so they can go up and be advanced for promotion. So they change every 2 or 3 or 4 years. You cannot possibly run any technical work, any organization of PAGENO="1044" 1040 that type, the way our Defelise Department, for example, is being run today. You cannot do it and have an efficient, reliable outfit. You cannot do that. The problem is that these desires and needs of individuals are given precedence over the desires and needs of the organization. It would be analogous to having all brandnew Congressmen and Senators every 2 to 6 years. It could not work very well. There is no residual experience. I am making a pretty important point. This is one reason that we have had whatever success we have had. We have had continuity of personnel. I have several people here, if you were to ask them how long they have been in the program, I have them here today, on the average they have been with me over 20 years. That is the only way we can work. If you do not do that you are not going to have a viable program. I think you can check that with respect to the civilian program to see how that compares. Mr. MCCORMACK. May I interrupt you? You seem to be describ- ing the failure of the Department of Energy. Since you are really close to it, I would like to ask you, is this what you are saying now in the Department of Energy, we have one Assistant Secretary for R. & D., and another one for demonstrations and construction, and another one for commercial applications, another one for consumer protection, another one for environmental protection and public health, and so when you try to get a project going you have to go through every one of them individually in a totally different orga- nization rather than having a goal-oriented group such as you have? It seems to me you are saying this sort of organization will not work. Admiral RICKOVER. No, I did not quite say that. You have to distinguish between the vastness of one organization as com- pared-you cannot have anything as vast as the Department of Energy and concentrate it. What you can do there is to split it up in parts and then concentrate the functions in an individual. You could not possibly take an organization of that magnitude and use the same system. What you can do everywhere is to break the thing up into parts and make long-term individuals responsible, whether it is in the military or civilian aspect. That is what I am merely saying. Mr. MCCORMACK. Thank you. Admiral RICKOVER. I hope that clears up the point, sir. Incidentally, you have present in the audience a very distin- guished man, Congressman Chet Holifield, who was on the original Joint Committee on Atomic Energy, and who probably knew more about this game than anyone in the United States at the time he retired. I must say that without all the help he gave us, without his thorough understanding and sympathy with the program, we could not have reached the stage we are in now. I would like through you to thank him very much. Mr. MCCORMACK. I must say we also have previously recognized Chet Holifield earlier this morning, and I very much agree with what you have said. Admiral RICKOVER. Thank you, sir. Mr. WYDLER. Could I add to that? Although he made a great contribution, no question about it, in the nuclear field, I had the additional great honor of serving under him on the Government PAGENO="1045" 1041 Operations Committee. I can say I never saw a more constructive committee chairman or Member of Congress in all, the years I have served here. He did just remarkable work for the country in get- ting legislation put together out of the committee in a way and fashion that I have never seen the like of. So he was good in all fields. Admiral RICKOVER. I will top you on that. I called him one of the people who was a Renaissance man, a man who is familiar with many things, who knows human nature, who knows what the problems are, and puts all of the weight of his learning and con- science to the job. That is what Chet is. Do you agree with that? Mr. WYDLER. I do indeed. Admiral RICKOVER. You second the motion, he is a Renaissance man. I hope the chairman does, too. This kind of compartmentalization of responsibility is typical in government work, but the practice of having shared responsibility really means that no one is responsible. It reminds me of the figure in Nast's cartoon of the Tweed Ring, where all of the characters stand in a circle, each one pointing his thumb at his neighbor as the responsible person. Unless you can point your finger at the one person who is responsible when something goes wrong, then you have never had anyone really responsible. That is the crucial test of responsibility. Something goes wrong, can you find who is the responsible person? If you cannot do that, then no one has ever been responsible. For these reasons, I did all I could to gain support for my concept of total responsibility. It required that a single position be estab- lished to handle both the Navy and the AEC parts of the job. The reason we had to have it in both organizations is because the Navy did not want nuclear-powered submarines. The Atomic Energy Commission did back it, and we got nearly all of our support and most of our money from the Atomic Energy Commission. That was the reason for having a joint organization, it was forced on us by the U.S. Navy. Particularly the submarine people in the Navy were against atomic power. If you are interested why, I will give you the logic. The logic was that they thought that an atomic submarine would cost 1½ times as much as a conventional submarine. There- fore, we would only get two instead of three submarines and there would only be places for two captains instead of one. That was the main reason behind their opposition, and they continued that oppo- sition for many years until Senator Jackson stepped in and the Senate unilaterally put more submarines into the program. That was the vast cooperation we had from the U.S. Navy in the begin- ning. Mr. MCCORMACK. The Senate owes much to Senator Jackson for this program. The country owes much to Senator Jackson. Admiral RICKOVER. He was there. We certainly do owe him a great deal for his wisdom, for his great intelligence and under- standing not only of things but mostly of people. I am glad that you agree with me on that. I think it might be of value to this subcommittee to outline how this designation of responsibility was derived from the `Atomic Energy Act of 1954, and how it is carried out all the way down to PAGENO="1046" 1042 the ships, whether in construction, operation, or overhaul. I have such an outline and with your permission I would like to include it in the record with my statement. Mr. MCCORMACK. Without objection it will be included at this point. Admiral RICKOVER. I can assure you that having only one indi- vidual responsible for a total program is a unique concept within the Department of Defense. I want to emphasize that throughout this entire period of over 30 years I have had full support from the Congress, mainly through the former Joint Committee on Atomic Energy and the Armed Services and Appropriations Committees, and from the Atomic Energy Commission and its successors, the Energy Research and Development Administration and now the Department of Energy. I have not had such consistent support from the Navy or the Department of Defense. FACING THE FACTS Another principle for successful application of a sophisticated technology is to resist the human inclination to hope that things will work out, despite evidence or suspicions to the contrary. This may seem obvious, but it is a human factor you must be conscious of and actively guard against. It can affect you in subtle ways, particularly when you have spent a lot of time and energy on a project and feel personally responsible for it, and thus somewhat possessive. It is a common human problem and it is not easy to admit what you thought was correct did not turn out that way. If conditions require it, you must face the facts and brutally make needed changes despite significant costs and schedule delays. There have been a number of times during the course of my work, not only in the atomic energy work but in charge of the electrical section of the Navy during the war, that I have made decisions to stop work and redesign or rebuild equipment to provide the needed high degree of assurance or satisfactory performance. The person in charge must personally set the example in this area and require his subordinates to do likewise. Briefly I will say what it is like in a figurative sense. You have to have the guts to kill your own children, if necessary. That is exactly what it amounts to. PRINCIPLES OF DESIGN AND ENGINEERING I will now discuss in detail the underlying basic principles of the naval reactors program. From the very beginning of the naval nuclear propulsion pro- gram I recognized that there were a large number of engineering problems in putting a naval reactor into a submarine. Some prob- lems were unique to submarine application, and some to the gener- al problem of making a reactor plant work. I realized at the time that the use of nuclear power, as with any new sophisticated tech- nology, would require the institution of novel requirements and standards. I realized that these requirements would necessarily be difficult to meet, and the standards would need to be more strin- gent than those which had been used in power plants up to that time. But when you are at the frontiers of science you must be prepared to accept the discipline this requires in order to proceed. PAGENO="1047" 1043 The fact that the application of nuclear power was almost entirely an engineering problem-not a problem of nuclear physics, as nearly all of the experts then believed-was clear to me. The emphasis I have placed on sound, conservative engineering has been a major factor in the performance of our plants. I should point out that in the late 1940's and early 1950's, when the original naval nuclear propulsion plant design studies began, there were no standards, design guides, or codes available. They had to be developed. Due to the military application, these design criteria included considerations of reliability, battle damage, high shock, and the close proximity of the crew to the reactor plant~ The propulsion plant design had to be readily maintainable so possible equipment failures at sea could be repaired. The fact that major maintenance operations would be infrequent and refueling possibly as seldom as once in a ship's lifetime required that standards for materials and systems be very rigorous and that only premium products which had a proven pedigree could be considered for use. My design objective is and has been to provide a warship that can be relied upon to perform its mission and return. You may be interested in knowing practically all the standards used in the entire nuclear program originally were developed in the naval program. That is even true of the manufacturers. At the height of the naval program, many years ago, I deliberately had at least three separate companies competing for the same job. That indus- try was established for the naval program and part of it is still left for the civilian program. So I had a problem there of not only building the ship, I had to set the standards and create an industry to support the work. I would like to add here an interesting point, which perhaps is not known to you. When I started out with a company, let us take Westinghouse, which is the first one, I held a series of 20 lectures for all the top officials of the Westinghouse Co., including the president and chairman of the board. I did the same for General Electric and for many other companies, and that way I got the top people in the company to understand what the naval effort was all about. I think it would be worthwhile your checking into the civilian program to see whether the people who operate these plants and the top officials have had any kind of similar training to under- stand what it is all about. This is one suggestion I can give you that may be worthwhile. CONSERVATISM OF DESIGN I will explain some of the elements of good engineering as I have applied them to the reactor plants for which I am responsible. First, in any engineering endeavor, and particularly in an ad- vanced field such as nuclear power, conservatism is necessary, so as to allow for possible unknown and unforeseen effects. This con- servatism must be built into the design from the very beginning. If the basic design is not conservative, it quickly becomes impractica- ble to provide the needed conservatism. Here is an important point. It then becomes necessary to add complexities to the system in an attempt to compensate for the inadequacies of the basic design. PAGENO="1048" 1044 These complexities, in turn, serve to reduce conservatism and reli- ability. I have called that the elephant system. You see carvings, 1 big elephant followed by 20 increasingly smaller elephants. In a lot of designs, they get into a problem and instead of trying to change the top elephant they add other elephants. That means you have more elephants to feed, more to take care of, and so on. That is an analogy that I think is worth your considering, the elephant system. I must make it clear that the military requirements which must be met by naval propulsion reactors are far more exacting than those which central station plants must endure. For example, the shock loadings for which naval plants are designed are far greater than the earthquake shock loadings for civilian plants. In addition, naval plants must be able to accommodate power transients much more rapidly than civilian plants. We are faced with this all the time. A ship is steaming along and you ring up a bell and it has to be answered immediately. They are not faced with that problem, because you have got plenty of time to change your power in commercial plants. Generally it is scheduled. Ours are all com- pletely unscheduled and must be answered immediately if the ship is to remain safely submerged. Each naval vessel depends entirely on its own reactor plant for the capability to perform its mission. For a ship there is no inter- connected grid to pick up the load and allow the ship to continue functioning. The stringent requirements of operating a ship at sea are reflected in a conservative design with a large overall design margin in almost every element of the plant. Some specific examples of the conservatism in design which I have used are: Use of ordinary water of high purity as the reactor coolant. Water has been widely used in industrial applications; its proper- ties are well-known, and when irradiated, has short-lived radioac- tivity. Use of conservative limits for systems and equipment. Design is based on the worst credible set of circumstances, rather than rely- ing on a statistical approach which deals in average or probable conditions. Provision in the design for redundancy so that failure of one component, or one portion of a system, will not result in shutting the plant down, or in damage to the reactor. Design of the reactor plant to enable it to accommodate expected transients, without the need for immediate operator action. This means the plant is inherently stable, and helps the operator when there is an unusual transient. Simple system design, so that minimum reliance must be placed on automatic control. Reliance is primarily placed on direct opera- tor control. Selection of materials with which there is known experience for the type of application intended and which, insofar as practicable, do not require special controls for procurement, fabrication, and maintenance which could lead to problems if not properly accom- plished. PAGENO="1049" 1045 Use of a land-based prototype of the same design as the ship- board plant, and that is extremely important. This prototype plant can be tested and subjected to the potential transients a shipboard plant will experience prior to operation of the shipboard plant. I made that decision at the very beginning in the 1940's that I would not put a ship to sea, I would first build a real, honest-to-God identical plant onshore. Meanwhile, we started building the Nauti- lus while we were building and operating the prototype and we learned many lessons on the prototype which were incorporated into the Nautilus. I think that was a farsighted and essential decision I made. Use of extensive analyses, full scale mockups, and tests to con- firm the design. We do that for the entire ship, and it never used to be done in the Navy, that is to have a full scale model of the machinery part of ships. We have had a complete, full scale, wooden mockup of every machinery plant in any nuclear powered ship, whether it's a submarine, aircraft carrier, or cruiser, or any- thing else, we have always done that because scale mockups are very deceptive. I have seen mockups of factories and they are very deceptive. The human eye is not capable, even in a quarter scale mockup, of seeing things properly. It's a very interesting thing, and so we have always used full scale mockups, with the slightest thing, every nut, every piece of cable, everything exactly the way it is on the ship. The people who are building the ship can go right in there and see how it is supposed to be. It's expensive, but it's essential. Strict control of manufacture of all equipment, including exten- sive inspections by specially trained inspectors. We have our own corps of inspectors. We have taken people from the regular Depart- ment of Defense inspection system. They have been assigned to us and we have given them special training in our work. This means that at many points during the manufacture an independent check is required, with signed certification that the step has been com- pleted properly. That is an absolute essential in any part of the program, wheth- er it's an inspection system or whether it's an operating system. We have a legal form which has been approved by the Federal courts. When a man signs the statement on the bottom it says words to this effect-I don't know the exact words-, but, "I hereby certify by my signature that I have actually carried out the thing I have signed for", and he can be legally held accountable for it. I don't know whether that is used anywhere else. We use it even on board ship in our valve checkoff lists. We have a legal document on which a man who does something has to sign his name. Mr. MCCORMACK. Do you do this for routine maintenance, Admi- ral? Admiral RICKOVER. No; that is not a maintenance problem. That is used in inspection, any kind of an inspection, no matter what it is. It is not in maintenance, that is a different thing. But we do have other systems that take care of that. We have checkoff lists in maintenance, and we also have the work supervised and it has to be checked after a job is finished. We find mistakes and we have a system that finds the mistakes. PAGENO="1050" 1046 I am not implying that there are no eyesores in this program, no problems and everything runs all right. It can't anywhere in the world. Any human endeavor is bound to have its problems. But we take precautions to the maximum extent that we can, recognizing you have to deal with human beings and you know what a tough job that is. Providing extensive detailed operating procedures and manuals, I think also is something we excel in. Our manuals and operating procedures are done by experts and it's very carefull.y checked to see that they can be done on board ships. One of the most frequent issues I have in dealing with my own engineers when they write changes in the manual or create something, I say is this sailor- proof. That is, I have to figure if we are getting young men in on these ships who have had very little experience and when you issue an operating instruction are the words such that can be understood by ordinary human beings. I go over every one of these procedures myself and I think you can ask any one of my people in this room and you will find out that is one of the most frequent things I call them on. Can this be understood by a sailor? It's very tempting for engineers and scien- tists to write things which cannot be understood by ordinary human beings, and that is something you have to watch all of the time, and you have to know. I know from my considerable shipboard operating experience what you can really get a young sailor to do, and you have to bear that in mind. I mention I provide extensive detailed operating procedures and manuals prepared and approved by technical people knowledgeable of the plant design. For example, Mr. Wegner; who handles person- nel, has in his office several ex-captains of submarines who look over these things too to see if they are suitable for us onboard ship with the kind of people they have. We don't just arbitrarily issue instructions. They must be checked by responsible people. These manuals are constantly up- dated as we learn from the operations of the many other reactors. What we learn on one plant is incorporated into all our plants, and we have a system for that, for anything that comes in. By the way, I read everything, every report. I require formal reports of anything that goes wrong on any ship. They come to me directly and I read each one of them, and I route them out to other people who are responsible with a system that makes absolutely sure that they will be handled and not forgotten. We keep records on every one of these, so everything that goes wrong is taken care of, not only on that ship but we see if there is any application to any other part of our system. I don't know whether you have that in the civilian program where these things are looked at by people at a central place and effective correction, changes in manuals or changes in equipment is required. This is one thing you could do in a civilian industry, make them responsible to have some system of this kind. I think this may come up in questioning. I am almost through now. PAGENO="1051" 1047 Use of frequent, thorough, and detailed audits of all aspects of the program by individuals who are specifically selected and trained. We regularly send our most competent people from headquarters for a week to a Navy yard or shipyard to make a very thorough inspection of those who build and repair the ships. We have inspec- tion boards out in the fleet whose sole duty is to go on board ships, and spend several days on any ships to inspect all of the elements of the operation of the propulsion plant. After they do it they report to the fleet commander and to me. I call almost every captain of every ship when the report comes in. If he does not do well I ask him why not and what is he doing about it. As I said I get regular reports from them anyway on their training and everything else that is wrong. Use of formal documentation for design decisions, manufacturing procedures, inspection requirements, and inspection results. In addition to the detailed technical review and approval by my office, the safety aspects of operation of naval nuclear powered ships are independently reviewed by the Nuclear Regulatory Com- mission and the Advisory Committee on Reactor Safeguards. APPROACH TO NEW REACTORS Now, the last part of my testimony will be the approach to new reactors. The kind of engineering approach I have just outlined is, in my opinion, why the naval reactors program has resulted in safe, reliable nuclear power. To the casual reader much of what I have said may appear obvious. But I assure you it is not when you try to carry out these concepts in every day work. I have encountered many cases where these ideas are ignored or not understood. I have, on many occasions, reviewed proposals for smaller, lighter, and cheaper reactors. This is a very frequent thing coming in all of the time from the Navy and system analysts-they advocate smaller, lighter, and cheaper reactors. While such proposals have covered a wide variety of concepts, they have been completely consistent in one respect; they have all involved the sacrifice of sound, conservative engineering to achieve a design theoretically having better performance. They each violat- ed most if not all of the engineering principles I have just dis- cussed. If there has been one consistent thing in the program from some line officers in the Navy, it is this. I once saw a cartoon about a lot of admirals sitting around the table and saying, "If he only wanted to, he could design a small, cheaper one." In other words, they believe it's an obstinacy on my part not to do it. Instead it is an absolute certainty because I am responsible for the safety of the ships and the people. They don't know enough about it. The idea stems from electron- ics. Over a period of many years now they have finally gotten down to little diodes and they have an idea you can do that with machin- ery too. You cannot; they do not understand one fundamental of engineering-in an engineering plant you have to dissipate heat. So you have condensers and if you put out a smaller, more power- PAGENO="1052" 1048 ful plant, you still have to dissipate the same amount of heat. You cannot avoid it. But they also avoid all of the safety aspects, the idea being they will be designed later or excluded but, the more difficult the design the more safety will be necessary. Now, you can understand it but I cannot get people in the Navy to understand it. So every 2 years or so we are bombarded with this and a lot of money is spent and it wastes our time fighting the idea of getting little plants that put out the same power as the big ones and would be more reliable. We just don't understand how people can believe this but yet this is not true in the Energy Department or the AEC. They have never done it; they are far more realistic. But in the Navy we get these 2 and 3 year people in who say this is a good thing, therefore, you ought to have it. This is a very important point because if you didn't have a long time organization with people who know the facts we would have attempted all kinds of things and they would all have been fail- ures. There is no question in my mind about that. But we are con- stantly bombarded on this issue and I don't know how to get around it. This is the only forum I have. I cannot find the people in the Navy that will believe this because they are used to believing in magic, and you have to in 2 or 3 year jobs; it's the only way you can make your name. These cheap ones all violate most, if not all, of the engineering principles I have just discussed. They would all have been in my opinion unsafe and unsatisfactory for naval warship application. How often have you known of cases where in the fervor of winning contracts, firms will promise all kinds of performance, only to be found incapable of delivering it when they try to make the equip- ment work. By this, I do not mean we should not make improvements. We have. But at all stages you must proceed in accordance with sound, conservative engineering practices if you are to produce something that will work instead of something that is just an expensive piece of unreliable and unsafe junk. As an example, I have often been pressed to reduce radiation shielding-that's a good one-to make new ships smaller and light- er. However, if I removed 100 tons of radiation shielding from a typical submarine, the ship would be only 2 percent lighter. But the radiation exposures to ship personnel would increase to 10 times the current levels. I have not agreed to reducing shielding because I believe radiation exposure to personnel should be as low as I can reasonably obtain. In fact, I am telling you informally, there was one Chief of the Bureau that wanted me to reduce the shielding, and his reason was, "People will learn to live with radiation." That's right. Now, don't think I am making a statement that I cannot verify. If necessary, I can supply it for the record. NAVAL NUCLEAR TRAINING Another element in my approach to safe operation of naval reactor plants involves the selection and training of the. operators. PAGENO="1053" 1049 I consider the training of officers and men to be at least as impor- tant as any other element of the Navy nuclear power program. I think now I am beginning to hit on what you are mostly interested in. I consider it of the greatest importance that the mental abilities, qualities of judgment, and level of training, be commensurate with the responsibility involved in operating a nuclear reactor. The selection of personnel and their training in the Naval nuclear power program are carried out with these considerations in mind. Academic ability, personal character as demonstrated by any acts reflecting unreliability and honest desire for the nuclear pro- gram are all taken into account in selection of personnel. Once selected for the Naval nuclear power program, the individual is continually subject to review. To accomplish these objectives, I require a one year training period prior to an operator going on board his first nuclear ship. The first 6 months of nuclear power training are spent at nuclear power school in Orlando, Fla., where the curriculum concentrates on the theoretical basis for shipboard systems. You might wonder why it was Orlando. It was because one Congressman on a commit- tee, a very senior one, came from there. What are you laughing at? Mr. MCCORMACK. I am just wondering if you enjoy it anyway. Is it a good site anyway? Admiral RICKOVER. The first 6 months are at Orlando. Upon graduation from nuclear power school the student reports to one of our land-based prototype plants where he learns to actually oper- ate the propulsion plant. There the student must demonstrate that he can operate the plant under normal and casualty conditions, and he is taught to operate in strict compliance with detailed operating and casualty procedures. I established the naval nuclear power training program on a base of rigid high standards. My staff at Naval Reactors Headquar- ters approves the curriculum at nuclear power school and the qualification guides used to develop the prototype and shipboard operator qualification programs. This insures that the standards are not reduced by someone who does not understand the overall goals of the program, and that the individuals responsible for the design and construction of the reactor plant systems are involved in the training considerations on that system. The methods we use in training involve lectures, seminars, homework assignments and both oral and written examinations. We also require operators to be able to demonstrate their practical knowledge in order to become qualified at the land-based proto- type, which, as you know, is completely identical with the one on the ship. These individuals must subsequently qualify on board ship. I am not satisfied with bringing an operator to a qualified level once and then forgetting about him. Therefore, we continually reinforce theoretical and practical training with a continuing train- ing program on board ship. We have it on board ship but, of course, at the prototype it goes on all day long. But we do it at the ship also. This includes frequent practice in plant evolutions and casual- ty drills. PAGENO="1054" 1050 The examinations given must be tough and must be approved by a competent person in authority. Instructors are trained so that they are capable of correctly instructing the student. Instructors, as well as students, are monitored. We monitor the instructors too. InspectiOns of personnel in the fleet are conducted by members of my staff, both those in the field and from headquarters, by the Fleet Nuclear Propulsion Examining Boards established by the Chief of Naval Operations and by nuclear trained personnel on various other naval staffs. I review the results of all their inspec- tions. When I say, "I", my organization reviews the results too. But when I say, "I" that means me, personally. I want to tell you that word "I" is not used loosely or in any figurative manner. I have established a formal system of reporting propulsion plant problems which identifies areas which need improvement in the training program. I also require the Commanding Officer of each nuclear powered ship to write me periodically concerning propul- sion plant problems. These letters contain a summary of the training he has conducted and allow me to personally check the adequacy. The frequency of these letters is every 2 weeks for ships in overhaul; for ships operating like Polaris submarines, it's every 3 months, and the report outlines in detail everything that has hap- pened on the ship, all of the problems. I get individual copies of reports, and a complete list of the training; it includes each day's training, the number of people who were given training, what the subject was, who did the training and who monitored and how long it lasted. There is a standard form so I can judge how much training we are doing. Because training is so important I want to provide a much more detailed description of what we do for your record. I know you don't have time now to read it, but I hope you do read it finally. MISTAKES MUST BE TAKEN INTO ACCOUNT Now, mistakes must be taken into account. What I have present- ed at this point represents the main substance of my statement. In it I have outlined what I do in running the naval reactors program. Even when these measures are carried out it is important to recog- nize that mistakes will be made, because we are dealing with machines and they cannot be made perfect. The human body is God's finest creation and yet we get sick. If we cannot have perfect human beings then why should we expect, philosophically, that machines designed by human beings will be more perfect than their creators? That is a great fallacy today in modern technology, with all of the articles written and with un- knowledgeable newspaper reporters we are being given the impres- sion that a machine can do a job better than a man. Now, some things it can do better, like doing computations, but for all practical work the machine cannot be better than a human being; it's impossible because the human being made it. This is what many unthinking people demand even though the Lord himself did not reach this height. I believe if you follow the practices of conservative engineering and personnel training I have outlined and if you carry them out with steadfast commitment, PAGENO="1055" 1051 nuclear power can be safely used, even taking into account mis- takes that will inevitably occur. That is the basis on which I have conducted all my work in this field and I believe it true just as strongly today as I ever have. DECISION ON NUCLEAR POWER As well as anyone in this room, I recognize that nuclear power is a very difficult subject for anyone to deal with. It involves energy, a vital element in our Nation's future; it involves individuals' concerns for themselves and their families, and it is a highly technical, sophisticated technology. Ultimately, the decision as to whether we will have nuclear power is a political one, in the true sense of the word, that is, one made by the people through their elected representatives, and that means all of you. It is vital that the decision be made on the basis of fact, not rhetoric, not conjecture or hope, or as a result of the widespread tendency to sensationalize the current topic and ignore the real limits or risks of the alternative. NUCL~AR POWER SENSATIONALIZED The press is avid for sensationalizing everything that happens, and you also know about many of these people who call themselves Ph. D.'s who have never gotten recognition in their fields, but who can seize on radiation and make a lot of political hay out of it. They are doing a great deal of harm. They are making exagger- ated statements. For the first time in their lives they are getting publicity and that is what they want. They are not really interest- ed in health; they are really interested in getting publicity for themselves and becoming spokesmen. This is one thing I am sure you and your members are aware of, Mr. Chairman, and you have got to be very careful about it and I accuse the press of over-sensationalizing everything connected with atomic power. It's a favorite thing for them to do, and I would urge the editors of the papers to act in a more responsible manner. For example, in Norfolk somebody sees a sailor dump a bucket of water off the stern of an aircraft carrier and immediately there is a headline, "Radioactive water poured into Norfolk Harbor." The guy had washed his socks in it and he poured the water overboard; yet that is immediately reported as nuclear water. And we have that sort of nonsense happening all of the time. You might think, well, that's funny. But it really is not funny. You, in all your wisdom, have created a Freedom of Information Act. What you have created is a monster. I hope you would apply it to Congress and then you would change the law. It takes all of the time of our top people; we have become essentially information agencies. Our time is taken up with answering these questions that anyone can ask. We are required by law to answer them within 10 days, and that has become the biggest preoccupation of people in Government. PAGENO="1056" 1052 First, we are all known to be dishonest; that is accepted by the press and by the people, that all government servants are dishon- est. Next we have to answer any questions that are asked. For example, supposing a fraud case is lodged against a compa- ny. That company has a way -to get many of the Government documents before it even goes on trial. They try, through the Freedom of Information Act, to get the Government's case, but that is only a detail. The worst is we are constantly flooded with these requests for information that ties up all of our people, and I can assure you from personal experience that it's almost impossible to do any constructive work anymore. The Government has now become an information handout agency and I strongly urge, based on what- ever experience I have derived in my job, that you really ought to do something about that. I am not saying that Government agencies should not be respon- sible, but there should be a formal way and you should treat us the same way you treat Congress, which you are not doing. If you had to be faced with that in Congress you never could work, and you never would work. On top of the Freedom of Infor- mation Act we have the vast proliferation of congressional staffs and every new member on a staff, has to make his way. So he gets it by taking on the executive branch. Fine; you can have your way, but what are you ending up with? Now, I am probably the only one who can talk as frankly as that to you, but I think you have got a real problem and you ought to face it. Mr. MCCORMACK. Admiral Rickover, we want to thank you for your testimony. Admiral RICKOVER. I have not finished yet. I may take some other cracks at you. Mr. MCCORMACK. Please proceed. JUDGMENT ON NUCLEAR POWER Admiral RICKOVER. I am not an expert or even particularly knowledgeable in the areas of environmental effects of other forms of power generation. However, I am aware that a good many knowledgeable people conclude that the total risk involved in the use of nuclear power is no greater than is involved in the use of any alternate source which can be tapped in the next 50 years. I also remember the optimistic projections made for nuclear power when it was first being developed. These sprang from hope and from ignorance of the real engineering problems that would be encountered in using nuclear power. There is no reason to believe that current projections for alter- nate means of providing large amounts of power are any more precise. In fact, the more you study power from the Sun and other sources you will find you can run into exactly the same problems. Any large scale generation of power involves major engineering difficulties and potential environmental impacts. The job of this committee and the Congress in the days ahead will not be easy. I hope and pray you will find the strength and wisdom to make the right decisions. PAGENO="1057" 1053 I also hope that my testimony will in some way contribute to your difficult deliberations. This is a point you want to remember. Anything that you don't have yet is touted as safe. Yet if you get into the environmental aspects of coal, and of other things, you are going to have the same or similar problems as nuclear power. So, you have to make up your mind, do you want advantages. If you do want an easier way of life, you are going to pay for it in one form or another. You have to make up your mind. PERSPECTIVE ON RADIATION For example, right here in the Capitol you have one place where the radiation is greater on account of the stone you have here than we allow the navy yard people to have. If you don't like anybody, stand them up in that place. Mr. MCCORMACK. Now, Admiral, I want to say thank you again. I want to say, by the way-- Admiral RICKOVER. Thank you for listening to all my comments, particularly on Congress. Mr. MCCORMACK. We appreciate them. I might say that I have had a survey done of the radiation levels in the Capitol Building. The radiation levels in a number of places around Capitol Hill, because of stone construction, are higher than those at the gates of nuclear powerplants. I am sure that they are higher than the radiation levels in the operating rooms of the naval nuclear powerplants, too. This is a point that is not generally understood by the public, background radiation in many areas, just because of stone build- ings, is higher than nuclear powerplants. As a matter of fact, you mentioned the stone in this building. At the Vanderbilt entrance at Grand Central Station in New York City the radiation level is 500 times higher than it is at the gate of a nuclear powerplant. Admiral RICKOVER. There is a political impact of this, too. I once told a Member of the Congressional Delegation of New Hampshire that they talked too much about this. If the tourists found out that radiation was given off by all the stone up in that State, that it might deter tourists, and he never said much after that. APPROACH TO TRAINING Mr. MCCORMACK. Admiral, I would like to ask you a couple of questions about this basic approach to training nuclear powerplant operators. You have talked in your presentation today about your programs in the nuclear Navy. By inference you have drawn a contrast between the high standards of disciplines and rigid programs for training and qualification and requalification that you have always maintained and what may not be those high standards in the commercial world. The testimony that we have received so far indicates that those high standards are not maintained, at least in some instances, in nuclear powerplants, and indeed this may have been a significant contributing factor to the accident at the Three Mile Island plant. 48-721 0 - 79 - 67 PAGENO="1058" 1054 I would like to ask you if you believe that it is realistic or possible or practical to establish these kinds of standards for com- mercial nuclear powerplant operation? Do you believe that it is practical for us-I hope you say yes, I would like to have your honest appraisal-do you believe it is practical for us to have, for instance, high academic qualifications and achievement for nuclear powerplant operators? Can we establish the same kind of rigid training programs, the high degree of intellectual discipline, the same standards for past conduct, the same standards for substantive evaluation of the atti- tudes, and the same programs for continual reevaluation and the same programs for removal of a license to operate if they do not meet these qualifications? This seems to us to be a critical element in the nuclear power program in this country today. I would like to ask you if you believe we could establish these within the commercial nuclear power program? Admiral RICKOVER. I assume you have read the 70 or 80 addition- al pages of my statement which goes in vast detail into the train- ing detail. Again, I suggest if any members have not read it you should because that is the guts of the. whole thing. All I have done this moring is outline it. Yes, I think it can be done, but here in this program we have central personalized control. In the utility program you don't. UTILITY ACTIONS First, as most or nearly all utilities are operated, the top man is either a banker, a lawyer or an accountant. He doesn't have the technical expertise. Step one, I mentioned I would take steps to get them to have some detailed knowledge of what their product is and how it is achieved. I think that is essential for any business. On the other hand, most people today in large conglomerates are interested in the bottom line, how do you make money. If you start anything that costs more money they generally will object to it. Therefore, whatever standards you set up must be the same throughout. Ultimately, the people are going to have to pay for it one way or the other. If you want nuclear safety you have to have this kind of training. Now, naturally, over a period of many, many years I have given a lot of thought to this same question and I have made suggestions at various times. One, the obvious thing, why not let the Govern- ment train all the people? That is wrong. The Government has already undertaken so many things which it shouldn't and which should be done by the people in private industry. I have advocated we stop all the nonsense and that each child at birth be given a welfare certificate, a pension certificate and diploma from an Ivy League college, and stop all the nonsense that we are doing. If we keep on the way we are going, I don't know where we are going to get all the money. Take all the radiation injury claims. Anyone can apply now for any type of disease. We might as well stop the nonsense and give everybody a pension at birth. PAGENO="1059" 1055 Now, here is what I would do. I don't believe in a government doing it. I would have the utility industry set up a group of their own people, charged with this responsibility of seeing to it that they get the proper people, that they are trained properly and to conduct their own inspections. I am not saying inspections should not also be conducted by a Government agency, but I would have the utility industry police it. They had the origin of the idea in the National Electric Light Association-it was an old organization which was generally a trade promotion agency-which was to educate people in how to use more electricity. That is what its primary function was. I would change that around to take on this job and that could be done. Make the utilities responsible. At the same time, you have a regulatory commission, have them check into it. But for the Gov- ernment to take on this function is dead wrong. I think the Government should stay out of it as much as it can in order to carry out our basic political principles and not ultimately become like the Russians. It can be done. So what I would do, to be specific, you could do that very well, your committee, you could have a meeting of the top people in the utility industry, tell them the problems you see and ask them what they are going to do about it. That is a simple answer, but it carries in it the idea which will help solve this problem. As far as training is concerned, if they wish to find out how to do it, they can, we will tell them what we do, it is part of the United States and we would be glad to show them what we do. Mr. MCCORMACK. Thank you. Mr. Wydler? Admiral RICKOVER. I haven't given you a detailed answer. Mr. MCCORMACK. Yes, I think you have answered it. Fundamen- tally you are saying we have to establish some sort of program for the-- Admiral RICKOVER. For the industry. NRC ACTIONS Mr. MCCORMACK. Let me ask you one very quick question. Would you believe that it would be a good idea for the NRC then to appoint some sort of a Hyman Rickover within the NRC family to see to it that these programs are carried out, be responsible for approving qualifications, approving examinations and this sort of thing? Admiral RICKOVER. One Hyman Rickover is enough for the United States. You have to let them work that out themselves. The graveyards are full of indispensable people. There is no one person that you have to have do it. The idea is very simple. You cannot afford to have transient management. That is why the utility industry has to do it and they can set up standards and pay their people properly that they will get some permanent people. If they are going to have a guy come in and out every year or so, it will never work. It will not work as a technical and administra- tive outfit. That is what they are going to do if you let them alone. PAGENO="1060" 1056 Therefore, there must be a form of inspection by somebody and, yes, you could turn that over as a function of the regulatory agency to see that this is complied with. It is certainly within their power tO do it, let them set it up, they have some permanent people. But it must basically be done by the industry itself. Mr. MCCORMACK. Thank you. Mr. Wydler? Mr. WYDLER. Admiral, the testimony you gave here today was excellent, and frankly, I think the facts you have given us about the existence of your program is proof positive to the American public that we can handle atomic power and live with atomic power in a safe and reasonable fashion, if we go about it in a very deliberate way, as you have done in the naval program. I get letters from people in this area, not many, but some, and they are all upset. They found out they are living within 50 miles of a nuclear reactor and they seem very uptight about that, like some part of their life is going to be changed as a result. When I think about the fact that your personnel have to go down in a rather small containment vessel and right in the vessel, under- neath the waters off the ocean, and live with the reactor-- Admiral RICKOVER. They nearly always get less radiation than they get if they are ashore. Mr. WYDLER [continuing]. And live with it for long periods under- water and yet you don't seem to be hysterical about it. As far as I can find out, there have been no adverse effects. That is th~ first question I have to ask you. Admiral RICKOVER. We have had none. Mr. WYDLER. What are, if any, the adverse effects in the sense of unusual sickness of any kind to the Naval personnel who are aboard the atomic submarines of our country, or who have been on duty and continued to be on duty right to this time? Admiral RICKOVER. We have had none. We have had publicists that have talked about cancer deaths from the original crew of the Nautilus. This is where I get back to the media. I think that they have taken a very irresponsible atti- tude toward the public and I suggest that this committee address the editors and tell them what they are doing to the public. They are scaring the hell out of the public unnecessarily and also the pseudo Ph. D.'s that are running around and getting their names in the paper, they are doing a great deal of harm. MISTAKES AT THREE MILE ISLAND Mr. WYDLER. We were told to get specific about Three Mile Island. One of the things that happened-and there was a long sequence of mistakes that were made-was that a couple of valves had been shut. We were told that these were on the auxiliary feed pumps of the water system. We were further told that when valves were shut there was a dial of some kind, or an indicator lamp or gage of some kind in the control room which indicated the fact that the valves were shut. We were further told that about four or five shifts of control room personnel came on and went off duty while these indicator lights were in the wrong position. We were further told the posi- PAGENO="1061" 1057 tion they were on was green. That meant danger. I didn't quite understand that. Admiral RICKOVER. What was the last part? They were green? Mr. WYDLER. The lights were green when they should have been red. Apparently, if the system is in the wrong position on this particular system, the light is green. Anyway, that is what they told us. Admiral RICKOVER. Can I interrupt you to tell you a story about the girl who went in the drugstore and asked for some green lipstick. The druggist looked around and said, "Lady, I am sorry, we don't have any. We only have red. Do you mind if I ask you why?" "My boyfriend is a taxi driver and he stops when he sees red." Apparently they changed. I see even your lady member is smil- ing. They had their gages. The universal: thing on gages is green is a sort of go ahead. Mr. WYDLER. It has always been to me. In this case, apparently the trained personnel should know it should be red instead of green, I guess, but the fact of the matter is these shifts came on and went off and came on and went off, came on and went off, and nobody even noticed it. Could that happen on a Navy ship? NAVY DIFFERENCES Admiral RICKOVER. I don't want to create the impression that the U.S. Navy and particularly the nuclear powered Navy is the per- fect creation of the Lord. It is not. Even I am not infallible. Now, in the first place, we have some differences between civil- ian plants. We have a trained officer supervisor, an officer in charge of each watch. The only sailors who are allowed to stand watch are those who have been trained. If we are teaching somebody, he stands along with the trained man. We do not have any unqualified people standing watch. We keep logs. When a new officer goes on watch and relieves the first one, he finds out all that is going on, he assures himself it is all right, and then he says I relieve you. He doesn't relieve him while there is anything wrong unless he accepts it. There is a constant transfer of that information. We require it. We furthermore require everything to be entered in the log. Mr. WYDLER. When a shift comes on, do they check all the instruments to see that everything is normal or as it should be? Admiral RICKOVER. No, they don't check everything but what we do, we don't depend on a remote operation. We have people sta- tioned in the engineroom. We have several people on watch who check things as they go on duty. But you can't take every one of thousands of valves and check it. After all, the ship is operating. Before you get underway you have a checkoff list where you check every valve that is going to be used and it is checked by two people and each one of them must sign his initial on each valve. Sometimes they don't do that. Sometimes they just look at the other guy and they think the valve is open. We have that happen, too. But before we get underway we try out the plant, and this sort of thing shows up. PAGENO="1062" 1058 We have things happen, too. I do not want you to think that we have a perfect operation. It would be a wrong concept, but we do train our people to check things and they quickly find out if something is wrong. For example, take the case of the water level in the reactor. I thought you might ask me that question so I will come to it right now. There is no direct indication of reactor water level but we have gages which show temperature and pressure, and if the man is trained he can tell what the level is. That is what we do. We do it through people training. We have cases where you can't get the answer directly from a gage, we train them, and further- more, we generally have duplicate gages on most things so if one goes wrong, we have another. We have a lot of duplication that way. But the basic thing we depend on is training of people. After a man gets trained on a prototype, he then, as I men- tioned-you may not have the import of what I said-he gets to a ship and has to spend several weeks qualifying all over again on that ship even if the plant is the same. What I am getting at is I don't believe you have what I would call the infinite attention to detail which we do and we require. We require keeping records. We require reporting. We have our own inspection system. You cannot guarantee this modern technology is going to work by itself; that is the biggest heresy there is-to think the more complex technology is, the less trouble you have. COMPLEXITY DOES NOT MEAN SAFETY There is an interesting thing I notice when I go onboard ships. I started out my submarine duty in a 1,500-ton submarine. I hope I am not boring you because I am trying to give you some concept of where I get my philosophy in operation. You could see every system. It was a single-hulled ship. Every cable, every line was right there in front of you. It was easy to trace out. Now you go on a modern submarine, with thousands of things and you have a vast amount. It gives people a false sense of security. They think by having more equipment that it is safer. It is exactly the opposite. Therefore, the more complex it is the far better trained the people have to be or they are going to get in trouble. Do you get the point? This is the fallacy and it comes about from the press and the science writers. They are always talking about the wonders of science and new technology, and they don't know enough to point out the pitfalls. Therefore, they neglect training because when you read all these wonderful articles on science, science will save the world, God is no longer necessary, training is no longer necessary. You get the point? Mr. WYDLER. Yes. Admiral RICKOVER. That is the real lesson I am trying to get across here today. You have to depend on people. If you have to depend on people then they must know what they are doing. That PAGENO="1063" 1059 means training not only once but constantly. That is why people are required to go to church every week. The ordinary human being does not remember anything longer than a week. [Laughter.] Mr. WYDLER. Thank you, Mr. Chairman. Mr. MCCORMACK. Thank you. Admiral RICKOVER. That does not necessarily apply to Congress- men because you people are smarter. Mr. WYDLER. We have to go more often. Mr. MCCORMACK. Mrs. Bouquárd. NUCLEAR POWER AS ENERGY SOURCE Mrs. BOUQUARD. Thank you very much, Mr. Chairman. Admiral, it is always a delight when you come before this com- mi~tee. We appreciate your knowledge, your humor, but one of the things that I-- Admiral RICKOVER. You like my humor? Mrs. BOUQUARD. I certainly do. Admiral RICKOVER. I wish you would put that in the record. Some people do not. Mrs. BOUQUARD. We also appreciate the confidence that we feel, when you come before us, that we have been in good hands with you as head of our naval nuclear reactor program. I hope that you will agree with me that, since the Three Mile Island incident, more and more Americans have come to realize that nuclear power is a very vital source of energy. Also, that we really have no alterna- tives, whereas before we have had something. Some people have been sitting on the fence, one side or the other, but all of a sudden they have to focus on what it really mean to them? This is some- thing I have seen happen. Admiral RICKOVER. Well, I cannot say that you have no alterna- tive but you must remember you can mine for coal, but that creates problems, too. That has radioactivity which the amount can be greater than--- Mrs. BOUQUARD. Yes. Let me preface my remark, we have no alternative percentage of energy that is produced by-- Admiral RICKOVER. Yes. Mrs. BOUQUARD. I think that it has in its own way strengthened our resolve, as a nation, to go forward and build better and safer nuclear plants, as a result of what has happened. I think that we once again will reach the place we will solve our problems and we know that we have one. TRAINING CONCEPTS Admiral RICKOVER. I think we can solve the problems. Mrs. BOUQUARD. Another thing I think we recognize is that we know a little bit more about the unknown as a result of the Three Mile Island incident. I was wondering if you feel that we should perhaps have new training concepts for those who are responsible for our nuclear-- ~ Admiral RICKOVER. Training of those responsible? Mrs. BOUQUARD. Those that are responsible for the operation. Admiral RICKOVER. You mean like the leaders of the utility? Mrs. BOUQUARD. Yes. PAGENO="1064" 1060 Admiral RICKOVER. I told you how I did it and I think that same concept could be used, at least they could get a modicum of under- standing of what it is they are running and making their money from. Now, the problem in the United States, all over, as I see it, is that many people are in charge of technical organizations that are only interested in making money. Take conglomerates, where a man takes over a lot of companies, he is not taking over for other than to make money. By the way, it's no longer B. & W., it's the McDermott Co. They own the thing. They should be given all the credit for it now. That illustrates the point I am making. Here you had a pretty good company, from our experience. Now it is taken over by a conglomerate, so, whatever responsiblity they may have, whatever they may have done now it may never get to the top people. COST OF TRAINING Mrs. BOUQUARD. One final question, sir. What is the average cost of training a nuclear operator in your Navy nuclear propulsion program? Admiral RICKOVER. That is a good question. I think the best way I can do that first is timewise it is considerable. I will ask Mr. Wegner. What do you guess it is? Mr. WEGNER. Well, that question has been asked many times and the answer depends upon how you count. Do you count the pay; do you count the recruiting to go out and get the individuals, do you count all the losses along the way? Mrs. BOUQUARD. Actual training for their-- Mr. WEGNER. The number to use in an overall sense probably is around $30,000 to $40,000 as far as the cost to the Government is concerned. Admiral RICKOVER. Let me amplify that. We run our prototypes. If we did not have sailors run them we would have to hire civil- ians. It would cost a lot more. Furthermore, we supply a lot of trained people to the nuclear industry. Dr. Schlesinger at one time when he was chairman of the Atomic Energy Commission estimated we had actually contributed somewhere between $2 and $3 billion with our training to the national economy. So when you start in talking about cost, there are a lot of ramifications to this thing. Now, it costs somewhere, it costs over $100,000 for a utility to train a man. If they can get a man who is fairly well trained by the Navy, that cost is significantly reduced. So what you are interested in is the overall economy, and I would say this, that probably we do not cost anything from that standpoint. Mrs. BOUQUARD. That is great, I am happy to know we have something that is not costing us anything, too. I do not say that lightly. Admiral RICKOVER. I am not getting paid extra for being here. Mrs. BOUQUARD. We sure are glad you are here. Thank you very much. Thank you, Mr. Chairman. Mr. MCCORMACK. Mr. Walker. Mr. WALKER. Thank you, Mr. Chairman. PAGENO="1065" 1061 LIVING WITH RADIATION Admiral Rickover, I was fascinated by your story about the fellow from the Department of Defense who told you, the line when you were going to decrease the radiation shielding, that people would have to learn to live with radiation. It fascinated me because to some extent I get the impression that the commercial industry in nuclear power is telling us the same thing. Insofar as the public goes, we hear from them as to a certain level of radiation that you have to accept as a part of this kind of generation of power. What I am wondering is, whether or not in light of your work with ship personnel and so on, whether you have some feeling for the kinds of risks that nuclear generation will produce for the public? What is the public going to have to accept in terms of risks for the receiving of electricity from nuclear energy? Admiral RICKOVER. Well, to be quite up to date, I see that the estimate is that the extra cancer deaths in the paper from Three Mile Island is perhaps one or two. We have been accused of overra- diating. People cite the Portsmouth Navy Yard as an example. We have been made aware of a study where a young doctor attributed cancer deaths at Portsmouth Navy Yard to radiation. Then we checked the death statistics and we found out that normally out of every 10,000 people employed there, there would be 1,600 who will die of cancer whether there was radiation or not. There might possibly be 1,601 deaths if each of the 10,000 was exposed to one rem each. There is some more radiation, but if you take into account all the other radiation a person gets from natural sources, and particularly from medical sources, it is very minor. Mr. WALKER. Do you see as the principal risk then that the public has to accept with this the radiation possibility and the possibilty of cancer deaths from that radiation? Admiral RICKOVER. I think the number of cancer deaths you get from radiation from the atomic energy is a sort of thing that is being played around with by a lot of people whQ are making headlines. I think the amount is so small that it's insignificant. Mr. WALKER. In your opinion that is not a real risk? Admiral RICKOVER. No; it could be if you had an accident where people directly were involved and there would be a few people. But let's take the injuries and deaths you get in the coal mines. The other day there was one involving about 20 or 30 people and that is passed off. Let's take all of the automobile accidents you get. But this word radiation is one that inspires fear and people are taking advantage of it. I think from the standpoint of the energy you get, if we wish to maintain our present standard of living or increase it, you are going to get more deaths from many other sources. More people get X-rays, more get medical treatment, and these are used as diagnos- tic devices. The amount of radiation you get from nuclear power is insignificant in comparison. But it's something you can play up because that is the word, when you go to a doctor or a dentist no one says, radiation. You get a chest X-ray or you get a tooth X-ray but when it comes to nuclear power it's radiation. PAGENO="1066" 1062 Mr. WALKER. I appreciate your comments and I think they are very helpful. But we all know and you have said yourself in your testimony no energy source is risk free. Admiral RICKOVER. That's right. Mr. WALKER. Now, I guess my question is what are the risks, if the radiation risk is not realistic? What are the real risks that might be associated with the nuclear industry and should we be looking at them in terms of the safety of the plant? Admiral RICKOVER. I think you have to be far more careful in operating a nuclear plant just as much as you had to be more careful in operating a coal-fired plant than operating a windmill. It's a difference in degree, but I think if it's properly handled I don't see where radiation is really the issue. It has been made the issue, and the plants can be designed properly and operated proper- ly, and if they are you won't get significant amounts of it. I have tried to demonstrate that in the naval program. What is the average level we expose our sailors, people on the ship? It's mild; a tenth of a rem a year, last year. Mr. WALKER. So if we contain the radiation problem we really don't have any additional risk? Admiral RICKOVER. Yes, and we have a particular problem in the Navy on that because we have a confined atmosphere, a small place. We have lots of people and they live right around the reac- tor, they eat around it and live near it. It's all self-contained, and I will give you an example how safe it can be. When an atomic bomb is burst somewhere, say the Chinese explode one over there and our submarine is in the shipyard and we can measure the fallout, we can measure the radiation, from the fallout. When you go down into the submarine, you cannot detect the radiation from the fallout. In fact, we have had to require people not to wear radium dial wristwatches in nuclear submarines be- cause the radioactivity in them interferes with the readings of the instruments. When a man inadvertently brings one on board we seal it up in a box while the ship is underway. My opinion is that radiation has now been overplayed by the press, and I think it's time we call a halt and look at it realistically, and I think this is something this committee can do. You have heard many witnesses and you can form your own opinions, but the attitude I would take on it is many years agO when we were building our first pressure vessel and the industry wanted to bolt the pressure vessel I was very much afraid of radiation and I said, no, we will weld it. The standard I would have to use is this one: "Would I want my son to serve on that submarine?" and I would be perfectly willing to serve on these ships, that is all there is to it. So when I talk this way I am not talking because I am in nuclear power. I think I am old enough and have learned enough to take the same kind of attitude the Members of Congress take, you have to think about the country and the people and they have been scared too much. This is why I keep on getting back at the media. They are doing a great deal of harm. PAGENO="1067" 1063 MEDIA IMPACT Mr. MCCORMACK. I want to thank you for these comments, Admi- ral Rickover. I think they are so very important. I think it's important, Con- gressman Walker has a legitimate concern for his constituents and their concern about Three Mile Island. This is a very difficult thing for him to handle because of the emotionalism that has been generated by the press and media. A great to-do has been made in the press because the background radiation in that populated area has been increased by about 1 ~/2 milli-rem total dose. This is the HEW and NRC figure. In fact, the background in the area is 100 times as great every year. If we assume, for instance, there is one additional cancer death in that area sometime from that incident then we have to assume that there are 100 times that, the 100 cancer deaths every year in that area from normal background. The same thing applies to normal radiation back- ground across the country. The entire nuclear industry combined is only one part in 6,000 of the normal background that we get from the cosmic radiation, from the sky and normal background, from the soil and all other sources other than the nuclear industry. Consequently, the poten- tial for a cancer death from other than nuclear energy causes is 6,000 times greater than from nuclear energy, just from the radi- ation, to say nothing of all of the other causes like cigarette smok- ing. Admiral RICKOVER. You have the combination of two words, radi- ation and energy. These are very fearsome words so you combine those two and you have something. Now, people want all of the advantages they get from modern technology; they don't see how much better off they are than their forefathers; they live longer and they live healthier lives and more productive lives, but they want to pick out one thing, and that is, I keep on harping back to the responsibility of the press. They are creating this. From a factual standpoint, the people who get cancer or are otherwise hurt by radiation are a very small number compared to the benefits you get from it. Now, that is what I said at the beginning. It's a political decision. It's your committee and Congress who have to decide. You get cancer deaths from all kinds of things. You ought to eliminate all kinds of things, and pretty soon the only man who won't get cancer is the guy who stays in a nonradioactive cave and never gets out of it all of his life. Mr. MCCORMACK. Or never eats. Mr. AMBRO. Would the gentleman yield on just that point? Mr. MCCORMACK. Certainly. PUBLIC ISSUE Mr. AMBRO. I hate to take issue with you, Admiral Rickover, but radiation is not the issue by itself. In my opinion, whether it's press-generated, moving picture generated or just an attitude as the result of sensational reading matter, the threat of huge amounts of radiation carried by, let's say radioactive steam, as a result of, if there is such a thing, a meltdown or an explosion, that PAGENO="1068" 1064 is what is in the minds of the public, in the public perception, and that is where the difficulty comes, not the radiation that one might be subjected to when a plant is in operation and functioning safely. It's the unsafe aspects of it that you very well have dealt with in your testimony to assure safety. But the other part of it is that if we have an incident that comes to a catastrophe, tens of thousands and millions of people will be affected. That is what is in the public perception, not the radiation that one is subjected to when you walk in the gate. Admiral RICKOVER. I don't know how to discuss this from a philosophical standpoint or intellectual standpoint. You made the statements of tens of thousands or millions of people. Now, how do I answer a question like that? That is a figment of your mind. I cannot answer every question that anyone asks, but so far there has been no evidence of this thing. Mr. AMBRO. Let's say it's a political question. That's the politics or the essence of the political question that we must deal with. The public perception with respect to this kind of accident, that is what we are talking about. Admiral RICKOVER. Well, Mr. Leighton came up and whispered the thing you have to have is to operate them safely and you can make them operate safely. Therefore, it seems to me, and I under- stand this to be the position of the Chairman, you want to find out what can be done to make them operate safely. Is that correct, sir? Mr. MCCORMACK. That is correct, Admiral. Admiral RICKOVER. That is what you have to do. Mr. MCCORMACK. And we believe it can be done. Admiral RICKOVER. I don't know where you come from, but I can see where there could be some chemical factory in your district that does not operate safely and there are analogous things that can happen there, too. Mr. MCCORMACK. Let's go to Mr. Ertel of Pennsylvania. UTILITY TRAINING Mr. ERTEL. Thank you, Mr. Chairman. Admiral, I have a couple of questions. I was curious about your statement that we ought to have the utilities get together and set up a training program. Then you also indicated that most of the people in charge of the utilities are interested in the bottom line or the manufacturers, I guess. For instance, McDermott took over Babcock and Wilcox and they are interested in the bottom line. They are a conglomerate. Do these not fly in the face of each other, going to set up an expensive training facility themselves without Government intervention and requiring them to do so? Will they do that if they are interested in the bottom line, expecially when all utilities don't have nuclear powerplants. Admiral RICKOVER. Yes, sir; they will, if this committee comes out with a report they have to. Mr. ERTEL. In other words, we have to legislate them to do so? Admiral RICKOVER. No; it affects their bottom line. They have a large investment in nuclear power and presumably they are going to have even a much larger investment. If they realize that in PAGENO="1069" 1065 order to run these plants they have to operate them safely, and the amount of money they have to spend for training is minimal com- pared to the cost of the electric power, they will do it. They have not been educated properly. Mr. ERTEL. Well, it's taking a long time to educate them proper- ly, to doing it safely. and we have not encountered that. Obviously, your program is a lot superior to the civilian training programs; do you not agree? Admiral RICKOVER. I cannot talk about superiority. I don't want to get into that. I have done what I felt was necessary to conduct a safe program for the Navy. It's easy for me to take off at any one who does not do things the way I do, but I cannot do that because I am not in their shoes. Mr. ERTEL. I want to interrupt you, Admiral. Do yOu think you have the best program in the Nation or in the world? Admiral RICKOVER. I don't know about the rest of the world. I think I have a pretty good program. I am doing the best I can with my knowledge. That's all I can say. I think my program can be improved. Mr. ERTEL. Do you think you are better than-I am sure you are familiar with the utilities' training programs-do you think your program is better? Admiral RICKOVER. Yes; I think it's better. Mr. ERTEL. In other words, they could use your program as at least an example and they could improve on your program maybe. Admiral RIcK0vER. Sure, but nothing has ever stopped them from doing it up to now. Mr. ERTEL. They have not, have they? RECOMMENDATIONS ON ATOMIC POWERPLANTS Admiral RICKOVER~ Apparently not. But nothing has stopped them. I will tell you what happened in 1966; I was in Greece and I knew the King and the Queen. The Queen told me, it was Queen Frederika, they were intending to build atomic powerplants, so they asked my advice on how to go about it. When I got back to the United States I sent her some advice and I will read you off some of the things I told her: May I read it, Mr. Chairman? Here's the answer: "In purchasing a central station nuclear powerplant consideration should be given to the following sugges- tions: "Have one company, the seller", I call him the seller, "re- sponsible for design, construction and test of the entire plant so that the purchaser does not have to coordinate technical schedule and cost items among several organizations." You get that point, the several organizations. "Require the seller to guarantee the following, that the plant will perform reliably." We don't do any of these things. "Specifical- ly, it should be available for unrestricted full power operation at least 95 percent of the time for at least 2 years after initial full power operation and completion of the testing program agreed to by the seller and the purchaser. "Minimum power and energy outputs;" specify that; "Satisfac- tory equipment performance"; this is a guarantee now by whatever company is supplying it "for a period of at least 1 year after initial PAGENO="1070" 1066 full power operation of the plant and completion of the testing program agreed to by the seller and purchaser." I am trying to answer your question here. "Design and construction; require that all aspects of the job, including the design, manufacture, construction and test be subject to the purchaser's approval." That is the power company. They don't do that. "And that the purchaser's representatives have full and free access to all plans and* reports and to all factories in which equip- ment or parts for the plant are manufactured." I am describing the naval program here; that is what I am really doing. "Require that the standards to be used in all aspects of the job design, materials, fabrication, and so on, are defined by the seller in writing before placing the order." That requires them to have knowledgeable people before they decide to buy a powerplant. "All deviations from these standards should be documented and approved by purchaser. The purchaser should retain an independ- ent organization to check and audit all phases of design and con- struction. This organization should, for example, review design cal- culations and verify nondestructive tests for conformance to stand- ards." I will put, with the permission of the Chairman, I will put this document in the record. Mr. MCCORMACK. Without objection, we will insert the entire document in the record. [The document follows:] In purchasing a central station nuclear power plant consideration should be given to the following suggestions: GENERAL 1. Have one company (the "seller") responsible for design, construction and test of the entire plant so that the "purchaser" does not have to coordinate technical, schedule and cost items among several organizations. 2. Require the "seller" to guarantee: a. That the plant will perform reliably. Specifically, it should be available for unrestricted full power operation at least 95 percent of the time for at least two years after the initial full power operation and completion of the test program agreed to by the "seller" and "purchaser". b. Minimum power and energy outputs. c. That the fuel elements will perform satisfactorily throughout the full life of the reactor core. d. Satisfactory equipment performance for a period of at least one year after initial full power operation of the plant and completion of the test program agreed to by the "seller" and "purchaser". DE5IGN AND CONSTRUCTION 1. Require that all aspects of the job including the design, manufacture, construc- tion and test be subject to the "purchaser's" approval and that the "Purchaser's" representatives have full and free access to all plans and reports and to all factories in which equipment or parts for the plant are manufactured. 2. Require that the standards to be used in all aspects of the job (design, materi- als, fabrication, etc.) are defined by the "seller" in writing before placing the order. All deviations from these standards should be documented and approved by the "purchaser". 3. The "purchaser" should retain an independent organization to check and audit all phases of design and construction. This organization should, for example, review design calculations and verify non-destructive tests for conformance to standards. 4. The "purchaser" should perform audits of manufacturing and construction operations. The right to do this should be specified in the contract and required to be included in all subcontracts. PAGENO="1071" 1067 5. Require that detailed written procedures be provided by the "seller" for instal- lation, operation and maintenance of all equipment and that these procedures be verified by use during plant construction and testing and corrected as necessary. 6. Require that detailed written procedures be provided by the "seller" for all aspects of plant operation. These procedures should be verified by the "seller" during the plant test program and corrected as necessary. 7. Require that technical manuals be provided by the "seller" for all equipment and for the plant. These manuals should describe the equipment, discuss its func- tion, performance and limits, and provide the basis for these limits. 8. Require that all equipment and operations required to replace nuclear fuel be checked out by the "seller" before the plant is radioactive. 9. Require the "seller" to provide a complete set of plans showing the equipment and plant as actually delivered, i.e., including all changes made during fabrication, installation and test. 10. The "seller" should have full time representatives at the plant during con- struction and test. 11. The "purchaser" should have full time representative at the plant site during construction and test. These representatives should have authority to stop the work if there is reason to believe it is not in accordance with all approved requirements. 12. The plant and equipment should be designed and constructed in accordance with the latest safety requirements of the "seller's" country in addition to any safety requirements specified by the "purchaser". 13. Adequate spare equipment and parts should be provided by the "seller". The number and type to be provided should be approved by the "purchaser". 14. Sufficient information should be provided by the "seller" to permit the "pur- chaser" to procure additional equipment and parts. OPERATION 1. All plant operations including tests, normal operation refueling and mainte- nance should be carried out in strict compliance with detailed written procedures provided by the "seller" and approved by the "purchaser". 2. Detailed records should be kept of all changes to the plant or machinery and the drawings and manuals should be modified to show the current situation. 3. All difficulties or unusual situations encountered should be documented and the disposition (i.e., changes in design or operating procedures) approved by the "purchaser"and "seller". 4. Formal qualification should be required for all plant operators. This should include written and oral examinations and periodic re-examinations. 5. The "purchaser" should have full time qualified representatives at the plant at all times with the authority to stop operations if there is reason to believe they are unsafe or not in accordance with all approved requirements. Admiral RICKOVER. "The `purchaser' should perform audits of manufacturing and construction operations. The right to do this should be specified in the contract and required to be included in all subcontracts." I am probably giving you one of the most valuable parts of this testimony right here: Require the detailed procedures be provided by the seller for installation, oper- ation, and maintenance of all equipment and that these procedures be verified by use during plant construction and testing and corrected as necessary. I am really reading the charter you can come up with on this committee right here. Require that the detailed written procedures be provided by the "seller" for all aspects of plant operation. These procedures should be verified by the "seller" during the plant test program and corrected as necessary. Require that the technical manuals be provided by the "seller" for all equipment and for the plant. These manuals should describe the equipment, discuss its func- tion, performance, limits, and provide the basis for these limits. Require that all equipment and operations required to replace nuclear fuel be checked out by the "seller" before the plant becomes radioactive. Require the "seller" to provide a complete set of plans showing the equipment and plant as actually delivered that is including all changes made during fabrica- tion, installation and tests. PAGENO="1072" 1068~ The "seller" should have full time representatives at the plant during construc- tion and testing. The "purchaser" should have full time representatives at the plant site during construction and testing. These representatives should have authority to stop the work if there is reason to believe it is not in accordance with all approved require- ments. The plant and equipment should be designed and constructed in accordance with the latest safety requirements of the "seller's" country in addition to any safety requirements specified by the "purchaser". Adequate spare equipment and parts should be provided by the "seller". The number and type to be provided should be approved by the purchaser. Sufficient information should be provided by the "seller" to permit the "purchas- er" to procure additional equipment and parts. All plant operations, including tests, normal operation refueling and maintenance should be carried out in strict compliance with detailed written procedures provided by the "seller" and approved by the "purchaser". Detailed records should be kept of all changes to the plant or machinery and the drawings and manuals should be modified to show the current situation. All difficulties or unusual situations encountered should be documented and the disposition (i.e., changes in design or operating procedure) approved by the "pur- chaser" and "seller". Formal qualification should be required for all plant operators. This should in- clude written and oral examinations and periodic reexaminations. The "purchaser" should have full time qualified representatives at the plant at all times with the authority to stop operations if there is reason to believe they are unsafe or not in accordance with all approved requirements. Now, you see, this is 1966, but this is what I have been using since the late 1940's. Now, as you may know, I am responsible for Shippingport, which is the only central station I am responsible for, and I have one of my representatives in the control room, present at all times that plant is operating, with authority to shut the plant down if he believes they are operating the plant unsafely. If he points to anything and they don't do it, he orders the plant shut down and we have had to do that twice. Now, does that answer your question? You are not satisfied? I think what you want is some way to guarantee there will be no radiation. HOW TO GET THE BEST TRAINING PROGRAM Mr. ERTEL. No, Admiral; I am not indicating that at all. I am trying to establish a training program for operators, and how we go about getting the best one. I happen to agree with you, you have the best in the Nation, and maybe in the world. I think that is a good prototype that we ought to go after and to try and emulate and improve on, and you don't seem to want to agree with me on that. Admiral RICKOVER. No; I am sorry; I didn't understand your question. 1 think the big thrust of my statement was training. I thought you gathered that, Mr. Chairman. Mr. ERTEL. I am sorry, but you went further and said now the utilities ought to do this training program, but then you came back and said the utilities or the people who really run the companies are only interested in the bottom line. I suggest to you the Govern- ment ii going to have to have a role in guaranteeing the training program, that we have a very substantial stake in it. Admiral RICKOVER. That is right, but it's not up to the Govern- ment to actually train these people. Now we are getting on common ground. I say the Government should see to it that they do PAGENO="1073" 1069 this, but not have the Government responsible for doing the job and training all of these people. That is what I am saying. Mr. ERTEL. I guess you agree with the amendment I put on the DOE authorization act which basically mandates that DOE look at your program and tell the industry, come on fellows, let's get with it, and let's do like Admiral Rickover does, or a little bit better. Admiral RICKOVER. The industry knows what we do because most of their operators come from the Navy. But that does not answer it either, because having unsupervised people won't do the job. You have got to have the top people who have to know what it is they are operating and what the dangers are. That's the point I am making. Mr. ERTEL. Well, I think that's true, and I think if the man is ruining that operation then the company ought to know, if he is a nuclear operator, what is going on. I would agree 100 percent. But I would suggest to you we can't put Admiral Rickover over in every nuclear powerplant. Therefore, we have to train the supervisors in that powerplant to have as much experience as does your watch officer in the Navy on duty when you are the captain. Admiral RICKOVER. Well, I think we really agree, but I would suggest you have the Nuclear Regulatory Commission be responsi- ble instead of the Department of Energy. They are outside of the. Department of Energy. They are deliberately set up as an inde- pendent organization because then you would have an in-house capability. Mr. ERTEL. I just wondered, Admiral, who was in charge of your nuclear reactor safety program ultimately within the civilian struc- ture, DOE? Admiral RIcK0vER. The Nuclear Regulatory Commission. Mr. ERTEL. Do you report to DOE? Admiral RICKOVER. I report to DOE, yes. Mr. ERTEL. That's what I thought. Admiral RICKOVER. I thought you were referring to civilian plants, with them it's the Nuclear Regulatory Commission. Mr. ERTEL. Maybe we can go to another question. Admiral RICKOVER. Have I answered your question? SIMULATORS OR PROTOTYPES Mr. ERTEL. Well, I think we have gotten the same answer by circuitous routes, and we have both come from different ways, but I think we have agreed generally. Yes, I think you have answered my question. I have heard you testify here that you used prototypes in your training program and run people through on prototypes. What is your analysis, can you give me a comparison between a simulator and prototype in operator training and which do you think is the most viable system? Admiral RICKOVER. The practice I have used is not using simula- tors. I can understand there are some phases of things, some cer- tain exotic accidents that you can simulate that you might want to use a simulator. I have from the beginning been opposed to simula- tors for training because the problem is if you have a simulator and you make a mistake all you have to do is put the switch back. 48-721 0 - 79 - 68 PAGENO="1074" 1070 Actually, the way we train we have actual casualty conditions and the man has to work his way put of them on a real, honest-to- God plant. That might take 1 or 2 hours, and he has to know the theory in the plant. We train our people in theory because you can never postulate every accident that might happen. Therefore, the only real safety you have is each operator having a theoretical and practical knowledge of the plant so he can react in any emergency. That is what we have found. PERSONNEL SCREENING Mr. ERTEL. One last question, if I may. I am wondering in your selection process, and .1 am interested in your training program, do you use a psychological screening as well as an educational or intellectual training program? Admiral RICKOVER. Psychological? Mr. ERTEL. Yes. Admiral RICKOVER. What is that? Mr. ERTEL. Well, I suppose it means is a man equipped to handle emergencies; does he have the proper makeup, the ability to handle emergencies. There are certain psychological factors we find with policemen, for instance; they may have a very low tolerance of aggravation and, therefore, they react unreasonably. Admiral RICKOVER. The reason I. don't believe in a psychological approach is because I once took a graduate course in psychology and I learned the pitfalls. When I saw the professor who was teaching it I swore off psy- chology. Now here's what we do for officers. Mr. ERTEL. Maybe we are not worried about that particular professor. Admiral RICKOVER. I will tell you how I do it so you will know. Any officer that aspires to get in this program is interviewed in my headquarters office by three separate individuals. Then I inter- view him and I make the final decision. I judge the man all around. For example, the other day I did something I never have done before. There was a member of a minority who had a SAT score of 800. Mind you, they wouldn't take him in the Naval Academy even if he had a score of 1,200, and there is a geometrical difference. But I sized up this man, he had been deprived and had not had enough adequate education that it would appear he could make it. So I used judgment, and accepted him. On the other hand when I see some lad who 1 tKs like he is queasy and might succumb, and this is judged by the other people too, I will not take him in the program. But then with that rigid screening we get about 20 percent of those I select who will not make the final year's training. We have an attrition rate of about 20 percent. Sailors are selected with special requirements by the recruiters. They come to our schools and your attrition rate there is about 20 percent. But I can use my own psychology. You can very quickly in ordinary circumstances tell by the way he talks, and acts, and I worry about that because I don't like to turn a man down. So I will have him interviewed perhaps by two oth~i people, and there will PAGENO="1075" 1071 be a total of six interviews to make sure-we don't like to turn them down. Some people it's very obvious they ara not the type who should be admitted anywhere near atomic power. That is a matter of judgment. But I don't see how you can define it with any rules or any classical psychology rules. I am leery as hell about these psychologists. Mr. ERTEL. Well, I guess maybe a lot of people are leery about psychologists, I guess, having tried a lot of cases with a lot of psychologists involved. But the point being you want somebody who has the capability psychologically to cope with an emergency. Some people can't, and that is what you are doing, only you are calling it a different name. Admiral RICKOVER. Well, I have to judge from my experience and then when he goes through our practical training for 6 months he has to operate plants and react and if he cannot no matter how smart he is, we get rid of him. So we have practical psychology. Mr. ERTEL. Thank you very much, Admiral. Mr. MCCORMACK. With that we will take a recess while we go to vote and come right back. Admiral RICKOVER. It is more effective psychological than theo- retical; we get rid of the man. The psychologist tries to cure him. Mr. MCCORMACK. May we take about a 7-minute recess and then we will come back. [A short recess was taken.] Mr. MCCORMACK. We will reconvene our hearing. I would like to ask Congressman Anthony if he has any questions? HYDROGEN EXPLOSION Mr. ANTHONY. Thank you, Mr. Chairman. Admiral Rickover, we have discussed press and press coverage and the bias that it does sometimes create in the public perception. During the press coverage on Three Mile Island there was great coverage given to the possibility of a hydrogen explosion. I would like to know if you ever considered that such an explosion was a credible threat? Admiral RICKOVER. I have considered it, sir, I don't think that was a credible threat. I can see where you can have a lot of radioactivity possibly come out. A reactor is not like a bomb. A bomb is designed to explode. A reactor is not. You are talking about a hydrogen explosion? Mr. ANTHONY. This would be the hydrogen explosion because of the buildup of the hydrogen with the possibility that it may mix with oxygen as it would rise to the top. Admiral RICKOVER. Well, we have never considered, certainly have not considered it to be likely. My experts tell me under the proper circumstances you could get-we don't know enough about the Three Mile Island, I said at the beginning about that particular plant, to talk about it. Mr. ANTHONY. Going back to your own personal operation, what has been the naval experience with a hydrogen bubble that would create the possibility of a hydrogen gas explosion? Admiral RICKOVER. We have never had anything like it. The next question would be what if we did? That is a good question. I can PAGENO="1076" 1072 anticipate that but our system is such that the hydrogen would not have formed. That is the way we operate. Mr. ANTHONY. You feel that your safety and your training would have been such that you would not have had the water contamina- tion that apparently is existing at Three Mile Island? Admiral RICKOVER. Yes, sir; I do firmly feel that. Again, it gets back to the kind of training you have that you have to depend on the knowledge, and we talked about water in the reactor and I mentioned we have two instruments, one is temperature and one is pressure, which gives us an indication of what is going on. That is what we use, and a man has to understand what is happening all the time. PLANT DESIGN Mr. ANTHONY. The two followup questions I had to that was, what is the Navy experience with water level indicators, which seems to be one of the causes of the manmade errors? Admiral RICKOVER. We have had occasional trouble with it but our steam generators were designed to take care of it. There was a difference. There is a difference in the design of the steam gener- ators in the Three Mile plant than ours. They only had a very small amount of time, about 30 seconds, ours we would have min- utes to act on that rather than a few seconds. Mr. ANTHONY. A followup question to that. Based on the time frame and the design of instrumentation of the naval-operated plant versus the civilian~~operated plant, would you suggest any drastic engineering changes in the civilian reac- tors and, if so, what would they be? Admiral RICKOVER. You are now asking me a question which I would like to stay out of because it starts in making me an expert on civilian plants. The type of design they have I am not familiar with, and I would like to stay out of that. I think there will certainly be reports and lessons to come out of the Three Mile thing and I believe that, in fact, I know they are considering this very issue. Mr. ANTHONY. Going on to the area of responsibility of NRC, as I understand it from your testimony, on page 16, NRC does review the design of the naval plant. Admiral RICKOVER. Yes, sir. Mr. ANTHONY. They issue some type of authorization or permit based on their approval of the design? Admiral RICKOVER. Yes, sir. They issue a formal report not actu- ally a permit or a license. Mr. ANTHONY. What has been your experience with the NRC in reviewing the extensive training programs that you have indicated by your testimony that you have instituted in the naval program and do they monitor it on a continuing basis? Admiral RICKOVER. Well, the NRC conducts reviews, they do not monitor on a continuous basis. Mr. ANTHONY. So NRC does not monitor your training program on a continual basis, so it is really left up to you-- Admiral RICKOVER. They pretty well know, they are quite famil- iar with our training program and they know over a period of years how we operate and we certainly need no urging to continue this. PAGENO="1077" 1073 TRAINING INPUT Mr. ANTHONY. Well, knowing that the whole purpose of the hearing before this Subcommittee on Energy Research and Produc- tion, the whole idea and issue being the perspectives on nuclear powerplant safety, knowing that this is a great concern to the American public, be it through an inflammatory press, or be it through their own perceptions, he they real or be they false, I would like to know more positively how you feel the Navy could or would be willing to participate in a program to support a selection and training program for the operation of the personnel of civilian nuclear powerplants or whether or not you think the Navy should even participate whatsoever? Admiral RICKOVER. I think the extent of the Navy participation would be to give information to the civilian industry, if they care to have it. They know what we do anyway because many of their people have come out of the naval program. So there is no secret about it. Mr. ANTHONY. That also brings, I think, a very strong followup question, one that I heard back in my district prior to attending these hearings. The question is that in view of the fact that many of the plant operators are Navy trained, what do you think about the responsibility of the Three Mile Island plant operators? Admiral RICKOVER. Well, you can't blame individuals. We use a different system. We have constant retraining. We also have people in charge who are specially trained. We have an officer in charge of the watch and we do a lot of inspections. For example, when a ship is in port I have my own representatives who are stationed at that place go around at various times of the night, and day to see how they even stand watches on a shutdown plant and report to me. We find things that are wrong. We find them all the time. But we take action. We try to improve it. But we know. Mr. ANTHONY. Would you-- Admiral RICKOVER. The basic question you asked me whether I would be willing to participate. I don't have the people or the time and I have my own responsibility, a great many responsibilities. I am willing to let them see what we do at any time. I don't know what more I can do than that. I cannot become responsible for their training. Mr. MCCORMACK. We have to cut off your questions at this point. Mr. ANTHONY. Thank you very much. Mr. MCCORMACK. We have to move along. Mr. Ambro. Mr. AMBRO. Thank you, Mr. Chairman. Admiral Rickover, I want to say at the outset that I am a fan, I think without your pioneer- ing and foresight the kind of deterrent that this Nation has would never be in place. I must tell you the American people owe you a tremendous debt. You are one of the great treasures and resources of this country. I do not know if you like to be characterized that way, but indeed I think you are. Admiral RICKOVER. That is what my wife thinks, too. [Laughter.] Mr. AMBRO. How long ago? Admiral RICKOVER. Recently. PAGENO="1078" 1074 APPROACH TO NAVY TRAINING Mr. AMBRO. You said that in your training program YOU not only provide your people with land-based prototype training, but then give them shipboard or onboard training as well. You teach them the operations and the functions of all of the equipment, and you tell them as well what the dangers are. What are the dangers? Admiral RICKOVER. Well, the dangers are anything that might happen and the plant shuts down, equipment goes out of order, how it would affect the plant. Now our system of training is such that for every trainee, each one of them has an experienced man with him. It is a very expensive and difficult system. A man, he is not just off there by himself, he is always training with some person right at his elbow, guiding him. So he learns what might happen. We don't do anything, we can't train them if a shell hits the plant and blows it up, we cannot tell him what to do because he wouldn't be there to do it. NAVAL PLANT DESIGN Mr. AMBRO. OK. You said the American people are inflamed by two words, radio- activity and cancer. That may be, and I am sure that the two are juxtaposed in people's minds. What about the word "meltdown"; is there such a thing? Can it happen, aside from computer simula- tions? Admiral RICKOVER. It could happen but our plants, the plants that I am responsible for are so designed there is much more time to take action. We have never `experienced anything of the sort. We also have emergency sytems for taking care of that situation. Also, we have an emergency system and the ordinary system. If it doesn't work, the emergency system goes into effect. Mr. AMBRO. Do you feel comfortable about commenting as to whether or not a commercial plant could experience meltdown? Admiral RICKOVER. No, sir. As you can gather, I have tried to avoid making judgments on commercial plants. I am not entirely familiar with their problems. I do think they might be able to learn from some of the things we do and we can learn something from Three Mile Island, too. I am not saying we cannot learn any lessons and we will, and if we find things we should do we will do it, and no doubt we will. But they can also learn from what we do and I have made some suggestions here which they in my opinion can adopt in order to have a more reliable system in a commercial plant. USE OF COMPUTERS Mr. AMBRO. We had testimony before the full committee from Dr. Teller and his entourage about a variety of things with respect to this accident and nuclear power in general. They said, of course, we could build better reactors, we could build into them a redun- dant sytem, we could do better with respect to training. What else they said was that we could use sophisticated computers to scale down the information that was being provided at the plants, in order to provide operators of plants with more simple but more effective kinds of information to quickly take action in the event of an incident. PAGENO="1079" 1075 Do you agree with the use of computers, let's say? Admiral RICKOVER. You know, one of the things that was said here was that they even painted the dial wrong on the real instru- ments. When you start in depending too much on computers, maybe a fuse blows out. Furthermore, this is my opinion-and Dr. Teller and entourage are experienced people, and I do not want to take issue with them, they have had more experience with weap- ons than they have with reactors. But I am deadly afraid of having some computer relied on to give the answer to a real generating problem. I would feel very, very uncomfortable with that because the man is going to start depending on that machine rather than on his own judgment and his own knowledge. That is what worries me. Throughout this presentation I have stressed the importance of people. I am deadly afraid of all these gadgets, and insofar as I have been able to, I have kept that out of our system. Mr. AMBRO. Well, you see this kind of a time constraint makes it difficult to explore some of the things that one has to do, especial- ly, for example, the fragmentation of the private sector process vis- a-vis what you do and how the military handles it. But I do want to get to just one specific and last question. Do you have experience with B. & W. in your program? Admiral RICKOVER. They manufacture various types of equip- ment. Of course whether it's B. & W. or any other outfit, we, in my organization at headquarters are responsible for the design. The man who manufactures it is not and B. & W. has done a good job in the manufacture of things, but the design is my responsibility, the inspection is my responsibility and the installation is my re- sponsibility. So B. & W. just does what we approve. I do not believe that is the case in the civilian industry. This is the point I made in the letter I sent to the Queen of Greece about how to approach obtaining reactors. That is the difference. Mr. AMBRO. Well, of course, in terms of the fragmentation in the private sector, why that is indeed the difference and it is very difficult for us to deal with here. We may have to have a series of communications from this committee to Admiral Rickover so that we can get a better handle on how to reconcile those differences. We must not only assure policing by the private sector, but over- view from the governments and the kind of specifications that we should have had, modular interests for incorporation in all reactors in the United States. You can see the complexity of that kind of problem as opposed to the way you are able through your office and your authority to deal with it. Admiral RICKOVER. They can set up, they can have an analogous system if they care to. Why not? Mr. MCCORMACK. Admiral Rickover, would you be willing to answer some questions presented to you in writing subsequently by the staff? Admiral RICKOVER. I would be very happy to. CONCLUSION Mr. MCCORMACK. We promised to be out of this room at 2 o'clock and it is now 1 minute after 2. There is another meeting scheduled. We are going to be forced to adjourn even though we would like to go on. I want to thank you, Admiral Rickover, and your staff for PAGENO="1080" 1076 the extraordinarily valuable presentation you have presented to us today and the information you have provided. I can assure you that your testimony is going to have an impact on this committee, on this Congress, and I believe on the nuclear industry, and it is going to be an impact for good and I appreciate what you have done. I want to say in general that I think these hearings have been good hearings, the witnesses have been outstanding, the whole idea of hearings has been to collect relevant information, to get true facts, and to try. to exercise commonsense with respect to all the questions associated with nuclear energy and nuclear safety. To the extent that we have succeeded, I think we will make a contribution and I want to thank Drs. Tirén, Larsson, Low, and you, Admiral Rickover, for your contribution today, and again our appreciation for all the time you have put in, and our congratulations on the wonderful program you have established and we will be looking forward to working with you in the future. Admiral RICKOVER. I would like to thank you and the members of your committee for the cogent questions you asked, for your obvious knowledge and understanding of the problems, and the way you handled this thing. I think you will get something out of it because you elicit confidence, you and your members, in the manner of your questioning. Some of the questions I perhaps have not understood thoroughly, but I think I have performed some service in answer to what you have sought, so I give you the full credit. Mr. MCCORMACK. Thank you very much. Admiral RICKOVER. Of course if it does not work it is your fault. [Laughter.] Mr. MCCORMACK. Thank you very much, Admiral. [The information follows:] CLOSING REMARKS OF HON. MIKE MCCORMACK, CHAIRMAN, SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION I would like to thank all of the witnesses for coming and for presenting their views on nuclear power plant safety to our Subcommittee. Certainly, obtaining the most accurate information on this subject is of great importance to our country. These three days of hearings have been very worthwhile to us all. We have obtained rather different views on each of the three days, both on the general approach to nuclear safety and on the significance of the accident at Three Mile Island. The first day provided details of the philosophy and technology of nuclear power plant safety systems, and showed that there are a number of ways in which present safety equipment and procedures can be improved. The second day of the hearings, which emphasized the Three Mile Island accident, gave us valuable insight to the operations of the Three Mile Island plant both during and immediately after the event. It demonstrated the part that plant design, equipment performance and operator action played in the accident, and especially highlighted the need for operators to be able to take prompt and effective action. Today, we heard from witnesses outside the commercial U.S. reactor industry. The Subcommittee was particularly pleased to have the benefit of the Swedish views on licensing and safety, and I wish to especially thank Dr. Tirén for coming from Sweden for these hearings. Today's session was particularly valuable in putting the preceding sessions in perspective, and in laying the groundwork for further action by the Subcommittee. The hearings have shown that despite the extensive efforts to date, there are several areas in which the safety of nuclear power plants can be improved. These range from the training and selection of operators, to the need for more stringent operating procedures, and to the obvious need for improvements in the man-ma- chine interface. Clearly, adequate funds must be made available to implement these improvements. This is important because it will allow us to move ahead with confidence to build the nuclear power plants which we must have to reduce our PAGENO="1081" 1077 dependence on imported energy. At the same time, the hearings have shown that reactor safety systems do work, and that despite the serious nature of the accident that occurred, no fatalities resulted. The record of the civilian nuclear power indus- try remains intact in this regard. We thank the participants for their work and their fine presentations. We thank you all for your attention. The Subcommittee will continue to be receptive to suggestions and help in this important area. The record of these hearings shall be open for some time, so that anyone wishing to submit a statement or material for the record may do so. Again, my thanks to all involved. This hearing is adjourned. Mr. MCCORMACK. The meeting stands adjourned. [Whereupon, at 2:03 p.m., the subcommittee adjourned.] PAGENO="1082" 1078 APPENDIX I ADDITIONAL MATERIAL FOR THE RECORD SWEDISH EMBASSY ADDRESS ~I~~4~REAVE,N OFFICE OF SCIENCE AND TECHNOLOGY TELEPHONE June 15, 1979 ~ Congressman Mike NcCorrrtack Chairman, Subcommittee on Energy Research and Production Committee on Science and Technology U.S. House of Representatives Suite 2321 Rayburn House Office Building Washington, D.C. 20515 Dear Congressman McCormack: TJ-9172 It was an honour for Dr. Tir~n and myself to appear before your subcommittee on April 24, on your hearings about Nuclear Reactor Safety. Dr. Tirén has asked me to transmit the attached supplemen- tary responses to questions raised by members of your subcommittee. These clarifications may, if you so wish be included for the record into the testimony. Sincerely yours, CL~ Lars G Larsson Attaché Science and Technology LGL/ms end. PAGENO="1083" 1079 Re Testimony before US House of Representatives, Committee on Science and Technology, Subcommittee on Ener~y Researq~ and Production, May 24, 1979 by Dr. Ingmar Tirdn, AB ASEA-ATOM, Sweden In response to questions during the testimony, please supplement Dr. Tirdn's verbal presentation by the following comments. ~p~ly to Congressman Wydler on question regarding the use of check lists in Swedish nuclear plant operation: Swedish utility representative confirms that no formal check list is used at dayly take-over from one shift to another. The shift engineer keeps record of notable items. He passes on this information to the next shift together with an oral and informal exchange of information. The list of notable items is kept up to date by the shift engineer in charge. to Congressman Ertel on question regarding the possibility of a release of contaminated water from the reactor containment to an auxiliary building in Swedish p~lants, assuming accident conditions similar to those that occured in TMI unit No.2: This is a question related to design details. The design principle of any plant is to provide containment isolation whenever there is an indication of a risk for radioactive contamination of the athmosphere or the water inside containment. With regard to.details, I can only reply with respect to the ASEA-ATOM boiling water reactor (BWR) plants. In these plants no transfer of water from the containment to an auxiliary building takes place during abnormal conditions. There are situations in which water is extracted from the containment pool by means of pumps located outside containment. However, in such situations the water is fed back into the reactor containment in a closed loop. In ASEA-ATOM plants the reactor containment is isolated upon the automatic actuation of signals indicating high pressure or high temperature inside containment. Thus we do not rely on a high pressure condition only. PAGENO="1084" 1080 Dr. Ingemar Tiren Manager Nuclear Safety and Licensing (ASEA-ATOM) P. 0. Box 53; 5-72104 Vasteras, SWEDEN Dear Dr. Tiren: Thank you very much for attending our Subcommittee hearings on Nuclear Power Plant Safety. Your testimony was indeed very valuable and it was awfully kind of you to come all the way from Sweden to give the Sub- committee the benefit of your experience. During the hearings on May 24, lg7g, you indicated that you may be able to provide the Subcommittee with responses to a number of questions, to- gether with other additional information. I have.enclosed a list of questions and I would be grateful if you could find the time to respond to them. by July 13, 1g79. On behalf of the Subcormnittee, I want to thank you again for coning to Washington and for providing an invaluable contribution to our under- standing of nuclear power plant safety in terms of your own unique rational perspective. ~ MIKE McCORMACK Chairman, Subcommittee on Energy Research and Production MM/we COMMITTEE ON SCIENCE AND TECHNOLOGY U.S. HOUSE OF REPRESENTATIVES 5U1TE2321 navnuna HOU5EOTFICE BUILDING WASHINGTON. D.C. 205j5 June 19, 1979 Enclosure PAGENO="1085" 1081 AS EA-ATO M Deettwtth by Ow Data Oat refetence I Tirén August 8, 1979 Forthe attentlono? Voar Date Yourreterence Congressman Mike McCormack Chairman, Subcommittee on Energy Research and Production Committee on Science and Technology U.S. House of Representatives Suite 2321 Rayburn House Office Building WASHINGTON, D.C. 20515 USA Dear Congressman McCormack, Thank you for your letter of June 19 with guestions relating to my testimony during your May 24 hearing. I have tried to respond to most of the questions in the attached papers. Some of the questions, however, require the attention of my colleagues and will there- fore need some more time to be answered. It was a great honour for me to appear before your committee, and I enjoyed the occation very much. If there are additional questions or enquiries relating to European nuclear safety considerations that you may have, I shall be glad to respond to the best of my knowledge. If I can help with facts and viewpoints on nuclear safety in a more comprehensive and independent way I should also be happy to do so on a consultantTh basis. I hope the responses given here will be of some use to you and your fellow Congressmen. Yours sincerely, /~j4L~L4(A~ It'Wt~ Ingm~r Tirén Attached: Response to questionnaire Description of SECURE reactor (3 copies) Postal address Telephone Telex Telegraphic cddroes ASEA-ATOM VOeteSs 40629 Sos 53 51-tOoccO S-POt 54 VASTERAS t Sweden Cadet Wetters Scion end PAste PAGENO="1086" 1082 SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION Questions from Ilay 24, 1979, Hearings on Nuclear Power Plant Safety for Dr. Ingemar Tiren, Manager, Nuclear Safety and Licensing, ASEA - Atom, Vasteras, Sweden. 1. Please describe the "30 minute rule" that you mentioned in your testimony. 2. How does your N-2 rule differ from present U.S. practice. Can it be applied to U.S. nuclear power plants presently in operation? 3. Describe the "SECURE" reactor system in which a core melt is an "not a possible event." 4. Please send us a description of the "Shift Change Procedure" which is representative of present Swedish practice. 5. Please expand upon your comments regarding Sweden's plans for the future use of coal. 6. Describe the Swedish program for training nuclear power çlant operators. 7. Would there be any benefit in having the assistance of experienced power plant operators during the design stages of control rooms and control panels? Is this done in Sweden? 8. Do you believe that it is reasonable for a utility to be entirely responsible for the design, construction and operation of nuclear power plants? - 9. Describe any significant differences in the control, instrumentation and monitoring systems of Sweden and the U.S. regarding power plants. 10. Are there any significant differences in the educational requirements of Swedish and U.S. power plant operators? PAGENO="1087" 1083 ~ ~- Oc~ Responses to questions from May 24, 1979, Hearing on Nuclear Power Plant Safety by Ingmar Tirén, ASEA-ATOM, Sweden `30 minute rule" The safety analysis report (SAR) that is submitted to the Nuclear Inspectorate for approval before plant operation contains a comprehensive "Accident Analysis". This is similar to what is required by the USNRC. The accident analysis is based on the assumption that a set of mishaps and accidents might occur in the power plant. These occurrences can be labeled as "postulated events" required by the NRC or the Swedish Inspectorste to be analysed. One must demon- strate that the consequences of each of these events in. terms of radioactive release are acceptable, and in this context acceptability has been defined by the licensing authority in their rules, regulations and guidelines. Now, in the Swedish case, we must assume in evaluating the consequences of each accident or mishap, that no operator action is made during the first 30 minutes after *the initiating event, that is to say he takes no action in order to mitigate the harmful consequence of the event. In this context "harmful consequence' means excessive release of radioactive substances off-site. The design related effect of this 30 minute rule is that necessary actions have to be performed by auto- matic means, i.e. by the automatic actuation and operation of safety related systems, if these actions have to be made during the first half-hour in order to maintain the release of radioactivity within the acceptable limits. The rule thus leads to a design in which automatic devices are used somewhat more extensively than they would be if no 30 minute rule had been established. These automatic devices have to be tested periodically. The purpose of the 30 minute rule is to relieve the operator from the requirement to perform a (large) number of actions shortly after an abnormal occurence, i.e. during a time period in which he might be under considerable stress. It should be stressed that the 30 minute rule does not prohibit the operator to take manual action. 2 N-2 rule The "N-2 rule" applies to important safety related systems. Such systems are identified by classification schemes accepted by the regulatory body. PAGENO="1088" 1084 page 2 International safety criteria require that, when a safety related system is called upon to operate, one must assume that one component within that system fails (single failure criterion). In order to comply with this criterion, designers traditionally have chosen to split up a safety related system into two independent subsystems, each with adequate capability to fulfil the required safety function. Now, the N-2 rule goes further along these lines. In simplified terms this rule requires the designer to assume that not only does one component fail to operate but, in addition, another component or sub- system is unavailable due to repair. So two subsystems might not suffice, you have to introduce 3 or 4 sub- systems, or in general terms, N subsystems~ Of the "N" subsystems one is assumed to fail on account of the single failure criterion, and one fails to operate due to its being subject to repair or main- tenance. So the designer may employ three (N=3) sub- systems each with full capacity for the intended safety function or four (N=4) subsystems, each with 50% of full capacity. Now I must point out that I believe that, in Europe, the N-2 rule has not been established primarily by a regulating process but rather by `practice" or as a result of the utilities' desire to run the plant with one subsystem out of order for a considerable time. The utility wishes to be able to get the autho- rities' permission to allow generous time intervals for repair without the requirement to shut down the plant. It is my belief, that most plants now in operation, in Europe as well as in the U.S., do not comply with the N-2 rule. However, I also believe that most plants now under construction in West Germany and some other West European countries do fulfil the N-2 requirement in the case of principal safety systems. Swedish BWR plants under construction or in the commissioning stage are designed according to the N-2 rule in the case of emergency cooling systems and some other important safety systems. For older plants, American as well as European, it would probably be very costly to adapt them to the N-2 rule. In certain cases this should,however, be possible by introducing additional pumps (in parallel with an existing pump), or additional valves etc. I should also like to point out again that the N-2 rule is a "utility" rule established in order to enhance plant availibity (being able to repair without shut-down) at least as much as it is a "safety" rule. The splitt~,ing up of a safety system into several (N) subsystems achieves its full safety oriented merit only if the subsystems are properly ~gp~rated physically (by adequate distance or by barriers) in su~ a way that no occurrence (a fire, a missile) can result in the damage of more than one of the subsystems at a PAGENO="1089" 1085 page 3 time. By this means systematic failure of the entire system due to a single event is avoided, i.e. a class of Common Cause Failures of the system is prevented. In conclusion I believe it is generally difficult and safety-wise ineffective to apply the N-2 rule to plants presently in operation. 3 The SECURE reactor system A description of SECURE is attached in a separate document (3 copies). 4 Shift Change Procedure typical of present Swedish practice The shift change procedure at a Swedish nuclear power plant is typically fairly informal. Swedish utility representatives confirm that no formal check list is used at the dayly take-over from one shift to another. The shift engineer keeps record of notable items. He passes on this information to the next shift together with an oral and informal exchange of information. The list of notable items is kept up to date by the shift engineer in charge. The introduction of a formal procedure involving a check list has been discussed in Sweden. A comment on this question by a utility chief operator is that the informal take-over has merits because it involves a two-sided exchange of information between the shift engineers. In a formalized procedure the information might become one-sided and stereotyped. This item addresses itself to the general problem of man-machine interfaces at a nuclear power plant Research projects within this field are in progress in Sweden under the direction of the Swedish Nuclear Power Inspectorate. Oetailed information about this work may be obtained from the NRC under the current U. S.-Swedish agreement. 5 Sweden's plans for ~the future use of coal I have passed on this question to experts in the field and will submit an answer as soon as possible. 6 Swedish program for training nuclear power plant operators I have passed on this question to experts in the field and will submit an answer as soon as possible. 7 Assistance of power plant operators during the design stages of control~rooms and control panels There is certainly great benefit in having the assist- ance of experienced power plant operators during the design stages of control rooms and control panels. Their experience from the operation of previous plants 48-721 0 - 79 - 69 PAGENO="1090" 1086 page 4 is needed to obtain improved designs for new control rooms. These experienced operators can provide most valid arguments for modifications regarding the arrange- ment of panels for easy access, visibility of instru- ments, operability of switches etc. They can distinguish between items important to the operator and things less important, and this is necessary because of the multitude of information available in the control room. They can give valid view-points on the practical design, lay-out and arrangement of all sorts of equipment. This experience is utilized in the design of control rooms and control panels for Swedish plants. ASEA- ATOM, the manufacturer, have within their own ranks many experienced operators whose knowledge is utilized. These are persons who have conducted the commissioning runs of our early plants before take-over of plant operation by the utility. In addition, ASEA-ATOM has to leave considerable room for the ideas and require- ments of the customer in the arrangement of the control room and control panels. The customers, i.e. the utilities, have their own experienced operators who have strong views about how things should be arranged and presented, and these views must be taken into account to a very great extent. So there is a con- tinuous and strong cooperation between the utility and the designer in these matters. A couple of photographs of the control room in the TVO I plant are attached. TVO I was taken into commer- cial operation around New Year 1979 and is the first BWR plant delivered by ASEA-ATOM in Finland. 8 Is it reasonable- fora utility to be entirely responsible for the design, construction and operation of nuclear pquer plants? Iknowofno case in which a utility has designed a commercial nuclear power plant entirely on their own. This is done by the manufacturer, normally. Most manufacturers or architect engineers also have a good deal of responsi- bility in the construction phase, together with the utility. I can only say that I em convinced the Swedish utilities have resources and qualifications sufficient for their share of responsibility during all stages of the design, construction and operation of our nuclear plants. Perhaps your question about-responsibility refers to ~ responsibility? If so, I can give no opinion. 9 Significant differences in the control, instrumentation and monitoring systems in Sweden and the U.S. regarding power plants I have passed this question on to our experts and I shall submit an answer as soon as possible. 10 Significant differences in the educational requirements of Swedish and U.S. power plant operators This question will be dealt with in conjunction with our reply to question No. 6. PAGENO="1091" 1087 PAGENO="1092" ~r~ñLh CFIT PAGENO="1093" 1089 SECURE NUCLEAR DISTRICT HEATING PLANT In the budget for energy R & D, approved by Swedish Parliament in 1975, funds were made available for the initial development of a low temperature district heating reactor. In 1976, the Finnish Government allocated money for the same purpose. A joint Finnish- Swedish design effort was started in January 1976 and concluded in July 1977. The aim of the study was to clarify the technical and economic aspects of a low temperature nuclear district heating plant in sufficient detail to allow decisions to be made for the possible use of nuclear district heating. The organizations responsible for the work are: AB ASEA-ATOM Västerâs, Sweden AB ATOMENERGI Studsvik, Sweden OY FINNATOM AB Helsinki, Finland TECHNICAL RESEARCH CENTRE OF FINLAND Espoo, Finland PAGENO="1094" Domestic heating today in Scandinavia is to a large extent based on fossil fuel, mainly oil. There are many reasons for reducing the use of oil for such elementary purposes: environment, balance of trade, security of supply and economy. To the extent this is possible, the demand for heating in the Scandinavian countries should be met by using other forms of energy. Waste heat from large nuclear power plants can be used for this purpose, but this depends on the location of such plants in relation to urban centres, low temperature distribution technigues, the total electricity demands etc. In any case, the use of such heat is confined to a restricted number of areas with large population concentrations. One way of avoiding the use of oil or other fossil fuels in the smaller urban centres spread over the country would be to adopt small low-cost reactors with properties allowing location near urban centres. The present concept SECURE (Safe Environmentally Clean Urban REactor) is designed to cater for the needs of such a programme. The rationale of this reactor is that simplicity in design and inherent safety features due to the low temperature and pressure should make such reactors economically feasible in much smaller unit sizes than nuclear power reactors and should make possible their urban location. 1090 NUCLEAR DISTRICT HEATING I n'~~t/ l~fl (,,,il'i,i-I l~~~il lull aulc//'(uu~'l .\uIea,- ll('Lll 4 PAGENO="1095" 21X)0 401K) (4K))) ))0)K) t;llifuiion inic 0 Project SECURE encompasses the preliminary design and safety analysis of a 200 MW(th) nuclear district heating plant for the municipal space heating of a city of about 100 000 inhabitants. This power level represents a compromise between the improved economics for a larger output and the increased potential market for a smaller unit. The present work does not refer to any specific site. District heating systems in Scandinavia usually operate at a 120°C maximum temperature, reached only on the coldest winter day. The cost characteristics make the district heating reactor most suitable for catering to the thermal base load requirements. The annual distribution of district heating temperatures and thermal load show that it is sufficient to design the reactor for 95°C outgoing temperature to the district heating system and for about half the maximum load. Under these conditions an annual heat generation corresponding to 4000-5000 effective full power hours can be expected. Fossil-fuelled heaters are used to cope with the peak load. Only about 15% of the total annual energy need has to be met in this manner. ilii.ti itilt Ii ii 1091 Finland CuTe/h Ihiel seiuieet I~n dint/el Iiealin~ ~tjiniiiiiiiit 1t~itl it jilt iii) I itt) / 1lin~ Iii ii) ii lIt dine lilt) ii) Citol K))) lit el lietct itii~ 01(111 ~ .ltutdin a ~t \ 120 110 1(111) is)) (ii) 4)) 30 21) 1 enipet 1)111 net etini tim n p.111k load tout i~ itoh loittpui flute ii ii slot tittijierilure Duration curves for district heating load and temperatures 5 PAGENO="1096" 1092 SECURE CONCEPT SAFETY PHILOSOPHY For economic reasons, a space-heating reactor must be located close to the load centre of the district heating grid being served. SECURE is therefore designed to eliminate the requirement of geographic separation between urban high-density population centres and reactor sites. At present, there are no specific governmental criteria regarding the design of nuclear plants for urban siting. Nor is there any defined risk philosophy on which to base such a design. Current light water reactors achieve the required high degree of safety by the use of engineered safety systems containing active components such as pumps and valves. By rigid quality assurance, redundancy, diversity, physical separation and in-service functional testing the probability of an accident with major impact on the environment is made acceptably small. However, this leads to high investment and maintenance costs and the resulting plant design complexity virtually prevents comprehension of the safety problems by the concerned layman. Thus, both economics and public acceptance suggest another approach. For SECURE the most essential safety features can be characterized as follows: - Shut down and core cooling assured in all accident conditions as inherent feature of design - no engineered safety systems necessary. - No requirement of operator action subsequent to accident - i.e. a "walk away" situation exists at all times. - Low power density - favourable operating conditions for fuel results in very low fission product release. - Underground siting - favourable from environmental and containment viewpoints. REACTOR DESIGN The reactor core is located at the bottom of a large pool, containing about 1000 m3 of cold highly borated water. The pool is enclosed in a cylindrical prestressed concrete vessel, covered with a prestressed concrete lid and is slightly pressurized. The whole reactor installation is located in an underground cavity. The prestressed concrete vessel is located below the floor level of the reactor hall. This ensures that the core always remains under water and is safely cooled in case of accidents. The concrete vessel design permits inspection of all prestressing tendons from the reactor hall. The reactor vessel itself has no pressure retaining function, but serves as a flow baffle between the highly borated pool water and the low-boron reactor water. The main coolant circuits along with pumps and heat exchangers are located outside the concrete pool. The reactor coolant water is heated from 90°C to 115°C in its passage through the core. The reactor core consists of conventional uranium dioxide fuel rods with Zircaloy cladding, arranged in a square lattice in Zircaloy fuel boxes. The rod diameter is the same and the fuel length is about half that for the ASEA-ATOM BWR. The four central fuel rods in each fuel assembly are replaced by a square tube for the boron steel spheres used for long term shut down. The fuel power density is less than two thirds that of a modern BWR and about half that of a modern PWR. This low power density results in very low fuel and cladding - temperatures, thereby reducing the frequency of cladding defects as well as the release of fission products in case of their occurrence. Core flux distribution control and burn up compensation are achieved by means of gadolinium in the fuel and by shuffling of fuel regions similar to PWR practice. Reactivity control is by means of boric acid concentration adjustment only and there are no mechanical control roth However, for long term shut down boron steel spheres can be dropped by means of gravity to a position inside the core. 6 PAGENO="1097" 1093 REACTOR POOL AND INTERNALS it!!! /1 lint: I u/ni liii ten! .iphere.c / hitnal IV!!!! lilT/U! P,sun.seil CuIUI! I/il ..... :`Iagi!:ttte./ IT/V lIT/TO!! it!.!! yl/lere! . P!CSt!('T!tt! (OULI!u tint!. Pres!1esvi!!!/ tendoni / / I? noel/i, iei 01 J/~ liii 1!! `11111 eli Clt/!lti(!ll /l(!!t (/1(1/1 I Ott!.! gui mi!' MU//i ClTi1!lallOt! I/O!! inlet 7 PAGENO="1098" 312 Reactivity control system 313 Main circulation system 314 Pressure relief system 315 Reactor water clean up system 317 Boric acid and clean water make up system 318 Gas lock system 324 Concrete vessel water clean up system 326 Controlled drainage system 329 Hydraulic system for mechanical absorbers 342 Active waste system 345 Controlled area floor drainage system 348 Recombination system 411 Divtrict heating system 421 Intermediate cfrculation system 711 Cooling tower 721 Residual heat removal system 724 Component cooling system 742 Reactor cavern ventilation system 766 Process heating system 767 Ground water drainage system 1094 MAIN FLOW DIAGRAM 8 PAGENO="1099" 1095 9 PAGENO="1100" 1096 SAFETY FEATURES Fast shut doivn by main circulation pump trio Inherent shut down by venturi tube cavitation REACTOR SHUT DOWN Reactor shut down can be accomplished in four different ways. During normal operation, mixing of the cold highly borated pool water and the warm low-boron coolant is prevented by a gas bubble in the reactor vessel above the core. Reactor power controland normal shut down is by means of adjustment of boric acid concentration in the coolant. The gas bubble is kept in place by the pressure drop across the core existing as a result of the coolant circulation. A decrease in circulation rate, e.g. due to run down of the pumps upon loss of power supply, will decrease the core pressure drop as well as the height of the gas bubble. The corresponding displaced gas volume is replaced by cold highly borated pool water and the reactor is shut down. Depressurization, loss of heat sink, or excess reactor power which also may endanger the adequate cooling of the core, will initiate reactor shut down in the same way as pump run down. A flow limiter has been included in the primary circuit for this purpose. This consists of a set of parallel venturi tubes, where steam formation accompanied by increased pressure drop and decreased flow occurs before steam formation starts in the core. Thus there is inherent safety built into the system against the consequences of incidents that could potentially endanger core cooling. Automatic long term shut down is achieved by dropping boron steel spheres by gravity to positions inside the fuel assemblies. Normal shut down by boric acid injection Long term shut down by boron steel spheres 10 PAGENO="1101" 1097 REACTOR CORE COOLING The core is permanently connected to three separate coolant circuits, namely the two primary circuits, through which heat is extracted to the district heating grid during normal operation as well as a natural circulation circuit connecting it to the concrete pool of borated cold water. There are no valves or other mechanical structures in any of the circuits. During normal operation the reactor coolant is separated from the pool water by a gas bubble above the core. Following normal reactor shut down, the residual heat is continuously absorbed by the district heating grid through the primary coolant circuits. If the reactor coolant pumps trip, the gas bubble disappears altogether from above the core and the core is shut down and cooled ultimately via natural circulation to the pool water. Loss of cooling water from the pooi is impossible because the reactor is situated in the lowest region of a leak tight rock chamber. Long term cooling of the pool water after shut down is by means of a closed natural circulation cooling system that dissipates decay heat to ambient air via a cooling tower. The pool will be kept at 95°C or below for an unlimited time without further action. Emergency power is not needed nor is there need for any operator action. Long term residual heat removal to cooling tower Normal residual heat removal to district heating grid Inherent residual heat removal to pool water 11 PAGENO="1102" = 1. Tunnel entrance 2. Ventilation stack 3. Main entrance 4. Administration building, md. control room and conventional equipment The reactor, the primary cooling circuit and the reactor auxiliary systems are located in an underground rock cavern. The secondary heat exchangers connected to the district heating grid and all conventional plant auxiliary systems are placed in a surface building~ In the general case, a concrete building could serve as an underground reactor containment. In the special case of good Scandinavian rock a blasted chamber subsequently injected with cement is sufficiently leak tight to serve as reactor containment without further sealing arrangements. The underground ventilation system needs no emergency filters. In case of an emergency it is simply shut down and the system is closed by means of automatic valves in the inlet and outlet ducts. Activity release to the environment will be extremely low. 1098 STATION LAYOUT 5. Cooling tower 6. Communication shaft 7. Reactor hail 8. Primary heat exchangers 9. Reactor pool 10. Vessel lid during refuelling 11. Fuel cask pool 12. Fuel handling machine 13. Air lock 14. Transport tunnel 15. Auxiliary system cavern 16. Electrical system cavern 12 PAGENO="1103" 1099 ENVIRONMENTAL EFFECTS The SECURE system represents a liquid radwaste. Radioactive drainage and municipal heat supply plant with negligible leakage water from the reactor systems are pollution. Waste heat is insignificant, there is collected, treated and reused as make up water no smoke, gaseous radioactivity release causes to the reactor again. Spent ion exchange resins less than one thousandth of the dose due to etc. are taken to a central plant at a nuclear natural backgroundradiation, and there is no power plant facility. 1 rui~prttt iii 1 ft ~h tnt! punt In.!. nc! Irtiupt rt~ pLtil tn ~ Iutnr'e rc~tn. nt a-tn a t~tc RtIcasc. tm ii fr )tfl . ~ttt Itt tUfl tack cs I ttttttrtI ltt-Itrtttttttl tttI_~ttttt it. (a t'IStfl flit fl, )~I~' (t) I ~ ~ ~`t,1ttcii listI 2~(ftiliit ~~(ili(t Sttlphttt \it!c~ 11)')....! l~~' 2ihh `llrtt'rn t'~ttk', tt't llttt~ nlt'tttl'. Itt .5) ~ EII7~7~ SECURE nuclear district heating plant Fossil -fitelled district heating jilant 13 PAGENO="1104" 1100 MAIN DATA GENERAL Reactor power MW(th) 200 Reactor outlet temperature °C 115 Reactor inlet temperature °C 90 Reactor pressure MPa 0.7 Core circulation flow kg/s 1 900 District heating outlet temp °C 95 District heating inlet temp °C 60 District heating circ. flow kg/s 1 360 CORE Number of fuel assemblies 144 Fuel weight total tons U 13 Active core height mm 1 970 Power density in fuel W/g U 15 Average heat flux W/cm2 30 Max heat flux W/cm2 70 Max linear heat rating W/cm 270 Mm margin subcooled boiling °C 25 Number of orifice zones 4 Enrichment, equilibrium % 2.58 Burn up. equilibrium MWd/ton U 22 000 Number of control rods 0 FUEL Number of fuel rods 60 Fuel length mm 1 970 Fuel rod outer diameter mm 12.25 Cladding thickness mm 0.8 Fuel rod pitch mm 15.0 * cladding material Zr'2 Average fuel temperature oC 370 BUILDINGS Underground caverns m3 84 000 Surface building m3 28 000 14 PAGENO="1105" 1101 1185C1236)(1~121737G219)PD 0~/07/79 1234 Telegram IWABIO ICS IPMIIH~ IISS CY IISS~M ITT 07 1234 PMS FFICE BUILDING WASHINGTON DC AWN699 VIA ITT ITB167 1GT6532 DU 532 USWA Co SWSM 085 C VAESTERAS 85/81 7 1657 PAGE 1/50 COMMITTEE ON SCIENCE AND TECHNOLOGY C U.S. HOUSE OF REPRESENTATIVES SUITE 2321 RAYBURN HOUSE OFFICE BUILDING WASHINGTON/DC(20525) CONGRESSMAN MIKE MCCORMACK CHAIRMAN SUBCOMMITTEE ON ENERGY RE EARCH AND PRODUCTION THANK YOU FOR YOUR LETTER OF JUNE 19 WITH QUESTIONS RELATING TO YOUR MAY 24 HEARING. * I DIT NOT RECEIVE THIS LETTER UNTIL YESTERDAY COL WASHINGTONDC(20515) 2321 19 24 SF-1201 (R5-6~) ~rn ~ Telegram C TGT6532 COMMITTEE ON SCIENCE PAGE 2/31 AUGUST 6, DUE TO VACATIONS. I AM SORRY FOR THE DELAY HOWEVER I SHALL SEND RESPONSES TO YGURQiJEST IONS BY AIR MAIL AS SOON AS POSSIBLE C SINCERELY INGMAR TIREN ASEAATOM SWEDEN R~CE1VED AUG 71979 S COMMITTEE ON SCIENCE AND TECHNOLOGY 48-721 0 - 79 - 70 (S CS C. C C PAGENO="1106" 1102 AS EA-ATOM Mr I Tirén, (021) 106013 1979-08-17 T/lT Congressman Mike McCormack Chairman, Subcommittee on Energy Research and Production U.S. House of Representatives WASHINGTON, D.C. Dear Congressman McCormack: Please, find enclosed my responses to questions No 5, 6, 9, and 10 addressed to me upon your May 24 hearing. I hope they will be of some use to your Committee. If you have additional questions with respect to my responses I shall be glad to try to furnish explanations and details. Yours sincerely, AKTIEBOLAGET ASEA-ATOM Technical Department Special Assignments ~A,t G~4 Ing*r Tirén End.: Response to questionnaire Description of BWR simulator (3 copies) Description of activities of the Nuclear Power Training Center (1 copy) S PAGENO="1107" 1103 Responses to questions from May 24, 1979 Hearing on Nuclear Power Plant Safety by Ingmar Tirén, ASEA-ATOM, Sweden ~Swede~~g~thefuture use of coal There are no firm projects for the future extended use of coal in Sweden. These plans depend on the outcome of the referendum on nuclear power which is going to take place next year and which was triggered by the TMI incident. However, there are many speculations and preliminary plans for the extended use of coal, for heating purposes as well as for the generation of electricity. Such preliminary plans are made within the big utilities such as the Swedish State Power Board and the South Swedish Power Co Ltd as well as by local communities. In several cases, when utilities have made public their plans for the localization of a coal plant at a specific site, there have been local protests and misgivings about the environmbntal effects of the plant. Utilities, however, look at coal as a means of obtaining an alternative source of energy by the end of the 1980's for the purpose of diversification. The question is: Alternative to what? Sweden possesses no significant coal doposits of her own. - An industry group has proposed the formation of an organization for the centralized import of coal to Sweden. An interesting question on our part in this conjunction is whether the U.S. will he willing and roady to export coal to Sweden. A kind of tentative answer to your cuestiun can be given by reference to the Energy Proposition by the Swedish Government of March, 1979. According to this official government policy document the Minister of Industry finds the increased use of coal to be an urgent means to reduce our dependence on oil. The Minister believes that it is possible to increase the present coal-based genera- tion capacity of about 20 TWh to a level of 45-70 TWh by the year 1990. With regard to the generation of electricity the Minister indicates an aim of employing coal as a fuel together with the introduction of new sources such as wind (!), chip and peat. Today, coal makes no significant contribution to electric energy generation in Sweden. By the year 1990, according to the aim indicated by the Government, 3-7 TWh should be ~enerated by coal. However, in this figure some contributions from chip and peat are included. This range of figures should be compared with the projected figure of some 140 TWh of totally ~nerated electric energy in 1990, today's figure being about 90 TWh. I believe additional questions in this matter could best be handled by the Swedish Embassy in Washington. PAGENO="1108" 1104 6 Swedish program for training nuclear pp~r plant operators This question is somewhat difficult to respond to for several reasons. The Swedish Nuclear Inspecto- rate have delegated much of the responsibility for operator training to the utilities, and somewhat different procedures and practices are used by the three Swedish utilities. There is, today, no formal "operator's license" required by the Inspectorate. Furthermore, the matters of operator training is in a state of development, and a good deal of modification, in principle as well as in practice, may be expected as a result of the TMI incident. The Inspectorate is expected to surveil and follow up more closely the competence of the personnel engaged. There are several items covered by the term "operator training". An important item is training of operators and other personnel during plant commissioning and start-up in order for the utility to take over operations from the supplier. In this phase ASEA- ATOM's personnel play an important role as instruc- tors. However, this item will not be further discussed here. There are several categories of personnel involved in the operation of a nuclear power plant. The persons who are in the most close contact with the process form, in a Swedish plant, a "shift toam". This team normally consists of - the shift engineer immediately responsible for operations, - the control room engineer acting as reactor operator, - the control room technician acting as turbo- generator operator, - two plant technicians. These are the categories of persons whose training will be described briefly in the subsequence. Upon the occurrence of an abnormal situation which the shift engineer feels he cannot handle conclusively by himself he shall call the attention of an "engineer in charge" who shall be available (on telephone) around the clock and shall be able to reach the plant within half an hour. This is a senior person in managing position, whose education and training is not described here. Neither will the education and status of the plant management be dealt with. PAGENO="1109" 1105 The following account is divided in three sections dealing with - recruitment of personnel, - training of personnel, - tho Nuclear Power Training Center at Studevik. Such of the information covered by the first two of these sections has been obtained from a consultant firm which i.s presently engaged by the Swedish Nuclear Power Inspectorate in a review and assessment of the recruitment and education of nuclear plant operators. Further details, especially with regard to further modifications of the items involved, may he obtained via the NRC under the current NRC--Swedish Inspectorate Agreement. Recruitment of Noel ear Powar Plant Personnel The three Swadish nuclear utilities have set up similar requircoonts on persons to be recruited for duties within a nuclear power plant in general, and in the control room in particular. Differences in emphasis and practices exist, however. The following account of required qualifications applies to the Rinyhals plant operated by the Swedish State Power Board. This site includes one BWR and one PBR plant in operation, and two more PWRs yet to be taken into operation. For the employment of a shift engineer naval engineers or college-graduated mechanical engineers are often recruited. These persons are required to have substantial practical experience such as seven years of practice of the operation of a power plant or a similar industrial process. They must have some experience in superv~s1ng capacities and shall also have practical experience from employnent as a control room engineer. The control room engineer is required to have a similar education as the shift engineer. With PAGENO="1110" 1106 respect to practical capon enco a five year record free the ooorat.ion of a power plant or similar process is considered necessary. He should also have some experience in a supervising capacity. The control room technic n, who is to be responsible Per the operation of the tu:-ho--uenerator should have an education of a technician or an engine operator. Yore teportant is his practical oxperieece that ahcnld he adapted to his duties end nheeld ce:priso a period of 3-5 years. Similar recruitment qoide] inns exist for the plant technician although Toss exp~rionco is rejuired. The internal education and training of these persons, once osplcyed by the utility, is adapted to their backgrounds. The in-plant training and other further courses given to the technicians and op ators is stressed by the utilities as an essential portion of the efforts race To strengthen and cintain their cc:npctence. The South Swedish Power Co observes that, in practice, most technici ens actually employed hove in fact a college degree in engineering. Also, the nuloynent of the core qualified categories of person ci, i.e. cpnrators and shift engineers, is To a nat eLect ha sod on the internal promotion of eapnnicnced Technicians, ahnr than the recruiting of nw c-eployees free the outside. Furthereorf, west censors recruited for control room duties fun the outside have a] ready provious experience from the eperateon of a nuclear rector. In this respect tha comparat ively I argo numhnr of research reactors operated at Stu]evi k during the 1960's have established a qeon t~is for the recru itmnnt of nuclear power ci ent operators. ci hurl ear Power Plant Personnel ho mining tnrocedore of plant operators and other p1 ant personnel differs socket among the various utilities. The follcwing short description refers to conditions at the ilereetlick site involving tao units oeratod by the South Swedish Power Ce Ltd. However, the other utilities employ similar training proidirns. Newly recruited plant technicians receive basic training and cocat~on involving scvnral different items After two days of inC:roductory information the technician works with a shift team for 1-3 months and is then given a five weeks' basic course involving two weeks on nuclear reactor physics and radiation physics end Three weeks en nuclear ~ow0r engineering. The newly recruited techn reran is alne made famil far with other activities within the plant by way of PAGENO="1111" 1107 participating as observer of work done in thor groups during two weeks. Upon the completion of the basic course a 16 weeks' course in plant enignooring follows. This course involves the famil:iarization of the technician with plant systems hasod on simplified systems descrip- tions and drawings. During 12 of the 16 weeks this training is based on self-tuition as an essential moans of training and is conducted in parallel with the technician's normal work on a shift basis. During this course there are four written examinations Further education of diant technicians is organized in the form of two courses. This education is given to four technicians at a time who, during the courses, continue to participate in the normal activities of their shift teams. Approximately `50% of the course is based on self-tuition with one or two reviews conducted by a teacher each week. The first of these courses comprises mathematics and physics, nuclear reactor physics, radiation physics and nuclear engineering. The course appears to involve a 6 weeks' period. The other course involves plant engineering and comprises 12 weeks, the course being conducted by a teacher during one third of the time. The content of this course comprises syst:eas descriptions, process drawings and descriptions of integrated plant function. The purpose of this course is to give the technician a comprehensive eccount of these iteds that are necessary to comprehend and he familiar with for a person working in the plant control room. Technic ices to be~pre~notod tocontrol room duties are given additional basic education comprising - service in the control room for 2-4 weeks, - basic 5 weeks' course at the BWR simulator at Studsvik, - a practice-oriented one week course in electric engineering. The simulator course at Studsvik is worthy of some comments. During the first three weeks of this course there are lessons conducted by teachers, working groups, exercises, and demonstrations in the control room of the simulator conducted by instructors. The `two last weeks of the course are devoted to exercises in the control room of the simulator and follow-ups of accomplished simulator runs. PAGENO="1112" 1108 A written examination is given at the end of the third week of the course. The goal of this course is that the trainee shall be able to perform the following tasks on the BWR simulator: - Nuclear heating of the reactor from cold shut- down, synchronizing and loading of the turbo- generator, Power operation and pcwer reduction and cooling to a cold shut-down condition, - Relevant and correct checks and actions in a number of simulated abnormal situations. Some 30 instructor-conducted lessons are included in the course. A scope of 100 hours of simulator time is shared between demonstrations, criticality runs by the trainee, steady power operation, and training with regard to malfunctions. Re~Lra4g4p~ is given by annual retraining coursos comprising one week's training at the Nuclear Power Training Center at Studsvik including simulator training. These courses are given to the control room personnel jointly, i.e. to the shift engineer, the control room engineer, and the control room technician who normally cooperate in a shift teen. Other courses given end conducted by the utilities for the training of various categories of plant personnel include: - Training in rescue-duties, including fire protect ion, - Reviews of Technical Specifications for Plant Operation, - Review of reactor core operation and surveillance, - Supervisor courses, - Training in the operation of the fuel loading machine, - ENR technology courses, - etc. Nuclear oa'er Ta~ nmng Center In close association with the Studsvik nuclear research centre the Nuclear Power Training Center AKU, was established in 1972. This center is jointly owned by the three Swedish nuclear utilities, the Swedish State Power Board, Oskarshaens Power Group, and the South Sac-dish Power Co Ltd. PAGENO="1113" 1109 The key facility of AKU is the BWR/PWR simulator which comprises faithful replicas of the control rooms of the llarsehUck 1 BWR plant and the Ringhals 3 PKR plant. As a supplement to this most important training facility AKU, often in cooperation with the Studsvik Research Centre, offers courses in a variety of subjects such as mathematics, physics, nuclear reactor- and health physics, and nuclear power technology. Separate descriptions of the simulator and AKU activities are given in the attached brochures. PAGENO="1114" 1110 9 Significant differences in the control, instrumentation and monitoring systems in Sweden and the U.S. regarding ppwer plants _______________________________ ______ A review of control, instrumentation and monitoring systems for nuclear power plants reveals few principal or other more general differences between U.S. and Swedish practices in this area. This review has been focused on safety-related systems. In the area of equipment identified as having no bearing on safety there may be differences not discovered in this review. The fact that the safety-related systems are designed similarly in the U.S. and in Sweden is based on the extensive use, in Sweden, of U.S. rules, regulatiuns and guidelines for the design of safety- related systems. Furthermore, the standards established by the U.S. Institute of Electrical and Electronics Engineers (IEEE) are also employed to a great extent in Swedish nuclear plants, in the case of safety- related equipment. It is believed that the Swedish 30-minute rule described in response to your question No 1 has resulted in a somewhat more extensive use of automatic actuation of safety-related systems in Swedish plants than in U.S. plants. There are also several differences in detail. For example differences exist between U.S. and Swedish EWE plants with regard to automatic means for the isolation of the reactor containment. A significant difference with a possible hearing on the Three Nile Island incident is that, in Swedish tWR plants, the reactor containment is isolated upon the automatic actuation of signals indicating high tc-mserature inside containment, as well as upon high pressure signals. Thus we do not rely on a high pressure condition alone. In Swedish BWR plants there are permanently installed systems for the rece~nhination of hydrogen formed within containment in abnormal situation. These recombination systems are installed at each unit and are thus not shared between several units. In the Forsnork 1 plant (contracted in 1972) and later Swedish EWE plants the recoi~bination system is made up of two redundant subsystems in accordance with the requirements of the USNRC Regulatory Guide 1.7 (first issued by the USAEC as a Safety Guide in 1971). - From accounts relating to the TEl incident it appears that the same previsions may not have been made in some U.S. plants. PAGENO="1115" 1111 10 In conjunction with the TMI incident our experts are somewhat puzzled on the question of the closed valves in the auxiliary feed water system. From accounts given it appears that these valves could he opened or closed by remote actuation, i.e. by the maneuvering of switches (or similar devices) in the control room. Assuming this to be true, a significantly different situation would apply to Swedish OUR plants: Upon the automatic actuation of the auxiliary feed water system to start ~.utor tic and ever-riding si9nal would aisobe_given to the valves 1oppen. So these valves would be opened even if they had previously boon closed by maneuvering in the control room. The only instance in which valves in a safety- related system (such as the auxiliary feed water system) would not be automatically geared to the required position for safety action would apply to such service valvesthat can only be maneuvered locally by a hand wheel. Such valves are avoided as such as possible, however. If they have to be used, they are required to he locked in the safe position. PAGENO="1116" 1112 11 10 Differences in the educational reuuirc-ments of d~ J2pwer 21ant_g~erator~~~ An accurate response to this question requires a thorough analysis of the educational require- ments of the nuclear authorities and utilities in both countries. To my knowledge, no such analysis has been undertaken in Sweden. A person within the Swedish Nuclear Power Inspecto- rate staff who is engaged in educational matters has expressed the opinion that the requirements in the U.S. and in Sweden are roughly equivalent, although it is believed that these requirements are sore formalized in the U.S.A. As a basis for this opinion he refers to statements given by Swedish PNR operators who have been trained in the United States. A description of educational requirements and practices in Sweden is given in response to item 6 of your questionnaire. On the basis of this information I hope that your own experts may be able to draw some conclusions with regard to the present item. PAGENO="1117" 1113 Kämkraftskolán Nuclear PowerTraining Center --~ai~J ~ __ ~t7~ PAGENO="1118" AKU svarar for vidareutbildning av kSrnkraftverkens driftpersonai. Det tIter vid Klrnkraftskolan I Studsvik, strax utanfOr Nykoping. HIs harman byggt upp en simulatoranllggning for att under realistiska fOrhAlian- den trIna och utbilda driftpersonal. AKU utarbetar Iven laromedelapaket fOr sjalvstudier vid de olika karnkraftverken. Klrnkraftskolan har ett tiotal anstIflda, vilka utformar kurasnaterialet, instruerar eleverna och skOter simula- torn. Nuclear Power Training Center with simulators AB Karnkraftutbildning, AKIJ was established in 1972 by Vattenfail (the Swedish State Power Board), 0KG (Oskarshamns Power Group) and Sydkraft (the South Swedish Power Co Ltd.). AKU offers services in training of the operating per- sonnel at nuclear power plants. The company has built the Nuclear Power Training Center at Studsvik, about 90 kilometers south of Stockholm. The main feature of the Training Center is a large simulator plant for training and education of operating personnel during realistic circumstances. AKU also produces training materials for use at nuclear power stations. The training center has twelve employees who com- pose the training packages, instruct the trainees and operate the simulator. 1114 Kärnkraftskola med simulator AB Karnkraftutbildning, AKU, bildades 1972 av Vattenfall, Oskarshamnsverkets Kraftgrupp och Syd. kraft. PAGENO="1119" 1115 Kompletterande utbildning Bakgrunden till satsningen pA ett simulerat kraftverk är att tiden fOr idrifttagning av karnkraftverk blir allt kortare fOr varje nyu aggregat. Korta prov- och av- stallningstider betyder att traningsmOjligheterna fOr- samras fOr personalen. DärfOr blir kärnkraftverks- simulatorn ett viktigt komplement till den standiga utbildning och Atertraning som driftpersonalen genom- gAr. Supplementary training The motives for building a power plant simulator are that the time for start up of power plants tends to be shorter for each new unite. Short commissioning periods as well as short shut down times give the per- sosnel small possibilities for training. Therefore the nuclear power training simulator will be an important complement to the continuous instruction and retrain- ing which the shift personnel receive on the job. 1. Kontrollrum BWR (Barseback 1) Control room BWR 2. Kontrollrum PWR (Ringhals 3) Control room PWR 3. Instruktorsrum Instructor's room 4. Dator Computer PAGENO="1120" Tvá stags kdrnkraftverk, BWR och PWR Simulatorn bestIr av tvl kompletta kontroUrum med instrumenteringarna kopplade till en gemensam dator- anldggning. Det ena lr en kopia av kontrolirummet i Barsebacks- verkets fOrsta aggregat, vilket Ir en BWR (kokarreaktor) med en turbin. Det andra är en kopia av kontrollrum- met i Ringhalsverkets tredje aggregat, en PWR (tryck- vattenreaktor) med tvl turbiner. Kontrollrummen kan dock inte vera inkopplade samtidigt utan mIste an- vIndas var for sig. De kIrnkraftverk som nu finns eller planeras i Sverige är antinges av typen BWR eller PWR. All driftpersonal vid vIra kdrnkraftverk kan ddrfOr trdnas i simulatorn. BWR-stimulatorn anvandes första gIngen 1974. PWR- simulatorn beraknas bli fardig 1977. Unika traningsmOjligheter Berakningsdelen av simulatorn utgOrs av en dator. Den her programmerats med matematiska modeller av BWR- resp PWR-stationen. En mindre dator skOter hante- ringen av signalerna mellan kontrollrummet och berak- ningsdatorn. Vane kontrollutrustning omfattar mer In 600 visarinstrument, 5 000 lampindikeringar och 2 500 tryckknappar. PS instrumenten och indikeringarna visas det aktuella tillstlndet i det simulerade kraftverket. Eleven kan silly styra forloppen p1 samma sltt som i kraftverket. Realismen her drivits 51 llngt att eleven upplever simu- latorn sons en verklig station. Aven ljudeffekter finns med. FOr att Ova formtgan att uppfatta olika tänkbara driftsituationer efterliknas mInga driftstorningar med simulatorn. Forloppen ken kOras lSngsamt och stannas helt. Det ger eleven tid att studera tilistlnden. När simulatorn sedan körs normalt ken eleven llttare fOlja upp handelseutvecklingen. 1116 ; ~ PAGENO="1121" 48-721 0 - 79 - 71 1117 Two kinds of power plants, BWR and PWR The simulator cossists of two complete control rooms with the instruments connected to a central computer system. One control room is a copy of the control room in the first unit at Barseback, which is a BWR (Boiling Water Reactor) with one turbine. The other control room will be a copy of the third unit at Ringhals, a PWR (Pressurized Water Reactor) with two turbises. The control rooms can only be used one at a time. The power plants which are built or are planned in Sweden are either of the BWR- or PWR-type. The operating personnel at our power plants will be trained at the simulator. The BWR-simulator was used for the first time in November 1974. The PWR-simulator is calculated to be ready in 1977. Unique possibilities for training The plant process simulation is made by a medium size digital computer. It has been programmed with mathematical models from both the BWR- and the PWR-stations. A smaller computer takes care of the handling of signals between the control room and the central computer. Each control equipment con- sists of more than 600 isstrumentn, 5.000 lamps and 2.500 pushbuttoms. The actual status of the simulated power plant is shown on the instruments and the lamp signals. The trainee can himself operate the simulator in the name way an the power plant. The realism has been driven no far that the trainee experiences the simulator as a real plant. Even sound effects are simulated. In order to make the trainee understand different possible operating situations, many malfunctions are imitated with the simulator. The sequences can be simulated very slowly and be stopped completely. That given the trainee time to study what has happened. When the simulator then in operated at normal speed the trainee can batter follow what han actually happened. PAGENO="1122" C cc PAGENO="1123" 1119 btandlga Ovnlngar Simulatorutbildning av driftpersonal sker i grupper om 2-4 personer. Vane grupp besOker Kärnkraftskolan atskilliga gAnger fOr att repetera tidigare Ovningar och fOr att trSnas i nya stOrningssituationer. Det gor att personalen kan hAlla zig i topptnim i den rutinniassiga dniften av karnkraftstationerna. Training and retraining The training of operating personnel at the simulator takes place in groups of 2-4 persons. Each group visits the Training Center many times to repeat what they have learnt before and to be trained with new malfunctions. That aids the personnel in maintaining high ability and knowledge during the routine operating of the power plants. Data om datorn RANK XEROX SIGMA 8 - ordlangd 32 bitar - cykeltid 0.9 ps - ktrnminne 64 k - trumminne 1.5 M PDP 11/05 - ordlangd 16 bitar - cykeltid 1 ps - karnminne 24 k Facts of the computers RANK XEROX SIGMA 8 - word length 32 bits - cycle time 0.9 Ps - core memory 64k - drum memory 1.5 M PDP 11/05 - word length 16 bits - cycle time 1 ps - core memory 24 k Laromedeispaket Driftpersonalens teoretiska grundutbildning sker vid kraftstationerna med hjalp av AKUs sjalvinstruerande lAromedel. Genom omsorgsfull utformning av text, ijud och bild har erforderlig l8raninsats reducerats till ett minimum. Kursen omfattar: * Matematik * Fysik * Reaktor- och StrAlningsfysik * Kärnkraftteknik Dc tvA sistnämnda delarna finns Even i fOrkortade versioner. LEromedlet har producerats av AKU p8 faktaunderlag frAn experter mom kraftindustrin. Flera hundra lEro- medeispaket Er utplacerade vid kErnkraftstationerna. Genom AKU frasntas aven andra lEromedel for anvgnd- sing av kErnkraftindustrin i olika sammasthang. Training package The theoretic fundamental education of the operating personnel takes place at the power plants with help of AKU's self instructive training package. Through care- ful arrangement of text, sound and pictures, it has been possible to reduce the need of teachers to a minimum. The training package contains four volumes: * Mathematics * Physics * Reactor. and Health Physics * Nuclear Power Technology The two last mentioned are also produced in shorter versions. The training package has been produced by AKU based on materials presented by experts in the power industry. Hundreds of these packages have been distributed to the power stations. AKU also produces other programs for use by the nuclear power industry. PAGENO="1124" 1120 AS KARNXRAFFUTBILDNIMG Studsvik Fack S-611 01 NYKOPING SWEDEN Te10155-60470 Telex 640 l3atergs Iay~t~~LAI ~ ~ PAGENO="1125" 1121 Full-scale nuclear power plant training simulator Bi Reprint from ASEA JOURNAL 1978 VOLUME 51 NO. 5 PAGENO="1126" 1122 Full-scale nuclear power plant training simulator Bi Kenneth Randén, ABASEA-ATOM Abe RulIgIrd, ASEA AB Plant Engineering Division tJ.D.C. 621311.25 :621.039 :371693.4 ASEA Org. 7211, 973 An account is given of the full-scale nuclear power plant training simulator supplied by ASEA to AB KSrokraftut- bildning (AKU Nuclear Posver Training Center), with special reference en the scope of the simulator, the hardsvare, modelling techniques, genera) softsvare principles and project implementation. cold shutdown condition, heat the systems to the operating temperatures, start the turbine, syocheonise the generator to the netsvork, in crease the output to 100 per cent and return the posver station to the cold shoe- doom condition. For all these routines the trainees follosv the same detailed operating procedures as used in the real nuclear power station. * During training sessions with the normal operating routines, the in- structor can introduce malfunctions of different degrees of complexity to give the trainee the opportunity both to reveal that a malfunction has nc- This article on the nuclear poorer plaot training simulator El discusses certain special technical questions in conjunction ss'ith the design and installation of the simulator. For a more general descrip- tion, reference should be made to the article "Nuclear posver plant training simulator" published in ASEA Journal 1977:1, pp. 20-21 and a p reseotalion of the project in the article "Nuclear poster plant training simulator for Swedish. ittilities" published in Nuclear Engineer. ing International, 1973:5, pp. 414-415. Scope of the simulator The simulator B1 is modelled on an actoal plant, the BarsebAck 1 Nuclear Poster Plane, svhich has an ASEA- ATOM BWR with an electrical output of 600 MW. For a simulator to be full. scale, it is necessary that: * Al) main systems in the nuclear power plant, i.e., reactor, turbine, generator ss-ith associated buses as svrll as plant auxiliary syste mu monitored and con- trolled front the control room are simulated (see Fig. 2) by means of mathematical ntodrls, svhich calculate chains of events in the different sys. * The simulator includes a replica of the control room of the poster plant represented in the simulator. * The working range of thr simulator is such that the operators from the control room in ehe simulator can stare up the "power station" from the Fig. 1. Hardware conliguralias ol the Bi simulator. Main compatet Sigma 8 PAGENO="1127" 1123 1-Lu I LJTLIJ'LLJ LIII _ Lu1- L Lu LJLE _ L~L Fig. 2. Systems simulated in the Bi simulator. curred and to take suitable measnees The architecture of the computer system to eliminate or reduce the effect of allocation of consmonication sigisals, tlte nralfunction on the operatiots of program functions, etc.) and detailed the power station, principles )svoed letsgth, floating arith. * The B! simitlaror incitrporates for mrtic, etc.) have proved to be highly this purpose about 100 niajor nual- suited for the tasks of the simulator. futtctions coveringass'idesprctrunt The calcuilatiuins nsade its advance of the such as cotstroller failitres, pipe leaks, necessary capacity of the systeiss turned pump failures, etc. In addition, it in- our to be valid doting the isoplrmen- corporatesa thousand or so simple tation of the peoject. plant failures such as stuck instru-. From the operational point of viess' metses, false alarm signals, etc., svhich the simulator is designed for a total life may be introduced at any time and of 80,000 ho ties ssith p reveti tise mainten- in different combinations during the ance of 4 hours per svcek. The simulator training sessions. cas be utsed cotsuiusueosly, except during the p reveit tive maintenatsce, and has been tutu in this matinee since the begin- ning of 1976 svith good experience of the availability. Up to nose this has been - I close to 100 p er cent. The design MTBF mu a or ar ware Mean Time Betsveen Failures) of 80 Fig. 1 shows the configuration of the hours has been achieved by a good simulator hardware, where the main margin. perfurmance figures of the equipment Very great importance has been at- have also been given. Figs. 3 to 5 illus- tached to the develupnuetst of efficirnt trate the actual hardware, namely the troubleshooting progrants as svell as to control room, I/O system and instructor' s ease of maintenance with good access cuesole, for servicing. A very high plant engineer- ing standard also contributes to the good results obtained. Mudriling techniques By niodelhing technique is meant the methud used for the mathematical de- scription of the posver station systems to be reproduced by the simulator. These mathematical descriptions subsequently form the basis of the programming of the simulator's computer equipment. The modelling techniques used for a few typical and important subsystems will be briefly described in the follosving. Core model The core model comprises four major building blocks, * The hydraulics model, which rep- resents the water/steam flow through the cute, upper plenum, downcomer, eecirculation pumps and lower pie. LIlil LII~Th :-~. 4 ~-LI] PAGENO="1128" also includes diesel-generator srts and gas turbines for emergency pusver, svhilr thr frequency and voltage of the external nrtsvork are represented by a simple model. A `dynamic model, based on a full a.c. load solution, is used. Individual loads, primarily pomp loads, are summed for each bus. The 30-bus nrtsvork is reduced to a 6-bus admittance matrix, svhich involves only the six generator General softsvare design principles The simulator softssare system com- prises three major blocks: * Plant models, svhich simulate the functioning of the various subsystems of the nuclear posver station, such as core, turbine and electrical system. * Instructor's system, ss-hich isasprcifio simstlator function and svhich enables the instructor easily to control and supervise the training in the simulator. * Front-end computer programs, vs-hich ensure that signals from the control room are fed to the model programs and that computed values are trans- mitted to the control-room instru- mentation and indicators. A goal daring the design of the soft- svare has been to apply as far as possible standard system softss'are (operating sys- Fig. 3. Conlrol room br lhn Bi simulalor. 1124 num, is based on conventional thermo- these~strms, e.g., valves, pumps, heat dynamic and hydraulic equations, exchangers, filters, arc individually rep- * The fuel model, which represents is resented so that the simulator represen- typical furl rod, svhere the rod is tation still be isomorphic svith the systems dis'ided into tsvu circular regions, is in the real plant. Pipe flo:v resistance is based on standard heat conduction, lumped svith the fluu~ rrsis~ncr in some equations for calculating the fuel suitably selected valve, `The model en- temperature. crises us inputs buundary p restore, in- * The nuclear model cunsists of tss'o , coming flosv and flu svrrsistance for parts: a point `kinetics model with each component. It then calculates the tsvo groups of delayed neutrons for pressure and flosv distribution in each calculating the nuclear power and a system. Pressure losses are generally as- three-dimensional "nodal model with tamed no be proportional to the square 120: nudes for simulating the posver of the flow. Temperature distributions distribution in three dimensions in in th essstems are obtained by using gen- the cure. The point kinetics modrl is real routines for heat evch angers and cal- used to calculate fast power changes culation of floss' miving in pipe branches. in conjunction svith, for example, reactor scram. During such `transients the posver distribution in the core isassc med to be constant during 1 intervals, which are the updating fee- Turbine nude! quency for the poster dsstrubutson in the there-dimensional nodal model. The tssrb:ne is represented by a three- This division of the model is a com- time-constant model (HP turbine, re- promise brtsvrrn the computing time heater and LP turbine). The model is assd the computing accsseac, svhich similar no that normally esed in posvrr gives the necessary rca lism in the system stability studies. simulator, also during manual control Anxili.ur'v electrical goner model Hydraulic ovatems strudel is ~e~t~?n g:rat derail on the con- A general hydraulic model is used to trol boards of the Bl simulator. About simulate a large no mber of hydraulic 30 buses on the 400 V level and above systems in the plant. The components in are individually modelled. The model ------`l ~-:::::::~:---: n I I PAGENO="1129" tems, compilers, etc.) and to perform as much as possible the programming in a high-level language (FORTRAN IV). It also proved possible to achieve this to a great extent, which has been one of the contributory reasons why the soft- ware design could take place within the given resource frameworks and only a few problems were encountered with the system software. In general all dynamic models, except for the electrical auxiliary power system, have been written in FORTRAN IV, which facilitates modification of the models in the future. All nsodels for the plant logic and the front-end computer programs have been written in assembly language. Anothtr design goal has been to rep- resent, whenever possible, plant func- tions by software rather than by tied- ware, i.e., all functional relationships have been calculated instead of, as in certain other simulators, being represented by components identical to those in the power station. Consequently, in the B1 simulator only the front of the control boards is identical with corresponding equipment in the power station. This principle has naturally resulted in a rather heavy load on the computer system On the other hand, a high degree of flexibility has been achieved with regard to modifications, which will be necessary to a certain extent in the future to adapt the simulator to modifications in the simulated nuclear power plant as well as to modifications required foe training reasons. This "software before hardware" principle has made it possible to represent a vast amount of simple plant failures, as mentioned earlier. The models calculating the responses of the plant systems to actions executed in the control room are divided into tsvo groups, svhich are eon through five times and once pee second, respectively. The software of the "fast group" remains resident in the core memory, svhile the other programs are stored on a disc memory and read into the core memory during execution. All such model pro- grams are processed in the central com- puter (type Sigma 8). The task of the frost-end computer (type POP-Il) is to administer the transfer of signals betsveen the control room and the centeal com- The front-end computer programs scan at a rate of about 10 cycles pee second the signals from pushbuttons and other controls in the control room and period- ically feed signals to instruments and indicators in the control room. The data transferred by the front-end computer in this way are stored in the data area of the Sigma 8 core memory, This data area constitutes the central data interface be- tween the plant models, the instructor's system and the front-end computer. In addition to its basic I/O functions, the front-rod computer programs handle cer- tutu alarm pattern modes, sorb as fast and slow flashing in the control room, ceetain simple plant failures and smoothing of signals prior to pteseo- tation on instruments in the control room. All these functions ssould otherwise has-c to be performed svith tome kind of hard- svare, e.g., loss-pass filters in each instro- most for the sigital sttsoothing fonction. Apart from the difficulties associated svith the designing of these filters, this woold have made the system less flexible. In addition to the plant models, the Sigma 0 corn potee contains the necessary softsvaee foe the instructor's system, svhich enables sIte instructor effectisely to con- trol and supervise the traioiog in the simulator. The insttrictoe communicates svith the simulator via a graphic display unit, svltich has a special input to the central computer, kept separara frotn the connection to the front-end computer. This ~~rrangrwent has proved to be prac- tical and efficient bath for the sofia-are develupmeot and for the running ef the simulator. Among the approximately 20 basic ft,uctions included in the itsstroc- tot's menu cats be meittiotsed the fol- losviag: * Initial condition, svhich allow-s the simulator to be started from any of 20 suitably selected standard initial conditions within the normal svorkiog range of the posver station. * Start of the simulation. * Freezing of the dynamic state ob- tained until a start or ness initial cundition is ordered. 1125 Fig. 4. Computer equipment and I/O system. PAGENO="1130" * Snapshot,. which means that an in- stantaneous picture of th estatus of the simulation is stored for later pre- sentation during the following up of the training session between the in- structor and she trainees. * Startlstop of simulated malfunctions. * Logging on line printer or magnetic tape of up to 20 parameters of in- Project implementation A full-scale simulator like the one desmibed in this article is an extremely complex and comprehensive system and the project implementation has also been affected by numerous problems, which could not he foreseen and eliminated in advance. Thanks to the system design and the flexibility of the hardsvare, bose- ever, the problems occurring could be overcome. The delivery, even though it n-as affected by some delays, enabled she customer, AB Kiirnkraftusbildning (AKU Nuclear Poster Training Center) so utilise the equipment for the planned training. This proved possible thanks to ~ the testing and commissioning in stages of rIse functions required for the training A special problem was the testing of certain malfunctions, sshich can be rep- resented in the simulator, because com- paratise data from nuclear poster stations in operation were not available. Another problem stan experieneed when modificarinns were introauced in the nuclear poster station after the simulator functions had been specified. Such modi- fications can naturally be introduced in the simulator software, but take their time. This has resulted in some delays in the original delivery schedule. Conclusion Finally, it should be stressed that a project of this size and complexity is specially helped by close co-operation betsveen the customer and the supplier during the development and delivery of the simulator. Such continuous co-oper- ation helps the customer during the take-over of the simulator since know- ledge of the system, its structure and functions is gradually and systematically built up within his orgunisotinn. 1126 Fig. 5. Inslruclors console for the Bi simulator. 6 PAGENO="1131" rn ~ D ~ CD --~.-~ -C ~CDCD-~ ~ -~ CD CD -1 ~ CD CD CD -~-OCD CD CD (*CDCD CD CD (~) DC -~ 0. 0 CD -~- 0 CD CD CD 0~ 1 CD -~ ~CJ)Z 9 ~:~h!~ j~ ~ ~ ~ PAGENO="1151" 1147 SUBCOUMITTEE ON ENERGY RESEARCH AND PRODUCTION QUESTIONS FROM MAY 24, 1979, HEARINGS ON NUCLEAR POWER PLANT SAFETY FOR ADMIRAL H.G. RICKOVER, USN, DIRECTOR OF NAVAL NUCLEAR PROPULSION PROGRAM. 1. In the testimony, both you and Dr. Low stressed the need for personal respon- sibility in the design, construction and operation of your systems. How can this be achieved in commercial nuclear power plants? 2. Should the control room operators be employed by the utility or by some other agsncy? 3. Discuss the need for a nuclear safety Czar" and the scope of his responsibility. 4. Discuss the benefits of standardizing the design of nuclear power plant control rooms and their instrumentation and display systems. 5. Describe how.the experience and approach of the Naval training programs can be applied to improving the training of commercial power plant operators. 6. Should there be a new and independent agency responsible for training nuclear power plant operators? What can DOE contribute? 7. In your testimony, you mentioned that naval reactors are designed to be in- herently stable under all "normal transient" conditions. Should this be a basic requirement for all commercial reactors? 8. Are there any reasons for not having direct reading instruments for all the most important parameters? Discuss the merits of a direct reading instrument for indicating the level in pressurizers. 9. Should all monitoring systems be such that they indicate that the control function has been performed, rather than that the command signal has been sent to the device in question? 10. How can a utility ensure that it retains a "long term or permanent staff"? How important is it to have permanent staff? . 11. Discuss the need for redundent systems in nuclear power plants. 12. What are the costs for training the various types of Navy nuclear propulsion operators and supervisors? 13. How can computers and microprocessors be used to assist in the normal opera- tion of nuclear power plants, and in operations under emergency conditions? PAGENO="1152" ;~ ~ DC ~~D( DC ~ ~-pLfl~-pCD~ ~< -4~OOCD~< -S ~ -C~ CD OC-P4C 0 o VCC+CD 0 -S +O~Cfl1 ~< OCD -1)0 o 0C*~0CDS CD (fl~~-1-P0 5 -CD0~<< -5< o 0 ~C+ CD(CD CD -0CD CD C~ 0~-~ 1\)VC o D(CDC. CD 050 CD CD 0 CD ~J 0 15C (1(5 CD 0 D o 0 CD(-P0 rP CD CDCD (fl5 CD-~ ~CD 000(0 Q CD CD CD0CD -J or)CD (0 DC -Cs DC 0 (~ o~. 01USD) ~+ CD CD ~ -~ 0 ~ Si) DC (0 C+ -s CD -<-1 o CD -or- 5CD0~ N) 05 01 OUS o C+ rP C~ cx A 0 C US 11(1 P1 P1> ~D `~flflJ~~J II PAGENO="1153" 1149 SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION HEARINGS ON NUCLEAR POWER PLANT SAFETY ADDITIONAL QUESTIONS FOR DR. G. M. LOW 1. Expand upon your comment that experienced control room operators should be used to assist in the design of the control room and the control room instrumentation. 2. In your testimony you mentioned that NASA did their own reviews and that there was "nobody looking over your shoulder". How could this be applied to the design, construction and operation of commercial nuclear power plants? 3. In the testimony, both you and Admiral Rickover stressed the need for personal responsibility in the design, construction and operation of your systems. How can this be achieved in commercial, nuclear power plants? 4. Expand upon your comment that in the NASA programs experienced operators assisted in writing the training programs. How would this be applied to commercial, nuclear power plants? 5. Should the control room operators be employed by the utility or by some other agency? 6. Should there be a Nuclear Safety Czar? 7. Would there be any benefit in standardizing the design of nuclear power plant control rooms, and their instrumentation and display systems? 8. Would it be reasonable to require that a utility be entirely responsible for the design, construction and operation of nuclear power plants? 9. Should there be a new and independent agency responsible for the training of nuclear power plant operators? 10. List your recommendations for the educational qualifications of nuclear power plant operators. PAGENO="1154" COMMITTEE ON SCIENCE AND TECHNOLOGY U.S. HOUSE OF REPRESENTATIVES SWTEZ3Z1 RAY URNHOAJ$EorncEeJI~NG WASHINGTON, DC. 20515 June 19, 1979 Dr. Ingemar Ti ren Manager Nuclear Safety and Licensing (ASEA-ATOM) P. 0. Box 53; S-72104 Vasteras, SWEDEN Dear Dr. Tiren: Thank you very much for attending our Subcommittee hearings on Nuclear Power Plant Safety. Your testimony was indeed very valuable and it was awfully kind of you to come all the way from Sweden to give the Sub- committee the benefit of your experience. During the hearings on May 24, 1979, you indicated that you may be able to provide the Subcomittee with responses to a number of questions, to- gether with other additional information. I have enclosed a list of questions and I would be grateful if you could find the time to respond to them. by July 13, 1979. On behalf of the Subcommittee, I want to thank you again for coming to Washington and for providing an invaluable contribution to our under- standing of nuclear power plant safety in terms of your own unique rational perspective. MM/wm MIKE McCORMAC Chairman, Subcommittee on Energy Research and Production 1150 Enclosure PAGENO="1155" 1151 SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION Questions from May 24, 1979, Hearings on Nuclear Power Plant Safety for Dr. Ingemar Tiren, Manager, Nuclear Safety and Licensing, ASEA - Atom, Vasteras, Sweden. 1. Please describe the `3D minute. rule that you mentioned in your testimony. 2. How does your N-2 rule jiffer from present U.S. practice. Can it be applied to U.S. nuclear power plants presently in operation? 3. Describe the `SECURE' reactor system in which a core melt is an "not a possible event." 4. Please send us a description of the "Shift Change Procedure" which is representative of present Swedish practice. 5. Please expand upon your comments regarding Sweden's plans for the future use of coal. 6. Describe the Swedish program for training nuclear power plant operators. 7. Would there be any benefit in having the assistance of experienced power plant operators during the design stages of control rooms and control panels? Is this done in Sweden? 8. Do you believe that it is reasonable for a utility to be entirely responsible for the design, construction and operation of nuclear power plants? 9. Describe any significant differences in the control, instrumentation and monitoring systems of Sweden and the U.S. regarding power plants. 10. Are there any significant differences in the educational requirements of Swedish and U.S. power plant operators? PAGENO="1156" 1152 SWEDISH EMBASSY ~~ESS :~:~~::~PE AVE N OFFICE OF SCIENCE AND TECHNOLOGY USA298 TELEPHONE (2oz~C.~I~C June 15, 1979 Congressman Mike NcCormack Chairman, Subcommittee on Energy Research and Production Committee on Science and Technology U.S. House of Representatives~ Suite 2321 Rayburn House Office Building Washington, D.C. 20515 Dear Congressman HcCormack: 13-9172 It was an honour for Dr. Tirén and myself to appear before your subcommittee on~prt~l 24, on your hearings about Nuclear Reactor SafetyY~~l_~ Dr. Tirén has asked me to transmit the attached supplemen- tary responses to questions raised by members of your subcommittee. These clarifications may, if you so wish be included for the record into the testimony. Sincerely yours, Q~L~ Lars G Larsson Attaché Science and Technology LGL/ms end. PAGENO="1157" 1153 Swedish Embassy Re Testimony before US House of Representatives, Committee on Science and Technology, Subcommittee on Energy Research and Production, May 24, 1979 by Dr. Ingmar Tirén, ABASEA-ATOM, Sweden tn response to questions during the testimony, please supplement Dr. Tirén's verbal presentation by the following comments. to Congressman Wydler on question regarding the use of check lists in Swedish nuclear plant operation: Swedish utIlity representative confirms that no formal check list is used at dayly take-over from one shift to another. The shift engineer keeps record of notable items. He passes on this information to the next shift together with an oral and informal exchange of information. The list of notable items is kept up to date by the shift engineer in charge. ~p~y to CongressmanErtel on question regarding the possibility of a release of contaminated water from the reactor containment to an auxiliary building in Swedish plants, assuming accident conditions similar to those that occured in TMI unit No. 2: This is a question related to design details. The design principle of any plant is to provide containment isolation whenever there is an indication of a risk for radioactive contamination of the athmosphere or the water inside containment. With regard to details, I can only reply with respect to the ASEA-ATOM boiling water reactor (BWR) plants. In these plants no transfer of water from the containment to an auxiliary building takes place during abnormal conditions. There are situations in which water is extracted from the containment pool by means of pumps located outside containment. However, in such situations the water is fed back into the reactor containment in a closed loop. In ASEA-ATOM plants the reactor containment is isolated upon the automatic actuation of signals indicating high pressure `or high temperature inside containment. Thus we do not rely on a high pressure condition only. PAGENO="1158" 0 CD CD `(